Subject: [Raven] [FYI] NL: Intelligence agency authorized to scan satellite communications

From: William Allen Simpson <[email-masked]>
Date: Tue, 11 Apr 2000 15:41:04 -0400

Wasn't that a Dutch national that said this would never happen 
in a civilized country???

-------- Original Message --------
Subject: [FYI] NL: Intelligence agency authorized to scan satellite communications
Date: Tue, 11 Apr 2000 20:15:30 +0100
From: "Axel H Horns" <[email-masked]>

http://www.heise.de/tp/english/inhalt/co/6731/1.html  

Echelon in Holland  

Jelle van Buuren   11.04.2000  

Dutch intelligence agency authorized to scan satellite communications 

The Dutch Intelligence Agency BVD is getting new powers. Among other 
things, the powers to intercept communications will be extended. The 
agency is authorized, if the government gets its way, to intercept 
satellite communications at random and search the intercepted traffic 
by keywords. Also, the BVD gets a new intelligence task: the 
gathering of economical information. Holland goes Echelon, it seems.  

The new 'Act on the intelligence and security agencies' (WIV), which 
is currently debated by Dutch parliament, gives the powers of the BVD 
a new legal basis. Actually, it means mainly the extension of 
investigative powers. In each amendment on the original proposal, new 
powers are given. For instance, in the first draft of the new Act, 
the BVD got the power to intercept, record and listen into 
telecommunications. In the latest amendment, from the beginning of 
this year, the power to 'receive' telecommunications was added. This 
means the BVD is authorized to directly pluck telecommunications, for 
instance GSM-traffic, out of the air. In this way, the BVD is no 
longer dependent on the willingness of telcom operators to intercept 
traffic, but can create for instance their own parallel network of 
receivers to intercept all GSM-traffic. Also, this prevents providers 
from 'leaking' about the fine work the BVD is doing in this area.  

[...]

Encryption  

The new powers of the BVD are also interesting because some articles 
are related to cryptography and information technology. The BVD is 
authorized to break into homes and offices to bug keyboards. Besides 
that, the BVD is authorized to break into computers and steal, alter 
or delete information that is stored in computers. In other words, 
the BVD is allowed to hack. In this way, the intelligence agency can 
steal data from computers, manipulate software, corrupt passwords or 
install a Trojan Horse, so access is secured and cryptography can be 
bypassed.  

Cryptography is a topic of special interest for the BVD. In the draft 
Act, the power to undo encryption is being extended. In the first 
proposal the BVD got the authority to decrypt encrypted communication 
and data "by technical means". In the latest amendment this is 
extended to decryption "by all possible means". According to the 
explanatory note, "practice has shown there are other ways than just 
technical means to decrypt encrypted communications."  

This cryptic description seems to be directed at infiltrators who 
diddle out passwords, or look over the shoulder when messages are 
encrypted, or intelligence teams breaking into homes and offices in 
search of the little piece of paper the password is written on.  

The articles on the interception of telecommunication also contain 
remarks on cryptography. Encrypted messages may be kept in storage as 
long as is necessary for the BVD to decrypt them. The explanatory 
note says:  

"Where telecommunication is concerned, of which the encryption is not 
undone, and where the mere fact that cryptography has been used makes 
this communication interesting for the agency, it is desirable to 
save this communication to the moment the capacity exists or is being 
developed to decrypt the communication."  

So the use of a perfectly normal technique to protect ones privacy, 
trade secrets or sensitive political information, is in the eyes of 
the Dutch government a highly suspected act.  

The draft Act also introduces the obligation for "every one" the 
authorities believes has acces to the keys, to cooperate with the 
intelligence agency in decrypting the encryption. Refusal is 
punishable with a sentence of two years. The Dutch parliament has 
asked the government if this means that suspects also are obliged to 
hand over the keys.  

The answer is not available yet. But if the governement confirms this 
obligation also applies to suspects, this will be a clear violation 
of the fundamental human rights, as stated for instance in the Treaty 
on the protection of the Human Rights and Fundamental Freedoms. It 
means an obligation to cooperate on your own condemniation and the 
reversal of the burden of proof.  

Copyright © 1996-2000 All Rights Reserved. Alle Rechte vorbehalten 
Verlag Heinz Heise, Hannover

_______________________________________________
raven mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Tue, 11 Apr 2000 22:07:39 +0200

> install a Trojan Horse, so access is secured and cryptography can be 

I hope nobody was shocked by the article, that's inevitably 
what you get if Encryption is free and law enforcement 
needs means. It is a legalised electronic form of a 
"razzia" and should be avoided as much as possible in a 
decent society in my opinion.

(Nothing new in the article, the BVD, our internal 
intelligence agency that only may report to the heads of 
goverment, tapped already and all kind of things. Lots of 
things are now more and more specified in laws. Microphones 
in homes were allowed for use by the police some months 
ago, the use of encryption by criminals certainly made it 
easier to pass that law.)

I know I'm extremely bad understood by most of you but 
still think we need the following:

Communication providers should be demanded by law to 
encrypt the data of their customers and the customers 
themselves should not be allowed to encrypt. The police 
shouldn't be allowed to enter homes for placing bugs 
without proof that the suspected are using encryption to 
hide their communication.

+++chefren

p.s. There is still some time to reject that 
everything but new pointless American-macho RFC...

---

From: "Richard Payne" <[email-masked]>
Date: Wed, 12 Apr 2000 10:52:09 -0400

I note that even ch*fr*n does not care to defend random interception of
satellite communications or gathering of economic intelligence, neither of
which can reasonably be linked to a legitimate law enforcement purpose. This
kind of random snooping is the best possible argument for the average user
to adopt strong end-to-end crypto.

A reverse onus of proof (two years for not being able to prove that you
_don't_ have a key seems to follow) is also very troubling, at least to
those of us who are used to "innocent until proven guilty".

Since this is reported as being currently under debate in the Dutch
parliament, does anyone have information on how the debate is going, and
when this might become law?

Richard Payne

----- Original Message -----
From: chefren <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, April 11, 2000 4:07 PM
Subject: Re: [Raven] [FYI] NL: Intelligence agency authorized to scan
satellite communications

---

From: "chefren" <[email-masked]>
Date: Wed, 12 Apr 2000 18:28:46 +0200

> to adopt strong end-to-end crypto.

It isn't if you look a little bit further.

If encryption is free for end-users it's reasonable that 
law enforcement may place bugs to circumvent the real-world 
"no places to hide for the law" problem.

So communication providers, the ones that keep up satelites 
for the end users should crypt and law enforcement should 
stay out of homes as long as use of strong encryption isn't 
proved.
 
> those of us who are used to "innocent until proven guilty".

All far too difficult and tricky. If encryption is 
regulated for end-users and provided by communication 
providers because law demands it, law enforcement can ask 
communication providers to decode messages and there are no 
further problems. Unless an end user do uses encryption, in 
that case law enforcement should be able to place bugs in 
homes.
 
> when this might become law?

There is little or maybe even no public debate as far as I 
know. I will post a report if I hear anything about it.

However, it's all in line with the laws that appeared in 
the last few years.

+++chefren

---

From: "Christian Price" <[email-masked]>
Date: Wed, 12 Apr 2000 10:22:33 -0700

This still seems to me to be technical folly.  If the data are not encrypted
until they reach the provider, then the data travel unencrypted over open
lines until they reach the provider.  This would seem to defeat the purpose
of encrypting the data at all.

--Christian