December 2003 - cypherpunks-legacy

Fire and Forget
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:26 PM 5/1/96, Black Unicorn wrote: >On Wed, 1 May 1996, Steven Weller wrote: > >> >Jim Ray wrote >> >> I haven't bothered reading this particular thread up until now, but in my >> opinion, based on this drivel, you're getting dangerously close to being >> certified officially by the Cabal as an ignorant kook. >> >> >Nor does freedom increase through less laws or no laws. >> >> Of course it does. However, to maintain community resposibility must also >> increase. > > >Watch your attributation, Jim Ray did not write this. What!!!! Now you tell me, after I spent all that money on a "fire and forget" contract! Well, Jim, all I can say is keep your head down. Sorry! (Seriously, I knew the "Jim Ray wrote" must've been a misattribution, as that is not the kind of stuff Jim writes.) (Oh, and the "fire and forget" contract assassins were well-described by William Gibson in, I believe, "Count Zero.") --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Burns bill?
by jim bell 17 Dec '03

17 Dec '03

It has been over a month since we first heard that Burns was going to introduce a bill to free up encryption software exports. It isn't here, yet, as you may have noticed. However, I don't think that's the real problem. The real problem is that we have seen essentially no information on it, and we (by we, I mean the entire Internet community) have not had an opportunity to study it and comment BEFORE it is introduced in Congress. See, the usual practice of introducing it in Congress first and only then letting the public see the bill is, by my way of thinking, an example of extreme rudeness on the part of the politicians. Bills are far easier to change before they've been officially filed, which I suppose is the point. We're not getting the opportunity to fix minor mistakes, or at least make Burns (or any other supporter) aware of them. This is a glaring "take it or leave it" philosophy, one that we should reject. Does he really intend to insult us? I see no reason to believe that Burns should be able to produce an adequate bill with the assistance of only industry lobbyists, but not the help of other citizens of varying degrees of expertise. Burns should immediately release the text of the bill developed up until now, and then wait at least a few weeks before introducing it formally, after changes are proposed, considered, and accepted. Jim Bell jimbell(a)pacifier.com Jim Bell jimbell(a)pacifier.com

1 0

Re: If the Net were an industrial city... (nee: Freedom and security)
by rick hoselton 17 Dec '03

17 Dec '03

At 08:11 PM 5/1/96 +0200, you wrote: > >> >It's now a major industrial city and will >> >> It's industry being? > >It's a service industry. An information service industry. >Journalists, phone-sex whores, business consultants, >bankers, brokers and barkers are moving into town, setting >up their virtual shops, and catering to the hordes of >readers, sightseers, sex-seekers, game-players, businessmen, >professionals and amateurs of all stripes that are pouring >into town in wave after wave. Its also a college town. And a publishing center. Then there's the warehouse district, and the post office. There's also a thriving import-export business. No wonder the political big-shots back in Atomland wish they could annex Cyberspace. I predict that these attempts will succeed about as well as the European colonization of the Americas. (ambiguity intended) >Granted most of these virtual shops consist of a single >ticket-taker's booth and a 10-meter tall neon facade. That's how boom-towns start, allright. >Granted that the shops occasionally collapse on visitors, Yes. >that there are no streets, We have streets all over the place. From here theres a 56Kb lane road that's even fairly well paved. But they mostly lead to "Atomland expatriot hobbyists" and a few service subsistance farms. >that you can't tell the sellers from the buyers It always starts with a barter economy. >... few people are able to accept cash. It will be a while, but someday folks will say: "Save your greenbacks, Atomland will rise again!" and they will be wrong. >Still, it's a service industry. Coming soon.... Virtual Food! Okay, maybe I got a little carried away....

