
Do not presume to tell me what I have and have not read.  The system may
not rely upon registering people as owning particular phone units, but
it is necessary to know which phone units are likely to be used for some
suspected criminal communication before you can obtain their unit keys
from escrow.  This necessity raises the stakes in favor of a criminal's
coercing or colluding use of some other person's Clipper phone.

I will restate my assumptions more explicitly and amplify my argument.
The original title perhaps should have been "Distinction between legal
and illegal cipher systems considered harmful", but "Clipper considered
harmful" is not inaccurate, and is more eye-catching in the current context.

Assumptions:

  1.  Clipper is made available.

  2.  Laws are passed to make use of cipher systems other than Clipper illegal
      (either on radio systems, or on any common carrier system).  These laws
      also include enforcement authority to listen across the relevant radio
      spectrum (or other medium), characterize signals, validate Clipper
      wrappers, detect probable use of non-Clipper ciphers, and make such
      detection a cause for further action.

  3.  For escrowed keys to be useful, some specific Clipper chip must be
      associated with a suspected criminal.  This means that at a minimum
      some association between the common carrier's unique phone ID (ESN) and
      the Clipper chip serial number N will be stored in a government database.
      An observed pairing of N and ESN other than the one recorded raises a
      red flag.

  4.  To reduce ordinary fraud, the cellphone system which offers Clipper
      will also be constructed with an ESN mechanism much more tamper-proof
      and much less spoofable than today's cellphones.

  5.  Criminals want inscrutable communications.  Some criminals are not
      entirely stupid or ignorant, and will figure out both that Clipper
      cellphones offer excellent security in normal circumstances, and that
      they offer no security against law enforcement once a (presumably
      legitimate) wiretap order exists.  They will also figure out that the
      wiretap order must necessarily be against a specific cellphone, because
      each one has a unique unit key.

  6.  Criminals do not want to call attention to themselves.  Because they
      are not stupid or ignorant (or because they read netnews), and because
      they know that their open use of a non-Clipper cipher is likely to be
      detected, they will generally avoid using non-Clipper ciphers directly
      on some monitorable/tappable channel.  They know that do so would raise
      a red flag, putting a given cellphone (if not a given person) under
      immediate suspicion.

  7.  It is impractical to reverse engineer Skipjack, discover family key F,
      and construct a functional clone of a Clipper chip.

By #2, #3, #4, and #7 it will be very difficult to spoof a given Clipper
phone without immediate detection.  Because it is difficult to obscure one's
association to a specific phone by reprogramming or changing chips
around, the criminal will be motivated to find an intact phone which is
associated with someone else.

A non-stupid criminal will conclude that they can have Clipper-secure
communications, at least for some limited time T, if they buy, beg, borrow,
or steal use of someone's phone in a way that prevents that person from
reporting compromise of the phone for at least time T.  The encrypted
communications might have been recorded, and thus be retrievable later,
but the criminal can delay, and quite likely evade, discovery by destroying
or abandoning the phone before T elapses.

It would be unusual for an innocent person to volunteer use of their Clipper
phone to someone else.  The honest subscriber doesn't want to pay someone
else's bill, and he doesn't want to fall under suspicion.

This leaves two sources of Clipper phones for criminal use: coercion
and collusion.

Coercion first.  Theft bears a relatively low risk, but also sometimes
a low time until detection (a few minutes if a phone is stolen from
a car parked in front of a store, a couple of weeks if a phone is stolen
from someone who is away on vacation).  Criminal commerce is likely to
arise in stolen Clipper phones, with phones coming from risk-inured poor
criminals, and cash coming from risk-averse wealthy criminals.  Someone
who is extraordinarily motivated to gain a day or two of undetected
communication (like a terrorist) could kill a person or hold them hostage.
The limited time (before detection) that a coerced phone is useful means
that continuing criminal enterprises require a continuing supply of
freshly coerced phones.

There would also be created a collusive commerce between relatively
wealthy criminals, and ignorant or don't-care patsies who need money,
and who will submit to being paid in return for subscribing to Clipper
phone service for someone else's use.

Criminals will learn that it is more to their advantage to coerce use of a
Clipper cellphone than it is to apply a non-Clipper cipher to a normal
cellphone.  They will call much less attention to themselves (or at least to
their stolen phone) this way.  The fact of a phone's use being coerced must
first be reported before it can be identified as an interesting phone, and
have its keys obtained from escrow.

Clipper also allows an extraordinary opportunity for the criminal to
conceal use of super-encryption.  An automated full-system surveillance
mechanism (quite feasible across radio bandwidth) which knows family key F,
can validate Clipper wrappers and N:ESN associations, but it cannot reveal
in realtime the use of super-encryption, unless it knows all unit keys,
which we are being assured are only to be made available in two separate
pieces, upon specific wiretap-like order.

Whereas a criminal's use of any cipher within a normally cleartext medium
would stand out, a criminal's use of a non-Clipper cipher within a Clipper
medium would be very difficult to detect, even ex post facto in bulk
recordings, as long as the association between criminal and specific Clipper
chip is fractured.

If you make use of this other cipher illegal per se, then you can charge
the criminal with this (if you can identify the true criminal - he'll be
using someone else's phone), but you'll have no evidence to help you against
whatever traditional crime he might have been planning.  You will not even be
able to detect that unusual (encrypted) communications are occurring until you
identify specific phones and obtain their keys from escrow.

The gangster and terrorist are thus arguably more, not less, secure than
they were before Clipper came along.

I therefore consider Clipper harmful because:

  1.  It does not provide absolute privacy to the honest public against
      aggressive or dishonest government.

  2.  If other ciphers are proscribed, it engenders new types of direct
      criminal threat to the honest public.

  3.  It provides an extraordinarily effective mechanism for criminals to
      hide their use of some other cipher, making it more difficult than
      ever even to gain notice that unusual communications are occurring
      and that plans for some criminal act might be in progress.

  4.  If other ciphers are proscribed, lazy investigators and prosecutors
      are more likely to pursue the easily quantifiable cipher-use crime
      than they are the traditional and directly harmful crimes which key
      escrow is claimed to help against.

  5.  If other ciphers are proscribed, the stage is set for witch hunting
      of "illegal" cipher use.  Because any computer can be used as a cipher
      machine...