February 1993 - cypherpunks-legacy

anon user on cypherpunks list
by Johan Helsingius 04 Mar '93

04 Mar '93

Er... Seems somebody has added an13556(a)anon.penet.fi to the mailing list, causing every message on the list to go through the server. This results in everyone sending to the list being allocated an anon id! Could you please change the address to be na13556(a)anon.penet.fi instead, thus avoiding the problem (yes, I've implemented the feature, but I don't want to announce it yet, as there are some implications I want to fix first...). Also a *WARNING*... an13556(a)anon.penet.fi now knows the … [View More]

4 5

Anon address attack...
by Hal 01 Mar '93

01 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- It seems like there are several problems that arise from this "automatic" anonymization of messages sent through the Penet remailer. You have these security threats which involve people being tricked into sending messages through the remailer in such a way that the recipient knows the true email address from where the messages are coming. (I think that is what happened here with "deadbeat", because otherwise why would he have asked people to send their … [View More]email addresses? He wouldn't need email addresses since he could reply to people without knowing them, by just using a "reply" command in his mailer.) (It's interesting that he also sent his message via one of the Cypherpunks remailers. Maybe he thought they worked like the Penet remailer and he could break anonymity on those as well.) Another problem that people have complained about is when they respond to an anonymous posting, they get a message from Penet saying that they now have an anonymous ID assigned. This confuses and bothers some people. We had some debate about this issue here several months ago (before Penet was operating, I think). One question is, if I send mail to anonymous person A, does that mean or imply that I should be made anonymous to A? This is to some extent a matter of expectations. Some people argued that should be no expectation of anonymity in this case; A is the one who wants to be anonymous, not the people who are sending to him/her. Others replied that since some anonymous remailers already worked this way, there would be an expectation of anonymity, and so the safest assumption was to anonymize all messages since people can always override the anonymity by revealing their true addresses. I think these attacks on Penet re-open these questions. Evidentally there is positive harm that can occur by automatically anonymizing all messages which pass through a remailer. (BTW, I certainly don't mean here to be presuming to tell Julf what he should or should not do with Penet. I'm just taking that as an example. We have discussed adding similar functionality to our Cypher- punks remailers. The main problem occurs when sending a message to an anonymous Penet address. For the other uses of the Penet remailer, for anonymous posting and for mail to a non-anonymous address, it's more reasonable to assume that anonymization is desired. (Otherwise, why would they be using the service?) But when sending a message to an anonymous address, it's not known whether the sender wants to be anonymized or not. One possibility (which might not be that easy technically) would be to assign a new anonymous ID for each such message through the Penet server. This means that you would get a _different_ anonymous ID for each of these messages, preventing an attacker from pairing up your "usual" posting ID with your email address. (Perhaps this anonymous ID creation could be suppressed with another X- command, as proposed earlier, but this could be the default behavior.) It might be hard to keep track of that many anonymous ID's, but perhaps they could be kept active for only a limited period of time (several weeks or months) and retired after that. It might seem that people should just be careful about what they send through Penet, but there are some problems with this. What do you do if you get a message from an5877(a)anon.penet.fi asking for advice on cryptography mailing lists? If you reply, your questioner can figure out who the reply is coming from, and sees your Penet alias. There is no way to prevent this from happening currently. Also, I have seen proposals that anonymous ID's should be made less recognizable, so that instead of an5877(a)anon.penet.fi we would have joe(a)serv.uba.edu. In such a situation it might be tedious to scrutinize every email address we send to (via replies, for example) to make sure it isn't a remailer where you have an anonymous ID. All in all, I think some changes need to be made in how anonymous addresses are used and implemented in order to provide reasonable amounts of security. Hal Finney -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK4lfIagTA69YIUw3AQGzQAQApOduiD7P2C26f7ml5tcOJf6xQff7bdV0 qw+zjOevW6hSBunOY59Qstkk5uQ2CoEALDAyUfKRsy7dionBAtCJYlwfX7uclHKL Sonor8bg0NPHMP8SV/antacq00fK3b5wtiFFMn3WsjCvSEjhGoB9SIE/TB/zL9Et Ow8JEodP488= =cXHd -----END PGP SIGNATURE----- [View Less]

