December 2002 - cypherpunks-legacy

I Crypto U and your files
by lcs Mixmaster Remailer 26 Dec '02

26 Dec '02

Blah blah blah wrote... (Begin quote) "The down side is the concern that they will be doing something unusual. Since there is no mass use of PGP, crypto users do stand out - all 23,000 of us regular users worldwide are well mapped, charted and identified. I don't have a good answer for this. What novice users really want is ANONYMOUS use of crypto, so that they don't raise flags. Then I have to explain about anonymous remailers, whose reliability is nowhere near regular smtp e-mail. The only remaining option is use of public-access internet terminals." (End quote) A point I was harping on a few weeks ago (but that seems to have been largely overlooked), is that if the amount of traffic that is encrypted rises exponentially, then those red flags will mean very little (I remember Homer Simpson designing a car and saying: "You know those little balls you put on your antenna to find your car in the mall parking lot? Every car should have one!"). One leverage point for possibly encouraging this to happen is in P2P, methinks. A few power-users have been prosecuted recently, so imagine a nice little crypto-tunnel (and mp3 disc-encryptor) app that could easily be injected into the Kazaa or other Gnutella-centric browsers. The nice thing here is that if we could get a functioning app, the app itself could be shared and spread variola-like via the P2P networks themselves. There's the technical difficulty that someone pointed out here that the IP address of both serv-ants is visible. One possible go-around is to have an encrypted tunnel materialize through blacknet, but I strongly doubt this will scale to millions of users very well. Another possibility includes allowing the user to make only a portion of their content visible to any single user (plus crypto of course), the logic being that 'they' won't come after the millions of regular file sharers. Any thoughts? If we could develop such an app and roll it over into the file-sharing networks, then the amount of encrypted files being moved around could increase tremendously. ANd then, us law-abiding, flag-saluting supporters of even this governments' insistence on world destabilisation will feel safer in using crypto on a daily basis, because crypto will no longer be the sole provence of cranks, kooks, and libertarians. -TD

1 0

Obituary - Gary Howland - 197? - 2002
by R. A. Hettinga 24 Dec '02

24 Dec '02

--- begin forwarded text

1 0

Re: Using Brin to thwart ISP subpoenas
by Steve Schear 22 Dec '02

22 Dec '02

At 10:16 PM 12/22/2002 -0500, you wrote: >On Sunday, Dec 22, 2002, at 21:28 US/Eastern, Steve Schear wrote: > >>At 09:59 AM 12/20/2002 -0500, you wrote: >>>Date: Fri, 20 Dec 2002 09:10:18 -0500 >>>Subject: Re: Using Brin to thwart ISP subpoenas >>>From: Charles Evans <cwe(a)chyden.net> >>>To: "R. A. Hettinga" <rah(a)shipwright.com> >>> >>>How long do you think it would be before the ISP described below would >>>receive a cease and desist letter, ordering it to remove the cameras, >>>in order to protect customer privacy? >> >>I guess it would depend on the ISP's posted privacy policy. There are no >>regulations, AFAIK, that set some minimum standard for customer privacy. > >The customer privacy part would be an excuse. Your legal-irony hack is >too clever to stand unchallenged. It would be interesting. In a way it would be a test of Brin. One way might be to have property management companies build total surveillance into their leases. Could a court prevent a company from becoming transparent to its customers. >>If the ISP accepted only DMT or e-gold payments, which are anonymous, it >>would not be likely to reveal much about a customer's privacy during the >>course of normal office conversations except perhaps their email address. > >How do you mean anonymous? Do you mean untraceable? Well I'd never say untraceable, however, DMT does not require any meat space customer information. See https://196.40.46.24/ If you can't join 'em, beat 'em. -- W's global policy of hegenomy

1 0

Re: Bruce Schneier Hullabaloo
by Neil Johnson 21 Dec '02

21 Dec '02

On Saturday 21 December 2002 08:45 am, Anonymous wrote: > > The high ranking for power concentration you implicity give to > transnationals is undeserved and you are fearful of the wrong > threat. The humblest meter maid can commence a process against > you with consequences far greater than those that can be > directed your way by the CEO of the most loathsome transnational > company. That meter maid can write you a ticket. If unpaid, you > will be fined. If unpaid again, your property will be seized. If > you resist having your property seized, you will be beaten. If > you resist being beaten, you will be shot until dead. > > Your most dreaded CEO can only dream for the power of a meter > maid. > Uhhhh, how about. 1. Big multi-national corporation buys off politicians to pass laws to protect their business model (DMCA anyone ?) 2. Gets meter maid to enforce said law. 3. See above. Ahhh, I see. Let's just get rid of the middle-man (government) and then the corps can take take of enforcement directly (pirate a song, get whacked). Much more efficient I would guess. -- Neil Johnson PGP key available on request.

