Hacker 2/HACKER2.mdf/cud/cud532c.txt

Text File | 1995-01-03 | 13KB | 220 lines

Date: Wed, 28 Apr 93 12:57:01 PDT
From: [e-mail]
Subject: File 3--Some thoughts on Clipper and the Constitution (1)

Date--Mon, 26 Apr 93 17:55:36 -0500
[e-mail] (Mike Godwin)
Newsgroups--austin.eff
Subject--Some thoughts on Clipper and the Constitution

   Note: These notes were a response to a question during Saturday's
   Cypherpunks meeting about the possible implications of the Clipper
   Chip initiative on Fourth Amendment rights. Forward to anyone else who
   might think these interesting.

   --Mike


Notes on Cryptography, Digital Telephony, and the Bill of Rights
By Mike Godwin

I.  Introduction

      A.  The recent announcement of the federal government's "Clipper
Chip" has started me thinking again about what the principled "pure
Constitutional" arguments a) opposed to Digital Telephony and b) in favor
of the continuing legality of widespread powerful public-key encryption.
      B.  These notes do *not* include many of the complaints that have
already been raised about the Clipper Chip initiative, such as:
         1.  Failure of the Administration to conduct an inquiry before
embracing a standard,
         2.  Refusal to allow public scrutiny of the chosen encryption
algorithm(s), which is the normal procedure for testing a cryptographic
scheme, and
         3.  Failure of the administration to address the policy questions
raised by the Clipper Chip, such as whether the right balance between
privacy and law-enforcement needs has been struck.
      C.  In other words, they do not address complaints about the federal
government's *process* in embracing the Clipper Chip system. They do,
however, attempt to address some of the substantive legal and
Constitutional questions raised by the Clipper Chip and Digital Telephony
initiatives.

II.  Hard Questions from Law Enforcement

      A.  In trying to clarify my own thinking about the possible
Constitutional issues raised by the government's efforts to guarantee
access to public communications between individuals, I have spoken and
argued with a number of individuals who are on the other side of the
issues from me, including Dorothy Denning and various respresentatives of
the FBI, including Alan McDonald.
      B.  McDonald, like Denning and other proponents both of Digital
Telephony and of a standard key-escrow system for cryptography, is fond of
asking hard questions: What if FBI had a wiretap authorization order and
couldn't implement it, either because it was impossible to extract the
right bits from a digital-telephony data stream, or because the
communication was encrypted? Doesn't it make sense to have a law that
requires the phone companies to be able to comply with a wiretap order?
      C.  Rather than respond to these questions, for now at least let's
ask a different question. Suppose the FBI had an authorization order for a
secret microphone at a public restaurant. Now suppose it planted the bug,
but couldn't make out the conversation it was authorized to "seize"
because of background noise at the restaurant. Wouldn't it make sense to
have a law requiring everyone to speak more softly in restaurants and not
to clatter the dishes so much?
      D.  This response is not entirely facetious. The Department of
Justice and the FBI have consistently insisted that they are not seeking
new authority under the federal wiretap statutes ("Title III"). The same
statute that was drafted to outline the authority for law enforcement to
tap telephonic conversations was also drafted to outline law enforcement's
authority to capture normal spoken conversations with secret or remote
microphones. (The statute was amended in the middle '80s by the Electronic
Communications Privacy Act to protect "electronic communications," which
includes e-mail, and a new chapter protecting _stored_ electronic
communications was also added.)
      E.  Should we understand the law the way Digital Telephony
proponents insist we do--as a law designed to mandate that the FBI (for
example) be guaranteed access to telephonic communications? Digital
Telephony supporters insist that it merely "clarifies" phone company
obligations and governmental rights under Title III. If they're right,
then I think we have to understand the provisions regarding "oral
communications" the same way. Which is to say, it would make perfect sense
to have a law requiring that people speak quietly in public places, so as
to guarantee that the government can bug an oral conversation if it needs
to.
      F.  But of course I don't really take Digital Telephony as an
initiative to "clarify" governmental prerogatives. It seems clear to me
that Digital Telephony, together with the "Clipper" initiative, prefigure
a government strategy to set up an information regime that precludes truly
private communications between individuals who are speaking in any way
other than face-to-face. This I think is an expansion of government
authority by almost any analysis.

III.  Digital Telephony, Cryptography, and the Fourth Amendment

      A.  In talking with law enforcement representatives such as Gail
Thackeray, one occasionally encounters the view that the Fourth Amendment
is actually a _grant_ of a Constitutional entitlement to searches and
seizures. This interpretation is jolting to those who have studied the
history of the Fourth Amendment and who recognize that it was drafted as a
limitation on government power, not as a grant of government power. But
even if one doesn't know the history of this amendment, one can look at
its  language and draw certain conclusions.
      B.  The Fourth Amendment reads: "The right of the people to be
secure in their persons, houses, papers, and effects, against unreasonable
searches and seizures, shall not be violated, and no Warrants shall issue,
but upon probable cause, supported by Oath or affirmation, and
particularly describing the place to be searched, and the persons or
things to be seized."
      C.  Conspicuously missing from the language of this amendment is any
guarantee that the government, with properly obtained warrant in hand,
will be _successful_ in finding the right place to be searched or persons
or things to be seized. What the Fourth Amendment is about is _obtaining
warrants_--similarly, what the wiretap statutes are about is _obtaining
authorization_ for wiretaps and other interceptions. Neither the Fourth
Amendment nor Title III nor the other protections of the ECPA constitute
an law-enforcement _entitlement_ for law enforcement.
      D.  It follows, then, that if digital telephony or widespread
encryption were to create new burdens for law enforcement, this would not,
as some law-enforcement representatives have argued, constitute an
"effective repeal" of Title III. What it would constitute is a change in
the environment in which law enforcement, along with the rest of us, has
to work. Technology often creates changes in our social environment--some,
such as the original innovation of the wiretap, may aid law enforcement,
while others, such as powerful public-key cryptography, pose the risk of
inhibiting law enforcement. Historically, law enforcement has responded to
technological change by adapting. (Indeed, the original wiretaps were an
adaptation to the widespread use of the telephone.) Does it make sense for
law enforcement suddenly to be able to require that the rest of society
adapt to its perceived needs?