8 11

more ideas on anonymity
by L. Detweiler 01 Mar '93

01 Mar '93

The question as to what specifically to prohibit being posted anonymously has come up, and is by far one of our most serious and sensitive considerations. Of course, the decision is largely in the hands of the anonymous server operator, but no generally accepted guidelines currently exist, and we might help some people and advance the cause by codifying `legitimate use'. First, let me assure you my intent and preference is that it should be as liberal as possible. Let's look at some of the … [View More]options (I'm tiptoeing on eggshells here, please don't flame me too much): 1) operator makes decision for every posting brought to his attention. Things that would test this system: what about revisionists (not ugly-enough term) who claim that the Holocaust never happened? Or someone who is posting extremely provocative but fabricated data? (The first case happened on Prodigy--the censors let it through at one point, and was documented in a column by Alan Dershowitz, famous American lawyer defending e.g. Mike Tyson, and other major celebrities. The second case happened with the now infamous challenger transcript posting, where anonymous user of penet posts without any comment a `transcript' of shuttle crew dialog during the crash.) Here, I think one policy might be that if the poster seems to be repeatedly and blatantly fabricating the data himself, maybe some restriction or warning is in order. But if ever the poster includes `real source' (no matter how trashy) from the outside world, and makes it clear that they are not the originator, only the purveyor (`messenger'), perhaps this is less serious. (I think Mr. Helsingius' current standards in this area should be held up as an outstanding model of commitment to privacy and free speech.) 2) some kind of global system for keeping track of `abusive' posters. Here are some interesting ideas--how about lists circulated among anonymous server operators only (not public) that record barred users by their email address or even real identity? The lists could be categorized and tagged so that the administrator can prohibit use based on the seriousness of the offense. Here are some things that operators `might' look at: 1) ad hominem attacks 2) flame baiting 3) lying outright 4) defying Usenet conventions: posting copyrighted material, binaries to regular groups, massive amounts of data, etc. 5) number or existence of *any* complaints 6) `racist' remarks 7) terrorism 8) `harassment' 9) anything illegal in the poster's country (yes, tricky I know) ad infinitum ad nauseam. Maybe we could try to organize the severity of this kind of stuff, and classify servers as `type 1' or `type 2' and we can get a feel for how liberal or conservative the operator is. The operator would say which lists he subscribes to, and which lists your email address will go on if you abuse the site. Really extreme operators (like Mr. Kleinpaste) might actually be interested in `public' lists -- abusers get their email addresses, along with the offense, posted on the public list, i.e. `outed'. Now, I think a lot of this is pretty unpalatable, but we have things to gain by formalizing these mechanisms, and as long as the anonymous user is *warned* in the server intro-use message, and possibly even has ways of redress, and has choice of different servers, then the system could be fairly agreeable by most. Remember, no one is preventing operators from being conservative or liberal as they like, the only thing wanted is adherence to their stated policies. Look what we have to gain. Currently, there is a lot of censorship (attempts? conquests?) going on behind the scenes, as a recent episode here attests. No one really knows how effective in general it is currently to hunt down and bar `abusive' users (hence a lot of misinformation and paranoia about the effects of anonymous servers). If we could have some *statistics* that show x% of nonanonymous users get complaints and y% of anonymous ones do, this would be very useful for gauging the social impact of our technologies. (There could be some very surprising results---I get the impression that many very responsible people *prefer* anonymity, and conceivably the overall complaints on anonymity could even be *less*). 3) Possibility of net.trials Ok, so don't flame me too much on this one. But if `abusers' (this could be for anonymity on a local server, but eventually involve to other realms) were subject to a `trial by peers', imagine what this could do to enhance the legitimate reputation of networks. Suddenly, a judicial system. I certainly don't want to be known as an advocate of bringing in lawyers and bureaucrats. Actually, that's precisely why I'm proposing this, to prevent that scenario. Imagine that the net establishes these formal self-regulating mechanisms. People in the real-world law enforcement would be much less likely to become enraged by perceived abuses when they realize that there are intrinsic mechanisms for quelling the psychopaths (uhm, maybe, anyway). Also, if people weren't added to blacklists just by the caprice of one operator but after a perceived fair `trial', people at other sites would be much more willing to enforce the sentences of suspension, expulsion or whatever. An electronic trial by peers? (with voting at the end?) A very interesting idea. Each server may develop a kind of peer or family structure, keeping kin in line. Maybe everyone that replies to an anonymous message could vote in their header whether to get rid of the user, with the default `one vote of approval' (limit voting regularity). Approves add, complaints subtract. The user starts with some initial balance. If he gets down to zero, *poof*. Lots of `approval'? No problemo. Post something really outrageous? You might get enough zaps to lose it all. Imagine, this could improve the accountability of users in *general* (the mechanisms could be applied to new Usenet groups, for example, or if very trustworthy and fair even logins themselves). I've been a bit vague and ambiguous in some of these statements. This is because, as I hope has become clear, the kind of things that start out on anonymous servers could eventually have a much greater scope, so that it `behooves' us to develop effective and dynamic mechanisms for self-regulation. Keep in mind a lot of these things are happening already albeit in much less formal ways. For example, the convention is to send complaints to the system adminstrator at a site regarding their users, and they act as judge and jury (or use whatever other local procedures are in place). The user may or may not be able to justify their actions (redress). There is already a loose confederation of cooperation between administrators, esp. over extremely abusive posters. We already get somewhat public `trials' of extremists, where people put forward all the evidence on Usenet and argue both sides. `Enforcement' and `punishment' sometimes consists of revoking logins, feeds, or whatever. I think we ultimately stand to gain by `formalizing' a lot of the currently informal mechanisms in place. My feeling is that if we don't head off these issues at the pass, so to speak, Real World (tm) courts will start deciding them for us. Let's develop something we can be proud of and will be a model of excellence for the future, and not something frail and unstable. Perhaps our anonymous motto: ``I disagree with what you say but will defend to my death your right to say it.'' --Voltaire (written pseudonymously) [View Less]

