[00:01.400 --> 00:18.660]  To my left, I have Declan McCullagh, who is a journalist involved with numerous organizations, now working for News.com, and also Matt Blaze, who works at the security department for AT&T, and was involved with the deconstruction of the Clipper chip,
[00:18.940 --> 00:20.660]  which I'm sure he could tell you more about.
[00:21.220 --> 00:22.800]  But let's get you guys started.
[00:23.120 --> 00:25.420]  This is Educating Lawmakers, Is It Possible?
[00:29.320 --> 00:30.100]  Okay, folks.
[00:33.140 --> 00:35.360]  I run Politech.
[00:35.520 --> 00:44.000]  I wrote for the last four years for Wired News, and now I'm living and working in Washington, D.C., writing for CNETSnews.com about technology and politics.
[00:44.520 --> 00:55.180]  The question at hand today, and the reason I hope you're here if you haven't made a mistake, is can you make a difference in politics without being a wholly owned tool of the Demo-Publican party?
[00:56.100 --> 01:00.100]  I'll tell you what I think towards the end, but let me ask you this first.
[01:00.380 --> 01:02.180]  What the fuck are y'all thinking?
[01:02.780 --> 01:04.620]  Why the hell are y'all here?
[01:04.980 --> 01:10.220]  Why would anyone with a fractional clue even want to be involved with politics?
[01:10.220 --> 01:15.140]  Congress is not a place for considered rational debate.
[01:15.460 --> 01:17.980]  It is not a place bounded by rationality.
[01:18.040 --> 01:22.180]  It is not a place with even a tenuous tie to the demands of logic.
[01:22.180 --> 01:25.640]  There is not one computer scientist in Congress.
[01:26.080 --> 01:27.360]  Not one sysadmin.
[01:27.520 --> 01:29.140]  Not one network administrator.
[01:29.540 --> 01:31.860]  They don't have a clue about technology.
[01:32.160 --> 01:34.860]  They ban laptops from the Senate floor.
[01:34.860 --> 01:37.500]  And it's getting worse fast.
[01:37.920 --> 01:42.540]  Politics is populated by the type of people who like to control your ass.
[01:43.140 --> 01:49.420]  Congress is ruled by campaign contributions, special interests, lobbying, unions, business groups, and nonprofits.
[01:49.420 --> 01:51.760]  And most of all, partisan politics.
[01:52.220 --> 01:58.620]  Especially in the House, the goal is to get a majority at all costs, preferably by dissing the other party.
[01:59.480 --> 02:02.720]  Tom Davis is the head of the National Republican Campaign Committee.
[02:02.940 --> 02:08.060]  He sent out a memo titled, I kid you not, Democrat Hypocrisy, on Wednesday.
[02:08.060 --> 02:15.820]  It says, Democrat claims that Republicans created a culture of permissiveness and enabled this evil corporate behavior are preposterous.
[02:16.000 --> 02:19.220]  Democrats have no credibility or standing to attack us on this issue.
[02:19.620 --> 02:25.080]  Dick Gephardt, the Democratic leader of the House, replied yesterday with his email that his press secretary sent me.
[02:25.480 --> 02:29.840]  Republicans have been talking about privatization of Social Security for the last three years.
[02:29.840 --> 02:34.560]  But in the last six months, he's talking about the financial accounting scandal.
[02:34.740 --> 02:38.880]  Social Security privatization has magically disappeared from the Republican message playbook.
[02:39.460 --> 02:42.960]  Well, now what does Enron or WorldCom have to do with Social Security?
[02:43.320 --> 02:49.240]  Even with Friday's close at 9,000 or so, the stock market is still a better overall investment than Social Security.
[02:49.240 --> 02:51.520]  It was around 3,000 in 1992.
[02:51.520 --> 02:53.860]  That's a three-fold increase in ten years.
[02:54.140 --> 02:56.220]  Like I said, no logic here.
[02:56.220 --> 02:59.700]  But let me go through some examples of stupid Senate tricks.
[03:00.640 --> 03:09.180]  Admiral Tom Wilson, the head of the Defense Intelligence Agency, firmly believes that Fidel Castro may be planning a cyber-attack against the United States.
[03:10.900 --> 03:12.600]  I'm not making this up.
[03:12.800 --> 03:28.980]  Wilson told the Senate Intelligence Committee during a public hearing in February 2001 that the 74-year-old communist dictator is capable of initiating a, quote, information warfare or computer network attack that could disrupt our military.
[03:29.600 --> 03:30.180]  I mean, what?
[03:30.240 --> 03:32.480]  You got these M1 Abrams tanks hooked up to the internet?
[03:34.880 --> 03:37.500]  How about responses to September 11th?
[03:37.660 --> 03:42.120]  Oh, by the way, after that happened, the panel went to closed session to discuss classified material.
[03:43.260 --> 03:45.240]  How about responses to September 11th?
[03:45.280 --> 03:48.040]  You all know about the PATRIOT Act, the USA PATRIOT Act.
[03:48.040 --> 04:02.820]  What you might not know is that the wiretap sections of that law, using carnivore in some circumstances without a court order, were part of a bill that the Senate enacted unanimously on September 13th, just two days after September 11th.
[04:02.940 --> 04:06.880]  You see, the FBI and Department of Justice had this written just in case.
[04:07.960 --> 04:15.260]  That Thursday evening, the Senate approved the Combating Terrorism Act of 2001 by a unanimous vote.
[04:15.400 --> 04:19.600]  It was written by Orrin Hatch and Dianne Feinstein, two lovers of liberty.
[04:20.200 --> 04:22.500]  It says that any U.S.
[04:22.800 --> 04:28.240]  Attorney or State Attorney General could order the installation of the carnivore system without having to go to a judge first.
[04:28.240 --> 04:31.860]  Hatch argued that such laws are necessary to thwart terrorism.
[04:32.140 --> 04:41.980]  Quote, it is essential that we give our law enforcement authorities every possible tool to search out and bring to justice those individuals who have brought such indiscriminate death into our backyard.
[04:43.340 --> 04:50.240]  The same day, in a floor speech earlier, Senator Judd Gregg, a Republican from New Hampshire, called for crypto restrictions.
[04:50.940 --> 05:01.200]  Gregg said encryption makers, quote, have as much risk as we have at risk as a nation, and they should understand that as a matter of citizenship, they have an obligation to include back doors.
[05:02.660 --> 05:06.260]  Pretty much everyone yelled, and Gregg eventually backed down.
[05:06.460 --> 05:07.740]  But he didn't do it publicly.
[05:07.920 --> 05:09.940]  His spokesman refused to comment.
[05:10.240 --> 05:18.360]  So I sent a junior reporter over to wait outside his office until the spokesman stuck his head out for lunch and then he couldn't ignore us anymore.
[05:19.580 --> 05:23.120]  Well, at least we have an internet caucus to help us on these issues.
[05:23.120 --> 05:26.120]  He's our last great hope for sane internet legislation.
[05:26.120 --> 05:28.840]  A way to stop this sensorial madness, right?
[05:29.460 --> 05:31.060]  Well, not so fast.
