CPSR Letter on Crypto Policy

The following is the text of a letter Computer Professionals for Social
Responsibility (CPSR) recently sent to Rep. Jack Brooks, chairman of the House
Judiciary Committee.  The letter raises several issues concerning computer
security and cryptography policy.  For additional information on CPSR's
activities in this area, contact banisar@washofc.cpsr.org.   For information
concerning CPSR generally (including membership information), contact
cpsr@csli.stanford.edu.

====================================================

August 11, 1992

Representative Jack Brooks Chairman House Judiciary Committee 2138 Rayburn
House Office Bldg. Washington, DC 20515-6216

Dear Mr. Chairman:

     Earlier this year, you held hearings before the Subcommittee on Economic
and Commercial Law on the threat of foreign economic espionage to U.S.
corporations.  Among the issues raised during the hearings were the future of
computer security authority and the efforts of government agencies to restrict
the use of new technologies, such as cryptography.

     As a national organization of computer professionals interested in the
policies surrounding civil liberties and privacy, including computer security
and cryptography, CPSR supports your efforts to encourage public dialogue of
these matters.  Particularly as the United States becomes more dependent on
advanced network technologies, such as cellular communications, the long-term
impact of proposed restrictions on privacy-enhancing techniques should be
carefully explored in a public forum.

     When we had the opportunity to testify before the Subcommittee on
Legislation and National Security in May 1989 on the enforcement of the
Computer Security Act of 1987, we raised a number of these issues.  We write to
you now to provide new information about the role of the National Security
Agency in the development of the Digital Signature Standard and the recent
National Security Directive on computer security authority. The information
that we have gathered suggests that further hearings are necessary to assess
the activities of the National Security Agency since passage of the Computer
Security Act of 1987.

The National Security Agency and the Digital Signature Standard

     Through the Freedom of Information Act, CPSR has recently learned that the
NSA was the driving force behind the selection and development of the Digital
Signature Standard (DSS).  We believe that the NSA's actions contravene the
Computer Security Act of 1987.  We have also determined that the National
Institute of Standards and Technology (NIST) attempted to shield the NSA's role
in the development of the DSS from public scrutiny.

     The Digital Signature Standard will be used for the authentication of
computer messages that travel across the public computer network.  Its
development was closely watched in the computer science community. Questions
about the factors leading to the selection of the standard were raised by a
Federal Register notice, 56 Fed. Reg. 42, (Aug 30, 1991), in which NIST
indicated that it had considered the impact of the proposed standard on
"national security and law enforcement," though there was no apparent reason
why these factors might be considered in the development of a technical
standard for communications security.

     In August 1991, CPSR filed a FOIA request with the National Institute of
Standards and Technology seeking all documentation relating to the development
of the DSS.  NIST denied our request in its entirety.  The agency did not
indicate that they had responsive documents from the National Security Agency
in their files, as they were required to do under their own regulations.  15 C.
F.R. Sec. 4.6(a)(4) (1992).  In October 1991, we filed a similar request for
documents concerning the development of the DSS with the Department of Defense.
The Department replied that they were forwarding the request to the NSA, from
whom we never received even an acknowledgement of our request.

     In April 1992, CPSR filed suit against NIST to force disclosure of the
documents.  CPSR v. NIST, et al., Civil Action No. 92-0972-RCL (D.D.C.).  As

a result of that lawsuit, NIST released 140 out of a total of 142 pages. Among
those documents is a memo from Roy Saltman to Lynn McNulty which suggests that
there were better algorithms available than the one NIST eventually recommended
for adoption. If that is so, why did NIST recommend a standard that its own
expert believed was inferior?

     Further, NIST was required under Section 2 of the Computer Security Act to
develop standards and guidelines to "assure the cost-effective security and
privacy of sensitive information in federal systems." However, the algorithm
selected by NIST as the DSS was purposely designed to minimize privacy
protection: its use is limited to message authentication.  Other algorithms
that were considered by NIST included both the ability to authenticate messages
and the capability to incorporate privacy-enhancing features.  Was NSA's
interest in communication surveillance one of the factors that lead to the NIST
decision to select an algorithm that was useful for authentication, but not for
communications privacy?

     Most significantly, NIST also disclosed that 1,138 pages on the DSS that
were created by the NSA were in their files and were being sent back to the NSA
for processing.  Note that only 142 pages of material were identified as
originating with NIST.  In addition, it appears that the patent for the DSS is
filed in the name of an NSA contractor.

     The events surrounding the development of the Digital Signature Standard
warrant further Congressional investigation.  When Congress passed the Computer
Security Act, it sought to return authority for technical standard-setting to
the civilian sector.  It explicitly rejected the proposition that NSA should
have authority for developing technical guidelines:

     Since work on technical standards represents virtually
     all of the research effort being done today, NSA would
     take over virtually the entire computer standards job
     from the [National Institute of Standards and
     Technology].  By putting the NSA in charge of developing
     technical security guidelines (software, hardware,
     communications), [NIST] would be left with the
     responsibility for only administrative and physical
     security measures -- which have generally been done
     years ago.  [NIST], in effect, would on the surface be
     given the responsibility for the computer standards
     program with little to say about the most important part
     of the program -- the technical guidelines developed by
     NSA.

