September 2001 - cypherpunks-legacy

Are Plea Agreements Always Accurate
by enochian 27 Sep '01

27 Sep '01

According to an article by Declan in this morning's Wired News, Brian K. West has decided to take a plea agreement in the government's case against him for accessing an inadvertantly left wide open web site at a newspaper. http://www.wired.com/news/politics/0,1283,47146,00.html The plea agreement alleges, amongst other things, that Mr. West intended to modify the newspaper's Perl scripts and market them commercially, as well as using a password file to access "private areas." As I remember the original story, Mr. West snarfed a local copy of the site to edit with Microsoft's FrontPage, to see what some modifications to it might look like, and in doing so, discovered that the copy of the site on the newspaper's server could be accessed and modified by anyone without need of a password, with complete access to all its scripts and other files. In the collection of files presented to the public was something that looked like a password file, and Mr. West tried one entry from it to see if access was granted, much like trying a key one finds on the ground in a nearby lock to see if it fits. Mr. West then informed the newspaper, which instead of simply fixing the misconfiguration, called the authorities, who then visited Mr. West under false pretenses, and attempted to get him to incriminate himself, and subsequently raided the premises and seized his computer. The newspaper, which had noticed the log entry from the password being tested, decided the whole thing was an attempt to steal their extremely precious Perl scripts, and market them to the public. The prosecutors, as prosecutors tend to do, managed to lie by juxtiposition by stating the fact of access using a password, a count of files transferred to Mr. West's machine, and the newspaper's allegations of software theft, in a way which suggested that Mr. West had "hacked" his way into the site using a stolen password, and used that access to steal hundreds of files, with the intent of making a profit from marketing the newspaper's stolen intellectual property. In fact, testing one of the passwords was incidental to the file transfer, the files were obtained because the site was wide open, not because a password was used, and the allegations that Mr. West intended to become the next Larry Ellison by stealing some Perl scripts a product of the newspaper's paranoid imagination. Now I find it unremarkable that Mr. West has chosen to take a plea agreement in this case, on a misdemeanor charge, instead of standing trial in the aftermath of the World Trade Center flattening as an Evil Terrorist Hacker, where the government's proof of nothing more than "unauthorized access" could send him to prison for many years. I also find it unremarkable that the plea agreement offered Mr. West to sign contains a complete laundry list of both the newspaper's and the prosecutor's twisting of the facts, and numerous confessions of "intent." What I find remarkable, is that Declan has written an article claiming that the plea agreement constitutes a "confession" by Mr. West, and that it demonstrates how easily "well-meaning" Netizens can be lead astray by a person who's really a dangerous criminal. Declan also has glowing words for the prosecutor, who he characterizes as unfairly maligned, and for the plea agreement, whose every word he characterizes as "fact." One wonders if Declan also considers everything in the Jim Bell and Carl Johnson plea agreements to constitute "fact" as well." The slant of Declan's article is also not helped by the fact that all the links provided by Wired as "also see" are about an exploit in Microsoft's Web server software having nothing to do with this case. Wired News and MSNBC continue to run neck in neck in the Birdcage Liner Olympics. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