1 0

CFA: a million geeks?
by Rich Burroughs 17 Dec '03

17 Dec '03

This is an interview I did with Keith Glass about the changes with the Electronic Freedom March. He mentions making crypto an issue there. Rich -----BEGIN PGP SIGNED MESSAGE----- [This is an article from the may96 issue of the web zine _cause for alarm_, http://www.teleport.com/~richieb/cause. It may be redistributed electronically with this header included.] I contacted Keith Glass about an interview shortly after finding out that he had taken over as head of the Electronic Freedom March. The March, an attempt to influence Washington with a critical mass of geeks, was originally scheduled for June. In his response to my email, Keith said that the March was being rescheduled for late September and that he would make a public announcement soon. His subsequent press release said that, "With the current state of the case against the CDA, ACLU vs. Reno, and several organizational factors, it's been concluded that it would be far more effective to focus the political power of the citizens of the Net closer to the November elections." Keith joined me at Club Wired, after a hard day at work. --- CFA: Thanks for coming, Keith :) Keith G: And thus ends another thrilling day, standing for Truth, Justice, and/or the American Way <g> CFA: Heh. Keith G: Hey, a day at the Pentagon is like... a day in hell, only the cooking is worse. CFA: What do you do there BTW? If it's not classified? ;) Keith G: Nope: I work Pollution Preventions and Standardization issues for the Secretary of the Air Force. I'm a contractor, better known as one of the legendary "Beltway Bandits", although **I** prefer the term "Parkway Patriot"...;-) CFA: :) So, let's talk about the March. The new date is Sept. 29, tentatively? Keith G: Tentatively. I'm checking with the Park Service and the Majority Leaders' office in the next few days, to insure we can get a place... CFA: Where will the speakers be at, if you know? I mean human speakers :) Keith G: That depends on where we can locate. Since I'm trying to combine it with some congressional lobbying, I'd LIKE it to be on the west stairs of the Capitol. But the Ellipse, which we had reserved for the original date, would put us in shouting distance of the White House... CFA: *nod* Keith G: Of course, this thing has grown beyond JUST the CDA. In my opinion, it'll be wastepaper by mid-June. . . but we have to fight for crypto rights, and the ill-informed types who foisted the CDA on us will be back next year. This isn't just one battle... this is the start of a whole new political front. CFA: You're going to involve crypto issues? Keith G: Free speech is free speech. If they ban crypto, then they'd better make damned sure that envelopes are banned, too. Encrypted or clear, free speech is an absolute. CFA: *nod* Keith G: We also need to let the Congress know a few things about the Net: according to a pal of mine at CDT, your average Net user makes over $40K, and votes SIGNIFICANTLY more than not-Net-users. We have money, we have votes... it's time to turn that into power. CFA: So, you're in charge of the whole shebang now? Keith G: Yep. John Wash, who started this, got way too bogged down in work, realized it, and handed it off to me last Monday, April 15th... CFA: For those who missed your announcement, why the new date? Keith G: Well, to be honest, when I looked at what we had set up, AND what the Park Service required of us (i.e. portatpotties, medics, security), I saw we needed a LOT more money and organization than was possible for a bunch of part-time activists to get in the time remaining. Secondly, the CDA trial is going FAR faster than anything we had expected: the verdict will be out by mid-June, and from all reports, the Feds have been unusually incompetent in their arguments. So, I thought we should move as close as we can to the election, to (1) maximize our power, politically, (2) get a MUCH better organization in place, and (3) get out of the summer DC sun. This place is AWFUL in the summer... ;) CFA: :) Keith G: We need to let the Congress know that the Net is NOT all porno fiends, militia types exchanging bomb recipes, and all the other net.myths that seem to abound on Capitol Hill. Also, I'd like to work towards a declaration by Congresscritters that Email will be taken just as seriously as snailmail. Right now, most of the time your Congressional Email gets answered by a Bot... and that's the end of it. My friends on the Hill tell me they read email when all else is done... CFA: What about folks who can't make it to DC? Are you encouraging local events? Keith G: Locally, we'd LIKE to get all the people who CAN'T make it, visit their local Congressman and Senators offices' on the Friday before, or Monday after. And lobby, in person... CFA: Right. Keith G: I've gotten word today of a possible parallel EFM in Seattle. If we can get simultaneous marches in several cities, that'd be great. CFA: What can people do to help? It sounds like there's a lot of work to be done. Keith G: What do we need?? I've got webmasters, organizers, publicity types: I need a financial type, and some fund-raisers. We also need sponsors. We have NONE. We've been given a lot of "Sure we'll support you," but when we ask for $$, all of a sudden it gets real quiet. CFA: *nod* Have you had any reports of folks raising funds on the local level? Keith G: Not as yet. We're attempting to formalize a relationship with an existing non-profit, to use as a tax-deductible funding vehicle. We're also looking at selling T-shirts, and I've been approached with several business offers... CFA: Would you encourage local fund-raising for the March? Keith G: Absolutely. CFA: How did you get involved in net.activism? Keith G: How?? I went to the February 10th protest in Lafayette Park (behind the White House) that Tom Edwards put on. My first protest. The rest, well, it just sort of happened... CFA: :) The Feb. 10 protest was about the CDA? Keith G: Yep. Clinton signed it on Black Thursday, the 8th of February. Tom started the whole thing a few days earlier, and we got several hundred to turn out on fairly short notice. CFA: Are there other things that I, as an average net guy, can do to help? Keith G: Average net.guy... hmm... Well, when we get set up, buy a T-shirt, wear it to your Congresscritter's office. Also one or two particularly crafty ideas that I'm working on, but not ready to unveil yet (legal, non-violent, but potentially VERY politically effective...) CFA: Okay :) Keep us posted. Keith G: Oh, it will be on the web site... which I'm getting re-written... HTML 3.0, frames, Java, hot-and-cold running ASCII. <g> CFA: What's the turnout projected for the March? Keith G: Honestly, I don't know. **MY** original projections for the June rally were between 1 and 10K: John Wash kept saying 20K. If we can set up an organization of college students during the summer and have them recruit aggressively when school starts, we could hit 20K. We're also organizing amongst other communities that are more heavily wired than most: my first appointments were a Gay/Lesbian/Bi coordinator... I hope to get some help from the Pagan community as well... I already have plenty of hookups in Fandom... CFA: Cool :) Getting the word out seems very important now, with the changes... Keith G: Exactly. The Web site is among the top 5% hit, I have done my best to get the word out without overly spamming USENET. I know I'm going to about 15 or so lists... CFA: Jon Lebkowsky said you're doing the Club Wired EF forum? May 30? Keith G: Yep. Jon and I finalized that yesterday. CFA: Great. Keith G: Now, to beat that darned cyber-stagefright <g> CFA: :) What about multimedia stuff? Are there plans for video and/or audio from the March? Keith G: We're talking with NetRadio about a simulcast, one gent also is looking into a video feed, on the level of the Fish-cam. CFA: What about the roster of speakers? Any changes? Keith G: Not as yet.... but we're trying to get some bigger names. If anyone has an, ER, PIPELINE to Bill Gates or Mark Andreessen of Netscape, I'd be glad to chat. I'd like to get Barlow of EFF, maybe even Newt... CFA: Yes, a politician would be good. Maybe Leahy... Keith G: Leahy comes to mind. NOT Gore... unless we could boo him offstage... CFA: Heh. Keith G: I am NOT pleased with the two-facedness of the politicos over this whole thing... ESPECIALLY Clinton's, "It's unconstitutional but..." followed by his letter to Exon. Even if I WASN'T Republican, I couldn't vote for Clinton/Gore due to their utter fecklessness over the CDA CFA: The letter to Exon had me fuming, too. I'm getting tired of settling for the lesser evil... Keith G: Right: vote for the GREATER evil... dread Chthulu in 96 !!! <g> CFA: :) Well, anything else you want to add before I let you get some rest? Keith G: Nothing I can think of... our website is http://www.efm.org, and I'll post announcements to alt.censorship, comp.org.eff.talk, alt.activism, alt.wired, at minimum. CFA: Okay. Thanks for coming to talk :) Keith G: Anytime... --- rich burroughs <richieb(a)teleport.com> (april 26, 1996) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYgTA4T0GKfZRA/9AQH8OwP+NjWJAuYHWRbMdDCVt6Wj6Nh3ZxJIj0lU DUXM8eJKEzI/CdOVGCUHYB7w3cQlCT6q1oNgiuiMGrWsd66WLR12Xmm/Zx1/pme4 egB5SB4Wuc96ZJ89q2qwuHG8V9FBzD2HJxFYLdHdadWMNpj5cM/DV1G1vCvFREz1 cSA5AsbCnuI= =SXzn -----END PGP SIGNATURE----- ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Re: aufweidersehn, * grave$
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

