<story><title>NSA&apos;s Backdoor Key from Lotus Notes</title><url>http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html</url></story><parent_chain><item><author>rozzie</author><text>Ray Ozzie here.  Regarding &amp;quot;minitruth&amp;quot; - you&amp;#x27;ve got to maintain a bit of a sense of humor when things get stressful.&lt;p&gt;It was such a long time ago, but one thing that clearly differentiates our efforts in those days vs. what&amp;#x27;s been reported in the news in the past few days is the issue of transparency.&lt;p&gt;The day we shipped the &amp;quot;differential workfactor&amp;quot; implementation in Notes, I keynoted the RSA Conference and gave a speech laying out what we did and why. Charlie Kaufman, a great cryptographer who worked for me, also distributed a paper he wrote with the technical details.  You can find my speech and his paper buried in here if you&amp;#x27;re interested.  (search for &amp;quot;lotus.notes&amp;quot;)&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;web.textfiles.com&amp;#x2F;ezines&amp;#x2F;HWA&amp;#x2F;hwa-hn19.txt&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;web.textfiles.com&amp;#x2F;ezines&amp;#x2F;HWA&amp;#x2F;hwa-hn19.txt&lt;/a&gt;&lt;p&gt;And if you&amp;#x27;re really motivated to understand what it was like during the Crypto Wars, go read Steven Levy&amp;#x27;s book &amp;quot;Crypto&amp;quot;.&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.stevenlevy.com&amp;#x2F;index.php&amp;#x2F;books&amp;#x2F;crypto&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.stevenlevy.com&amp;#x2F;index.php&amp;#x2F;books&amp;#x2F;crypto&lt;/a&gt;&lt;p&gt;Back to the present - it pains me to see such a lack of transparency in how our elected officials are running our government.  Of course, the common man knows it&amp;#x27;s common sense that there&amp;#x27;s an inherent need for secrecy in conducting small scale covert operations.  We do get it.&lt;p&gt;However, it&amp;#x27;s also common sense that it&amp;#x27;s inevitable that any complex large-scale long-term operation will ultimately come to light.  And so it&amp;#x27;s just common sense that any such broad-based operations that might be perceived as impacting our constitutional rights should be the subject of broad public debate.  No, not when they&amp;#x27;re being prototyped or tested or used in small scale settings - but definitely somewhere on the path from &amp;quot;tactical use&amp;quot; to &amp;quot;broad strategic dependence&amp;quot;.&lt;p&gt;These are not small issues, nor need they be at all partisan.  Wyden, Paul, and others are trying.  Theses issues are fundamental to defining the relationship between us citizens and our government in the decades ahead.&lt;p&gt;In particular, in this world where &amp;quot;SaaS&amp;quot; and &amp;quot;software eats everything&amp;quot; and &amp;quot;cloud computing&amp;quot; and &amp;quot;big data&amp;quot; are inevitable and already pervasive, it pains me to see how 3rd Party Doctrine may now already be being leveraged to effectively gut the intent of U.S. citizens&amp;#x27; Fourth Amendment rights.  Don&amp;#x27;t we need a common-sense refresh to the wording of our laws and potentially our constitution as it pertains to how we now rely upon 3rd parties?  It makes zero sense in a &amp;quot;services age&amp;quot; where granting third parties limited rights to our private information is so basic and fundamental to how we think, work, conduct and enjoy life.&lt;p&gt;For example, did you really intend to yield your 4th amendment rights when you granted a 3rd party access to your files as a part of Mac Software Update, Windows Update, Virus Scanners, etc., or when you started using a service-tethered smartphone?&lt;p&gt;Anyway, unlike &amp;#x27;web tracking&amp;#x27; issues which seem to be broadly ignored because of our love for ad-supported services, I hope we all (especially the young readers of reddit, hackernews, etc) wake up to the fact that these privacy and transparency issues are REAL, and that they truly will impact you and the country you live in, and that even if you don&amp;#x27;t consider yourself an activist you really should get informed and form an opinion.  Again, this is a non-partisan issue, and let&amp;#x27;s all work to ensure that it stays this way.