June 1993 - cypherpunks-legacy

request for patent info
by Nickey MacDonald 15 Jun '93

15 Jun '93

Seems to me that now might be a good time to get a list together of all encryption related patents and when they expire. Unless someone already has such a list, I will compile and repost any info sent to me. -- Nick MacDonald | NMD on IRC i6t4(a)jupiter.sun.csd.unb.ca | PGP 2.1 Public key available via finger i6t4(a)unb.ca | (506) 457-1931 ^{1024/746EBB 1993/02/23}

6 7

Re: 2600 testimony to Markey's subcommittee
by Peter Wayner 15 Jun '93

15 Jun '93

Of course, it seems perfectly obvious to Markey that 2600 is a "handbook on crime", but EG should have turned around and pointed out that he's just transmitting information on the world and there is nothing wrong with that. Gosh, if there was then Congressional Hearings and C-Span should be rated R to prevent the little whippersnappers from seeing and hearing demonstrations like the one that John Gage gave the committee several weeks ago. One person commented that Time magazine's latest article on Crack was practically a "How-To" guide. It satisfied the "Enquiring Minds" that wanted to know just what those people did with the magic crystals. Another friend informs me that Pornography is often transmitted with the label "For Scientific Research purposes only." Apparently, the law contains some exception for Doctors and Biologists. Hmmm. I wonder where Masters and Johnson fit in here. -Peter Wayner

1 0

Digital cash software
by gnu 15 Jun '93

15 Jun '93

I spoke with David Chaum, the inventor of digital money, last week at the cryptography meetings in DC. He is willing to give us a noncommercial license to use his digital money patents, and copies of some of his software for digital cash, for us to deploy somehow, and start using. He'll be back in August for Crypto '93 in Santa Barbara, and will bring one of his assistants (Nils) up to the Bay Area to teach us about the software. I think we can get a copy from him in the meantime, and puzzle it out ourselves between now and then. We'll also need to work out the legalese on the patents; it should be simple, but then again, almost everything *should* be simple... If we have a small group of people (say 2 to 5) who are seriously interested in building a digital-cash-on-the-Internet application and getting it into use, then speak up and get organized, and I will cross-connect you to David and Nils so things will start moving. David's company Digicash has been working on toll collection systems; he showed pictures of their newest system that allows driving full speed through the tollbooths and still does the transaction, using infrared through the windshield, I think. If someone wanted to present his system and his company to the authoritarians who were last seen preparing to put unencrypted automated vehicle-ID numbers on cars in California for toll collection, that would be a good thing. Speak up... John

3 2

Re: Steganography and Steganalysis
by kqb＠whscad1.att.com 15 Jun '93

15 Jun '93

I have received some useful feedback to yesterday's message on steganography and steganalysis. Here are some clarifications to my cryptic presentation and a correction. I was most interested in finding if the steganographic capacity of English is high enough to make steganography practical for everyday use, so I didn't even address the meaningfulness of the output. For example, if I could only produce a capacity of a tenth of one percent, the meaningfulness would not even be an issue because nobody would want to send large messages via steganography anyway. A capacity of 10%, requiring the public text to be only 10 times as long as the hidden text, may be good enough for everyday use. If that can be achieved, then the next step is to see if meaningful output can have a high steganographic content. If so, then I expect that several cypherpunks would want to pursue that. (FYI: I plan to do more analysis on my own, even if nobody else does.) My guesstimate for the steganographic capacity of English did not provide a steganographic algorithm. For example, I haven't even looked into how to map a bit string to a parenthesis grouping; I was just noting that if you have X(N-1) possibilities, there must be log (X(N-1)) bits available, assuming all possibilities are equally likely. Is there a simple-to-compute mapping of the numbers 1 through X(N-1) to the X(N-1) parenthesizations of an N word sentence? Fortunately, N rarely gets large for ordinary English sentences, so a general solution may be unnecessary. My presentation mistakenly implied that a good steganographic algorithm may have the form: E(K, M) = E2( E1(K,M) ) where E1 is a cryptographically secure encryption function with public key K and hidden message M, E2 somehow converts the encrypted message to ordinary English text, and E1, K, and E2 are publicly known. Unfortunately, if the inverse of E2 (let's call it D2), is easily found, then the presence of a hidden message can be detected easily, even though that message cannot be decrypted easily. This is because the output of E1, which is incompressible, is easily distinguishable from D2(ordinary English text). Here is a better formulation for the steganographic schema: E(K1, K2, M) = E3( E2(K2, E1(K1,M) )) where: E1(K1,M) converts the hidden message M to a cryptographically secure cyphertext by using the key K1. E1 and K1 are public, but the decryption function D1 is difficult to compute without the private key PK1. E3(C) converts a bit string to ordinary-looking English text. Assume that both E3 and its inverse D3 are public. E2(K2, C) converts the cyphertext C into another bit string such that E2(K2, C) has the same statistical characteristics as D3(ordinary English text). Assume that E2 and K2 are public, but D2 is difficult to compute without the private key PK2. Function E1 is normal public key cryptography, which produces an incompressible cyphertext. I hope that function E3 has a high enough steganographic capacity to make steganalysis worthwhile. Function E2 cannot be a normal encryption function because its output needs to be as compressible as D3(ordinary English text). Both functions E2 and E3 are new types of functions that require more research to work well. I still haven't seen any references to this type of steganography being done before, but thanks to the various people who gave pointers to tools that may help in building it. Kevin Q. Brown INTERNET kqb(a)whscad1.att.com or kevin_q_brown(a)att.com

3 2

forward: Cu Digest, #5.43 -- 2600 & CPSR House Subcommittee Testimony
by jet＠nas.nasa.gov 15 Jun '93

