October 2000 - cypherpunks-legacy

CDR: Who says there's gridlock in DC?
by Declan McCullagh 24 Oct '00

24 Oct '00

bills that the prez signed today... On Tuesday, October 24th, 2000, the President signed into law: H.R. 1509 Disabled Veterans' LIFE Memorial Foundation H.R. 3201 Carter G. Woodson Home National Historic Site Study Act of 2000 H.R. 3632 Golden Gate National Recreation Area Bountary Adjustment Act of 2000 H.R. 3676 Santa Rosa and Santa Jacinto Mountains National Monument Act H.R. 4063 Rosie the Riveter/World War II Home Front National Historical Park Establishment Act of 2000 H.R. 4275 Colorado Canyons National Conservation Area and Black Ridge Canyons Wilderness Act of 2000 H.R. 4386 Breast and Cervical Cancer Prevention and Treatment Act of 2000 H.R. 4613 National Historic Lighthouse Preservation Act of 2000 H.R. 5036 Dayton Aviation Heritage preservation Amendment of 2000 S. 1849 White Clay Creek Wild and Scenic Rivers System

2 1

CDR: DCSB: Ramzan and Van Someren; Minting Millidollars for Streaming Cash
by R. A. Hettinga 24 Oct '00

24 Oct '00

--- begin forwarded text

1 0

CDR: Public Demo of Carnivore and Friends
by An Metet 24 Oct '00

24 Oct '00

FBI agent Marcus C. Thomas (who is mentioned in the EPIC FOIA documents) made a very interesting presentation at NANOG 20 yesterday morning, discussing Carnivore. Agent Thomas gave a demonstration of both Carnivore 1.34 (the currently deployed version) and Carnivore 2.0 (the development version) as well as some of the other DragonWare tools. Most of this information isn't new, but it demonstrates that the DragonWare tools can be used to massively analyze all network traffic accessible to a Carnivore box. The configuration screen of Carnivore shows that protocol information can be captured in 3 different modes: Full, Pen, and None. There are check boxes for TCP, UDP, and ICMP. Carnivore can be used to capture all data sent to or from a given IP address, or range of IP addresses. It can be used to search on information in the traffic, doing matching against text entered in the "Data Text Strings" box. This, the agent assured us, was so that web mail could be identified and captured, but other browsing could be excluded. It can be used to automatically capture telnet, pop3, and FTP logins with the click of a check box. It can monitor mail to and/or from specific email addresses. It can be configured to monitor based on IP address, RADIUS username, MAC address, or network adaptor. IPs can be manually added to a running Carnivore session for monitoring. Carnivore allows for monitoring of specific TCP or UDP ports and port ranges (with drop down boxes for the most common protocols). Carnivore 2.0 is much the same, but the configuration menu is cleaner, and it allows Boolean statements for exclusion filter creation. -- The Packeteer program takes raw network traffic dumps, reconstructs the packets, and writes them to browsable files. CoolMiner is the post-processor session browser. The demo was version 1.2SP4. CoolMiner has the ability to replay a victim's steps while web browsing, chatting on ICQ, Yahoo Messenger, AIM, IRC. It can step through telnet sessions, AOL account usage, and Netmeeting. It can display information sent to a network printer. It can process netbios data. CoolMiner displays summary usage, broken down by origination and destination IP addresses, which can be selectively viewed. Carnivore usually runs on Windows NT Workstation, but could run on Windows 2000. Some choice quotes from Agent Thomas: "Non-relevant data is sealed from disclosure." "Carnivore has no active interaction with any devices on the network." "In most cases Carnivore is only used with a Title III. The FBI will deploy Carnivore without a warrant in cases where the victim is willing to allow a Carnivore box to monitor his communication." "We rely on the ISP's security [for the security of the Carnivore box]." "We aren't concerned about the ISP's security." When asked how Carnivore boxes were protected from attack, he said that the only way they were accessible was through dialup or ISDN. "We could take measures all the way up to encryption if we thought it was necessary." While it doesn't appear that Carnivore uses a dial-back system to prevent unauthorized access, Thomas mentioned that the FBI sometimes "uses a firmware device to prevent unauthorized calls." When asked to address the concerns that FBI agents could modify Carnivore data to plant evidence, Thomas reported that Carnivore logs FBI agents' access attempts. The FBI agent access logs for the Carnivore box become part of the court records. When asked the question "It's often common practice to write back doors into [software programs]. How do we know you aren't doing that?", Thomas replied "I agree 100%. You're absolutely right." When asked why the FBI would not release source, he said: "We don't sell guns, even though we have them." When asked: "What do you do in cases where the subject is using encryption?" Thomas replied, "This suite of devices can't handle that." I guess they hand it off to the NSA. He further stated that about 10% of the FBI's Carnivore cases are thwarted by the use of encryption, and that it is "more common to find encryption when we seize static data, such as on hard drives." 80% of Carnivore cases have involved national security. -- Also of interest was a network diagram that looked very similar to the one in the EPIC FOIA document at http://www.epic.org/privacy/carnivore/omnivorecapabilities1.html , except that there was no redaction of captions. -- Marcus Thomas can be contacted for questions at mthomas(a)fbi.gov or at (730) 632-6091. He is "usually at his desk."