Government Operation Committee Report at 25-26, reprinted in 1988 U.S. Code
Cong. and Admin. News at 3177-78.  See also Science Committee Report at 27,
reprinted in 1988 U.S.C.A.N. 3142.

     Despite the clear mandate of the Computer Security Act, NSA does, indeed,
appear to have assumed the lead role in the development of the DSS.  In a
letter to MacWeek magazine last fall, NSA's Chief of Information Policy
acknowledged that the Agency "evaluated and provided candidate algorithms
including the one ultimately selected by NIST."  Letter from Michael S. Conn to
Mitch Ratcliffe, Oct. 31, 1991.  By its own admission, NSA not only urged the
adoption of the DSS -- it actually "provided" the standard to NIST.

     The development of the DSS is the first real test of the effectiveness of
the Computer Security Act.  If, as appears to be the case, NSA was able to
develop the standard without regard to recommendations of NIST, then the intent
of the Act has clearly been undermined.

     Congress' intent that the standard-setting process be open to public
scrutiny has also been frustrated.  Given the role of NSA in developing the
DSS, and NIST's refusal to open the process to meaningful public scrutiny, the
public's ability to monitor the effectiveness of the Computer Security Act has
been called into question.

     On a related point, we should note that the National Security Agency also
exercised its influence in the development of an important standard for the
digital cellular standards committee.  NSA's influence was clear in two areas. 
First, the NSA ensured that the privacy features of the proposed standard would
be kept secret.  This effectively prevents public review of the standard and is
contrary to principles of scientific research.

The NSA was also responsible for promoting the development of a standard that
is less robust than other standards that might have been selected. This is
particularly problematic as our country becomes increasingly dependent on
cellular telephone services for routine business and personal communication.

     Considering the recent experience with the DSS and the digital cellular

standard, we can anticipate that future NSA involvement in the technical
standards field will produce two results: (1) diminished privacy protection for
users of new communications technologies, and (2) restrictions on public access
to information about the selection of technical standards.  The first result
will have severe consequences for the security of our advanced communications
infrastructure.  The second result will restrict our ability to recognize this
problem.

     However, these problems were anticipated when Congress first considered
the possible impact of President Reagan's National Security Decision Directive
on computer security authority, and chose to develop legislation to promote
privacy and security and to reverse efforts to limit public accountability.

National Security Directive 42

      Congressional enactment of the Computer Security Act was a response to
President Reagan's issuance of National Security Decision Directive ("NSDD")
145 in September 1984.  It was intended to reverse an executive policy that
enlarged classification authority and permitted the intelligence community
broad say over the development of technical security standards for unclassified
government and non-government computer systems and networks.  As noted in the
committee report, the original NSDD 145 gave the intelligence community new
authority to set technical standards in the private sector:

     [u]nder this directive, the Department of Defense (DOD)
     was given broad new powers to issue policies and
     standards for the safeguarding of not only classified
     information, but also other information in the civilian
     agencies and private sector which DOD believed should be
     protected.  The National Security Agency (NSA), whose
     primary mission is one of monitoring foreign
     communications, was given the responsibility of
     managing this program on a day-to-day basis.

H. Rep. No. 153 (Part 2), 100th Cong., 1st Sess. 6 (1987).  The legislation was
specifically intended to override the Presidential directive and to "greatly
restrict these types of activities by the military intelligence agencies ...
while at the same time providing a statutory mandate for a strong security
program headed up by [NIST], a civilian agency."  Id. at 7.

     President Bush issued National Security Directive ("NSD") 42 on July 5,

1990.  On July 10, 1990, Assistant Secretary of Defense Duane P. Andrews
testified before the House Subcommittee on Transportation, Aviation, and
Materials on the contents of the revised NSD.  The Assistant Secretary stated
that the "the new policy is fully compliant with the Computer Security Act of
1987 (and the Warner Amendment) and clearly delineates the responsibilities
within the Federal Government for national security systems."

     On August 27, 1990, CPSR wrote to the Directorate for Freedom of
Information of the Department of Defense and requested a copy of the revised
NSD, which had been described by an administration official at the July hearing
but had not actually been disclosed to the public.  CPSR subsequently sent a
request to the National Security Council seeking the same document.  When both
agencies failed to reply in a timely fashion, CPSR filed suit seeking
disclosure of the Directive. CPSR v. NSC, et al., Civil Action No. 91-0013-TPJ
(D.D.C.).

     The Directive, which purports to rescind NSDD 145, was recently disclosed
as a result of this litigation CPSR initiated against the National

Security Council.

