Subject: EFFector Online 09.03: New Pro-Crypto Bills * CDA Cases Update
summary: 1) 2 new crypto bills, despite problems, a major step forward; 2)
Join the legal challenge against the CDA!
organization: Electronic Frontier Foundation
________________ _______________ _______________
/_______________/\ /_______________\ /\______________\
\\\\\\\\\\\\\\\\\/ ||||||||||||||||| / ////////////////
\\\\\________/\ |||||________\ / /////______\
\\\\\\\\\\\\\/____ |||||||||||||| / /////////////
\\\\\___________/\ ||||| / ////
\\\\\\\\\\\\\\\\/ ||||| \////
EFFector Online Volume 09 No. 03 Mar. 6, 1996 edit...@eff.org
A Publication of the Electronic Frontier Foundation ISSN 1062-9424
IN THIS ISSUE:
Encrypted Communications Privacy Act: Enabling Electronic Envelopes
Update on "Decency" Censorship Law Legal Challenges
Electronic Frontiers Georgia Formed
AOL Against Government Censorship, For User Empowerment
US Customs Decides Internet is Not a Place - Fines Those Who Claim Otherwise
Quote of the Day
What YOU Can Do
* See http://www.eff.org/Alerts/ or ftp.eff.org, /pub/Alerts/ for more
information on current EFF activities and online activism alerts! *
Subject: Encrypted Communications Privacy Act: Enabling Electronic Envelopes
Yesterday, Sen. Patrick Leahy, Rep. Robert Goodlatte, and many other
Congresspersons introduced two very similar pro-encryption, pro-privacy,
pro-Internet bills, one in the House, one in the Senate, to mostly deregulate
the export of encryption and to affirm US citizens's rights to use any
encryption they wish, with no requirement the users' crypto keys be
"escrowed". Below is a statement on the Leahy/Burns/Murray version.
Most of the good (and bad) points apply to the Goodlatte version in the
House as well, though it has stronger protections against imposition of
government-access-to-keys, a very good sign. The new felony category
created by both bills has been narrowed since the release below was
written, to require that any cryptographic obsctruction of justice be
done "in the furtherance" of a crime to be subject to additional criminal
penalties. This is an improvement, though not perfect.
The significance of these bills is that, like the 1994 Cantwell export
deregulation bill, they raise vital issues relating to privacy, security,
authentication and responsibility, and competitiveness before Congress, and
they do so pre-emptively: It is believed that the Clinton administration is
preparing it's own *anti*-crypto legislation at the behest of the FBI and
NSA. It is unknown at present what such a bill would look like in detail,
but it is unlikely to be favorable to Internet user's privacy rights,
digital commerce, system security, or freedom of expression. The
current bills give those of us concerned about these issues a head start
in educating legislators, the media and the public before the storm hits.
Coupled with the EFF/Bernstein and Karn legal cases' constitutional
challenge against the crypto export restrictions themselves, the
Leahy/Goodlatte legislation is an important step toward securing privacy
and confidentiality for users of all new media.
FOR IMMEDIATE RELEASE ELECTRONIC FRONTIER FOUNDATION
+1 415 436 9333
March 5, 1996 http://www.eff.org
The Electronic Frontier Foundation (EFF) is encouraged to see
Congressional support for lifting restrictions on encryption and
affirming privacy rights for U.S. citizens. The bill introduced today
by Senators Pat Leahy (D-VT), Patricia Murray (D-WA) and Conrad Burns
(R-MT) is an important step in reclaiming privacy and encryption
rights for society and business. The bill would legalize wide use of
"electronic envelopes" to protect private information. Today this
information travels on "electronic postcards" which can easily be
altered or intercepted. However, the bill also includes key escrow
and obstruction of justice provisions which would cause problems if
"The bill provides a new opportunity to bring reason into the crypto
policy debate," said EFF co-founder John Gilmore. "We support the
Senators for bringing their energy into the process. The bill is a
good start, and with healthy debate and modification, it could become
Electronic privacy and encryption policy is extremely complex because
it intertwines our constitutional rights of free speech, publication,
association, and protection from self-incrimination and unreasonable
search, with issues of wiretapping, spying, military security,
personal privacy, and computer security. This bill would pick a new
balance among these competing interests, with long-term impacts on our
society and economy. EFF is committed to working with government,
industry and public interest organizations to raise the level of
understanding and debate in resolving these complex issues.
