December 2003 - cypherpunks-legacy

Re: Riding online elevators (Was CNN: Anonymous Stock Tips
by Deranged Mutant 17 Dec '03

17 Dec '03

On 2 Jun 96 at 1:00, Harry Bartholomew wrote: > > In my mail this morning was this bit of spam, I never heard of this guy > > before, Likely scooped my mailing address from misc.invest.stocks. [..] > No. Seems to have gone to all cypherpunks. I've never heard of > misc.invest.stocks. The only time I saw it was in that post... thankfully. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

No Subject
by John D. Ervin 17 Dec '03

17 Dec '03

list John D. Ervin Also known as "Felix1" jervin(a)netpath.net

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by minow＠apple.com 17 Dec '03

17 Dec '03

> >One of the oldest tricks for running a stock up (or down) is >to put rumor teams on elevators in the financial district of >major cities. It would be more efficient to talk about the rumor on a cellular phone. Probably make a nice sting scenario, too. Martin Minow (who expects a cut of the reward money). minow(a)apple.com

1 0

Re: Java Crypto API questions
by minow＠apple.com 17 Dec '03

17 Dec '03

>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on >the eagerly awaited (at least by this user) Java Crypto API. Here are my notes (and between-the-lines observations) from the Java crypto sesions (which were very well received). Watch the Java web sites for transcripts from JavaOne sessions. (but I don't know if the BOF will be available). -- Security is *important* -- zero tolerance for security bugs. Gosling said in his keynote that it changes things when people send their bug reports to USA Today. -- They're working with standards folk: W3C, IETF. -- Clean, simple design, paying attention toll aspects of security design: language, virtual machine, components (libraries). -- Adding digital signatures to code enables greater trust -- the user can allow an applet to "escape from the sandbox." -- Policies = Assertions + Capabilities. That's what my notes say -- I think it means that the user can use a signature to authenticate the applet's author/publisher and allow it greater capabilities. For example, a stock trading applet might be granted the capability to access a stock price service (Dow Jones) *and* a stock trading service. The current applet model only allows remote connection to the site that distributed the applet. -- Java will allow signing archives (a set of classes and resources). -- Network-centered security: digital signatues, encryption, key exchange, hash, bignum, random number generators. -- Packages (third-party applets) communicate with security packages through an abstract layer. There may be multiple packages. -- They will provide a secure key storage (like Apple's PowerTalk today, I presume) where "all" of your keys are held under a a single password. Rogue applications (applets?) can't leak keys. -- Feedback to security-api(a)java.sun.com. -- There's a white paper on the verifyier on the sun web site. -- They're writing a security policy for applications (applications function like "ordinary" Unix/Mac/whatever applications. -- User preference to designate capabilities for signed/unsigned applets. ---- ---- ---- Notes from the security birds of a feather session ---- ---- ---- -- Need multiple security managers: if any say no, reject the request. -- Servet, applet need different security managers. -- Problem with firewalls: client accesses server via firewall via proxy servers. May not be able to open a URL directly. -- Java Commerce API coming for payment functions. -- Problem with foreign applet vendors: how can a non-US security class vendor certify a class to be used (outside the US). Currently, it must be imported and signed by Sun. But, then it can't be exported without a Commerce Department license. No (current) plans to establish a signing authority outside of the U.S. Martin Minow minow(a)apple.com

1 0

premail manual info
by test921148＠alpha.c2.org 17 Dec '03

17 Dec '03

Whopee! Just installed premail. But I have a Question on how to use it. I need some Manual explaining how to use Premail and what can I put into its Configuration-file. I use Version 0.43 of Premail. The perl Script is somewhat readable but it is better if some User-manual was available. Send Answers to test921148(a)alpha.c2.org