Some anonymous illiterate racist socialist wrote: > Noticeable about capitali$t graves, he dissmisses EVERY attempt > to censor racists with a "who cares," "there just a bunch > of weinies," "if you can be heard *somewhere* without being > arrested, it's not censorship," etc. In defense of Rich, note that we libertarians accused him of being a socialist, and this anonymous socialist accuses him of being a capitalist. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

aufweidersehn, * grave$
by an572010＠anon.penet.fi 17 Dec '03

17 Dec '03

Glad that lying anti-racist jerk is leaving. With all his/her's nyms, rc graves is impossible to trust. Mike Beebe, Beowulf, ezundel, nietzsche, ernstzundel and others to make transparent trolls the ignorant anti-racist makes up. Mike Beebe: Posted that he WILL murder David Irving, simply because Irving was rejected by St Martins Press because of "controversial material." Noticeable about capitali$t graves, he dissmisses EVERY attempt to censor racists with a "who cares," "there just a bunch of weinies," "if you can be heard *somewhere* without being arrested, it's not censorship," etc. He seems to imply that merely because racists are powerless, we are not worthy of protection. I suppose if you have enough money, you can PURCHASE your freedom, if not, tough shit. We free-speachers don't need a character who defends the prosecutors when racists are sued or imprisoned in Canada, UK, and Germany, merely for printing racist leaflets. == sub-sub-Commandant --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

KEY_lok
by jya＠pipeline.com 17 Dec '03

17 Dec '03

5-2-96 FiTi reports at length on its investigation of a $19 million fraud and conspiracy involving smart cards using the Fiat-Shamir algorithm for encrypting UK video. Most of the detailed, complicated report is about the financial and tax-evasive shenanigan's of firms jointly providing the cards to BSkyB sat-tv. Adi Shamir's work is featured but he does not appear to be at fault, although a central role was played by News Data Security Products (10% owned by Shamir). The report does not get into the technology of crypto, but shows its keylock appeal for criminal conspiracies. KEY_lok

1 0

disclosure
by Brian D Williams 17 Dec '03

17 Dec '03

>From cypherpunks-errors(a)toad.com Tue Apr 30 23:58:28 1996 >Date: Wed, 1 May 1996 00:52:03 -0500 (CDT) >From: snow <snow(a)smoke.suba.com> >To: "Perry E. Metzger" <perry(a)piermont.com> >cc: "L. Detweiler" <vznuri(a)netcom.com>, cypherpunks(a)toad.com ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >Subject: Re: Why I dislike Java. (was Re: "Scruffies" vs. "Neats") >MIME-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk Game, set, match......

1 0

No Subject
by jim bell 17 Dec '03

17 Dec '03

If anybody wants to join me in expressing displeasure at being left out of the crafting of this "Burns bill" which ostensibly loosens up export controls on encryption software, here is his address. conrad_burns(a)burns.senate.govJim Bell jimbell(a)pacifier.com

1 0

EET on PGP API Quash
by jya＠pipeline.com 17 Dec '03

17 Dec '03

[Thanks to BC] Electronic Engineering Times, April 29, 1996, page 4 State Dept. Tries To Quash API's for PGP cryptography By Loring Wirbel Washington -- The Justice Department may have halted attempts to bring criminal charges against Phil Zimmermann, author of the Pretty Good Privacy (PGP) public-key cryptography algorithms, but the State Department is taking an increasingly hard line on PGP. Where once the State had restricted itself to warning developers against exporting source code with PGP file-encryption routines, it is now arguing that application programming interfaces (API) allowing PGP program insertion should be subject to control under arms-trading statutes. Warning letters sent out in the last few weeks reflect the bizarre status of cryptography algorithms in the government's Export Control Act. Under the International Traffic in Arms Regulations (ITAR) promulgated under the act, the government can restrict any encryption programs the National Security Agency (NSA) is uncomfortable with. The new moves represent the first time State has tried to extend ITAR to software that only provides hooks for encryption packages, however. "There is some room to maneuver and make strong arguments that the rules on crypto APIs have some serious ambiquities," said Kenneth Bass, an attorney specializing in export control with the Washington law firm of Venable Attorneys at Law. Bass said several companies have received warning letters from State, but most do not want to do battle with the Federal government. Meanwhile, wildly differing rulings in the U.S. District Courts on the West and East coasts send mixed messages about software embedding crypto algorithms. In refusing to dismiss developer Daniel Bernstein's suit against the State Department, Judge Marilyn Hall Patel of San Francisco ruled in early April that source code can be protected free speech. "The particular language one chooses does not change the nature of the language for First Amendment purposes," Patel said. "This court can find no meaningful difference between computer languages ... and German or French; ... whether source code or object code is also functional is immaterial." Bernstein seeks to establish that his zero-delay private-key program, Snuffle, is not subject to ITAR. Opposite Rationale But on March 22, Judge Charles Richey of Washington dismissed Philip Karn's suit against State using almost exactly the opposite rationale. Karn, an employee of Qualcomm Inc. (San Diego), challenged a ruling that the floppy disks accompanying some editions of Bruce Schneier's book, *Applied Cryptography*, could be barred from export. Judge Richey said the government was free to view implemented source code as a munition that could be banned, and said Defense Department decisions regarding materials covered under export control were precluded from judicial review. Karn appealed to the U.S. Circuit Court of Appeals on April 19. "The stage is being set for some very basic issues on souce code and free speech to be decided," said attorney Bass. So far the API issue has not spurred any suits. Network Telesystems Inc. (Santa Clara, Calif.) a TCP/IP stack specialist and the one company that has admitted receiving a warning from State, said that a PGP API is not central enough to its business to warrant making its preservation a federal case. Company president John Davidson said Network Telesystems elected to make its new e-mail package, Confidante, "PGP ready" by including a PGP API instead of licensing the code. Davidson said the warning must have been the result of government officials seeing the press release on the package, which has not yet shipped, or a short article in a national magazine. "We thought it was a misunderstanding at first, since we had no resident PGP code," Davidson said. "It didn't seem possible that the government could really be talking about an interface." One computer-security expert said off the record that "NSA has told State to watch out for any APIs outside NSA's own effort to define a crypto API." NSA is embracing the API work of companies like RSA Data Security Inc., the source said, "but Zimmermann's PGP work has always been a freelance effort, so a compromise is not seen as necessary." -----