1 0

Policing Bioterror Research
by Eugen Leitl 21 Dec '02

21 Dec '02

http://sciencenow.sciencemag.org/cgi/content/full/2002/1217/1 Policing Bioterror Research One of science's hottest fields is now becoming one of its most heavily regulated, too. The U.S. government last week unveiled sweeping new bioterror research regulations that will require 20,000 scientists at nearly 1000 laboratories to beef up security--or face hefty fines and jail sentences. The interim rules, due to go into effect early next year, could also force scientists to get prior approval for a growing list of sensitive experiments. Select experts. CDC's Larry Sparks (right) and other government officials answer questions about the new rules. CREDIT: D. MALAKOFF/SCIENCE The 13 December announcements in the Federal Register, which ran nearly 50 pages, are a response to the 2001 anthrax letter attacks. Alarmed by reports of weak security in labs that study deadly viruses, bacteria, and other potential bioweapons, Congress this summer passed a bioterror bill that called for stricter controls on dozens of "select agents" that could imperil people, farm animals, and crops (Science, 31 May, p. 1585). The new rules, issued by the Centers for Disease Control and Prevention (CDC) in Atlanta, in conjunction with the U.S. Department of Agriculture (USDA), mete out responsibilities among universities, private companies, and government laboratories. All must agree to unannounced inspections. Labs that handle any of nearly 100 select agents must register with the government, submit detailed physical security and training plans, and provide the names--and probably fingerprints--of all workers for background checks. Moreover, prior approval from the Department of Health and Human Services will be needed for experiments that might make a select agent more toxic or more resistant to known drugs, as well as similar studies that could be added to a restricted list. Some researchers think the list is a good idea. Biochemist Richard Ebright of Rutgers University in Piscataway, New Jersey, says it should include experiments that could lead to better methods for making or spreading bioweapons. "It's common sense that such work get stricter scrutiny," he says. But Ron Atlas, a bioterrorism expert at the University of Louisville in Kentucky and president of the American Society for Microbiology, says he's "not sure the government should start proscribing experiments . and locking rules into regulations" which can be difficult to adjust, he says. He'd rather have the government issue less legalistic guidelines, which better evolve with the times. --DAVID MALAKOFF Related sites CDC and USDA rules http://www.asm.org/ CDC select agent FAQ http://www.cdc.gov/od/sap/docs/faq.pdf FAQ for New Select Agent Regulation (42 CFR 73) General Questions Concerning Select Biological and Toxins 1. What is the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 and how do I find a copy? On June 12, 2002, President Bush signed the .Public Health Security and Bioterrorism Preparedness Response Act of 2002. (Public Law 107-188). The law is designed to improve the ability of the United States to prevent, prepare for, and respond to bioterrorism and other public health emergencies. Section 202(a) of the Law requires that all persons possessing biological agents or toxins deemed a threat to public health to notify the Secretary, Department of Health and Human Services (HHS). Section 213(b) of Law requires all persons possessing biological agents or toxins deemed a threat to animal or plant health and to animal or plant products notify the Secretary, United States Department of Agriculture (USDA). The Law also requires that both Secretaries be notified when a person possesses agents that appear on both the HHS and the USDA list of agents and toxins. These agents and toxins have been designated HHS/USDA overlap agents. The Centers for Disease Control and Prevention (CDC) has been designated as the HHS agency responsible for providing guidance on this notification. The Animal and Plant Health Inspection Service (APHIS) has been designated as the USDA agency responsible for providing guidance on this notification. For more information on the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Public Law 107-188) see: http://www.cdc.gov/od/sap/bioterro.htm Subsequent to the enactment of Public Law 107-188, requirements for facilities or entities that possess, use, or transfer select agents and toxins have been published by HHS (42 CFR 73; December 13, 2002) and by USDA (9 CFR 121 and 7 CFR 331; December 13, 2002). 2. What is the USA PATRIOT Act and how does it relate to the new select agent regulation? Where can I find a copy? The USA PATRIOT Act is a law signed by President Bush on October 26, 2001, that places restrictions on persons who possess select agents and provides criminal penalties for possession of such agents that cannot be justified for specified peaceful purposes. More information on the PATRIOT Act can be found at: http://www.cdc.gov/od/sap/patriot.htm 3. What is a select agent or toxin (.select agent.)