[05:31.320 --> 05:39.920]  It turns out that the internet caucus is chaired by Representative Bob Goodlatte, a Republican from Virginia, who also chairs the House Republican High Technology Working Group.
[05:40.440 --> 05:45.900]  And instead of supporting pro-internet bills, Goodlatte has been racking up a history of doing precisely the opposite.
[05:46.240 --> 05:48.960]  He drafted a bill to prohibit internet gambling.
[05:48.960 --> 05:52.700]  He was one of the big supporters of the Communications Decency Act.
[05:52.920 --> 05:56.820]  He was a vocal proponent of the Digital Millennium Copyright Act.
[05:57.360 --> 06:04.120]  He wrote a bill to make non-profit copyright infringement, giving your dad a copy of Microsoft Office.
[06:04.120 --> 06:05.500]  A federal crime.
[06:06.020 --> 06:07.580]  Clinton signed it into law.
[06:08.120 --> 06:13.100]  He introduced a bill last year called the Anti-Spamming Act of 2001 that allows the U.S.
[06:13.220 --> 06:21.480]  Secret Service to police software that, quote, is designed or produced primarily for the purpose of concealing the source or routing information of bulk email.
[06:21.480 --> 06:23.200]  Well, that sounds good, maybe.
[06:23.440 --> 06:35.760]  But because of the broad way it's written, if you modify a Pearl autoresponder CGI script to forge the from line of a message, you're guilty of a federal crime, $15,000 fine, and one year in prison.
[06:38.500 --> 06:45.620]  So, this is what you get when you mix discussions of technology with the weak minds of the aging techno halfwits in the U.S.
[06:45.760 --> 06:46.060]  Congress.
[06:46.060 --> 06:52.180]  You get a screwball dialogue that veers haphazardly between the idiotic and inane.
[06:53.040 --> 07:03.260]  Let's remember and honor former Senator James Exxon, a Democrat from Nebraska, who retired after shepherding successfully the Communications Decency Act through Congress.
[07:03.540 --> 07:13.280]  He once said in all seriousness, the information superhighway is a revolution that, in years to come, will transcend newspapers, radio, and television as an information source.
[07:13.280 --> 07:17.260]  Therefore, I think this is the time to put some restrictions or guidelines on it.
[07:19.920 --> 07:28.160]  Joining Exxon was Larry Pressler, the former chair of the Senate panel that oversaw the bill that included the CDA.
[07:28.540 --> 07:33.320]  Here's an excerpt from a book that the folks at counterpunch.org wrote.
[07:33.640 --> 07:40.940]  Quote, mentally frail and morally inert, Republican Senator Larry Pressler is the telecommunications industry point man in Congress.
[07:40.940 --> 07:46.380]  He is a man long and widely derided in Washington as an imbecile of fantastic proportions.
[07:46.800 --> 07:54.040]  They describe how Pressler's colleagues watched in bemusement as he rose from a meeting and mistook a closet door for the exit.
[07:54.660 --> 07:58.980]  Pressler realized his mistake, but decided the best strategy was to stand pat.
[07:58.980 --> 08:06.140]  His plan backfired when his colleagues decided to wait him out and saw him when he emerged 15 minutes later.
[08:09.780 --> 08:14.720]  I remember one long-time Hill Observer telling me about the late Senator Bill Scott of Virginia.
[08:15.340 --> 08:19.540]  He once fired his press aide for reading a newspaper while on the job.
[08:20.280 --> 08:21.980]  When Time Magazine called him...
[08:25.020 --> 08:30.680]  When Time Magazine called him dumb in an article, he held a press conference to deny it.
[08:30.880 --> 08:32.640]  Quote, I am not dumb, he said.
[08:38.430 --> 08:45.150]  Much is lost also on Senator Charles Grassley, well known for his fascination with pedophiles in the internet.
[08:45.150 --> 08:47.910]  The theme of a 1995 cyber porn hearing he organized.
[08:48.090 --> 08:49.390]  He's still in Congress, by the way.
[08:50.530 --> 08:59.430]  After the Supreme Court struck down the CDA in 1997, the Iowa Republican has been forced to vent his frustrations on encryption instead.
[08:59.430 --> 09:05.210]  At a hearing that year, he demanded how many child molesters should go free because of encryption.
[09:08.520 --> 09:09.400]  Exact quote.
[09:10.140 --> 09:20.320]  The 1996 presidential campaign, at its low moments too, Bob Dole punctuated a presidential debate with a domain name and misspoke the address of his campaign's own website.
[09:20.940 --> 09:23.160]  And who can forget his immortal advice?
[09:23.420 --> 09:26.500]  The net is a great way to get on the internet.
[09:30.790 --> 09:33.150]  Bill Clinton seemed almost as clueless.
[09:33.450 --> 09:41.830]  Quote, it may be that what we have to do for computers is try to develop something like the equivalent of what we're developing for television, like the V chip.
[09:42.190 --> 09:43.570]  What did he mean by this?
[09:43.570 --> 09:45.290]  A mandatory chip in every PC?
[09:45.590 --> 09:47.570]  His aides couldn't respond.
[09:47.730 --> 09:48.630]  They had no clue.
[09:48.630 --> 09:50.450]  He just made it up on the spot.
[09:53.270 --> 09:58.790]  There's President George Bush who said famously, there ought to be limits to freedom.
[09:59.890 --> 10:02.810]  After he was mocked on GWBush.com.
[10:03.030 --> 10:09.950]  Al Gore, who told Wolf Blitzer on CNN with an entirely straight face, I took the initiative in creating the internet.
[10:11.670 --> 10:12.390]  Crypto.
[10:13.730 --> 10:19.630]  Crypto remains the topic most likely to transform articulate legislators into babbling bird brains.
[10:19.630 --> 10:28.070]  A few years ago, the House International Relations Committee was desperately seeking a metaphor to explain the effect of permitting the export of crypto.
[10:29.090 --> 10:32.250]  Quote, do we open the door to let all the cows out?
[10:32.470 --> 10:33.810]  Asked one Congress critter.
[10:33.990 --> 10:38.430]  An FBI official replied, there are many, many still left inside the barn.
[10:39.030 --> 10:41.930]  No, said Zog Lofgren, a Democrat from Silicon Valley.
[10:42.090 --> 10:44.130]  The cows are tromping all over America.
[10:44.550 --> 10:45.750]  Cows can replicate.
[10:45.750 --> 10:47.810]  They're being born all over the world.
[10:47.990 --> 10:49.450]  There's plenty of beef available.
[10:53.430 --> 10:59.350]  Once, Senator Bob Carey of Nebraska was asked to define encryption by an even more clueless reporter.
[10:59.730 --> 11:01.250]  The results were horrific.
[11:02.450 --> 11:11.530]  Quote, well, I mean, to answer your question, I mean encryption is the political equivalent of encryption is that you ask me a question, I give you an answer and you don't understand it.
[11:16.340 --> 11:19.160]  I mean, I intentionally garble the answer frequently.
[11:19.380 --> 11:22.600]  I intentionally garble the answer so that you can't understand what I'm saying.
[11:22.820 --> 11:25.600]  And that's, you notice I've got the ability to do that.
