💾 Archived View for gemini.spam.works › mirrors › textfiles › magazines › EFF › eff505.law captured on 2022-06-12 at 11:33:58.
-=-=-=-=-=-=-
? Newsgroup: comp.org.eff.talk
? Message-ID: <1993Apr2.214920.10432@eff.org>
? Subject: EFFector Online 5.05
-==--==--==-<>-==--==--==-
In this issue:
Keys to Privacy in the Digital Information Age
What's Important About the Medphone Libel Case?
-==--==--==-<>-==--==--==-
Keys to Privacy in the Digital Information Age
by Jerry Berman and Daniel J. Weitzner
With dramatic increases in reliance on digital media for
communications, the need for comprehensive protection of privacy in
these media grows. For many reading this newsletter, the point may
seem trite, but the scope of the digital communications revolution (of
which we only stand at the very beginning), poses major new
challenges for those concerned about protecting communications
privacy. Communication carried on paper through the mail system,
or over the wire-based public telephone network, is relatively secure
from random intrusion by others. But the same communication
carried, for example, over a cellular or other wireless communication
system is vulnerable to being intercepted by anyone who has very
inexpensive, easy-to-obtain, scanning technology. If designed and
deployed properly, communications technology has the potential to
actually support and enhance the level of privacy that we all enjoy.
But if, in the design process, privacy concerns are slighted, whether
consciously or not, privacy may be compromised.
Public policy has a critical impact on the degree of privacy
protection afforded by the new communications systems now being
designed and deployed for public use. Two ongoing public policy
issues present the challenges of digital privacy protection in sharp
relief. In the first case, government policy seeks to limit the
introduction of robust encryption technologies. Motivated by
national security concerns, the National Security Agency is using
export control regulations to discourage the widespread foreign and
domestic adoption of strong encryption systems. The NSA's
reasoning is if uncrackable encryption is available, the NSA will be
powerless to intercept the communications of foreign espionage
agents operating in and around the United States. However, the
NSA's restriction on the use of powerful encryption systems limits
the ability of all who rely on electronic communication systems to
protect their privacy.
Second, on the domestic front, the FBI has proposed a
comprehensive licensing regime that would require all new
communications systems to be certified as "wire-tappable" before
their introduction into the market. This proposal threatens to force
the widespread use of communications systems that have "back
doors" in them that make them inherently insecure and to expand
the scope of the FBI's wiretapping authority to an unspecified degree.
Although these two proposals are now being pursued in independent
policy arenas, it is critical to view them together in order to
appreciate the full implications for privacy.
Encryption Policy
For the individual who relies on digital communications media,
reliable privacy protection cannot be achieved without the protection
of robust encryption technology. While legal restrictions on the use
of scanners or other technology that might facilitate such invasions of
privacy seem to be attractive preventative measures, these are not
lasting or comprehensive solutions. We should have a guarantee --
with physics and mathematics, not only with laws -- that we can
give ourselves real privacy of personal communications through
technical means. We already know how to do this, but we have not
made encryption technology widely available for public use because
of public policy barriers. The actual debate going on involves both
the National Security Agency and the National Institute of Standards
and Technology. They are in the process of deciding what version of
a particularly strong type of encryption system ought to be promoted
for public use. Called Public Key Encryption systems, these coding
systems derive their strength, in part, from the size of the ?key? used
to encrypt the message.
In examining discrete issues such as the desirability of various
cryptography standards, we take a comprehensive view of "digital
privacy" policy as a whole. Such a comprehensive view requires a
clear vision of the underlying civil liberties issues at stake: privacy
and free speech. It also requires looking beyond the cryptography
questions raised by many to include some of law enforcement's
recent concerns about the pace of digital infrastructure innovation.
For the sake of promoting innovation and protecting civil liberties,
we must also bear in mind the principle that computer security
policy is fundamentally a concern for domestic, civilian agencies.