? What is a High Consequence Pathogen and Toxin? How do they differ? The original list of select agents was published in Appendix A of 42 CFR Part 72.6 (.Additional Requirements for Facilities Transferring or Receiving Select Agents,. October 24, 1996). The list included approximately 40 viruses, bacteria, rickettsiae, fungi, and toxins that CDC considers New Select Agent Regulation FAQ Page 1 of 13 to have potential to pose substantial harm to human health. The list of select agents in 42 CFR 72.6 is available at: http://www.cdc.gov/od/sap/42cfr72.htm. Under that regulation, laboratories were to register with CDC prior to transfer of select agents. The regulation and additional information may be found at: http://www.cdc.gov/od/sap/42cfr72.htm. A listing of HHS select agents and toxins in the new select agent regulation (42 CFR 73) is available at http://www.cdc.gov/od/sap. High Consequence Livestock Pathogens and Toxins are agents that the USDA considers to have the potential to pose a severe threat to animal or plant health, or to animal or plant products. A list of the agents may be found at: http://www.aphis.usda.gov/vs/ncie/bta.html. Agents that appear on both the HHS and USDA list of agents and toxins are referred to as .Overlap Agents.. The list of overlap agents is available at: http://www.cdc.gov/od/sap or http://www.aphis.usda.gov/vs/ncie. The plant pathogens listed by USDA have been deemed a threat to plant health or products. The list of plant agents and toxins is available at http://www.aphis.usda.gov/ppq/permits. 4. Why do I need to register with HHS and USDA for select agents that I may possess or use? Agents identified under the HHS and USDA lists of biological select agents and toxins or USDA.s list of High Consequence Livestock Pathogens and Toxins have been deemed a potential threat to human, animal, or plant health or animal or plant products. The registration of facilities possessing and using these agents or toxins is part of the government.s efforts to improve the ability of the United States to prevent, prepare for, and respond to bioterrorism and other public health emergencies and is required under the Public Health Security and Bioterrorism Preparedness and Response Act of 2002. Reporting Possession of Select Agents 1. What is the difference between notification and registration? Under the new Public Health Security and Bioterrorism Preparedness Act, all facilities that possessed an HHS select agent or toxin, or a USDA .High Consequence Livestock Pathogens and Toxins. were required to notify HHS by September 10, 2002 and/or USDA by October 11, 2002. This was a one-time notification process. The specific requirements for reporting were published in a Federal Register Notice on July 12, 2002. The notification period has passed. The current HHS Select Agent Program requires facilities to register with CDC if they transferred or received a select agent listed in Appendix A of Title 42 CFR Part 72. The current registration process also requires submission of an application that certifies that the facility is in compliance with specific safety and security standards set forth in the regulation. More information is available at http://www.cdc.gov/od/sap. New Select Agent Regulation FAQ Page 2 of 13 The Public Health Security and Bioterrorism Preparedness and Response Act of 2002, required both HHS and USDA to publish an interim final rule in the Federal Register that will describe the new regulations and registration processes for both agencies. 2. Can I still notify HHS and USDA that I possess select agents? If you have questions or concerns regarding this activity, please call 404-498-2250. General Questions Regarding the New Select Agent Regulation (42 CFR 73) 1. Where can I find a copy of the interim final rule? The regulation published by HHS concerning HHS and HHS/USDA overlap select agents and toxins (42 CFR 73, December 13, 2002) is available at: http://www.cdc.gov/od/sap. The regulations published by CDC/APHIS for HHS/USDA overlap and USDA high consequence livestock and pathogens and for listed plant agents (9 CFR 121 and 7 CFR 331, December 13, 2002) are available at: http://www.aphis.usda.gov. 2. Where do I submit comments on the Interim Final Rule (42 CFR 73)? Written comments pertaining to the Interim Final Rule should be sent to: Minh Thomas, Centers for Disease Control and Prevention, Select Agent Program, 1600 Clifton Road, MS E-79, Atlanta, Georgia 30333 within 60 days of the publication of the Federal Register notice. The last date for comments is February 7, 2003. 3. How was the select agent list determined? CDC prepared the select agent list for 42 CFR 73 after receiving extensive input from scientists representing 21 Federal government entities. The proposed list was published in the Federal Register for public comment on August 23, 2002. The HHS Secretary considered the following criteria for establishing the list as directed in 42 U.S.C. 262a (a)(1)(B): . The effect on human health of exposure to the agent or toxin; . The degree of contagiousness of the agent or toxin and the methods by which the agent or toxin is transferred to humans; . The availability and effectiveness of pharmacotherapies and immunizations to treat and prevent any illness resulting from infection by the agent or toxin. 4. What is an entity? An entity is any government agency (Federal, State, or local), academic institution, corporation, company, partnership, society, association, firm, sole proprietorship, or other legal entity. 5. Who is affected by the new select agent regulation? New Select Agent Regulation FAQ Page 3 of 13 The new select agent regulation (42 CFR 73) requires that entities possessing biological agents that are listed as select agents must register with CDC and/or APHIS and demonstrate compliance with specific safety and security standards for handling these agents. Any entity that possesses the select agents and toxins listed in 42 CFR 73, unless specifically exempted, are affected by the regulation. The exclusions and exemptions are discussed in questions 6 , 7 and 8 below. 6. What changes will affect CLIA labs? Does 42 CFR 73.6(a)(1) automatically include and replace the previous CLIA exemption? Any diagnostic or CLIA lab that does diagnostic testing, verification or proficiency testing is exempt from the regulation. The laboratory director must notify HHS immediately upon identifying specific select agents; the entity must transfer the agents to a registered facility or destroy them (unless directed otherwise by law enforcement or HHS) within 7 calendar days of identification of the select agent. See number 7 and 8, below. NOTE: Retention of any select agent as a positive control or reference sample is no longer exempt for any reason. 