another key registration body bites the dust imho one of the candidates that has been suggested for a key registration body is the aclu i think this is poor choice the aclu is essentially a group of auditors they audit how people s civil liberties are administered traditionally auditors do not like to get involved in the design or operational aspects of things and with good reason when i was a systems programmer it always infuriated me that the auditors would come in and tell us our implementation stunk from a security point of view but wouldn t tell us how to fix it i always figured they just liked to critcize without doing the work to help fix the problem then i took a stint as an auditor and i found out the real reason auditors don t like to recommend solutions because it puts them in a bad position if they have to criticize the implementation later the auditee can say well you told us this way would be ok it compromises the independence that is a necessary part of the auditor s job taking the case at hand suppose aclu becomes a key half registrar suppose that perhaps through some error on aclu s part a key half gets away that shouldn t and is used to deprive someone of her civil liberties the aclu gets wind of this and wants to take it to court but they end up being at the same time on the side of the defendant and of the plaintiff which is not an easy position to be in there are exceptions to the complete independence of auditors at one place where i worked when payroll checks were printed they were signed automatically by a signature drum on the bursting machine this drum was kept by the auditors who also kept the check stock and was brought down to data processing when it was time to do the checks i believe the difference between this situation and the key registration situation is that it is fairly obvious when it is time to do the payroll checks if they were done yesterday and someone wants to do them again today he better be able to produce yesterday s checks so that they can be destroyed determining which of the many requests for key halves are legit is a trickier process one much more prone to mistakes that could put the aclu in a protecting the client versus protecting the aclu conflict of interest as always my opinions are my own lynn grant grant dockmaster ncsc mil
