December 2003 - cypherpunks-legacy

cryptography
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Response to Freedom Now! program on PBS, regarding expanding use of cryptography by individuals. - ----------------------------------------------------------- Unfortunately, the NSA representative (Mr. Baker?) on today's (3/3/96) show neglected to mention that the Clinton administration called for the introduction of the Clipper chip in *all* phones, NOT just those used by the government. This may be readily verified online via the archives at the EFF (http://www.eff.org) EPIC (http://www.epic.org) and even the White House' (http://www.whitehouse.gov) own ftp-able copies of the President's speeches. Also missed was the fact that the Clipper chip would readily permit the implementation of what is called "traffic analysis" - knowing who spoke with whom, regardless of content. Traffic analysis data could readily be misinterpreted. If I were to make a dozen calls to a KKK office, traffic analysis would show such; it would *not* indicate whether the calls were in support of, or opposition to, the KKK's existence. I found 'interesting' the NSA representative's emphasis of the fact that with the introduction of the automobile, the government's response was licensing and requirements for absolute identification. Extending that response, and the extensive licensing and identification procedures used to (legally) acquire (legal) firearms, to the use of cryptography and communications: are we going to see licensed telephones? Are we going to be obliged to present a National ID card before being able to use a public pay phone? Somehow, I have trouble equating a submachine gun to a Princess phone... but then, I'm not a (probably justifiably so) paranoid government official. David K. Merriman merriman(a)arn.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTks9MVrTvyYOzAZAQF+tQP/Z1WQQ5lA04Lkt1e4pDM6x/MA113+LuAQ DnKSSy50778cblcW44IimEkeWvxAQ/ee4FYtDlDvpxVgCXJc9ARUdawpZ0eFoCON 5nQ1VixVUMhmMrZYUrx1MFmacvgYDfkqXS7QEHmkrQzvZTKsjM67gs2VKCUhJm0D p54R34ooaKM= =1HPq -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

1 0

remailer, web site, listserve
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I and a partner are expecting to be online by the 8th of March with a commercial web server (shellback.com) As part of this presence, I am working on hacking together a program to interface with the SLMail95 (yes, it will be running on a Win95 machine :-) email server to allow operation as a remailer. Initially, I anticipate that it will be a fairly 'dumb' remailer, offering only remailing, reordering, and PGP encryption. Additional CP-style features will be added as my time to implement them permits. I am offering to maintain an initially limited archives of CP materials and a listserve host (if needed/wanted). I am also actively soliciting (via email to me personally, please, and forgive me if I don't acknowledge it) pointers and materials (files, documents, etc) to include on the site. I have the PGP files from the CP ftp site (before it got 'lost' again), but anything else is *most* welcome. We will also be offering anonymous email accounts for $5/month. Following is the PGP key for the remailer we'll be operating (remailer(a)shellback.com) I want to emphasize that the remailer will *not* keep *any* kind of logs. Bad headers, bounces, or anything else not processed on the first go-through will simply fall into the bitbucket for electron recycling. Since I'll be the postmaster/webmaster, I can say that with no small measure of confidence :-) - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzE0kfEAAAEEALf5sIOqMfEAFi3geJ6aofyaCRy1ZJt8D91QBqPPeU1X3ond BoIcEcfaMf7s3cOBaiEl7rKFMYqEpL08G7FFelQxc1WRvsR5XtTN+xFB3j0RPNON vMxju5j6anjPVb2RMnowSYqNKUWIEYd4Soa7L+ZWpaHgLSGkhb6Ex2tu6LdpAAUR tCFSZW1haWxlciA8cmVtYWlsZXJAc2hlbGxiYWNrLmNvbT6JAJUDBRAxNJK/xWtO /Jg7MBkBAfiVBACk6dDtebwemmY2+nxK+WD46a0Uj/lwpXLGzJvixdYGo4mwYG2/ LUw/23xBNxLIvPCFR8Qvt9zguyPdMWAp07I64ZlL6yv9Co3DETtTLB8wBdPce6Wx CLswIWAQ3MSLOmgVB35TzOYrYf5RzYtNKktCl3YDa9mxV4sug9xAx5uxvw== =9EvL - -----END PGP PUBLIC KEY BLOCK----- We return you now to your regularly scheduled anarchy..... Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTkzSsVrTvyYOzAZAQGVxQP/cFSgADQRFs58aTRv9FmzVFKK5xP4Ew2T lFajc73ltr0u6qa3luCfZKUqhG93REt8KXqzj2j65i+wrSKzs10DN2N75dEfRHO9 oGm0ka82eTmY+NXLLuNn1THw0+J8EsH9itQD0H4IzEWFkqUYq/C8pEtARF8LCt3V oKN1V/E6zPs= =sfA+ -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

1 0

Re: Duress
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:49 PM 03/3/96 EST, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >"A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> writes: >> Those of you who follow FIREWALLS may recall that I premote the use of >> "minefields" on networks, machines that should never be accessed and will >> trigger an alarm/response on any access. >> >> Some years ago I wrote a spec for cryptographic securing of notebooks/ >> E-Mail that included a "duress" capability: a "password" that, when >> entered would appear to be properly accepted but would report an error >> on retrieval. Optional was to be overwriting of any material whose access >> was attempted. > >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. > Many (if not most) alarm companies make the duress code the *reverse* of the normal code. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTlEzsVrTvyYOzAZAQG9sAQAjfAQP6pEReh/vzx/dsJKU987FOMbqWgV Ik/NtzW7fRRzVYmruribT1ZtPQAcPTkdORZC22xHvk82E/m9Awv9q6Zhkbd29/TQ kcLQ42G3ddcUMA7EWtWtP231tofnyQtM5M7KRdIkKyT7oZdyXgjP42mysjGNDHAy wv2VcfiPwPQ= =fc6C -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