[11:28.340 --> 11:31.120]  There are only two types of people who participate in politics.
[11:31.340 --> 11:32.860]  Those with principles and those without.
[11:33.180 --> 11:36.400]  And if you want to get involved, make sure you know which one you want to be.
[11:36.400 --> 11:42.960]  So when someone says, hey, there's this bill that would mandate key escrow, how about just like have a halfway key escrow bill?
[11:43.280 --> 11:45.280]  Are you going to support that with us or not?
[11:46.200 --> 11:50.660]  Even with the stupid Senate tricks I've told you about, there's still a way to get involved reasonably.
[11:50.920 --> 11:54.400]  You can work through professional societies like ACM and IEEE.
[11:54.400 --> 11:59.840]  You can take to the streets like the DMCA protesters did and the free Sklerov crowd did.
[12:00.160 --> 12:06.640]  You can write to your local newspapers and ask them to publish op-eds or start special interest websites and try to get the media interested.
[12:07.140 --> 12:10.980]  But in the long run, this isn't what the community in this room is good at.
[12:11.160 --> 12:12.820]  And what do you think makes more of a difference?
[12:12.940 --> 12:20.520]  15 people or even 150 people in front of the U.S. Capitol building waving free Dimitri signs or programs like PGP and Freenet?
[12:20.520 --> 12:22.500]  What makes more of a difference in the long run?
[12:22.740 --> 12:24.720]  What do you think actually changes the world?
[12:25.860 --> 12:34.740]  Congress is used to hundreds of thousands of people marching on Capitol Hill on issues like firearms confiscation or abortion.
[12:35.020 --> 12:36.960]  They can deal with this kind of pressure.
[12:37.100 --> 12:40.780]  They ignore it for the most part unless it translates into votes.
[12:40.920 --> 12:44.660]  And your influence there is limited at least for the foreseeable future.
[12:44.980 --> 12:48.120]  That's why the cypherpunk motto gets it right.
[12:48.120 --> 12:49.640]  Cypherpunks write code.
[12:50.820 --> 12:53.120]  I'll leave you with one last antidote.
[12:53.640 --> 13:02.840]  If you thought that Dianne Feinstein, who hails from the home of Silicon Valley and once was a mayor of San Francisco, might be more clueful, you'd be badly mistaken.
[13:03.040 --> 13:12.300]  At one crypto hearing, she talked about whether businesses would prefer a, quote, hard key or digital key or a key infrastructure, a phrase that's nothing but meaningless blather.
[13:14.280 --> 13:23.580]  There was the time when one of her aides, who was in the room at the time, told me where they were introducing her to the internet.
[13:23.720 --> 13:25.220]  Here's your website, Senator.
[13:25.780 --> 13:29.300]  The chief of staff said, quote, here's, take my seat behind the desk.
[13:29.460 --> 13:31.360]  Oh, here, Feinstein asked nervously.
[13:31.600 --> 13:34.520]  Now this thing controls the arrow on the screen.
[13:34.780 --> 13:36.560]  Uh-huh, the Senator responded.
[13:36.560 --> 13:39.000]  Now, put your hand on the mouse.
[13:39.560 --> 13:40.840]  Mouse, cries the Senator.
[13:41.040 --> 13:46.600]  She pulls up her feet, pulls her knees to the side, hitches up her skirt, and looks underneath the desk for a rodent.
[13:47.160 --> 13:48.080]  Thank you, folks.
[13:55.250 --> 13:58.170]  You have no idea how happy I am to get to follow that.
[14:00.730 --> 14:06.250]  I've always admired the fact that Declan never reveals what his own opinions are.
[14:06.250 --> 14:11.890]  He's a model of journalistic objectivity, if I've ever seen one.
[14:14.450 --> 14:19.590]  So, I'm a cryptographer by trade.
[14:19.710 --> 14:24.850]  I study how to use cryptography to build secure systems.
[14:25.110 --> 14:31.450]  I've been interested in that professionally for about 10 or 15 years or so.
[14:32.610 --> 14:36.530]  So, my background is as a techie, right?
[14:36.690 --> 14:38.870]  I mean, I hail from the hacker community.
[14:41.230 --> 14:42.950]  I'm interested in the technology.
[14:42.950 --> 14:49.730]  I have this bias that says technology is a great way to have a huge impact, right?
[14:49.830 --> 14:56.390]  Small things, small inventions technically can just have profound changes in our society.
[14:57.270 --> 15:10.170]  And, you know, I still believe that's true, although I've been humbled over the last 15 years, really since my involvement in crypto, at what the limits of that are.
[15:10.210 --> 15:19.570]  And what happens when technology comes up against the public policy, the legislative, and the marketing world.
[15:21.070 --> 15:23.050]  The internet has become big business.
[15:23.190 --> 15:24.670]  Technology has become big business.
[15:24.830 --> 15:29.010]  And that attracts a lot of non-technical forces to it.
[15:29.490 --> 15:32.810]  So, what I'd like to do is essentially tell a story.
[15:33.150 --> 15:37.110]  And then, hopefully, Declan and I will find something to disagree about.
[15:37.210 --> 15:38.910]  But I'm not sure how easy that'll be.
[15:39.330 --> 15:42.470]  And then we'll open it up for questions.
[15:42.470 --> 15:46.850]  So, back in 1993, the U.S. government... I realize that's before, like, most of you were born.
[15:50.490 --> 15:51.990]  But the U.S. government proposed something called key escrow.
[15:56.050 --> 15:59.570]  And the idea of key escrow was the U.S.
[15:59.850 --> 16:14.770]  government was afraid of encryption, afraid that, you know, encryption would become widespread and that that would somehow hamper the ability of law enforcement to investigate crimes that had electronic communication in it, national security to do wiretapping and surveillance,
[16:15.190 --> 16:23.690]  and that this would upset the balance of power in ways that the government was probably reasonably afraid of.
[16:24.310 --> 16:26.990]  It hadn't happened yet, but they were worried that it would.
[16:27.250 --> 16:38.810]  So, what they proposed was that encryption systems should, from then on, send a copy of the key to the government for safekeeping.
[16:38.810 --> 16:59.030]  So, if you used an encryption system, you should make sure that any time you generate a key, you essentially mail a copy of the key to the NSA, and if anybody needs to investigate you later, they can just look up the key and decrypt your messages.
[16:59.350 --> 17:13.250]  And the idea was that vendors would do this, and, you know, the mafia, when they buy encryption systems, would make sure that they bought, you know, encryption systems that mailed copies of the keys to the NSA and the FBI.
[17:13.730 --> 17:18.990]  Now, you know, that sounds kind of dumb, but actually that was pretty much the idea.
[17:20.250 --> 17:23.230]  And they proposed this thing called the clipper chip.
[17:23.490 --> 17:38.010]  Now, the timing of this was interesting because we had reached a stage in technology where the community had realized that the data encryption standard was obsolete, or rapidly becoming obsolete.
[17:38.010 --> 17:45.810]  It had a 56-bit key, which was really on the edge of what was feasible to break by exhaustive search.