1 0

CDR: Watermarking Utopia ...
by Anonymous Remailer 24 Oct '00

24 Oct '00

2 1

CDR: Welcome to oral-heaven
by oral-heaven Moderator 24 Oct '00

24 Oct '00

Hi ! Welcome to the group The success or otherwise of the group will depend on its members so please try to post whenever possible. Please take a few mins. to read the Frequently Asked Questions at http://www8.50megs.com/egtoys/faq.html Buy Sex Toys online at http://www.sextoyfun.com/egtoys/ Never have problems finding an egroup to join. See this groups link page for a selection of some of the best groups. http://www.egroups.com/links/oral-heaven/ Toys and Collectables AUctions http://www.geocities.com/ebkev/auctioneg.html

1 0

CDR: RE: Wired News tech scorecard for U.S. House of Representatives
by Carskadden, Rush 24 Oct '00

24 Oct '00

Everyone, Just a quick observation here. According to the Wired chart, it appears that the Republicans average roughly 49.85058296 and the Democrats average roughly 47.27853081 on the Wired News scale, with one representative being independent (Bernard Sanders), and one representative with an "A" for their party designation (Spencer Bachus). Here's my Republicans vs. Democrats breakdown of the Wired News chart: Party | Republican | Democrat | ----------------------------------- HR2301 | 0.181818182 | 0.343137255 | ----------------------------------- HR3615 | 0.153846154 | 0.024509804 | ----------------------------------- HR3709 | 0.958715596 | 0.697115385 | ----------------------------------- HR3125 | 0.218009479 | 0.575129534 | ----------------------------------- HR1501 | 0.440909091 | 0.908653846 | ----------------------------------- HR10 | 0.522522523 | 0.058252427 | ----------------------------------- HR1714 | 0.986175115 | 0.695652174 | ----------------------------------- total | 3.381165919 | 3.203791469 | ----------------------------------- votes | 6.798206278 | 6.777251185 | ----------------------------------- score | 49.85058296 | 47.27853081 | ----------------------------------- These are all just averages, and I omitted the "A" and "I" designated representatives. In regards to the "A" designated representative, Spencer Bachus, I think the "A" is an error. I was under the impression that he was a Republican. If he is, in fact, a Republican, then that changes our averages slightly: Party | Republican | Democrat | ----------------------------------- HR2301 | 0.180995475 | 0.343137255 | ----------------------------------- HR3615 | 0.153110048 | 0.024509804 | ----------------------------------- HR3709 | 0.95890411 | 0.697115385 | ----------------------------------- HR3125 | 0.216981132 | 0.575129534 | ----------------------------------- HR1501 | 0.438914027 | 0.908653846 | ----------------------------------- HR10 | 0.520179372 | 0.058252427 | ----------------------------------- HR1714 | 0.986238532 | 0.695652174 | ----------------------------------- total | 3.375 | 3.203791469 | ----------------------------------- votes | 6.799107143 | 6.777251185 | ----------------------------------- score | 49.75558036 | 47.27853081 | ----------------------------------- Which still puts Republicans in more of a hands-off strategy for technology, according to voting history. If Spencer Bachus is not a Republican, then please tell me what the hell an "A" party designation stands for. If you are interested in seeing TOTALS as opposed to AVERAGES, here is your chart: Party | Republican | Democrat | ----------------------------------- HR2301 | 40 | 70 | ----------------------------------- HR3615 | 32 | 5 | ----------------------------------- HR3709 | 210 | 145 | ----------------------------------- HR3125 | 46 | 111 | ----------------------------------- HR1501 | 97 | 189 | ----------------------------------- HR10 | 116 | 12 | ----------------------------------- HR1714 | 215 | 144 | ----------------------------------- total | 756 | 676 | ----------------------------------- votes | 1523 | 1430 | ----------------------------------- Again, it is entirely possible that my information is incorrect. I do recommend that you do the research yourself, as relying too much on these numbers means relying on numbers collected by a media source and in turn sorted and re-calculated by some punk-ass on the cypherpunks mailing list. To the best of my knowledge, however, this looks right. What alarms me is that though there is a slight difference in the overall score between Republicans and Democrats, neither party has a very strong leaning one way or the other, which illustrates the frustrations that a two-party system creates for those of us who would like to see a strong stance (either way) on the issue of government regulation of technology. I anxiously await any speculation that might take place on this list regarding how Libertarian representatives might have voted had they been in there, but the fact is that we live in a two-party system for the time being, and if we feel strongly about these issues, we need to accept that our representation may not be hearing us. Is it because we aren't speaking loudly enough on these issues? ok, Rush Carskadden -----Original Message----- From: Declan McCullagh [mailto:declan@well.com] Sent: Tuesday, October 24, 2000 11:15 AM To: Cypherpunks Mailing List Cc: fight-censorship(a)vorlon.mit.edu Subject: Wired News tech scorecard for U.S. House of Representatives At Wired News, we've compiled a list of the technology voting records of each member of the U.S. House of Representatives. That meant picking seven tech bills and grading all 435 legislators -- at least the ones who showed up those days -- on their floor votes. If they chose to take a hands-off approach, they got a "1", while regulatory votes got a "0." (If you disagree with us, flip the scale around.) Here's the list sorted by last name (scoll down to find your legislator): http://www.wired.com/news/print/0,1294,39637,00.html Sorted by score, with the two California reps with 100 percent at the top: http://www.wired.com/news/print/0,1294,39636,00.html And a summary of the results, with some methodology: http://www.wired.com/news/politics/0,1283,39625,00.html Some interesting results: Purported privacy advocates like Democrat Ed Markey didn't score well, getting a 33% of 100%, in part because of his opposition to financial privacy legislation. Republican Bob Goodlatte, Internet caucus co-chair, got just 43% because of his support for speech and gambling restrictions. -Declan The floor votes scored: HR2031: A vote to restrict online sales of alcohol. (No is 1) HR3615: A vote to create a new federal agency to spend $1.25 billion on rural TV service. (No is 1) HR3709: A vote to extend a temporary federal ban on Internet taxes. (Yes is 1) HR3125: A vote to prohibit Internet gambling. (No is 1) HR1501: A vote on an amendment to restrict the sale of violent material such as videogames to anyone under the age of 18. (No is 1) HR10: A vote on an amendment to protect financial privacy by restricting government monitoring of bank accounts. (Yes is 1) HR1714: A vote to allow the use of electronic signatures. (Yes is 1)