2 1

Re: NYT login
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just Rich wrote: > > Rumour has it that there might be a cpunks/cpunks (cypherpunks was taken). This brings up an interesting prtoblem which I have been trying to solve. How can we fund content providers on the Web while not compromising privacy? Early on I targeted political and governmental sites as likely users of the Web. This also reflected a personal belief that I have in open government. What I did not anticipate was the speed with which the mainstream press started appearing on the Web. In part this was due to the Whitehouse server which has legitimized the Web in many corporated boardrooms. There is a problem though, nobody has a fully convincing revenue model yet. This will have to chage if sites like the NYT are going to stay online. Ideally I would like these sites to be free to the readers because it helps break down international chauvnism and petty minded nationalism. I believe that the significant number of trans-national relationships forged over the internet have lead to a significant shift in support for French Nuclear testing for example. Ten years ago many French supported terrorism such as the sinking of the Rainbow warrior in persuit of this policy, this time round there has been much less support for the government posistion. The challenge therefore is to find a means by which NYT etc can pay their staffs. Advertising is an obvious mechanism but here there is a problem. Advertisers need to know what they are receiving by way of value for money. Don't believe the stories of $50K per month advertising charges, many of these prices are very heavily discounted. $50K is what advertisers are willing to pay once they know for sure the Web works for them. If we apply traditional advertising logic it would be necessary to use very intrusive methods to discover how effective the Web is. This is not necessarily the case on the Web since it is an interactive medium. As Jock Gill pointed out at a recent conference we organised, instead of targetting customers the Web permits a participatory process which may be far more profitable for big name brands, allowing them to establish the high value long term relationships they really want. So the question is how can we square the circle? I have no problem telling the NYT's advertisers that NYT have a reader who is in the high tech goodies purchasingcategory. I have a serious problem allowing the government to know that I read the NYT, remember that in many countries that could lead to getting you arrested. I also think we need to be cautious about comapnies collecting similar information. Imagine for a moment that the US elected a fascist president opposed to "left wing intellectuals". It would be a bad thing if he could obtain a list of likely left wing intellectuals compiled from readership of various magazines, visiting of left wing Web sites etc. This is a live issue in Holland where no phone records are kept because stored records were used by the NAZIs when they were invaded to find out who was talking to whom. Some Ideas I had: 1) An anonymous session identifier generated by the browser constructed in a cryptographically secure manner so as to prevent linkage across sites. This would allow NYTs to find out that a reader had moved from the sports section to the politics section within the site but not to track them from the NYT to Time Warner. 2) A privacy code of conduct. Sites adhering to this code would be alowed to display a trademarked icon on their pages. This code would cover items such as not selling log files not maintaining online records of identity. There are many people who are willing to put in the effort to make the Web a place where people can interact in privacy. I know very senior people in very large companies who are as concerned as many cypherpunks on this issue. The point is that we need to come up with a scheme which addresses their legitimate business needs and protects privacy. Otherwise the market will decide and it does not care much about privacy. I have written up some working drafts. You can get them from the IETF in ascii text or via the web as W3c working drafts http://w3.org/ Phill Hallam-Baker - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMToQuyoZzwIn1bdtAQFSZgGAwMeBfDr4g3yBclG08m6f8K2Ml1Gv07i1 L5wybpz4/8o4Gy7/P3UUP+82IcEpgGrl =hUU/ -----END PGP SIGNATURE-----

4 3

Re: A brief comparison of email encryption protocols
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:01 AM 2/29/96 -0800, Laurence Lundblade <lgl(a)qualcomm.com> wrote: .....CME wrote.... >>Like X.509, my certs have an Issuing-name and a Subject-name -- but >>they're both cryptographic hashes of public keys. You can take a portion >>of those hashes [e.g., low order 12 bits] and use it to index a hash table >>of certificates or keys. The cert is more general than X.509 -- that is, ...... >Isn't using a hash as the identifier replicating the key distribution >problem that PGP has or are you including some other data that can be used >to look up the cert? I think a problem occurs when you have 20 billion of >these certs (two for every person in the year 2010 or such). A simple hash >into a table isn't going to cut it because you a single database (with >replication?) isn't going to be possible. Some hierarchical lookup like >DNS is going to be needed. The look ups are needed to check for revocation. There's a name collision on the word "hash" here. Carl was using both hashes in the same sentence. A "cryptographic hash" is a strongly one-way mapping from an input string (in this case a public key) to a number. A hash table is a data structure that uses a mapping from an input string to a number to decide where to put things. An MD5 cryptographic hash function used on PGP public keys (e.g. to get the fingerprint) is 64 bits long, so there may be a few collisions if there are 2**34 keys out there; if things scale to that point, PGP 4.1.3 need to use SHA for fingerprints instead (or in addition). Carl is proposing using a hash table (indexed by a hash-table hash of the cryptographic hash) to store public keys; that's a separate problem, though of course if you want to store 20 billion keys in one place, there are better data structures than simple hash tables. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Netcom and Credit Cards
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: > > The "credit card numbers were stolen" point, that I believe Ed Carp was > > referring to, had to do with the Mitnick affair, and is very old news. > > The fact that they had been stolen was mentioned in an edition of 2600 > 6 months before the Mitnick saga. Netcom had been told about the > security breaches many times, but refused to acknowledge that their > site was insecure. It was this arrogance that pissed people off > more than their insecurity. As someone who was involved in the recent iKP / SEPP /STT / --> SET event I would like to point out that it was the storage of CC numbers in databases connected to the Internet which was the primary concern of credit card companies. Sending credit card numbers across the internet in the clear was to an extent a side issue. Clearly if the merchant was nopt going to be able to store the number the number would have to not be received in cleartext by the merchant. Phill - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMToR2yoZzwIn1bdtAQEBDAF+Mgb3VluBwhqkjIgPCJ5YurkDWWm9MRwg RJoqXdalTBmM20ldY5qddiuTGoxni4ac =9L/X -----END PGP SIGNATURE-----

1 0

Request Comments: Transpose/XOR Hash
by Olcay Cirit 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi! I'm working on a cipher that utilizes Cipher Block Chaining and One-way hashing to create a sequence of pseudo-random numbers to XOR against a plaintext. I'd like to know if anyone has comments regarding the hash method I came up with. It is a combination of Transposition and XORing. Basically, it works like this: Let's say K is the 8 character key that will be hashed. There are two binary accumulators M and L, which store the Most and Least significant bits in each byte of K. After M and L are both 8 bits long, they are XORed together and the resulting value replaces byte N in the Key. This is repeated 8 times, and each time, N is incremented by one. Any thoughts, comments? -olcay - -- "For he who lives more lives than one, |) Olcay Cirit -- olcay(a)libtech.com more deaths than one must die" (| http://www.libtech.com/olo2.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTpumyoZzwIn1bdtAQHnqAGA2CzuLVpiPdRQ84MuC8aBxy7vcIZsujLr 85hGcVoknfAujjXFoy7KOxGQrZt3RorK =jQ7w -----END PGP SIGNATURE-----