1 0

INFO: Sen. Burns urges White House to follow NRC recommendations (6/2/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| SEN. CONRAD BURNS URGES CLINTON TO REASSES ENCRYPTION POLICY AND ANNOUNCES HEARINGS ON THE ISSUE for 6/12/96 REP. RICK WHITE (R-WA) SCHEDULED FOR HOTWIRED CHAT 6/5/96 9-10PM EST SEN. CONRAD BURNS (R-MT) SCHEDULED FOR HOTWIRED CHAT 6/11/96 10-11PM EST Date: June 2, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents News Text of Sen. Burns' letter to President Clinton How to receive crypto-news ----------------------------------------------------------------------------- NEWS Sen. Conrad Burns (R-MT), principal co-sponsor of legislation to ease restrictions on encryption, yesterday sent President Clinton a letter urging the Administration to reassess its encryption policy in light of a recent report by the National Research Council. The findings contained in the NRC study, released at a briefing in Washington DC on Thursday, raise serious questions about the rational for the Administration's current approach to cryptography policy. The study states explicitly, "Current national cryptography policy is not adequate to support the information security requirements of an information society." In his letter to the President, Senator Burns said that the NRC study presents overwhelming evidence that the current approach to encryption policy has failed. Burns also pledged to hold hearings in the Senate Commerce Committee on June 12 and 26. The night before the hearings (June 11 at 10 pm ET), Senator Burns will be live online at HotWired (http://www.hotwired.com/wiredside) Be sure to save the date and stop by to talk with the Senator about his efforts to encourage the widespread availability of strong encryption and get a preview of the hearings on the Pro_CODE bill. Information on Senator Burns' legislation, as well as information on the NRC report, is available at http://www.crypto.com DON'T FORGET! Representative Rick White (R-WA) will be on HotWired Wednesday June 5th at 9pm EST at http://www.hotwired.com/wiredside/ You can tune in and listen to the chat with the RealAudio software (http://www.realaudio.com) You can ask questions of the Representative through a moderator and get real, immediate responses. ----------------------------------------------------------------------------- TEXT OF SEN. BURNS' LETTER TO PRESIDENT CLINTON May 30, 1996 The President The White House Washington, D.C. 20500 Dear Mr. President, I urge you to reassess the administration's position on cryptography policy in light of the report released today by the National Research Council, "Cryptography's Role in Securing the Information Society." The report was put together by the NRC Committee to Study National Cryptography, which included members from across the spectrum of the business, academic, defense and intelligence communities. The fact that such a diverse roster of our brightest minds could achieve consensus after taking two years to pore over the details of encryption policy is remarkable, and their recommendations should be taken most seriously. The acronym of the report's title-CRISIS-is especially apt given the massive economic and national security costs of the current policy, which severely restricts the export of software containing strong encryption. As the report states, "Current national cryptography policy is not adequate to support the information security requirements of an information society. Indeed, current policy discourages the use of cryptography, whether intentional or not, and in so doing impedes the ability of the nation to use cryptographic tools that would help to remediate certain important vulnerabilities." As the Chairman of the NRC Committee to Study National Cryptography, Kenneth Dam, states in the report "the crisis is a policy crisis, rather than a technology crisis, an industry crisis, a law enforcement crisis, or an intelligence-gathering crisis..." The most recent version of the administration's policy, as reflected in the draft white paper of the interagency working group on encryption, unfortunately reveals a continuing commitment to government-imposed mandates rather than private-sector solutions. The proposal, which was quickly dubbed "Clipper III" because of its close alignment with the earlier rejected Clipper schemes, has the support of neither the software industry nor the Net community. Indeed, as the Committee noted, an essential flaw behind the administration's policy is the continuing reliance on the national security and law enforcement communities to drive the policy through administrative diktat rather than open legislative action. As the report states, rather than vainly attempting to reign in the inevitable widespread use of strong encryption, the administration should be actively promoting it. The use of strong encryption has become vital to both ensuring the privacy of individuals and fostering the growth of the Global Information Infrastructure into the 21st century. As for the national security aspects of encryption policy, the report states that cryptography can protect proprietary information and reduce economic espionage. In addition, strong encryption can protect nationally sensitive information systems and networks against unauthorized penetration. Therefore, the use of strong encryption serves to protect national security rather than hinder it. Simply put, "on balance, the advantages of more widespread use of cryptography outweigh the disadvantages." I further call your attention to specific recommendations by the Committee: *National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. *No law should bar the manufacture, sale, or use of any form of encryption within the United States. *Export Controls on cryptography should be progressively relaxed. *The U.S. government should promote the security of the telecommunications networks more actively. *The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. *Aggressive government promotion of escrowed encryption is not appropriate... *The debate over national cryptography policy can be carried out in a reasonable manner on an unclassified basis. *National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. A core recommendation of the Committee is that the administration foster an open public debate so that a national consensus on cryptography can be developed. I agree wholeheartedly and hope that the public hearings beginning on June 12 in the Commerce Committee's Subcommittee on Science, Space and Technology, which I chair, will help foster this process. Many of the NRC's recommendations are reflected in the "Burns Pro-CODE bill," S. 1726, which will be debated on that date, with an additional hearing to be held on June 26. Now that some of the best scientific and technical minds in the country have essentially endorsed the position that business and policy advocates have been taking for years, it's time for the administration to come around as well. In conclusion, I can only agree with the Chairman Dam's statement: We believe that our report makes some reasonable proposals for national cryptography policy. But a proposal for action. What is needed now is a public debate, using and not sidestepping the full processes of government, leading to a judicious resolution of pressing cryptography policy issues and including, on some important points, legislative action. Only in this manner will the policy crisis come to a satisfactory and stable resolution. Sincerely, /s/ Conrad Burns U.S. Senator ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