15 Jun '93

Emmanuel's comments are somewhat disturbing... > > > Computer underground Digest Sun June 13 1993 Volume 5 : Issue 43 > ISSN 1004-043X > > Editors: Jim Thomas and Gordon Meyer (TK0JUT2(a)NIU.BITNET) > Archivist: Brendan Kehoe > Shadow-Archivists: Dan Carosone / Paul Southworth > Ralph Sims / Jyrki Kuoppala > Ian Dickinson > Copy Editor: Etaoin Shrdlu, Seniur > > CONTENTS, #5.43 (June 13 1993) > File 1--Hacker testimony to House subcommittee largely unheard > File 2--CPSR Clipper Testimony (6-9-93) in House Subcommittee > > Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are > available at no cost electronically from tk0jut2(a)mvs.cso.niu.edu. The > editors may be contacted by voice (815-753-6430), fax (815-753-6302) > or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL > 60115. > > Issues of CuD can also be found in the Usenet comp.society.cu-digest > news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of > LAWSIG, and DL0 and DL12 of TELECOM; on GEnie in the PF*NPC RT > libraries and in the VIRUS/SECURITY library; from America Online in > the PC Telecom forum under "computing newsletters;" > On Delphi in the General Discussion database of the Internet SIG; > on the PC-EXEC BBS at (414) 789-4210; and on: Rune Stone BBS (IIRG > WHQ) 203-832-8441 NUP:Conspiracy > CuD is also available via Fidonet File Request from 1:11/70; unlisted > nodes and points welcome. > EUROPE: from the ComNet in LUXEMBOURG BBS (++352) 466893; > In ITALY: Bits against the Empire BBS: +39-461-980493 > > ANONYMOUS FTP SITES: > UNITED STATES: ftp.eff.org (192.88.144.4) in /pub/cud > uglymouse.css.itd.umich.edu (141.211.182.53) in /pub/CuD/cud > halcyon.com( 202.135.191.2) in /pub/mirror/cud > AUSTRALIA: ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD. > EUROPE: nic.funet.fi in pub/doc/cud. (Finland) > ftp.warwick.ac.uk in pub/cud (United Kingdom) > > COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing > information among computerists and to the presentation and debate of > diverse views. CuD material may be reprinted for non-profit as long > as the source is cited. Authors hold a presumptive copyright, and > they should be contacted for reprint permission. It is assumed that > non-personal mail to the moderators may be reprinted unless otherwise > specified. Readers are encouraged to submit reasoned articles > relating to computer culture and communication. Articles are > preferred to short responses. Please avoid quoting previous posts > unless absolutely necessary. > > DISCLAIMER: The views represented herein do not necessarily represent > the views of the moderators. Digest contributors assume all > responsibility for ensuring that articles submitted do not > violate copyright protections. > > ---------------------------------------------------------------------- > > Date: Thu, 10 Jun 1993 16:53:48 -0700 > From: Emmanuel Goldstein <emmanuel(a)WELL.SF.CA.US> > Subject: File 1--Hacker testimony to House subcommittee largely unheard > > What follows is a copy of my written testimony before the House > Subcommittee on Telecommunications and Finance. The June 9th hearing > was supposed to have been on the topic of network security, toll > fraud, and the social implications of the rapidly emerging > technologies. I was asked to speak for those who had no voice, which > translates to hackers and consumers. Instead I found myself barraged > with accusations from the two representatives in attendance (Rep. Ed > Markey D-MA and Rep. Jack Fields R-TX) who considered 2600 Magazine > (of which I'm the editor) nothing more than a manual for computer > crime. One article in particular that Markey latched upon was one in > our Spring issue that explained how a cable descrambler worked. > According to Markey, there was no use for this information outside of > a criminal context. Fields claimed we were printing cellular "codes" > that allowed people to listen in on cellular calls. In actuality, we > printed frequencies. The difference didn't seem to matter - after > explaining it to him, he still said he was very disturbed by the fact > that I was allowed to keep publishing. It soon became apparent to me > that neither one had read my testimony as there seemed to be no > inclination to discuss any of the issues I had brought up. In a way, > it was very much like being on the Geraldo show. Somehow I thought > elected representatives would be less sensationalist and more > interested in learning but this was not the case here. We got > absolutely nowhere. Markey in particular was rude, patronizing, and > not at all interested in entertaining any thought outside his narrow > perception. It's too bad this opportunity was lost. There is a real > danger in elected officials who don't listen to all relevant opinions > and who persist in sticking to old-fashioned, outdated notions that > just don't apply to high technology. You can look forward to more > restrictive regulations and higher penalties for violating them if > this mentality continues to dominate. > > +++++++++++++++++++ > WRITTEN TESTIMONY FOLLOWS: > > Mr. Chairman, members of the Committee, thank you for the > opportunity to speak on the issue of the rapid growth and changes in > the telecommunications industry. > > My name is Emmanuel Goldstein and I am the publisher of 2600 > Magazine, which is a journal for computer hackers as well as anyone > else who happens to be interested in the direction that technology is > taking us. We tend to be brutally honest in our assessments and, as a > result, we do get some corporations quite angry at us. But we've also > managed to educate a large number of people as to how their telephone > system works, what kinds of computers may be watching them, and how > they can shape technology to meet their needs, rather than be forced > to tailor their existence to meet technology's needs. > > I am also the host of a weekly radio program called Off The Hook > which airs over WBAI in New York. Through that forum we have > discovered the eagerness and curiosity that many "ordinary people on > the street" possess for technology. At the same time we have seen > fears and suspicions expressed that would be unwise to ignore. > > HOW TO HANDLE RAPIDLY CHANGING TECHNOLOGY > > The next few years will almost certainly go down in history as > those in which the most change took place in the least amount of time. > The computer and telecommunications revolution that we are now in the > midst of is moving full speed ahead into unknown territory. The > potential for amazing advances in individual thought and creativity is > very real. But so is the potential for oppression and mistrust the > likes of which we have never before seen. One way or the other, we > will be making history. > > I think we can imagine it best if we think of ourselves speeding > down a potentially dangerous highway. Perhaps the road will become > slick with ice or fraught with sharp curves. It's a road that nobody > has gone down before. And the question we have to ask ourselves is > what kind of a vehicle would we prefer to be in if things should start > getting out of control: our own automobile where we would have at > least some chance of controlling the vehicle and bringing it down to a > safe speed or a bus where we, along with many others, must put all of > our trust behind a total stranger to prevent a disaster. The answer is > obviously different depending on the circumstances. There are those of > us who do not want the responsibility of driving and others who have > proven themselves unworthy of it. What's important is that we all have > the opportunity at some point to choose which way we want to go. > > Rapidly changing technology can also be very dangerous if we > don't look where we're going or if too many of us close our eyes and > let someone else do the driving. This is a ride we all must stay awake > for. > > I am not saying we should be overly suspicious of every form of > technology. I believe we are on the verge of something very positive. > But the members of this committee should be aware of the dangers of an > uninformed populace. These dangers will manifest themselves in the > form of suspicion towards authority, overall fear of technology, and > an unhealthy feeling of helplessness. > > HOW NEW TECHNOLOGY CAN HURT US > > The recent FBI proposal to have wiretap capabilities built into > digital telephone systems got most of its publicity because American > taxpayers were expected to foot the bill. But to many of the > non-technical people I talked to, it was just another example of Big > Brother edging one step closer. It is commonly believed that the > National Security Agency monitors all traffic on the Internet, not to > mention all international telephone calls. Between Caller ID, TRW > credit reports, video cameras, room monitors, and computer > categorizations of our personalities, the average American feels as if > life no longer has many private moments. Our Social Security numbers, > which once were for Social Security, are now used for everything from > video rentals to driver's licenses. These numbers can easily be used > to track a person's location, expenses, and habits - all without any > consent. If you know a person's name, you can get their telephone > number. If you have their phone number, you can get their address. > Getting their Social Security number is not even a challenge anymore. > With this information, you can not only get every bit of information > about this person that exists on any computer from Blockbuster Video > to the local library to the phone company to the FBI, but you can > begin to do things in this poor person's name. It's possible we may > want a society like this, where we will be accountable for our every > movement and where only criminals will pursue privacy. The American > public needs to be asked. But first, they need to understand. > > In Germany, there is a fairly new computerized system