Re:US control (Score 1)

The question of whether it should be possible for the government to listen in to our private conversations is old, and I do not it came to rest before because of ethical considerations, but rather due to technical concerns and cost issues. And perhaps because its impact is likely to be very low. Before considering the evils of having, versus not having, escrowed keys, I think we should all ask ourselves what makes *us* so interesting, warranting the government to spend time or effort listening in to our email correspondence. Chances are that neither you nor I would ever be directly affected by any such effort. This is an argument that is likely to be made at some point. The fact that the average citizen would not be e-tapped does not mean that he should not worry. The reason is that one could be indirectly affected by e-tapping. Take Watergate as an example of a small directed tapping effort that could have changed the lives of countless people (by potentially changing national politics, had the outcome of the election been altered). On the other hand, we need to ask ourselves whether this particular type of tapping could be prevented by means of strong cryptography. It probably would not, since (directed) virus attacks and "viral" operaring systems may counter any effects of encryption, either by leaking keys or plaintexts. A second threat is that of "immoral behavior", such as the collection of child pornography, etc. Here, a main threat to law enforcement is if arrested suspects have all evidence encrypted on their hard disk. No escrowing would ever help this case, since the keys may be locally generated and used. Another aspect, of course, is to apprehend the criminal, but this relates more to traffic analysis than the hiding of communicated information. Besides, this is not what has spurred the debate at this point. The reason for again considering escrowing is, of course, the possibility of detecting suspicious terrorist related activity, probably by scanning the activities of a moderately large number of people belonging to high-risk groups, and later, the attentive eavesdropping on conversations between people detected in the scanning. I believe that only dumb terrorists would allow themselves to be detected by an automated scanner. For example, there is nothing suspicious about the sentence "Let's go down to New York City some time soon. We'll fly, right? Let's meet at the WTC". At least, this would not have caught any attention a few weeks ago. This means that the search / surveillance would probably have to be performed by people -- not machines -- which limits its scope severely. This suggests again that most ordinary citizens would not be directly affected. In order to figure out whether "not so ordinary" residents would be affected by escrowing, ;et us consider the following: Escrowing of keys means "escrowing of secret keys whose public keys are certified and associated with a PKI." It does not mean "stopping the use of encryption between parties who have already met and agreed on secret keys". That is something we cannot stop, short of prohibiting cryptography. That makes key escrow a pretty lame weapon against terrorists, assuming these work in small groups of people with some common contact point. Therefore, it seems like ordinary citizens will not be directly affected by escrowing; neither will we be indirectly affected by the way of politicians. Moreover, neither will child pornographers, nor will terrorists. The only situation I can see it making any difference is that of drug trade -- but only for the layer closest to the consumer. This may be a worthwhile reason to introduce it, but does not seem relevant in the context of current legislative efforts. Therefore, I think we should not panic and reduce civil rights when it seems to make no difference anyway. If we want to implement key escrow, we must understand what types of crimes it may avoid, and what crimes it will have no impact on. Markus