EXPORT CONTROL LIBERALIZATION
The Encrypted Communications Privacy bill would make long-overdue changes
to the export restrictions currently hampering the deployment of privacy
and security "envelopes" for Windows, Unix, the Mac, and the Internet.
* Moves export control of all non-military information security products,
incuding encryption, to the Commerce Dept., whose rules protect
constitutional rights and reflect market realities.
* Requires that no license be required to export generally available
mass-market software, public domain software, and computers that
include such software.
* Requires that export be authorized for non-military encryption
software to any country where similar software is exportable from
the U.S. to foreign financial institutions.
* Requires that export be authorized for encryption hardware if a
comparable product is available overseas.
The above changes would significantly improve the nation's crypto
policy. But they make detailed changes in a very complex section of
the law and regulations. There is a significant risk that they will
be implemented by the Administration in a different fashion than
Congress intended. This happened in 1987, for example, when
Congress tried to eliminate NSA meddling with civilian computers by
passing the Computer Security Act. It was subverted by a series of
Presidential directives and agreements among Executive Branch
departments. The result today is that NSA is still in control of
We would encourage futher deregulation as a simpler, more effective,
and far more reliable solution. The bill should simply eliminate all export
controls on non-military encryption.
CRIMINALIZATION OF ENCRYPTION AND ENCOURAGEMENT OF KEY ESCROW
The following provisions raise serious concerns about the imbalance
between the rights of the people and the desires of the goverment. EFF
feels that the impact of these provisions must be closely considered,
and will work to modify or remove them to better serve the public
interest. The bill:
* Makes it a new crime to "use encryption to obstruct justice", with
5-10 year sentences, plus fines. In plain language, this is a
extra criminal charge that can be applied when police are frustrated
in an investigation but happen to catch someone breaking the law in
some other way. It's like Adding an extra ten-year jail term if you
close your curtains while committing a crime. Americans have the
right to protect their own privacy by any nonviolent means, and we
expect that encryption will soon be built into all computers,
phones, and networks.
* Provides a legal infrastructure for key escrow, a system in which
all users' keys are copied to permit government access. The
Clinton Administration has been pushing key escrow to replace its
failed "Clipper chip", out of fear that if Americans have real
privacy they will abuse it. These provisions in the bill would
encourage people to use the flawed key-copying system.
CLARIFICATION AND REFINEMENT
The are a number of areas of the bill that would benefit from additional
debate and clarification. Specifically, where the bill:
* Explicitly does not mandate key escrow, but fails to prohibit
the Administration from attempting to impose it with regulations.
* Outlaws disclosure of others' keys except to the government, with
1-2 year sentences, plus fines, but includes a broad "good
faith" exemption for when the government does something illegal or
* Requires disclosure of other peoples' keys to the government, under
the same procedures currently used for wiretaps, searches of online
records and backup tapes, and fishing expeditions in billing records.
The provision does not always require adversary legal process, in
which citizens can argue for their privacy before a judge, but instead
relies solely on the integrity of prosecutors.
* Legalizes the use any encryption "except as provided in this
Act...or in any other law".
EFF'S PROPOSED CRYPTO-PRIVACY PRINCIPLES
originally written during the Clipper Chip debate, are the touchstone
by which we measure privacy legislation and policy issues:
* Private-sector access to encryption technology must not be hindered,
either by regulation of what crypto may be used domestically, or by
restriction on what may be exported.
* Government policy on encryption usage and standards must be set in open
forums with proper attention paid to public input. Secret hearings and
classified algorithms have no part to play in a democratic process.
* Encryption must become part of the "information infrastructure" to
protect personal, commercial and governmental privacy and security.
Cryptographic tools must not be crippled or weakened for the convenience
of government agents, and users must be free to choose what encryption
they prefer and whether and to whom they will reveal encryption keys.