2 1

(Fwd) Gov't run anon servers
by James Caldwell 17 Dec '03

17 Dec '03

This states that some anonymous remailers are run by various gov't and that encryption keys up to 1000 bits are crackable. Whether this is true or disinformation, you are using a 1024 bit key and all your messages through anonymous remailers are encrypted aren't they? Also note that while later versions of PGP are capable of larger keys, that these versions of PGP are not known to be secure. PGP 2.3a is the last version released prior to gov't interference. PGP 2.3a will do 1264 bit keys if you enter 1264 in the box instead of the number it askes for when if asks for the type of key security you want. ------- Forwarded Message Follows ------- alt.privacy.anon-server,alt.anonymous.messages,alt.anonymous, talk.politics.crypto,alt.politics.org.covert,alt.politics.org.nsa,alt.politics.datahighway, alt.culture.internet,alt.culture.usenet,alt.cyberspace,alt.conspiracy From: an366601(a)anon.penet.fi (** CRAM **) Date: Sun, 3 Mar 1996 13:15:55 UTC Subject: Strassman & Marlow comment on NSA/remailers Forwarded message: >From ausman(a)wired.com Tue Feb 6 01:42:13 1996 Message-Id: <199602060109.RAA09056(a)wired.com> To: sameer(a)CSUA.Berkeley.EDU Subject: has this been on cypherpunks? Date: Mon, 05 Feb 1996 17:09:17 -0800 From: Jim Ausman <ausman(a)wired.com> Received: (from daemon@localhost) by wired.com (8.7.3/8.7.3) id QAA27559 for pork-list; Mon, 5 Feb 1996 16:13:51 -0800 (PST) Received: from [204.62.132.47] (mckinley.wired.com [204.62.132.47]) by wired.com (8.7.3/8.7.3) with SMTP id QAA27543 for <pork>; Mon, 5 Feb 1996 16:13:43 -0800 (PST) Message-Id: <v0213050bad3c4c88b88d(a)[204.62.132.47]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Mon, 5 Feb 1996 16:14:37 -0800 To: pork(a)wired.com From: kate(a)hotwired.com (Kate McKinley) Subject: CIA and you Sender: owner-pork(a)hotwired.com Precedence: bulk Status: O >Sorry to send this through the "help email address" but I couldn't find >your news email address. >I attended last weeks "Information, National Policies, and International >Infrastructure" Symposium at Harvard Law School, organized by the Global >Information Infrastructure Commission, the Kennedy School and the >Institute for Information Technology Law & Policy of Harvard Law School. >During the presentation by Paul Strassmann, National Defense University >and William Marlow, Science Applications International Corporation, >entitled "Anonymous Remailers as Risk-Free International Infoterrorists" >the questions was raised from audience (Professor Chaarles Nesson, >Harvard LAw School) - in a rather extended debate - whether the CIA and >similar government agencies are involved in running anonymous remailers >as this would be a perfect target to scan possibly illegal messages. >Both presenters explicitly acknowledged that a number of anonymous >remnailers in the US are run by government agencies scanning traffic. >Marlow said that the government runs at least a dozen remailers and that >the most popular remailers in France and Germany are run by the >respective government agencies in these countries. In addition they >mentioned that the NSA has successfully developed systems to break >encrypted messages below 1000 bit of key length and strongly suggested >to use at least 1024 bit keys. They said that they semselves use 1024 >bit keys. >I ask Marlos afterwards if these comments were off or on record, he >paused then said that he can be quoted. >So I thought I pass that on. It seems interesting enough, don't you >think? >Best >Viktor Mayer-Schoenberger >Information Law Project >Austrian Institute for Legal Policy Kate McKinley kate(a)hotwired.com CAVE CANUM \ \ \ \ \ \ \ \ \ | / / / / / / / / / / _______ ________ _____ _____ _____ /// \\\ ||| \\\ /// \\\ |||\\\///||| ||| ~~ ||| /// ||| ||| ||| \\// ||| ||| __ |||~~~\\\ |||~~~||| ||| ~~ ||| \\\ /// ||| \\\ ||| ||| ||| ||| ~~~~~~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~~ / / / / / / / / / | \ \ \ \ \ \ \ \ \ \ C y b e r s p a t i a l R e a l i t y A d v a n c e m e n t M o v e m e n t --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi Yet she became more and more promiscuous as she recalled the days of her youth, when she was a prostitute in Egypt. There she lusted after her lovers, whose genitals were like those of donkeys and whose emissions were like that of horses. So you longed for the lewdness of your youth, when in Egypt your bosom was caressed and your young breasts fondled. Ezekiel 23:19-21 Fight the Communications Decency Act or suffer not being able to transmit the Bible online. http://www.cdt.org/ I like cats, probably more than I should. They are cute, cuddly and kill things and then lay them at my feet in tribute.

1 0

Any Ideas??
by electro 17 Dec '03

17 Dec '03

Hello im new to this mailing list and I have seen alot of talk about re-mailers. I run my schools netconnection (it was just a Win 3.11 Computer before i got there) And I have installed Linux 1.2.8 (Slackware 2.3) (T-1 Connect!!!) I want to setup as mutch anonmized stuff (It whould all be free) that I can find. I have wrote shell scripts that let you ftp stuff and then download it by zmodem. But i havent benable to find WWW Baised Remailer Software or The software that anon.pennet.fi uses (not sure the name for it) If you have any ideas, or Places where I can find this software. Please e-mail me

1 0

Leslie Fish address?
by mlove＠olywa.net 17 Dec '03

17 Dec '03

Do you know of an e-mail address for Leslie Fish? m

2 1

Re: Duress
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:49 PM 3/3/96 -0500, Dr. Dimitri Vulis wrote: >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. The air-transport system has had a Hijack transponder code for years. The pilot dials it into the air traffic system radar transponder when the plane is hijacked. However there is a problem. One of the private pilot magazines reported that a small plane operator used the code (because his airplane was, in fact, being hijacked). When he landed the airplane, it was surrounded by LEA, and in the ensuing gun battle, everyone on the airplane died. The went on to say that the safety of the passengers and airplane are the pilot's primary responsibility and that pilots should consider this incident when deciding to use the code. Duress codes need to be designed to minimized the chance of such responses when they are used. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

4 4

Re: Crypto Export Legislation?
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I took a look at the text of the bill. There was a line in it making it a crime to use crypto in a way that obstructs a federal investigation. While understandable, this is too vague... it could easily be interpreted (IMO) as any strong crypto without escrow of some kind. Anyone else feel this way about that line in the bill? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTorUyoZzwIn1bdtAQEWJgGA1KdA1HtbX9L0U22rBLKFouIQHQniAdA3 lvimml/i+Z/KmYSmHGqkGBwCb1hAfSxc =E2ZA -----END PGP SIGNATURE-----

1 0

Interesting Identity Hacking Experiment: www.switchboard.com
by Just Rich 17 Dec '03

17 Dec '03

http://www.switchboard.com/ is a white pages directory. Basically, it's the Database America CD-ROM on the Web. The difference is, it's writeable, and free. Pretty cool. I don't think it was wise for them to allow anyone with an email address to change anyone else's white pages entry, though. Can anyone think of a prominent politician who would be in the phone book? The freeform "more information" field is just asking to be used. Potentially interesting applications for anonymous web proxies and secure pseudonym servers. At least they don't make direct changes to the database -- I'd guess they only set a flag to look in the separate user-supplied file. I.e., I changed my entry, then hit "unregister," and all the original information returned immediately. -rich

1 0

Re: Electronic Freedom press release
by sj＠io.com 17 Dec '03

17 Dec '03

At 1:50 PM 3/3/96, LibertyWMA(a)aol.com wrote: (quoting George Phillies) > When the Secret >Service raided Steve Jackson Games to suppress publication of 'Hacker' I >immediately wrote Congress to protest. Serious distortion of the facts. "Hacker" was published as a reaction to the raid; it was not the target of the raid. The book you are thinking about is GURPS CYBERPUNK, which the Secret Service encouraged us to believe was the object of the raid, but testimony at the trial indicated that that was not the case. The SS was ignorantly indifferent to free speech and publisher's rights, rather than taking direct aim at them. See www.io.com/SS/ for more information. Our case was a victory, but if it is cited in support of irrelevancies, it has no more meaning than if it is forgotten completely. Steve Jackson, sj(a)io.com - this will do till I fix my .sig file . . .