4 4

CFP Costs Too Much!
by tcmay＠netcom.com 01 Mar '93

01 Mar '93

(I'm copying Bruce Koball, General Chair of the CFP Conference, on this message, as I don't know if he gets the Cypherpunks list.) Dave Deltorto is one of several people I know, including myself, who don't like the prices of the upcoming Computers, Freedom, and Privacy Conference: >.... I would also dearly like to attend CFP, but >I haven't yet found a way to do it without money (anyone who knows a way I >can volunteer my way in and help out please say so - I'll sweep up after, >… [View More]anything...). In my opinion, $405 is way too much to pay for this conference. Science Fiction conventions routinely get the use of major hotels at a far lower per head price (from $40-$125 is typical). The BayCon convention takes over most of the public facilities in San Jose's Red Lion Inn (several ballrooms, many smaller rooms, and most of the public lobby areas), has about 500 attendees (same as CFP), and charges less than $100 for 4 days (and one-day memberships are typically around $30). And the "Hackers Conference" has kept its cost down to around $300, which includes two nights lodging and all meals (very sumptuous meals, too). Granted, CFP puts out a nice transcript of the talks--credit them $20 for that. Granted, a couple of meals are thrown in--credit them another $30 or so. What's left is still too much. Yes, a "register early" discount exists/existed, but inasmuch as there's a nonzero risk someone can't attend (and hence loses what they paid, or some fraction of it), counting such discounts is not really kosher. There are several possible reasons for the high fees: 1. Price insensitivity. $405 is what the traffic will bear. Most attendees are subsidized by their law firms (which often charge $200 or more per hour, so $400 for a conference is practically invisible to them), their corporations, or the government (taxpayers). I suspect most targeted attendees are price-insensitive. I'm price-sensitive, because I have to _earn_ about $700-800 before taxes to pay for the $405 being charged, and I have better uses for $405 (like a new DAT machine). 2. "Everyone else is doing it." Conference prices have been skyrocketing the last few years, although some conferences (like the SF conventions I mentioned) are still price-conscious and hold down prices. If CFP meets their attendance goal of 550, I guess they'll have been justified to price it as they did (though the mix of attendees could still be an issue to consider). And if they fail to meet the goal of 550, even with the comped or subsidized attendees, perhaps they can reconsider their pricing. 3. Subsidies of journalists. In talking to several journalists and journalistic wannabees, I've found they're getting "comped" passes. Thus, the paying attendees are subsidizing the shmoozings and barhoppings of our journalist friends! (This is not meant as an insult to the journalists out there...I just can't see why they get subsidized attendance.) How important a factor this is depends on the number of journalists, of course. (With hundreds of new magazines every year, 50 channels of shit on the t.v. (to borrow a phrase), and thousands of newsletters on every conceivable subject, I am waiting for the day when there are more journalists at these kinds of conferences than nonjournalists! They can all talk to themselves, I guess.) 4. Other costs. And profits. Maybe it costs CFP much more to put on this conference than it does some of the other conferences I've mentioned. Maybe they have fewer volunteers. In any case, I wish them luck. They are free to set their rates as they wish. I don't plan to attend, in case I haven't already made that clear. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available. [View Less]