Inasmuch as digital privacy policy has broad implications for
constitutional rights of free speech and privacy, these issues must be
explored and resolved in an open, civilian policy context. This
principle is clearly articulated in the Computer Security Act of 1987.
These questions are simply too important to be decided by the
national security establishment alone. The structure of the Act arose,
in significant part, from the concern that the national security
establishment was exercising undue control over the flow of public
information and the use of information technology. When
considering the law in 1986, the Congress asked the question,
"Whether it is proper for a super-secret agency [the NSA] that
operates without public scrutiny to involve itself in domestic
activities...?" The answer was a clear no, and the authority for
establishing computer security policy was vested in NIST (then the
National Bureau of Standards).
In this context, we need a robust public debate over our
government's continuing heavy-handed efforts to control
commercially developed cryptography. It is no secret that
throughout the cold war era, the Defense and State Departments and
the National Security Agency have used any and all means, including
threats of prosecution, control over research and denial of export
licenses, to prevent advanced secret coding capabilities from getting
into the hands of our adversaries. NSA does this to maximize its
ability to intercept and crack all international communications of
national security interest.
Now the Cold War is over, but the practice continues. In recent
years, Lotus, Microsoft, and others have developed or tried to
incorporate powerful encryption means into mass market software to
enhance the security and privacy of business, financial, and personal
communications. In an era of computer crime, sophisticated
surveillance technologies and industrial espionage, it is a laudable
goal.
Although NSA does not have the authority to interfere with
domestic distribution encryption systems, its licensing stranglehold
over foreign distribution has significant domestic consequences.
United States firms have been unable to sell competitive security and
privacy products in international markets. More important, because
the cost of producing two different products is often prohibitive, NSA
policy encourages firms to produce a single product for both
domestic and worldwide use, resulting in sub-standard privacy and
security for users both here and abroad.
While we all recognize that NSA has legitimate national security
concerns in the post cold war era, this is a seriously flawed process.
Foreign countries or entities who want to obtain advanced encryption
technology can purchase it through intermediaries in the United
States or from companies in a host of foreign countries who are not
subject to US export restrictions. By taking a page out of the
Emperor's New Clothes, NSA opts to act as if the process works by
continuing to block export.
In order to get some improvement in mass market encryption, the
computer industry had to resort to using the threat of legislation to
get NSA to engage in the negotiations that finally led NSA to agree to
expedited clearance for the export of encryption software of limited
key lengths. Still, all concede that the agreement does not go far
enough and that far more powerful products are commonly available
in the US. The remaining limits specifying maximum key lengths
offers little long-term security given advances in computer
processing power.
Does this kind of policy make any sense in the post Cold War era?
Mass market products offer limited security for our citizens.
Determined adversaries can obtain much more powerful products
from foreign countries or by purchasing it here in the US. Is the NSA
policy of slowing down the pace of encryption use by foreigners and
adversaries -- and there's some debate as to whether the NSA policy
really does slow down that pace -- any longer worth the significant
price we pay in terms of failing to meet our own communications
privacy and security needs? We don't think so.
FBI's Digital Telephony Proposal
The public policy debate on electronic privacy issues over the last
few years has demonstrated that a comprehensive approach to
digital privacy policy cannot be complete without examining both
questions regarding the availability of encryption technology and the
corresponding infrastructure issues, such as those raised by the FBI's
Digital Telephony Proposal.
Last year, the FBI first proposed a "Sense of the Congress"
resolution stating that communications firms and computer and
communications equipment manufacturers were obligated to provide
law enforcement access to the "plain text" of all voice, data and video
communications, including communications using software
encryption. The Electronic Frontier Foundation (EFF) played an
active and leading role both in opposing such a law and in seeking to
find more acceptable means for meeting legitimate law enforcement
needs. Because of our advocacy and coalition-building efforts with
communications and privacy groups, we were successful in
persuading Senate Judiciary Chairman Joseph Biden to remove the
Sense of the Congress Resolution from active consideration as part of
Omnibus crime legislation last year.