1 0

Re: aufweidersehn, * grave$
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:05 AM 5/2/96 UTC, Skipjack Sally wrote: >Noticeable about capitali$t graves, he dissmisses EVERY attempt >to censor racists with a "who cares," "there just a bunch >of weinies," "if you can be heard *somewhere* without being >arrested, it's not censorship," etc. He seems to imply that >merely because racists are powerless, we are not worthy of >protection. I suppose if you have enough money, you can >PURCHASE your freedom, if not, tough shit. You do not need protection against speech, you need protection against ACTS. Speech in and of itself does not harm anyone. >We free-speachers don't need a character who defends the >prosecutors when racists are sued or imprisoned in Canada, >UK, and Germany, merely for printing racist leaflets. You claim to believe in free speech, but only for yourself it seems. You seem to desire the punishment of some speech, but not others. Who decides in this case? You? Me? The amorphious blob known as "Government"? I prefer the racists being able to speak in public because it gives people the chance to counter their lies with arguments. Truncheons just create marters and sympathy for their cause. Actually, I believe that the people who have been crying for the racists to be silenced have given them more free advertising than they could possibly get on their own. In the black and white thinking patterns of today, and the resistance to authority that is growing in the world, cries for censorship make those groups more attractive to those looking for a "cause". --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

CDT Policy Post 2.15 - Legislation Challenges Clinton's Grip on US Crypto Policy
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 15 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 15 May 2, 1996 CONTENTS: (1) New Bill Challenges Clinton's Iron Grip on US Encryption Policy * Senators Go Online To Discuss Bill, Seek Input from Netizens * Broad Public Interest/Industry Coalition Announces Support for Encryption Export Relief, Announces Public Education Campaign (2) Background on the Encryption Policy Debate * Why should Internet Users Care About this Issue? * Pointers to More Information on the Encryption Policy Debate (3) Subscription Information (4) About CDT, contacting us ** This document may be redistributed freely with this banner in tact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ----------------------------------------------------------------------------- (1) NEW EXPORT CONTROL REPEAL BILL CHALLENGES CLINTON ADMINISTRATION'S GRIP ON US ENCRYPTION POLICY In a move to replace the Cold War-era regulations on encryption with policies that make sense for the global Internet, Senators Burns (R-MT), Dole (R-KS), Leahy (D-VT), Pressler (R-SD), Wyden (D-OR), and others today introduced legislation to roll back the restrictions prohibiting the export of strong encryption technology. This historic legislation promises to inject the debate over privacy and security on the Internet into the 1996 presidential campaign. The bill, entitled the "Promotion of Commerce On-Line in the Digital Era (Pro-CODE) Act of 1996", is designed to encourage the widespread availability of strong, easy-to-use privacy and security technologies for the Internet. It is similar to a bill introduced in March by Senators Leahy and Burns, though the new bill does not contain criminal provisions or provisions imposing liability for third party key holders. Over 25 public interest organizations, and computer and communications companies, including Microsoft, Netscape, America Online, EFF, VTW, and Americans for Tax Reform, expressed support for this effort in a letter sent today to the sponsors of the bill. A list of signatories and excerpts of the letter are included below. Among other things, the "Pro-CODE" would: * Allow the export of "generally available" or "public domain" encryption software such as PGP and popular World Wide Web browsers without requiring NSA authority. * Allow the export of encryption hardware and software not available in the "mass market" or "public domain" under an export scheme that would allow up to roughly DES-strength (i.e., 56 bit key-length) security. if a product of similar strength is commercially available from a foreign supplier * Prohibit the government from imposing mandatory key-escrow encryption schemes domestically, or from restricting the sale of commercial encryption products within the United States * Prohibit the Department of Commerce from imposing government designed standards for encryption technologies (such as Clipper and Clipper II). For more information, including the text of the bill, analysis, and relevant background materials, visit CDT's Cryptography Policy Issues Page at (http://www.cdt.org/crypto/) CDT commends Senators Burns, Dole, Leahy, Wyden, Pressler, and the other sponsors of this proposal for their efforts to bring strong privacy and security technologies into the hands of Internet users, and for creating an opportunity for a national debate on the need to reform US policy towards encryption. We look forward to working with these and other members of Congress, the computer and communications industry, public interest groups, and the Internet Community as the bill makes its way through Congress. ------------------------------------------------------------------------------ * SENATORS TO GO ONLINE TO DISCUSS BILLS, TAKE COMMENTS FROM NETIZENS In an effort to bring the Internet Community into the debate and encourage members of Congress to work with the Net.community on vital Internet policy issues, Senator Burns and Senator Leahy will participate in live, online discussions of the new legislation. CDT and VTW, who are helping to coordinate these events, will publish the transcripts of the sessions and encourage Netizens to participate. Please join Senator Burns live online to discuss the Pro-CODE bill on: * MONDAY, MAY 6 AT 9:00 PM ET IN AMERICA ONLINE'S NEWS ROOM AUDITORIUM Note that you will have to join AOL participate in this chat. (If you aren't currently an AOL member, you can obtain the software by either a) finding one of those pervasive free floppy disks, or b) by using ftp to get it from ftp.aol.com (ftp://www.aol.com/) * MONDAY, MAY 13 AT 9:00 ET AT HotWired's CLUB WIRED Visit http://www.hotwired.com/ for more information. Senator Leahy will also conduct sessions on America Online and HotWired in the next several weeks, dates and times are TBA (visit http://www.crypto.com for updates) ----------------------------------------------------------------------------- * BROAD COALITION OF BUSINESSES, PUBLIC INTEREST GROUPS ANNOUNCE SUPPORT FOR ENCRYPTION EXPORT RELIEF, LAUNCH PUBLIC EDUCATION EFFORT In a letter sent to Senators Burns (R-MT), Dole (R-KS), Leahy (D-VT), Pressler (R-SD) Wyden (D-OR), Murray (D-WA) and the other sponsors of the Pro-CODE proposal, a broad coalition of computer and communications companies, public interest and privacy organizations across the political spectrum announced support for legislative efforts to relax encryption export controls as well as plans to conduct a broad effort to raise public awareness on the need to reform encryption policy. The letter states, "Current U.S. Export controls and other regulations on encryption technologies are stifling electronic commerce on the Internet, handicapping U.S. industry in the global marketplace, and preventing computer users from protecting their privacy online." The full text of the letter is available at CDT's Crypto issues web page (http://www.cdt.org/crypto/) Some of the 25 groups joining the effort include the American Bankers Association, Americans for Tax Reform, America Online, Bellcore, Business Software Alliance, CDT, Compuserve, EFF, the Institute for Justice, Lotus, The Media Institute, Microsoft, Netscape, Novell, Oracle Corp., Pacific Telesis, People for the American Way, Prodigy, Securities Industry Association, Software Publishers Association, Sybase, the Telecommincations Industry Association, the Voters Telecommunications Watch (VTW), and others. The groups also announced a large-scale public education campaign designed to raise public awareness of the importance of encryption to US competitiveness and individual privacy, including an "encryption education day" to be held in California's Silicon Valley in early July. The event will bring together industry leaders, members of Congress, encryption experts, and others to discuss the need to reform US encryption policy. Similar events, to be held throughout the US and on the Net, are also being planned. ------------------------------------------------------------------------------- (2) BACKGROUND ON THE ENCRYPTION POLICY DEBATE * Why is this issue important to Internet users? Encryption technologies are the locks and keys of the Information age. Encryption technology allows vital personal and commercial communications to travel securely over insecure and inexpensive communications networks like the Internet. For far too long, the debate over US encryption policy has been dominated by the NSA, FBI, and Clinton Administration, who continue to insist that privacy, security, and the competitive advantage of the US computer and communications industry must take a back seat to national security and law enforcement interests. While encryption products like PGP do allow the most computer-savvy among us to communicate securely, there are few strong, widely available, easy-to-use encryption applications available to Internet users. This is due in part to the Federal regulations which prohibit the export of strong encryption. As a result of these laws, US companies tend to build only one version of an encryption product, with relatively weak encryption, in order to sell to the global market. This results in the limited availability of strong encryption for domestic Internet users. Worse, the Clinton Administration has attempted to leverage the desire of US companies to sell strong encryption overseas to include features in products that will allow the Federal Government easy access to the plain text of encrypted communications. The Administration has used the standards promotion power of the National Institute of Standards and Technology (NIST) to serve the narrow interests of the NSA as compared to the broader interest of Internet users and US businesses. These "key-escrow" proposals, known as Clipper and Clipper II, have met with stiff resistance from civil libertarians, Internet users, and the US computer and communications industries. While legitimate law enforcement and national security issues are important factors in this debate, the need for individual privacy and security for personal and commercial communications and data is vital to the future of the Internet and other interactive communications technologies. As a result, the outcome of this policy debate will have tremendous implications on your privacy and the future of the Internet. ------------------------------------------------------------------------------ FOR MORE INFORMATION ON THIS ISSUE For more information on the Encryption Policy Debate, please visit CDT's encryption policy issues page at http://www.cdt.org/crypto/ You can also join CDT, VTW, EFF, EPIC, People for the American Way, Wired Magazine, and others in an online campaign to promote secure communications online. For more information, visit: * The Encryption Policy Resource Page -- http://www.crypto.com/ * The Internet Privacy Coalition Page -- http://www.privacy.org/ipc * EFF's Crypto Page -- http://www.eff.org/ * EPIC's Crypto Page -- http://www.epic.org/crypto * VTW's Crypto Page -- http://www.vtw.org/ ----------------------------------------------------------------------- (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.15 5/2/96 -----------------------------------------------------------------------