of identity > cards. Every citizen must carry one of these cards. The information > includes their name, address, date of birth, and nationality - in > other words, the country they were originally born in. Such a system > of national identity can be quite useful, but in the wrong hands it > can be extremely scary. For example, if a neo-Nazi group were to > somehow get their hands on the database, they could instantly find out > where everyone of Turkish nationality lived. A malevolent government > could do the same and, since not carrying the card would be a crime, > it would be very hard to avoid its wrath. > > Before introducing a new technology that is all-encompassing, all > of its potential side-effects and disadvantages should be discussed > and addressed. Opportunities must exist for everyone to ask questions. > In our own country, nobody was ever asked if they wanted a credit file > opened on them, if they wanted to have their phone numbers given to > the people and companies they called through the use of Caller ID and > ANI, or if they wanted to be categorized in any manner on numerous > lists and databases. Yet all of this has now become standard practice. > > This implementation of new rules has resulted in a degree of > cynicism in many of us, as well as a sense of foreboding and dread. We > all know that these new inventions will be abused and used to > somebody's advantage at some point. There are those who would have us > believe that the only people capable of such misdeeds are computer > hackers and their ilk. But it just isn't that simple. > > UNDERSTANDING COMPUTER HACKERS > > To understand computer hackers, it helps to think of an alien > culture. We have such cultures constantly around us - those with > teenage children ought to know what this means. There are alien > cultures of unlimited varieties throughout the globe, sometimes in the > most unexpected places. I'm convinced that this is a good thing. > Unfortunately, all too often our default setting on whatever it is we > don't understand is "bad". Suspicion and hostility follow and are soon > met with similar feelings from the other side. This has been going on > between and within our cultures for as long as we've existed. While we > can't stop it entirely, we can learn to recognize the danger signs. > The best way that I've found to deal with an alien culture, whether > it's in a foreign country or right here at home, is to try and > appreciate it while giving it a little leeway. There is not a single > alien culture I've encountered that has not been decidedly friendly. > That includes deadheads, skateboarders, Rastafarians, and hackers. > > When we talk about computer hackers, different images spring to > mind. Most of these images have come about because of perceptions > voiced by the media. Too often, as I'm sure the members of this > committee already suspect, the media just doesn't get it. This is not > necessarily due to malice on their part but rather a general lack of > understanding and an overwhelming pressure to produce a good story. > Hence we get an abundance of sensationalism and, when the dust clears, > hackers are being compared with bank robbers, mobsters, terrorists, > and the like. It's gotten to the point that the word hacker is almost > analogous to the word criminal. > > Fortunately, the media is learning. Reporters now approach > hackers with a degree of technological savvy. For the most part, they > have stopped asking us to commit crimes so they can write a story > about it. As the technology envelops us, journalists are developing > the same appreciation and curiosity for it that hackers have always > had. Any good reporter is at least part hacker because what a hacker > does primarily is relentlessly pursue an answer. Computers naturally > lend themselves to this sort of pursuit, since they tend to be very > patient when asked a lot of questions. > > WHAT CONSTITUTES A HI-TECH CRIME? > > So where is the boundary between the hacker world and the > criminal world? To me, it has always been in the same place. We know > that it's wrong to steal tangible objects. We know that it's wrong to > vandalize. We know that it's wrong to invade somebody's privacy. Not > one of these elements is part of the hacker world. > > A hacker can certainly turn into a criminal and take advantage of > the weaknesses in our telephone and computer systems. But this is > rare. What is more likely is that a hacker will share knowledge with > people, one of whom will decide to use that knowledge for criminal > purposes. This does not make the hacker a criminal for figuring it > out. And it certainly doesn't make the criminal into a hacker. > > It is easy to see this when we are talking about crimes that we > understand as crimes. But then there are the more nebulous crimes; the > ones where we have to ask ourselves: "Is this really a crime?" Copying > software is one example. We all know that copying a computer program > and then selling it is a crime. It's stealing, plain and simple. But > copying a program from a friend to try it out on your home computer -- > is this the same kind of crime? It seems obvious to me that it is not, > the reason being that you must make a leap of logic to turn such an > action into a crime. Imagine if we were to charge a licensing fee > every time somebody browsed through a magazine at the local bookshop, > every time material was borrowed from a library, or every time a phone > number was jotted down from the yellow pages. Yet, organizations like > the Software Publishers Association have gone on record as saying that > it is illegal to use the same computer program on more than one > computer in your house. They claim that you must purchase it again or > face the threat of federal marshalls kicking in your door. That is a > leap of logic. > > It is a leap of logic to assume that because a word processor > costs $500, a college student will not try to make a free copy in > order to write and become a little more computer literate. Do we > punish this student for breaking a rule? Do we charge him with > stealing $500? To the hacker culture on whose behalf I am speaking > today, the only sensible answer is to make it as easy as possible for > that college student to use the software he needs. And while we're at > it, we should be happy that he's interested in the first place. > > Of course, this represents a fundamental change in our society's > outlook. Technology as a way of life, not just another way to make > money. After all, we encourage people to read books even if they can't > pay for them because to our society literacy is a very important goal. > I believe technological literacy is becoming increasingly important. > But you cannot have literacy of any kind without having access. > > If we continue to make access to technology difficult, > bureaucratic, and illogical, then there will also be more computer > crime. The reason being that if you treat someone like a criminal, > they will begin to act like one. If we succeed in convincing people > that copying a file is the same as physically stealing something, we > can hardly be surprised when the broad-based definition results in > more overall crime. Blurring the distinction between a virtual > infraction and a real-life crime is a mistake. > > LEGISLATION FOR COMPUTER AGE CRIME > > New laws are not needed because there is not a single crime that > can be committed with a computer that is not already defined as a > crime without a computer. But let us not be loose with that > definition. Is mere unauthorized access to a computer worthy of > federal indictments, lengthy court battles, confiscation of equipment, > huge fines, and years of prison time? Or is it closer to a case of > trespassing, which in the real world is usually punished by a simple > warning? "Of course not," some will say, "since accessing a computer > is far more sensitive than walking into an unlocked office building." > If that is the case, why is it still so easy to do? If it's possible > for somebody to easily gain unauthorized access to a computer that has > information about me, I would like to know about it. But somehow I > don't think the company or agency running the system would tell me > that they have gaping security holes. Hackers, on the other hand, are > very open about what they discover which is why large corporations > hate them so much. Through legislation, we can turn what the hackers > do into a crime and there just might be a slim chance that we can stop > them. But that won't fix poorly designed systems whose very existence > is a violation of our privacy. > > THE DANGERS OF UNINFORMED CONSUMERS > > The concept of privacy is something that is very important to a > hacker. This is so because hackers know how fragile privacy is in > today's world. Wherever possible we encourage people to protect their > directories, encrypt their electronic mail, not use cellular phones, > and whatever else it takes to keep their lives to themselves. In 1984 > hackers were instrumental in showing the world how TRW kept credit > files on millions of Americans. Most people had never even heard of a > credit file until this happened. Passwords were very poorly guarded - > in fact, credit reports had the password printed on the credit report > itself. More recently, hackers found that MCI's Friends and Family > program allowed anybody to call an 800 number and find out the numbers > of everyone in a customer's "calling circle". As a bonus, you could > also find out how these numbers were related to the customer: friend, > brother, daughter-in-law, business partner, etc. Many times these > numbers were unlisted yet all that was needed to "verify" the > customer's identity was the correct zip code. In both the TRW and MCI > cases, hackers were ironically accused of being the ones to invade > privacy. What they really did was help to educate the American > consumer. > > Nowhere