7. Who is exempt from the new select agent regulation? An entity may be exempt from the provisions of the regulation, if: . The only activities that an entity conducts concerning select agents are processing diagnostic, verification or proficiency specimens or isolates (see ' 73.6 for details on additional requirements for these laboratories. Also see number 8, below). . The entity has select agents or toxins that are cleared, approved, licensed, or registered under any of the laws specified in the regulation, and are used only for the approved purpose of such laws. . The entity applies to CDC and/or APHIS as appropriate for an exemption for select agents or toxins that are an investigational product authorized under a Federal Act listed in the regulation. . An exemption is granted by CDC and/or APHIS due to a public health or agricultural emergency. 8. Our entity has been exempt since we are a diagnostic/clinical laboratory. What are we required to do under 42 CFR 73? . Even if exempt, the entity must immediately report to CDC (telephone: 404-498-2255, facsimile: 404-498-2265, or to lrsat(a)cdc.gov ) the identification of the following select agents: Variola major virus (Smallpox virus) and Variola minor (Alastrim), Bacillus anthracis, Yersinia pestis, Botulinum neurotoxins, Francisella tularensis, Ebola viruses, Marburg virus, Lassa fever virus, and South American Haemorrhagic Fever viruses (Junin, Machupo, Sabia, Flexal, Guanarito). . The entity reports as required under Federal, State, or local law, to appropriate authorities. New Select Agent Regulation FAQ Page 4 of 13 . After diagnosis, verification or proficiency testing, the entity either transfers the specimens or isolates to a registered facility or destroys them on-site by an appropriate method. . Select agents used for diagnosis, verification or proficiency testing are transferred or destroyed within 7 days after identification, unless directed otherwise by the FBI or other law enforcement agency after consultation with the HHS Secretary. . Select agents used for proficiency testing are transferred or destroyed within 90 days after receipt. . The entity makes a written record of the identification and transfer or destruction on CDC Form 0.1318, submits the form to the HHS Secretary (within 7 days after identification or 90 days after receipt for proficiency testing). . The entity maintains a copy of the record for a period of three years. 9. Under what conditions is an entity excluded from the new select agent regulation (42 CFR 73)? The following are excluded from the regulation: . Select agents or toxins that are in their naturally occurring environment, provided that it has not been intentionally introduced, cultivated, collected, or otherwise extracted from its natural source. . Non-viable select agent organisms or nonfunctional toxins. . The vaccine strain of Junin virus (Candid #1). . It is possible under the new rule to apply for exclusion for any attenuated agent or toxin using an appropriate form obtainable from CDC. Exclusions for specific strains may be granted if the attenuated strain is determined not to pose a significant public health or safety threat. Exclusions will be published in the notice section of the Federal Register and will be listed on the CDC website at http://www.cdc.gov/od/sap. . Exclusions for entities with specific quantities of toxins under the control of a principal investigator at a given time are also detailed in the regulation (see number 10, below). 10. What specific changes in the list of agents take effect in the new regulation when compared to the agents and toxins listed in 42 CFR 72.6? (For USDA only agents see: http://www.aphis.usda.gov/vs/ncie.) . Two agents (viruses causing Hantavirus pulmonary syndrome and yellow fever virus) have been removed from the list. One toxin (aflatoxin) was removed from the list previously published in 42 CFR 72.6. . Several agents have been added to the list of HHS agents, including Cercopithecine herpes virus 1 (Herpes B virus), Monkeypox virus, Coccidioides posadasii, and Shigalike ribosome inactivating proteins. . Nomenclature changes are as follows: Equine Morbillivirus Virus has been renamed to Nipah and Hendra Complex viruses; Clostridium botulinum was updated to include botulinum neurotoxin producing species New Select Agent Regulation FAQ Page 5 of 13 of Clostridium. Tick borne encephalitis complex (flavi) viruses are now specified by individual name (Central European Tick-Borne encephalitis (CTBE); Far Eastern Tickborne encephalitis (including Russian Spring and Summer encephalitis (RSSE), Kyasanur Forest disease, and Omsk hemorrhagic fever). The listing of Variola minor virus (Alastrim) is added to Variola major (smallpox) virus. Toxins are regulated based on potency and quantity (as opposed to potency only or LD50 values as in 42 CFR 72.6). Entities that do not at any time have more than the following aggregate amounts (in the purified form or in combinations of pure and impure forms) under the control of a principal investigator are excluded from requirements of the regulation: Abrin 100 mg Botulinum neurotoxin 0.5 mg Clostridium perfringens epsilon toxin 100 mg Conotoxins 100 mg Diacetoxyscirpenol 1000 mg Ricin 100 mg Saxitoxin 100 mg Shiga-like ribosome inactivating proteins 100 mg Shigatoxin 100 mg Staphylococcal enterotoxin 5 mg Tetrodotoxin 100 mg T-2 1,000 mg 11. Who must register? Any entity that possesses, uses, or will receive or transfer any select agent or toxin to or from entities within the US or outside the US are subject to 42 CFR 73. 