Welcome back.
Our next panel, or our first panel, actually,
deals with an interesting and not so widely discussed
technology along with its associated
crucial social question.
Danny Weitzner, a lawyer by training,
a pioneer of the negotiated approach to privacy,
and head of the Laboratories Worldwide Web Consortium
Technology and Society Division will chair the panel
and frame the question.
Danny?
Thank you, Bob.
[LAUGHTER]
See, I knew that he would steal my opening.
We're here to talk about a really important subject,
pranks notwithstanding.
I think we'd all agree that--
[LAUGHTER]
I think that we'd all agree that one of the tremendous paradoxes
of the net is that on the one hand,
our interactions online seem so impersonal,
and this frustrates people sometimes
and leads for calls for greater trust online.
But at the same time, many of us are aware that we really
do leave a trail of virtual breadcrumbs
as we surf around the web, and this compels some of us
to take rather extraordinary measures to hide our identity,
to conceal our true identity when we're online.
And one of these tools is an anonymous remailer,
one such remailer is run here at LCS
is the subject of a significant amount of research activity.
And Michael Dertouzos, the head of the lab,
has posed a very pointed question to all of us,
should the lab be running this tool?
Is this a valid subject for research?
Is this a socially useful activity?
Or is it destructive?
And to answer these questions, which
are very important, especially important to some people
on the panel, we have a really tremendous panel
of experts who are going to help us sort out
both the core legal and technology questions posed
by anonymous remailers.
At the end of the table on the left
is Nadine Strossen, who's a personal hero of mine,
the president of the ACLU since 1991
and a professor at New York Law School.
She's been a national leader.
[APPLAUSE]
Thank you.
Now, was that for New York Law School or the ACLU?
She has been a national leader in defending civil liberties
on the internet.
Her book, Defending Pornography, Free Speech, Sex,
and the Fight for Women's Rights was named by The New York Times
Notable Book of 1995.
Next, we have Philip Reitinger, a colleague
at a truly honorable adversary, sometimes, of mine,
in these internet civil liberties
debates in Washington.
He is senior counsel with the United States
Department of Justice Computer Crimes section.
He's prosecuted a number of computer crime cases
and is really a leading authority
on this subject in the country.
We have some guy sitting here, and next to him we have David
Maziéres, who's a graduate student here at LCS.
He's doing research and operating systems, security,
and privacy.
He designed and implemented the nym.alias.net pseudonymous
remailer, which is currently running at LCS.
We're going to try to have a relatively open free form
discussion among the panelists.
To start us off, David has agreed
to spend about 10 minutes just bringing us all up
to speed on just what this technology is
that we're talking about.
So David, please.
[APPLAUSE]
Thanks.
There are many reasons you might want to send anonymous mail.
So here's an example.
This is a piece of email.
And the person who sent this email
might not want to be traced.
Now, you can look at this and see
that the message is addressed to Bill Gates at Microsoft.com
and it's coming from pieguy@nym.alias.net.
Now, what is nym.alias.net?
Well, nym.alias.net is a pseudonym server
that we've been running at LCS.
And this allows people to establish email pseudonyms
that we call nyms, and that look like ordinary email addresses,
like, for example, pieguy@nym.alias.net.
And nyms function just like regular email addresses,
and that you can use one both to send and receive mail.
But what's interesting about nyms
is that nym owners are completely anonymous.
So even the people who administer the system
don't know the true identities of the people who
own these nym email addresses.
So nym.alias.net is actually in fairly widespread use outside
of computer science research.
It's been open to the public since June of '96,
and you only need a PGP to use it.
PGP is a widely available piece of encryption software.
And people actually have gone ahead and developed more user
friendly clients specifically for the server software that
runs on DOS windows and Unix.
And throughout the existence of the service,
there have been about 2,000 to 3,000 active accounts on it
at any given time.
Now, why do people need a service like nym.alias.net?
Well, of course, we don't know, since we
don't read people's email, we have no way of knowing for sure
what people are using the service for.
But we decided to send out a survey to all of our users
and ask them to tell us what they like about the service
and what they're using it for.
And we encouraged people to be as candid as possible,
saying that this was not a referendum on the service's
existence, but would help us in our research.
And we got back a wide range of responses
that vary in the degree of privacy that they needed.
At the most critical end of the spectrum
were people who use nym.alias.net
because they need protection from oppressive governments.
One particularly compelling story
came from a person who was a humanitarian aid
worker in a country with a fairly oppressive government.
And that person said that he or she did not
feel comfortable communicating back home to friends via email
without the availability of a service like this.
Another large class of people use
the service because they're worried
about losing their jobs, or potentially harassment,
or just simply embarrassment for uses,
such as discussing alcoholism, depression, being
a sexual minority.
Some people said that they used nym.alias.net to blow
the whistle on illegal activities,
and a few people said that they found it incredibly
useful for fighting harmful cults
and helping people escape those cults.
Another class of people simply wanted protection from mail
logs.
Right now, on most systems, if you have an email account,
even if no one's sitting there reading your mail,
the system is building up a log file of all the mail
messages that come and go, and someone
can derive from that list of all the people you've
exchanged email with.
And people who don't feel comfortable with that
use this service to keep the identity
of their correspondence secret from the system administrators.
And finally, some people simply use this service for protection
from search engines.
And the fact is right now you could
make a statement in a public forum under your real name,
and 10 years from now people may call up your name on a search
engine and be looking at statements
you made 10 years ago.
Do you still want to be associated
with those statements?
And in particular, one person gave a story of a candidate
at a job interview who's Usenet News posting history came up
as a subject for the job interview,
and that person was obviously very uncomfortable with that.
Finally, a few people admitted to using
the service for admittedly marginal purposes.
And probably the most common of these
are people who said they use it to discuss
marijuana cultivation.
But there are also a couple of people
who said that they used it for software piracy
and for virus development.
So how do we build a system like this
that allows people to have these email addresses anonymously?
Well, the key idea is that users of the system
never communicate directly with nym.alias.net.
And the way we do this is to build on an existing
network of anonymous remailers.
And these are servers that forward email on
to some destination address, but strip off all the information
about the person who originated the piece of email.