2 1

Re: Real life pseudonyms (was re: more ideas on anonymity)
by jordan＠imsi.com 01 Mar '93

01 Mar '93

From thug(a)phantom.com Sun Feb 28 10:48:57 1993 For instance, can I walk into a U.S. bank, present false ID, and obtain a checking account to use for legitimate reasons? Banking and Tax regulations provide solid legal ground for requiring banks to verify identity and Tax status in the US. Answer: no. By definition, there are no "legitimate" reasons for having a checking account in this country that is unaccountable. There are plenty of other ways of hiding cash and money transactions … [View More]

2 1

unsubscribe
by tlr1＠acpub.duke.edu 28 Feb '93

28 Feb '93

Please unsubscribe me as I am unable to handle the volume of your mail. Thank you for your time. Sincerely, Tristan Reid tlr1(a)acpub.duke.edu

1 0

Re: EFF Speaks to CIA
by hkhenson＠cup.portal.com 28 Feb '93

28 Feb '93

A substantial number of you have probably seen this already, but if it missed--well, it is worth reading. Keith Henson ------ Remarks of John Perry Barlow to the First International Symposium on National Security & National Competitiveness McLean, Virginia December 1, 1993 I can't tell you the sense of strangeness that comes over someone who earns his living writing Grateful Dead songs, addressing people who earn their livings as many of you do, especially after hearing the last … [View More]speaker. If you don't appreciate the irony of our appearing in succession, you have no sense of irony at all. You and I inhabit very different worlds, but I am pleased to note, as my presence here strongly suggests, these two worlds may be growing closer. The reason I am here has absolutely nothing to do with the Grateful Dead. I'm here because I met a fellow named Mitch Kapor in 1989. Despite obvious differences, I felt as if we'd both been up in the same saucer or something...that we shared a sense of computers being more than just better adding machines or a better typewriters. We saw that computers, connected together, had the capacity to create an environment which human beings could and did inhabit. Yesterday, I was encouraged to hear evidence that [former Presidential Science Advisor] Dr. Jay Keyworth and [Conference Organizer and former CIA agent] Robert Steele, might have been up in that saucer too. The people who share this awareness are natives of the future. People who have a hard time with it may always be immigrants. When Mitch and I saw that computers had created a place, we started asking some questions about what kind of place it was....what were the operating terms and conditions of this place, what kinds of people already lived there, who was going to inhabit it, what was going on in it, did it have a name? We decided to name it Cyberspace, after Bill Gibson's description of a futuristic place rather like it which we found in his novel Neuromancer. Rather than being a figment of Bill's imagination, we felt that Cyberspace was already up and happening. Indeed, if you're having trouble with the concept, ask yourself where phone conversation takes place. That's right. Cyberspace is where you are when you're on the phone. It's also where most of your money is, unless you keep it in Krugerands buried out in the garden...which I suppose some folks in this room might just do. It's also...and I think this is very important... the place where the greater part of the world's business is happening now. So it's a highly significant locale, and yet it's invisible to most of the people who are in it every day of their lives. I believe it was Marshall McLuhan who said, "We don't know who it was that discovered water, but we're pretty sure it wasn't a fish..." In any case, when EFF first got together, our principal concern was making certain the U.S. Constitution applied to Cyberspace. We could see the government, specifically the Secret Service, taking actions which made it obvious that they didn't quite get it. They didn't seem to be acting out of malice, but they were, at best, differently clued. They clearly didn't understand that the First Amendment applied as certainly to bytes as it did to ink on paper. At the time we thought that we could just hire a few nasty civil liberties lawyers from New York to put the fear of God in them, and that would be that. But it's been like tugging at a thread on your sweater, where you begin to pull, and pretty soon you have more thread on the ground than on your back. It turns out that there are questions raised in this environment to which we don't have good answers. Indeed, it turns out that this is a place where the First Amendment...along with just about every other law on the planet...is a local ordinance. There are no clean jurisdictional boundaries. This is a place which may always be outside the law. This may be an unwelcome concept, but it is true, and it is something we will all have to grapple with as society moves into the virtual world. I believe you folks in the Intelligence Community are going to be challenged by these issues as directly as anyone. This is because intelligence, and especially the CIA and NSA, are supposed to work under stern guidelines intended to separate the domestic from the foreign. You're not supposed to be conducting domestic surveillance. Well, in Cyberspace, the difference between domestic and foreign, in fact the difference between any country and any other country, the difference between us and them, is extremely blurry. If it exists at all... This is also an economic environment in which everyone seems to be everywhere at once. I hear you're becoming interested in protecting American Business from foreign espionage. But against this "everywhereness" it becomes very difficult to say, "Alright, this is our guy, this is General Motors, we're