is this more apparent than in the telephone industry. > Throughout the country, telephone companies take advantage of > consumers. They do this primarily because the consumer does not > understand the technology. When we don't understand something > complicated, we tend to believe those who do understand. The same is > true for auto mechanics, plumbers, doctors, and lawyers. They all > speak some strange language that the majority of us will never > understand. So we tend to believe them. The difference with the phone > companies, and here I am referring to the local companies, is that you > cannot deal with somebody else if you happen to disagree with them or > find them untrustworthy. The phone companies have us in a situation > where we must believe what they say. If we don't believe them, we > cannot go elsewhere. > > This is the frustration that the hacker community constantly > faces. We face it especially because we are able to understand when > the local phone companies take advantage of consumers. Here are a few > examples: > > Charging a fee for touch tone service. This is a misnomer. It > actually takes extra effort to tell the computer to ignore the tones > that you produce. Everybody already has touch tone capability but we > are forced to pay the phone company not to block it. While $1.50 a > month may not seem like much, when added together the local companies > that still engage in this practice are making millions of dollars a > year for absolutely nothing. Why do they get away with it? Because too > many of us don't understand how the phone system works. I try to draw > an analogy in this particular case - imagine if the phone company > decided that a fee would be charged to those customers who wanted to > use the number five when dialing. They could argue that the five takes > more energy than the four but most of us would see through this flimsy > logic. We must seek out other such dubious practices and not blindly > accept what we are told. > > Other examples abound: being charged extra not to have your name > listed in the telephone directory, a monthly maintenance charge if you > select your own telephone number, the fact that calling information to > get a number now costs more than calling the number itself. > > More recently, we have become acquainted with a new standard > called Signalling System Seven or SS7. Through this system it is > possible for telephones to have all kinds of new features: Caller ID, > Return Call, Repeat Calling to get through a busy signal, and more. > But again, we are having the wool pulled over our eyes. For instance, > if you take advantage of Call Return in New York (which will call the > last person who dialed your number), you are charged 75 cents on top > of the cost of the call itself. Obviously, there is a cost involved > when new technologies are introduced. But there is no additional > equipment, manpower, or time consumed when you dial *69 to return a > call. It's a permanent part of the system. As a comparison, we could > say that it also costs money to install a hold button. Imagine how we > would feel if we were charged a fee every time we used it. > > The local companies are not the only offenders but it is > particularly bad in their case because, for the vast majority of > Americans, there is no competition on this level. The same complaints > are being voiced concerning cable television companies. > > Long distance telephone companies are also guilty. AT&T, MCI, and > Sprint all encourage the use of calling cards. Yet each imposes a > formidable surcharge each and every time they're used. AT&T, for > example, charges 13 cents for the first minute of a nighttime call > from Washington DC to New York plus an 80 cent surcharge. Since a > calling card can only be used to make telephone calls, why are > consumers expected to pay an extra fee as if they were doing something > above and beyond the normal capability of the card? Again, there is no > extra work necessary to complete a calling card call - at least not on > the phone company's part. The consumer, on the other hand, must enter > up to 25 additional digits. But billing is accomplished merely by > computers sending data to each other. Gone are the days of tickets > being written up by hand and verified by human beings. Everything is > accomplished quickly, efficiently, and cheaply by computer. Therefore, > these extra charges are outdated. > > SOCIAL INJUSTICES OF TECHNOLOGY > > The way in which we have allowed public telephones to be operated > is particularly unfair to those who are economically disadvantaged. A > one minute call to Washington DC can cost as little as 12 cents from > the comfort of your own home. However, if you don't happen to have a > phone, or if you don't happen to have a home, that same one minute > call will cost you $2.20. That figure is the cheapest rate there is > from a Bell operated payphone. With whatever kind of logic was used to > set these prices, the results are clear. We have made it harder and > more expensive for the poor among us to gain access to the telephone > network. Surely this is not something we can be proud of. > > A direct result of this inequity is the prevalence of red boxes. > Red boxes are nothing more than tone generators that transmit a quick > burst of five tones which convince the central office that a quarter > has been deposited. It's very easy and almost totally undetectable. > It's also been going on for decades. Neither the local nor long > distance companies have expended much effort towards stopping red > boxes, which gives the impression that the payphone profits are still > lucrative, even with this abuse. But even more troubling is the > message this is sending. Think of it. For a poor and homeless person > to gain access to something that would cost the rest of us 12 cents, > they must commit a crime and steal $2.20. This is not equal access. > > CORPORATE RULES > > Hackers and phone phreaks, as some of us are called, are very > aware of these facts. We learn by asking lots of questions. We learn > by going to libraries and doing research. We learn by diving into > phone company trash dumpsters, reading discarded material, and doing > more research. But who will listen to people like us who have been > frequently characterized as criminals? I am particularly grateful that > this committee has chosen to hear us. What is very important to us is > open communications. Freedom of information. An educated public. > > This puts us at direct odds with many organizations, who believe > that everything they do is "proprietary" and that the public has no > right to know how the public networks work. In July of 1992 we were > threatened with legal action by Bellcore (the research arm of the > Regional Bell Operating Companies) for revealing security weaknesses > inherent in Busy Line Verification (BLV) trunks. The information had > been leaked to us and we did not feel compelled to join Bellcore's > conspiracy of silence. In April of this year, we were threatened with > legal action by AT&T for printing proprietary information of theirs. > The information in question was a partial list of the addresses of > AT&T offices. It's very hard for us to imagine how such information > could be considered secret. But these actions are not surprising. They > only serve to illustrate the wide disparities between the corporate > mindset and that of the individual. It is essential that the hundreds > of millions of Americans who will be affected by today's > all-encompassing inventions not be forced to play by corporate rules. > > In 1990 a magazine similar to 2600 was closed down by the United > States government because Bell South said they printed proprietary > information. Most people never found out about this because Phrack > Magazine was electronic, i.e., only available on computer bulletin > boards and networks. This in itself is wrong; a publication must have > the same First Amendment rights regardless of whether it is printed > electronically or on paper. As more online journals appear, this basic > tenet will become increasingly critical to our nation's future as a > democracy. Apart from this matter, we must look at what Bell South > claimed - that a document discussing the Enhanced 911 system which was > worth $79,449 had been "stolen" and printed by Phrack. (Some newspaper > accounts even managed to change it into an E911 program which gave the > appearance that hackers were actually interfering with the operation > of an E911 system and putting lives at risk. In reality there has > never been a report of a hacker gaining access to such a system.) It > was not until after the publisher of Phrack was forced to go to trial > that the real value of the document was revealed. Anyone could get a > copy for around $14. The government promptly dropped its case against > the publisher who, to this day, is still paying back $100,000 in legal > fees. As further evidence of the inquity between individual justice > and corporate justice, Bell South was never charged with fraud for its > claim that a $14 document was worth nearly $80,000. Their logic, as > explained in a memo to then Assistant U.S. Attorney Bill Cook, was > that the full salaries of everyone who helped write the document, as > well as the full cost of all hardware and software used in the > endeavor ($31,000 for a Vaxstation II, $6,000 for a printer), was > perfectly acceptable. It is very disturbing that the United States > government agreed with this assessment and moved to put a pre-law > student behind bars for violating corporate rules. > > MISGUIDED AUTHORITY > > I wish I could stand before this committee and say that we have > been successful in stopping all such miscarriages of justice. While > the Phrack case may have been the most bizarre, there are many more > instances of individuals being victimized in similar manners. A > teenager in Chicago was