A closely watched revolution

Internet eavesdropping is a government imperative worldwide, but two western democracies fumble their arguments and mistakenly assume Internet surveillance is a substitute for skillful investigation.

U.S. government officials dote on American prowess in telecommunications and the good it brings the world. In September 1996, the former chairman of the FCC, Reed Hundt, told Britain's Royal Institute of International Affairs that the communications revolution was: "The most global since the Russian, the most liberal since the French, ...the most American since the American. We will spread this revolution to every city and town, village, and farm." But the counter-revolution is underway. In a networked world where the Internet is vital infrastructure, protecting it should be the first objective, but law enforcement wants to eavesdrop on the Internet and control encryption products. Such laws have been passed or are under consideration in Japan, the United States, Canada, Britain, and other European countries.

Last September, the U.S. Department of Justice (DoJ) proposed a law giving it the right to preview encryption software before it is sold in the markets, so law enforcement always has the code to any encrypted message. The DoJ justifies the legislation, "The Cyberspace Electronic Security Act of 1999," by proposing that "Congress find the following: The Internet...exposes U.S. citizens...to un precedented risks...encryption...protect[s]...privacy...It has also been used to...hide unlawful activity by terrorists, drug traffickers, child pornographers...In the context of...stopping a terrorist attack or seeking to recover a kidnapped child, time is of the essence and may mean the difference between success and catastrophic failure."

These are serious concerns, but the DoJ blundered by associating its need for communications interception with crimes having scant history of requiring interception. The Administrative Office of the United States Courts tallies all court orders by crime for interception of electronic, wire, and oral communications. In 1998, there were 1329 orders: 955 for narcotics, 153 for racketeering, 93 for gambling, 53 for homicide, 19 for larceny, 12 for extortion, nine for bribery, five for kidnapping, and 30 for other types. Narcotics or drug trafficking is the only match between the DoJ's proposed congressional findings and the court data.

Terrorism and child pornography are absent from the court's report, but the DoJ explicitly links these emotion-laden issues with the "time is of the essence" argument, laying the basis for insinuations that opponents of the Cyberspace Act bear moral culpability for crimes that could be prevented. However, the three most obvious cases of terrorism in the United States--the World Trade Center bombing, the Una Bomber, and the Oklahoma City bombing--were solved through investigation, not through Internet surveillance.

Thus the Act's opponents see it as "prior restraint," a practice where lawful behavior is restricted in anticipation that it leads to unlawful behavior (U.S. courts consider prior restraint a violation of the First Amendment of the Constitution). Opponents also fear the Act will allow government to bypass subpoenas required to access company business records or to conduct economic espionage. The DoJ does not share these concerns and considers the Act an "appropriate means...to fulfill...law-enforcement objectives, consistent with existing legal authorities and constitutional principles."

Britain's government plans major changes in its Communications Interception law. The government will maintain a registrar of "approved providers of cryptography support services" and the British Secretary of State will have a duty "to secure that there are arrangements in force granting approvals," such arrangements apparently being determined solely by the government. The British Home Office issued a consultation paper to explain and justify its call for new legislation. Like the U.S. DoJ, the Home Office refers to narcotics and terrorism but makes the same mistake the DoJ did--not supporting its argument with statistics. The consultation paper reads: "Interception is used by law enforcement, security, and intelligence agencies in their work against serious crime, and threats to national security, including terrorism...Lawful interception played a part...in...1200 arrests, seizure of [115] tonnes of drugs [and] 450 firearms." No claim is made that these incidents reflect terrorism or national security. The British and American governments' public arguments for preemptive control of encryption software and Internet snooping do not rely on hard evidence but instead resort to an anxiety-driven syllogism: Drug traffickers use encryption on the Internet, drug traffic threatens public safety, and encryption on the Internet threatens public safety.

Each government's policy has an unspoken assumption: Public safety is more protected by electronic eavesdropping than by keeping tabs with a network of narks, a system lampooned nearly 300 years ago by Jonathan Swift in his satire, Gulliver's Travels. Swift, a British subject, wrote of a kingdom where the "bulk of the people consisted wholly of discoverers, witnesses, informers, accusers, prosecutors...all under the...pay of Ministers." But he also satirized his government's interception of written communications, suggesting it would transform mundane messages into provocative ones: "They can decipher all initial letters into political meanings...N shall signify a plot...L a fleet or...by transposing the letters of the alphabet...they can discover the deepest designs of a discontented party...If I should say in a letter to a friend, our brother Tom has just got the piles...the same letters which compose that sentence may be analyzed into the following words: Resist, a plot is brought home."

Swift's satire implies trouble for law enforcement: There will be billions of messages with ambiguous meanings or double entendre but no ready way to ensure their equal and impartial interpretation. Identical phrasings by two different sources may not have identical meaning. Thus electronic information gathering is no substitute for human intelligence. Also, the volume of Internet data will grow enormously when video streams are treated as data and encrypted. Thus steganography, the art of hiding messages in images, will grow because technical circumstances will be ripe for steganographic exploitation.

The Advanced Television Standards Committee took years to agree on 18 digital-TV formats to be hardwired into digital-TV sets. But according to one company's filing in the FCC's docket CS 98-120, "In the Matter of Carriage of the Transmissions of Digital Television Broadcast Stations," software can create any number of digital formats, so the 18 hardwired formats may be superseded by thousands of software-created formats. Producers could encode a movie to be seen only by viewers with the right key. Would-be interception laws may require video producers sending movies over the Internet to supply the encryption codes to law enforcement, a huge task that would cause the video industry to holler "censorship." Of course, a video message's bit count dwarfs the bit count of a text message. Internet surveillance will not be easy when end users send home-grown videos across the network. Finally, end-to-end proprietary fiber networks are secure and need no encryption, provided there are no hidden taps. Thus, law enforcement may be denied data, or drown in unanalyzed data and clamor for more resources to soak up the information deluge.

Help may come from an inside source. The Internet Engineering Task Force (IETF), a standards-setting body, recently considered whether it should "support mechanisms whose primary purpose is to support wiretapping or other law enforcement activities." IETF's chairman, an engineer for Cisco said, "It is only logical that the subject has to come up. We are deciding to bring it up proactively rather than reacting to something later in the game." An FBI spokesman chimed in saying the IETF's choice was "a wise and prudent move."

A worldwide Internet standard for snooping is unlikely given the conflicting interests of countries such as China, Britain, Japan, and the U.S. National Standards will control, as Mr. Hundt said in his London speech: "Foreign-owned networks are just as subject as domestic-owned networks to any nation's privacy laws or police powers."

Stephen N. Brown writes on public policy in telecommunications. He can be contacted by e-mail at [email protected] or telephone: (615) 399-1239.