Make no mistake; this is a well written and very well researched book
that addresses the issues cited in the title in a very thorough
fashion. Although there appears to be little that is truly new in the
book, it does bring together a diverse collection of information from
many sources, in an effort to provide a high level guide to this complex
topic. Over 20% of the book is devoted to endnotes and
bibliographic references! The authors are both quite knowledgeable
about the subject matter and they bring a crisp, easy-to-read style to
this writing endeavor.
However, the claim made in the introduction that this is balanced treatment
of the topic is not quite accurate. It is probably
unrealistic to expect to find authors who know this subject as well
as these two, and yet who do not bring their personal biases to the task
of writing a book of this sort. These authors have excellent
credentials, but they bring to this topic publicly documented
positions that are hardly neutral, and the text reflects these biases.
Nonetheless, this is an excellent book.
The timing of the release of this book is somewhat ironic, in that British
government cryptographers have just released material that
claims to document their invention of public-key cryptography circa
1970, six years before Whit Diffie (a co-author of this book) and
Marty Hellman published their own "invention" of the subject area.
The British account is consistent with comments made by Adm. Bobby Inman,
former director of the NSA, re the invention of this technology in the
classified world. There is at least one point in the book where it
is suggested that the NSA has not chosen to release the details of its
public key scheme, Firefly, because of possible patent
issues. However, if the public statements of the British and
of Admiral Inman are true, the academic community rediscovered, but did
not invent, both the concept of public-key cryptography and it's best
known implementations (the Diffie-Hellman and RSA algorithms).
The second chapter explores cryptography, providing a brief but good
historical overview of the subject without overloading the reader. It
uses analogies and simple examples to explain various styles of cryptosystems,
including one-time pads, code books, Vigenere and
substitution ciphers, shift registers, modern block ciphers, and public-key
cryptography. The key distribution problem is examined and
examples of military key distribution systems are used illustratively.
However, when this chapter goes beyond purely technical discussions,
the quality of the writing is not so high. For example, discussions
of the impact of government policy on the use of cryptography are
presented without supporting citations, in contrast to the footnote
and reference-laced tone of much of the book. A quote stating that the
likely market for commercial cryptography is much bigger than the government
market, a statement likely to be true, is not substantiated
not by a commercial supplier of such technology, but by a British academician
who is a well known gadfly of (US and UK) government
crypto policies.
The cryptography and public policy chapter shows some of the authors
prejudices, but is still well written. It introduces some additional
details of modern cryptography in tracing the history of the development
of the DES. This chapter traces the evolution of major
government cryptographic programs and of some notable policy points
through the 70s, 80s, and into the 90s. Much of the chapter focuses on
the policy issues in which the government, especially NSA, is portrayed
as the heavy. Some details are questionable, e.g., the authors suggest
that NSA's Firefly public-key management may have been classified, in part,
to avoid paying royalties. The authors know that it is common practice
for NSA to classify all algorithms used to protect classified data. Moreover,
even if Firefly technology were
covered by the public-key patents issued in the early 80s, the U.S.
Government had royalty-free use of such technology due to the funding
that supported the research that led to these patents.
Chapter four addresses the topic of national security and is chock full
of tidbits about intelligence, especially relating to electronic
interception of communication. It provides detailed analysis
of what sorts of problems face an eavesdropper, from the perspective of
a
outside observer who has thought through the process. Of course
the authors lack first-hand access to authoritative information on the
topic; but if they did, they would not be able to write about it!
Chapter five, on law enforcement, provides a very good history of the
evolution of electronic surveillance in this context. It traces the
court cases and legislation that have shaped the current constraints
on legal wiretaps, and provides excerpts from Supreme Court decisions (and
dissenting opinions) that have been critical in establishing the law in
this area.
The next chapter, on privacy protection and threats, takes on a much broader topic. Here the authors explore a number of issues related to personal privacy. This discussion provides good balance to the narrow focus of much of the rest of the book, noting the many ways in which personal privacy can be lost irrespective of the use of cryptography or wiretaps. This is a brief chapter and other writings have explored these issues in greater depth, but this chapter does provide a good overview of many aspects of the topic.