1 0

Re: [Linux] Unix plugins for Netscape (Was: Calling other code in Java applications and applets)
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:45 AM 5/2/96 -0700, Ian Goldberg wrote: >I'd venture a guess that most people who have a Linux box sufficiently cool >to run netscape at all, have the ability to run ELF. In fact, there are >probably a lot of people (like everyone who bought Slackware 3.0 or a recent >RedHat) for which netscape is the _only_ a.out binary on their system. In order to run any of the recient kernels you HAVE to be running ELF. (Or have your copy of GCC upgraded to 2.7.0 or higher.) The docs make no mention of it, but it barfs on the make if you do not have it. (There are three flags that are not supported under the old versions of GCC.) > - Ian "Add me to the 'Make an ELF Linux binary!!!' list..." Are they keeping a list? As for Linux, last I heard it was still on the semi-supported list. (The dropping of BSD on the fasttrack server pisses me off as well, but that is another matter...) I would like to get a version of the Linux binary that supports 128 bit SSL. (As well as the ELF binaries.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

3 2

proposed anti-pseudospoofing law in Georgia
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

this law got a little notice here although I didn't notice people considering its identity aspects in particular. this proposed law in Georgia would make it illegal to have a login name other than your legal name, as I understand it. I consider it rather silly, naive, and unenforcable, but it does suggest a few things: 1. lawmakers are starting to notice the internet bigtime. 2. its starting to freak them out. 3. the identity issues raised by cyberspace have significant social implications and will not go away quietly. 4. there are some legitimate reasons to require ID in some places in cyberspace. of course I will be flamed on 4, but my position is, has always been the following: both anonymous and "identified" communication have their places. I am not suggesting that either one is superior a priori. however each has different uses. some things that are possible in one are not possible in the other, etc. I think it is reasonable for people who create/maintain forums or other cyberspace services to demand, and be able to enforce, that you use your real identity if they choose. likewise, you are free not to join these place or use these services. I think anyone should be free to create alternatives that spit in the face of these restrictions. let the market decide what is most viable in given situations. I suspect that we are going to see some laws being passed trying to regulate cyberspace that are really ridiculous. it will take the lawmakers awhile to figure out what they can and can't get away with and when their opinions are or are not relevant to what happens. meanwhile, if the internet really is robust, their irrelevant posturings should not make much difference, although I am *not* advocating that people resign themselves to these laws, only that if they pass the situation is not necessarily catastrophic or apocalyptic. ------- Forwarded Message - ------- Forwarded Message Date: Tue, 30 Apr 1996 11:31:52 -0400 (EDT) From: merkaba(a)styx.ios.com Reply-To: snetnews(a)xbn.shore.net To: Multiple recipients of list SNETNEWS <SNETNEWS(a)XBN.SHORE.NET> Subject: INTERNET POLICE (fwd) - - ---------- Forwarded message ---------- Date: Fri, 26 Apr 1996 21:44:53 -0400 From: Ronald Pearce <ronald(a)cybercomm.net> To: merkaba(a)styx.ios.com Subject: INTERNET POLICE > >It is being dubbed the Internet Police Law. Georgia's state government is >beginning to catch a little net-heat because of a new law signed by the >Governor last week which, according to some, CRIMINALIZES the use of e-mail >addresses which don't properly identify a person, as well as the practice of >linking to another web page by name without first obtaining permission to >link. > >If anyone cares to see information and commentary on this new law, feel free >to browse over to www.kuesterlaw.com. I would love to know what everyone >thinks about the constitutionality of this bill, as well as any other comments. > >Thanks. >jk >Jeffrey R. Kuester, Esq. Patent, Copyright, & Trademark Law >6445 Powers Ferry Road, Suite 230, Atlanta, Georgia 30339 >Ph (770) 951-2623 Fax (770) 612-9713 >E-mail: kuester(a)kuesterlaw.com >WWW: http://www.KUESTERLAW.com (The Technology Law Resource) > >--------------------------------------------------------------- - - -> SNETNEWS Mailing List & Fidonet Echo - - -> Post to: listserv(a)xbn.shore.net - - -> subscribe snetnews - ------- End of Forwarded Message ------- End of Forwarded Message