And there exist independently operated in several countries
and jurisdictions.
And when mail is sent through a series of remailers,
the key point is that multiple retailers
need to be compromised in order to expose
the path that any email message has taken.
And so you can see from this that it's
fairly simple for users to send mail
to nym.alias.net when they want to establish accounts and send
outgoing mail.
And there are actually several ways
of receiving anonymous mail for nym.alias.net
to reply to the users.
And I'll give you a particularly simple example, which
is that even if you forget about email,
if you wanted someone to send you a message without knowing
who you are, you might tell that person
to go take out a classified ad in The New York Times,
and you could read The New York Times every day
along with millions of other people,
and see the message when it arrives.
And nym.alias.net allows people to configure their pseudonyms
so that any mail that is received for that pseudonym
is posted to a public forum where it's very difficult
to trace to the person.
And there are also ways of doing this more efficiently using
the anonymous remailer network.
OK, so the first thing that we noticed
when we deployed the system is that nym.alias.net
draws attacks.
Anonymous speech can definitely upset people.
And when people get upset at anonymous speakers,
the first thing they want to do is
know who is speaking anonymously so that they can
exact some kind of retribution.
And failing that, when they can't find out
who's actually making these statements,
they tend to turn on the service provider
and they want to shut it down.
And in fact, protecting the identities of users
is a fairly well-known problem.
And it's been going back to 1981,
there's been work in that.
And we understand how to do this fairly well.
But in practice, defending a service and keeping it up
and useful is actually not nearly as well understood
a problem.
And so I'll give you some examples of some of the things
you can do to try to disrupt an anonymous service.
One thing you can do is use the service
to attack some third party anonymously, and then
hope that that third party turns on the remailer
and tries to get it shut down.
Another thing you can try to do is
to try to marginalize the service through disruptive use
so that if the existence of the service
becomes absolutely intolerable to everyone,
then even legitimate users of the system
are not going to be able to be heard because no one's going
to have any choice but to ignore all anonymous traffic that's
coming from the service.
And finally, one thing you can try to do
is to try to make life really difficult
for the operators of the service,
so that it will not be worth their while to keep
running the service and they'll want to shut it down.
Well, in fact, defending against some of these attacks
also poses some unusual challenges.
And there are several reasons for that.
First of all, in general, when you have a server that's
on the internet and you're trying to protect it
from attack, one of your front line defenses,
and the best ways of finding out if you're being attacked
and potentially who's attacking you
is to look at logs of who's connecting to the server
and using it.
And in general, with an anonymous server,
privacy concerns preclude any kind of usage logs.
You don't want to keep track of who's made use of your service.
A second problem is that the service by its very nature
is designed to hide the identities of users.
And that applies to abusers, too.
So when someone is abusing the system,
you have no way of knowing who that person is.
In fact, even if you do know who is actually
trying to disrupt use of your service,
you can't necessarily ban that person
from making use of the service because the server is designed
to prevent the operators from associating incoming messages
with particular people, you're not
going to know which incoming requests are actually
coming from a malicious person trying to disrupt your service.
And finally, for a number of reasons,
any kind of content-based censorship
of filtering disruptive messages is
completely impractical for a number of reasons.
First of all, if you try to put some kind of automatic filter
in place that's just going to filter on keywords,
well, you're dealing with human adversaries
and they're going to adapt to whatever automatic
filters you put in place if they know what you're blocking.
Second of all, if you start filtering certain messages,
you're going to block legitimate users, too, potentially.
And in fact, this may well be the goal of your attacker.
So if your response to attacking is to start filtering messages,
and people want you to filter messages,
they're going to attack the system
and try to make disruptive use of it.
Finally, if you actually try to look
at every individual message going through the system,
it's just simply way too much human effort.
And in fact, in the US at least, inspecting messages manually
like that actually opens you up to liability,
which is something you certainly want
to avoid in the case of an anonymous remailer.
So some things we've concluded from running this service.
First of all, we think that open anonymous servers, in fact,
are practical.
We've been running this system for three years
and we've had some hard challenges to deal with.
But basically, we've overcome all the problems that
have been thrown in our way.
But one thing we have learned is that when
you're building an anonymous service like that,
you have to factor abuse into the design of the service.
A second thing we've learned is that people
can be incredibly creative in finding ways
to disrupt an anonymous server.
So you really ought to deploy anonymous systems
to assess their viability.
And in fact, when you're trying to assess their viability,
the key metric to use in measuring
how successful and robust an anonymous system is,
is really human time.
And the worst thing you can possibly
do if you're designing an anonymous system
and deploying it is to put yourself in a situation
where manually you have to inspect every message that goes
through the system, or you have to manually clean up the mess
every time someone manages to make
disruptive use of the system, because then someone can
write a program to generate all kinds of disruptive mail.
And that person runs a program that's
costing you countless hours every time it runs.
And on the flip side, the way to win,
and the way to control abuse, and to keep the service useful
for legitimate users is to try to limit
the trouble to any single person can stir up
by making sure that the system costs
a certain amount of human time to use.
And I haven't been able to go into any
of the details of the kinds of attacks that we had here,
but if this is interesting to you,
I'd invite you to read some of our war stories, which
are on the LCS web page under human impact.
Thank you.
[APPLAUSE]
Thank you, David.
So Phil Reitinger, can you give us
a little bit of context here?
At some level, this sounds like pretty interesting research.
David and this other guy have worked hard.
How do you know it's a guy?
[LAUGHS] I was sitting next to him.
What are we losing here?
What's the problem?
That calls for a follow-up comment.
Sorry.
I'd like to answer your question but I'm
frozen into fear by the anonymous masked person
next to me.
[LAUGHTER]
Sure.
You're not going to unmask him, are you?
Well, the upshot of that is, of course, anonymity
has a downside, too.
I know this will come as a shock,
to many of you, including Danny, but people actually
commit crimes on the internet.
And it's hard for law enforcement
to put a pseudonym in jail.
You don't see a lot of indictments that say
United States versus John Doe.
If you want to discover people who are committing crimes,
and then prosecute them, and put them in jail, if appropriate,
you've got to discover who they are.