     The text of the Directive raises several questions concerning the
Administration's compliance with the Computer Security Act:

     1. The new NSD 42 grants NSA broad authority over "national security
systems."  This phrase is not defined in the Computer Security Act and raises
questions given the expansive interpretation of "national security"
historically employed by the military and intelligence agencies and the broad
scope that such a term might have when applied to computer systems within the
federal government.

     If national security now includes international economic activity, as
several witnesses at your hearings suggested, does NSD 42 now grant NSA
computer security authority in the economic realm?  Such a result would clearly
contravene congressional intent and eviscerate the distinction between civilian
and "national security" computer systems.

     More critically, the term "national security systems" is used throughout
the document to provide the Director of the National Security Agency with broad
new authority to set technical standards.  Section 7 of NSD 42 states that the
Director of the NSA, as "National Manager for National Security
Telecommunications and Information Systems Security," shall

     * * *

     c. Conduct, *approve*, or endorse research and
     development of techniques and equipment to secure
     national security systems.

     d. Review and *approve* all standards, techniques,
     systems, and equipment, related to the security of
     national security systems.

     * * *

     h. Operate a central technical center to evaluate and
     *certify* the security of national security
     telecommunications and information systems.

(Emphasis added)

     Given the recent concern about the role of the National Security Agency

in the development of the Digital Signature Standard, it is our belief that any
standard-setting authority created by NSD 42 should require the most careful
public review.

     2. NSD 42 appears to grant the NSA new authority for  information
security.  This is a new area for the agency; NSA's role has historically been
limited to communications security.  Section 4 of the directive provides as
follows:

     The National Security Council/Policy Coordinating
     Committee (PCC) for National Security Telecommuni-
     cations, chaired by the Department of Defense, under the
     authority of National Security Directives 1 and 10,
     assumed the responsibility for the National Security
     Telecommunications NSDD 97 Steering Group.  By
     authority of this directive, the PCC for National Security
     Telecommunications is renamed the PCC for National
     Security Telecommunications and Information Systems,
     and shall expand its authority to include the
     responsibilities to protect the government's national
     security telecommunications and information systems.

(Emphasis added).

     Thus, by its own terms, NSD 42 "expands" DOD's authority to include
"information systems."  What is the significance of this new authority? Will it
result in military control of systems previously deemed to be civilian?

     3. NSD 42 appears to consolidate NSTISSC (The National Security
Telecommunications and Information Systems Security Committee) authority for
both computer security policy and computer security budget determinations.

     According to section 7 of the revised directive, the National Manager for
NSTISSC shall:

     j. Review and assess annually the national security
     telecommunications systems security programs and
     budgets of Executive department and agencies of the U.S.
     Government, and recommend alternatives, where
     appropriate, for the Executive Agent.

     NTISSC has never been given budget review authority for federal agencies. 
This is a power, in the executive branch, that properly resides in the Office
of Management and Budget.  There is an additional concern that Congress's
ability to monitor the activities of federal agencies may be significantly
curtailed if this NTISSC, an entity created by presidential

directive, is permitted to review agency budgets in the name of national
security.

     4. NSD 42 appears to weaken the oversight mechanism established by the
Computer Security Act.  Under the Act, a Computer Systems Security and Privacy
Advisory Board was established to identify emerging issues, to inform the
Secretary of Commerce, and to report findings to the Congressional Oversight
Committees.  Sec. 3, 15 U.S.C. Sec. 278g-4(b).

     However, according to NSD 42, NSTISSC is established "to consider
technical matters and develop operating policies, procedures, guidelines,
instructions, and standards as necessary to implement provisions of this
Directive."  What is the impact of NSTISSC authority under NSD 42 on the review
authority of the Computer Systems Security and Privacy Advisory Board created
by the Computer Security Act?

Conclusion

     Five years after passage of the Computer Security Act, questions remain
about the extent of military involvement in civilian and private sector
computer security.  The acknowledged role of the National Security Agency in
the development of the proposed Digital Signature Standard appears to violate
the congressional intent that NIST, and not NSA, be responsible for developing
security standards for civilian agencies.  The DSS experience suggests that one
of the costs of permitting technical standard setting by the Department of
Defense is a reduction in communications privacy for the public.  The recently
released NSD 42 appears to expands DOD's security authority in direct
contravention of the intent of the Computer Security Act, again raising
questions as to the role of the military in the nation's communications
network.

     There are also questions that should be pursued regarding the National
Security Agency's compliance with the Freedom of Information Act.  Given the
NSA's increasing presence in the civilian computing world, it is simply
unacceptable that it should continue to hide its activities behind a veil of

secrecy.  As an agency of the federal government, the NSA remains accountable
to the public for its activities.

     We commend you for opening a public discussion of these important issues
and look forward to additional hearings that might address the questions we
have raised.


                                                     Sincerely,



                                                     Marc Rotenberg, Director
                                                     CPSR Washington Office