3 3

Sen. Patrick Leahy's PGP key now avail.
by rodger＠interramp.com 17 Dec '03

17 Dec '03

Wanna write the good Senator on the occasion of his newest bill? His pub key's out there. (URL is http://bs.mit.edu:8001/pks-commands.html#submit/ ) Will Rodger

2 1

Best Digital Signature Lib from a WEB server
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Can anyone recommend a signature implementation for cgi/forms? For instance, someone registers on a WEB site and gets a signed receipt back. (No cookies or such, because the receipt will be show to 3rd party members.) I'm thinking in terms of self-labeling and PICS like work. The PICS Label Syntax and Communication Protocols mentions that Jim Bidzos has agree to allow RSAREF to be available to PICS developers at no cost. Has anyone tried this, or actually implemented a scheme like this? _______________________ Regards, I, man, am regal; a German am I Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Announce: Windows PGP QuickStart
by Joel McNamara 17 Dec '03

17 Dec '03

Due to a fair amount of demand from Private Idaho users who had novice friends that wanted to use PGP, but were frustrated at the installation and configuration process of the DOS version, I wrote a Windows utility called PGP QuickStart. This is an extremely simple app that handholds the user from downloading PGP with their Web browser to creating their key rings. It automatically unzips the files, creates the appropriate directory, and modifies the AUTOEXEC.BAT file. The user just follows easy to understand dialog boxes and clicks buttons. This is not a full-featured front-end. Its purpose is only to simplify the PGP installation process so a user can later use Private Idaho or any of the other Windows shells that are available. Obviously, most people on the list aren't going to have much personal use for this app. However, it is perfect for recommending to PC users who want to get started with crypto, but may be a little bit intimidated. The beta version is located at: http://www.eskimo.com/~joelm/pi.html Comments to: joelm(a)eskimo.com As with Private Idaho, this utility is free...

1 0

Re: CDT Policy Post 2.15 - Legislation Challenges Clinton's Grip on US Crypto Policy
by jim bell 17 Dec '03

17 Dec '03

> The Center for Democracy and Technology Volume 2, Number 15 >Among other things, the "Pro-CODE" would: >* Allow the export of "generally available" or "public domain" > encryption software such as PGP and popular World Wide Web browsers > without requiring NSA authority. > >* Allow the export of encryption hardware and software not available in > the "mass market" or "public domain" under an export scheme that would > allow up to roughly DES-strength (i.e., 56 bit key-length) security. > if a product of similar strength is commercially available from a > foreign supplier What, exactly, is the point of such a provision that would limit key length? Since the classifications of encryption export software seem to allow any keylength, why should there be an exception for others? I think they should give specific examples of hardware or software whose export would not be allowed, and more particularly an explanation why an exception is needed in those cases. We really need to know what they're thinking about, here. It isn't obvious why, and generally I've found that whenever laws carve out exceptions, there are substantial reasons for those exceptions, although not necessarily "good" reasons. Notice, for example, that there appears to be a distinction between hardware and software. (although, in the bill, it does list both hardware and software.) As we all should understand, the distinction ought to be meaningless, but one of our goals should be to allow the unrestricted export of good-encryption telephones which have their encryption done in hardware. That doesn't appear to be the case, and I think this is a telling limitation. The law will practically guarantee that no factories to build good crypto phones get sited in the US. However, a look at the actual bill shows nothing which specifically limits things to 56-bit keys, although it seems to make an unusual distinction, allowing exports "in any foregin country to which those exports of computers software and computer hardware of similar capability are permitted for use by financial institutions..." The problem, as I see it, is that this is practically an open invitation to foreign countries to pass laws which are specifically intended to restrict encryption. We should not be encouraging them to do this. Some explanation is definitely in order! BTW, that brings us to another issue: The bill should specifically prohibit restrictions on the IMPORTATION of any kind of encryption systems, either hardware and software. >* Prohibit the government from imposing mandatory key-escrow encryption > schemes domestically, or from restricting the sale of commercial > encryption products within the United States Redundant. The 1st amendment should already do this. I have no objection to them re-stating Constitutional protections, but it should label them as such. >* Prohibit the Department of Commerce from imposing government designed > standards for encryption technologies (such as Clipper and Clipper > II). Ditto. But more importantly, I think it ought to be prohibited from even _encouraging_ the use of such systems, which as we all know the government can do by abusing its power. It should be prohibited from spending any money to develop those standards, as well as prohibiting government from encouraging the use of those standards, etc. All in all, a substantial improvement over the Leahy bill, but it could still use a little work. Jim Bell jimbell(a)pacifier.com Jim Bell jimbell(a)pacifier.com

1 0

VTW: Senate attacks Clinton encryption export policy
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