Re: [Off-Topic] "Curfews"
by jim bell 17 Dec '03

17 Dec '03

At 07:45 PM 6/1/96 -0700, Timothy C. May wrote: >At 1:59 AM 6/2/96, Duncan Frissell wrote: > >>Of course curfew laws only control the inarticulate and scruffy. Well >>dressed children (coat and tie for the boys dress or suit for the girls) who >>can claim that they are out doing tons of protected things like work and >>school and worship and political campaigning and "trying to save street >>children for Jesus" will not be picked up. They can also say things like > >This, by the way, is the main thing that concerns certain civil rights >groups (including the Santa Cruz chapter of the ACLU). They say they'll be >monitoring enforcement patterns to see if more "children of color" are >picked up than their percentage in the population represents. This, the curfew situation, is yet another of the reasons I'd favor "playing hardball" with the government. I'm very much against discriminatory enforcement, but on the other hand I don't think my liberty should be dependent on getting an organization like the ACLU to look out for and complain against discrimination against me. I feel if a group of left-handed albinos think the police are being too hard on left-handed albinos, they shouldn't have to convince the ACLU of this, and should be entitled and able to fight back effectively and prevent what they view as abuse. True, such a situation may occasionally lead to abuses, but I strongly expect that those abuses will be far fewer than the current system. Jim Bell jimbell(a)pacifier.com

2 1

(no subject)
by ira 17 Dec '03

17 Dec '03

1 0

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 09:30 AM 6/2/96 -0700, Martin Minow wrote: >>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on >>the eagerly awaited (at least by this user) Java Crypto API. >---- ---- ---- >Notes from the security birds of a feather session >---- ---- ---- > >-- Need multiple security managers: if any say no, reject the request. >-- Servet, applet need different security managers. >-- Problem with firewalls: client accesses server via firewall via > proxy servers. May not be able to open a URL directly. >-- Java Commerce API coming for payment functions. >-- Problem with foreign applet vendors: how can a non-US security > class vendor certify a class to be used (outside the US). > Currently, it must be imported and signed by Sun. But, then > it can't be exported without a Commerce Department license. > No (current) plans to establish a signing authority outside > of the U.S. We've heard this assertion before. Why not import the software, generate a detachable signature, and then export the signature for re-attachment overseas? Surely export of signatures isn't controlled (even arguably) by ITAR. Jim Bell jimbell(a)pacifier.com

1 0

Insider Trading and Inside Information
by mpd＠netcom.com 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) writes: > And, how can someone who acts on overheard information--as > in the elevator example Sandy cited--be charged with any > crime? Unless they are "insiders," covered by SEC rules > about trading, they are free to act on essentially anything > they hear. "He who hesitates to act on inside information is > lost." > (To elaborate on this: I was never classified as an > "insider" during my time at Intel, and I certainly bought > and sold the stock based on what products and news I knew > was coming out or what rumors I'd heard. Only a select group > of executives and staff in the specific departments > generating earnings announcements, auditing, etc., were > covered. And senior executives are covered by various rules > about trading stocks. And family members and friends may be > covered, if they learn of "inside" (in the SEC sense) > information. The SEC, in cooperation with the courts, has been gradually shifting the definitions of "insider" and "inside information" to more all-encompassing ones. It used to be that an insider was an officer of the company, or someone with a fiduciary relationship to the firm, such as a auditor or investment banker with which the firm did business. Inside information was also similarly limited to a narrow collection of material subject to regulatory restrictions on its disclosure. Nowdays "inside information" has been expanded to include anything that the general public is not privy to, and "insiders" can be almost anyone as well. Indeed, the current definitions can subject to criminal sanctions low level employees trading their company's stock on the basis of rumors, or newspaper columnists trading in anticipation of reaction to their published speculations. It's not even safe to trade on what formerly would have been known as "hot tips" any more, unless the average person in the street had a mechanism to access the information. The legal theory behind all this is that anyone, no matter who they are, trading on any publicly unavailable information, no matter what it is, might be perceived as profiting at the expense of the zillions of ordinary investors, whose continued playing of the Stock Lottery^H^H^H^H^H^H^H Market the govermment and big business definitely want to encourage. Not to mention the huge public support for the prosecution of anyone who the public thinks has "gotten away with something" that Joe Six-Pack didn't have the opportunity to do, and made a few bucks in the process. If this trend continues, I won't even be able to take an Intel janitor to lunch, and trade the stock based on his impression that Andy Grove looked particularly happy while having his office cleaned, without risking an "insider trading violation" should the stock go up. A new and interesting manifestation of the "Surveilance State." -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Ok, what about PGP (was: MD5 collisions)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 May 96 at 1:26, Chris Adams wrote: > How about a NSA-stomper option that would use all-of-the-above? For the truly paranoid (or > owners of Pentium-Pro 200Mhz multi-processor machines Chances are that if the algorithms alone aren't "NSA-stompers", an all-of-the-above option won't be. > Also, what's the verdict on IDEA? Is there a switch yet that would allow straight RSA? > (with the obvious speed decrease...) That would actually be less secure. RSA may be PGP's weakest link. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

penet to be compromised again? More Scientology lawsuit crap
by Deana Holmes 17 Dec '03