jailed for a year for copying a file that was > worth millions, according to AT&T, but was utterly worthless and > unusable to a kid. A bulletin board operator in California, along with > his entire family, was held at gunpoint for hours while authorities > seized his equipment in an unsuccessful attempt to find child > pornography. Three hackers in Atlanta, after being imprisoned up to a > year for dialing into a Bell South computer system that had no > password, were forced to pay $233,000 in restitution so the company > could install a password system. More recently, a student at the > University of Texas at Houston was suspended from school for a year > because he accessed a file that merely listed the users of the system > (a file which the system allows all users to access). In increasing > numbers, young people are being sent to jail, not necessarily for > something they did, but rather for something they could have done in a > worst-case scenario. Again this indicates fear and misunderstanding of > technology and its applications. But this time those feelings emanate > from those in authority. > > Locally, an ominous happening occurred at a 2600 monthly meeting > last November. (These meetings occur in public areas in cities > throughout the nation on the first Friday of every month.) Shortly > after it began, the Washington meeting was broken up by Pentagon City > Mall security guards. Without any provocation, people were forced to > submit to searches and everybody's name was taken down. One of the > attendees who was writing down an officer's name had the paper ripped > from his hand, another had his film taken from his camera as he tried > to document what was going on. Upon questioning by a reporter from > Communications Daily, the mall security chief claimed that he was > acting under orders from the United States Secret Service. Subsequent > Freedom of Information Act requests by Computer Professionals for > Social Responsibility have yielded more evidence implicating the > Secret Service in this illegal and unwarranted action. Nothing of a > criminal nature was ever found in any of the bags that were searched. > But a full list of the attendees wound up in the possession of the > Secret Service. It seems ironic that while hackers are conducting an > open gathering in the middle of a shopping mall in order to share > knowledge and welcome new people, agents of the Secret Service are > lurking in the shadows trying to figure out ways to stop them. > > How can we move forward and talk about exciting new applications > of technology when we're off to such a bad start? The people that are > being arrested, harassed, and intimidated are the people who will be > designing and running these new systems. They are the ones who will > appreciate their capabilities and understand their weaknesses. Through > our short-sightedness and eagerness to listen to the loudest voices, > we are alienating the promises of the future. How many here, who grew > up in decades past, remember hearing teenagers talk of how the > government is after them, watching their every move, listening to > their phone calls, doing everything one might expect in a totalitarian > regime. Such feelings are the sure sign of an ailing society. It does > not matter if these things are not actually occurring - their mere > perception is enough to cause lasting harm and mistrust. > > PROMISE OF THE INTERNET > > The future holds such enormous potential. It is vital that we not > succumb to our fears and allow our democratic ideals and privacy > values to be shattered. In many ways, the world of cyberspace is more > real than the real world itself. I say this because it is only within > the virtual world that people are really free to be themselves - to > speak without fear of reprisal, to be anonymous if they so choose, to > participate in a dialogue where one is judged by the merits of their > words, not the color of their skin or the timbre of their voice. > Contrast this to our existing "real" world where we often have people > sized up before they even utter a word. The Internet has evolved, on > its own volition, to become a true bastion of worldwide democracy. It > is the obligation of this committee, and of governments throughout the > world, not to stand in its way. > > This does not mean we should stand back and do nothing. Quite > the contrary, there is much we have to do if accessibility and > equality are our goals. Over-regulation and commercialization are two > ways to quickly kill these goals. A way to realize them is to have a > network access point in every house. Currently, network access is > restricted to students or professors at participating schools, > scientists, commercial establishments, and those who have access to, > and can afford, local services that link into the Internet. Yes, a lot > of people have access today. But a far greater number do not and it > is to these people that we must speak. The bigger the Internet gets, > the better it gets. As it exists today, cultures from around the globe > are represented; information of all kinds is exchanged. People are > writing, reading, thinking. It's potentially the greatest educational > tool we have. Therefore, it is essential that we not allow it to > become a commodity that only certain people in society will be able to > afford. With today's technology, we face the danger of widening the > gap between the haves and the have-nots to a monumental level. Or we > can open the door and discover that people really do have a lot to > learn from each other, given the opportunity. > > It is my hope that this committee will recognize the importance > of dialogue with the American public, in order to answer the questions > so many are asking and to address the concerns that have been > overlooked. I thank you for this opportunity to express those issues > that I feel relevant to this hearing. > > ------------------------------ > > Date: Sat, 12 Jun 1993 12:30:38 EST > From: Dave Banisar <banisar(a)WASHOFC.CPSR.ORG> > Subject: File 2--CPSR Clipper Testimony (6-9-93) in House Subcommittee > > CPSR Clipper Testimony 6/9 > > On June 9, 1993, Congressman Edward Markey, Chairman of the > House Subcommittee on Telecommunications and Finance held an > oversight hearing on Rencryption and telecommunications network > security. Panelists were Whitfield Diffie of Sun Microsystems, Dr. > Dorothy Denning, Steven Bryen of Secure Communications, Marc > Rotenberg of the CPSR Washington Office and E.R. Kerkeslager of AT&T. > > Congressman Markey, after hearing the testimony presented, > noted that the Clipper proposal had raised an arched eyebrow among > the whole committeeS and that the committee viewed the proposal > skeptically. This statement was the latest indication that the Clipper > proposal has not been well received by policy makers. Last Friday, > the Computer Systems Security and Privacy Advisory Board of NIST > issued two resolutions critical of the encryption plan, suggesting > that further study was required and that implementation of the plan > should be delayed until the review is completed. > > At the Third CPSR Cryptography and Privacy Conference on > Monday, June 7, the Acting Director of NIST, Raymond Kammer, announced > that the implementation of the proposal will be delayed and that a > more comprehensive review will be undertaken. The review is due in > the fall. Kammer told the Washington Post that Rmaybe we wonUt > continue in the direction we started ous. > > +------------------------------------------------- > > Prepared Testimony > and > Statement for the Record > of > Marc Rotenberg, director > CPSR Washington Office > on > Encryption Technology and Policy > Before > The Subcommittee on Telecommunications and Finance. > Committee on Energy and Commerce > > U.S. House of Representatives > June 9, 1993 > > SUMMARY > > The cryptography issue is of particular concern to CPSR. > During the past several years CPSR has pursued an extensive study of > cryptography policy in the United States. CPSR has organized public > conferences, conducted litigation under the Freedom of Information Act, > and has emphasized the importance of cryptography for privacy > protection and the need to scrutinize carefully government proposals > designed to limit the use of this technology. > To evaluate the Clipper proposal it is necessary to look at a > 1987 law, the Computer Security Act, which made clear that in the area > of unclassified computing systems, the National Institute of Standards > and Technology (NIST) and not the National Security Agency (NSA), would > be responsible for the development of technical standards. The Act > emphasized public accountability and stressed open decision-making. > In the spirit of the Act, in 1989 NIST set out to develop a > public key cryptography standard. According to documents obtained by > CPSR through the Freedom of Information Act, NIST recommended that the > algorithm be "public, unclassified, implementable in both hardware or > software, usable by federal Agencies and U.S. based multi-national > corporation." However, the Clipper proposal and the full-blown Capstone > configuration that resulted is very different: the Clipper algorithm, > Skipjack, is classified; public access to the reasons underlying the > proposal is restricted; Skipjack can be implemented only in > tamper-proof hardware; it is unlikely to be used by multi-national > corporations, and the security of Clipper remains unproven. > The Clipper proposal undermines the central purpose of the > Computer Security Act. Although intended for broad use in commercial > networks, it was not developed at the request of either U.S. business > or the general public. It does not reflect public goals. > The premise of the Clipper key escrow arrangement is that the > government must have the ability to intercept electronic > communications. However, there is no legal basis to