In fact, law enforcement has to prove identity
in every criminal case.
But anonymity is the antithesis of identity.
And so if a person is truly anonymous,
then there can be no criminal law enforcement
and people are free, which has an upside and a downside,
to doing whatever they want on the internet.
Now, one of the things I said was
that if a person is completely anonymous-- it's
an important distinction, because a lot of people
think about anonymity as being a binary concept,
either you are anonymous or you are not.
But in point of fact, there's a fairly broad set
of differentiation depending upon how difficult
it is to determine the real identity of a person associated
with a particular message or a pseudonymous identity.
And that's where the distinctions come in.
If one is serious about enforcing law regarding
activities on the internet-- and by enforcing law,
I'm talking about laws that refer
to both speech-related crimes, if you will,
such as harassment, extortion, and such similar sorts
of crimes, and non speech-related crimes
like engaging in computer intrusions,
law enforcement has to be able to determine
the identity of the person.
And so you need the ability to trace communications
to their source to determine the identity of the person
committing the crime.
Let me just ask you, I think that we understand
the problem in the abstract.
In point of fact, have any of your investigations
or investigations you're aware of been blocked or made
substantially more difficult by anonymous remailers?
I know of cases where anonymous remailers were used
in the commission of crimes.
And I think anecdotally there is a large upswing
in the use of anonymous, particularly web-based email
services, to send harassing communications.
A typical example might be, let's say
you wanted to threaten the President of the United States.
So you go to an anonymous web browsing service--
don't want to mention any of them-- but you go to one
and you use that service to access an anonymous email
account and send out a harassing message to the president
or whatever person you want, because it's likely
that neither the anonymous remailer or the anonymous web
browsing service is going to keep any records at all
that would allow tracing of that communications.
You have effectively committed the perfect crime.
It's an almost untraceable threat.
And for example, if you make it fairly detailed
and make it a bomb threat or something,
you can cause a lot of damage without really
facing any real jeopardy.
Nadine, Phil's very worried about these services
and he hasn't told us what exactly he
wants to do-- we'll come to that later
about these sorts of services.
What do you think are the issues on the free speech
side of this equation?
Aren't people just hiding behind these barriers
for no particularly good reason?
Well, I, like Phil, am very concerned
about law enforcement.
And I, like Phil, recognize that the supreme law in this country
is the United States Constitution.
I want to be sure that constitutional guarantees
of freedom of speech, freedom of the press,
freedom of association, and privacy are
as honored and robust in cyberspace
as they have been in more traditional media.
It proves too much to say, well, we
might be able to solve more crimes, or detect more crimes,
or even deter more crimes if we somehow
bit that supreme law to alter the balance of power
between individual freedom on the one hand and government
surveillance capability on the other hand.
The reason it proves too much is that very same
philosophical issue confronted the framers.
So I am taking the very conservative position adopted
200 years ago that there are certain individual rights that
simply may not be sacrificed, no matter what the potential law
enforcement gain is on the other side.
Another very, very important point is we cannot let
the debate be driven by thinking of the most horrible abuses
that could be made of freedom of speech or privacy,
because after all, anything can be abused.
When the automobile was first invented,
Phil's predecessors in the Justice Department and law
enforcement argued that it should be an illegal object,
because, after all, criminals were
going to be able to use cars to flee
from the scene of the crime.
Now, that seems like an absurd argument to us
now, judging by the audience response,
but to me is exactly the same argument that
is being made now, because some technology can be abused,
can be used to commit crimes, therefore, we
are going to deprive all of the legitimate users
from human rights dissidents, to whistleblowers, to authors,
to all kinds of individuals who, in many cases,
would not have freedom of speech if they did not
have the security and confidentiality provided
by anonymous remailers.
Now, I think at this juncture, the guy in the mask
might have something to offer.
But he's going to have to take it off
before he can speak to this audience.
This is a professor Frans Kaashoek, who many of you know.
He's associate professor at MIT'S
Electrical Engineering computer. science Department.
And he's a member of LCS.
Aside from his work on anonymous remailers,
his research includes exokernels,
and extensible operating system architecture,
and SFSS, a secure decentralized global file system.
Frans, why did you choose to do this work?
Good question.
I guess I like getting subpoenas and receiving
the blame for this project.
I always like to joke that.
Dave gets the credit, I get the blame.
I guess it comes down to a couple of issues.
First, I guess I strongly believe in freedom of speech.
And I think this is going to be very important issue in trying
to figure out how to have freedom of speech
on the internet.
And understanding that and providing services
that actually allow you to have freedom of speech
seems like crucial in understanding the debate
and the issues that are involved here.
And I guess go back to, and sort of one
of the comments Nadine makes that the original federal
papers were which were United States was founded on
were published on a pseudonym.
And so there's clearly a case that where
anonymity is actually important and plays an important role.
Now, we might not have been sitting here
having been that the case 200 years ago.
The other side of it is it brings out
a lot of interesting research problems
in the area of security.
I know Dave touched on a number of them in his talk.
Services like this attract people
that actually get mad at the service
and trying to shut down the service.
nym.alias.net is not the only service that people are mad at.
There are lots of people out there
trying to attack other kinds of services
and trying to force them down.
So it seems to be from a research point,
important to try to understand what kind techniques can
be used to protect against people
that illegally are shutting down services.
I'm sure you have been reading the attacks on the NATO website
in the last couple of weeks.
What kind of techniques can develop
to protect against these denial of service attacks?
And nym.alias.net is one example of a service
that we can investigate, learn, understand, and figure out what
techniques work and don't work.
And part of that is, if you offer a service like that,
I think one of the key problems is, how do you deal with abuse?
It's not only focusing on the problem
of how do you protect the identity
of the nym, the other side of that
is, how do you deal with abuse?
Phil gave his example of harassment.
It turns out that actually is pretty easy to deal with.
Two things.
First of all, a piece of email coming from nym.alias.net
is identifying that it came from there.
Second of all, we have features on the servers that
allow users to say, I don't want to receive an email coming
from nym.alias.net.