1 0

Third Generation Problems
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Bill rites: >Duress codes need to be designed to minimized the chance of such responses >when they are used. Absolutely but is a third generation problem: First generation: being able to protect the information (encryption) Second Generation: being able to respond to risks (duress) incurred by the first generation solution (duress codes) Third Generation: being able to respond to risks incurred by using the second generation response (using the duress codes). Is nice to plan for each up front but often the succeding generation risks only become apparent after living with the preceeding generation solution for a while. This should not prevent anyone from implementing the first because of what *might* happen in the second. "Doing nothing" is a sound solution only for politicians. Besides the purpose of "duress codes" is not just to provide an avenue for use in case of threat, it is also to deter the threat in the first place by reducing the "win" probability for those who might issue the threat. (previously mentioned a very real consideration for the fifth amendment. will not repeat.) Warmly, Padgett

1 0

Re: Randomness paper (posting it)
by rollo＠artvark.com 17 Dec '03

17 Dec '03

OK. Post it WHERE? >> Postscript, only in FrameMaker format, or as Interchange - MIF or as Text. > >If you can save it as text, then please post it as text. > > Yiorgos Adamopoulos adamo(a)noc.ntua.gr > National Technical University of Athens, NOC Rollo Silver | e-mail: rollo(a)artvark.com | Artvark | Home page: http://www.artvark.com/artvark/ | PO Box 219 | Voice: 505-586-0197 | San Cristobal, NM 87564 USA | Compuserve 71174,1453 | =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

1 0

Re: So, what crypto legislation (if any) is necessary?
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

unicorn @ schloss.li (Black Unicorn) wrote: >On Tue, 26 Mar 1996, Duncan Frissell wrote: >>... >> In fact, I suppose that government operation of the identification system >> (drivers' licenses, passports, etc.) in general is also horribly inefficient >> and should be attacked on efficiency grounds. > >You might not like what you get in response. Streamlined and uniform >identity documents generated at birth and renewed with tax filings would >be the likeliest efficiency improvement. An inefficient government >identification system is to the advantage of the privacy seeker. Indeed. A wise man once said "Thank goodness we don't get all the government we pay for". Government inefficiency is our friend (except at tax time) -- don't wish for it to get more efficient unless it gets a lot smaller FIRST. paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "The only purpose for which power can be rightfully exercised over ! any member of a civilized community, against his will, is to prevent ! harm to others. His own good, either physical or moral, is not ! a sufficient warrant." -- John Stuart Mill, "On Liberty" 1859

1 0

InfoWarCon IV - Final Schedule
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