======================================================================== __ _________ __ \ \ / /_ _\ \ / / Voters Telecommunications Watch \ \ / / | | \ \ /\ / / (vtw(a)vtw.org) \ V / | | \ V V / May 2, 1996 \_/ |_| \_/\_/ Redistribute only until 5/28/96 SENATORS FIRE BROADSIDE SALVO AT CLINTON ADMINISTRATION'S HEINOUS AND ANTIQUATED ENCRYPTION EXPORT POLICIES Please widely redistribute this document with this banner intact until May 28, 1996 ________________________________________________________________________ CONTENTS The Latest News Chronology of the 1996 Crypto Bills For More Information ________________________________________________________________________ THE LATEST NEWS Today, a core contingent of the US Senate proposed legislation that would free public domain software such as Phil Zimmerman's PGP (Pretty Good Privacy), allow for the export of products that have competitive encryption abroad, and limit the government's ability to propose another Clipper-style standard. The latest proposal, sponsored by Sen. Burns (R-MT) is the third in a series of bills this year that blatantly attack the Clinton Administration's policies of restricting the export of encryption that is already found outside the United States. Text of the legislation is now available on http://www.crypto.com/ and http://www.vtw.org/ as soon as we get it. In another bold move, Senators Conrad Burns (R-MT) and Patrick Leahy (D-VT) have scheduled online chats to discuss this legislation with the people who understand the issue the best: the net community. As a part of the Whistlestop96 campaign by VTW and CDT (Center for Democracy and Technology) to bring members of Congress in touch with the net community during the 1996 campaigns, Senators Burns and Leahy will be attending live online chat sessions on HotWired and America Online. The schedule as currently available is: Sen. Burns America Online, News Room auditorium: Monday May 6, 9pm EST Hotwired: Monday May 13, 9pm EST Sen. Leahy America Online: date not yet available Hotwired: date not yet available In addition, volunteers have begun maintaining a resource page at http://www.crypto.com/ with a corresponding mailing list for encryption policy news. You can subscribe to it from the WWW page http://www.crypto.com/ or by sending mail to majordomo(a)panix.com. ________________________________________________________________________ CHRONOLOGY OF THE 1996 ENCRYPTION BILLS May 2, '96 Bi-partisan group of Senators introduce PRO-CODE Act, which would free public-domain encryption software (such as PGP) for export, free much commercial encryption for export, and reduce the government's ability to push Clipper proposals down the throats of an unwilling public. Original sponsors include: Senators Burns (R-MT), Dole (R-KS), Faircloth (R-NC), Leahy (D-VT), Murray (D-WA), Nickles (R-OK), Pressler (R-SD), and Wyden (D-OR). Mar 5, '96 Sen. Leahy (D-VT) and Rep. Goodlatte (R-VA) introduce bills to liberalize cryptography exports. Cosponsoring this legislation on the Senate side at Sen. Burns (R-MT) and Sen. Murray (D-WA). On the House side are the following cosponsors: DeLay, Campbell, Eshoo, Moorhead, Doolittle, Barr, Ewing, Mica, Everett, Bono, Lofgren, and McKeon. ________________________________________________________________________ FOR MORE INFORMATION ABOUT ENCRYPTION Encryption Policy Resource Page: http://www.crypto.com/ Voters Telecommunications Watch: http://www.vtw.org/ Internet Privacy Coalition: http://www.privacy.org/ ========================================================================

1 0

Re: proposed anti-pseudospoofing law in Georgia
by Rich Burroughs 17 Dec '03

17 Dec '03

At 12:52 PM 5/2/96 -0700, "Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: [snip] >this proposed law in Georgia >would make it illegal to have a login name other than >your legal name, as I understand it. [snip] More than proposed. It was signed by Gov. Zell Miller on April 18, and is now the law in GA. see http://www.clark.net/pub/rothman/ga.htm and http://www.gahouse.com/docs/whatsnew/parsons.htm Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

unsescribe
by HardWorkingStudent 17 Dec '03

17 Dec '03

unsescribe razz(a)eden.rutgers.edu unsuscribe razz(a)eden.rutgers.edu

2 1

Re: [Fwd: Cylink can export 128-bit DH?]
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:55 AM 5/2/96 -0700, Ian Goldberg wrote: >Bill Frantz <frantz(a)netcom.com> wrote: >>As far as I know, DES is DES, domestic or export. If your DES >>interoperates with domestic DES (or popular implementations available on >>non-US servers), then you have DES. > >Not quite. CDMF key shortening was designed by IBM to shrink a 56-bit DES >key to 40 bits, suitable for export. See AC2, page 366. I heard a rumour >that CDMF is in SET, but I'm not sure how much that makes sense. I can find no evidence in Draft 2/23/96 of SET for 40bit DES keys. (BTW, I would not call CDMF DES, but this may be merely quibbling.) On page 31, it says, "The DES key format follows FIPS 46: it contains 56 bits of keying material and eight optional check bits." Since SET is very careful to not deal with anything but the financial aspects of online commerce, they can probably get a license for export under the current rules. (SET only includes a SHA hash of the "contract", calculated by both the cardholder and the merchant in its encrypted content. Both versions must match for the transaction to be authorized.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

"Scruffies" vs. "Neats"
by tcmay＠got.net 17 Dec '03

17 Dec '03

PREFACE I haven't written many essays lately...something about having several hundred or more of them on this list over the past three and a half years makes writing another one less urgent for me. But I've been thinking a lot about the interesting discussion we are having over the Java security issues and basic security model for running applets, and note some similarities with similar approaches in AI (artificial intelligence). I think it important that people here not "firmly commit" to positions they may have to change, as this leads to a "sticking coefficient" that retards changes (note that I am not commenting on which positions may need to change!). No one language is the end-all and be-all of programming, nor is any one approach the inevitable winner. But it certainly behooves us to think about likely future (and current) computing platforms. (We've done this many times, as with discussions a few years ago about which environments to put effort into...we had advocates of Emacs, Eudora, Perl, TCL, Safe-TCL, the clipboard of Mac and Windows systems, pure text only, and so on. In fact, an extensive poll was taken--by Eric Hughes, I believe--in November 1992, with the conclusion that at least a dozen major choices were popular, with none having a share over 10%.) So, it is a mistake to assume that I am making a "primate display" of supporting Java. At this point, and with having seen many fads come and go, my strong hunch is that "Web plus browsers plus applets plus Java" is likely to become the main choice of many people. (I am hardly alone in this judgment, natch. Any look at the trade press, the stock market, the shelves of new books, etc., will confirm this. But just because something is popular does not mean it is not in fact the likely future.) And I am sure that even the critics of various aspects of this model--including the studies of Java security--see this same scenario unfolding. I view their criticisms as being necessary and helpful, though I tend to dismiss the conclusions of some that the model is so deeply flawed that it should be discarded completely and a new model and/or language should be awaited....this just ain't gonna happen anytime soon. (The thrust of this essay is not how and why new computing paradigms spread, so I won't get into my views on this. Suffice it to say that historically the world has gotten a major new model (paradigm) no more than twice a decade, and usually only once per decade. Left as an exercise is what those have been.) SCRUFFIES AND NEATS On to "scruffies" and "neats." The AI world had two main camps, according to a popular view. The "scruffies" and the "neats." The scruffies believed intelligent behavior in a program would likely only come from gobs and gobs of code. They believed in cobbling together apps as quickly as possibly, racing out into the new landscape of computing and rigging something up to work. Loosely speaking, they favored hacking Lisp until something worked...a checkers program (a la ur-hacker Greenblatt), a vision system, a robot, etc. Scruffies like messy desks, because they like to be blasted with lots of random inputs, lots of unrelated ideas and concepts, and "inspiration." More recently, the scruffies have embraced neural nets, emergent computation, stochastic computing, genetic algorithms, and similar buzzwords. The recent work on "subsumption architectures" (a la Brooks) and agent architectures is consistent with viewpoint (though elements of logic are of course involved). (These are all gross overgeneralizations, caricatures, to clearly show what the polar viewpoints are.) The neats, on the other hand, believed that logic rules. Epitomized by Newell and Simon, and by the early Winograd, they believed intelligent behavior would come when the logical principles of thought could be found and implemented in a programming language. Much of the work on theorem proving and logic programming came out of this camp. According to the caricature (and caricatures can be useful, even if overstated), the neats have neat desks, work in neat languages, and favor mathematical rigor. (Of course, not all neats are neat. Some are scruffy, as Ted Kaczynski shows!) SCRUFFIES AND NEATS IN SECURITY The "security neat" believes in applying rigor to security. Machines and languages should be "provably secure." (Better yet, machines should be "provably correct," a la Viper, and operating systems and languages should produce provably correct code.) The "security scruffy" believes things are moving too quickly to insist his machine must be Orange Book top-rated, or that his OS must be fully secure....in fact, he doubts that such definitions have real meaning. [Aside: This polar caricature overstates things, as I said earlier. For example, even the "security scruffies" are not in favor of bad cryptographic code, of seriously-flawed PGP implementations, or of Java applets that can reach into user files and read or corrupt them. And even the security neats use machines hooked up to networks rather than running programs in some secure kernel on a machine locked in a secure room....] The scruffies believe that it may ultimately produce more overall security (not to mention producing interesting other results!) to race out into the new terrain, to establish outposts and colonies.... Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 10