So one of the things we're trying to do
is to figure out how to make the servers in such a way
that people can live pleasantly with the service in existence.
And I guess, then, the final side of this
is that I think it's important-- now,
clearly the area of anonymity and the role of technology
here is ill understood.
And we wouldn't be having this panel here if we actually
understood the problem exactly.
And one of the hopes when I got involved in all this,
was trying to understand the role between technology,
and the role between law enforcement,
and the role between society.
And if we hadn't done this particular experiment,
again, we wouldn't be sitting here, and discussing,
and having this particular debate.
And so to sum up, there's three important reasons for me
to be involved and support the nym.alias.net.
One is the freedom of speech.
I'm a strong believer in it.
Two, there are very interesting research problems
and we've got to figure them out.
Three, what's the role of technology in society?
And all of the three are important in supporting
this particular service.
Now, Frans, you said that it's actually not
so hard to deal with some problems
that Phil brought up, some crimes that Phil brought up,
namely harassment, that you've got
a method for dealing with that.
But you also said that you've been the subject
of a number of subpoenas.
So it must be that you can't quite
deal with all the problems that are at least allegedly arising
out of your service.
Tell us a little bit about what happens
when you get a subpoena.
What sort of information is asked for?
What kind of information do you give law enforcement?
Let me make a couple of statements along those lines.
So first of all, the policy statement that we actually
have on nym.alias.net and for any user on nym.alias.net
says clearly that one shouldn't use nym.alias.net
for breaking any federal or Massachusetts laws.
And we have received in the last couple
of years, a number of subpoenas where
allegedly one of our users did something incorrectly.
And if we discuss this with our lawyers,
and if our lawyers advise us to comply,
we comply with the subpoena.
And in most cases, this means that there's
a little bit of information stored on nym.alias.net that
basically says, if you think about the chain of remailers,
it basically says, what's the last remailer where
it came from, and where it has to go to on its way
back to the owner?
And all this information is carefully encrypted.
The last hop has to be known.
So we supply what we call the reply block, which contains
some information, a set of instructions what
the next hop should you do, and the set of instructions
are encrypted, so we don't really know what it means,
but we supply that particular piece of information.
So if a user--
and this is the important point--
if a user uses our service correctly,
the information that we're providing
doesn't really have much value to law enforcement, at least.
Not clear what you could learn from it.
Of course, there are people that use our system incorrectly
and law enforcement might actually
have good luck with this particular piece
of information.
So Phil, what do you expect Frans to do?
I mean, these guys can obviously configure the system
in a variety of ways.
Frans has just told us that, in fact, correctly used,
his system doesn't really provide
much useful information.
What are these guys to do?
Well, I don't have any real silver bullets, Danny.
I hate to tell you that, but it's true.
It seems to me that people are too ready, generally,
to resort to law to solve all of the problems presented
by technology.
Technology can solve a lot of the problems,
policies and practices can solve a lot of the problems.
And if I may refer to the nym.alias.net policy FAQ,
it has a great line in it.
"Out experience with nym.alias.net shows
that controlling abuse is as important
as protecting the identities of anonymous users",
excuse me, users.
I think the first and primary thing that has to happen
is that people who are responsible for designing
and implementing technology and standards
need to be sensitive to how technologies can be abused,
and need to consider the extent to which that
can happen in designing and implementing the systems.
I agree completely, by the way, with Nadine,
that we should not reason from worst-case scenarios.
Either the worst-case scenario, probably,
of the kidnapper who you need to trace immediately or people
will die.
But you also don't need to reason
from the worst-case scenario on the other side
of the human rights advocate in a country who,
if his identity is exposed, will be immediately executed.
These these are both harms that you
have to take into consideration in developing
a balanced policy that addresses all of the relevant concerns.
I think Phil's point about a lot of these problems,
we should see technology as providing solutions
and not jump to law, I'd like to agree with that point
but come at it from a different perspective, which
is, I'm very concerned about the very enormous threats
to individual privacy that have occurred in cyberspace because
of technological power that has vastly increased
the ability of everybody, from government
to the private sector, to engage in snooping, and putting
together, and trading in what many of us like to think
is personal information that pertains only to us, including
information of a very personal nature,
such as financial information and medical information.
Unfortunately, from my point of view,
the laws in the United States are not
very protective of individual privacy with respect
to that kind of information.
And therefore, I welcome the kind of technology
that LCS has put together through the anonymous remailer,
together with other such privacy protecting technologies,
including encryption, as the only way that individuals
can try to enjoy, in cyberspace, the kind of privacy
that we've traditionally enjoyed in other kinds of media.
So Nadine, you're a law professor,
you're a defender of the Constitution,
and you appear to be ready to throw it all out the window
and rely on what these guys sitting up
at the table and our colleagues at in the audience
have developed.
I'd rather rely on them than the current United States Supreme
Court, I'm sorry to say.
[LAUGHS]
[APPLAUSE]
But in all seriousness, I mean, we do have,
as you well know, a Fourth Amendment to the US
Constitution that protects against unreasonable search
and seizures.
We have an extensive wiretapping law
which prescribes very difficult hurdles
that Phil and his colleagues have to jump through in order
to gain access to private information,
whether on the internet or other telecommunications systems.
Isn't that enough for you?
Well, it would be if the Fourth Amendment were
enforced in accordance with its plain language
and original intent.
But that's, in fact, not the case.
We're sounding very conservative tonight.
Really conservative.
About almost 20 years ago, a law professor
wrote an article called, The Incredible Shrinking Fourth
Amendment.
And unfortunately, it's shrunk a lot more since then.
Most recently, just last week, the United States Supreme Court
cut back very far.
And I think the most pernicious thing that's
happened to constitutional privacy doctrine
is that rather than setting an absolute guarantee, which
I believe the Fourth Amendment was clearly intended to do,
it's become extremely relative.
And this started happening about a generation ago
when the Supreme Court said, you will only
be protected in what you claim to be a privacy right if it
is something that society recognizes
where you have a legitimate expectation of privacy.
So if you know that your government, together
with private actors, are putting video surveillance
cameras in public places, if you know
that websites are using cookies, if you
know that your employer is engaging in wiretapping,
you no longer have a legitimate expectation of privacy,
says the Supreme Court.
