Re: [iwar] Computer and Network Security vs. Information Privacy and Confidentiality

From: Fred Cohen (fc@all.net)
Date: 2001-08-10 07:11:11


Return-Path: <sentto-279987-1581-997452685-fc=all.net@returns.onelist.com>
Delivered-To: fc@all.net
Received: from 204.181.12.215 by localhost with POP3 (fetchmail-5.1.0) for fc@localhost (single-drop); Fri, 10 Aug 2001 07:12:10 -0700 (PDT)
Received: (qmail 32692 invoked by uid 510); 10 Aug 2001 13:13:30 -0000
Received: from n3.groups.yahoo.com (216.115.96.53) by 204.181.12.215 with SMTP; 10 Aug 2001 13:13:30 -0000
X-eGroups-Return: sentto-279987-1581-997452685-fc=all.net@returns.onelist.com
Received: from [10.1.4.56] by hj.egroups.com with NNFMP; 10 Aug 2001 14:11:25 -0000
X-Sender: fc@big.all.net
X-Apparently-To: iwar@yahoogroups.com
Received: (EGP: mail-7_3_1); 10 Aug 2001 14:11:24 -0000
Received: (qmail 77612 invoked from network); 10 Aug 2001 14:11:11 -0000
Received: from unknown (10.1.10.142) by l10.egroups.com with QMQP; 10 Aug 2001 14:11:11 -0000
Received: from unknown (HELO big.all.net) (65.0.156.78) by mta3 with SMTP; 10 Aug 2001 14:11:11 -0000
Received: (from fc@localhost) by big.all.net (8.9.3/8.7.3) id HAA27275 for iwar@yahoogroups.com; Fri, 10 Aug 2001 07:11:11 -0700
Message-Id: <200108101411.HAA27275@big.all.net>
To: iwar@yahoogroups.com
In-Reply-To: <20010810075656.43238.qmail@web14510.mail.yahoo.com> from "e.r." at Aug 10, 2001 12:56:56 AM
Organization: I'm not allowed to say
X-Mailer: don't even ask
X-Mailer: ELM [version 2.5 PL1]
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Delivered-To: mailing list iwar@yahoogroups.com
Precedence: bulk
List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com>
Date: Fri, 10 Aug 2001 07:11:11 -0700 (PDT)
Reply-To: iwar@yahoogroups.com
Subject: Re: [iwar] Computer and Network Security vs. Information   Privacy and Confidentiality
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Per the message sent by e.r.:

...
> There is clearly a significant problem when the issue of computer
> security and personal liberties are conflicted. How can we "deconflict"
> this situation, or  without a oversight body, will the net become more
> like the "Dodge City" of old?  It will be people v security v verification.
> This has already become a problem with online businesses.  What's next?

I don't think that there is any doubt that someone's security and other
people's personal liberties are conflicted.  For example, those in the
Federal law enforcement community have, over several generations,
demonstrated their willingness to break the laws they claim to be trying
to enforce in order to dig up dirt on people that were opposed to their
political views.  The extent to which they are now able to invade
privacy is well beyond what it was in the days when the Constitution was
created, and the Constitution was created, in large part, to stop the
government from doing such things to its people.  The big difference is
that it's much more insidious now because it can be done covertly.  No
need to smash in the doors to watch what you do in the bedroom - they
can do it with optical fibers and micro-cameras, or with infrared images
through your walls from the street, or in the case of computers, from
their positions inside your ISPs and phone companies.  They reach out
and touch people they don't like.

I am personally appalled by the abuses I have seen, and I don't see very
much at all compared to people like Martin Luther King and others who
have opposed some of the opressionist views of our government from time
to time.  If you believe that nobody would do that today, you are only
fooling yourself. 

> Tony's possible solution is interesting, but does it require all on the
> net to be as cyber-literate as many on this space? I would like to hear
> any suggestions.

My view, as expressed in a policy decision a year or so ago, was to
advise all of my clients to use encryption whenever they send anything
important and to use it at other times so that the important things
could not be identified so easily.  I now believe that all computers
should be mandated by law to encrypt everything all of the time with
encryption that is sufficiently strong so that the government can break
it only by focusing in on a small number of individuals - say the
number currently authorized by the federal courts for tapping.  It may
not be easy to achieve this balance, but in the end, the people must
protect themselves from the government they elect while the government
must be able to do its legitimate job.

FC
--This communication is confidential to the parties it is intended to serve--
Fred Cohen		Fred Cohen & Associates.........tel/fax:925-454-0171
fc@all.net		The University of New Haven.....http://www.unhca.com/
http://all.net/		Sandia National Laboratories....tel:925-294-2087


------------------------ Yahoo! Groups Sponsor ---------------------~-->
Small business owners...
Tell us what you think!
http://us.click.yahoo.com/vO1FAB/txzCAA/ySSFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/ 



This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:39 PDT