From: prm@ecn.purdue.edu (Philip R. Moyer)
Subject: Re: text of White House announcement and Q&As on clipper chip encryption
Organization: Engineering Computer Network
Distribution: na
Lines: 27

In article <1993Apr17.032022.14021@clarinet.com>, brad@clarinet.com (Brad Templeton) writes:
|>
|> Let's assume, for the moment, that the system really is secure unless
|> you get both halves of the encryption key from the two independent
|> escrow houses.  Let's say you even trust the escrow houses -- one is
|> the ACLU and the other is the EFF.  (And I'm not entirely joking about
|> those two names)
|> 
|> In that case the Prince of Wales has nothing to worry about on this
|> system.

I must respectfully disagree with this assertion, Brad.  The government is
notoriously sloppy with physical, communications, and information security.  They
can't keep their computers safe, and they're "trying".  Read "DEA is
Not Adequately Protecting National Security Information" [GAO/IMTEC 92-31] for an
excellent example of what I'm talking about.

Private sector organizations tend to be even more lax in their security measures.
I believe that the escrow organizations will be penetrated by foreign
intelligence services within months, if not weeks, of their selection.  Private
organizations that lack the resources of a full-fleged intelligence service will
take longer - perhaps on the order of one to two years.  Nonetheless, the
penetrations will take place, without question.

Philip R. Moyer						     ECN Software Staff
Engineering Computer Network				    Voice: 317-494-3648
prm@ecn.purdue.edu					    Fax:   317-494-6440
