Slashdot Mirror
News.com: Crypto Doesn't Kill - People Do
McSpew writes: "Bravo to News.com for telling the truth about cryptography. They even cited /.'s coverage of Phil Zimmerman's real views on PGP and its possible role in any terrorist acts." On a per-word basis, this may be the best summary of why calls to ban or restrict encryption technology (as with government key escrow, or constrained key sizes) has little to do with enhancing national or world security.
It's quite a valid observation that terorists can write their own software. I managed to write an implementation of RSA in about a day from descriptions only, and that included writing my own big integers library.
All for improving the homeland security, of course.
The problem I see, is that most people view somethings that's encrypted as something more tangable. They want to be able to get their hands on it. They assume simply because people want to hide what a message says, it must be bad/evil. I'd like to be able to keep all my info private.
CIA officials just need to find better ways of snooping on people.
I really hate Dan Patrick.
A good article that could be made better by emphasizing the one-time pad cipher.
The one-time pad is a very easy cipher to explain to lay people. They need no understanding of math, not even arithmetic.
Anybody, anywhere can create a one-time pad by simply flipping a coin or rolling the dice, and use the resulting information to encrypt a message that is impervious to all manners of cryptoanalysis, even techniques made possible by the much-feared though yet-to-be-stocked quantum computer.
In other words, you can create a encrypted message without encryption software or even a computer, and yet be assured that the message is unreadable by any computer devisable today or anytime in the future.
There should be no debate here. Military-grade cryptography is available to anyone with a penny in their pocket and a sheet of paper and pencil.
We need to stop wasting time talking about this.
Is this truly the only Earth I can live on?
They could post their encryption concerns to a site http://slashdot.af/index.pl?section=askslashdot for instance. But I don't think the Taliban would let them call the intellectual currency "karma."
Inventor of the LOLbalrog meme.
Re read that article, but swap every occurrence of "crypto" with "guns".
Now you know what all the gun nuts were talking about.
It's already been done wth handguns - I figured all guns were next, but looks like crypto is next.
(This coming from a geek trying to put it in a language that many marketers, politicians, economists, etc could understand, who actually dislikes most businesses today.)
The simple fact of the matter is that the latest calls for key escrow/backdoors to encryption, just like the ban on exporting 'strong encryption' during the 90's, will in the end only hurt the US.
"Einstein argued that [...] God is not capricious or arbitrary. No such faith comforts the software engineer." ~ Brooks
What about the priority of preserving through logic and appeals to legitimate and justified self-interest the freedoms terrorists would like to destroy with their intimidation attacks? That one suits me.
The FBI has found hand-written order letters in the baggages of terrorists.
Is this PGP ?
NO !
So why does the crypto=terrorist meme still continues ?
Paradoxically, paper letters are a more secure way to transmit information than the internet...
Long ago when PGP was first announced I had a key generated. I have long since forgot about using PGP until PZ's /. post.
I have since installed, and configured PGP and GNU/GPG software on my home and work machines and am making active use of signing my documents. Not only that I've helped several others do the same thing.
Also, in my crypto-arsenal is OpenSSH which is a godsend to me since I no longer use telnet or ftp services on any of my computers accessible to the internet.
It's not that I worry about who is listening, or why; I have nothing to hide. I know that if someone is listening, they won't get squat out of my communications.
The security agencies are already checking through most or a statistical useful percentage of the bytes that flow over the US internet, and are characterising it all. Their actions only make sense if they are doing that.
Anyone using encryption stands out; so they write a file on them.
Where they find encrypted data they can't characterise it any further; so they hit a brick wall. But its not common right now, so they can make a file. However, if everyone on the internet routinely uses uncrackable encryption they can't build a file on everyone.
On the other hand, if they have key escrow they can blow away the encryption on all the legitimate data and they are left with 'illegal' encryption; except presumably terrorists and other malcontents; a much smaller group that they can write files on.