Law enforcement must obtain court orders, not simply administrative
subpoenas to seize keys or decrypt and search encrypted information.
* Government policy regarding emerging technologies like encryption
must not erode Constitutional protections. In particular, any such
policies must be compatible with the rights to freedom of speech,
press and association, freedom from coerced self-incrimination,
and freedom from unreasonable search and seizure.
* Encryption will be built into all next-generation Internet,
communications and computer technology. There must be no government
policy equating use of encryption with evidence of criminal
behavior, nor the creation of any new crime category that holds
encryption users liable for making criminal investigation more
* Government at all levels should explore cryptography's potential to
replace identity-based or dossier-based systems - such as driver's
licenses, credit cards, social security numbers, and passports - with
less invasive technology.
The Encrypted Communications Privacy bill at this time passes some of these
tests, and we are committed to working with industry, government, and public
interest organiations to address the remaining issues.
The Electronic Frontier Foundation (EFF) is a nonprofit public interest
organization devoted to the protection of online privacy and free
expression. EFF was founded in 1990, and is based in San Francisco,
The International Traffic in Arms Regulations (ITARs), administered by
the State Department, and in the background by the National Security
Agency, unreasonably treat encryption software and hardware as if they
were weapons of war, like rockets and bombs. It has proven very difficult
to deploy U.S.-made encryption products in an increasingly important global
market due to these regulations, at a time when the need for online
security systems for personal and commercial use has never been more
EFF has for several years led efforts to fend off governmental attempts
to restrict the development and public availability of secure
privacy technology. In 1993-4, EFF and other civil liberties organizations
successfully opposed implementation of the U.S. Administration's "Clipper"
or "Skipjack" system - hardware encryption for voice and data
communications in which all encryption keys are held by government for
the convenience of law enforcement and intelligence agencies. In 1994, we
helped ensure that crypto export became a major legislative topic,
laying the groundwork for eventual liberalization of the ITARs. In
1994 and 1995 EFF opposed implementation of and helped defeat funding for
the FBI's "Digital Telephony" scheme, in which up to one person on every
city block could be simultaneously wiretapped. In 1995, we filed an ongoing
federal lawsuit with mathematician Daniel Bernstein, challenging the
constitutionality of the export control laws.
ONLINE RESOURCES FOR MORE INFORMATION
Please see EFF's Internet archives for more details on this and other issues.
EFF Privacy & Encryption Archive: http://www.eff.org/pub/Privacy/
EFF Legal Issues & Policy Archive: http://www.eff.org/pub/Legal/
Action Alerts: http://www.eff.org/pub/Alerts/
Topical Index of the EFF Archive: http://www.eff.org/links.html
The Electronic Frontier Foundation
1550 Bryant St., Suite 725
San Francisco CA 94103 USA
+1 415 436 9333 (voice)
+1 415 436 9993 (fax)
John Gilmore, Co-founder and Member of the Board
g...@eff.org +1 415 221 6524
Subject: Update on "Decency" Censorship Law Legal Challenges
The Communications Decency Amendment to the Telecom Act, and another
Telecom Act provision in a different section of that huge piece of
legislation, have come under concerted attack in no less than four
federal lawsuits filed nearly immediately after passage.
EFF, the ACLU, and many other organizations and invividual plaintiff,
most of them online content producers, filed suit in the US District
Court for the Eastern Dist. of Pennsylvania, Feb. 8, 1996, before Judge
The judge commended the plaintiffs on a well preprated case, and issued a
temporary restraining order against enforcement of certain provisions of
the CDA (in particular the "indecency" ban, but not the "patently
offensive material" ban), calling the CDA "unconstitutional". Subsequent
to this, attorneys for our side obtained an agreement from the Justice
Department, who also appear to recognize the new laws
unconstitutionality, to not enforce any of the CDA's challenged provisions.
This case is ACLU, et al. v. Reno, and will soon be before a 3-judge
panel who are expected to issue a longer-lasting and more complete
preliminary injunction against CDA enforcement until the Supreme Court
can hear the meat of the case. This case is likely to be fast-tracked,
and may reach the highest court in the land before the year is out.