4 3

Diffie, Sterling, Lessig, et al., interviewed (fwd)
by Jim Choate 27 Sep '01

27 Sep '01

---------- Forwarded message ---------- Date: Thu, 27 Sep 2001 16:17:45 -0400 From: "R. A. Hettinga" <rah(a)shipwright.com> To: dcsb(a)ai.mit.edu, cryptography(a)wasabisystems.com Subject: Diffie, Sterling, Lessig, et al., interviewed http://www.nytimes.com/2001/09/27/technology/circuits/27TECH.html?pagewante… September 27, 2001 In the Next Chapter, Is Technology an Ally? By KATIE HAFNER OVER the last two weeks, computer scientists and others who think about technology have wondered aloud about its likely role in countering terrorism -- or in carrying it out. Have the limitations and dangers of technology been overlooked? Where, on the other hand, might technological innovation emerge or be redirected as a result of recent events? For Ray Kurzweil, an expert in artificial intelligence and an innovative figure in computing, the events are already accelerating technologies that allow work, and people, to be dispersed rather than centralized. Security experts like Peter Neumann point to the renewed interest - and perhaps unfounded confidence - in technologies to confirm identities and track movements. "Overendowing high-tech solutions is riskful," Dr. Neumann said, "in the absence of adequate understanding of the limitations of the technology and the frailties and perversities of human nature." Mr. Kurzweil and Dr. Neumann, a computer scientist at SRI International, a research group in Menlo Park, Calif., were among six technology experts invited by Circuits to assess the challenges ahead. The other participants were Bruce Sterling, a science fiction author who writes frequently about technology; Lawrence Lessig, a professor at Stanford Law School who has written extensively on law and the Internet; Severo Ornstein, a retired hardware engineer and one of the computer scientists who worked on the original Arpanet, the precursor to the Internet; and Whitfield Diffie, the inventor of public key cryptography, a method of encoding electronic communications. Each has been in the public eye for a decade or more, thinking and writing about the promise and peril of technology. Some are more sanguine than others about a high-tech society. Their discussion, conducted last weekend by e-mail, touched on technology's possible uses in fostering security and on the issues that will arise along the way. Here are excerpts from the conversation. Q. What role will technological innovation play in responding to terrorism? Lessig These attacks could spur a great deal of technological innovation. The hard question is whether the innovation will be tailored to protect privacy as well as support legitimate state interests in surveillance and control. We as a culture think too crudely about technologies for surveillance. The conflict is always framed as some grand either/or. But if we kept pressure on the innovators and, in particular, the government, to develop technologies that did both, we could preserve important aspects of our freedom, while responding to the real threats presented by the attacks. Kurzweil The Sept. 11 tragedy will accelerate a profound trend already well under way from centralized technologies to distributed ones and from the real world to the virtual world. Centralized technologies are subject to disruption and disaster. They also tend to be inefficient, wasteful and harmful to the environment. Distributed technologies, on the other hand, tend to be flexible, efficient and relatively benign in their environment effects. In the immediate aftermath of this crisis, we already see a dramatic movement away from meetings and conferences in the real world to those in the virtual world, including Web- based meetings, Internet-based videoconferencing and other examples of virtual communication. Despite the recent collapse of market value in telecommunications, bandwidth nonetheless continues to expand exponentially, which will continue to improve the resolution and sense of realism in the virtual world. We'll see a great deal of innovation to overcome many of the current limitations. Diffie Revision of the air traffic control system together with that of other industrial command and control phenomena will push reliability and security in computing and computer communications. Such systems may provide a testing ground for the command and control of ballistic missile defense systems in which response times may be slower but the spectrum of phenomena requiring analysis will be broader. Attempts to control the use of cryptography and other security measures will make the development of improved command and control networks more difficult and may impede this task by limiting the people who can contribute to approved government and contractor personnel. Lessig This "scenario of terror" was not low tech, for its impact was not just the impact of the souls who were lost. As powerful was the effect of a world watching as it occurred. The technology of a networked world meant that scores of television cameras would be trained on the south tower, to capture the horror of the delayed second impact. And the extraordinary impact of these killings in two cities is the product of a heavily integrated - technologically integrated - world community. Terrorists take advantage of this technology to have the effect they seek. Elsewhere, in places without this technology, it would not have the same effect. Diffie Larry, this is a great observation. I wonder if it will be possible to discover whether the attackers had that subtlety of thought. Q. Larry Lessig says that the hard question is whether innovation will be tailored to protect privacy as well as support legitimate state interests in surveillance and control. Do you agree that we as a culture tend to think too crudely about technologies for surveillance? Where do you think the trade-offs should be? Neumann The most elaborate technological measures are likely to be inadequate, misused and subverted. Surveillance is all too easily misused. Trapdoors in cryptography to facilitate law enforcement can be misused. Existing system security is seriously flawed. As a result, we must avoid expecting technological security measures to be adequate in protecting privacy. So, ultimately, we have a double-edged sword. Techniques to protect can be used to subvert, attack or otherwise compromise human rights, nation states and organizations. The problems are inherently human, and technology can be used for good or bad. Sterling The question is badly put. I don't worry much about Big Brother states surveilling average citizens. It's just not cost-effective, and what Mom says in Peoria just doesn't interest the serious power players in spydom. I do worry plenty about sneaky political operatives carrying out dirty-tricks campaigns against the private lives of prominent politicians. The payoff there is huge. It can destabilize legitimate governments more effectively than terrorism. I don't think there's a good trade- off here. If we're going to use surveillance as a weapon, then we should trust our democratic traditions and arm the population with it. Kurzweil The nature of these terrorist attacks and the organization behind it puts civil liberties in general at odds with legitimate state interests in surveillance and control. The entire basis of our law enforcement system, and indeed much of our thinking about security, is based on an assumption that people are motivated to preserve their own lives and well-being. That is the logic behind all of our strategies from law enforcement on the local level to mutual assured destruction on the world stage. But a foe that values the destruction of both its enemy and itself is not amenable to this line of attack. Lessig This is a critically important insight. The real problem we face is not slowness in technological innovation. The real problem is slowness in legal and civil rights innovation in response to the technological change. It was not until the late 1960's that the Supreme Court finally held that wiretapping was regulated by the Fourth Amendment. The reason for this failing has lots to do with the way lawyers think. We are reactive traditionalists. It is hard to think creatively. But if we used the same kind of innovative creativity that our Framers used in crafting our government, we could craft creative balances between technological capabilities and human weakness. Technologies can't be guaranteed to be used only for the good. But technologies placed within well-crafted institutional structures can be made more likely safe than not. Diffie (Disclosure: I am in the protection business.) In my view the natural trade-off is a broad public right to inquire (i.e., listen to the radio, point infrared sensors around, make video recordings, analyze the data from the sensors with computers, etc.) and the right of the individual to employ protection from surveillance (cryptography, insulated walls, wearing a mask, using pseudonyms, etc.). This presumes a commercial right to make and sell products that support the individual's desire for privacy. I read in the documents of the revolutionary era a recognition of a broad right of the individual to act on self-perceived interest and generally not to be required to cooperate with someone else's view of those interests. This seems to me roughly what freedom means. The trends in contemporary society that most bother me are not so much government use of wiretaps or video cameras but such things as the requirement that cash transactions over $10,000 be reported to the I.R.S., that I must show identification to travel, etc. Ornstein I think there is a genuine tension between the desire for security and for privacy/individual freedom. This is just an instance of the more general conflict between the needs and desires of the individual and those of the larger society. Today's technology permits small numbers of people to wreak a disproportionate amount of havoc. (Without jet airplanes, the hijackers couldn't have done much damage with their box cutters.) I suspect the debate about where to draw the security line will probably be ongoing and will depend on how much damage occurs in the future: The more damage, the tighter we'll circle the wagons. Copyright 2001 The New York Times Company | Privacy Information -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Defeatist Compromising Commentary From Reason Magazine
by Paul Spirito 27 Sep '01