Of course this 'monitor all the traffic on the internet idea' falls down in several other ways. As an example, suppose somebody creates a Quake III server that has some sort of low bandwidth messaging in it perhaps the player steps left at careful timed moments or something, the characterisation by the NSA would be, oh its just another Quake player, when really its sending an encrypted message as well. [I just made that Quake idea up- its called 'steganography' in general, hiding encrypted messages in something else.]
Anyway, that's really what's going on. The security agencies are using the WTC disaster as a chance to get their legislation through whilst the going is good. Of course anyone with any sense can evade it, but not every terrorist has sense.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"One week ago today, I wrote essentially the same thing to my congress people. Here is my letter in case anyone else would like to send it to their congress critters:
------
Honorable Senator xxxxxx,
I am writing to bring to your attention the pointlessness of Senator Judd Gregg's new legislation mandating backdoors in all cryptographic products. I could make many arguments that discuss our civil liberties and the right to be secure within our papers and possessions, but that argument while true and immensely important, is not even required in this case.
Simply put, with respect to strong cryptographic software, the "cat is out of the bag." The world is already full of good, secure cryptographic products with no backdoors. That is the case now, and was PRIOR to Congress' reduction of ITAR restrictions that kept us from exporting strong cryptographic products.
The world is full of smart people many of whom do not work for the NSA, and do not live within the United States. These people in the civilian cryptographic world are constantly researching and developing new cryptographic techniques, which Senator Gregg's legislation WILL NOT AFFECT. No matter how many laws you pass, NOTHING will keep the BAD GUYS from being able to download this cryptographic software from European and other web sites.
If Europe latches on to Senator Gregg's idea of mandating backdoors in all cryptographic products, then the people who want to use cryptographic products with no backdoors will simply write their own, or copy VERBATIM the computer source code for strong cryptographic software that already exists in many hundreds of published books.
Allow me to quote Bruce Schneier, perhaps the United States' leading civilian cryptographic expert:
"To illustrate the ease with which a cryptosystem can be implemented, I present the full code necessary for establishing a secure cryptographic channel over the internet, called the Diffie-Hellman Key Exchange. Both people communicating do the following:
"1. Get public key (Y, P) of the other person. This is just a pair of large numbers.
"2. Raise Y to the power of X, where X is the private key, modulo P. The result is the secret key.
"Modular arithmetic is taught to fourth-graders under the name 'clock math,' and secret-key cryptosystems are just as easy to memorize and implement as public-key systems. I could teach any twelve-year-old how to reproduce from memory in under fifteen minutes a strong cryptosystem on any Windows machine. Any terrorist is quite capable of doing the same."
This speaks volumes about the current state of cryptographic software in the world today, and the ease with which it can be implemented.
If Senator Gregg's legislation is passed, it will have ZERO affect on the people who DO have things to hide from you, and will only harm the innocent citizens of the United States who wish nothing more than to insure that their banking records and private email conversations remain truly private.
Regards,
-----
Rich...
Ignore Alien Orders
224137216
It's 309 digits long! As you can see the numbers are big and get exponentially bigger as the key size increases. The idea with public key encryption is that, while it is quite quick to multiply two numbers this size together, it is very hard to factor the result into the two parts again. It is possible but, for keys > about 56-bit, it is beyond what modern computers are capable of.
Distributed.net is a SETI@home-like project to crack ever larger keys, among other things. Check them out.
After all, the Feds can install keystroke loggers on your 'puter, or they can call out a van full of TEMPEST equipment. The keystroke loggers require agents to physically enter the premises, which obviously requires a warrant. As for the TEMPEST equipment, no precedent exists AFAIK, but the ruling regarding thermal imaging may be helpful.
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delendae sunt RIAA, MPAA et Windoze
It would be more sensible to assume most terrorists aren't so sophisticated. But, in that case, they wouldn't depend on computers for encryption. They would use code phrases, one-way pads, and many other methods that do not depend on computers.
