Re: [Cfrg] Requesting removal of CFRG co-chair

[Adam Back <[e-mail]>]

Dan perhaps this last round is overly focussing on details of how Alyssa
Rowan expressed the post.  Probably modulo the wording you agree at
principle leve, if I had to guess.  I'm more interested to see an
articulation of principle (from you and others).

As I said in my comments this is completely impartial.  It has nothing to do
with Kevin Igoe.  Its his employer the NSA, and the egregious, sustained
well funded, systemic full-spectrum APT attack on societal security. 
Society is the victim, NSA is the outed criminal organization.

Lets make an analogy: 

   Its like you had a massive electronic bank robbery where many ordinary
   people lost their retirement funds, never recovered, to the level of
   affecting US national budget and business reputation globally, and it was
   discovered that it was an insider job, one of the technical consultants
   slipped a backdoor into the security system.  For plea bargaining reasons
   he escaped prosecution (flipped a higher up player) but guilt is
   completely not in doubt.

   Ok now you have a standards body for open peer reviewed design of banking
   security sytems.  Do you invite this guy to chair the group?  Or one of
   his co-consipirators already is co-chair, do you remove him given his
   criminal association.  Lets say despite criminal record these people are
   exceedinly well qualified and clever, so there is real possibility with
   careful closed planning and bribes, hidden contracts etc that they might
   systematically succed in outwitting the public, or gaining some non-zero
   advantage in soft-sabotage/brittleness/disruption of robust architecture
   in plausibly deniable ways.

This is basically what happened.

But now the game is up, should we invite a new chair who was explicitly NSA? 
I think it would be a resounding NO.  

If we would not, why would we sit by inactive while an NSA employee is in
such a position for historical reasons.  What cold considered logical motive
could there be to defend him staying?

The public interest and security of society is much bigger than emotive
attachment to being nice to an individual.  An individual for whatever
reason who chose to align himself with NSA.  Sorry for him, but he made the
choice, informed or not, thats the luck of anyone who worked at NSA and now
faces the employment record implications.  And companies that were outed as
collaborating or taking or falling for bribes.  There are many victims of
this criminal organization, including their technical employees.

But the open standards process, the biggest victim, has the clear obligation
to clean house and avoid any association.  Even as participants everything
an NSA contributor says will be viewed with extreme caution and scepticism. 

To have an NSA personnel as the co-chair is clearly absolutely untennable in
this new reality.

Adam

ps Whether or not something untoward happened with Dragonfly isnt really the
principle, often there will be plausible deniability, soft-sabotage, unknown
collaborators, duped participants etc and there are specific allegations and
academic cryptanalysis as I see you are aware (and various papers).

http://arstechnica.com/security/2013/12/critics-nsa-agent-co-chairing-key-crypto-standards-body-should-be-removed/

But lets please put that detail to one side.  Its not personal to dragonfly
either, nor to you.

On Mon, Dec 23, 2013 at 12:44:14AM -0800, Dan Harkins wrote:
>
>On Sun, December 22, 2013 11:10 pm, Alyssa Rowan wrote:
>>
>> Documented fact: Kevin belongs to an agency with a "SIGINT Enabling
>> Project". Their job is to "enable" [backdoor and/or disrupt] strong
>> cryptography so the NSA can exploit it.
>>
>> That makes his advice untrustworthy. For all we know, it's *literally*
>> his job to lie to us, and mislead us.
>
>  "For all we know…", translation, "What I'm saying is complete
>conjecture…."
>
>> And if he is responsible, as co-chair, for relaying the CFRG's advice
>> to WGs, he is in the perfect position to do just that. The net effect
>> is to taint that advice with the NSA's proven untrustworthiness.
>>
>> That's the central problem here.
>>
>> The only fix is for him to step down as co-chair. (It wouldn't hurt
>> for him to resign from the NSA, or speak out, either; that he hasn't,
>> as Daniel raised, can only be reasonably interpreted as indicative of
>> his approval of the agency's actions.)
>
>  This is another example of the argumentum ad hominem fallacy.
>You're saying that you will judge his statements based on some
>aspect of him and not on their fundamental truth (or falsehood!).
>
>> Do you agree?
>>
>> If not, Dan, why do you wish Kevin to remain co-chair: despite the
>> profound concerns raised, and the fundamental conflict-of-interest
>> between his duties here, and the NSA's mission?
>>
>> Kindly explain your reason. I'm keenly interested to hear it.
>
>  No, I don't' agree. Because I:
>
>  1. don't believe in guilt by association and have no truck with
>      ad hominem attacks; and,
>  2. think that a dangerous precedent would be set if a social media
>      fueled campaign to influence an SDO was successful.
>
>> I mean, what I've heard from you so far is... just look at this gem:
>>
>> On Thu 12 Dec 2013 16:06, on TLS WG, Trevor Perrin wrote:
>>>> The consequences of adopting a protocol we think is secure that
>>>> isn't: dead people.
>>
>> (Correct security engineering thinking, backed up by decades of proven
>>  history, and still just as true today, as Jacob Applebaum or Moxie
>>  would be able to confirm.)
>>
>> On Fri 13 Dec 2013 08:35, on TLS WG, Dan Harkins wrote this reply:
>>> You obviously read too much fiction and have too little practical
>>> experience. Dragonfly is not a threat to human life. Get a grip.
>>
>> (...and well, I think that speaks for itself, doesn't it?)
>
>  Let's stick to the topic, shall we? There will be plenty of opportunity
>in the future to extract sentences from my numerous posts to various
>lists and to bring up irrelevance like death by protocol ("it's true, just
>ask these people who have not been killed by a protocol!"). The topic
>right now is the subject of this email.
>
>  Dan.
>
>
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>http://www.irtf.org/mailman/listinfo/cfrg