support this > premise. In law there is nothing inherently illegal or suspect about > the use of a telephone. The federal wiretap statute says only that > communication service providers must assist law enforcement execute a > lawful warrant. > CPSR supports the review of cryptography policy currently > underway at the Department of Commerce. CPSR also supports the efforts > undertaken by the Subcommittee on Telecommunications and Finance to > study the full ramifications of the Clipper proposal. However, we are > not pleased about the review now being undertaken at the White House. > That effort has led to a series of secret meetings, has asked that > scientists sign non-disclosure agreements and accept restrictions on > publication, and has attempted to resolve public concerns through > private channels. This is not a good process for the evaluation of a > technology that is proposed for the public switched network. > Even if the issues regarding Clipper are resolved favorably, > privacy concerns will not go away. Rules still need to be developed > about the collection and use of transactional data generated by > computer communications. Several specific steps should be taken. > First, the FCC should be given a broad mandate to pursue privacy > concerns. Second, current gaps in the communications law should be > filled. The protection of transactional records is particularly > important. Third, telecommunications companies should be encouraged to > explore innovative ways to protect privacy. "Telephone cards", widely > available in other countries, are an ideal way to protect privacy. > > > TESTIMONY > > Mr. Chairman, members of the Subcommittee, thank you for the > opportunity to testify today on encryption policy and the Clipper > proposal. I especially wish to thank you Congressman Markey, on behalf > of CPSR, for your ongoing efforts on the privacy front as well as your > work to promote public access to electronic information. > The cryptography issue is of particular concern to CPSR. > During the past several years we have pursued an extensive study of > cryptography policy in the United States. We have organized several > public conferences, conducted litigation under the Freedom of > Information Act, and appeared on a number of panels to discuss the > importance of cryptography for privacy protection and the need to > scrutinize carefully government proposals designed to limit the use of > this technology. > While we do not represent any particular computer company or > trade association we do speak for a great many people in the computer > profession who value privacy and are concerned about the government's > Clipper initiative. > Today I will briefly summarize our assessment of the Clipper > proposal. Then I would like to say a few words about the current > status of privacy protection. > > CLIPPER > To put the Clipper proposal in a policy context, I will need to > briefly to describe a law passed in 1987 intended to address the roles > of the Department of Commerce and the Department of Defense in the > development of technical standards. The Computer Security Act of 1987 > was enacted to improve computer security in the federal government, to > clarify the responsibilities of the National Institute of Standards and > Technology (NIST) and the National Security Agency, and to ensure that > technical standards would serve civilian and commercial needs. > The law made clear that in the area of unclassified computing > systems, NIST and not NSA, would be responsible for the development of > technical standards. It emphasized public accountability and stressed > open decision-making. The Computer Security Act also established the > Computer System Security and Privacy Advisory Board (CSSPAB), charged > with reviewing the activities of NIST and ensuring that the mandate of > the law was enforced. > The Computer Security Act grew out of a concern that classified > standards and secret meetings would not serve the interests of the > general public. As the practical applications for cryptography have > moved from the military and intelligence arenas to the commercial > sphere, this point has become clear. There is also clearly a conflict > of interest when an agency tasked with signal interception is also > given authority to develop standards for network security. > In the spirit of the Computer Security Act, NIST set out in > 1989 to develop a public key standard FIPS (Federal Information > Processing Standard). In a memo dated May 5, 1989, obtained by CPSR > through the Freedom of Information Act, NIST said that it planned: > > to develop the necessary public-key based security standards. We > require a public-key algorithm for calculating digital signatures and > we also require a public-key algorithm for distributing secret keys. > > NIST then went on to define the requirements of the standard: > > The algorithms that we use must be public, unclassified, implementable > in both hardware or software, usable by federal Agencies and U.S. based > multi-national corporation, and must provide a level of security > sufficient for the protection of unclassified, sensitive information > and commercial propriety and/or valuable information. > > The Clipper proposal and the full-blown Capstone configuration, > which incorporates the key management function NIST set out to develop > in 1989, is very different from the one originally conceived by NIST. > > % The Clipper algorithm, Skipjack, is classified, > % Public access to the reasons underlying the proposal is > restricted, > % Skipjack can be implemented only in tamper-proof hardware, > % It is Unlikely to be used by multi-national corporations, and > % The security of Clipper remains unproven. > > The Clipper proposal undermines the central purpose of the > Computer Security Act. Although intended for broad use in commercial > networks, it was not developed at the request of either U.S. business > or the general public. It does not reflect public goals. Rather it > reflects the interests of one secret agency with the authority to > conduct foreign signal intelligence and another government agency > responsible for law enforcement investigations. > Documents obtained by CPSR through the Freedom of Information > Act indicate that the National Security Agency dominated the meetings > of the joint NIST/NSA Technical Working group which made > recommendations to NIST regarding public key cryptography, and that a > related technical standard for message authentication, the Digital > Signature Standard, clearly reflected the interests of the NSA. > We are still trying to determine the precise role of the NSA in > the development of the Clipper proposal. We would be pleased to > provide to the Subcommittee whatever materials we obtain. > > LEGAL AND POLICY ISSUES > There are also several legal and constitutional issues raised > by the government's key escrow proposal. The premise of the Clipper > key escrow arrangement is that the government must have the ability to > intercept electronic communications, regardless of the economic or > societal costs. The FBI's Digital Telephony proposal, and the earlier > Senate bill 266, were based on the same assumption. > There are a number of arguments made in defense of this > position: that privacy rights and law enforcement needs must be > balanced, or that the government will be unable to conduct criminal > investigations without this capability. > Regardless of how one views these various claims, there is one > point about the law that should be made very clear: currently there is > no legal basis -- in statute, the Constitution or anywhere else -- > that supports the premise which underlies the Clipper proposal. As the > law currently stands, surveillance is not a design goal. General > Motors would have a stronger legal basis for building cars that could > go no faster than 65 miles per hour than AT&T does in marketing a > commercial telephone that has a built-in wiretap capability. In law > there is simply nothing about the use of a telephone that is inherently > illegal or suspect. > The federal wiretap statute says only that communication > service providers must assist law enforcement in the execution of a > lawful warrant. It does not say that anyone is obligated to design > systems to facilitate future wire surveillance. That distinction is > the difference between countries that restrict wire surveillance to > narrow circumstances defined in law and those that treat all users of > the telephone network as potential criminals. U.S. law takes the first > approach. Countries such as the former East Germany took the second > approach. The use of the phone system by citizens was considered > inherently suspect and for that reason more than 10,000 people were > employed by the East German government to listen in on telephone calls. > It is precisely because the wiretap statute does not contain > the obligation to incorporate surveillance capability -- the design > premise of the Clipper proposal -- that the Federal Bureau of > Investigation introduced the Digital Telephony legislation. But that > legislation has not moved forward and the law has remained unchanged. > The Clipper proposal attempts to accomplish through the > standard-setting and procurement process what the Congress has been > unwilling to do through the legislative process. > On legal grounds, adopting the Clipper would be a mistake. > There is an important policy goal underlying the wiretap law. The > Fourth Amendment and the federal wiretap statute do not so much balance > competing interests as they erect barriers against government excess > and define the proper scope of criminal investigation. The purpose of > the federal wiretap law is to restrict the government, it is not to > coerce the public. > Therefore, if the government endorses the Clipper proposal, it > will undermine the basic philosophy of the federal wiretap law and the > fundamental