In the end, the people most affected by encryption limiting laws would be common middle-class citizens in the developed nations, people who do on-line shopping and banking, or who use credit cards for any purchases. Remember, you don't need to do any on-line shopping to be vulnerable if your local shopkeepers keep your credit card numbers in vulnerable computers.
They need to have the quantity and quality of understanding and education that you have.
For some, this will be difficult.
Also, some people DO prefer safety to freedom.
"It is a greater offense to steal men's labor, than their clothes"
Now there is finally someone who understands the gun issue... On wait, this article is about encryption!
I do everything the voices in my head tell me to...
Problems like this exist in maths as well as the physical world. One such problem is used in RSA encryption, which can be used in PGP. This problem centers around the belief that it is easy to multiply two very large prime numbers, but given the product it is very difficult to go back to the original primes. I say belief deliberatly since it is possible (albeit extremely unlikely) that there is an easy way to factor large numbers. Most PGP implementations actually use Elgamal rather than RSA, but the principle is similar.
If you are interested in this subject I would strongly recommend you buy/borrow a copy of Applied Cryptography by Bruce Schneier (amazon link). This is the best crypto book available (IMHO) and explains the fundementals of the suject, including the maths behind RSA and ElGamal without requiring any previous knowledge.
Hope this helps.
Steven Murdoch.
web: http://www.cl.cam.ac.uk/users/sjm217/
One thing I find interesting is that these terrorists could have just as easily used cleartext email to distribute their logistic plans. Couldn't they have just have a predetermined language and the actual emails would have looked as innocuous as someone writing their friend to meet somewhere.
Let's meet at 7:45 in front of the Arthur Anderson school on the 11th
Translation: You will overtake American Airlines flight 745 on the 11th
That would look totally benign, yet be the actual trigger to the event. No crypto needed!
What is scary about this U.S. government talk of not allowing secure encryption is that it is working so well. Even the intelligent, educated people who comment on Slashdot (Don't joke about this, it's the truth.) are being led completely away from the real issue.
The real issue is that they are trying to get you to accept that you have no right to privacy.
The really important matter is that the U.S. government is trying to get you to accept the principle that it can spy on you. They know they will lose the encryption battle.
Do you ever have the right to privacy? If there is a single case in which you have the right to privacy, then you have the right to encryption, because you need it for that case.
From the article, What should be the Response to Violence? :
"The U.S. government has three separate, very large agencies that function as global secret police: The FBI, the CIA, and the NSA. The first two are authorized to kill other people. These agencies are secret in two senses: Their activities are hidden from the people of the U.S., even though the U.S. is a democracy. They also have secret budgets. These agencies function everywhere in the world, including inside the U.S."
It has somehow been established that U.S. citizens will accept that they cannot be told about either the activities or the budget of the secret "national security" agencies. Clearly, if they did know, and if they had a chance to vote, most citizens of the U.S. would vote against many of the activities. However, U.S. citizens are not allowed to have enough information to make an informed decision about the secret agencies.
Bush's education improvements were
Steganography.
Steganography.
Steganography.
Fire anti-lameness filter torpedoes...
We've had cryptography and steganography since back when messages were tattoed on the tops of soldiers head and run between camps. The public has been sending secret messages long before it was rendered legal for them to do it, and they will continue long after it is rendered illegal again.
:)
Language has always had two purposes: 1. To aid in communication with those you like, and 2. To hinder communication with those you don't. Otherwise, we would probobly all be speaking in the same tongue or dialect. Even if these laws are passed, sending secret messages will always happen, and crypto/stego are too great a tool to be just thrown away by the people.
Use of GIF images to send secret messages is one obvious way to make your message invisible or even undetectable. Encrypting that message against any commercially available CD image would be even more useful. Any attempts to circumvent that encryption would result in extracting a CD image, and that's a DMCA violation.
"Look at me, I invented the stove!" -- Ben Franklin
...the United States military uses encryption every single day to save thousands of lives. How do you think these soldiers in the field talk to each other, relay coordinates, maintain anonymity in foreign lands to stay alive? That's right class, strong encryption!