[17:46.030 --> 17:59.670]  Moore's law, computer technology, had advanced to the point where we really couldn't trust the 56-bit keys in DES, which was the most widely trusted secret key encryption system, to be long enough.
[17:59.670 --> 18:04.710]  So the time was ripe for a replacement for the data encryption standard.
[18:05.010 --> 18:10.690]  And so what the government very cleverly did was came up with an encryption system that had a longer key.
[18:11.810 --> 18:15.430]  And that had an 80-bit key, and the system was called SKIPJACK.
[18:15.790 --> 18:19.070]  And unlike the data encryption standard, it was secret.
[18:19.230 --> 18:20.930]  They didn't tell you what the algorithm was.
[18:21.590 --> 18:27.510]  Instead, if you wanted to use the SKIPJACK algorithm, you'd have to buy it in a chip.
[18:27.510 --> 18:32.990]  And the first generation of these chips was called Clipper, the Clipper chip.
[18:33.130 --> 18:39.790]  And they cost about $30, which, compared with software encryption, is obviously very expensive.
[18:40.110 --> 18:48.670]  But the market issue of hardware encryption versus software encryption aside, there was another problem with Clipper.
[18:48.890 --> 18:52.710]  And that was that it implemented key escrow.
[18:52.710 --> 19:08.770]  So along with the key exchange that it would do at the beginning of setting up a message with another one of these Clipper chips, it would encrypt a copy of your key with keys known to the government and include that in the message.
[19:08.930 --> 19:16.090]  And the receiving chip would make sure that you had done this before it would go into decrypt mode.
[19:16.090 --> 19:23.790]  So essentially, what this meant was that if you didn't know the government key, the system would be as secure as the algorithm.
[19:23.790 --> 19:32.610]  But if you did know the government's key, then the... or these keys that were kept in escrow at the government, then the system would be tappable.
[19:33.110 --> 19:48.510]  And, you know, so as long as they could convince the mafia and the KGB to encrypt all their communications with Clipper, it would be secure against, you know, competing organized crime organizations, but not secure against the government.
[19:48.510 --> 19:52.850]  And, you know, the society could rest comfortably at night.
[19:53.090 --> 20:00.990]  So as a cryptographer and somebody who designed secure systems, I understood intuitively that this was a really silly idea.
[20:01.370 --> 20:22.030]  You know, political issues aside about how much power the government should have to do wiretapping, you don't even need to think about to realize that a system that creates big databases of keys and has essentially online requirements for setting up the communication is always going to be more expensive and less secure than a system that doesn't.
[20:22.270 --> 20:27.470]  So when Clipper came out, I was interested in understanding some more things about it.
[20:29.710 --> 20:36.570]  So I was particularly interested in the question of how do they make sure that the key actually gets sent.
[20:38.070 --> 20:46.590]  So a bunch of us invited some people from the NSA to come up to Bell Labs and give a little presentation about Clipper.
[20:46.710 --> 20:48.090]  We hope to learn a little more about it.
[20:48.550 --> 20:51.550]  None of us would take security clearances.
[20:51.730 --> 20:58.270]  We made sure to stay in the unclassified world so that they couldn't arrest us if we published papers about it or criticized it.
[20:59.090 --> 21:03.190]  And they came up and gave a little presentation and they sent their techies.
[21:03.410 --> 21:04.770]  And it was a good exchange.
[21:05.010 --> 21:06.530]  We talked about what was hard about this.
[21:06.630 --> 21:08.190]  We talked about what was easy about this.
[21:08.310 --> 21:11.710]  And then, you know, the little dream thing happened at the end.
[21:12.730 --> 21:18.610]  I said, would you mind if I posted a message to Comp.Risks, you know, summarizing our meeting.
[21:18.770 --> 21:20.130]  And they said, no problem.
[21:20.130 --> 21:20.790]  And I did.
[21:20.950 --> 21:23.070]  And they said, you know, we really liked your message.
[21:23.070 --> 21:25.190]  It didn't include the phrase, jackbooted thugs.
[21:25.350 --> 21:26.950]  And most of the messages about this do.
[21:27.890 --> 21:34.370]  So, you know, if you want to come down, and, you know, we'd like to, you know, give you some samples.
[21:34.430 --> 21:35.630]  And, you know, you can play with them.
[21:36.330 --> 21:38.470]  And I thought, well, gee, this should be interesting.
[21:39.050 --> 21:50.750]  About the same time, by the way, somebody had posted to the net a copy of the NSA security manual listing all of the security procedures at Fort Meade and the colors, what the different colors of the badges were.
[21:50.890 --> 21:53.930]  It was purporting to be the NSA security manual.
[21:54.430 --> 21:56.050]  So, I had read all of this stuff.
[21:56.230 --> 21:57.270]  I had read Bamford's book.
[21:57.410 --> 22:00.750]  You know, I had always been kind of in awe of the NSA world.
[22:00.870 --> 22:03.170]  So, visiting Fort Meade would be a lot of fun.
[22:03.370 --> 22:07.490]  So, went down to Fort Meade with a colleague.
[22:07.490 --> 22:12.610]  And, you know, sure enough, it's this, you know, very secure environment.
[22:12.610 --> 22:14.950]  There are people with guns.
[22:15.170 --> 22:16.530]  They didn't have marine guards anymore.
[22:16.530 --> 22:19.290]  But they had the NSA police, it was called.
[22:19.650 --> 22:25.050]  And if you... you had to go through this little zig-zaggy corridor that would keep RF out.
[22:25.290 --> 22:27.590]  So, the whole building was this sort of tempest enclosure.
[22:31.250 --> 22:37.450]  The... if you walk down the wrong corridor, a light would go off.
[22:37.450 --> 22:41.430]  And this disembodied voice would come out and say, please identify yourself.
[22:42.230 --> 22:46.650]  And your host would have to hold up his badge and you would have to hold up your badge.
[22:46.750 --> 22:48.130]  And then they'd say, please proceed.
[22:48.330 --> 22:51.950]  And, you know, this would happen if you went out and had to go to the bathroom or anything like that.
[22:52.130 --> 23:01.090]  So, it was, you know, if you think Jack Valenti doesn't want you going to the bathroom without permission, the NSA is much stricter about it.
[23:02.230 --> 23:04.890]  So, you know, it was an interesting experience.
[23:04.890 --> 23:08.890]  They gave me a clipper chip in a PCMCIA card.
[23:09.110 --> 23:11.290]  Something called a Tessera card.
[23:11.450 --> 23:15.470]  Though they had to change the name because it turned out to be a registered trademark of somebody else.
[23:16.450 --> 23:21.090]  So, you know, that gives you kind of an idea that this program was rolled out fairly quickly.
[23:21.930 --> 23:26.590]  And, you know, then I had read the NSA security manual and realized that, you know, any...
[23:26.590 --> 23:34.750]  taking computer equipment out of the building isn't really something that they like people without security clearances in particular to do.
[23:35.010 --> 23:36.950]  So, I said, how am I going to get this out of the building?
[23:37.790 --> 23:41.070]  And my host said, hmm, that's a problem.
[23:41.230 --> 23:42.410]  Remember, these are techies.