Putting aside its attempt to control the use of encryption systems,
last year the FBI proposed legislation that would require telephone
companies, electronic information providers, and computer and
communications equipment manufacturers to seek an FCC "license" or
Attorney General "certification" that their technologies are
susceptible to electronic surveillance. EFF fears we are in danger of
creating a domestic version of the export control laws for computer
and communications technology.
While the FBI claims that neither of last year's proposals address
encryption issues, the Bureau has made it clear it plans to return to
this issue in the future. A broad-based coalition of public interest
and industry groups, coordinated by the Electronic Frontier
Foundation, has called on the FBI to explore more realistic, less
vague, and less potentially onerous policy options for meeting
legitimate law enforcement needs. The EFF-coordinated coalition
includes over 30 industry groups (including AT&T, Lotus, Microsoft,
Sun Microsystems, IBM and Digital Equipment) along with public
interest organizations such as the American Civil Liberties Union and
Computer Professionals for Social Responsibility. Last year the
coalition was successful at stopping two separate FBI legislative
attempts, but we fully expect that the Digital Telephony proposal will
be back on the table.
TOWARD A COMPREHENSIVE VISION OF COMMUNICATIONS PRIVACY
IN THE INFORMATION AGE
At times, the arcana of encryption standards, export control laws,
and technical specifications of new digital telephony equipment may
unfortunately obscure the critical issues at stake in protecting
individual privacy. Many people are already relying on digital media
-- whether electronic mail, bulletin board systems, or other new
media -- for a plethora of personal, political, professional, and
cultural communications tasks. To provide adequate privacy
protection in the future, we will have to learn to wrestle with both
technical details and constitutional principles together, simply
because more and more of our personal activities will be pursued
through new digital media.
The multi-front battle being waged about digital privacy creates
formidable roadblocks to a final resolution of the policy disputes at
issue. Neither the restrictions of encryption, nor the FBI's wiretap
concerns, can be thoroughly addressed independent of the other.
Those who seek greater privacy and security cannot trust a
settlement on one front, because their victory is likely to be
undermined by action on the other issue. And law enforcement and
national security concerns cannot be adequately addressed without a
sense of the overall solution being proposed on both the encryption
and infrastructure fronts. It is time for policymakers to conduct a
comprehensive review of digital privacy and security policy, with a
consideration of both of these sets of issues.
In the case of the FBI's Digital Telephony proposal, we must tread
carefully. Current laws governing wiretapping authority, for
example, reflect a subtle balance between the guarantees of privacy
and security from state intervention embodied in our constitutional
tradition on the one hand, and the needs of law enforcement, on the
other. The rule developed for one medium -- voice telephony --
cannot be mechanically extended to the host of new communications
options now becoming available. Rather, we must give careful
consideration to the scope of wiretap authority that is appropriate to
the new media that the FBI seek to sweep under their wiretap
authority. In the case of encryption policy, it is critical that private
citizens have access to affordable, effective, and legal encryption
technology. In the information age, concerns for protecting
individual privacy should take precedence over outmoded national
security concerns left over from the Cold War.
-==--==--==-<>-==--==--==-
"What's Important About the Medphone Libel Case?"
By Mike Godwin
Online conferencing seems so much like informal conversation that
it may come as a surprise to some people to discover that they may
be bound by the same libel law that applies to The New York Times.
It certainly came as a surprise to Peter DeNigris, who is now being
sued for statements he made while participating in a forum on
Prodigy. But a look at the law of defamation (of which libel law is a
major part) makes clear that there's no reason to believe that online
statements are "immune" from libel lawsuits.
_What is defamation and what is libel?_
A communication is considered defamatory if it tends to damage
someone's reputation. Some legal definitions of "defamation" also
specify that the communication has to be false. If a communication is
both false and it defames someone, the person whose reputation is
injured can sue for damages. In general, if the defamation is