going to take care of his interests." Nothing is so cleanly delineated. These are a few of the fundamental changes which arise as a result of literally moving out of the world of experience and onto the map of information. Another one which is especially pertinent to the people in this room, is what happens when you have direct e-mail access to every member of your organization. This can have a terrifically decentralizing effect on structure. It weakens hierarchy. It flattens the organization. It can create one hell of a lot of confusion, even as it speeds response time. There are in this room representatives of some tall and rigid outfits. Prepare for the possibility that your organization is about to go all flat and squishy due to tenderizing influence of e-mail. We are also looking at a complete redefinition of ownership and property. I mean, we now have the mind as our principle source of commercial goods. At last it seems we can we can really get something for nothing. As recently as fifteen years ago all new wealth derived from minerals extraction or agriculture. Everything else was simply passing it around. No longer must you rip your goods from the ground. You don't have to wait for the sun to grow some. New wealth can be had by just sitting around and rubbing some facts together...essentially what you folks have been doing all along. This economy of virtual substance is a fundamental change and one which you can exploit if you're willing. We're also looking at some fundamental shifts in the nature of property. This is going to be relevant to you as you move into a more open interaction with the rest of the world. In an information economy, much depends on the sanctity of copyright. But copyright, it turns out, derives most of its force from the physical manifestation of intellectual property. Copyright protects expression, the thing that happens when you print a book or press a record. In Cyberspace, you don't get that manifestation. It never goes physical. So the bottles we have been relying on for the protection of our intellectual goods are disappearing, and, since we've been selling bottles and not wine all along, we will soon have a lot of wine and nothing to put it in. Interesting problems will arise. They're already upon us. In any case, when EFF saw the multitude of things going on in this arena, we battened ourselves down for the long haul, and we are dealing with a whole range of issues, including the Open Platform initiative. Which is our effort to try to deploy something like universal data service. We believe that the best thing that could happen for the American economy, and actually the best thing that could happen for liberty on the Planet Earth, would be to make everyone capable of jacking in if they want to. We find that other countries are lagging in this. For example, the Japanese see absolutely no use for high speed personal data connections. The folks at NTT certainly can't see any reason to trade their 70,000 operators on digital switches. So we have a significant leg up on the Japanese that is not well known in this country. Another thing that we are working on is the FBI's Digital Telephony proposal which is, as you may know, the idea that we should stop all telecommunications progress in this country in order to accommodate the FBI is just amazing to me, and yet it somehow manages to live on Congress. Also, for those of you whose badges say U.S. Government [code for National Security Agency], we are trying to overturn NSA's data encryption embargo. It's our position that trying to embargo software is like trying to embargo wind. This is a fact that you are going to have to come to grips with. Digitized information is very hard to stamp "classified" or keep contained. This stuff is incredibly leaky and volatile. It's almost a life form in its ability to self-propagate. If something hits the Net...and it's something which people on there find interesting...it will spread like a virus of the mind. I believe you must simply accept the idea that we are moving into an environment where any information which is at all interesting to people is going to get out. And there will be very little that you can do about it. This is not a bad thing in my view, but you may differ... I'm going to talk a little bit now about the very nature of information. This conference, I must say, has blown me away. I had no idea there were people in your [the intelligence] community talking about these things. I am pleased and gratified by the folks I have met here and talked to personally, but I want to reiterate Dr. Keyworth's phrase yesterday: which is that government, especially American government, must end its obsession with secrecy. We must do so because we are engaged in...and I don't want to use the word warfare here...we are engaged in a form of economic competition where our principal advantage is our ability to distribute information. It is not our ability to conceal it. Perhaps this has always been true. Let me tell you a story. Last year, I was addressing the computer security establishment at the Department of Energy. These are the people in charge of protecting the computers that nuclear weapons get designed on. The other keynote speaker at this conference was, uh, Edward Teller. [Laughter.] Yeah, well, I was pretty sure if evil walked the planet, its name was Edward Teller. Anyway, I got up and said that I wasn't sure that DOE's secrecy was an asset. I wasn't going to say that it was a liability, so much as beside the point. After all, I know how to make an atomic bomb. You give me five and a half pounds of weapons grade plutonium and a week in my garage and I'll give you a nuclear weapon. It will be dirty, but it will work. The problem for anyone who wants to do this is that