12. Where can I obtain an application? In the near future (after February 1, 2003), an application will be available from the Select Agent Program website at www.cdc.gov/od/sap or by directly contacting our office via phone at 404- 498-2255 or facsimile 404-498-2265. 13. What are the duties of the Responsible Official (RO)? The RO is responsible for ensuring compliance with the regulations including: . Developing and implementing safety, security and emergency response plans; . Allowing only approved individuals to have access to select agents or toxins. . Providing appropriate training for safety, security, and emergency response. . Transferring select agents or toxins. . Providing timely notice of any theft, loss or release of a select agent or toxin. . Maintaining detailed records of information necessary to give a complete accounting of all activities related to select agents or toxins. New Select Agent Regulation FAQ Page 6 of 13 . Reporting the identification of a select agent or toxin as a result of diagnosis, verification or proficiency testing. CDC recommends that the RO and alternate RO are biosafety officers or senior management officials of the entity/facility, or both. Although we understand that some entities have limited staff, we recommend that the RO not be an individual actually using, working with, or transferring or receiving the select agents and toxins to minimize potential conflicts of interest. 14. What is the responsibility of the alternate RO? The alternate RO must meet all the qualifications for the RO and must be able to conduct all the activities of the RO (listed above) in the absence of the RO. 15. What agency should the application be submitted to? The agency that the Responsible Official (RO) should contact is determined by the type of select biological agent or toxin that is possessed. . For HHS agents, the RO should contact CDC (telephone: 404-498-2255; facsimile 404- 498-2265). . For USDA agents (animal agents and toxins), the RO should contact APHIS (telephone: 301-734-3277; facsimile: 301-734-3652). . For HHS/USDA overlap agents, the RO may contact either APHIS or the CDC. . For plant agents and toxins the RO should contact APHIS (telephone: 301-734-5519; facsimile: 301-734-8700). . A listing of HHS select biological agents and toxins is available at http://www.cdc.gov/od/sap. . A listing of USDA animal agents and toxins is available at http://www.aphis.usda.gov/vs/ncie/bta.html. . The list of plant agents and toxins is available at http://www.aphis.usda.gov/ppq/permits. 16. Will one or both agencies approve applications that include overlap select agents? Regardless of which agency receives the application regarding an overlap select agent or toxin, both agencies will provide input before a determination is made to grant or deny a certificate of registration. 17. What does the registration cover? The registration will only be valid for the specific select agents and toxins and the specific activities and locations consistent with the information which the certificate of registration or amendment is granted. 18. What if we need to update, change, or amend our registration? If any change occurs in the information submitted, the Responsible Official (RO) of the entity must obtain prior approval by promptly notifying the CDC in writing in accordance with 42 CFR New Select Agent Regulation FAQ Page 7 of 13 73.21. This includes modifications to the list of individuals that have been approved under 42 CFR 73.8 to work/access select agents, changes in work locations, and changes in protocols or objectives of the studies. The entity must submit the information requested in the relevant portion of the application package to the agency that issued the certificate of registration. 19. Under what conditions could a registration be terminated? The HHS Secretary will terminate a certificate of registration based on a determination that the entity no longer conducts activities covered by the certificate. It may also be terminated based on the security risk assessment from Department of Justice, or if the entity fails to meet or maintain safety or security requirements as specified in 42 CFR 73. The HHS Secretary may take such action immediately if necessary to protect the public health or safety. Upon such termination the select agent or toxin possessed by the entity must be destroyed or transferred as directed by the HHS Secretary. 20. Who has to have a security risk assessment? All entities (except for Federal, State, or local governmental agencies), the RO, alternate RO, and all individuals working with or having access to select agents or toxins must have an approved security risk assessment. An entity may not provide an individual access to a select agent or toxin unless the individual has been approved by the HHS Secretary or USDA Secretary based on this security risk assessment. 21. How does an entity obtain a security risk assessment? Information will be posted on our website when it becomes available. 22. What criteria are used for determining approval of a security risk assessment? The security risk assessment will evaluate if an individual is a restricted person based on the criteria of the PATRIOT Act http://www.cdc.gov/od/sap/patriot.htm , has committed a Federal crime, is involved with any group that engages in domestic or international terrorism or any organization that engages in intentional acts of violence, or is an agent of a foreign power. 23. How long is the security risk assessment valid? It is valid for a period of three years unless terminated by the HHS Secretary sooner. 