I asked this question of my network security brethren, post Sept. 11th and how much more crappy legislature do we have to deal with? First came along the Patriot Act which generalized a description of a terrorist so that practically anyone could fit the bill.

And now comes along a new piece of legislature that is going to be introduced to the senate. In this piece of Legislature it will supposedly make the use of cryptographic material during a crime an additional felony. This means that if you break any law and in the process at anytime use a form of encryption you will gain an additional felony offense.

Once again this legislature has broad definitions of the word encryption. They have in essence included any form of Encryption, Including encryption that may be used during authentication methods with programs. So if you're using PKI or SSL or another form of encryption and you perform a crime, no matter how minor, you could possibly be facing felony charges in addition to the crime you were originally charged with.

Now many people would say that if you are on the straight and narrow, then there’s nothing you should worry about. But, that’s not the point here. The point is, that the government continues to use a generalized approach to drafting legislature. Instead of attempting to invent new ways for attaching additional penalties to crimes, they should just stiffen penalties for already existing crimes.

An article in Security Focus, properly illustrated this point.
View original article at: http://www.securityfocus.com/columnists/145
Mark Rash gives us an example of how far this legislature can go.

If you're purchasing a book from Amazon.com, and perhaps decide not to click on the “include sales tax” button. And you were then caught. You can then be charged with a felony criminal offense. The reason being that during the transaction you used SSL. This is a 128 bit encryption algorithm. Hence, you used encryption during the commission of your crime. Obviously this illustration makes it painfully apparent how ridiculous this piece of legislation is.

Now I'm not saying encryption will not be used during terrorist activities or criminal activities. My point is that this legislation does nothing to prevent that, and nor does it strike any additional fear in the heart of the criminal. So such useless legislature will hopefully never get past.

Blake Wiedman
Founder Governmentsecurity.org

[Back to list]