It's ok to implement backdoors in the publically available encryption, but oh, this little stuff we use over here in our military is classified, you can't see it, and we can't even tell you we use it.. But here's a 200 page document, all conveniently highlighted in black marker, that explains everything you need to know about it.
All of these politicians and gubbermint officials supporting this type of intrusive "anal exploration" of our freedoms needs a brain exam.
dd if=/dev/urandom ibs=256 count=1 | uuencode binladen.msg
is a criminal act? 'uuencode' may not be strong crypto, but it's still crypto...
(Damn! I like that "Gestapo Key" notion!)
Here's how I would explain it:
"Cryptography is a mathematical method used for the secure transmission of mails, financial transactions, credit card information, and confidential business documents. Securing the transmission makes sure that only the intended recipient will be able to read the information."
Note that the word cryptography is used only once, and the but-it's-a-terrorist-tool reaction is prevented by immediately explaining it's nothing but mathematics. Make sure not to scare people of off with technical terms. Explain to them why they need encryption, not how it works.
Sig (appended to the end of comments I post, 54 chars)
So if you keep making suspicious remarks like that it won't be long before the black vans arrive in the dead of night to drag you away, and your neighbors pretend to hear nothing when you scream!
:)
Though I agree with everything you said, the fundamental problem goes a bit deeper than privacy.
The full underlying cause of this is nationalism and the belief that the State is an almost divine entity that will protect you from all ills provided you play by its rules.
History shows that this is a fool's bargain. Any state--and yes, flag-wavers, that includes the US--is *designed* to limit your freedoms for the "greater good". While this works for a great many people indoctrinated to accept the definitions the State provides for "freedom" and "democracy", it is not, nor has it ever been, a complete solution for people in the world, and *much* has been done in the name of the State--like much was done in the name of God before it--that is simply hateful and evil.
Allegiance to the State, a belief that the State is all, that you should be proud to be part of the State, happened in Germany in the 1930s, and it appears to be happening here. Based on some of the troll posts here, you just have to substitute Arab for Jew, and you have the basic plank of the Nazi party flying in full colors.
How does this relate to crypto? It doesn't really at all--that's the point. But, if we're really trying to make a connection, then there's the tenuous observation that crypto is math, and knows no allegiance to State, which has no allegiance to you, meaning that Crypto is like the State in that it is an abstract concept without any feeling or allegiance to anyone or anything. The major difference between Crypto and the State is that the State is established, has full access to social control mechanisms, and panders to people's senses of belonging while Crypto is simply math that individuals can use to keep pieces of themselves from the State and unto themselves.
It is natural that the State--which *fully* seeks the totality of National Socialism, and now has the capacity to make _1984_ look like a Disneyland ride--would seek to abolish the one tool that can put an individual on equal footing with it. It's up to *us* to drop our allegiance to one abstract concept and rally our efforts around the other.
I'll leave it up to you to decide which way the wind appears to be blowing.
"The more corrupt the state, the more numerous the laws."--Tacitus, The Histories
But haven't you seen that Simpsons episode where Homer joins the NRA? Guns can be used as TV remote controls, light switches (off only), beer can openers, etc. There's a world of possibilities out there.
On a serious note, the purpose of a gun is to propel a projectile at a high velocity. The gun does not (well, in most cases at least, target recognition and artificial intelligence aside) aim itself. It takes a person to decide whether to point the gun at a paper target, television, car, animal, person, etc. The issue isn't what the gun is capable of, but whether the person holding it is capable of handling the task of pointing it (this isn't always properly addressed by firearms regulations unfortunately).
Cryptography is quite a different issue, as it only affects the flow of information. Law enforcement agencies are complaining because they want all information to flow through them. The idea is that they must know what everyone is doing so that they will know when someone is doing something wrong. Since that is going a bit far, they will settle for just the option of knowing what someone is doing if they think that person is doing something wrong. Cryptography presents a challenge here, so back doors have been proposed to potentially remove the potential that someone could possibly be planning to maybe do something that could be bad without law enforcement knowing about it. If that sounds absurd, it's because it is, and that's the point.