P L E A S E D I S T R I B U T E W I D E L Y F I N A L S C H E D U L E IW4 -- InfoWarCon (Europe) '96 Fourth International Conference on Information Warfare: Defining the European Perspective Brussels, Belgium May 23-24 1996 Sponsored by: National Computer Security Association Winn Schwartau, President and CEO, Interpact, Inc. Robert David Steele, Chairman & CEO, Open Source Solutions Group CoSponsors: IBM Internet Security Systems, Inc. Jane's Information Group Network Systems, Inc. Norman Data Defense Background Information Warfare represents a global challenge that faces all late-industrial and information age nation states. It also represents the easiest and cheapest way for less developed nation-states and religious or political movements to anonymously and grieviously attack major nations and international corporations. Not only are the definitions of InfoWar unclear, but they span many areas and disciplines. This conference will examine the European perspectives on all three classes of Information Warfare while contributing some American lessons learned, mistakes made and successes enjoyed. Class One: Personal Privacy Class Two: Industrial and Economic Spying and Warfare Class Three: Global Conflict, Terrorism and the Military As at all other Information Warfare Conferences, this special European Conference encourages active audience participation, contribution and debate. May 22, 1996 17:00 - 20:00 Pre-Registration 18:00 - 21:00 Hosted Cocktail Party with Music Meet Mr. Schwartau, Mr. Steele and many of our other distinguished guests and conference speakers for casual 'off-line' conversation.. May 23, 1996 07:00 - 08:30 Registration 07:00 - 08:30 Sponsored Continental Breakfast PLENARY SESSIONS 08:30 - 09:00 Keynote Speech Maj. General Edwin Ebert J-6 Assistant Chief of Staff (C4I) USA 09:00 - 10:00 "Information Warfare: Chaos on the Electronic Superhighway" Winn Schwartau, President and CEO, Interpact, Inc., USA 10:00 - 11:15 East Versus West: Military Views of Information Warfare Moderator: Robert Steele East: General Nikolai Ivanovich Turko, Information Warfare Russia West: US - Gen. Jim McCarthy USAF (Retired) 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Information Warfare or Information in Warfare? Support for Conventional War Fighting Moderator: Winn Schwartau Panel: Russia: Admiral Vladimir Semenovich Pirumov (Retired) Chairman of Scientific Counsel of the Russian Security Counsel Sweden: Navy Captain Bo Wallendar UK: Captain Patrick Tyrell, Assistant Director, Information Warfare Policy, Ministry of Defence 13:00 - 13:30 Dealing with Internet Intruders in Emergency Mode: An IBM Perspective Peter Streibelt, IBM Europe Program Manager for Advanced Networking and Internet Emergency Response 13:30 - 14:30 Lunch BREAKOUT SESSIONS 14:30 - 16:00 Breakout One: Defending Against the Internet: The Threat to European Civil Prosperity Moderator: Mich Kabay, Klaus-Peter Kossakowski, DFN-CERT, Univ. of Hamburg, Germany Christopher Klaus, CEO and Founder, Internet Security Systems, US Peter Streibelt, IBM Europe Breakout Two: "Paradigm Shift" Moderated by: Winn Schwartau Dr. Phillipe Beaumard, University of Paris, France Colonel George Dunlop, USAF 16:00 - 16:30 Sponsored Break PLENARY SESSION 16:30 - 18:00 "Hackers: National Resources or Merely Cyber-Criminals?" Co-Moderators: Mich Kabay, Ph.D., Director of Education, NCSA and Robert Steele, President, OSS, Inc. Rop Gonggrijp - Hactic and The Digital City, Amsterdam, Andy Mueller-Maguhn, CHAOS Computer Club Germany "Frantic" - Anthony C. Zboralski - Convicted French Hacker 18:00 - 21:00 Hosted Reception 21:00 - 23:00 Self-paid Dinners for "Birds of a Feather." Rallying points will be provided. May 24, 1996 07:00 - 8:30 Sponsored Continental Breakfast 08:30 - 9:00 Keynote Speech "Efforts to Maximize Information As New Age Weapon" General Pichot-Duclos, France PLENARY SESSIONS 9:00 - 10:00 "Creating Smart Nations Through National Information Strategies: Intelligence And Security Issues" Robert David Steele, President, OSS, Inc. US 10:00 - 11:15 "The Convergence of Military and Commercial Vulnerabilities" Moderator: Winn Schwartau Panel: Bob Ayers, Chief IW Division, DISA, Department of Defense, US Captain Patrick Tyrell, Assistant Director, Information Warfare Policy, Ministry of Defence, United Kingdom 11:15 - 11:45 Sponsored Break 11:45 - 13:00 Societal Impact of Information Warfare Moderator: Winn Schwartau, Panel:The Croatian View: Pedrag Pale, Chairman of the InfoTech Coordinating Committee, Ministry of Science, Technology, and Informatics Dr. Ken Dark, Fellow, University of Camabridge, UK 13:00 - 13:30 Sponsored Luncheon Presentation 13:30 - 14:30 Special Luncheon Presentation BREAKOUT SESSIONS 14:30 - 16:00 Breakout One: Legislation & Personal Privacy: A Global Electronic Bill of Rights? Dr. Mich Kabay, Director of Education, NCSA Simon Davies, Electronic Privacy International, UK Dr. Leroy Pearce, Senior Technical Advisor, representing MajGen Leech, Asst. Deputy Minister of Defence Information Services, Canada Breakout Two: "Industrial Espionage: An Update" Moderator: Robert Steele Maurice Najman, Television Coorespondent, France Miguel Chamorro, Exec. Director, Interpol (invited) UK, Arish Turle, Kroll Associates 16:00 - 16:30 Sponsored Break PLENARY 16:30 - 18:00 Defining War in the Information Age "The New National Security" Brief comments by Winn Schwartau and Robert Steele - and then a lively interactive audience debate. 18:00 - 18:10 Closing Comments 18:00 - 20:00 No-Host Reception For complete schedules, and information on InfoWarCon IV (Europe) MAIL OR FAX OR EMAIL: National Computer Security Association 10 South Courthouse Avenue Carlisle, PA 17013 Phone 717-258-1816 or FAX 717-243-8642 EMAIL:conference@ncsa.com To obtain the latest edition of this program, send EMail to: euroinfowar(a)ncsa.com For more information about NCSA: WWW: http://www.ncsa.com CompuServe: GO NCSA Email: info(a)ncsa.com Sponsorships for various InfoWarCon (Europe) 96 events are still available. To Find out how to sponsor portions: Contact Paul Gates at the NCSA: pgates(a)ncsa.com To reach: Winn Schwartau: winn(a)infowar.com Robert Steele: ceo(a)oss.net V 1.19/3.11.96 SH Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Re: So, what crypto legislation (if any) is necessary?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On Thu, 28 Mar 1996, jim bell wrote: > > Escrowing encrypted keys makes them useless to subpoena, and in > > fact it helps the key owner because the escrow agent can (and, in fact, > > must!) be obligated to inform the key owner if his key is requested. At 05:49 AM 3/29/96 -0500, Black Unicorn wrote: > I thought I would take the time to let everyone know that this is > baseless as well. Most jurisdictions forbid third parties to reveal > prosecution inquries to the principal for which they are holding > documents or other information. A VERY few have laws on the books that > require this disclosure. Switzerland is no longer one of them. If you had actually read the article that you criticize you would have noticed that the "must" was enforced by cryptographic protocols, not by the blunt sword of the law. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Open letter from the Congressional Internet Caucus
by Declan B. McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message begins here ---------- Date: Fri, 29 Mar 1996 09:45:11 -0800 From: Congressional Internet Caucus <inetcauc(a)hr.house.gov> Organization: U.S. House of Representatives X-Mailer: Mozilla 2.0 (Win16; I) Mime-Version: 1.0 To: fight-censorship+(a)andrew.cmu.edu Subject: Open letter from the Congressional Internet Caucus To the Internet Community at-large, Finally, there is something that both Democrats and Republicans can agree on -- it is time to get Congress on-line for the 21st Century. Over the past few years, the Internet has changed the way we communicate, do business and educate our children. Millions of people log-on to the Internet each day to send and receive information. And this new medium has created thousands of new jobs in our nation's economy. As more and more people go on-line and as the Internet becomes a greater part of our daily lives, new questions arise about how to deal with this new medium. Members of Congress are having to make policy decisions on Internet issues that will impact our future. What role, if any, will the federal government have in developing the Internet? How will Congress respond to Internet-related issues? From encryption to indecency, copyright protection to universal service, Congress will need to make prudent public policy decisions about a medium that presents such enormous opportunities for all Americans. Congress must not make these decisions without the full understanding of and familiarity with the Internet. The Internet will also transform Congress and the government. From communicating with constituents to making government documents available on-line, we need to move into the Information Age NOW. Members of Congress need to use the Internet. To solve some of these problems, we are forming the Internet Caucus: a bipartisan, bicameral group of members with diverse viewpoints. What we share is a mutual concern for promoting the Internet. We will not just talk the talk. Caucus members will walk the walk into cyberspace by signing a pledge to 1) educate themselves about the Internet, 2) get on-line, 3) and educate other members about the Internet. The caucus will also serve as a clearinghouse of information for the public and other offices about Internet related issues. With the assistance of an advisory committee comprised of public interest groups, industry, and respected experts on the Internet, members will discuss and debate policy options. We look forward to getting your input on the many issues before Congress. See you on-line! Sincerely, Congressman Rick White http://www.house.gov/white/ Senator Patrick Leahy http://www.house.gov/~leahy Congressman Rick Boucher http://www.house.gov/boucher/welcome.htm Senator Larry Pressler http://www.senate.gov/senator/pressler.html Speaker Newt Gingrich mailto:georgia6@hr.house.gov Congressman Jack Fields Congressman Edward Markey Congressman Mike Oxley http://www.house.gov/oxley/welcome.html Congressman Christopher Cox Congresswoman Anna Eshoo http://www-eshoo.house.gov/ Congressman Bob Goodlatte mailto:talk2bob@hr.house.gov Congressman Tom Campbell mailto:campbell@hr.house.gov Congressman Robert Walker http://www.house.gov/walker/welcome.html Congresswoman Jennifer Dunn mailto:dunnwa08@hr.house.gov Congressman Vern Ehlers http://www.house.gov/ehlers/welcome.html Senator Slade Gorton http://www.senate.gov/senator/gorton.html Senator Conrad Burns http://www.senate.gov/~burns Senator Ron Wyden http://www.senate.gov/senator/wyden.html Congressman Sam Farr http://www.house.gov/farr/welcome.html Congressman Bill Luther http://www.house.gov/luther/welcome.html