values embodied in the Constitution. It will establish a > technical mechanism for signal interception based on a premise that has > no legal foundation. The assumption underlying the Clipper proposal is > more compatible with the practice of telephone surveillance in the > former East Germany than it is with the narrowly limited circumstances > that wire surveillance has been allowed in the United States. > > UNANSWERED QUESTIONS > There are a number of other legal issues that have not been > adequately considered by the proponents of the key escrow arrangement > that the Subcommittee should examine. First, not all lawful wiretaps > follow a normal warrant process. The proponents of Clipper should make > clear how emergency wiretaps will be conducted before the proposal goes > forward. Second, there may be civil liability issues for the escrow > agents, if they are private parties, if there is abuse or compromise of > the keys. Third, there is a Fifth Amendment dimension to the proposed > escrow key arrangement if a network user is compelled to disclose his > or her key to the government in order to access a communications > network. Each one of these issues should be examined carefully. > > > CPSR CONFERENCE > At a conference organized by CPSR this week at the Carnegie > Endowment for International Peace we heard presentations from staff > members at NIST, FBI, NSA and the White House about the Clipper > proposal. The participants at the meeting had the opportunity to ask > questions and to exchange views. > Certain points now seem clear: > > % The Clipper proposal was not developed in response to any > perceived public or business need. It was developed solely to address > a law enforcement concern. > % Wire surveillance remains a small part of law enforcement > investigations. The number of arrests resulting from wiretaps has > remained essentially unchanged since the federal wiretap law was enacted > in 1968. > % The potential risks of the Clipper proposal have not been > assessed and many questions about the implementation remain unanswered. > % Clipper does not appear to have the support of the business or > research community. > > Many comments on the Clipper proposal, both positive and > negative as well the materials obtained by CPSR through the Freedom of > Information Act, are contained in the Source book compiled by CPSR for > the recent conference. I am please to make a copy of this available to > the Subcommittee. > > > NETWORK PRIVACY PROTECTION > Communications privacy remains a critical test for network > development. Networks that do not provide a high degree of privacy are > clearly less useful to network users. Given the choice between a > cryptography product without a key escrow and one with a key escrow, it > would be difficult to find a user who would prefer the key escrow > requirement. If this proposal does go forward, it will not be because > network users or commercial service providers favored it. > Even if the issues regarding the Clipper are resolved > favorably, privacy concerns will not go away. Cryptography is a part > of communications privacy, but it is only a small part. Rules still > need to be developed about the collection and use of transactional data > generated by computer communications. While the federal wiretap law > generally does a very good job of protecting the content of > communications against interception by government agencies, large holes > still remain. The extensive use of subpoenas by the government to > obtain toll records and the sale of telephone records by private > companies are just two examples of gaps in current law. > The enforcement of privacy laws is also a particularly serious > concern in the United States. Good laws without clear mechanisms for > enforcement raise over-arching questions about the adequacy of legal > protections in this country. This problem is known to those who have > followed developments with the Privacy Act since passage in 1974 and > the more recent Video Privacy and Protection Act of 1988. I make this > point because it has been the experience in other countries that > agencies charged with the responsibility for privacy protection can be > effective advocates for the public in the protection of personal > privacy. > > RECOMMENDATIONS > Regarding the Clipper proposal, we believe that the national > review currently underway by the Computer Security and Privacy Advisory > Board at the Department of Commerce will be extremely useful and we > look forward to the results of that effort. The Panel has already > conducted a series of important open hearings and compiled useful > materials on Clipper and cryptography policy for public review. > We are also pleased that the Subcommittee on Telecommunications > and Finance has undertaken this hearing. This Subcommittee can play a > particularly important role in the resolution of these issues. We also > appreciate the Chairman's efforts to ensure that the proper studies are > undertaken, that the General Accounting Office fully explores these > issues, and that the Secretary of Commerce carefully assesses the > potential impact of the Clipper proposal on export policy. > We are, however, less pleased about the White House study > currently underway. That effort, organized in large part by the > National Security Council, has led to a series of secret meetings, has > asked that scientists sign non-disclosure agreements and accept > restrictions on publication, and has attempted to resolve public > concerns through private channels. This is not a good process for the > evaluation of a technology that is proposed for the public switched > network. While we acknowledge that the White House has been reasonably > forthcoming in explaining the current state of affairs, we do not think > that this process is a good one. > For these reasons, we believe that the White House should > properly defer to the recommendations of the Computer System Security > and Privacy Advisory Board and the Subcommittee on Telecommunications > and Finance. We hope that no further steps in support of the Clipper > initiative will be taken. We specifically recommend that no further > purchase of Clipper chips be approved. > Speaking more generally, we believe that a number of steps > could be taken to ensure that future communications initiatives could > properly be viewed as a boost to privacy and not a set-back. > > % The FCC must be given a strong mandate to pursue privacy > concerns. There should be an office specifically established to > examine privacy issues and to prepare reports. Similar efforts in > other countries have been enormously successful. The Japanese Ministry > of Post and Telecommunications developed a set of privacy principles to > ensure continued trade with Europe. The Canada Ministry of > Communications developed a set of communications principles to address > public concerns about the privacy of cellular communications. In > Europe, the EC put forward an important directive on privacy protection > for the development of new network services. > > % Current gaps in the communications law should be filled. The > protection of transactional records is particularly important. > Legislation is needed to limit law enforcement access to toll record > information and to restrict the sale of data generated by the use of > telecommunication services. As the network becomes digital, the > transaction records associated with a particular communication may > become more valuable than the content of the communication itself. > > % Telecommunications companies should be encouraged to explore > innovative ways to protect privacy. Cryptography is a particular > method to seal electronic communications, but far more important for > routine communications could be anonymous telephone cards, similar to > the metro cards here in the District of Columbia, that allow consumers > to purchase services without establishing accounts, transferring > personal data, or recording personal activities. Such cards are widely > available in Europe, Japan, and Australia. > > I thank you very much for the opportunity to appear before the > Subcommittee and would be pleased to answer your questions Computer > Professionals for Social Responsibility > > CPSR is a national membership organization, established in > 1982, to address the social impact of computer technology. There are > 2,500 members in 20 chapters across the United States, and offices in > Palo Alto, California, Cambridge, Massachusetts, and Washington DC. The > organization is governed by a board of elected officers and meetings > are open to the public. CPSR sponsors an annual meeting and the > biennial conference on Directions and Implications of Advanced > Computing. CPSR sponsored the first conference on Computers, Freedom, > and Privacy in 1991. CPSR also operates the Internet Library at > cpsr.org. The library contains documents from the White House on > technology policy and a wide range of public laws covering privacy, > access to information, and communications law and is available free of > charge to all users of the Internet. > > Marc Rotenberg is the director of the CPSR Washington office > and an adjunct professor at Georgetown University Law Center. He is > chairman of the ACM Committee on Scientific Freedom and Human Rights, > an editor for the Computer Law and Security Report (London), and the > secretary of Privacy International, an organization of human rights > advocates and privacy scholars in forty countries. He received an A.B. > from Harvard College and a J.D. from Stanford Law School, and is a > member of the bar of the United States Supreme Court. His forthcoming > article "Communications Privacy: Implications for Network Design" will > appear in the August 1993 issue of Communications o0f the ACM. > > ------------------------------ > > End of Computer Underground Digest #5.43 > ************************************