Chapter seven brings the authors back to their favorite subject, wiretapping,
the subtitle of this book. The scope of this chapter
extends over a century of law in this area, from the late 1800s through
the late-1980s. The authors examine the history of wiretap law
and recount excesses of the law enforcement and national security communities
with regard to domestic electronic surveillance. From
Olmstead to ECPA, this chapter traces the use of wiretaps in criminal
investigations, including the rising focus on organized crime, and the
growing restrictions placed on wiretaps through federal law and Supreme
Court decisions.
Chapter eight focuses on contemporary issues in wiretapping, with more
detailed citations from legal cases and ACLU and EPIC reports. The picture
painted here is that wiretaps are not as useful as the FBI and other law
enforcement agencies would have us believe. The authors argue that
wiretaps are not so critical in most cases, that the statistics and official
statements on the subject overstate the
effectiveness and importance of wiretaps (vs. other forms of surveillance).
However, most of the statistics and anecdotal evidence
cited here seem to be just as subject to interpretation by the authors
to support their position as are the numbers and evidence offered by
law enforcement. The chapter examines the so called "digital telephony"
issue, a demand from law enforcement that common carriers
continue to provide authorized wiretap access to calls as telephony
transitions from the analog to the digital domain. Despite passage
of
the CALEA legislation in 1994, this issue is still the subject of ongoing
negotiations between phone companies and law enforcement.
The penultimate chapter addresses contemporary cryptography and public policy issues, paralleling chapter eight. The chapter begins with a review of the history of PGP and goes on to discuss the escrowed encryption standard (EES), the Clipper and Capstone chips, and several peripheral topics, e.g., SDNS and MISSI. The EES and the chips that were designed to support it are well documented, although there is no discussion of the recovery side of the system, i.e., the safeguards put in place to ensure that law enforcement access is authorized, audited, etc. The discussion of the politics associated with the ESS and with later Government activities in the area of key recovery is slightly out of date. For example, the chapter argues that talk of a FIPS for key recovery is "odd" and not credible, yet a committee to develop such a FIPS was created and held its first public meeting in December 1996, amid some fanfare. It's a pity that a book hitting the streets a year later contains a comment of this sort. The discussions of MISSI and SDNS are very brief and not completely accurate. For example, while it is true the goal of SDNS was to develop a new generation of cryptographically secure data communication protocols, the broader goals of MISSI did not rely entirely on the use of PCMCIA crypto tokens. The chapter concludes with an examination of the international scene vis a vis crypto policy. As might be expected, many of the assertions of U.S. influence in this sphere are not easily substantiated with the sort of footnotes and citations that mark much of the rest of the book.
In the concluding chapter, the authors make their case as a preface,
then go on to provide their analysis of the arguments put forth by the
government (intelligence and law enforcement) and by privacy advocates.
The preface is decidedly one-sided, and repeats several
questionable arguments. For example, in arguing against CALEA, the
claim is made that it expands the capabilities traditionally available
to law enforcement. The other side of this argument is that CALEA requires
phone companies to provide the same level of access in a
digital communication context that was available in an analog context.
Similarly, the authors dredge up governmental violations of personal
privacy over the last 50 years, without simultaneously noting the shift
in laws and public perceptions that have made such violations illegal and
resulted in closer monitoring of wiretaps. With this sort of preface,
it is not surprising that the presentation of "the government's case" concludes
that the case is very weak indeed. The privacy arguments call for a revision
of wiretap laws (making them more restrictive) and an broadened interpretation
of constitution freedoms ("the right to bear keys?").
As noted above, this is a well written book, an easy read. It provides
the reader with a basic understanding of many related topics, a
substantial number of references, and the authors' views of the issues
underlying the wiretapping vs. cryptography debate. I recommend it,
if viewed as a persuasive essay on this topic, written from a particular
perspective, not as a balanced examination of the issues.