Phil Zimmermann

Woah, I didn't know that Joe Biden was the sponsor of the exact bill that Phil Zimmerman referenced in his essay, “Why I Wrote PGP”.

From the OP:

“On the other hand, as a senator in the 1990s, Vice President Joe Biden introduced a bill at the FBI's behest that echoes the bureau's proposal today. Biden's bill said companies should "ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." (Biden's legislation spurred the public release of PGP, one of the first easy-to-use encryption utilities.)”

The bill:

S.266
Latest Title: Comprehensive Counter-Terrorism Act of 1991
Sponsor: Sen Biden, Joseph R., Jr. [DE] (introduced 1/24/1991) Cosponsors (3)

From Zimmerman's essay:

“Senate Bill 266, a 1991 omnibus anticrime bill, had an unsettling measure buried in it. If this non-binding resolution had become real law, it would have forced manufacturers of secure communications equipment to insert special "trap doors" in their products, so that the government could read anyone's encrypted messages. It reads, "It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." It was this bill that led me to…

I remember the pushback in the 90s against the Clipper chip. PGP was one of the responses to the NSA's overreach. I think it's hard to find people who cares about this today because there appears to be both a general lack of historical literacy combined with the fact that a lot of people are just grinding to stay alive right now.

"The government knows what a pivotal role cryptography is destined to play in the power relationship with its people. In April 1993, the Clinton administration unveiled a bold new encryption policy initiative, which had been under development at the National Security Agency (NSA) since the start of the Bush administration. The centerpiece of this initiative was a government-built encryption device, called the Clipper chip, containing a new classified NSA encryption algorithm. The government tried to encourage private industry to design it into all their secure communication products, such as secure phones, secure faxes, and so on. AT&T put Clipper into its secure voice products. The catch: At the time of manufacture, each Clipper chip is loaded with its own unique key, and the government gets to keep a copy, placed in escrow. Not to worry, though–the government promises that they will use these keys to read your traffic only "when duly authorized by law." Of course, to make Clipper completely effective, the next logical step would be to outlaw other forms of cryptography." -Phil Zimmerman, Why I Wrote PGP [0]

[0]…

Not sure what to believe here but we do know that the NSA and authorities do need to have access to data for security. If there are systems that aren't apt to putting in backdoors or trapdoors then they treat you like Phil Zimmerman in the 90's by dropping the DOJ on you: http://www.philzimmermann.com/EN/faq/index.html + http://en.wikipedia.org/wiki/Phil_Zimmermann or at least that was the MO at that time.

But the DOJ and US Customs dropped the case against Zimmerman in '96. Obviously they would need to go with a new plan of attack after that method failed for intercepting messages in algorithms and software that is closed or running new algorithms like PGP. Backdoors and trapdoors in software that wraps crypto algorithms is one prong in that attack. The NSA neither confirms nor denies trapdoors, backdoors, etc but DOES employ some of the top cryptographers in the world.

In 2000, the U.S. government lifted the export controls on strong crypto, so (pure speculation) other methods to intercept communications were/are needed. The alleged event here happened in 2000/2001 which might fit with a new MO.

> Web code written in any language without a well-integrated string data type. strcpy() is a target painted on my back if I did that.

Writing a URI parser in C which extracts hostname, port, and path is about the upper limit of what I want to do there.

I've done it, it works, I learned about strstr(3) in the process, and I don't want to do it again.

http://man7.org/linux/man-pages/man3/strstr.3.html

> Anybody who claims they've got amazing new data- or media= compression technology and wants funding for it.

Encryption is probably worse for snakeoil, but I like reading about crypto snake oil. Schneier has a good series on it called The Doghouse. Example entry:

https://www.schneier.com/blog/archives/2019/09/the_doghouse_cr_1.html

Phil Zimmermann (PGP) has an essay on recognizing it:

https://philzimmermann.com/EN/essays/SnakeOil.html

djb even has a competition:

https://snakeoil.cr.yp.to/

To see the full quote, click on the loc.gov linked URL to Biden's bill, then "text of legislation," then "printer friendly."

You'll see this text:
"It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law."

Vice President (then Senator) Biden's bill was what led Phil Zimmermann to publish PGP, as he wrote here in the original 1991 PGP User's Guide:

*"It was this bill that led me to publish PGP electronically for free that year, shortly before the measure was defeated after vigorous protest by civil libertarians and industry groups." http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

The more things change...

Not as far as I know:

> It was this bill that led me to publish PGP electronically for free that year [1991]

https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

> It was on this day in 1991 that I sent the first release of PGP to a couple of my friends for uploading to the Internet. First, I sent it to Allan Hoeltje, who posted it to Peacenet, an ISP that specialized in grassroots political organizations, mainly in the peace movement. [...] Then, I uploaded it to Kelly Goen, who proceeded to upload it to a Usenet newsgroup that specialized in distributing source code.

https://www.philzimmermann.com/EN/news/PGP_10thAnniversary.html

Symantec later bought it and things changed, but thanks to there being an open standard (OpenPGP) and RFCs, people can and did write compatible software. With varying degrees of compatibility, admittedly.