textfiles/law/privsoc.law

                      THE PRIVATE AND OPEN SOCIETY
                            BY JOHN GILMORE

A transcript of remarks given by John Gilmore at the First Conference on
Computers, Freedom, and Privacy, March 28,1991

My talk concerns two ethics - the belief in an open society and the
belief in privacy.  These two ethics are related , and I would like to
say something about how they relate to our conduct in the world.

This society was built as a free and open society.  Our ancestors, our
parents, our peers, and ourselves are all making and building this
society in such a way - because we believe such a society outperforms
closed societies - in quality of life, in liberty, and in the pursuit of
happiness.

But I see this free and open society being nibbled to death by ducks, by
small, unheralded changes.  It's still legal to exist in our society
without an ID - but just barely.  It is still legal to exist by paying
with cash - just barely.  It is still legal to associate with anyone you
want - unless they bring a joint onto your boat, photograph naked
children for your museum, or work for you building a fantasy roleplaying
game.  And I think conferences like ours run the risk of being co-opted;
we sit here and we work hard and we talk to people and build our
consensus on what are relatively minor points, while we lose the larger
open society.

For example - we have the highest percentage in the world of our own
population in jail.  We used to be number two but last year we passed
South Africa.  We are number one.

Over the last ten years we've doubled the number of people in jail.  In
fact, those extra cells are mostly filled with people on drug charges, a
victimless crime that twenty years ago was accepted behavior.

But it's no wonder we are concerned about privacy, because we are all
"lawbreakers", We all break the law, but few of us are criminals.  The
problem is that simply attracting the attention of the police is enough
to put the best of us at risk, because we break the law all the time and
it's set up to make that happen!

I don't blame the cops for this.  They mostly just enforce the bad laws
that the legislatures write.  The legislatures aren't completely at
fault either, because in the long run, only educating the whole
population about the benefits of openness has a chance.  And I think I
do a little bit of work in this area.

But beyond that, as P. T. Barnum said, "Nobody ever lost money by
underestimating the intelligence of the American public."  Where I hold
out the most hope is in a different approach.  In the paraphrased words
of Ted Nelson, we probably can't stop this elephant but maybe we can run
between its legs.

In most of Europe, phone companies don't record the phone numbers when
you call, and they don't show up on your bill.  They only tick off the
charges on a meter.  Now, I was told that this is partly because the
Nazis used the call records that they used to have, to track and
identify the opposition after taking over those countries in World War
II.  They don't keep those records any more.

In the U.S., people boycotted the 1990 census in record numbers.  I
think that the most shameful story of how Japanese-Americans were
rounded up using census data had a lot to do with that.

Professor Tribe talked about the distrust we must hold for our
government.  We have to realize that people who run the government can
and do change.  Our society and laws must assume that bad people -
criminals even - will run the government, at least part of the time.

There's been a lot of talk here about privacy ... but we haven't focused
much on why we want it.  Privacy is a means; what is the real end we are
looking for here?  I submit that what we're looking for increased
tolerance.

Society tolerates all different kinds of behavior - differences in
religion, differences in political opinions, races, etc.  But if your
differences aren't accepted by the government or by other parts of
society, you can still be tolerated if they simply don't know that you
are different.  Even a repressive government or a regressive individual
can't persecute you if you look the same as everybody else.  And, as
George Perry said today, "Diversity is the comparative advantage of
American society".  I think that's what privacy is really protecting.

The whole conference has spent a lot of time talking about ways to
control uses of information and to protect peoples' privacy after the
information was collected.  But that only works if you assume a good
government.  If we get one seriously bad government, they'll have all
the information they need to make an efficient police state and make it
the last government.  It's more than convenient for them - in fact, it's
a temptation for people who want to do that, to try to get into power
and do it.  Because we are giving them the means.

What if we could build a society where the information was never
collected?  Where you could pay to rent a video without leaving a credit
card number or a bank number?  Where you could prove you're certified to
drive without ever giving your name?  Where you could send and receive
messages without revealing your physical location, like an electronic
post office box?

That's the kind of society I want to build.  I want a guarantee - with
physics and mathematics, not with laws - that we can give ourselves
things like real privacy of personal communications.  Encryption strong
enough that even the NSA can't break it.  We already know how.  But
we're not applying it.  We also need better protocols for mobile
communication that can't be tracked.

We also want real privacy of personal records.  Our computers are
extensions of our minds.  We should build them so that a thought written
in the computer is as private as a thought held in our minds.

We should have real freedom of trade.  We must be free to sell what we
make and buy what we want - from anyone and to anyone - to support
ourselves and accomplish what we need to do in this world.

Importantly, we need real financial privacy because the goods and
information cost money.  When you buy or sell or communicate, money is
going to change hands.  If they can track the money, they can track the
trade and the communication, and we lose the privacy involved.

We also need real control of identification.  We need the right to be
anonymous while exercising all other rights.  So that even with our
photos, our fingerprints and our DNA profile, they can't link our
communication and trade and financial activities to our person.

Now I'm not talking about lack of accountability here, at all.  We must
be accountable to the people we communicate with.  We must be
accountable to the people we trade with.  And the technology must be
built to enforce that.  But we must not be accountable to THE PUBLIC for
who we talk to, or who we buy and sell from.

There's plenty of problems here.  I think we need to work on them.  Just
laws need to be enforced in such a society.  People need to find
like-minded people.  And somebody still has to pay the cost of
government, even when they can't spy on our income and our purchases.  I
don't know how to solve these problems, but I'm not willing to throw the
baby out with the bath water.  I still think that we should shoot for
real privacy and look for solutions to these problems.

How do we create this kind of society?  One way is to stop building and
supporting fake protections, like laws that say you can't listen to
cellular phone calls.  We should definitely stop building outright
threatening systems like the Thai ID system or the CalTrans vehicle
tracking system.

Another thing to do is, if you know how, start and continue building
real protections into the things you build.  Build for the US market
even if the NSA continues to suppress privacy with export controls on
cryptography.  It costs more to build two versions, one for us and one
for export, but it's your society you're building for, and I think you
should build for the way you want to live.

If you don't know how to build real protection, buy it.  Make a market
for those people who are building it, and protect your own privacy at
the same time by putting it to use.  Demand it from the people who
supply you, like computer companies and cellular telephone
manufacturers.

Another thing is to work to eliminate trade restrictions.  We should be
able to import the best from everywhere and we should be able to export
the privacy and the best of our products to the rest of the world.  The
NSA is currently holding us hostage; Mainframe manufacturers, for
example, haven't built in security because they can't export it.  IBM
put DES into their whole new line of computers, and they were only going
to put it on the U.S. models, but the NSA threatened to persecute them
by stalling even their allowable exports in red tape.  IBM backed down
and took it out.  We can't allow this to continue.

We also need to educate everyone about what's possible so we can choose
this kind of freedom rather than assume it's unattainable.

None of these ideas are new. Freedom of association and privacy have
been prized by people everywhere. Cryptography has been used for these
goals for thousands of years. But we owe a special debt to cryptographer
David Chaum for researching how modern cryptography can enable these
goals to be met by everyone in society, on a large scale.  By reading
David's work, you can begin to understand the capabilities of
cryptography and how to apply them to provide financial and personal
privacy.

We need to keep cash and anonymity legal.  We'll need them as precedents
for untraceable electronic cash and cryptographic anonymity.

I think with these approaches, we'll do a lot more for our REAL freedom,
our real privacy, and our real security, than passing a few more laws or
scaring a few more kid crackers.  Please join me in building a future
we'll be proud to inhabit and happy to leave to our children.

Downloaded From P-80 International Information Systems 304-744-2253