From the article: "Once surveillance tools receive legitimization, who can guarantee that they'll always be used in enlightened ways by an administration in, oh, how about the year 2084?"
This is a good point. I'm glad someone finally pays attention to what's going on. Each standalone piece of legislation eventually gets combined into something larger when newer legislation is added. Rarely if ever is any legislation removed. The end result is that the government can only increase its power, decreasing that of its people. We can talk all we want about passing laws, like encryption backdoors, national ID cards, etc. The problem is that most people understand how these laws affect their lives now, but they don't extrapolate and try to picture the future. Furthermore...
From the article: "The competitive angle: If U.S. companies are forced to play by the these rules, rest assured there are foreign companies aplenty that will get around the Americans' export ban."
... You can't say that the encryption won't be cracked. Where there's a will, there's a way, and the backdoors will eventually be cracked. It's only a matter of time. Crackers (and foreign companies) will continue to use unencumbered encryption, while accessing our communications through the backdoors. The whole scheme sounds great from our law enforcement's point of view, but will actually make us much less secure. Imagine financial, legal and medical information getting into the wrong hands. (Besides, you don't honestly believe the government will use the same weak encryption as we will, do you?)
To make a long story short, as with any technology and knowledge, encryption can be used for good or evil. Chances are, most everything is used mostly for good. We shouldn't punish our entire country because some jerk-off from Wastelandistan may have used encryption.
Doesn't work. As far as I remember the news reports, the tickets were mostly bought a while before the attack, and they were bought over a period of a few days. If there was such a trigger event, it was something else.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
If I understand you correctly and you're saying that crypto isn't common right now, that's not true. Salespeople around the US have been selling Virtual Private Networks (VPNs) to companies for a few years now, and these encrypt all traffic between a company's sites. While there almost certainly is still much more unencrypted traffic on the net than encrypted traffic, encrypted traffic is far too common for the government to be building a file on every instance they encounter.
Many lawyers use encrypted email because of legal precedent which makes email less legally "privileged" than say a phone conversation.
Then there are all the /. nerds using SSH to talk to their servers. Do you think the FBI or NSA has a file on Shoeboy?
Everyday use of encryption is a lot more common than you might imagine.
Except that all you need to do is doubly-encrypt your messages - first with strong crypto, then with government-approved crypto. This can't be detected without going through the legal process of obtaining a key, so widespread scanning for non-approved crypto will only turn up the conscientious objectors and a few really dumb folk. Then again, some people say stupidity should be a crime...
All this backdoor nonsense is simply a ploy to shorten the processing time on the supercomputers to crack it. Save a few billion dollars here and there in computation time.
-
To really drive the point home about how hard it is to factor these big numbers, check out the prize list for The RSA Factoring Challenge. If anyone doesn't believe that it's difficult, well, there's a total of about $635,000 waiting for the person who can prove that it's not!
People who have never fired a gun are more likely to demonize guns. People who have not beneficially used cryptography are more likely to support restrictions on crypto.
.22 rifle. Therefore, I am permanently in the pro-gun camp. I could come up with lots of "reasons" but the real reason is experience. Likewise, most religious people follow the religion in which they were raised.
When I was a child, I was trained to fire a
As for sanity checks, what's the point? Accidental and criminal shooting far outnumber shootings by insane people. It's just that the media gives more play to "loony kills 20" than to "drug dealer shoots another drug dealer, again."
So you have a backdoor to all encryption: in 2005, Osama Bin Laden II has managed to crack the back door -- but he doesn't tell anybody, because that would undercut public confidence in the cryptosystem. Instead what he does, is eavesdrop on 'secure' conversations, and mess up financial transactions for the next year or 3.... until people realize what's going on, and trash the back doors
At that point, we're back were we started from -- except for the fact that we've had a few years of badly compromised commerce and communications.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Many of the guns=crypto arguments I am reading here have one fatal flaw:
Most people understand they do not have the right to point a gun at a cop or a federal officer. So why would those same people think they have they right to use crypto when the feds have a need to know?
