Reports You Won't See - A Survey Of Censorware Cryptography

[Another Censored Censorware Report]

Having examined more censorware internals than anyone else in the world, I've considered there might be an interesting academic survey paper describing the encryption algorithms employed various programs. It ranges all the way from the trivial encryption of "XOR" with a single byte (the original version of CyberSitter), to the full-blown Data Encryption Standard (DES). Of course, using the power of the Data Encryption Standard algorithm doesn't help too much when they give out the key in first place if one knows where to look.

Digression: During the DMCA exemptions testimony, when censorware company representative David Burt was taking the tactic that no American military was in Iraq no censorware decryption had been done, I thought of replying along the lines of "David, does the string [recite N2H2's private decryption key] mean anything to you?". But sadly, as a mere PR flack, he probably could have truthfully answered that the random letter/number combination which was N2H2's private decryption key, did not mean anything to him (and I couldn't remember it right then anyway).

But in terms of lawsuits, this isn't playing with fire, it's playing with WMD's (Weapons Of Mass Destruction). Or Lawsuits Of Massive Damages. A few years ago, when CyberPatrol sued two programmers, they opened with a $75,000 damage claim. Remember, that was just the start. These days, given the success of the music industry litigation tactic of loading up on claims of huge damages, gallows humor is whether a censorware lawsuit would confine itself to claiming mere millions of dollars, or go for billions of dollars.

Let's recall, even the DMCA 1201(g) research exemption is full of wiggles such as:

... the person made a good faith effort to obtain authorization before the circumvention;

[elsewhere] ... whether the information derived from the encryption research was disseminated, and if so, whether it was disseminated in a manner reasonably calculated to advance the state of knowledge or development of encryption technology, versus whether it was disseminated in a manner that facilitates infringement under this title or a violation of applicable law other than this section, including a violation of privacy or breach of security;

... whether the person is engaged in a legitimate course of study, is employed, or is appropriately trained or experienced, in the field of encryption technology; ...

There's almost a paradox here, in that low-hanging research fruit is likely snapped-up already by high-ranking researchers, leaving hard foraging for those further down the ranks. But that's exactly the sort of work which is going to involve more risk, yet at the same time apparently has less legal protection, because one almost needs to already have good formal credentials ("appropriately trained or experienced") in order to qualify in the first place! (i.e., want a job, get some experience, want some experience, get a job).

A paper which does very little for me personally, but has a reasonable chance of pauperizing litigation, yet I have no organization backing, is all a losing proposition. I am chilled.

Seth Finkelstein's Infothought blog (Wikipedia, Google, censorware, and an inside view of net-politics) - Syndicate site (subscribe, RSS)