IV.  Cryptography and the First Amendment

      A.  Increasingly, I have come to see two strong links between the
the use of cryptography and the First Amendment. The two links are freedom
of expression and freedom of association.
      B.  By "freedom of expression" I mean the traditionally understood
freedoms of speech and the press, as well as freedom of inquiry, which has
also long been understood to be protected by the First Amendment. It is
hard to see how saying or publishing something that happens to be
encrypted could not be protected under the First Amendment. It would be a
very poor freedom of speech indeed that dictated that we could *never*
choose the form in which we speak. Even the traditional limitations on
freedom of speech have never reached so far. My decision to encrypt a
communication should be no more illegal than my decision to speak in code.
To take one example, suppose my mother and I agree that the code "777",
when sent to me through my pager, means "I want you to call me and tell me
how my grandchild is doing." Does the FBI have a right to complain because
they don't know what "777" means? Should the FBI require pager services
never to allow such codes to be used? The First Amendment, it seems to me,
requires that both questions be answered "No."
      C.  "Freedom of association" is a First Amendment right that was
first clearly articulated in a Supreme Court case in 1958: NAACP v.
Alabama ex rel. Patterson. In that case, the Court held that Alabama could
not require the NAACP to disclose a list of its members residing in
Alabama. The Court accepted the NAACP's argument that disclosure of its
list would lead to reprisals on its members; it held such forced
disclosures, by placing an undue burden on NAACP members' exercise of
their freedoms of association and expression, effectively negate those
freedoms. (It is also important to note here that the Supreme Court in
effect recognized that anonymity might be closely associated with First
Amendment rights.)
      D.  If a law guaranteeing disclosure of one's name is sufficiently
"chilling" of First Amendment rights to be unconstitutional, surely a law
requiring that the government be able to read any communications is also
"chilling," not only of my right to speak, but also of my decisions on
whom to speak to. Knowing that I cannot guarantee the privacy of my
communications may mean that I don't conspire to arrange any drug deals or
kidnapping-murders (or that I'll be detected if do), but it also may mean
that I choose not to use this medium to speak to a loved one, or my
lawyer, or to my psychiatrist, or to an outspoken political activist.
Given that computer-based communications are likely to become the dominant
communications medium in the next century, isn't this chilling effect an
awfully high price to pay in order to keep law enforcement from having to
devise new solutions to new problems?

V.  Rereading the Clipper Chip announcements

      A.  It is important to recognize that the Clipper Chip represents,
among other things, an effort by the government to pre-empt certain
criticisms. The language of announcements makes clear that the government
wants us to believe it has recognized all needs and come up with a
credible solution to the dilemma many believe is posed by the ubiquity of
powerful cryptography.
      B.  Because the government is attempting to appear to take a
"moderate" or "balanced" position to the issue, its initiative will tend
to pre-empt criticisms of the government's proposal on the grounds of
*process* alone.
      C.  But there is more to complain about here than bad process. My
rereading of the Clipper Chip announcements will reveal that the
government hopes to develop a national policy that includes limitations on
some kinds of cryptography. Take the following two statements, for
example:
      D.  'We need the "Clipper Chip" and other approaches that can both
provide law-abiding citizens with access to the encryption they need and
prevent criminals from using it to hide their illegal activities.'
      E.  'The Administration is not saying, "since encryption threatens
the public safety and effective law enforcement, we will prohibit it
outright" (as some countries have effectively done); nor is the U.S.
saying that "every American, as a matter of right, is entitled to an
unbreakable commercial encryption product." '
      F.  It is clear that neither Digital Telephony nor the Clipper Chip
make any sense without restrictions on other kinds of encryption.
Widespread powerful public-key encryption, for example, would render
useless  any improved wiretappability in the communications
infrastructure, and would render superfluous any key-escrow scheme.
      G.  It follows, then, that we should anticipate, consistent with
these two initiatives, an eventual effort to prevent or inhibit the use of
powerful private encryption schemes in private hands.
      H.  Together with the Digital Telephony  and Clipper Chip
initiatives, this effort would, in my opinion, constitute an attempt to
shift the Constitutional balance of rights and responsibilities against
private entities and individuals and in favor of law enforcement. They
would, in effect, create _entitlements_ for law enforcement where none
existed before.
      I.  As my notes here suggest, these initiatives may be, in their
essence, inconsistent with Constitutional guarantees of expression,
association, and privacy.

Downloaded From P-80 International Information Systems 304-744-2253