17 Dec '03

I just received some information on IRC channel #scientology that Julf Helsinghuis is being sued by $cientology *yet again* for a name. Apparently this has to do with the deposition request to Homer Wilson Smith (lightlink.com) Scamizdat #3 was posted through lightlink.com and the $cientologists have wanted for a long time to figure out who did it. (Which is why they sued Grady Ward.) Homer, in response to the deposition request, consulted his logs, and said that the original post came from penet.fi. So $cientology has apparently gone to the Finns again to ask that Julf be forced to give up the name. I'm appending a copy of the IRC log, as I'm too lazy to edit it down to particulars. It includes the name of the police officer involved (Kaj Malmberg) as well as a Finnish newsgroup and article id for the whole story. If someone knows Finnish and can give a rough translation, it would be terribly appreciated by a lot of people. <enclosed IRC transcript> <Ignatius> hi guys... do you have the latest news on Julf Helsingius' case? > Ig: what do you mean, latest news? <Sherilyn> The julf case? * Sherilyn didn;t know there _was_ a julf case... <Ignatius> ok... copyright offences are crimes under Finnish law, not torts. <Ignatius> Kaj Malmberg, the Finnish police officer who handles the investigation of the copyrighted material through penet.fi, posted an article to a domestic newsgroup today. <Sherilyn> Do you have the message-id and group name? <Ignatius> the scienos have filed a motion at a local court in Helsinki to force Julf Helsingius to give out the name of the poster. <Ignatius> sherilyn, are you good at Finnish? <Sherilyn> ig: lol! <skaplin> Who posted what through penet?? <Ignatius> the hearing is scheduled for the beginning of next week... perhaps already tomorrow. <Sherilyn> So was penet the server before lightlink in the scamizdat case? <Sherilyn> Homer gave them the name of the prior server, or was going to *** skaplin changes topic to "Penet under attack...Again!" <Sherilyn> Well this needs to be put out loud on groups where people use penet <skaplin> Ignatus: How good are you at translating? <Sherilyn> Last attack on penet got the scientologists a very bad rep > Ig: We need that post. > IN ENGLISH > ASAP! > even if it's a lousy translation. <Sherilyn> This cop guy speaks English <Sherilyn> Didn't he post in English to a.r.s.? > Sheri: he may not want to post it on a.r.s <Sherilyn> It's true, skap <Ignatius> i don't know more than what I already mentioned. The police officer didn't even mention Scientology; he just mentioned that he was investigating a copyright offence. <Sherilyn> She would make a lovely domina > sheri: you should see what I'm reading now :) <skaplin> We're sure penet is under attack for a name though... <Sherilyn> Bloody hell fire! <Sherilyn> I have 6440 posts downloading! <Ignatius> i'm writing an article to post to the ng:s, but it's obvious we don't have all the bits of the puzzle yet. <skaplin> Want some kippers with your spam sheri?? :) <skaplin> Ignatus: What newsgroup was it in? > ig: please post it asap. > also, send it to rnewman(a)cybercom.net. <Ignatius> skap, sfnet.keskustelu.laki; <4os5bu$flp(a)idefix.eunet.fi> <Ignatius> the police officer, Kaj Malmberg, is at kaj.malmberg(a)helsinki.poliisi.fi <end of transcript> Deana Holmes mirele(a)xmission.com

1 0

Re: Java Crypto API questions
by minow＠apple.com 17 Dec '03

17 Dec '03

Jim Bell writes: >>-- Problem with foreign applet vendors: how can a non-US security >> class vendor certify a class to be used (outside the US). >> Currently, it must be imported and signed by Sun. But, then >> it can't be exported without a Commerce Department license. >> No (current) plans to establish a signing authority outside >> of the U.S. > >We've heard this assertion before. Why not import the software, generate a >detachable signature, and then export the signature for re-attachment overseas? > I suspect (but don't have any direct knowledge) that strong crypto classes are distributed after encryption by Sun's private key. The corresponding public key is enbedded in the Java Class Loader and/or virtual machine (or the security framework class -- I'm only speculating here). This means that "rogue" encryptors can't work under Sun's security manager as they will be rejected as "unloadable" Martin Minow minow(a)apple.com

