Letter to IETF Urging No Wiretap Provisions

This file is available on a Cryptome DVD offered by Cryptome. Donate $25 for a DVD of the Cryptome 10-year archives of 35,000 files from June 1996 to June 2006 (~3.5 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. Archives include all files of cryptome.org, cryptome2.org, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org. Cryptome offers with the Cryptome DVD an INSCOM DVD of about 18,000 pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985. No additional contribution required -- $25 for both. The DVDs will be sent anywhere worldwide without extra cost.

5 November 1999: Add Dov Smith message.

3 November 1999

From: Austin Hill <austin@zeroknowledge.com>
To: Austin Hill <austin@zeroknowledge.com>
Cc: "Dave Baniser (E-mail)" <banisar@2rad.net>
Subject: Letter to IETF urging to not adopt Wiretap provisions
Date: Tue, 2 Nov 1999 21:26:50 -0500

Dear friends,

We are circulating this letter to prominent security, cryptography, privacy and legal experts to ask you to consider it for the addition of your signature.

On Monday, November 8th at the National Press Club in Washington DC there will be the Junkbuster Privacy in Commerce award ceremony. (http://junkbusters.com/awards.html). At the same time, Zero-Knowledge Systems, the Privacy awards sponsor has set aside time to present this letter to members of the IETF and the media who will be in attendance.

If you agree to having your name included in this letter, please send e-mail to <austin@zeroknowledge.com> OR <banisar@2rad.net> BEFORE Saturday November 6th. Please ensure to list your name & organization/affiliation that you want included.

If there is someone you feel should also sign this letter please feel free to forward it to them, but please refrain from forwarding it to media, or open mailing lists as we would like to present the letter first to the media at this event.

We would also like to invite any of you who are going to be in the DC area to join us at 5:30 sharp at the National Press Club to present this letter and urge the IETF to not support wiretaps in protocols.

The details are,

The Holeman Lounge
National Press Club
529 14th St. NW, 13th Floor
Washington, DC 20045
Phone: 202-662-7500

There will be an open bar as well as some snacks.

If you want to know more about the room, you can look at it online: http://npc.press.org/club/mtgrooms.htm#holeman

Thank you for your support.

November 10, 1999

Open letter to IETF membership

Scott Bradner
Internet Engineering Task Force
c/o Corporation for National Research Initiatives
1895 Preston White Drive, Suite 100
Reston, VA 20191-5434
USA

+1 703 620 9071 (fax)

Dear Dr. Bradner (or open letter to the IETF membership)

We are writing to urge the IETF not to adopt new protocols or modify existing protocols to facilitate eavesdropping. Based on our expertise in the fields of computer security, cryptography, law and policy, we believe that such a development would harm network security, result in more illegal activities, diminish users' privacy, stifle innovation, and impose significant costs on developers of communications. At the same time, it is likely that Internet surveillance protocols would provide little or no real benefit for law enforcement.

It will undermine network security. Ensuring adequate security on the Internet is extremely difficult. Any protocol that requires backdoors or other methods of ensuring surveillance will create new security holes that can be exploited. In addition, the increased complexity of the systems will further undermine security and increase costs of development and implementation. The new security holes will likely cause more economic and personal harm than any interceptions facilitated.

It will stifle development of new communications technologies. Any requirement to ensure that every new communications system includes eavesdropping capabilities will limit the ability of companies and individuals to develop and deploy new communications technologies. In the United States, the Communications Assistance for Law Enforcement Act (CALEA) has delayed the development of new telephone, cellular and satellite communications technologies as conflicts over the surveillance standards have continued.

There are no legal requirements for the IETF to develop surveillance protocols. There are no current requirements under U.S. law requiring that computer networks facilitate surveillance. The U.S. Congress, when enacting CALEA, specifically rejected the inclusion of computer networks in the statutory mandate. In addition, it is inconsistent with laws in other jurisdictions, such as the European Union-enacted Directive 97/66/EC of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector, requiring that providers of telecommunications services "must take appropriate technical and organisational measures to safeguard security of its services."

The protocols will not prevent crime. Even if the IETF were to develop protocols that facilitated surveillance, it would not prevent crime as most significant criminal enterprises (i.e., those important enough to warrant being placed under surveillance in the first place) would be sophisticated enough to use end-to-end encryption products to prevent decoding of the intercepted communications. Indeed, nearly every national government has rejected calls for mandatory key-escrow encryption because they recognize that it would not be effective.

It is inconsistent with previous activities of the IETF. The IETF has long attempted to increase the security and privacy of computer networks. The August 1996 Internet Advisory Board (IAB) and Internet Engineering Steering Group (IESG) Statement on Cryptographic Technology and the Internet (RFC 1984) called for the availability and development of stronger tools to protect security and privacy of network users and rejected limitations on computer security based on country requirements for interception. More recently, the IETF agreed to adopt encryption into IPv6, even in the face of domestic and export controls in some countries. It would be a dramatic change in policy for the IETF to now begin work on developing surveillance capabilities for IPVo.

The proposal will have severe consequences in many non-democratic countries. Privacy of communications is a fundamental human right recognized in the United National Declaration of Human Rights, the International Convenant on Civil and Political Rights and many other international human rights agreements that have been signed by nearly every nation in the world. However, in many nations, those fundamental rights are routinely violated by the national governments and others. The U.S. State Department reported in its 1998 survey of human rights that governments in over 90 countries were conducting illegal surveillance of their citizens. The protocols would continue and likely expand that surveillance.

In conclusion, we urge that the IETF vote to not move forward with the development of these protocols.

Sincerely,

Austin Hill
Zero Knowledge Systems

Marc Rotenberg
Electronic Privacy Information Center

Bruce Schneier
Counterpane Systems

Richard M. Smith
Independent security consultant

Matt Blaze
AT&T

Peter Neumann
SRI

Simon Davies
Privacy International

From: Dov Smith <dov@zeroknowledge.com>
To: "'jy@jya.com'" <jy@jya.com>
Subject: RE: Open Letter to IETF
Date: Thu, 4 Nov 1999 20:15:58 -0500

I notice you have posted an advance copy of the Open Letter to the IETF. While I appreciate your interest in publishing it, I'd like to caution that what you've posted on Cryptome <http://cryptome.org/ietf-notap.htm> is neither a final and complete version, nor does it reflect the full range of signatories. As such, the Cryptome version is not a fully accurate reflection of what the IETF will see when the letter is delivered.

The letter is scheduled to be released publicly on Nov. 8. I would be happy to provide you a copy of the letter after it is finalized, at a time that we can arrange by telephone.

Please don't hesitate to contact me at the office, 514.287.7447 x 248, by cel at 514.995.2805, or by email at mailto:dov@zeroknowledge.com.

Best regards,

Dov

_______________________________________________________

Dov Smith, Director of Public Relations
Zero-Knowledge Systems Inc. -- "Nothing Personal"

T: 514.287.7447 x 248 E: mailto:dov@zeroknowledge.com
F: 514.287.0967 W: http://www.zeroknowledge.com

Press Room: http://www.zeroknowledge.com/pressroom

_______________________________________________________