[23:42.510 --> 23:44.810]  These are also hackers, too, that I'm talking to.
[23:44.970 --> 23:48.730]  So, the guy gives me a paper bag and said, just put it in here.
[23:48.730 --> 23:55.230]  And so, I kind of smuggled this thing out of the NSA building.
[23:55.450 --> 24:00.330]  And when I got home, I noticed the paper bag he gave me actually said, classified waste.
[24:01.210 --> 24:02.870]  You know, it's a burn bag.
[24:03.150 --> 24:05.010]  So, I've got my little... I framed it.
[24:05.090 --> 24:07.090]  I've got in my office my NSA burn bag.
[24:07.090 --> 24:08.030]  I'm really proud of it.
[24:08.950 --> 24:11.290]  But I had to return my visitor's badge, unfortunately.
[24:13.530 --> 24:16.570]  So, I played with it almost immediately.
[24:16.910 --> 24:26.330]  And, you know, tried some of the naive things to see how the enforcement of key escrow would work.
[24:26.490 --> 24:30.010]  And sure enough, the most naive ways of defeating it didn't work.
[24:30.230 --> 24:37.950]  But, much to my chagrin, the second most naive ways of defeating it worked just fine.
[24:38.630 --> 24:48.690]  And, you know, it turned out there was this whole litany of ways to defeat it, depending on how much computational power you had and how much cooperation you had from the person you're talking to.
[24:48.850 --> 24:55.590]  The entire key escrow system just was trivially easy to defeat.
[24:56.830 --> 24:59.190]  So, I wrote it up.
[24:59.330 --> 25:02.390]  And I circulated a paper among some colleagues.
[25:02.610 --> 25:07.650]  And I was very careful to do this entirely based on all the publicly available information.
[25:07.650 --> 25:10.770]  So, there was no classified information involved here.
[25:11.350 --> 25:18.290]  And, of course, because, you know, my techie hosts were, you know, cooperating with this.
[25:18.370 --> 25:19.610]  I sent them a copy of the paper.
[25:20.230 --> 25:21.190]  Faxed it down there.
[25:22.570 --> 25:32.470]  And got a phone call about three hours later from my technical host down there and said, are you planning, what are you planning on doing with this?
[25:33.190 --> 25:35.810]  And I said, well, you know, I'm planning on submitting it to a conference.
[25:36.550 --> 25:38.690]  And there was this kind of silence.
[25:38.890 --> 25:39.890]  And he said, I'll call you back.
[25:42.230 --> 25:53.750]  And the next morning, you know, I went out and, of course, now I'm getting, you know, all the paranoid fantasies are starting to seep up.
[25:53.750 --> 25:57.670]  I'm thinking, you know, is that guy with the umbrella, does that have a poison tip on the end of it?
[25:58.370 --> 26:00.870]  You know, are they trying to get rid of me?
[26:00.930 --> 26:02.210]  Do they know my home address?
[26:02.470 --> 26:05.030]  I gave them my social security number when I went down there.
[26:05.090 --> 26:06.610]  All my credit cards are going to get canceled.
[26:07.710 --> 26:16.850]  The next morning, I get a call from the techies, my technical host's boss, who was another techie.
[26:16.850 --> 26:21.650]  And he said, if you're going to publish this, are you going to send this to a conference?
[26:22.170 --> 26:22.770]  And I said, yeah.
[26:23.010 --> 26:25.330]  And he says, okay, well, you're going to have to make some changes.
[26:25.590 --> 26:28.630]  And now I'm thinking, wow, okay, my back is up.
[26:28.770 --> 26:34.850]  And I'm about to be fighting for academic freedom and scientific freedom versus the government.
[26:35.030 --> 26:43.710]  This will be a, you know, I'm really getting my back up for a fight in the five seconds after the guy said, you're going to have to make some changes.
[26:43.950 --> 26:46.750]  But I calmed myself down and I said, well, what kind of changes?
[26:47.210 --> 26:54.910]  And the guy says, well, you know, first of all, on page 14, you know, the last half of the sentence is missing.
[26:55.330 --> 26:59.950]  And on page 22, you used the wrong formula for this probability distribution.
[27:02.310 --> 27:05.170]  And, you know, this word here is misspelled.
[27:05.330 --> 27:09.810]  And in fact, the guy gives me this pretty detailed copy editing of my paper.
[27:10.410 --> 27:12.390]  You know, it really made it a lot better.
[27:12.510 --> 27:15.410]  And there was some embarrassing little typos there in the one that I had sent him.
[27:18.530 --> 27:21.550]  So, he, you know, he was a techie, right?
[27:21.690 --> 27:24.730]  And technical people appreciate technical reality, right?
[27:24.810 --> 27:37.250]  Essentially, their culture, like my culture, says, you know, you, the culture of the technical people in, you know, this deep, dark agency is the same as the culture of technical people anywhere, right?
[27:37.250 --> 27:39.370]  You know, you look to improve things, right?
[27:39.450 --> 27:41.030]  You look to make things better.
[27:41.130 --> 27:43.950]  You look to probe the outer boundaries of it.
[27:44.070 --> 27:50.430]  So, we're still within, you know, the low-level technical people who don't make policy.
[27:50.470 --> 27:51.690]  They make technology.
[27:52.490 --> 27:54.890]  And, you know, those people are great to deal with.
[27:54.890 --> 28:02.690]  So, I had also circulated this around to some colleagues, you know, also technical people.
[28:02.910 --> 28:12.890]  And eventually, the paper made its way to John Markoff at the New York Times.
[28:12.890 --> 28:19.430]  I think it was Jim Bidzos of RSA sent a copy to, he got a copy somehow, and he sent a copy to Markoff.
[28:19.550 --> 28:24.470]  He was having a fight with the NSA, and he figured this would be, you know, a good way to embarrass them.
[28:25.490 --> 28:31.370]  So, I get a call from John Markoff, and then, of course, I have to get the AT&T Public Relations Department involved.
[28:31.370 --> 28:40.010]  And, you know, now it's become, it's gone from being a question of what's the reality?
[28:40.010 --> 28:41.290]  What's the technical reality?
[28:41.370 --> 28:42.930]  How do we make this as good as possible?
[28:43.150 --> 28:47.810]  To, you know, a political, a full-fledged political issue.
[28:50.670 --> 29:00.750]  The, we decided, you know, I essentially decided that the only right thing to do is to, you know, just, let's discuss it with them.
[29:01.590 --> 29:10.590]  Let's, let's, you know, let's be completely honest, let's not make this look like this is some kind of whistleblowing, or that, you know, AT&T is trying to shut me up, or something like that.
[29:10.750 --> 29:14.570]  But, you know, let's just be straightforward with it.
[29:14.590 --> 29:16.110]  So, I talked to the reporter.
[29:16.710 --> 29:22.410]  He said, okay, well, this will be running in tomorrow's paper.
[29:23.270 --> 29:28.250]  And it was kind of surprising, you know, technical person, you know, technical publication takes a while.
[29:28.250 --> 29:30.290]  News cycles are faster, so that's one thing.
[29:30.450 --> 29:33.030]  Things can happen much more quickly than you expect.