Don't get the wrong idea. I don't like the idea of having my personal data searched without a search warent. But you need better logic than bastardizing the gun ownership argument.
Oh boy.
.gov would want to tap my phones is if I were doing something bad
.gov has will be misused to a greater or lesser degree. Innocent people will be hit by these misuses. Innocent people will go to jail as a direct result of these misuses. And innocent people will have no recourses.
government phone taps do not bother me because I know the only reason the
That's a completely specious argument.
Government people don't tap people's phones because they're doing something bad. Government people tap people's phones because they're under suspicion of doing something bad. You own a gun. You post on slashdot. You have a computer. You have political opinions. In some jurisdictions, that's more than enough to put you under suspicion of doing something bad. Like here in California.
If the government knows someone is doing something bad, then they don't have any need of a phone tap: they already have enough evidence for a conviction. The rule in law enforcement is "go far enough to get sufficient evidence for a conviction, and then stop!" The perpetual fear in the DA's office is that law enforcement will uncover exculpatory evidence (that's evidence that proves the suspect's innocence). Since the prosecution is obligated under discovery rules to turn over all evidence to the defense, the presence of exculpatory evidence is a bad thing in the eyes of the DA's office. DAs don't make the connection with the fact that the presence of exculpatory evidence means they're prosecuting the wrong guy: they just want a conviction so they can close the book.
What all this means is that if the LEAs have enough evidence to convict you, they won't even attempt to tap your phone, because their investigation might backfire. And since you don't need proof of wrongdoing to convict (you only need enough evidence to show wrongdoing "beyond a reasonable doubt"), the certain knowledge of wrongdoing is also a guarantee that the LEAs have enough evidence to satisfy a jury. Note that I said certain knowledge, not strong suspicion: LEAs are excitable folks who tend to leap to conclusions.
And that tendency to leap to conclusions is part of the problem. By and large, LEAs are ignorant boobs. I've had a lot of contact with the Secret Service's technology investigations group and the FBI's computer crime squad in San Fransisco, and even these guys (law enforcement's technological elites) aren't sufficiently up to speed to avoid leaping to conclusions.
Just look at the public records of the LAPD's illegal use of wiretaps throughout the 90's. At the instruction of the LA DA's office, no less. This was an ongoing, persistant misuse of wiretaps lasting many years, none of which were authorized by courts. With such widespread misuse in one jurisdiction, one must conclude that such misuse occurs in other jurisdictions as well. Cops, just like other professionals, have a tendancy to jump from one job to another, though perhaps not as often as in technical fields. So even if other jurisdictions didn't come up with the idea on their own, crosscontamination would've occurred. And the record is clear that illegal wiretaps have been commonplace throughout the US for decades at least. Since not all misuse is detectable, the truth must be that wiretaps are even more horribly misused than is known.
What all this means is that you should assume that any ability that the
Whether you're talking about wiretaps, gun registration databases, sex offender registries, or crypto backdoors, the issue isn't whether or not you've done something bad. It's merely whether or not you appear to have done something bad, or in the worst case, whether or not it can be made to appear that you've done something bad.
The simple matter is that with the sheer quantity and scope of the laws that already exist on the books, every one of you has done something bad. It's not possible to live a day in society without breaking a law. Do you have a bag of blue ice (the freezable cold packs) in your freezer? How about a piece of wood and some sandpaper? Or maybe a can of gasoline? If any of those are true, then you are in possession of bomb making materials. That's a federal felony. Do you own a car? Do you drive it? Then you're guilty of transporting hazardous materials without a license. Federal misdemeanor. Have you ever said the words "someone should kill the president" or anything to that effect, regardless of context or intent? Federal felony. Called a enemy in an online multiplayer game a "fucking nigger" for cheating? Or how about "bitch"? That's hate speech. Municipal misdemeanor in many jurisdictions. Do you possess pictures of your children as babies, naked? Child porn (go read the statute: it's very much over broad). Federal felony. Have you ever had sex with your boyfriend/girlfriend while they were a minor and you weren't (such as when you were 18 and they were 17)? Statutory rape. Federal felony with strong enforcement ("strong enforcement" is a term of art that means that the victim or victim's parents don't have to agree that a crime has been committed in order for prosecution to proceed).