1 0

Class III InfoWar: TST Article
by jya＠pipeline.com 17 Dec '03

17 Dec '03

This is the article Winn Schwartau cited to last night: ---------- The Sunday Times (London), June 2, 1996, pp. 1, 24. City surrenders to L400m gangs [Insight column] City of London financial institutions have paid huge sums to international gangs of sophisticated "cyber terrorists" who have amassed up to L400m worldwide by threatening to wipe out computer systems. Banks, broking firms and investment houses in America have also secretly paid ransom to prevent costly computer meltdown and a collapse in confidence among their customers, according to sources in Whitehall and Washington. An Insight investigation has established that British and American agencies are examining more than 40 "attacks" on financial institutions in London and New York since 1993. Victims have paid up to L13m a time after the blackmailers demonstrated their ability to bnng trading to a halt using advanced "information warfare" techniques learnt from the military. According to the American National Security Agency (NSA), they have penetrated computer systems using "logic bombs" (coded devices that can be remotely detonated), electromagnetic pulses and "high emission radio frequency guns", which blow a devastating electronic "wind" through a computer system. They have also left encrypted threats at the highest security levels, reading: "Now do you believe we can destroy your computers?" The authorities have been unable to stem the attacks, which are thought to onginate from the United States. In most cases, victim banks have failed to notify the police. "They have given in to blackmail rather than risk a collapse in confidence in their security systems," said a security director at one blue-chip merchant bank in the City. A senior detective in the City of London police said: "We are aware of the extortion methods, but the banking community has ways of dealing with it and rarely reports to the police." European and American police forces have set up special units to tackle the cyber criminals, who, Ministry of Defence sources believe, have netted between L200m and L400m globally over the past three years. But law enforcement agencies complain that senior financiers have closed ranks and are hindering inquiries. Experts in the field of information warfare met in Brussels last month to discuss defensive measures. Representatives included Captain Patrick Tyrrell, assistant director of computer information strategy at the Ministry of Defence; General James McCarthy, professor of national security at the US Air Force Academy; General Jean Pichot-Duclos, director of the economic intelligence department of the French Defence Council, and senior figures from the civilian computer industries. A separate closed meeting involving representatives from Whitehall and the intelligence community was held to analyse the 40 attacks on British and American financial centres since 1993. A further secret seminar took place in Washington this weekend. Kroll Associates, the international investigating firm, confirmed last week that it had acted for financial institutions that have been blackmailed. "One of the problems we face is that the potential embarrassment from loss of face is very senous," said a spokesman in New York. Kroll had evidence that firms in London and New York had been targeted. "The problem for law enforcement is that the crime is carried out globally, but law enforcement stops at the frontier," he said. Yesterday a Bank of England spokesman acknowleged the threat from the extortionists: "We are aware of this. It does exist. It is extortion and fraud." But the spokesman also insisted: "It is not the biggest issue in the banking market." Scotland Yard is now taking part in a Europe-wide initiative to catch the cyber criminals and has appointed a senior detective from its computer crime unit to take part in an operation codenamed Lathe Gambit. Such is the secrecy that few details about the inquiry have emerged. In America, the FBI has set up three separate units to investigate computer extortion. The NSA believes there are four cyber gangs and has evidence that at least one is based in Russia. The agency is now examining four examples of blackmail said to have occurred in London: + January 6, 1993: Trading halted at a broking house after blackmail threat and computer crash. Ransom of L10m paid to account in Zurich. + January 14, 1993: a blue-chip bank paid L12.5m after blackmail threats. + January 29, 1993: a broking house paid L10m in ransom after similar threats. + March 17, 1995: a defence firm paid L10m in ransom. In all four incidents, the gangs made threats to senior directors and demonstrated that they had the capacity to crash a computer system. Each victim conceded to the blackmailers' demands within hours and tranferred the money to offshore bank accounts, from which it was removed by the gangs within minutes. The techniques have varied. In London, criminals posing as marketing firms have gained detailed knowledge of a target's system by interviewing the heads of information technology departments. In some cases, they have even issued questionnaires to unsuspecting officials. Armed with this information, they have been able to breach security and leave encrypted messages warning of their capability. The gangs are believed to have gained expertise in information warfare techniques from the American military, which is developing "weapons" that can disable or destroy computer hardware. Some are also known to have infiltrated banks simply by placing saboteurs on their payroll as temporary staff. Little is yet known about the identities of the gangs but, according to the NSA, America is the main source of the attacks. It believes that at least one other group originates from Russia and has followed the movement of money to the former Soviet states. A spokesman for the Metropoiitan poiice said: "There is potential for extortion from those purporting to know how to damage computer systems. "The computer crime unit liaises where necessary with its Euro counterparts to discuss cross-frontier crimes." One merchant bank director said yesterday: "You will never get a financial institution to admit it has an extortion policy, let alone that it has paid money to blackmailers." ----- Additional reporting: Peter Warren [End]

4 4

No subject
by an633169＠anon.penet.fi 17 Dec '03

17 Dec '03

replying to ping --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: NSCP, PRZ Hit NRC Crypto Rec
by Chris Adams 17 Dec '03

17 Dec '03

> The report noted that the FBI has argued for years that its > law-enforcement efforts would be hampered if drug cartels > and other organized criminals began using codes that > couldn't be deciphered. Courtordered wiretaps, a major tool > used to break organized-crime cases, could become useless, > the FBI has contended. I've wondered the same thing about gun control efforts. Who are they worried about? Criminals. By definition, what is a criminal? One who breaks the laws. Are they seriously thinking that a) criminals might stop doing things because they are illegal? (For shame - I was going to use PGP to protect my child pornography sources. Good thing I found out it was illegal before I did that!) and b) criminals would not be able to buy programmers/etc to secure *their* privacy if they felt it was needed? /* From Chris Adams <adamsc(a)io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5! The Enigman Group - We do Web Pages! */ This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com.