[29:34.490 --> 29:35.790]  Look for it in tomorrow's paper.
[29:36.010 --> 29:37.450]  I get a call from him a little later.
[29:37.690 --> 29:39.490]  He needs to fact check a couple details.
[29:39.770 --> 29:43.690]  And he said, you know, by the way, this is probably going to get fairly prominent placement.
[29:43.890 --> 29:44.670]  It's a slow news day.
[29:45.590 --> 29:47.570]  Okay, I figured, prominent placement, fine.
[29:47.570 --> 29:50.530]  So, I pick up late that night.
[29:50.670 --> 29:54.270]  You can get the New York Times in New York, or at least you could then.
[29:54.390 --> 29:55.990]  You could get the New York Times around 10 p.m.
[29:56.330 --> 29:58.450]  print editions before they had the web edition.
[30:00.550 --> 30:02.650]  And, you know, it looked in the paper and it wasn't there.
[30:02.830 --> 30:04.110]  And I figured, okay, fine.
[30:04.590 --> 30:07.990]  You know, this isn't front page news or anything.
[30:08.310 --> 30:10.210]  You know, the story got bumped.
[30:10.850 --> 30:12.630]  I'll get to publish the paper later on.
[30:12.630 --> 30:18.310]  And when I got home, my phone, I had like 12 messages on my answering machine from people.
[30:18.570 --> 30:22.470]  Apparently, it hadn't occurred to me to look on the front page above the fold.
[30:24.250 --> 30:29.130]  And the, so it was in the upper right-hand corner.
[30:29.330 --> 30:31.250]  So, this was like the lead news position.
[30:31.450 --> 30:34.850]  The title of my paper was Protocol Failure in the Escrowed Encryption Standard.
[30:35.110 --> 30:39.690]  The New York Times headline was Flaw Found in Federal Plan for Wiretapping.
[30:39.690 --> 30:50.470]  And, you know, and it actually did a pretty good job of explaining, you know, it was technically pretty right on.
[30:50.610 --> 30:54.990]  But it was clear that this had caused a certain amount of consternation.
[30:55.490 --> 31:03.370]  I was utterly unprepared for the, you know, political world dealing with this.
[31:03.370 --> 31:10.770]  But the interesting thing was that, you know, as long as you stay in the technical world, everyone's motivation is really the same.
[31:12.030 --> 31:18.430]  As soon as you go into the political world or the business world or the economic world, things change rapidly.
[31:18.730 --> 31:20.770]  Now, I got interested in crypto policy.
[31:20.890 --> 31:23.010]  I was interested in the politics of things.
[31:23.010 --> 31:29.910]  So, you know, I was willing to participate in the policy debate.
[31:30.090 --> 31:35.450]  But it was definitely... I learned very quickly that this was not something that I was well trained for.
[31:35.610 --> 31:36.470]  I'll give you an example.
[31:37.130 --> 31:41.210]  We wrote a number of reports.
[31:42.150 --> 31:48.650]  We studied the question of, is key escrow, does the government policy make sense from a technical point of view?
[31:48.650 --> 31:58.130]  So, me and a number of colleagues studied these fairly carefully and came out with a couple of studies of the question.
[31:58.290 --> 32:00.350]  What are the risks and costs of key recovery?
[32:00.590 --> 32:02.670]  What length key do you need?
[32:02.870 --> 32:08.390]  You know, these are sort of technical questions that have some influence on the public policy world.
[32:08.550 --> 32:17.550]  So, aimed at people who make policy about encryption to educate them about the technical realities of this.
[32:17.550 --> 32:30.650]  And the thing that was clearest about this was that the goal of the two worlds was so different that it's very difficult for the two communities to talk to each other.
[32:30.830 --> 32:35.510]  The goal of the technical and scientific world is to deal with sort of objective reality.
[32:35.730 --> 32:36.770]  Figure out what it is.
[32:37.030 --> 32:39.950]  Figure out how to best engineer given objective reality.
[32:40.150 --> 32:43.030]  You don't get to negotiate with objective reality, right?
[32:43.790 --> 32:45.830]  The more you understand it, the better.
[32:46.070 --> 32:47.550]  Learning more things is good.
[32:48.130 --> 32:54.850]  And what we get rewarded for, at least in theory, you know, there's dishonesty in the technical world just like there is anywhere else.
[32:55.010 --> 33:01.570]  But at least in theory, the aim of this and what scientists are supposed to be rewarded for is telling the truth.
[33:01.830 --> 33:04.390]  Being clever about figuring out what the truth is.
[33:04.590 --> 33:08.210]  The political and policy world doesn't have that goal, right?
[33:08.210 --> 33:13.850]  Their goal, rightly so, is not to... Congress is not a scientific body, right?
[33:13.930 --> 33:18.010]  The goal of Congress is not to figure out the value of pi, right?
[33:18.250 --> 33:30.430]  The goal of Congress is that if there is one group that would prefer pi to be three and another group that would prefer pi to be four, figure out which group to make happy, right?
[33:30.430 --> 33:43.330]  And they won't call the mathematicians in to figure out which group to make happy, unless it's absolutely essential.
[33:43.630 --> 33:49.470]  I remember just one last story, and then I hope we can open this up for discussion.
[33:51.190 --> 33:59.710]  I spent a day doing on Capitol Hill with the group that had written one of these reports.
[33:59.710 --> 34:04.650]  We got to brief, among other things, the staffers of the Senate Intelligence Committee.
[34:04.890 --> 34:12.290]  Now, this is a cool experience for a hacker, because these congressional committees meet in really, really cool places.
[34:12.910 --> 34:19.430]  On Capitol Hill, there are these secret briefing rooms that are tempest-enclosed and have multiple walls and barriers.
[34:19.610 --> 34:22.210]  This is just all the stuff out of the movie.
[34:22.390 --> 34:28.270]  The House Intelligence Committee is actually in the dome of the Capitol, and you can't go up there without going past a bunch of guards.
[34:28.270 --> 34:29.470]  It's really interesting.
[34:30.250 --> 34:38.810]  And they have the seals of all these different agencies, some of which don't have public names, so they had to remove a couple of the seals from the walls before they'd let us in.
[34:39.910 --> 34:48.330]  And on the way out, just a quick aside, on the way out, this is with a bunch of pretty prominent scientists who are in this little group.
[34:49.890 --> 35:06.230]  People whose names you've heard of, and all of us, after we got downstairs, had independently and unbeknownst to anyone else, stolen the little notepads from the table that said Senate Intelligence Committee, and one of us got the gavel.
[35:11.850 --> 35:15.210]  So even though it's a very secure room, they don't really lock everything down.
[35:17.330 --> 35:26.870]  But I had thought that this briefing, we had all thought the briefing that we had done had gone really well, because the people involved were engaged and they were asking really tough questions.
[35:27.090 --> 35:31.710]  And in the scientific community, if someone asks you a really hard question, you feel great about it.
[35:31.710 --> 35:37.250]  If somebody gets up and says, I think you're wrong because of this, this, and this, that means you've engaged somebody.
[35:37.350 --> 35:39.330]  That means you're talking about something non-trivial.