Sorry, the Fourth Amendment doesn't apply.
So this vicious cycle has set up that the more we have invasions
of privacy, the less we have constitutional protections
against it.
I want to get Phil's response, because we
seem to have backed ourselves into a vicious circle where
the lawyers are concerned about what the technologists are
doing, and the users of the technology
don't trust the legal system to protect them,
so they're heading back to the technology.
Well, if I could respond, then.
Yes.
You can get us out of this vicious circle.
I don't know if I can do that.
I, as both a human being and a member of the United States
government, find--
Two separate categories?
[LAUGHTER]
They are some sort of Venn diagram.
Whether one is completely captured
within the other or not, I'll leave for you to judge.
I think there are no non humans employed by the United States
government, it's fair to say.
Privacy is very important to me.
But I am not--
Drug sniffing dogs.
But privacy is not an absolute right.
It's one of a lot of rights which have
to be taken into consideration.
If somebody broke into your house
and stole everything you owned, would you
defend the right of that person to remain private?
Probably not.
We have, from the beginning of this country, recognized--
and the Fourth Amendment recognizes--
that there are times when we can interrupt
people's reasonable expectations of privacy,
particularly by getting a search warrant that allows law
enforcement to go in and discover the things it needs
to do to enforce the law.
This is why anonymity is also not an absolute right.
Frans here, was wearing a mask before.
This may come as a shock to you, he's
not allowed to do that in some courthouses.
And the Seventh Circuit, at least,
has said that laws banning him wearing a mask in a courthouse
is OK.
We don't allow people to drive anonymously in the real world.
We have to recognize that there are costs to allowing people,
allowing the government to breach anonymity and find out
who is doing what.
There are benefits to doing that.
If you give government the ability to do that,
there will be abuses.
If you don't give government the ability to do that,
then there will be no law enforcement.
That's why you have to have a balanced solution that
takes into account what technology can provide
and what policies can do and address
the balance with an proprioceptive of standards.
The two questions really are, should law enforcement
be able to trace communications on the internet
in order to enforce the law?
And if they should--
I think the answer is they should,
that we shouldn't have no law enforcement on the internet--
what ought the standards be for law enforcement
to get access to the information in order
to trace communication.
Can I just interject something about--
Please, and then we'll come to David.
Because the United States Supreme Court did,
two years ago, issue--
four years ago, I'm sorry--
issue a decision.
7 to 2 was the vote, so very lopsided in favor of the right
to engage in anonymous expression.
The Seventh Circuit decision was wrong,
but that's not the highest court in the land.
We won't get there.
And in that case, the United States Supreme Court
said, yes, it's not an absolute right,
but it is a very strongly protected right, which
means it may be limited if, but only if, government can meet
a very high standard of proof.
Namely, it has to show an interest
of compelling importance.
Thinking that Frans has a cute face that we'd like to look at
is not of compelling importance.
Obviously, dealing with a serious crime would be.
Sorry.
[LAUGHS]
But even more importantly is the second requirement.
And that is that there is no less restrictive alternative
means that government can use to promote
that compelling purpose.
So this case that I'm talking about
was an ACLU case, by the way.
We defended the right of a woman to hand out anonymous handbills
or distribute anonymous campaign literature with respect
to a campaign issue, a political issue.
And the government had, the Supreme Court agreed,
a compellingly important interest
in being sure that there wasn't false information
injected into the political campaign,
but it said laws could be written that more narrowly
would deal with that problem, laws specifically targeting
fraud or deception.
So I would think at the very least--
and maybe this is not fair-- but I
would think at the very least, Phil,
you would agree that the broad question that's
posed to this panel, should the anonymous remailer be shut
down, would have to be answered in the negative
because your concern has to do with the kind of abuses
that, as the Supreme Court has said,
you don't deal with by completely prohibiting
anonymity.
You deal with it in a more selected, targeted, focused
fashion.
Well, it seems that one of the dilemmas we have
is that the technology--
I think we heard from David--
is not all that good at being selective.
In other words, these guys have not
built a political speech anonymous remailer
that rejects any speech which is not political.
They've not built the remailer for the late Mrs. McIntyre.
Not-- yeah, McIntyre, who was the plaintiff in the case
that you mentioned, they built a remailer for everyone.
For Mrs. McIntyre, for the person
who would harass Mrs. McIntyre, for the person who
would blow up the city that Mrs. McIntyre
lives in, wherever that is.
So David, I guess the question to you,
since you've built this stuff, is, are you
going to help Phil out?
Phil has said that he's going to be extra, extra, extra careful.
And Nadine is probably going to keep Phil honest.
She's going to go into court time, and time, and time again.
When Phil shows up at your door with a search warrant,
with a wiretap order for access to information,
Nadine is a great lawyer, is going
to figure out how to find out what
it is that Phil is asking for.
And if he's asking for too much, the ACLU
or some other organization, the defense attorney
is going to stop Phil.
So are you going to build something
that gives Phil a little bit?
Well, I think in some sense I'm interested in helping Phil out,
but I'm coming at it from a very different angle in the sense
that I'm very interested in making sure
that anonymous remailers, in fact,
can't be used to do horrible things, and commit crimes,
and so forth.
And in particular, probably one of the greatest threats
of an anonymous remailer is in terms of computer security,
potentially attacking computer systems.
And so certainly, to the extent that we
can do things to prevent the kinds of crimes
that you might be worried about, I'm all in favor of that.
And in particular, if you're worried about the White House
receiving a lot of bomb threats, I'm
perfectly happy if the White House comes to me and says,
well, you're costing the Secret Service hundreds of thousands
of dollars to search all these bomb threats,
and you know this president isn't
interested in getting anonymous political advice anyway,
just stop sending us mail, right?
OK, no problem.
You're not going to receive another piece of anonymous mail
from our server if you don't want to.
But again, that's up to you.
I mean, one thing I'd like to add, going back a little bit,
is that I shared Nadine's concern
that the Fourth Amendment may be shrinking.
But in the particular case of this anonymous remailer,
the US government is, in fact, not the only enemy.