27 Sep '01

In the Name of God, the Nonexistent, On Thu, 27 Sep 2001 09:51:32 -0400, "Trei, Peter" <ptrei(a)rsasecurity.com> wrote: > > Paul Spirito[SMTP:berezina@nihidyll.com] wrote: > > > > In fact, when was the last time terrorists struck Switzerland?* > > Paul > > > Well, just a few hours ago, actually [for certain values of the word > 'terrorism'.] > > ------------------------------------- > > http://news.bbc.co.uk/hi/english/world/europe/newsid_1566000/1566321.stm Oy. Reminds me of an old joke: If timing were everything, the Swiss would be funny. Thanks, -- Paul

1 0

Opening night
by osama_ben-laden＠hushmail.com 27 Sep '01

27 Sep '01

The rehearsals have gone off better than expected. Opening night for our production of Anthrax Theater approaches. Please check your TVs and newspapers for details.

1 0

FIS - CP Terror
by mmotyka＠lsil.com 27 Sep '01

27 Sep '01

Since when is it a crime to state an opinion? I doubt that saying "I hate <name> and they deserve <punishment>! Let <deity> sort 'em out." would cause you any trouble except perhaps if you talked about Special Wonderful People like politicians. Even then there's probably little they could do about it except talk to you, try to intimidate you by looking Really Serious and maybe put you on a sooper-secret disrespectful snotty characters list. There's more talk than planning or action going on here. It's more like a mutual agreement and flaming society than a revolutionary cabal. Excellent cover traffic for the Real Secret Work BTW ;) Mike All right, where should the next mock-AP database go? Who? Deserves What? Why? How Much?

