Re: Cybercrime treaty

[Gene Spafford <spaf@cerias.purdue.edu>]

I've been busy grading finals and fielding "love bug" questions, and 
I am way behind on email, so pardon my not responding sooner.

I need to look at the proposed language to clarify in my own mind 
what it says before I do anything to act or advocate.

However, I think you folks are missing an important idea here -- if 
the CVE board is concerned, then others will be too.  Leverage your 
concern and be activist in letting people know rather than in simply 
trying to take ownership of this.

1) Jim Davis at Iowa is about to put out another issue of IEEE 
Cipher.  One of you should *immediately* write up a couple 
paragraphs, include the URL and urge people to start talking to their 
legislators in their home countries.  Get it to Jim  ASAP so others 
can start in.

2) Send the same material to FIRST (send it to me and I will send it 
on -- I belong to a FIRST member team).  They are international and 
generally well-connected with law enforcement.  They also depend on 
these tools.

3) After I look at the treaty myself, I can send the same material on 
to people in Washington.   I'm not sure who all is on this list, but 
I think I am at least as well connected as anyone else here, and 
maybe more so.   In two weeks or less I'll be seeing Jeff Hunker and 
Dick Clarke, so I will raise the topic with them.  I also have 
contacts inside OSTP, DoD, DoE, DoJ and elsewhere.   If we get a 
*succinct* statement, I can plant it where it will generate some 
buzz.   I have a pretty deep mailing list at this point.

4) I am also chair of ACM's public policy committee.  I can lob it in 
there to see if it sticks.

5) I can get it in front of other security educators.   Besides Matt 
and myself (on this list) there are dozens of other educators who 
would be horrified if they could not use tools in classes and 
research.

6) Get it in front of Bruce Schneier, Peter Neumann and Dave Farber 
to get out to their mailing lists (Cryptogram, Risks, and Interesting 
People, respectively).  Those have major international coverage.

7) Each of us has other contacts.   Let's start getting them in on 
the act if there is indeed a reason for concern.


As someone who has been trying to be a bit of an activist for some 
time, including DCMA and UCITA issues, I can tell you that your best 
strategy is to get a short, factually accurate statement put 
together, and get it out to other parties -- amplify your voice by 
getting other reasonable (and sometimes not-so-reasonable) voices 
heard along with your own.   The longer you take to polish it 
internally, the more you have lost a chance to get outside voices 
swelling in unison with your own.

Cheers,
--spaf