&lt;p&gt;Two great organizations where you can learn are EPIC and EFF.  (Disclosure: I am on the board of EPIC.)  Take it in, and think.  Your contributions are needed and would of course be quite welcome.&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;epic.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;epic.org&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;eff.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;eff.org&lt;/a&gt;</text></item></parent_chain><comment><author>benjamincburns</author><text>First, thanks for recommending Steven Levy&amp;#x27;s &lt;i&gt;Crypto&lt;/i&gt;. It&amp;#x27;s a historical account that I think more hackers need to read.&lt;p&gt;I&amp;#x27;m probably on the hairy edge of the &amp;quot;young readers&amp;quot; you&amp;#x27;ve mentioned. I&amp;#x27;m 27. My present view on the recent NSA leaks is a distinct lack of outrage, but watching this huge response I can&amp;#x27;t help but feel the &lt;i&gt;whoosh&lt;/i&gt; as something big flies straight over my head.&lt;p&gt;I&amp;#x27;ve agreed to use technology which by its very nature monitors my activity in all kinds of ways. As a software engineer who does a lot of web work and dabbles in cell-enabled embedded systems, I understand and I&amp;#x27;m fully aware of most of the ways I&amp;#x27;m being monitored. Maybe I&amp;#x27;m naïve to think of the recent data sharing between corporations and government as a non-issue, but if this is such a big deal wasn&amp;#x27;t I just as naïve by allowing these corporations to collect this information in the first place?&lt;p&gt;This isn&amp;#x27;t the Clipper Chip or key escrow. This isn&amp;#x27;t the government grappling for an ear into conversations which nobody except Alice and Bob are intended to transceive. You could argue that were I Bob, Alice is the phone company, but I have no freaking clue who &amp;quot;the phone company&amp;quot; really is. To me it&amp;#x27;s just a faceless entity who I&amp;#x27;ve allowed to collect data about me. I&amp;#x27;m finding it hard to become angry over one faceless entity sharing said data with another faceless entity. And frankly, I have no clue if I&amp;#x27;ve already agreed for this to happen because I don&amp;#x27;t really care. I &lt;i&gt;expect&lt;/i&gt; them to share a ridiculous amount of information about me without abandon. I&amp;#x27;d be far more upset if they were sharing content of actual conversations, but metadata feels firmly within the realm of what I expect to be slung around willy-nilly.&lt;p&gt;I agree that this reasoning is wholly a &amp;quot;death by a thousand cuts&amp;quot; brought on by more and more invasive technologies. As an anecdote, many Facebook early adopters will remember the outrage over the news feed when it was first launched. Now can you imagine the outrage that would ensue if Facebook were to take it away? We&amp;#x27;re pretty much begging for invasive technology in our lives. How do you propose to correct that? How do we get millions of people to &amp;quot;vote with their feet&amp;quot; against useful-but-invasive technologies?</text></comment>
<story><title>NSA&apos;s Backdoor Key from Lotus Notes</title><url>http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html</url></story><parent_chain><item><author>rozzie</author><text>Ray Ozzie here.  Regarding &amp;quot;minitruth&amp;quot; - you&amp;#x27;ve got to maintain a bit of a sense of humor when things get stressful.&lt;p&gt;It was such a long time ago, but one thing that clearly differentiates our efforts in those days vs. what&amp;#x27;s been reported in the news in the past few days is the issue of transparency.&lt;p&gt;The day we shipped the &amp;quot;differential workfactor&amp;quot; implementation in Notes, I keynoted the RSA Conference and gave a speech laying out what we did and why. Charlie Kaufman, a great cryptographer who worked for me, also distributed a paper he wrote with the technical details.  You can find my speech and his paper buried in here if you&amp;#x27;re interested.  (search for &amp;quot;lotus.notes&amp;quot;)&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;web.textfiles.com&amp;#x2F;ezines&amp;#x2F;HWA&amp;#x2F;hwa-hn19.txt&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;web.textfiles.com&amp;#x2F;ezines&amp;#x2F;HWA&amp;#x2F;hwa-hn19.txt&lt;/a&gt;&lt;p&gt;And if you&amp;#x27;re really motivated to understand what it was like during the Crypto Wars, go read Steven Levy&amp;#x27;s book &amp;quot;Crypto&amp;quot;.&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.stevenlevy.com&amp;#x2F;index.php&amp;#x2F;books&amp;#x2F;crypto&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.stevenlevy.com&amp;#x2F;index.php&amp;#x2F;books&amp;#x2F;crypto&lt;/a&gt;&lt;p&gt;Back to the present - it pains me to see such a lack of transparency in how our elected officials are running our government.  Of course, the common man knows it&amp;#x27;s common sense that there&amp;#x27;s an inherent need for secrecy in conducting small scale covert operations.  We do get it.&lt;p&gt;However, it&amp;#x27;s also common sense that it&amp;#x27;s inevitable that any complex large-scale long-term operation will ultimately come to light.  And so it&amp;#x27;s just common sense that any such broad-based operations that might be perceived as impacting our constitutional rights should be the subject of broad public debate.  No, not when they&amp;#x27;re being prototyped or tested or used in small scale settings - but definitely somewhere on the path from &amp;quot;tactical use&amp;quot; to &amp;quot;broad strategic dependence&amp;quot;.&lt;p&gt;These are not small issues, nor need they be at all partisan.  Wyden, Paul, and others are trying.  Theses issues are fundamental to defining the relationship between us citizens and our government in the decades ahead.&lt;p&gt;In particular, in this world where &amp;quot;SaaS&amp;quot; and &amp;quot;software eats everything&amp;quot; and &amp;quot;cloud computing&amp;quot; and &amp;quot;big data&amp;quot; are inevitable and already pervasive, it pains me to see how 3rd Party Doctrine may now already be being leveraged to effectively gut the intent of U.S. citizens&amp;#x27; Fourth Amendment rights.  Don&amp;#x27;t we need a common-sense refresh to the wording of our laws and potentially our constitution as it pertains to how we now rely upon 3rd parties?  It makes zero sense in a &amp;quot;services age&amp;quot; where granting third parties limited rights to our private information is so basic and fundamental to how we think, work, conduct and enjoy life.&lt;p&gt;For example, did you really intend to yield your 4th amendment rights when you granted a 3rd party access to your files as a part of Mac Software Update, Windows Update, Virus Scanners, etc., or when you started using a service-tethered smartphone?&lt;p&gt;Anyway, unlike &amp;#x27;web tracking&amp;#x27; issues which seem to be broadly ignored because of our love for ad-supported services, I hope we all (especially the young readers of reddit, hackernews, etc) wake up to the fact that these privacy and transparency issues are REAL, and that they truly will impact you and the country you live in, and that even if you don&amp;#x27;t consider yourself an activist you really should get informed and form an opinion.  Again, this is a non-partisan issue, and let&amp;#x27;s all work to ensure that it stays this way.&lt;p&gt;Two great organizations where you can learn are EPIC and EFF.  (Disclosure: I am on the board of EPIC.)  Take it in, and think.  Your contributions are needed and would of course be quite welcome.&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;epic.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;epic.org&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;eff.org&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;eff.org&lt;/a&gt;</text></item></parent_chain><comment><author>philangist</author><text>I&amp;#x27;m a coder and one of the young redditors&amp;#x2F;HN readers you&amp;#x27;re talking about (18 years old). I&amp;#x27;ve grown up in a post-9&amp;#x2F;11 world so it can be sometimes hard for me to understand that there was a time that it wasn&amp;#x27;t assumed the government wasn&amp;#x27;t conducting mass surveillance. How do you approach the problem of making this a real issue for most people my age? And as technologists, how can we help develop solutions to intrusive government policies like this?</text></comment>