they can't get enough industrial capacity ginned up to create the plutonium. I mean, I just can't get my high temperature gas diffusion centrifuges to work. Indeed, it takes a whole society to put them together, even if the design information is available. It is not the information, which is readily available, that is crucial. It is the ability to execute that is the critical factor. I was interested to see how Dr. Teller would respond to that. To my surprise and satisfaction, he got up and agreed with me completely. He went on to say that he had never found a nuclear secret that the Russians could not obtain within a year of its development. Where they couldn't compete with us was in the areas where we were wide open. He cited the electronics industry, saying that at the end of World War II, we were about 20 years ahead of the Russians in nuclear weapons design, and roughly neck and neck in the electronics. Both sides entered a closed program on nuclear weapons design. And we went into a wild free-for-all in electronics. I mean, you should know that in the computer business, there are so many loose lips, you actually have to really try not to learn what you competitor is up to. Computer scientists are the meetingest bunch of people you ever saw, and when they meet, they tell one anther everything. The results of this approach speak for themselves. As Dr. Teller pointed out, by the time the Russians quit being a threat, they had moved to a position of parity with us in nuclear weapons, but they were 25 to 30 years behind us in electronics. I suspect one reason for this conference is to figure out how you guys are going to make your living now that the Party's Over. I believe the Intelligence Community still has a role. We are entering the Information Age. And Information, after all, is what you do. You have an edge in the field, and I would hate to see you blow your lead. But there are some serious issues about information which must be dealt with, and they have almost nothing to do with whether it is open or closed. The real questions regarding information relate to usability...whether or not it is meaningful, whether or not it is relevant, whether or not it accurate, whether or not it is genuinely useful. There is, for example, an enormous amount of information on the Net. But the signal-to-noise ratio on the net is terrible. There's an awful lot of racket. So I suppose you do get a kind of secrecy, rather as in those fancy restaurants with the highly reflective walls, where you can hear the people shouting at you at your table, but you can't make out what anyone else is saying for the hub-bub. It's the intimacy of white noise. You folks have some expertise in an important function: sorting out that which is relevant from the huge spray of data that is coming at everyone. That is an important problem that is largely overlooked...so far the software solutions to it don't strike me as being much good. We talk about "smart agents" but they aren't smart, they're pretty dumb. You send them out and they return with too much. The problem is that the difference between data and information is meaning, something machines know little of. To determine whether data are meaningful, whether they are, in fact, information, you must pass them through a human mind. There is also a question of authority, reliability, and bias. For example, I think one of the things you will find in using open sources is that most media are intentionally designed to evoke a fearful response in the reader. I mean, fear sells, as well you know. Perhaps you have an important role in certifying the reliability of materials in open circulation. Perhaps you are already engaged in it. I recently got a call from a friend who is an expert on computer networking in the Confederation of Independent States, or whatever they call what's left of the Evil Empire these days. He was in a terrible state. He said, "I just got visited by the CIA, I don't know what to do. They showed up and wanted to know all about my most recent report. I'm afraid they're going to try to make me a CIA agent!" A scary thought, eh? I told him, "Look, it seems to me you already are a CIA agent." They're just trying to figure out if you're a good one!" We may find that there are many CIA agents, of widely varying reliability. The real CIA agents will have the subtler job of finding out which of them is telling the truth. The most important problem which the intelligence community must now confront relates to your own bureaucratic sclerosis and the pace at which information moves through your honeycomb of secrecy. The future, as IBM is learning, will be to the supple and swift and not necessarily to the mighty. In a world moving as rapidly as this one, information becomes incredibly time sensitive. Even if you do...as I think you absolutely must...eliminate the unnecessary classification within and without your organizations, you still have all the cumbersome buffers of bureaucracy to contend with. As I was preparing these remarks, I considered coming in here and suggesting that you break up the CIA into about five different private companies and go into business. That's probably too good an idea to implement. But it seems worthy of consideration. There is something that happens to your sense of urgency when you have a bottom line. You know that if you don't deliver, someone else will, which might be exactly the though to leave you on. I would like to thank you very much for your indulgence of an entirely different perspective. I've genuinely enjoyed this opportunity to get to know you. -- <<*>><<*>><<*>><<*>><<*>><<*>> Cliff Figallo fig(a)eff.org Electronic Frontier Foundation (617)576-4500 (voice) Online Communications Coordinator (617)576-4520 (fax) [View Less]