[35:39.550 --> 35:42.030]  That means you're really doing your job.
[35:42.470 --> 35:48.730]  In the policy world, it was made clear from the policy person, if somebody asks you a hostile question, it's because they're hostile.
[35:49.930 --> 35:54.550]  And as a technical person, that's something you really have to get used to.
[35:54.790 --> 35:57.710]  So did we find anything to disagree about yet?
[35:59.010 --> 36:00.210]  I don't think so.
[36:00.210 --> 36:01.630]  I concur.
[36:02.690 --> 36:09.550]  You know, the folks who are technical folks or people inside federal agencies are pretty good.
[36:09.670 --> 36:16.230]  They may not be the most competent in the world, but they do share a lot of the geek or scientific technical ethic.
[36:17.790 --> 36:26.570]  One of the problems, though, is if you're really, really good and really, really smart and you can get a six-figure salary, why are you going to take your 50K a year civil service job?
[36:26.570 --> 36:26.950]  Right.
[36:27.250 --> 36:29.590]  Well, some of them are doing it out of a sense of patriotism.
[36:30.270 --> 36:35.550]  You know, there are people who could earn more in the private sector who I've met inside government agencies.
[36:36.310 --> 36:43.190]  You know, and there are bad people in the, I mean, there are no bad people in my company, but there are bad people in companies.
[36:44.450 --> 36:47.370]  And, you know, so, you know, you get a mix everywhere.
[36:47.370 --> 37:02.150]  I think what we have to realize is that you have to, if you're called upon to brief a policymaker, or if you're called, if you're trying to influence policy, you have to understand who your audience is.
[37:02.630 --> 37:15.490]  It's critically important that you not rely on only the kind of argument that's going to sway a technologist in the public policy world.
[37:15.490 --> 37:22.470]  And the trick is doing that in a way that doesn't undermine your own credibility at home, right?
[37:22.690 --> 37:25.510]  It doesn't undermine your own credibility in your own community.
[37:25.770 --> 37:30.970]  People will try to get you to say things that, in your heart, you couldn't say in a straight face.
[37:30.970 --> 37:34.390]  And it's very important to resist the temptation to say them.
[37:35.050 --> 37:40.390]  But you also need to understand that, you know, the first person to...
[37:40.390 --> 37:42.470]  Somebody pointed this out, and it's dead untrue.
[37:42.690 --> 37:48.370]  In a political argument, the first person to use an equation is the one who loses the argument, right?
[37:48.550 --> 37:57.470]  And you don't want to resort to complicated technical explanations of things, even when they're complicated technical problems.
[37:57.470 --> 38:00.770]  We have about nine minutes left, if you guys want to take some questions.
[38:01.310 --> 38:01.770]  Yeah, come on up.
[38:02.070 --> 38:04.310]  Please fight for a space at the microphone.
[38:04.630 --> 38:05.810]  Just climb over people.
[38:06.090 --> 38:06.630]  Be rude.
[38:07.830 --> 38:08.830]  Don't raise your hand.
[38:08.830 --> 38:09.550]  Look at the massive people.
[38:09.550 --> 38:10.950]  You've got to come... you've got to go to the mic.
[38:13.370 --> 38:14.070]  Here's a dude.
[38:16.010 --> 38:18.650]  Matt, how hard was it to keep your job at AT&T?
[38:18.770 --> 38:19.850]  How much did they love you?
[38:20.510 --> 38:20.990]  I mean...
[38:20.990 --> 38:22.950]  Do you have any political problems with them?
[38:22.950 --> 38:32.450]  I work for Bell Labs, which is now... part of it is now called AT&T Labs, which has long had a culture of, you know, scientific honesty.
[38:32.710 --> 38:42.010]  And I was very pleased that, you know, there were people in AT&T who were selling a product based on the clipper chip that I had published a paper disparaging.
[38:42.470 --> 38:49.190]  So I had... not only had I, you know, done something that embarrassed the government, I had done something that disparaged an AT&T product.
[38:49.790 --> 39:03.130]  And, you know, there were people who weren't happy about that in the company, some of whom, you know, would have been happy... you know, I wasn't really worried, seriously worried about being killed by the government, but, you know, the phone company is a little bit of a different story.
[39:04.150 --> 39:15.350]  And I was very pleased that I... you know, the reaction from management in research was, our job is to tell the truth.
[39:16.090 --> 39:17.950]  And, you know, they stood by that.
[39:18.130 --> 39:18.990]  You know, I got a raise.
[39:22.390 --> 39:27.730]  First of all, Declan, thank you very much for Politech, for being one of the few reporters with a clue.
[39:27.910 --> 39:31.670]  I think the man deserves a round of applause for being just...
[39:32.990 --> 39:37.290]  you know... certainly the best technical journalist I can think of.
[39:37.290 --> 39:37.810]  So thank you.
[39:39.230 --> 39:51.110]  My question, in both of your estimations, why do you think the code is speech argument in the DCSS case, now a couple of years old, failed on Capitol Hill in the courts?
[39:52.650 --> 40:02.970]  Well, okay, I'm not directly involved, but my understanding is that the code is speech hasn't completely failed, but it turned out not to be... they decided it on a different issue.
[40:02.970 --> 40:06.470]  I think the courts pretty well recognize that code is speech.
[40:08.830 --> 40:14.470]  What... the unfortunate thing is that's not sufficient to get all the First Amendment protections we'd like for it.
[40:14.650 --> 40:23.270]  And, you know, this is something you should definitely aim at the lawyers to get a subtler understanding of than I'm capable of myself.
[40:23.750 --> 40:27.890]  But, you know, I should just say a quick rant on this.
[40:28.230 --> 40:33.370]  You know, my doctor has told me not to talk about digital rights management because my blood pressure goes up too much.
[40:34.090 --> 40:39.990]  But, you know, back in the crypto debates, it was very frustrating.
[40:39.990 --> 40:49.130]  It took about eight years for, you know, for the policy to go from, you know, really frustrating to reasonably sensible.
[40:50.730 --> 40:57.490]  But there was a sense that the people I was arguing with were arguing in good faith.
[40:58.130 --> 41:02.030]  You know, that the arguments on the other side were pretty well on the table.
[41:02.190 --> 41:12.190]  And it was really a question of, you know, a question of values, a question of what relatively subtle technical arguments you believe.
[41:12.410 --> 41:15.470]  They believed that they were genuinely protecting people.
[41:15.630 --> 41:20.250]  In the case of the digital rights management stuff, oh, God, I just... my blood pressure goes up.
[41:20.250 --> 41:22.010]  You want to say liar, liar, liar.
[41:23.850 --> 41:38.410]  It's hard to imagine that some of the arguments that are made on the, you know, computers are bad because they allow copying, you know, can possibly be made by somebody, you know, without believing that they're lying.
[41:38.810 --> 41:40.650]  But it's very frustrating.
[41:40.790 --> 41:41.610]  I'll give it a shot.
[41:41.610 --> 41:48.190]  Back when Congress was doing the DMCA in 98 is when they got enacted, if I recall properly.
[41:48.670 --> 41:52.310]  Nobody that they were paying attention to was even making the argument.