Conrad_Burns@burns.senate.gov: Open Letter to Internet Community From Senator Burns
by Perry E. Metzger 17 Dec '03

17 Dec '03

Yes, I know this will probably be forwarded five hundred times. However, I thought I ought to try to be the first. ------- Forwarded Message Date: Thu, 2 May 1996 19:39:04 -0400 From: Conrad_Burns(a)burns.senate.gov To: Multiple recipients of list <com-priv(a)lists.psi.com> Subject: Open Letter to Internet Community From Senator Burns OPEN LETTER TO THE INTERNET COMMUNITY May 2, 1996 Dear friends: As an Internet user, you are no doubt aware of some of the hurdles the federal government has put up that limit the growth and full potential of exciting, emerging technologies. One of the most egregious of these has been the governmentally set limits on so-called "encryption" technologies. Today I am introducing a bill to address this major problem for businesses and users of the Internet. If the telecommunications law enacted this year is a vehicle to achieve real changes in the ways we interact with each other electronically, my bill is the engine that will allow this vehicle to move forward. The bill would promote the growth of electronic commerce, encourage the widespread availability to strong privacy and security technologies for the Internet, and repeal the out-dated regulations prohibiting the export of encryption technologies. This legislation is desperately needed because the Clinton administration continues to insist on restricting encryption exports, without regard to the harm this policy has on American businesses' ability to compete in the global marketplace or the ability of American citizens to protect their privacy online. Until we get the federal government out of the way and encourage the development of strong cryptography for the global market, electronic commerce and the potential of the Internet will not be realized. The last thing the Net needs are repressive and outdated regulations prohibiting the exports of strong privacy and security tools and making sure that the government has copies of the keys to our private communications. Yet this is exactly the situation we have today. My new bill, the Promotion of Commerce On-Line in the Digital Era (Pro-CODE) Act of 1996, would: - Allow for the unrestricted export of "mass-market" or "public-domain" encryption programs, including such products as Pretty Good Privacy and popular World Wide Web browsers. - Require the Secretary of Commerce to allow the unrestricted export of other encryption technologies if products of similar strength are generally available outside the United States. - Prohibit the federal government from imposing mandatory key-escrow encryption policies on the domestic market and limit the authority of the Secretary of Commerce to set standards for encryption products. Removing export controls will dramatically increase the domestic availability of strong, easy-to-use privacy and security products and encourage the use of the Internet as a forum of secure electronic commerce. It will also undermine the Clinton Administration's "Clipper" proposals which have used export restrictions as leverage to impose policies that guarantee government access to our encryption keys. The Pro-CODE bill is similar to a bill I co-authored with Senator Patrick Leahy of Vermont, except that it highlights the importance of encryption to electronic commerce and the need to dramatically change current policy to encourage its growth. My bill does not add any new criminal provisions and does not establish legal requirements for key-escrow agents. Over the coming months, I plan to hold hearings on this bill and encourage a public debate on the need to change the Clinton Administration's restrictive export control policies. I will need your support as we move forward towards building a global Internet that is good for electronic commerce and privacy. I look forward to working with the Internet community, online activists, and the computer and communications industry as this proposal moves through Congress. I'd like to hear from you, so please join me on two upcoming online events to talk about the new bill. The first is on America Online in the News Room auditorium at 9 p.m. Eastern Daylight Time on May 6. The second will be on Hotwired's Chat at 9 p.m. EDT on May 13. In the meantime, I need your help in supporting the effort to repeal cryptography export controls. You can find out more by visiting my web page http://www.senate.gov/~burns/. There you will find a collection of encryption education resources that my Webmaster has assembled. I trust that the entire Internet community, from the old-timers to those just starting to learn about encryption, will find this information useful. This bill is vital to all Americans, from everyday computer users and businesses to manufacturers of computer software and hardware. I very much look forward to working with you on this issue. Conrad Burns United States Senator ------- End of Forwarded Message

1 0

Burns Bill
by frantz＠netcom.com 17 Dec '03

17 Dec '03

A quick read thru the text of the bill (via http://www.cdt.org/crypto/) shows none of the principle objectionable features of the Lehey bill. (Standards for key escrow agents, and additional criminal penalties for using encryption to hinder an investigation.) This bill has some obscure, to me, exceptions. The most troubling of which I think means (IANAL) that export can be restricted if there is a reasonable expectation that the hard/software will be reexported to one of the countries on the extreme bad boys list. This provision could possibly be construed to affect FTP sites, but in any case, it is not clear how passage of the bill could possibly make things worse. Its provisions preventing the Secretary of Commerce from developing standards for anyone except government agencies, and forbidding mandatory GAK/key escrow are very welcome. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1