And one thing that has sort of become apparent
is that if you have anonymous systems and they fail,
people can get hurt.
And so one thing that I'm interested in this research,
and I want to carry this out.
And in order to carry this out, I
need to really deploy the system in the real world, which
means that there are people who are relying on this system--
Who's going to get hurt?
--for their safety.
Who's going to get hurt?
Well, for example, people in countries
with oppressive governments.
Or people who have escaped cults, for example,
and are trying to help other people escape cults.
There's some cults where in order to join
you have to give a lot of personal information
about yourself.
And you can be seriously harassed
afterwards if you start trying to work against the cult.
And in particular, I have an office
with a standard MIT lock on the door,
and I'm sure it's not very secure.
And if I had some machine in my office
that actually had information that was of great value
to someone, say, other than the US government,
say some organization that didn't, in fact,
care about respecting the laws, then
I'd be worried that someone could just walk into my office
and walk out with the machine.
And so, if in fact, I have to worry a lot about the security
of the system or worry about potentially getting people
hurt, then that's going to be a serious impediment
to my research.
Now, Phil, you've urged us to rely on the,
I think what we would all agree is
the very delicate and careful balance
that the Fourth Amendment strikes here.
Michael Dertouzos, ever internationally-minded has
pointed out that--
what did he say?
Only 4% of the world is in the United States.
These guys have built the technology
to help not just human rights workers in other countries,
but people who live in countries which do not
have the benefit of the Fourth Amendment protections
that we have as US citizens.
Now, all those people are not necessarily
your responsibility, and I don't want to put it on you alone.
But if you are urging the design of systems
to strike a more careful balance between US law,
and the rights that we have as US citizens,
and the needs of law enforcement in a Democratic country
like ours, what does that do in a global environment
to people who don't have those protections available to them?
Well, I'll steal an argument from Nadine,
I think that argument may prove too much.
Police officers in other countries may use firearms
to kill people that they shouldn't.
That doesn't mean we don't allow police officers in the United
States to be armed.
The fact that a technology can be abused outside the United
States is a fact to be taken into consideration
in deciding what the appropriate balance is.
But it's just an additional fact.
You still have to come up with a balanced policy.
And in particular, where those systems are
located in the United States.
The anonymous remailer is not going
to have to respond to requests from foreign governments.
The requests are going to have to be
root through the US government.
And the US government is going to make its own decision
on whether it's appropriate to bring
legal process in the United States,
if it's a foreign law enforcement request.
A more serious threat to anonymous remailers
may be civil lawsuits in the United States
about people who want access to information.
[INAUDIBLE]
Can you give us an example?
There's a fairly recent published case
involving an internet service provider where a--
[INAUDIBLE] if I remember--
a couple was getting divorced.
The new spouse of the divorced man
published some derogatory information
using a screen name on the internet
about the prior spouse.
And the spouse who was defamed was
able to get the information about who did that
from the service provider, because there were no anonymity
protections.
It was just done under a screen name.
Now, you can argue that either way,
whether you think that's a good thing or a bad thing.
The ability was there in that case.
And you can also argue--
I'm sure Nadine would say, well, there
weren't sufficient protections for that person's
anonymous identification.
She might be right.
But I think the way you address that type of problem
is by setting legal standards for access to the information.
And I'm sure Nadine will tell you that we already
have, with regard to government access, incredibly
complicated standards under the electronic communication
[INAUDIBLE].
Tell us, Nadine.
Well, I agree with that.
And they're not nearly as protective as they should be.
But I want to come back to Michael's point
as conveyed by Danny from a somewhat different perspective,
which is, I want to be very clear that I'm not here
advocating American imperialism in terms of exporting
the Fourth Amendment as originally written
around the world.
I certainly wouldn't want to export it
in its current watered down fashion.
But what we are talking about are basic concepts of privacy
that are respected and reflected at least as
strongly in international human rights law,
and in regional human rights agreements,
and in the constitutions of every country around the world.
Now, as is often the case in our own country,
sometimes those guarantees are honored in the breach.
But it is a standard that has been at least aspired to
by governments, and regional, and international bodies
around the world, and is advocated by cyber libertarians
around the world.
When I work on these issues, it's
not only in coalition with other organizations in this country,
but also organizations around the world, many of which
are working together under euphonious named
GILC, which stands for the-- the first time I heard it
I thought, geek.
Not quite.
It's the Global Internet Liberty Campaign.
Frans?
Yeah, I just wanted wanted to follow up
on this point of international and globalization.
And I think this is one of the problems
that, actually, Phil is going to face
is, this particular service runs in the United States,
but there's no reason why there couldn't
be a number of them outside of United States,
where the United States law doesn't apply at all.
And in fact, work even harder for you to try to, I guess,
create any particular piece of communication.
So one of the things that we have
to think about I think when we move forward,
and as the change the internet is bringing
is that we get this sort of universal globalization
and everybody can run these kinds of services.
And that changes, I think, some of the perspectives.
Because even if we enact some law here that says,
we decide today, or somebody decides that nym.alias.net
shouldn't be running, somebody can go off,
and actually, our software's publicly available,
and run it somewhere else.
As a footnote, someone's actually
running a copy of our software in Poland.
And there's another copy of the software running
in a server in the US, also.
So we aren't the only site.
Phil, it sounds like this situation is rapidly
spinning out of control from your perspective.
I mean, we have the clear proliferation
of these remailers, other kinds of encryption technology,
as you well know.
And I hear in what you say, a subtle message which
says that it's really incumbent on the technology
community, the internet community, the researchers
here at LCS and other places, to try
to direct the development of this technology in a way
that, as you say, would have a little bit more balance to it.
And I'm going to try to pin you down and see
if you can say, what would that mean in your eyes?
How would how would the world look?
I don't know if you can pin me down.
[LAUGHS] We'll see.
I'm a highly-trained lawyer.
First, I'll give an uncharacteristically brief
response to what Frans was saying,
and that's, Frans is right.
The globalization causes us severe problems.
One thing computer hackers do, for example,
is they break into a series of computers
before they get to their eventual target,
and they intentionally across international borders
to make it more difficult for law enforcement.