The injunction trial has tentatively been scheduled for March 21 and 22,
with the government getting a hearing Apr. 11 and 12. April 1 has also
been reserved in case it is needed. The 3 judges will be Appeals Judge
Sloviter, District Judge Dalzell, and and District Judge Buckwalter.
The CDA provisions of the bill are also being challenged by another suit
filed around the same time by an online newspaper, _The_American_Reporter_,
in the New York State Southern District US Court. This case and the
EFF/ACLU case raise most of the same issues, though with different
focusses in some areas. The cases dove-tail quite nicely.
In simultaneous action, Arthur Sanger, the Center for Reproductive
Law & Policy, Planned Parenthood of New York, and several other
plaintiffs filed a suit in challenging the constitutionality of Rep.
Henry Hyde's last-minute amendment to the Telecom Bill making it illegal
to post certain kinds of abortion-related information online. This
statute is arguably duplicative with current law - the old Comstock
obscenity code, which is not medium dependent and therefore already
includes the Internet, has banned this abortion info since the 19th
Century, but has simply not be enforced much. The case seeks to strike
down the abortion part of it completely. The judge in this case did not
issue a restraining order, apparently finding that the lack of
enforcement, and the Dept. of Justices (fairly weak) assurances that they
would not enforce this portion of the Telecom Bill either, as indicactive
of little enough risk to let the case proceed without directly enjoining
enforcement. This case, Sanger v. Reno, is ongoing in the US District
Court for the Eastern Dist. of New York State. The Justice Department
has openly acknowledged the unconstitutionality of the abortion-related
WHAT YOU CAN DO
Feb. 26, the Center for Democracy and Technology, the Am. Library Assoc.,
Wired Magazine, and additional plaintiffs from the online services
industry, filed a fourth suit, in the same district as the ACLU & EFF
suit, again challenging the unconstitutional "decency" provisions of the
Telecom bill. This case has a rather unique feature: You can add
yourself as a plaintiff at no expense! One of the plaintiffs is the
Citizen's Internet Empowerment Coalition - a coaltion you can join by
filling out a WWW form at:
DEADLINE: March 15, 1996!
As of March 1, the CIEC members numbered over 5000.
This latest case does not conflict with the other cases in anyway, and
may be merged with the EFF/ACLU case.
The CIEC/CDT plaintiffs have also filed for a preliminary injunction.
Hearing date is set for March 21.
Updates on these cases will be made at
on a regular basis.
* Electronic Frontiers Georgia Formed
A new state-level grassroots action organization has formed in Atlanta.
"Electronic Frontiers Georgia is a civil liberties organization that has
been formed to fight for freedom, privacy, and access on [the US
State of] Georgia's computer networks." Monthly physical meetings are
held in Atlanta.
For a list of other such groups (and other organization of various kinds
that have something to do with online civil liberties, access and
society), see our Online Activism Organizations FAQ at:
ftp.eff.org, cd /pub/Activism/, get activ_groups.faq
gopher.eff.org, path: 1/Activism, get activ_groups.faq
* AOL Against Government Censorship, For User Empowerment
According to an AP newswire, America Online chairman Steve Case said
Tues. that Internet censorship "is a very difficult, very sensitive issue
which requires a dialogue...for what the right balance is going to
be...this is a new medium and it does require a different perspective,
and we're going to be calling for a new framework that recognizes [that]."
Case said online content filtration, that would allow parents to block
child access to inappropriate materials, is the right solution, rather than
* US Customs Decides Internet is Not a Place - Fines Those Who Claim Otherwise
A "virtual" software corporation, ACD, with software engineers in both
California and Hungary, but no real physical business infrastructure, was
recently slapped with an $85 fine by US Customs.
ACD's product, EPublisher for the Web, was developed over the Internet
with no physical meetings or other contact between the developers. When
Hungarian developers sent versions of the software on diskette to their
US counterparts, the shipment was stopped by Customs at LAX (the major
Los Angeles airport) for "mark violation". The Hungarians had marked
"Country of Origin" on the forms as "Internet", as the product was not
decidably made in Hungary or the US, and the owners of the intellectual
property rights to the product are in no single physical location.
