Sen. Lieberman supports warrantless wiretaps, crypto-regs

2000-08-15 Thread Declan McCullagh



http://www.wired.com/news/politics/0,1283,38207,00.html

Lieberman's Privacy 'Tap' Dance
by Declan McCullagh ([EMAIL PROTECTED])

7:53 a.m. Aug. 15, 2000 PDT
The Democratic Party platform that delegates will
adopt this week embraces personal privacy
despite the checkered voting record of their vice
presidential candidate.

During his 12 years in the Senate, Connecticut's
Joseph Lieberman has supported regulations on
medical data collection while at the same time
championing expanded surveillance powers for law
enforcement.

In 1995, for instance, Lieberman began a campaign
to let police perform short-term warrantless wiretaps
in some cases that involved potential "violent acts."

He attempted to offer his warrantless-wiretap
amendment to an anti-terrorism bill being considered
by the Senate in response to the Oklahoma City
bombing.

"I can imagine a number of situations where the
power granted by (this amendment) would provide
exactly the kinds of tools that could make a
difference in stopping terrorists before they strike,"
Lieberman said in a floor speech at the time.

He called "electronic surveillance, particularly in this
high-technology communication age" one of the most
powerful tools police have against criminals.

That anti-privacy stance seems to conflict with the
strong language in the 2000 Democratic Party
platform, which talks of the "right to choose whether
personal information is disclosed; the right to know
how, when, and how much of that information is
being used; the right to see it yourself; and the right
to know if it is accurate."

During this election season, electronic privacy
concerns have reached an all-time high, fueled by
concerns about systems such as Echelon and
Carnivore. In July, the European Parliament appointed
a committee to investigate Echelon, and last week
Attorney General Janet Reno said she would ask an
unnamed university to audit the FBI's Carnivore
software.

"One has to question where Lieberman stands on
privacy," says Sonia Arrison, director of technology
policy at the free-market Pacific Research Institute.
"On the one hand, it's terrifying to think that a
potential vice president would support wiretapping
without a warrant, but on the other hand he's been
eager to enforce privacy policies on government
websites. I think he needs to come clean on this
issue."

A spokesman for Lieberman who asked not to be
identified by name defended the Connecticut
Democrat's record: "He has a pro-Internet agenda.
And he is concerned and attentive to the privacy of
Internet users."

To be sure, Lieberman has taken stands that drew
praise from civil libertarians.

Months before he became Vice President Al Gore's
running mate, Lieberman requested that auditors at
the General Accounting Office investigate whether or
not federal agencies are complying with
government-wide privacy standards. A recent
investigation by Wired News showed that many
federal websites are violating White House rules
about using cookies.

Months before he became Vice President Al Gore's
running mate, Lieberman requested that auditors at
the General Accounting Office investigate whether or
not federal agencies are complying with
government-wide privacy standards. A recent
investigation by Wired News showed that many
federal websites are violating White House rules
about using cookies.

Lieberman also co-sponsored a medical-reform bill
that required companies participating in Medicare and
Medicaid programs to report additional information to
the federal government. Data submitted are
supposed to remain confidential.

But Lieberman, the former attorney general of
Connecticut, frequently appears to agree with law
enforcement and national security officials when they
argue for more eavesdropping abilities.

One criticism of Lieberman's warrantless-wiretapping
plan came from Sen. Orrin Hatch (R-Utah), the chair
of the Judiciary committee. Hatch opposed the
amendment, saying it would define activist groups as
potential "terrorists" and permit police to conduct
surveillance without a judge's approval.

Hatch, a conservative Mormon, said groups like
ACT-UP and environmental activists could be
targeted under Lieberman's plan. "This amendment
could thus permit the government to listen to the
conversations of such groups without obtaining a
court order. ... I am concerned that this provision, if
enacted, would unnecessarily broaden emergency
wiretap authority," Hatch said.

Lieberman's spokesman said the purpose of the
amendment was to update existing wiretap laws to
cover terrorist activity, and that if a judge eventually
nixed the wiretap, the information gathered could not
be used in court. U.S. law had already allowed for
temporary warrantless taps in other areas.

The Senate defeated Lieberman's amendment 52 to
28 by tabling it, but a related amendment he offered
at the same time became law.

The law grants more wiretap powers to police by
allowing cops to use "roving" wiretaps on multiple
phone lines that a 

Re: Book on cryptography for programmers

2000-08-15 Thread Rick Smith

At 03:38 PM 8/10/00, Michael Paul Johnson wrote:

In case you haven't figured it out, yes, I am seriously contemplating 
writing such a book.

There's certainly a need for defensive programming books oriented towards 
security functions, and crypto functions in particular. On the other hand, 
there's probably not much need to publish more source code of crypto 
algorithms, which is where most of the export control misery resides.

In my own experience, the hard part of building secure software is to 
establish the right set of security requirements. Once a good programmer 
understands and implements the right requirements, the product should be 
OK, assuming that the serious implementation bugs have been found and 
fixed. Secure Computing builds some very strong stuff that way.

Originally I intended "Internet Cryptography" as a book for programmers, 
and I emphasized the problem of identifying security requirements. The book 
has a list of requirements for just about every component choice in a 
crypto system. Also, one of the nasty parts of book writing is that of 
deciding what material to include and what to omit. I used the lists of 
requirements to determine what technical concepts to describe -- I tried to 
include everything necessary to explain and justify the individual 
requirements, and omitted the rest.

But I found that the really important requirements applied as much to 
network administrators who simply bought stuff off the shelf and installed 
it. So the book doesn't have much of a programming flavor, especially since 
I didn't address defensive programming techniques.

What would you like to see on the CD-ROM that looks like it would fit 
export license exception TSU (open source, no explicit requirement for 
payment, no key size limits)?

A friend of mine bundled a CD with her book, and she found it to be a 
negative. The stuff on the CD was posted to a web site anyway, and the CD 
simply jacked up the cost of the book, reducing reader appeal. Check with 
your publisher -- the CD probably adds a few bucks to the production 
process which in turn adds $5-$10 to the retail cost.

Rick.
[EMAIL PROTECTED]