You do the same thing with anonymous remailers.
You can go through a chain of anonymous remailers
crossing borders, so that if we want to try and trace
the communication we've got to work with 8, or 10, or 20
odd countries in order to try and trace it.
That is becoming a more and more difficult burden for us
because it's very rare that we deal with a computer intrusion
case, for example, that doesn't have an international element.
But it may not be an insuperable--
excuse me-- an insuperable burden
if people keep the relevant records
and are able to assist us.
The reason-- now, moving on to your not pin me down question--
I cannot give you an absolute prescription on what people
should do now or shouldn't do now.
I think, like apparently the MIT anonymous remailer has done,
they need to keep into account what the risks are.
And they need to assist law enforcement
when law enforcement comes knocking
at the door with appropriate legal process.
As I said before, there shouldn't
be a first resort to law.
There should generally be a first resort
to technology and policy.
And I can't give you a prescription
because over the years, and in internet time,
over the hours or days, I don't know what
technology is going to bring.
I don't know how this is going to develop.
This all may be moot because we may have--
in six months, we may have a universal anonymous
infrastructure that's going to prevent the tracing
of any communications.
That's going to be a very different world.
And that might cause Congress to consider legal solutions.
But you have to look at each step of the way
and see where you are, what technology can do for you,
what policy can do for you, and balance
the harms at that point.
So--
And I'm not going to tell you to shut down
the anonymous remailer.
No, no, no, I know you're not.
But let me take a little straw poll, because clearly
no one's going to say shut it down, Michael.
Can we go now?
You should give them a chance to say it.
I defend their free speech right to say that.
[INAUDIBLE]
Of course you do, of course you do.
But I don't think anybody is even inclined, even Phil.
Now, let's see if we could get to a closer question.
Should the policy fact that you read
from, what I understand to be, more or less, the rules
that the remailer operators have agreed to guide themselves by,
should they say that they will not, if they can help it,
or that or the remailer should not be used in a chain
with a remailer in a country to which US law
enforcement does not have access through valid legal process?
In other words, let's try to accommodate-- oh I stumped
Phil.
That's great.
In other words--
This is the way to duck the question [INAUDIBLE]..
In other words, what we've understood here
is that if people use the remailer carelessly,
it's no problem for law enforcement.
If people use the remailer very cleverly,
and get good legal advice, and figure out
that they need to send their mail through a remailer chain,
including some country that has no wiretapping law
or won't answer US court orders or US requests for assistance,
then they've got a pretty good chance of evading access
by US law enforcement.
Should these guys, out of the goodness
of their hearts, being good netizens,
say that they will try to prevent that and encourage
people who use their service to abide by that policy?
But just a technical note.
I mean, we would potentially also need to keep logs for--
I understand you can't enforce it.
I'm not asking you to enforce it.
You don't want to force any of the policies
in your policy fact, now.
All you do is you say, here are the rules
for being a good citizen using our remailer.
I'm proposing to add another rule.
Nadine?
I suppose there's no harm in encouraging people to do it,
as long as it's not enforceable and there are no sanctions.
[LAUGHTER]
I defend their right to encourage
as a form of advocacy.
But again, one point where we agree--
and I think that's partly why Phil can't be pinned down--
is we don't want policy to be shaped
by the worst-case scenario, because maybe the person who
wants that kind of untraceable rooting
has what we would all agree is not only legitimate,
but indeed, even a compelling reason for doing it.
In fact, it may even be a law enforcement reason.
Maybe this is somebody who is going
to provide some tips about a crime that's been committed,
but fears for his or her safety if the identity comes to light.
So it may actually be an informant
who's trying to help Phil crack one of his cases open.
[LAUGHTER]
Let me see if I can answer the question this way.
What we are approaching now is perilously close
to a lose-lose situation on the internet,
generally, and not with respect to this anonymous remailer,
where legitimate citizens who are out there surfing the web
have little, if no privacy, because they're
tracked by commercial interests, et cetera.
But people who want to engage in criminal activity
can obtain nearly perfect privacy
by using things such as anonymous web browsing services
and anonymous emailers.
Essentially, we're reaching a level
where just the cognoscenti have privacy,
and criminals who have motive can
become part of the cognoscenti.
And I don't think that situation is advantageous for anyone.
[APPLAUSE]
What you can do about that, Frans?
Well, it seems to me that good criminals and clever criminals
have access to the same technology
that everybody else has.
And if they have access to good crypto stuff,
they can commit and communicate in any degree of security
they like.
And nym.alias.net or any of the other services, I don't think,
offer any additional benefit than existing technologies
for committing crimes.
And I don't see what any additional benefit a criminal
would get.
If you're going to go down that line,
I think the debate really is going
to go about whether people should be allowed to use crypto
technology or not.
And what we're providing, or what nym.alias.net provides
is basically one application of cryptology.
David?
If I could add, first of all, a lot
of the building blocks for privacy
are very, very basic things that are easy to obtain.
So to take a particularly, maybe oversimple example,
if you have two criminals who want to plot some terrorist act
and they don't want you to know that they're communicating
with each other, they could each take out classified ads
in The New York Times every day, or do the equivalent, which
is post to this newsgroup called alt.anonymous.messages,
where they're just all these encrypted messages going by,
and presumably people are downloading the ones that
are destined to them, but you don't know where it's going
or who's reading what.
Definitely one of the goals of nym.alias.net
is to make this technology more available.
And we've done it in at least sort of a one-sided way.
So one thing that people were particularly appreciative
of in the surveys we sent out is that, for example,
this humanitarian aid worker said
that there was no way his or her friends were going
to learn how to use PGP, and encryption software,
and all this stuff.
But this person was willing to put in the time to learn it.
And then, this person could use nym.alias.net to communicate
with other people.
And the nym just looked like an ordinary email address.
So that at least now you can communicate with people.
If you need privacy, you can learn it.
And you don't need to make all your friends learn this stuff.
And again, there's a lot of work to be
done in making this stuff easier to use.
And people have actually written software
to help make it easier to use.
But I absolutely agree that there's a lot to be done.