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 05:49 AM 3/29/96 -0500, Black Unicorn wrote: >On Thu, 28 Mar 1996, jim bell wrote: > >> Escrowing encrypted keys makes them useless to subpoena, and in >> fact it helps the key owner because the escrow agent can (and, in fact, >> must!) be obligated to inform the key owner if his key is requested. > >I thought I would take the time to let everyone know that this is >baseless as well. Most jurisdictions forbid third parties to reveal >prosecution inquries to the principal for which they are holding >documents or other information. A VERY few have laws on the books that >require this disclosure. Switzerland is no longer one of them. As usual, Unicorn is FOS. Not entirely in his facts, but in his conclusions. To "forbit third parties to reveal prosecution inquiries" is an obvious violation of freedom of speech, and in fact is PRIOR RESTRAINT. Maybe Unicorn can't see what's wrong with that, but I can. It is unclear whether this has ever been tested in court, or whether that test occurred recently. Now, in practice I recognize that in the past large organizations which are subpoenaed usually comply with requests to keep an inquiry secret, but one of the effects of the "crypto revolution" and the "net revolution" is clearly to decentralize information power from the places it used to be carefully kept (IBM, ATT, etc) and is now distributing it among many more, far smaller organizations which are much closer to the people the prosecutors might be inclined to target. (for example, your friendly neighborhood ISP). Furthermore, the development of good encryption will allow a willing ISP (for example) to send an encrypted (and possibly semi-anonymous) message to the target of the investigation (or possibly a public USENET area, unaddressed), containing a pre-arranged alarm code to be sent to the target of the investigation, in such a way that any other people (for example, the brainless cops) won't know. The target will be assured (though encryption and signing, or prior arrangement) that the message could only have originated from the contractor (ISP) but the target (and nobody else, as well) will not be able to prove this knowledge to a third party. For example, if I ask my ISP to send me an anonymous, encrypted message with the word, "Rosebud" in it to me if he receives any requests to tap my connection, he can do so with no fear of being discovered, because no third party can decrypt the message, know who is is from, or know the real meaning of the word, "Rosebud" in the context of an encrypted, anonymized message. Further, since the whole thing is by pre-arrangement, even I cannot prove (to the satisfaction of a third party) that the message really meant what I would interpret it to mean. The message is useful to me, as a warning, but it could never turn around and "bite" the ISP. The end result is that your foolish opinion of what the law allows will simply become irrelevant: The government cannot mandate what it cannot enforce, and it cannot enforce what it cannot detect. You may ask, "Why would the operator of a small ISP want to take even a minor risk informing the target of the investigation?" There are a number of obvious answers: 1. He's promised his customer to do so. 2. It's in the contract. 3. And the ever-popular, "He's afraid of getting killed, or his ISP business torched, if word later leaks out that he failed to inform his customer of an investigation." Don't underestimate the significance of such a risk to those people. Destruction of even a full phone switch would not have fazed ATT in the 1960's, but a small ISP depends on valuable equipment at (presumably) a single location. Getting a person mad at them for failing to anonymously inform them of an inquiry would NOT be the best tactic for these small-time operators. >Even if a judge was convinced by the defense not to levy heavy fines >against a third party who pleaded that he or she was simply unable to >comply, informing the principal would literally assure such fines would >be imposed regardless. Again, you assume that informing "the principal" would be detectable. Your wishful thinking is palpable. I really wish you'd be able to distinguish what "the law" could do, given limitless knowledge of the actions of the population, and the REAL WORLD, in which those judges and prosecutors and cops are limited in what they can do by what they can know. This is critical, because we are rapidly approaching a time in which what these people know will be dramatically limited by many of the technologies regularly discussed on Cypherpunks. >Criminal charges of obstruction could easily attach. Bullets could easily fly. You repeatedly state what might, hypothetically, happen, but you don't back it up with a realistic assessment of what actually would _likely_ happen. > Obstruction in connection with narcotics cases or other major >felonies are generally extraditable offenses as well. Someday, obstruction of the Constitution by government agents will be a death-penalty crime. >Once again Mr. Bell pulls legal analysis out of his rectum rather than >basing it in fact or research. > >With Mr. Bell as a defense attorney, who needs prosecutors? If I intended to limit myself to the tools of the court room (that's the enemy's playpen, BTW) I would probably be just as ineffective as the next defense attorney. I've frequently found that the question of who wins in any confrontation is strongly affected by whether I allow myself to be lured into the home territory of the other. This is actually more a psychological battle than a physical one. You obviously believe that the cops and judges can frequently win, if they are able to control the location of the battle; this is true, but it ignores the fact that "the legal system" is generally an 8-hour-per-day, 40-hour-per week system. Going outside the system and attacking directly bypasses all the rules and restrictions which are set up to allow THEM to win. This may sound unfair to people brainwashed to believe that the court system is and should be the final arbiter, but I suggest that long ago they lost whatever moral authority they once might have had. Every time you talk about them fining or prosecuting some third party for not cooperating, you demolish your own claims. Jim Bell jimbell(a)pacifier.com

2 1

POT_ktl
by John Young 17 Dec '03

17 Dec '03

3-29-96 NYT reports on the Montana Freemen's competition with the USG: printing money and fostering free market brigandry; building arsenals for terrorizing the weak and suppressing dissent; amassing national security treasure for the protection of the people; and PC education to boot. The USG, looking in the mirror, says such actions are a criminal conspiracy, a "school for crime." POT_ktl