1 0

CDR: Congress proposes raiding census records.
by Trei, Peter 24 Oct '00

24 Oct '00

Let us remember that the last time the privacy of census records were violated on this scale, they were used to imprison tens of thousands of law abiding American citizens, whose only crime was to have Japanese ancestry. Peter Trei ------------- http://www.nytimes.com/2000/10/23/opinion/23MONK.html (free registration required) New York Times, 23 October, 2000 My Data, Mine to Keep Private By LINDA R. MONK WASHINGTON -- I was one of those paranoid Americans who chose not to answer all questions on the long form of the 2000 census. My husband and I decided that the government did not need to know, or had other ways of finding out, what time we left for work, how much our mortgage payment was or the amount of our income that came from wages. We were willing to risk the $100 fine to take a stand for individual privacy in an increasingly nosy and automated age. Editorial writers across the nation chided people like us for being so silly, insisting that only right-wing nuts with delusions of jackbooted federal invaders could possibly object to the census. Think of all the poor women who need day care and disabled people who depend on public transportation, we were told. And don't listen to the warnings of Trent Lott, the Senate majority leader - they're just another Republican ploy to get a low count on the census. Now, however, my concerns don't appear quite so ridiculous. The Congressional Budget Office, with the surprising help of some Congressional Republicans, is angling to get its hands on Census Bureau files. The budget office wants to create a "linked data set" on individuals - using information from the Internal Revenue Service, Social Security Administration and Census Bureau surveys - to help it evaluate proposed reforms in Medicare and Social Security. Under current law, census data on individuals can be used only to benefit the Census Bureau, which has balked at turning over files to the budget office without greater assurances of individual privacy. However, the Congressional number crunchers are not taking no for an answer. Republicans may tack an amendment allowing Congress access to census data onto an appropriations bill before Congress adjourns for the elections. The records the budget office wants are not themselves from the 2000 Census; they are voluntary responses to monthly surveys, with confidentiality promised. Forcing the bureau to give them up would set a disturbing precedent. Commerce Secretary Norman Mineta, who supervises the Census Bureau, warned Congress this month that amending the census law would "seriously compromise" the department's ability to safeguard taxpayers' privacy and "to assure continued high response rates of the American public to census surveys." Chip Walker, a spokesman for Representative Dan Miller, a Florida Republican who chairs the House subcommittee on the census, sees no problem with congressional access to census data. "The Census Bureau is the government, and Congress is the government," he said. Well, that's exactly what I'm afraid of. It's not surprising that a federal agency that stockpiles information would be raided by other federal agencies. If Congress changes the census law, the government will be well on its way to becoming another Amazon.com, which abruptly and retroactively weakened its privacy policy this year. I expected as much, because I don't believe either the government or businesses when they promise me privacy. That's why I routinely lie about personal information when applying for shoppers' discount cards and the like. And it's why I don't answer invasive questions on census forms. Keep your hands off my data set.