LEAs will try to tell you that they won't proceed with prosecution unless there was "intent to commit a crime." But in practice, that's nonsense. "Intent" is defined and shown by the DA's office (or AG's office), not by the LEAs or defendant, and in the case of strong enforcement statutes, is irrelevant anyway.
Ok, I'm starting to ramble. So I'll sum up: we must always resist giving any power to law enforcement that is capable of being abused, because any abusable power will be abused, and the innocents are the only people who will suffer.
-- Nolite audere delere orbiculum rigidum meum.
"We are facing an enemy like we've never faced before, we can't see him, we can't bomb him. and[...]"
He's right, and to make every computer-illeterate american feel safe, his administration pointed a "tangible" enemy on which they can "look like they can do something about it".
Too bad they are forgetting that people can now use the net if they want to find out about stuff they don't understand fully. And besides, even if you're flipping burgers, you can understand that there's a shitload of material already available to build a safe encryption mechanism with what's on the net.
Talk about shooting in any directions. I'd feel much safer knowing they've catched the leaders of all the known terrorists groups, and that people increase the immigration security/background check.
--- Metamoderating abusive downgraders since my 300th post.
As far as I can see, *email* encryption really is what the general media and the politicians do think the argument is all about. Because so far only a small fringe minority use encrypted email, the pols think it will hardly be missed; and besides, the obsessive secrecy probably indicates that the users are up to no good anyway.
The idea of *channel* encryption probably doesn't even cross their radar. But 'alienmole' is absolutely right: the most widespread and important use of encryption at the moment is *not* email; it is the use of ssh and friends to secure public channels. And the reason these are so important is obvious -- and probably much easier to explain to the public -- in these days of crackers and virus writers: you really don't want anyone to be able to break into your channel, and interfere with your remotely-controlled telescope or heart operation or hack into your corporate network or whatever.
The case for SSH is much easier to make than the case for PGP, because of its demonstrable real-world importance. If we can move the debate towards channel security, away from email security, it will be much easier to win.
But of course as soon as two people can ssh into the same box and talk to each other, the banning of any other uses of encryption starts to look pretty irrelevant.
Not just write their own, there is a heap of good working encryption stuff, including steganography, available outside the USA for essentially no effort. The effect of outlawing encryption (or legislating key-escrow) will be to leave ``real'' encryption only in the hands of the terrorists and other outlaws.
The gun people have a saying ``If guns are outlawed, only outlaws will have guns.'' They're right, in a general sense, but this catch-cry is a two-edged sword. If guns (or truly secure encryption) is outlawed, ordinary people who must use them for their reasonable daily business will be, by definition, outlaws.
The idea of laws scaring terrorists is unbelievably stupid, thick, dumb, brainless, naive, irresponsible and many other bad things. It reminds me of the locality which has a $500 fine for detonating a nuclear explosive within city limits. If the cost of your terror mission against ``the great satan'' is your own life and the lives of many others what difference is the threat of a fine or jail term - or for that matter even a death sentence - ever going to make to you?
Got time? Spend some of it coding or testing
I don't know, maybe you could ask them if they would send their credit card number on a postcard? They also don't "see" anyone reading that. But those people are probably the ones that don't want to understand.
Maybe you could also try and explain to them the structure of the internet, the fact that they cannot control which systems will transmit their information, that those systems might be the systems of their competitors. But then, those people probably also don't want to know about network architectures.
Sig (appended to the end of comments I post, 54 chars)