24. What are the safety requirements of the new regulation? Each entity must implement a safety plan. This safety plan should consider: . The requirements of the Biosafety in Microbiological and Biomedical Laboratories (BMBL), including all appendices except Appendix F. . The requirements for handling toxins found in the 29 CFR 1910.1450 and / or 29 CFR 1910.1200, and Appendix I of the BMBL. New Select Agent Regulation FAQ Page 8 of 13 . NIH Guidelines for Research Involving Recombinant DNA (NIH Guidelines) for work with genetic elements, recombinant nucleic acids, and recombinant organisms. 25. What are the responsibilities of the RO with respect to the safety requirement? The RO must conduct regular inspections, at least annually, of the laboratory where select agents or toxins are stored or used to ensure compliance with all procedures and protocols of the safety plan. The results of these inspections must be documented and any deficiencies must be corrected. 26. What other safety requirements are included in the new regulation? An entity may not conduct the following types of experiments unless approved by the HHS Secretary: . Utilizing recombinant DNA to deliberately transfer drug resistance traits to select agents that are not known to acquire the trait naturally, if such acquisition could compromise the use of drug to control disease agents in humans, veterinary medicine, or agriculture. . Work involving the deliberate formation of recombinant DNA containing genes for the synthesis of select agent toxins lethal for vertebrates at an LD 50 < 100 ng/kg body weight. 27. What are the requirements of the security plan? The specific components to include in the security plan as required by 42 CFR 73 are located in the regulation at ' 73.11 http://www.cdc.gov/od/sap/docs/73_11.pdf. 28. What records are entities required to keep and for what duration? Records that should be kept include: the list of approved individuals that may access select agents, inventories, access to agents and toxins, areas where agents are used, and transfer and destruction documents. These should be maintained for a period of three years, as described in 42 CFR 73.15. 29. When and how will inspections take place? Inspectors from the CDC Select Agent Program will conduct inspections of registered entities. Such inspections may be conducted without prior notification and will include a review of all safety and security aspects, as well as record keeping requirements, covered by 42 CFR Part 73. 30. Are there criminal or civil penalties for not being in compliance with the new regulation? If yes, what are they? Violation of the Public Health Security and Bioterrorism Preparedness Response Act of 2002 can result in substantial fines or imprisonment of up to 5 years, or both. In addition, violation of the Law can result in a civil money penalty of up to $250,000 for individuals and $500,000 for an entity. New Select Agent Regulation FAQ Page 9 of 13 Questions Regarding the New Select Agent Regulation (42 CFR 73) for Facilities Currently Registered under 42 CFR 72.6 1. I was just registered for a period of three years, is anything further required of our institution as a result of the new regulation? Yes. Your RFO/ RO will be receiving a letter describing the requirements of 42 CFR 73, including the necessity to file a new application form. Please note that there are phase-in timeline dates that you are required to meet (see below, number 2). 2. My registration certificate states that we are registered until 2005, and yet the regulation says it is superceded by 42 CFR 73. Does that negate my current registration certificate? The new rule will supercede the previous registration rule according to the phase-in timeline specified in the regulation and you must follow the provisions of the new rule to remain registered to work with select agents and toxins. The requirements of the first phase-in date become effective on February 7, 2003. To remain registered, the entity must complete an application under 42 CFR 73 for the effective items set forth for the February phase-in date, and meet filing requirements at each of the subsequent phase-in date. Between February 7, 2003 and March 12, 2003, the new application compliance requirements include the designation of a Responsible Official; development of a safety plan and laboratory compliance with the requirements of the BMBL, 29 CFR 1910.1450, and/or NIH Guidelines for recombinant DNA; an emergency response plan; a security risk assessment; a record management system; acknowledgment of inspection requirement; a theft, loss, or release notification procedure; and acknowledgement of administrative review of adverse actions, civil and criminal penalties for violations, and application submission requirements. 3. How can I ensure continuity of our registration for Select Agents? File the new application as it becomes available, and provide documentation to the appropriate agency that your entity meets the requirements of the parts of the rule that become effective by each phase-in date. 4. Our facility has been inactive with respect to select agents, and is ready to register at this point. We are hopeful to begin work sooner than the new regulation takes full effect, how do we proceed, and when can we expect to proceed with work? File the new application as it becomes available, and meet the requirements of the parts of the rule which become effective by each phase-in date. By meeting the requirements for compliance at each phase-in date of 42 CFR 73, you will receive authorization to work with the agents. New Select Agent Regulation FAQ Page 10 of 13 5. Our institution now has occasion to register additional agents and laboratories, is this still a simple amendment? If you request an amendment to your registration under 42 CFR 72.6, the amendment will only be effective until the applicable phase-in date of 42 CFR 73. Please note that you will be required to submit an application for all work performed at your institution, including the amendment to meet the requirements of 42 CFR 73 on or around March 12, 2003. 