1 0

Re: more ideas on anonymity
by Tony Kidson 28 Feb '93

28 Feb '93

In message <9302272006.AA16075@SOS> you write: > Date: Sat, 27 Feb 93 00:58:46 GMT > From: Tony Kidson <tony(a)morgan.demon.co.uk> > > Yes, we can justify protecting those who threaten these acts. > This is a *far* cry fpom protecting those who *commit* those > acts. > > Ah, I see you are an absolute free-speach advocate. The problem is that > the line between speech and acts can be fuzzy at times, especially in > the world of cyperspace … [View More]

2 1

Re: more ideas on anonymity
by Hal 28 Feb '93

28 Feb '93

Ted Ts'o is right that anonymity can be used for many harmful purposes. On the other hand, as Tim May suggests, attempts to control the flow of information can easily lead to restrictions which do more harm than what they try to prevent. Although I assume that most people here share a commitment to the overall goals of what Tim calls "crypto anarchy", it's possible that we all have different reasons for our support. My own angle is that these techniques enhance privacy and provide … [View More]power to individuals which can counterbalance the influence and authority of large institutions. I've been influenced in this mostly by the papers of David Chaum. For me, crypto anarchy is a way to oppose the constantly growing databases of information about each person, a way for individuals to take control of information about their own lives. This is why I like one particular justification for anonymous posting that I read, that people should be free to choose for themselves how much information to reveal when they post. I worry that, although the networks are in their infancy today, there may come a time when all information ever posted to Usenet is online, accessible, and searchable in a few seconds. The posters' email addresses may be cross-linked to their current names and addresses. Anything you post today may come back twenty years from now to haunt you. (Already, the archives are being kept, so all that is needed is technological improvements to put the information on-line and allow that huge volume of data to be usefully searched.) Now, you may say, so what, 99% of what is posted on Usenet couldn't possibly interest anyone anyway, and besides, I'm not posting anything anyone would care about. This may be true, but think about how much you reveal about yourself over a period of time if you are an active poster. Imagine all of that information being available to every potential employer or new neighbor. Imagine trying to run for public office! I simply don't like the idea of everyone I meet potentially knowing my hobbies, interests, political affiliations, sexual preferences, and so on. These same considerations apply in many other areas of our lives. Financial transactions can supply a lot of the same information. So can phone records. Perhaps someday our cars will be tracked routinely to collect information about where we go. Uncomfortable as I may be with personal and private facts being used by marketers and employers to evaluate me, there is also the possibility of even more sinister uses. Imagine how a dictatorship could exploit this much detailed information about the daily lives of its subjects. Probably "that will never happen here" but the mere possibility should provide another reason to guard our privacy. I imagine most people here agree with the thrust of these arguments, so I won't go on. But the point is that anonymous/pseudonymous communications can provide real benefits to all members of society. It's not just a romantic attraction to bomb-throwing revolutionaries or an elitist desire to escape the clutching hands of the greedy masses whcih drives us. I believe that the benefits that crypto anonymity can provide to society will clearly outweigh the problems. Hal Finney 74076.1041(a)compuserve.com [View Less]

4 4

Fake ID to protect ID
by Matthew J Miszewski 28 Feb '93

28 Feb '93

With regard to Thug's question about the use of false identification for legal purposes, I did some cursory legal research on the subject. A search through LEXIS brings up only three cases throughout all of the federal and state scourts. The first case, and in fact the one most on point is a 1991 US court of appeals case (LEXIS 219121). In this case, the defendant attempted to utilize the 'Thug defense' of no intent to defraud. Unfortunately, the court held that the actual making of … [View More]

1 0