1 0

Re: Cypherpunks declared to be a terrorist organization?
by pablo-escobar＠hushmail.com 27 Sep '01

27 Sep '01

At 04:23 PM 9/27/2001 -0400, Steve Furlong wrote: >Easier and more productive, but it doesn't make for big flashy headlines. "Two Dozen Crypto Munitions Exporters Arrested in Midnight Raids; Ties to Money Laundering, Terrorists, Child Pornographers" would get the AG's name in the papers and distract Congress's attention from looking into just what BXA is doing. (Neal Knox noticed that criminal shooting sprees seem to take place before Congressional votes on gun restrictions. Maybe coincidence, maybe not. I'm extrapolating to a different department.) How about a small Pancho Cypherpunk? Come out with your pistolas buring or Districto Colombia VIPs in you reticula?

1 0

RE: [EMED-L] Should we ER/Healthcare workers get smallpox vaccine? (fwd)
by Paul E. Robichaux 27 Sep '01

27 Sep '01

I shouldn't have to point this out, but if you can't buy it (or steal it from someone who has bought it), it ain't available. The military *is supposed* to have 300K doses by the end of the calendar year, but the contract (IIRC) actually calls for delivery by end of FY 2003. Besides, 300K doses is significantly less than the number of active-duty military folks, much less civilians (or even civilian gov't officials) in likely target areas. -----Original Message----- From: measl(a)mfn.org [mailto:measl@mfn.org] Sent: Thursday, September 27, 2001 1:15 AM To: cypherpunks(a)einstein.ssz.com Subject: [EMED-L] Should we ER/Healthcare workers get smallpox vaccine? (fwd) For everyone under the impression that smallpox vaccine is no longer available... -- Yours, J.A. Terranson sysadmin(a)mfn.org ---------- Forwarded message ---------- Date: Wed, 26 Sep 2001 11:16:38 -0500 From: Willie Franklin <wfranklin(a)ERDOC.COM> <EMED-L(a)ITSSRV1.UCSF.EDU> To: EMED-L(a)ITSSRV1.UCSF.EDU Subject: [EMED-L] Should we ER/Healthcare workers get smallpox vaccine? The military is set to have 300,000 doses of smallpox vaccine by the end of this year. Should we be vaccinated? I was vaccinated as a child, but most of us who have been vaccinated are no longer immune. In the event that a terrorist decides to covertly unleash smallpox, we would all be at risk, as we would be the front line of defense. Any thoughts from the list? The first wave of ill people from a smallpox attack could also take out the healthcare system, as we are not immune, and may not recognize the early cases. Just thinking "out loud" here. Willie William E. Franklin, DO www.erdoc.com wfranklin(a)erdoc.com To unsubscribe, send the command "SIGNOFF EMED-L" to LISTSERV(a)ITSSRV1.UCSF.EDU

1 0

RE: The Confession Of Aimee Farr
by Aimee Farr 27 Sep '01

27 Sep '01

> On Wed, Sep 26, 2001 at 06:18:49PM -0500, Aimee Farr wrote: > > > > Since most of you wouldn't know an FBI Special Agent if one > bit you in the > > ass, I suggest you stop worrying about them. > > > > ~Aimee > > Sage advice. You won't mind if I tell you to Fuck Off and Die, will you? Sorry for FINALLY getting a little testy in regard to the Aimee-agent theory. I didn't mean to give offense, sincerely. (I had just received a rather concerning message offlist.) My comments would have been more appropriately directed to that person, but they did not leave a reply-address. ~Aimee