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 05:32 AM 3/29/96 -0500, Black Unicorn wrote: >On Thu, 28 Mar 1996, jim bell wrote: > >> At 03:46 PM 3/28/96 -0500, Black Unicorn wrote: >> >Given the significant contempt charges that can follow a refusal to >> >produce items (anonymous or not) this still depends on the absence of >> >initial detection. >> >> You clearly don't understand. You're making the ASSumption that the >> organization keeping the keys can produce them in a form that is "useful" to >> the cops. Escrowing encrypted keys makes them useless to subpoena, and in >> fact it helps the key owner because the escrow agent can (and, in fact, >> must!) be obligated to inform the key owner if his key is requested. > >You clearly don't understand. You are an ass making an assumption that a >court cares or believes that the witness can actually produce the >requested information or not. Fines tend to be imposed regardless. Bullets don't care that a judge was justified in his decisions, either. Ultimately, your repeated argument is simply, "The legal system can be abused by those who work in it." I don't challenge this claim, in fact my position depends on its truth; my assertion is that the current legal situation is out of the control of people faithful to the meaning of the Constitution, and has been so for a long time. One of the main reasons I promote a de-facto (and unofficial) death penalty for recalcitrant politicians and other government employees is because the traditional "checks and balances" system seems to no longer be working for the interests of the average citizen. >> And in any case, I consider it highly doubtful that anybody would contract >> with an escrow agent and identify himself by name > >The same way no one creates Panamanian companies with their own name. So >what? Third parties are still fined heavily. Any specific examples? No? I thought so! In any case, if "third parties" are "fined heavily," that is even more justification for setting up a method to deter out-of-control courts. Remember, freedom is always strongly disliked by authoritarian and totalitarian governments; you need to explain why the hypotheticals you're describing don't indicate that some emergency effort is needed. >>It would be a simple >> matter to operate "escrow agents," just glorified data-holders, who would >> receive data anonymously and send it out just as anonymously, to the person >> who can identify themselves via some sort of encrypted ID system. > >And simpler for courts to fine them out of existance (which happened to >several banks, trust companies and agents in Cayman and Panama. I guess you really don't realize that every claim you make demolishes the justification for your obvious hostility to a system which prevents exactly the kind of abuses you list. (Although it really isn't clear whether you would classify them as "abuses.") > Even >> "detecting" such a transfer is useless because the cops won't be able to >> figure out what the data is, since it's encrypted in both directions while >> being transferred, in addition to being encrypted while being held, with a >> code the escrow agent doesn't know. > >They need only suspect or have reason to suspect it might be exculpatory. _ ^^^^^^^^^^^ Sloppy word usage. I think you meant, "incriminating." Typical for you. >Practically speaking this means convincing a judge. Not hard when the >words "offshore holding company" are mentioned in a brief or hearing. > >> In short, you need to comprehend what you're responding to before you >> express your opinions. You're living down to my expectations. > >In short, go to law school, then try to talk about legal issues. In this day and in this country, "going to law school" is basically synonymous with "learn to get along with the current legal system." It should have been obvious long ago that I don't consider the current legal system to be worth living with. >> >> In fact, I suppose that government operation of the identification system >> >> (drivers' licenses, passports, etc.) in general is also horribly inefficient >> >> and should be attacked on efficiency grounds. >> > >> >You might not like what you get in response. Streamlined and uniform >> >identity documents generated at birth and renewed with tax filings would >> >be the likeliest efficiency improvement. An inefficient government >> >identification system is to the advantage of the privacy seeker. >> >> You seem to be ASSuming that an "efficient identification system" is one >> that will ALSO operate to the benefit of the government, as opposed to the >> individual who wants to be identified for only limited purposes. > >Without getting into semantics, and "efficient identification system" >implies one that identifies people efficently. Blocking government use, >or limiting it to certain circumstances is not efficiency. Only if viewed from the statist perspective, which I suppose is easy for you. An "efficient identification system" identifies me, efficiently, to anybody I _choose_ to be identified to, to whatever level of identification I choose to allow. Nothing more. Read Chaum's Sci Am article, carefully.