2 1

Re: DH for email (re: email protection and privacy)
by Brian.Hawthorne＠East.Sun.COM 15 Jun '93

15 Jun '93

> Let's say I have a (paper) document which explains how I (for example) > embezzled money from Megacorp, Inc. I presume that the Fifth > Amendment means I cannot be forced to produce this document. Bad assumption. Written documents, even if written by you and even if it incriminates you, can be subpoenaed. I forget the case that set the precedent for this, but it had to do with someone's diary.

1 0

Kahn Sees On-Going Battle On Cryptography 06/14/93
by gnu＠cygnus.com 15 Jun '93

15 Jun '93

From: newsbytes(a)clarinet.com Newsgroups: clari.nb.general Subject: Kahn Sees On-Going Battle On Cryptography 06/14/93 PALO ALTO, CALIFORNIA, U.S.A., 1993 JUN 14 (NB) -- David Kahn, author of "The Codebreakers", speaking at the Third CPSR Cryptography Conference, told those assembled that he sees an on- going battle between government and privacy advocates over personal and business uses of cryptography. Kahn began by saying "My thesis is that the growth of cryptography follows the growth of communication. When there was little literacy, writing itself was a form of cryptography" "A great leap forward came in World War I -- the use of radio brought the need for greater use of codes to insure the privacy of messages. In the fall out after the war, the use of cipher machines was attempted but this approach was not really practical until computers came along," he added. According to Khan, in recent times, interest in cryptography has grown dramatically. "When the RSA algorithm was mentioned in Scientific American, there were 5,000 requests for reprints of the article; the story "Ultra Secret" about the breaking of the Germans' code raised interest and threats such as computer "hackers", viruses and cellular phone fraud raised additional interest in cryptography and the protection of privacy," he said. Kahn then moved to his Antithesis: "(The) Government wants to stop the movement toward privacy. (The) Government wants to know about criminal and terrorists. It tries to accomplish this objective through such things as export controls and the Clipper & Capstone chips," he told the audience. "The Government sees its activity. not as an additional intrusion into individual privacy. but as an attempt to maintain the present state. However, the domain of individual rights has been expanding -- the Miranda warnings, abortion decisions and the more strident avocation of privacy rights are examples of this trend," he said. "The Government moves are trying to block the advance of privacy rather than intrude into present rights. Export limits inhibits business expansion," he added. Kahn concluded: "Now we have to look for the synthesis. It's a matter of "privacy is good" and "business profits are good" versus "security is good." The question that must be answered is how to balance these goods. Do we give up the first for the second?" "The World Trade Center bombing shows that terrorism is here and is a concern. Government wants to hold back technology. This can't be done forever but can be done for a while. Government will argue that the temporary holding back will save some lives and properties," he said. In the question and answer period that followed, Bill Murray, consultant to Deloite and Touche, commented: "When the government wants us to give up the right to private communications, it must show us the danger (that warrants it). If drug dealers and terrorists are the problem, it should be demonstrated that drug dealers and terrorists are abusing private communications." In response to a Newsbytes question as to whether the triumph of the expansion of privacy rights over government concerns was inevitable, Kahn said: "Privacy is to powerful a force to be stopped. It will eventually prevail." Ross Stapleton, a Central Intelligence Agency (CIA) analyst, commented: "These changes in information may cause a rethinking of the concept of national sovereignty. Governments have always have tried to control the flow of information; with the new technology and communications capabilities, they cannot. control it any longer." Murray said: "We cannot control it but we can criminalize it and that would be a mistake. By criminalizing drugs, we have destabilized society. There is so much illegal money from this policy that courts, law enforcement departments and legislatures have been corrupted." Asked by Newsbytes if he saw illegal money growing if the government tries to rein in the growth of cryptography or tries to make wiretapping more pervasive, Murray said: "No, it's not analogous in the money sense. But the criminalizing of anything without real justification causes destabilization." (Barbara E. McMullen & John F. McMullen/19930614/Press Contact: David Banisar, Computer Professionals For Social Responsibility, 202-544-9240 (voice); 202-547-5481 (fax); banisar(a)washofc.cpsr.org on the Internet) "Copyright 1993 by <UPI/Newsbytes/Whoever> (I have no idea who). Reposted with permission from the ClariNet Electronic Newspaper newsgroup clari.nb.general. For more info on ClariNet, write to info(a)clarinet.com or phone 1-800-USE-NETS."

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by bbyer＠BIX.com 15 Jun '93

15 Jun '93

In-Reply-To: <9306081620.AA07331(a)soda.berkeley.edu> > Here, in its almost full glory, is the letter that CERT sent to the > admin at berkeley. I've removed the addressee, since there's no need > to involve that person. I have not, however, removed the name of the > sender. > ... > > We have been passed information that indicates that the anonymous FTP > archive on the following host(s) may be in use by intruders for ^ > illegal trading of commercial software: > > >>>>>>> soda.berkeley.edu /pub/cypherpunks > > We have not confirmed this information, nor have we identified that > the anonymous FTP configuration on the above-listed host(s) is open > for abuse. ^ > > ... This look suspiciously like a form letter. The possible plurals ("(s)") and the fact that the site name is in a "list type" format indicate this is probably a form letter. This is even more disturbing; do they have a form letter because they use it often or do they have a daemon that searches for highly undesirable things such as ftp sites with lots of encryption related things and automatically fires off this harassing form letter? Ben Byer <bbyer(a)bix.com>

1 0

Re: DH for email (re: email protection and privacy)
by wcs＠anchor.ho.att.com 14 Jun '93

14 Jun '93

peb(a)PROCASE.COM writes: > > >Case 4: "I forgot." > > > > This one seems to work for U.S. presidents. Yes, but in Reagan's case it was quite believable that he had forgotten; you, on the other hand, are presumed to be competent :-) Bill

1 0

funky wierdmail
by Stanton McCandlish 14 Jun '93

14 Jun '93

Anyone got any idea why I keep getting mail like this? It appears to be a bounce of some sort. Dunno which list (if any) it is coming from, but many mailwizzes seem to be reading, so I am hoping no one will mind the bandwidth use... This is the WHOLE message, it's just header and no body. I get several of them per day, starting about 5 days ago. Quoth uucp(a)attmail.com, verily I saith unto thee: > From uucp(a)attmail.com Sun Jun 13 18:38:55 1993 > id <AA02312>; Sun, 13 Jun 1993 18:38:53 -0600 > Message-Id: <9306140038.AA02312(a)hydra.unm.edu> > From: uucp(a)attmail.com > Date: 14 Jun 93 00:30:46 GMT > To: anton(a)hydra.unm.edu > Report-Version: 2 > Confirming-Mts-Message-Id: </C=US/AD=ATTMAIL;internet1650027060> > Confirming-Ua-Content-Id: <ternet1650027060> > Original-Date: Mon Jun 14 00:30:46 GMT 1993 > Not-Delivered-To: mhs!wu/O=duncan_frissell/DD.ELN=62896145 due to 05 Unavailable User Agent > Content-Type: text > > -- When marriage is outlawed only outlaws will be inlaws! Stanton McCandlish, SysOp: Noise in the Void DataCenter Library BBS Internet anton(a)hydra.unm.edu IndraNet: 369:1/1 FidoNet: 1:301/2 Snail: 1811-B Coal Pl. SE, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0