1 0

RE: I SPY With My Micro$not Eye...
by Andrew Jenks 27 Sep '01

27 Sep '01

Turn it off in Tools->Options->E-mail Preferences->Tracking. The capability to request receipts has been in the software for several years. Some large percentage of users consider it a feature; you can turn it off completely if you're not one of them. -----Original Message----- From: CJ Parker [mailto:sog@w-link.net] Sent: Thursday, September 27, 2001 1:22 PM To: Cypher Toad Punks Subject: I SPY With My Micro$not Eye... Micro$not, hoping that QuadRuple/NoScruple Felons who have been Convicted of sending !!!DEATH THREATS!!! to ABillionaire2BeNamedLater might be diverted from their past fixations by being provided with *Fresh Victims*, have included Spying&OR&Stalking Features in their OutLook eMail SnoopWare. ForNoApparentReason, I seem to be getting Return Receipts from my eMail messages, INFORMing me who is reading the messages I send, who is deleting them, and RoadMaps to their Homes and WorkPlaces... (OK, I just made the last part up, eh?) Thus I am INFORMed, From: dgrays(a)co.dekalb.ga.us Your message To: Cypher Toad Punks Cc: Cipher SmartAss Punks Subject: Muslims and Christians Stand United Sent: Wed, 26 Sep 2001 07:01:01 -0400 was read on Wed, 26 Sep 2001 08:47:37 -0400 and now know who I can contact for help and support the next time that I am forced into hiding for engaging in criminal activity. I have also been INFORMed, From: <Matthijs.vanderWel(a)pac.nl> From: "Roxworth Cornette" <rcornette(a)freebalance.com> Your message To: Cypher Toad Punks Cc: Cipher SmartAss Punks Subject: Muslims and Christians Stand United Sent: Wed, 26 Sep 2001 13:01:01 +0200 was deleted without being read on Wed, 26 Sep 2001 16:11:36 +0200 so that if Osma bin Laden inquires as to whether or not I know of any individuals who are not showing proper concern for the issues that are important to him, I now have some names to provide to him. I was also INFORMed, This is a Return Receipt for the mail that you sent to bwphilli(a)cisco.com. piolenc(a)mozcom.com. Note: this Return Receipt only acknowledges that the message was displayed on the recipient's machine. There is no guarantee that the content has been read or understood. so that if they ever GetInMyFace, I can reply, "Hey! You're so FuckingSTUPID that your own computer doubts whether you can even read, or understand diddly, even if you can read..." And an AutoResponse Return Receipt INFORMs me,

1 0

I SPY With My Micro$not Eye...
by CJ Parker 27 Sep '01

27 Sep '01

Micro$not, hoping that QuadRuple/NoScruple Felons who have been Convicted of sending !!!DEATH THREATS!!! to ABillionaire2BeNamedLater might be diverted from their past fixations by being provided with *Fresh Victims*, have included Spying&OR&Stalking Features in their OutLook eMail SnoopWare. ForNoApparentReason, I seem to be getting Return Receipts from my eMail messages, INFORMing me who is reading the messages I send, who is deleting them, and RoadMaps to their Homes and WorkPlaces... (OK, I just made the last part up, eh?) Thus I am INFORMed, From: dgrays(a)co.dekalb.ga.us Your message To: Cypher Toad Punks Cc: Cipher SmartAss Punks Subject: Muslims and Christians Stand United Sent: Wed, 26 Sep 2001 07:01:01 -0400 was read on Wed, 26 Sep 2001 08:47:37 -0400 and now know who I can contact for help and support the next time that I am forced into hiding for engaging in criminal activity. I have also been INFORMed, From: <Matthijs.vanderWel(a)pac.nl> From: "Roxworth Cornette" <rcornette(a)freebalance.com> Your message To: Cypher Toad Punks Cc: Cipher SmartAss Punks Subject: Muslims and Christians Stand United Sent: Wed, 26 Sep 2001 13:01:01 +0200 was deleted without being read on Wed, 26 Sep 2001 16:11:36 +0200 so that if Osma bin Laden inquires as to whether or not I know of any individuals who are not showing proper concern for the issues that are important to him, I now have some names to provide to him. I was also INFORMed, This is a Return Receipt for the mail that you sent to bwphilli(a)cisco.com. piolenc(a)mozcom.com. Note: this Return Receipt only acknowledges that the message was displayed on the recipient's machine. There is no guarantee that the content has been read or understood. so that if they ever GetInMyFace, I can reply, "Hey! You're so FuckingSTUPID that your own computer doubts whether you can even read, or understand diddly, even if you can read..." And an AutoResponse Return Receipt INFORMs me, From: "Burkhouse, Martin T" <Martin.T.Burkhouse(a)usdoj.gov> To: "CJ Parker" <sog(a)w-link.net> Subject: Out of Office AutoReply: Muslims and Christians Stand United Date: Wednesday, September 26, 2001 4:05 AM Will return on 10/11. Check with Kevin Deeley if you need an immediate response so that if I suddenly get the Irresistable Urge to [Imaging *Your* WorstNighMare Here], I know that I will either have to wait for Martin's return date, or [I*Y*WNH] Kevin... OfCourseOfCourse [TM], this SpyStalk Feature of Micro$not'S eMail product will provide PerseProseCuting Attorneys with ValuableEvidence in Court Cases where RealEvidence is lacking, but this is of little import in light of the fact that CyberStalking Laws will no doubt soon be in place that make sending or receiving email a Federal Crime. (Don't worry, I'm sure they'll only prosecute the *BAD* guys, eh?)

1 0