1 0

The decline and fall of Australia
by TT 17 Dec '03

17 Dec '03

Just in case people on this list were under any delusions that Australia part of the free world get a load of this... **begin press release** Hon. J.W. Shaw, QC, MLC Attorney-General and Minister for Industrial Relations ------------------------------------------------------------------------ Level 20, Goodsell Building, Facsimile (02) 228 7301 Chifley Square, Sydney NSW 2000 Telephone (02) 228 8188 ------------------------------------------------------------------------ PAEDOPHILIA SHOULD NOT BE ENCOURAGED BY THE INTERNET The Attorney General Mr Jeff Shaw, QC, MLC, today explained the draft internet regulation legislation to members of the internet community who had apparently misunderstood the plans. "Despite their protests, those who support total freedom on the internet have yet to explain to me why material involving paedophilia should be readily available and encouraged on the internet", he said. "Those who assert that the proposals are a knee jerk reaction are completely wrong and appear to have been totally uninterested in the issue until very recently. For on 7 July 1995, a consultation paper on internet regulation was released both on the World Wide Web and in paper form. "That 'Consultation paper on the Regulation of On-Line Information Services,' has now been available from the Federal Attorney General's Department for almost a year. "When it was released, submissions were requested, and 121 submissions were received by the closing date of 1 September 1995. "Following unanimous endorsement of the proposals by all Attorney's General, the NSW Parliamentary Counsel drafted legislation based on the discussion paper and the consultation process. This legislation will be discussed by the Standing Committee of Attorney's General in July. "Those protesting about the proposed offences and penalties are conveniently ignoring half the story - the fact that the draft legislation creates broad defences that encourage compliance with approved codes of practice or the taking of reasonable steps to ensure the proscribed behaviour does not occur. "Why should a Government not prosecute a service provider who supplies the Internet to schools, yet refuses to install appropriate firewalls to screen out material involving explicit sex and violence or child sexual abuse? "The broad defences recognise, as I do, the impossibility of monitoring all data that goes through service providers systems, but encourage providers to maintain maximum awareness, not maximum ignorance, about the material disseminated. "Criminal sanctions are only aimed at operators and users who culpably breach the standards that are set out regarding material that they transmit or advertise, or those who fail or refuse to exercise any effective controls over material that is publicly available through their information services. "For example, people who have objectionable material placed on their bulletin board without their knowledge could argue that they are not liable as they had obtained undertakings from users that certain types of material would not be posted or posted inappropriately. They may also be able to demonstrate that they had conducted random checks of material available through their information service. "I do not believe that the community condones the easy availability of material encouraging paedophilia and other sexual abuse. The impossibility of absolute regulation does not justify a complete failure to do what we can to meet reasonable concerns. "I would hope that organisations like the Electronic Frontiers Association are interested in assisting the State and Federal Governments formulate workable proposals that will protect children while allowing adults freedom of expression on the internet. If they in fact are, detailed proposals about how this could be best achieved would be useful." **end** As to that last para I think u could read..."cos we have no bloody idea what we are doing or how to achieve this all on our lil lonesomes" Thank the gods for cypherpunks..

1 0

Re: [Off-Topic] "Curfews"
by Blake Wehlage 17 Dec '03

17 Dec '03

At 05:22 PM 6/2/96 -0400, Alan Horowitz wrote: >I'm more concerned about the other side of the coin. > >The next time there's street riots because a jury decided to think for >itself, will the ACLU be issuing quota guidelines that mandate that all >black arrestees above (percentage-of-population) be given a >"get-out-of-jail-free-for-pulling-a-bystanding-trucker-out-of-his-cab-and >slamming-his-head-with-bricks" card? > > Cool where can I get one of those? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Blake "Pokey" Wehlage Gaa- 3.69 <jwilk(a)iglou.com> Record- 2-4-4 Age- 13 Final Standings- 2nd Place (Beat in Championship) President & Founder: Revolution Software "I have the fastest glove in the east!" Profanity Software "Hackers never stop hacking they just get caught" VSoft My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie til' 5:00p, hack til' 7:00a Hank Aaron- d:-)!-< Pope- +<:-) Santa Claus- *<:-) The Unabrower |:-) Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