[41:52.590 --> 41:58.250]  And then when the court considered it, Congress didn't give the court a whole lot of wiggle room.
[41:58.430 --> 42:02.810]  And so that's why I covered the DeCSS trial and the appeals court arguments.
[42:03.090 --> 42:08.150]  And the court did pretty much what most legal scholars expected it to.
[42:09.470 --> 42:21.010]  There's... in terms of the First Amendment code of speech argument, I think the Ninth Circuit and then the Ohio case, Peter Junger's case, also recognized that source code can be speech.
[42:21.510 --> 42:27.070]  But this is just part of the strange First Amendment jurisprudence that the lawyers can talk to you about.
[42:27.170 --> 42:41.430]  You think the First Amendment Congress shall make no law mean something, but you've got all these but except obscenity, harassment, and child pornography threats, copyright, libel, indecency, harmful to minors, all these exceptions into the First Amendment,
[42:41.550 --> 42:42.410]  and that's one of them.
[42:43.710 --> 42:46.550]  So... and Congress is not going to change the DMCA.
[42:46.650 --> 42:50.170]  All the heads of the various subcommittees and committees have said, hey, you know, we like it just fine.
[42:50.190 --> 42:54.510]  They actually held a party on Capitol Hill.
[42:54.630 --> 42:56.130]  I've got photos on McCullagh.org.
[42:56.130 --> 43:04.830]  It was a DM, pro-DMCA hoedown a month or two ago, and they were all pouring champagne and Jack Valenti and Hillary Rosen showed up and gave speeches and all the top Congress critters were there.
[43:05.890 --> 43:06.830]  How'd you get invited?
[43:07.390 --> 43:08.950]  They actually sent out a press invite.
[43:09.050 --> 43:11.170]  I took my camera, only they let me in for some reason.
[43:13.290 --> 43:15.030]  Getting back to Clipper for a second.
[43:15.270 --> 43:24.710]  The deficiency that you found, was that in the SKIPJACK algorithm, the specific implementation of it, or the fabrication of the shit chip, and that that also exists in Capstone.
[43:25.150 --> 43:28.790]  Yeah, the problem wasn't the SKIPJACK algorithm, per se.
[43:29.130 --> 43:35.830]  In fact, I never learned what the SKIPJACK algorithm is until they declassified it several years later.
[43:37.010 --> 43:44.590]  The problem was in the protocol for creating the law enforcement access field.
[43:45.090 --> 43:48.290]  And the way it was set up, there were two things.
[43:48.370 --> 43:51.910]  First, you could spoof one if you had the cooperation of the receiving side.
[43:51.910 --> 43:57.150]  And secondly, the checksum was searchable by exhaustive search.
[43:57.310 --> 44:04.290]  But that was in, essentially, the protocol for exchanging the leaf and the structure of the leaf itself.
[44:04.490 --> 44:07.490]  But the algorithm itself, I treated as a black box.
[44:07.730 --> 44:10.230]  And the chip fabrication, I treated as a black box.
[44:10.410 --> 44:12.130]  And that also was true of Capstone?
[44:12.350 --> 44:14.890]  Yeah, same algorithm, same protocol.
[44:15.590 --> 44:22.050]  It's worth pointing out that I reverse-engineered classified information.
[44:22.650 --> 44:26.050]  Although I didn't have direct access, I never took a security clearance.
[44:26.170 --> 44:28.650]  I reverse-engineered classified information to figure this out.
[44:29.150 --> 44:31.110]  I looked at some documents analytically.
[44:31.750 --> 44:34.030]  I was able to figure out what some of the classified fields were.
[44:34.170 --> 44:35.590]  It wasn't rocket science or anything.
[44:35.830 --> 44:38.070]  It's interesting that that's perfectly legal.
[44:38.530 --> 44:42.770]  If this had been a copyright protection system, then I could go to jail.
[44:43.790 --> 44:44.370]  Thank you.
[44:46.950 --> 44:48.750]  I have a comment and a question, Matt.
[44:49.370 --> 44:57.650]  Surely there are some things at AT&T Bell Labs that are off-limits for research, like, for example, cell phone safety.
[45:00.270 --> 45:05.690]  I think there are limits even on what you can do in Bell Labs, especially in this new, mean, lean time.
[45:06.230 --> 45:08.170]  We're not a cell phone company anymore.
[45:08.310 --> 45:08.690]  Oh, you're lucky.
[45:08.930 --> 45:11.930]  I could probably do cell phone safety without ruffling anything.
[45:12.170 --> 45:12.610]  Oh, that's good.
[45:13.050 --> 45:14.150]  We're a lot of cell phone users.
[45:14.350 --> 45:15.470]  Thank WorldCom for something.
[45:16.130 --> 45:21.890]  So my question, though, is how long do you think it will be before there will be product liability for software?
[45:22.430 --> 45:34.350]  At the moment, even though there's software in everything, somehow all those manufacturers have managed to weasely deny their liability through shrink-wrapped licenses and that sort of thing.
[45:34.590 --> 45:38.810]  And it's been terrible for the industry as far as I can tell, particularly for security.
[45:42.550 --> 45:43.190]  Yeah.
[45:43.190 --> 45:49.890]  There are some subtleties here, and this is not my area.
[45:50.210 --> 45:58.330]  I share your puzzlement at the fact that we have liability pretty much everywhere in life except software.
[45:58.330 --> 46:05.830]  I'm not sure what the unintended consequences of extending liability to software should be.
[46:05.970 --> 46:09.950]  I mean, that's something that economists and lawyers and techies need to study.
[46:10.110 --> 46:22.930]  But I am sure that we're in a terrible situation as far as, you know, internet security with all of these, you know, essentially exploding computers out there.
[46:23.930 --> 46:35.190]  And, you know, running, you know, operating systems that, you know, can not only harm the user of the computer, but if they're hooked up to a DSL link, can harm everyone else on the net.
[46:35.450 --> 46:39.950]  And, you know, the responsibility for that that we have right now is none.
[46:41.290 --> 46:47.930]  To add a brief addition, I don't think that you're going to see Congress saying, oh, yeah, we're going to have product liability for software anytime soon.
[46:48.310 --> 46:53.770]  I'm not sure that what such a rule would do to the free software industry in any case.
[46:53.770 --> 47:01.730]  But there's nothing stopping a software maker from saying in their end user ClickWrap license, yeah, you can sue us.
[47:01.790 --> 47:02.170]  Sure.
[47:02.450 --> 47:03.730]  We're entirely liable.
[47:03.750 --> 47:06.770]  And we're going to charge you $10,000 for this $100 word processor.
[47:06.810 --> 47:07.790]  So it can happen right now.
[47:07.870 --> 47:09.570]  The market does not prohibit it.
[47:09.670 --> 47:13.770]  It's just that nobody seems willing to get that kind of insurance or to get sued.
[47:14.450 --> 47:18.950]  We're going to have to wrap up because in a few moments is the keynote with Aaron McGruder.
[47:19.190 --> 47:21.390]  I want to thank these guys for a great panel.
[47:21.830 --> 47:22.670]  Stick around.