6. How do I determine whether to submit my registration to CDC or USDA for the overlap select agents? You may submit your new registration package to either agency. A joint reporting system has been developed between CDC and APHIS to approve your application for use of HHS/USDA overlap agents. 7. If I have a CDC select agent and a USDA select agent in the same lab with the same Principal Investigator (PI), do I have to register the same lab with both agencies for each select agent? Yes. Even if you are registering the same laboratory and PI with the two agencies, you must submit a separate package to each agency for the agent under their control. 8. Our registration is about to expire. Are there changes in the process since our previous registration? There are new requirements and a new application. 42 CFR 72.6 is being superceded by 42 CFR 73 on November 12, 2003, with phase-in requirements from February 2003 through November 2003. Please use the new application when it becomes available (information to be posted on our website) to renew your registration under 42 CFR 73. 9. Will you utilize documentation on file which I have sent in for my current registration? Some documentation on file from your current registration will be used for activities such as transfers under 42 CFR 72.6 until March 12, 2003. After the date the 73.14 Transfer Section becomes effective, a new version of the transfer form will be used. To accomplish transfers, the 42 CFR 73 application must be on file and approved between February 7, 2003 and March 12, 2003. New documentation must be submitted because HHS and USDA are required to evaluate and concur on registrations for HHS/USDA overlap agents. 10. It may take some time to have the personnel in our laboratories approved for the security risk assessment by DOJ. How will this affect my registration and the processing of our application? Your entity will receive an application number when your application has been approved under 42 CFR 73. The DOJ component of the rule becomes effective on June 12, 2003, and compliance New Select Agent Regulation FAQ Page 11 of 13 with each phase of the registration process will enable you to conduct business legally until a registration number is issued under 42 CFR 73, as it supercedes 42 CFR 72.6 in November 2003. 11. We have select agents on the exclusive HHS list as well as on the exclusive USDA list. How do we coordinate the registration? You must register with both agencies if you have agents on both lists. If you are also working with an overlap agent, then continue with your initial registering agency. The two agencies will be jointly reviewing that portion of the evaluation. 12. Currently we only store select agents and toxins, do we have to register personnel with access to the freezers with DOJ? Yes. You must submit application for a security risk assessment to DOJ for any individuals that require access, including the appointed RO and alternate RO. 13. I just received a letter with a response due date from the inspector assigned to my facility. Is there a process by which I can request to extend this response date? The regulation specifically provides for an 8 week period of processing of the application. This time is to allow you to provide information that is required, but was not furnished with your application. As noted on the application, information not provided can seriously delay processing of your application, and may result in delaying your registration. 14. We are a facility that is currently registered with CDC to transfer select agents, but due to funding constraints for the select agent project, we are considering eliminating the project and destroying the agent. What should we do? Until on or around March 12, 2003 when the new transfer section becomes effective under 42 CFR 73.14, an EA-101 must be submitted to CDC to report the destruction of the agents or toxins (as specified in 42 CFR 72.6; see http://www.cdc.gov/od/sap/docs/attach6.pdf) After March 12, 2002, CDC must be notified in writing at least 5 business days prior to destruction. Questions Regarding the New Select Agent Regulation (42 CFR 73) for Facilities Not Currently Registered under 42 CFR 72.6 and Not Currently Possessing Select Agents 1. I did not possess select agents or toxins prior to February 7, 2003. What timeline must I meet to register my entity? As of February 7, 2003, to register your entity, you must submit an application that certifies your compliance with the designation of a Responsible Official; development of a safety plan and laboratory compliance with the requirements of the BMBL, 29 CFR 1910.1450, and/or NIH Guidelines for recombinant DNA; an emergency response plan; security risk assessment; training requirements; select agent transfer requirements; record management system; New Select Agent Regulation FAQ Page 12 of 13 New Select Agent Regulation FAQ Page 13 of 13 acknowledgment of inspection requirement; theft, loss, or release notification procedure; and acknowledgement of administrative review of adverse actions, civil and criminal penalties for violations, and application submission requirements. As of September 12, 2003, you must submit an amendment to your application that certifies your compliance with the security requirements by developing a security plan. As of November 12, 2003, you must be in full compliance with all provisions of the new select agent rule. You must meet the requirements for compliance at each phase-in date of 42 CFR 73 in order to be authorized to work with the agent.