And I hope that things happen to make privacy easier for people
who are not computer literate.
I definitely think that's an important problem.
Well, David, I think you're bringing us to a close here.
I think that we've learned, on the one hand,
that no one's ready to shut this remailer down.
I also think we've learned that the lose-lose scenario
that Phil describes where privacy is inaccessible to most
and, in fact, used harmfully by some is also not a scenario
judging by the Gallup poll of this audience,
that anyone wants to encourage.
In the spirit of this conference,
in the spirit of looking forward 35 years,
creating the future world of information,
I just want to ask all of you--
David gave his closing hopes, I think.
I want to ask all of you, starting with Frans,
to just give us a sense of how you'd
like the techniques of anonymity to look on the net
as we go forward.
I guess the two--
one way [INAUDIBLE] common.
Basically, I think if we like to see the technology develop
in the direction where more and more people can get access
to technology easily so that their privacy is protected.
And as Nadine pointed out, it's sort of a wild wild west there
on the internet, and privacy is really ill-protected,
and there's a lot of commercial efforts going
on trying to figure out who somebody is
and trying to record things.
And as was pointed out in the talk,
and, in fact, was pointed out in the haystack talk,
it's basically you say something now, or do something now,
and 10 years later, and you can still
be able to find it and exactly discover what you did.
And it also came out, I think, in Ron's talk very clearly.
So figuring out technology that will protect privacy of users
in the internet, I think, is going to be a crucial question,
and I would see that like to to happen.
At the same time, I think it's going
to be crucial to figure out in the next-- whatever--
a couple of decades, what this division is between law
enforcement, or under the laws, and the legal laws
in the technology.
And that struck me as a very important point,
because we certainly want to be the case
that if somebody commits a crime, they face prosecution.
Since this is the sort of final comments,
I want to make and one more other comment.
And actually, I want to thank all the people that actually
have made it possible to be able to run the service
over the last couple of years.
I mean, there are a lot of people, actually, some
in the audience, so many outside of here that helped us
in running the service and dealing
with some of the problematic issues that we faced.
And that's why I want to make sure that those people get
the appropriate thank you.
And Phil, you can thank those people, too, if you choose.
Please.
Am I next?
Yes.
OK.
I'll briefly return to an analogy Nadine drew earlier,
because I'm not really sure she'd like where it goes.
She indicated briefly that I was a person who
wanted to ban the use of the automobile.
But if you think about the illogical
result of that analogy, we have people use automobiles,
but you have to have a driver's license to use them,
and you have to identify yourself to drive the car.
So I think the logical extension of that is everyone
can use computers on the internet,
but you've got to identify yourself to government
and get a license to do it.
I don't think anybody here wants to go there.
So let's just leave that analogy behind.
I guess the concluding point comes from something
that Frans said, which is--
and this comes up all the time in the encryption debate--
the best criminals are going to use--
no matter what government policy is
in encryption-- strong encryption
that doesn't allow for government access.
The best criminals on the internet
are always going to be able to obtain anonymity.
In designing systems, in designing procedures,
for example, building in things like digital signatures
into products that will help law enforcement
determine who's engaging in communications,
if it's a part of a standard.
In designing products, and in designing policies and systems,
if we can do that so that you can
help law enforcement catch the stupid criminals,
that's a big help.
[APPLAUSE]
Nadine, the fate of the smart criminals are in your hands.
I don't want to get too much off into the driving analogy,
but I want to assure everybody out there
that the ACLU is constantly, and to some degree with success,
challenging violations of privacy that are now committed
in the name of driving.
In fact, here in Massachusetts, we recently
won the right of drivers to keep their Social Security numbers
off those licenses, because that's, as you know,
a major way to invade data privacy.
But when Danny asked us to look ahead 35 years,
I did a little bit of calculation here
and I thought, where were we 35 years ago, which was 1964.
In 1964, the United States Supreme Court
was still ruling that wiretapping was not
a search and seizure that was subject to the Fourth Amendment
at all.
That was a decision they made back in 1927
over an eloquent dissent by Justice Louis Brandeis who
issued ringing words that are still uncannily true today.
And unfortunately, I'm going to have
to paraphrase because I didn't bring the quote with me.
But basically the concept was that government is always
going to come up with new technologies that
can be used to invade individual freedom even more
effectively than the means that were available that prompted
the framers to write the Fourth Amendment, the First
Amendment, other individual freedoms into our Constitution.
And we cannot just throw those freedoms to the wind
because of the initial temptation to be panicked about
the potential abuses of the new technology.
But we've repeatedly gone through this cycle,
not only in American history, but around the world when
the printing press was first invented,
panic on the part of governments.
We've got to license it, prior restraint, all of this danger
can be used by criminals, it can corrupt children,
the same litany that we subsequently
heard with every new technology, and now we're
hearing with the internet.
But after a while, the panic subsides.
People understand that it's more alike than it's dissimilar,
that the positive uses far outweigh the dangerous uses,
that alternative means can be found to deal with the danger.
So I hope that, and believe strongly,
that 35 years from now, the panic about this supposed
unique dangers of the internet will seem as antiquated
as the panic that first withdrew constitutional protection
from earlier technologies.
Thank you, Nadine.
I think that the panel has really
done us a tremendous service, because not only have you
really helped us to think through the issues about today
and what we ought to be doing today,
but I think that you've helped us
really to frame what we all have to be thinking about
as we try to put privacy and other important values
into oxygen going forward.
With that, back to Bob Metcalf, our able master of ceremonies.
Thanks very much.
[APPLAUSE]
Thank you, all.
This marks the end of the presentations for the day.
Don't forget that tomorrow morning
we start sharply at 8:30 at the nearby Johnson Center.
And to help you find it tomorrow morning,
we're going to go there now just to show you where it is.
Incidentally, I want to remind you
that we have a special security event tomorrow in connection
with the visit of the Chinese Premier.
So you could come early if you wanted.
It would be OK to come early, rather than try
to think you're going to get in just at the last minute.
And now, we're going to move over
to the Johnson Center for a reception and for demos.
There's a bunch of demos waiting for you now
at the Johnson Center.
Good evening.
[APPLAUSE]