1 0

CDR: FW: House Republicans consider Census database, from NY Times
by Trei, Peter 24 Oct '00

24 Oct '00

The last time they did this, tens of thousands of law abiding American citizens were placed in prison camps, for no reason other than their ethnicity. Peter Trei > ---------- > From: Declan McCullagh[SMTP:declan@well.com] > Reply To: declan(a)well.com > Sent: Tuesday, October 24, 2000 2:29 PM > To: politech(a)politechbot.com > Subject: FC: House Republicans consider Census database, from NY > Times > > > ****** > > From: Steve Hutto <SHutto(a)Policy-Studies.com> > To: "'declan(a)well.com'" <declan(a)well.com> > Subject: politech submission > Date: Tue, 24 Oct 2000 12:21:36 -0600 > > Hi Declan, love the list. Apologies if you're already tracking this... > > Op-Ed from the NY Times 10/23/2000 > "My Data, Mine to Keep Private" by Linda R. Monk > http://www.nytimes.com/2000/10/23/opinion/23MONK.html > > Scary opinion about House Republicans looking at creating a "linked data > set" between Census Bureau files and the IRS and SSA. Any meat to this > one? > > Excerpt: > "Under current law, census data on individuals can be used only to > benefit the Census Bureau, which has balked at turning over files > to the budget office without greater assurances of individual > privacy. However, the Congressional number crunchers are not taking > no for an answer. Republicans may tack an amendment allowing > Congress access to census data onto an appropriations bill before > Congress adjourns for the elections." > > > > > ------------------------------------------------------------------------- > POLITECH -- the moderated mailing list of politics and technology > You may redistribute this message freely if it remains intact. > To subscribe, visit http://www.politechbot.com/info/subscribe.html > This message is archived at http://www.politechbot.com/ > ------------------------------------------------------------------------- >

1 0

CDR: Verify Your $25,000 Entry
by confirm＠easywinning.com 24 Oct '00

24 Oct '00

Dear fgjfgj, This email is to confirm and verify that you entered to the $25,000 prize at TroppoLotto recently. To verify that your entry please click the link below to and make sure your registration info is correct. We'll give you a bonus entry for the $25,000 prize for confirming your entry! http://www.easywinning.com/firsttime.asp?sl=troppolottomem&confirmation=cyp… Once a member of EasyWinning, you'll be able to enter to win tons of prizes like Vacations, Cash, Computers, TVs, Home Electronics, Jewelry and much more! Plus as a member of EasyWinning you'll be able to play Slots of Cash - the FREE, progressive slots game that is making winner's every day! Check it out! http://www.easywinning.com/firsttime.asp?sl=troppolottomem&confirmation=cyp… You have received this email as you indicated that you wanted an entry to win $25,000 from EasyWinning at TroppoLotto.com recently.

1 0

EZ-Pass discovers risk of sending URLs instead of actual text
by danny burstein 24 Oct '00

24 Oct '00

In a story datelined 24-Oct-2000, and headlined: New Jersey shuts down E-ZPass statement site after security breached The Associated Press reported on a problem with privacy and security on the New Jersey EZPASS website where people can review their usage. (EZPass is a radio transponder placed in your motor vehicle which is "read" at toll booths, enabling you to zip through without having to stop and hand over cash. Naturally it keeps records of when and where you were for billing purposes... Which is another RISK all together) Per the story: TRENTON, N.J. (AP) -- A security breach has forced New Jersey officials to temporarily shut down a service that allows E-ZPass users to get monthly statements via e-mail. The story contains claims and counter-claims, some of which are mutually exclusive, but then has the following paragraph: Reagoso said Monday that it wasn't hard to break into the system. He discovered that the electronic statements aren't sent directly to drivers via e-mail, but rather drivers are provided with a link to access their accounts. Presumably the link for, say, October would have been something like www.[the number of your account].200010.[somelocation] and all you'd have to do is replace your own account number with the person's you were looking for. Quoting one more paragraph from the story: "It's something that an eighth-grader who designs his own Web page at home is capable of doing," Reagoso said. "It took four accidental keystrokes to display anybody's account." I just checked the EZPass website (www.ezpass.com) and they don't have any comments posted... [It turns out Mr. Reagoso has his own website: http://www.reagoso.com in which he says a bit more. DB]

1 0