2 1

Re: Let's *NOT* "Raise their Awareness"
by rollo＠artvark.com 17 Dec '03

17 Dec '03

>>On Tue, 26 Mar 1996, David K. Merriman wrote: >>Yes, and some years ago a State legislature (I forget which) passed a >>resolution setting the value of pi at exactly 3. Well, this one has a grain of truth in it, but has drifted a bit in the telling. >From <alt.folklore.urban>'s FAQ: T. *Indiana House Bill #246 of 1897 would've set pi=3.2. Killed in state Senate. Fb. Some state (e.g., KS, OK, etc.) once considered a bill setting pi = 3 (or some other arbitrary, non-transcendental number). Key to Listed FAQs: T = 100% scientific truth Tb = believed true, but not conclusively proven F = 100% falsehood Ft = A legend, mostly untrue, but with a true occurrence or known origin. Fb = believed false, but not conclusively proven There is a comment, "*", on certain lines in the FAQ. This indicates that there is further information on this point available via anonymous ftp. See the AFU anonymous ftp sites noted in Part I of the FAQ for more information. The four part FAQ for alt.folklore.urban is also available via anonymous ftp at rtfm.mit.edu. You can retrieve them by grabbing the following files: /pub/usenet/news.answers/folklore-faq/part1 /pub/usenet/news.answers/folklore-faq/part2 /pub/usenet/news.answers/folklore-faq/part3 /pub/usenet/news.answers/folklore-faq/part4 /pub/usenet/news.answers/folklore-faq/part5 Or heck, just do: /pub/usenet/news.answers/folklore-faq/part* Rollo Silver | e-mail: rollo(a)artvark.com | Artvark | Home page: http://www.artvark.com/artvark/ | PO Box 219 | Voice: 505-586-0197 | San Cristobal, NM 87564 USA | Compuserve 71174,1453 | =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 04:54 PM 3/29/96 -0500, Black Unicorn wrote: >On Fri, 29 Mar 1996, jim bell wrote: >> >I thought I would take the time to let everyone know that this is >> >baseless as well. Most jurisdictions forbid third parties to reveal >> >prosecution inquries to the principal for which they are holding >> >documents or other information. A VERY few have laws on the books that >> >require this disclosure. Switzerland is no longer one of them. >> >> As usual, Unicorn is FOS. Not entirely in his facts, but in his >> conclusions. To "forbit third parties to reveal prosecution inquiries" is >> an obvious violation of freedom of speech, and in fact is PRIOR RESTRAINT. >> Maybe Unicorn can't see what's wrong with that, but I can. It is unclear >> whether this has ever been tested in court, or whether that test occurred >> recently. > >(Snore) How many cases do you want me to cite that hold that the >disclosure of an inquiry with the intent of evasion is conspiracy and >entails criminal charges? You _do_ have an odd way with words. "entails" criminal charges? Hey, they can charge ANYBODY with ANYTHING, but that doesn't mean that a crime has actually been committed. Further, it isn't clear that anybody is obligated to respond to a subpoena without the possibility of a court challenge, and your fantasy about the cops showing up and trying to strongarm the ISP is laughable at best. >Do you honestly think you can evade prosecution for suborning the >destruction of material evidence in a criminal trial? Who said anything about "destruction of material evidence"? Refusing to hand over information until AFTER a court has properly responded to a challenge to a subpoena is old hat to newspapers, TV stations, and other media-organizations who are occasioinally served with a subpoena. The ISP need merely say, I'm challenging this subpoena in court, go away motherfuckers! ISP prepares a challenge, "CC's" ALL the affected individuals, (including the person whose information is desired!), and the validity of the subpoena is tested. >Please. My feelings exactly. Please stop acting like a government suck-up all the time. Maybe you're paid to do it, but unless you're a plant, you're on your free time now. >> For example, if I ask my ISP to send me an anonymous, encrypted message with >> the word, "Rosebud" in it to me if he receives any requests to tap my >> connection, he can do so with no fear of being discovered, because no third >> party can decrypt the message, know who is is from, or know the real meaning >> of the word, "Rosebud" in the context of an encrypted, anonymized message. >> Further, since the whole thing is by pre-arrangement, even I cannot prove >> (to the satisfaction of a third party) that the message really meant what I >> would interpret it to mean. The message is useful to me, as a warning, but >> it could never turn around and "bite" the ISP. > >Unfortunately, by the time (in the case of domestic investigations, and >foreign investigations in more compliant jurisdictions) it gets to the >point where authorities are checking about, they will have walked into >the ISP and personally requested the information with subpoena in hand. Again, you blindly assume that the subpoena can't be challenged in court. It can be. >Perhaps the ISP with the nerve to destroy material evidence in the >presence of law enforcement exists, You keep inventing these phony scenarios, building up these straw men and knocking them down. Clearly, your underlying argument is quite weak. I said nothing about "destroying evidence." In fact, the ISP could simply encrypt everything with the target's public key, and keep it. That's not "destroying evidence," that's locking it away in such a way so that nobody except the target can unlock it. Ideally, this would be done automatically every time a person calls his ISP, although the software to do this probably doesn't exist yet. The result would be that whenever the target was NOT connected to the ISP, there would be no information on the ISP's system that could be decrypted by the ISP operator. This would be one of those inventive future uses of encryption, well beyond plain vanilla PGP, which we must assure ourselves will be developed. The kind of thing you dread, obviously. >but I sincerely doubt this ISP will >escape serious prosecution for doing it. I sincerely doubt Unicorn will ever stop being a government suck-up. > At the very least the employees >of the ISP will have knowledge of this practice. Unless it's a single >person run ISP, I doubt you're going to be able to keep everyone from >testifying. What you propose is a crime in the United States, and in >many foreign jurisdictions. If an ISP's system automatically encrypts all received message's with the destination's public key when received, and doesn't keep an unencrypted copy around, showing up at that ISP's location with a warrant will result in ZERO (ZIP, ZILCH, NEGATORI, etc) information that can be delivered, unencrypted, to the cops. >> The end result is that your foolish opinion of what the law allows will >> simply become irrelevant: The government cannot mandate what it cannot >> enforce, and it cannot enforce what it cannot detect. > >I have often noted that the best defense is the lack of detection in the >first place. No, an even better defense is to make it absolutely impossible, as a matter of business practice, to assist the police with any kind of an investigation. Before you go off and shoot your mouth off about how evil and bad that is, you need to remember that regular destruction of records is an acceptable practice in any company today. While courts will look askance at it when it does not appear to be a regular business practice (say, the company gets sued today and they have a mass shredding tomorrow) there is nothing wrong about regularly making past records unavailable by shredding, burning, erasing, or by any other method. Making those records SELECTIVELY unavailable by encrypting them with somebody else's public key and keeping them has probably never been tested in court, but if the business contracts this ISP regularly signs have this as a provision of doing business, the court can't squawk after the fact. After all, the ISP might have simply erased the files, keeping them from being accessed by ANYBODY, including their "owner." > Unfortunately this is the oft denounced "security through >obscurity." Look, I know it's fun to imagine you can thwart the >authorities with impunity within the United States. Hey, you can FREQUENTLY "thwart the authorities." If I have evidence of a crime in my house, the cops can't come in unless they have a warrant. If I know they're coming, and can destroy it untraceably, I WIN! See, that's how freedom works! It's nearly the exact opposite of "the government can do anything it wants, any time it wants, and anybody who frustrates them is a criminal!" Naturally, you won't like this. >Unfortunately it is >a fantasy. The system you propose requires someone to be present in the >ISP 24 hours a day. It requires some method of getting word to the >operator who will trigger the alarm both that an investigation is >looming, and who it entails. It requires someone to talk to the >authorities and stall them while the message is sent. It requires you to >be sitting at the screen when the message is received (perhaps this isn't >a problem for Mr. Bell), or to get home before the law enforcement >officials get a 2 hour warrant and open your door. Yet another one of your multiple problems is that you have no imagination when it comes to "thwarting the authorities." I do. Don't try to tell me what can't be done, because I'll turn around and tell you how it CAN be done! I just did. The actual implementation waits for some slick coder to do it, but I give you 5 years, tops, before it's in regular usage. And that's assuming they're all a bunch of lazy bastards. >> 3. And the ever-popular, "He's afraid of getting killed, or his ISP >> business torched, if word later leaks out that he failed to inform his >> customer of an investigation." > Don't underestimate the significance of such >> a risk to those people. Destruction of even a full phone switch would not >> have fazed ATT in the 1960's, but a small ISP depends on valuable equipment >> at (presumably) a single location. Getting a person mad at them for failing >> to anonymously inform them of an inquiry would NOT be the best tactic for >> these small-time operators. > >Your last resort in all of your arguments seems to be murder, extortion, >the threat of bodily harm, arson or assault, or destruction of private >property. A list which seems to be the current modus operandi of most levels of government in America, today. In any case, I think it's fair to hold an ISP to his word and contract. If the "normal" referee to such contracts (the court system) becomes biased because it begins to be an interested party to the enforcement of the contract terms, then bypassing that court system is unavoidable and is entirely appropriate. You won't like this, either. >> >Even if a judge was convinced by the defense not to levy heavy fines >> >against a third party who pleaded that he or she was simply unable to >> >comply, informing the principal would literally assure such fines would >> >be imposed regardless. >> >> Again, you assume that informing "the principal" would be detectable. Your >> wishful thinking is palpable. > >No. I speak from experience when I say that "proof" of complicity is >rarely a requirement. The judge need only suspect wrong doing. It's >easy to levy contempt fines, and very hard to overturn them. It's easy to kill, and hard to resurrect the dead. >The >standard in most jurisdictions is "clearly erronious." Tough stuff. Yes, I'd say you're "clearly erronious." If you can repeatedly describe, in nominally accurate terms, how abusive the government has become and NOT oppose its actions with every fiber in your being, then YOU have made yourself part of the problem. > >> I really wish you'd be able to distinguish >> what "the law" could do, given limitless knowledge of the actions of the >> population, and the REAL WORLD, in which those judges and prosecutors and >> cops are limited in what they can do by what they can know. This is >> critical, because we are rapidly approaching a time in which what these >> people know will be dramatically limited by many of the technologies >> regularly discussed on Cypherpunks. > >Unfortunately, fines and penalities are imposed every day based on >assumptions by the trier of fact. Go watch a major court case some time. You still haven't given me specific examples. >> Bullets could easily fly. > >And will. I've seen this happen. Trustee refuses to produce documents, >court imposes compelled discovery, documents burn or are lost or have been >stolen, trustee (who can be assigned no direct evidence of complicity) is >fined heftily. A case I was not personally involved in saw the judge >jail the trustee for 4 months. That's not what I'm referring to. Judges are mortal. If they abuse the sense of propriety of the average indidivual, they SHOULD be removed, by legal methods if possible, by other methods if not. Remember that prosecutor who died in Boston a few months ago? You know, the one who made the national news? I'm still waiting to see how that one came out, but I suspect they will never be able to prove who did it, and may not even be able to find out. >> >With Mr. Bell as a defense attorney, who needs prosecutors? >> >> If I intended to limit myself to the tools of the court room (that's the >> enemy's playpen, BTW) I would probably be just as ineffective as the next >> defense attorney. > >So again, we see Mr. Bell in his basic form. Violent offender. He will >obtain by force that which he cannot argue into his hands. Except that in a court room, the decision maker is PAID by a party to the case, the government. That sounds like a classic conflict of interest to me. What's the old rhyme, "Treason doth not prosper, what is the reason? Where treason does prosper, none dare call it treason." Jim Bell jimbell(a)pacifier.com

2 1