1 0

Re: CRYPTO-GRAM, December 15, 2002
by James A. Donald 21 Dec '02

21 Dec '02

-- On 20 Dec 2002 at 19:26, William Warren wrote: > voting keeps you free..voting is our way of controlling and > shaping the government. No matter who you vote for, a politician always gets elected. > Those who do not exercise this duty do not deserve to > complain about what goes on. By voting, you give the appearance of consent to what the government does to you. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG xmBBW56MrvFmh7U6fPSMDbyYqa+PTDPhTlRLmwmD 4cHSTvSFFo32sjmnBGPqe0vLtp3CfQhXyVLccQaXm

1 0

Re: Bruce Schneier hullabaloo
by Major Variola (ret) 20 Dec '02

20 Dec '02

At 01:43 PM 12/20/02 -0800, Mike Rosing wrote: > I >don't see Nero as that much different than W, other than W's >mom isn't gonna get offed like Nero's was. She's smarter than >her son is :-) Not necessarily. Nero's mom didn't have SS agents watching her and PaBush for life. -- "Intended only for lawful uses." -HP Computer Advert

1 0

[ANNOUNCE] OpenSSL 0.9.7 beta 6 released
by Richard Levitte - VMS Whacker 17 Dec '02

17 Dec '02

The sixth beta release of OpenSSL 0.9.7 is now available from the OpenSSL FTP site <URL: ftp://ftp.openssl.org/source/>. This beta contains just a few fixes since beta 5. This is assumed to be the final beta. The final release of OpenSSL 0.9.7 has been rescheduled for somewhere between Friday 2002-12-27 to Monday 2002-12-30, mostly because of all the holidays around that time. To make sure that it will work correctly, please test beta 6 thoroughly, for example with your favorite piece of software, and please report back to us! Also, please test on as many platforms as you have available and you have time for, especially on less common platforms. If you're interested in helping further, please join the openssl-dev(a)openssl.org list, where test requests on specific development snapshots will be announced. Changes between 0.9.7 beta 5 and 0.9.7 beta 6 include: o Solaris shared library fixes. o Support for new platforms: Linux 64-bit on Sparc v9 o Now only builds PIC code when shared library support is requested. o Makes symbolic links to or copies of manuals to cover all described functions. o Dynamic lock bugfixes. o Correct DES header protection macros for better backward compatibility. The full set of changes between 0.9.6{x} and 0.9.7 beta 5 include: o New library section OCSP. o Complete rewrite of ASN1 code. o CRL checking in verify code and openssl utility. o Extension copying in 'ca' utility. o Flexible display options in 'ca' utility. o Provisional support for international characters with UTF8. o Support for external crypto devices ('engine') is no longer a separate distribution. o New elliptic curve library section. o New AES (Rijndael) library section. o Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit, Linux x86_64, Linux 64-bit on Sparc v9 o Extended support for some platforms: VxWorks o Enhanced support for shared libraries. o Now only builds PIC code when shared library support is requested. o Support for pkg-config. o Lots of new manuals. o Makes symbolic links to or copies of manuals to cover all described functions. o Change DES API to clean up the namespace (some applications link also against libdes providing similar functions having the same name). Provide macros for backward compatibility (will be removed in the future). o Unify handling of cryptographic algorithms (software and engine) to be available via EVP routines for asymmetric and symmetric ciphers. o NCONF: new configuration handling routines. o Change API to use more 'const' modifiers to improve error checking and help optimizers. o Finally remove references to RSAref. o Reworked parts of the BIGNUM code. o Support for new engines: Broadcom ubsec, Accelerated Encryption Processing, IBM 4758. o A few new engines added in the demos area. o Extended and corrected OID (object identifier) table. o PRNG: query at more locations for a random device, automatic query for EGD style random sources at several locations. o SSL/TLS: allow optional cipher choice according to server's preference. o SSL/TLS: allow server to explicitly set new session ids. o SSL/TLS: support Kerberos cipher suites (RFC2712). Only supports MIT Kerberos for now. o SSL/TLS: allow more precise control of renegotiations and sessions. o SSL/TLS: add callback to retrieve SSL/TLS messages. o SSL/TLS: support AES cipher suites (RFC3268). The distribution file name is: o openssl-0.9.7-beta6.tar.gz MD5 checksum: 8877ea9643e4d6ac18476bc63015c450 The checksum was calculated using the following commands: openssl md5 < openssl-0.9.7-beta5.tar.gz --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: Extradition, Snatching, and the Danger of Traveling to Other Countries
by Landon Dyer 13 Dec '02

13 Dec '02

At 10:06 AM 12/13/2002 -0800, Major Variola (ret) wrote: >See Gilmore's proposal. Consider the meaning of >reverse-panopticon. Find federal employees >and let them know "we're watching you" but don't >identify "we". Publish public info. Do this >for executives in firms that pander to the Evil. >Not just e.g., Ellison ---there are more next-level-down >underlings who might just live in your neighborhood. > >Anyone got ideas for a "neighborhood watch" type >sticker which expresses the reverse-panopticon >visually? sure, I took a stab at this. i'm not much of an artist, but what the heck: http://fyyff.com/images/binocSmall.jpg http://fyyff.com/images/binocCounted.jpg (after a gary larson _far side_ cartoon that also used binoculars...) -landon [re-lurking]

1 0

Re: Extradition, Snatching, and the Danger of Traveling to Other Countries
by Steve Furlong 13 Dec '02

13 Dec '02

On Friday 13 December 2002 11:44, Trei, Peter wrote: > ... this sort > of thing could give the Libertarian Party legs, > if they handled it right. Hahahahahahaha -- Steve Furlong Computer Condottiere Have GNU, Will Travel You don't expect governments to obey the law because of some higher moral development. You expect them to obey the law because they know that if they don't, those who aren't shot will be hanged. --Michael Shirley

1 0