ACD's Laslo Chaki says, "We had to pay an $85 fine for mark violation.
Virtual company, in virtual city with $85 real fine!"
Though the intent of the "Country" section on customs forms is to ascertain
where a particular package was shipped from, and the listing of the country
of origin as "Internet" is somewhat silly in this context, the lack of any
sense of humor on the part of Customs is not particularly encouraging.
You might want to be careful with those RSA t-shirts - Customs just might
handle them as munitions after all, and regard you as an unlicensed
international arms dealer, at this rate.
Subject: Calendar of Events
This schedule lists events that are directly EFF-related. A much more
detailed calendar of events likely to be of interest to our members and
supporters is maintained at:
ftp: ftp.eff.org, /pub/EFF/calendar.eff
gopher: gopher.eff.org, 1/EFF, calendar.eff
Mar. 14 - National Silence Protest against the CDA!
See WWW site for more info.
Mar. 15 - LAST CHANCE to add your name as a plaintiff lawsuit against Net
censorship bill! See WWW site for more info.
30 - CFP96, the Sixth Conference on Computers, Freedom, & Privacy;
MIT, Cambridge, Massachusetts. Sponsored by ACM SIGCOMM,
SIGCAS, SIGSAC, and the World Wide Web Consortium. This is
THE electronic privacy conference. Speakers include EFF
representatives (and CFP is also the time and place of the
EFF Pioneer Awards ceremony.)
Apr. 30 - Electronic Freedom March on Washington!
See WWW site for more info.
Subject: Quote of the Day
"Two-point-five million use America Online. That's like a city. Parents
wouldn't let their kids go wandering in a city of 2.5 million people
without them, or without knowing what they're going to be doing."
- Pam McGraw, America Online spokesperson, in "Children Lured From Home
by Internet Acquaintances" by David Foster, Associated Press, June
Find yourself wondering if your privacy and freedom of speech are safe
when bills to censor the Internet are swimming about in a sea of of
surveillance legislation and anti-terrorism hysteria? Worried that in
the rush to make us secure from ourselves that our government
representatives may deprive us of our essential civil liberties?
Concerned that legislative efforts nominally to "protect children" will
actually censor all communications down to only content suitable for
the playground? Alarmed by commercial and religious organizations abusing
the judicial and legislative processes to stifle satire, dissent and
Even if you don't live in the U.S., the anti-Internet hysteria will soon
be visiting a legislative body near you. If it hasn't already.
Subject: What YOU Can Do
* The Communications Decency Act & Other Censorship Legislation
The Communications Decency Act and similar legislation pose serious
threats to freedom of expression online, and to the livelihoods of system
operators. The legislation also undermines several crucial privacy
JOIN THE ANTI-CDA LAWSUIT AS A PLAINTIFF! MARCH 15 DEADLINE:
Business/industry persons concerned should alert their corporate govt.
affairs office and/or legal counsel. Everyone should write to their own
Representatives and Senators, letting them know that such abuses of
public trust will not be tolerated, that legislators who vote against
your free speech rights will be voted against by you in the next elections.
Join in the Blue Ribbon Campaign - see http://www.eff.org/blueribbon.html
PARTICIPATE IN BLUE RIBBON ACTIVISM EFFORTS:
Support the EFF Cyberspace Legal Defense Fund:
For more information on what you can do to help stop this and other
dangerous legislation, see:
If you do not have full internet access (e.g. WWW), send your request
for information to a...@eff.org.
* New Crypto-Privacy Legislation
Urge your Senators and Representatives to call for hearings! Not much
else needs to be done on this right this moment, but expect this issue to
heat up rapidly. Pointers to Congress contact info are below.
Keep an eye on http://www.eff.org/pub/Activism/index.html#crypto
* Digital Telephony/Comms. Assistance to Law Enforcement Act
The FBI is now seeking both funding for the DT/CALEA wiretapping provisions,
and preparing to require that staggering numbers of citizens be
To oppose the funding, write to your own Senators and Representatives
urging them to vote against any appropriations for wiretapping.