NRC Session Hiss
by jya＠pipeline.com 17 Dec '03

17 Dec '03

During the Q&A of the NRC public session, it was asked why 56-bit DES was selected as the standard of export over other widely distributed programs such as PGP. The panelists seemed to me uneasy in answering this. Primarily their view was that DES was "ubquitious," well- known and tested by use. However, when pressed by later questioners on this topic, they expanded their view: that if another, stronger, program became "ubiquitous" -- in wide use -- they would support it as the standard of export. When it was pointed out that PGP now fit this definition, the panel merely repeated the statement about ubiquity without specifically affirming or denying the PGP claim. Their poker faces seemed uniformly in place to dampen a potential inflammatory topic. Perhaps other attendees will amplify this odd demeanor, but it seems to me that the panel was attempting to avoid commenting one way or the other on PGP's worldwide ubiquity for unstated reasons. I wonder if this was a nudge to the audience that the informal spread of unapproved encryption is the best way to establish its ubiquity and thereby to set a new standard for export, sort of under the noses of the authorities -- as if PGP was exemplary. Recall that this fits the Clinton administration's way of getting around the Croatian arms embargo -- the "no position" position of sidestepping legality. Also, I wonder if the panel wants avoid an open conflict with the administration, the LEAs and the security agencies about PGP. (Or do they know something about PGP that we don't know, or have been led to think they do?) Peter Neumann had pointed out earlier that crypto was going to be ubiquitous, and fairly soon, no matter what. He noted that it is the NRC's recommendation that LEAs take the "long-term, pro-active" view about this and get on with developing other technologies, and training personnel in them, to fight computer crime -- like traffic analysis, packet trace, etc. -- and to accept that prohibiting and cracking crypto is not effective. (This may have been diversionary, but he seemed sincere.) Perhaps the panel is agreeing the crypto genie is out of the bottle, and are advising the authorities to recognize that stronger and stronger crypto is going to become ubiquitous, and it's time to move on to other, presumably less ubiquitious, cyber-crime fighting technolgies. Perhaps the committee was briefed on these technolgies, or maybe some members are even developing them -- Mr. Neumann, for example, in conjunction with Ms. Denning, et al. Those who plan to attend the June 6 session might want to pursue the "no position" position about PGP's ubiquity, and why. Diversionary sop, say, to cover the promotion of non- crypto invasion of privacy. Further, it would be helpful to learn more about what the the committee members were told about "long-term" cyber- surveillance technologies in the pipeline. What bothered me more than anything else about the session was that individual privacy got such short shrift by panelists and by the audience. While there was a bit of discussion on personal privacy protection, government and business, and their mutual back-scratching, seemed to the the primary focus. Pretty Lousy Privacy appears to be in the works, judging from what was not disclosed in the session (and in the report) about two 800-pounders working in concert at citizen data gathering, mining, selling, controlling, dominating -- at the expense of individual privacy, and, shout it, liberty. Peter Neumann got to me when he described the "downside" of anonymity, encryption and security: how can we know who are the criminals if we don't for sure who is who and know for sure who is doing what? Not a single panelist disagreed with his statement about this, but then I heard only a few snorts from the criminal-fraught-fed audience. I kept mum. Jesus, who knows who was recording every titter and hiss -- besides anonymous beside me and me.

3 2

Re: opinions on book "The Truth Machine"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:14 AM 6/3/96, Adam Back wrote: >Well, we don't have curfews yet, but they're getting keen on security >video cameras lately, the university has a few even, on top of >buildings, the steerable variety, and with what I presume are IR spots >mounted on them. Today's newspaper (SJ Mercury News) carried a long article about increasingly ubiquitous video surveillance cameras, and singled out the U.K. as a place that is leading. Apparently even small villages have 50 or more cameras scattered around...men have been arrested for urinating in bushes outside pubs, caught by the infrared pickups (I hadn't thought about the cameras being IR, but this makes sense, as a large fraction of street crimes take place in dark or semidark areas). The article claimed that the cameras and microphones are the latest in surveillance technology, provided by the U.K. defense establishment. Privacy advocates gave comments--they were predictably quite worried. The links with crypto policy are of course apparent. --Winston Smith Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: Fate of Ecash if RSA is cracked?
by Matt Thomlinson 17 Dec '03

17 Dec '03

but probably not for decent RSA key lengths -- more probably the hashing algorithm used will fall, with much the same consequences. mattt >---------- >From: dlv@bwalk.dm.com[SMTP:dlv@bwalk.dm.com] >Sent: Sunday, June 02, 1996 6:49 PM >To: cypherpunks(a)toad.com >Subject: Re: Fate of Ecash if RSA is cracked? > >ichudov(a)algebra.com (Igor Chudov @ home) writes: >> scheme gets broken somehow? Suppose, for example, that someone >> discovers an ultra-fast factoring algorithm or something like that. > >This'll happen, probably sooner than later. > >--- > >Dr. Dimitri Vulis >Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, >14.4Kbps >

1 0

Reminder on PBS Show
by MELODYJAMES＠delphi.com 17 Dec '03

17 Dec '03

CYBER SECRETS (This week on Life on the Internet) Law enforcement agencies say that in the wrong hands, email encryption software called PGP (Pretty Good Privacy) threatens the public good. Check out the online transcript, hyperlinks and live video stream of this week's feature "Cyber Secrets" on the Life on the Internet web site. <http://www.pbs.org/internet/> The program *Life on the Internet* is broadcast on Saturday mornings in some areas. Check your listings.