We are aware of no major action on this threat at present, but keep your
eyes peeled. It will be back.
* Anti-Terrorism Bills
Numerous bills threatening your privacy and free speech have been introduced
this year. None of them are close to passage at this very moment, but
this status may change. Urge your Congresspersons to oppose these
unconstitutional and Big-Brotherish bills.
* The Anti-Electronic Racketeering Act
This bill is unlikely to pass in any form, being very poorly drafted, and
without much support. However, the CDA is just as bad and passed with
flying colors [the jolly roger?] in the Senate. It's better to be safe
than sorry. If you have a few moments to spare, writing to, faxing, or
calling your Congresspersons to urge opposition to this bill is a good
* Medical Privacy Legislation
Several bills relating to medical privacy issues are floating in Congress
right now. Urge your legislators to support only proposals that *truly*
enhance the medical privacy of citizens.
More information on this legislation will be available at
http://www.eff.org/pub/Privacy/Medical/ soon. Bug m...@eff.org to make
it appear there faster. :)
* Find Out Who Your Congresspersons Are
Writing letters to, faxing, and phoning your representatives in Congress
is one very important strategy of activism, and an essential way of
making sure YOUR voice is heard on vital issues.
EFF has lists of the Senate and House with contact information, as well
as lists of Congressional committees. (A House list is included in this
issue of EFFector). These lists are available at:
The full Senate and House lists are senate.list and hr.list, respectively.
Those not in the U.S. should seek out similar information about their
own legislative bodies. EFF will be happy to archive any such
If you are having difficulty determining who your Representatives are,
try contacting your local League of Women Voters, who maintain a great
deal of legislative information, or consult the free ZIPPER service
that matches Zip Codes to Congressional districts with about 85%
Computer Currents Interactive has provided Congress contact info, sorted
by who voted for and against the Communcations Decency Act:
* Join EFF!
You *know* privacy, freedom of speech and ability to make your voice heard
in government are important. You have probably participated in our online
campaigns and forums. Have you become a member of EFF yet? The best way to
protect your online rights is to be fully informed and to make your
opinions heard. EFF members are informed and are making a difference. Join
For EFF membership info, send queries to members...@eff.org, or send any
message to i...@eff.org for basic EFF info, and a membership form.
EFFector Online is published by:
The Electronic Frontier Foundation
1550 Bryant St., Suite 725
San Francisco CA 94103 USA
+1 415 436 9333 (voice)
+1 415 436 9993 (fax)
Membership & donations: members...@eff.org
Legal services: sste...@eff.org
General EFF, legal, policy or online resources queries: a...@eff.org
Editor: Stanton McCandlish, Online Activist, Webmaster (m...@eff.org)
Assoc. Editors: Ryan Thornburg, Communications Intern (r...@eff.org)
Dennis Derryberry, Communications Intern (den...@eff.org)
This newsletter is printed on 100% recycled electrons.
Reproduction of this publication in electronic media is encouraged. Signed
articles do not necessarily represent the views of EFF. To reproduce
signed articles individually, please contact the authors for their express
permission. Press releases and EFF announcements may be reproduced individ-
ually at will.
To subscribe to EFFector via email, send message body of "subscribe
effector-online" (without the "quotes") to lists...@eff.org, which will add
you to a subscription list for EFFector.
Back issues are available at:
To get the latest issue, send any message to effector-reflec...@eff.org (or
e...@eff.org), and it will be mailed to you automagically. You can also get
the file "current" from the EFFector directory at the above sites at any
time for a copy of the current issue. HTML editions available at:
at EFFweb. HTML editions of the current issue sometimes take a day or
longer to prepare after issue of the ASCII text version.
End of EFFector Online v09 #03 Digest
<HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish
</A><HR><A HREF="mailto:m...@eff.org"> m...@eff.org
</A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation
</A><P><A HREF="http://www.eff.org/A"> Online Activist </A></HTML>