1 0

"Insider Non-Trading" (Re: Insider Trading and Inside Information)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:15 PM 6/2/96, Mike Duvos wrote: >The SEC, in cooperation with the courts, has been gradually >shifting the definitions of "insider" and "inside information" to >more all-encompassing ones. ... >Nowdays "inside information" has been expanded to include >anything that the general public is not privy to, and "insiders" >can be almost anyone as well. ... Indeed, the recent changes to U.S. Code 18503-666, have been dubbed the "Insider Non-Trading Law." What, you may ask, is "insider non-trading"? Just as inside information may affect decisions to engage in a stock trade, so too can insider information cause a decision _not_ to engage in a stock trade! Imagine that Trader Joe was planning to sell Security Dynamics short. Perhaps with a direct short sale, or purchase of puts, or other variants. However, he learns from his golfing partner, Jim Bidzos, that RSA Data is about to be sold to SD for $250 million. Returning from his golf game, he cancels his short plans. Voila, "insider non-trading." The SEC tumbled to this some time ago, and now demands that all those who are insiders, or who are married to insiders, or who are golfing buddies of insiders register their trading intentions 90 days in advance of any transaction. (This will increase to 120 days in 1997, and 180 days the following year.) This form of "intention escrow" ensures that insider information cannot be used to cancel trades which were planned and then not pursued. Key escrow, signature escrow, identity escrow, position escrow, and, now, intention escrow. Welcome to the Escrow Society. --Tim May (P.S. Stu Brownstein, a Bay Area friend of mine, came up with this "insider non-trading" joke several years ago. He once thought about writing a letter to the "NYT" pointing out how insider trading laws must also imply insider non-trading laws, but a Washington friend of his, he claims, told him not to. "It may give the SEC ideas," he said.) Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Surveillance Cameras
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Tim May wrote: >Today's newspaper (SJ Mercury News) carried a long article about >increasingly ubiquitous video surveillance cameras, and singled out the >U.K. as a place that is leading. There was a news report on this a couple of months ago. In addition to the government surveillance cameras, when there's a major crime in the U.K. the cops have started collecting all the security tapes from offices, gas stations, railway stations, etc, etc in the surrounding area and scanning them to try to find the culprits. The interesting things that they said were : 1. The cameras only reduce crime rates locally, as the criminals simply move to areas without cameras. 2. The real criminals (e.g. IRA bombers) know how to disguise themselves well enough that the cameras cannot easily be used to identify them. 3. The cameras are often pointed in the wrong direction, not switched on or aren't recording. A good example is the London club which was bombed a year or so back. The bomber walked up to the entrance and placed the bomb directly in view of the security camera. It was switched off at the time ... 4. Even when people are recorded, the resolution is often too poor to identify them. So it appears that the cameras are great for arresting people who urinate in bushes, but useless for catching real criminals. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: opinions on book "The Truth Machine"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:14 AM 6/3/96, Adam Back wrote: >Tim May <tcmay(a)got.net> wrote: >> At 11:53 AM 6/1/96, Adam Back wrote: >> >Tim May <tcmay(a)got.net> wrote: >> [...] Maybe the "make.money.fast" description was a poor one...what I meant >> to imply is that the book is being advertised widely (I've seen half a >> dozen announcements of it), > >Ah .. I misunderstood, the ad is being spammed. We have a truly awful >news feed which gets around 2 weeks of lag, at time of posting that >was the only one I'd seen. And I thought my newsfeed was bad! Do an Alta Vista (or DejaNews, etc.) search of "The Truth Machine" and you'll find about 300 articles on Usenet about it. However, about 95% of them are from jhalpe(a)ix.netcom.com, the author of this media event novel or from ivypress(a)ix.netcom.com, his vanity publisher. (Actually, maybe Ivy Press is not a vanity publisher. Maybe Ivy Press is what might me dubbed a "Cantwell and Siegel publisher.") And the groups this was posted to....mama mia! This is why I was irked that this spam was leaking into the Cypherpunks group as well. But no harm done, and it demonstrates another example of how the Net is being used for such advertising. Imminent death of the Net predicted--news at 11. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0