December 2003 - cypherpunks-legacy

Clinternet?
by Robert Hettinga 17 Dec '03

17 Dec '03

Hoo boy. I had the most amazing whiff of paranoia from the morning news. Clinton wants to buy the internet back for $500 million so he can watch us better? Nawwww, 'course not... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

2 2

[ADMINISTRATIVIUM] Blowfish
by nobody＠replay.com 17 Dec '03

17 Dec '03

Many forgeries are traceable with mathematical certainty to feebleminded Timothy C[rook] Maya's poison keyboard.

1 0

SPA Press Release on ISP suits
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Fri, 11 Oct 1996 12:36:55 -0400 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Michael Dodson <dodsonm(a)WANE-LEON-MAIL.SCRI.FSU.EDU> Subject: SPA Press Release on ISP suits To: CYBERIA-L(a)LISTSERV.AOL.COM The formatting may be a bit rough. I am not a pro at this. FOR IMMEDIATE RELEASE ((edited)) Contact: David Phelps, (202) 452-1600, ext. 320, dphelps(a)spa.org SPA Files Copyright Suits Against ISPs and End Users Internet Anti-Piracy Campaign Launched (Oct.10, 1996 --Washington, D.C.) -- The Software Publishers Association (SPA) announced today that it has filed five civil lawsuits for copyright infringement occurring on the Internet. Three of the lawsuits were filed against Internet service providers (ISPs), and the remaining two were filed against individual end users. Additionally, SPA launched its Internet Anti-Piracy Campaign, which includes education and enforcement components, in an effort to educate and work cooperatively with ISPs regarding copyright infringement. ISP lawsuits were filed on Oct. 7 and 8 against Community ConneXion of Oakland, Calif.; GeoCities of Beverly Hills, Calif.; and Tripod Inc. of Williamstown, Mass. The SPA members named as plaintiffs in all three suits were Adobe Systems Inc., Claris Corp. and Traveling Software Inc. In each case, SPA first contacted the ISP and requested that the infringing material be removed, but the ISP failed to respond and cooperate. SPA also filed suit against Jeffrey Workman of Auburn, W. V., and Patricia Kropff of Scottsdale, Pa, on behalf of Adobe Systems Inc., Claris Corp., Corel Corp., Datastorm Technologies Inc. and Novell, Inc. In each of these instances, SPA received reports of alleged copyright infringement on certain Web sites, and with the assistance of the ISPs, tracked the individuals responsible for posting the infringing material. "These lawsuits send a clear signal to ISPs and end users that neither direct nor contributory copyright infringement will be tolerated. The Internet does not provide a safe haven for these types of activities," said Ken Wasch, SPA president. SPA's Internet Anti-Piracy Campaign (IAPC), which is outlined at http://www.spa.org/piracy/iapc.htm, contains information explaining why ISPs may be liable for copyright infringement, the risks involved and seven warning signs that infringing activity may be taking place on the ISP's server. Additionally, ISPs may sign an ISP Code of Conduct to show they have adopted the operating practices encouraged under the copyright law. Upon receiving a report of alleged copyright infringement on the Internet, SPA confirms the unlawful activity and sends a letter to the ISP servicing the infringing user. In most cases, the ISP cooperates and remedies the situation. If the infringing user can be identified -- as alleged in the Workman and Kropff cases -- SPA may then choose to seek action against the end user. If the ISP is unwilling to stop the unlawful activity, SPA may choose to file suit against the ISP. "Our intentions are to work cooperatively with ISPs. A key element of the IAPC is the ISP Education Program devoted to alerting ISPs to their potential liability and providing them with the tools and guidance to protect themselves," said Joshua Bauchner, SPA's Litigation Coordinator. "The IAPC maintains SPA's traditional balance between education and enforcement. We first make contact in an effort to amicably resolve the matter, and only when absolutely necessary do we turn to litigation." An integral part of the cooperative effort between SPA and ISPs is the ISP Code of Conduct. This simple agreement asks that ISPs protect themselves from liability by stopping pirate activity on their systems. In return, SPA will attempt to contact the ISP if it receives a piracy report concerning it -- before initiating other action. ((end of edited release)) See http://www.computerworld.com/news/news_articles/961010spa.html for early reactions. Michael Dodson dodsonm(a)wane-leon-mail.scri.fsu.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

3 2

Re: Londinium
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> May be you knew this. A few months back in the UK, some nut flipped > and shot up a school full of kids, finishing up by shooting himself > (sadly for the press, his second cousin once removed, did not have an > internet account). Much media teeth gnashing about hand guns, and > tighter gun laws ensued. (The guy had a gun license, something which > is needed to legally own a gun in the UK.) Yeah, and we`re looking at more fucked up laws possibly completely banning handguns over here. > The Schoolyard Slaughter game is I think a joke by someone with a > funny sense of humor, playing on this incident. Actually the PD library distributing the game said it was produced and released some months before the incident in Dunblane, but I can`t verify whether they were just covering themselves or if this is the truth, whatever the case, it is irrelevant, the game will probably be removed from circulation now for no legitimate reason other than a few nutters on a mission against guns happen not to like it. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Clinton's Encryption Plan Fits Law and Market
by Ernest Hua 17 Dec '03

17 Dec '03

Two serious flaws in this letter ... 1. Secretary of Commerce, Mickey Kantor said: > You assume that foreign buyers would not buy key-recovery products, > but you ignore the trend -- especially in Europe -- to require use > of key-recovery products and bar the import of stronger and stronger > encryption products that do not take law enforcement into account. A. This is an old argument constantly rehashed by the government. What it convenient ignores is that no one OUTSIDE the government wants what the government schemes. No one wants the government to mandate key recovery. Some important uses of encryption, such as secure telephone conversations, simply do NOT need key recovery for ANY reason other than law enforcement intercepts. B. The point on other nations barring imports is absurd. Since WHEN do we tailor our export limits to the import limits of OTHER nations? C. The so-called "trend" he refers to is ARTIFICIALLY created by the U.S. government through secret lobbying efforts, the most recent at the OECD in Paris. The administration uses the word "trend" as if other nations are independently pursuing the key-escrow/key-recovery path, when in fact, only a few nations are considering such a move. Other nations, such as Japan, have openly opposed such a direction, and some nations, such as Sweden, have done so secretly because such a policy could not possibliy withstand the scrutiny of democratic processes. 2. Kantor said: > The National Research Council did not say that we should allow the > export of all encryption. Again, more mincing of words. The administration, seeing that the NRC report was staunchly against key escrow and government-mandated schemes, chooses to ignore parts of the report it feels is convenient. The NRC report, in fact, said that the government should immediately relax all symmetric encryption up to 56-bits and all public domain encryption UNCONDITIONALLY. It did not say anything about signing a pledge to develope key escrow or key recovery. This condition invented by the administration is nothing short of blackmail: "play it our way, or you have no chance to compete globally". In short, Kantor's letter is yet more blatant lies and deception on the part of the administration to get what it wants for law enforcement and national security agencies without any concern for the nature of the technology nor the economic impact such policies will have. -- Ernest Hua, Software Sanitation Engineer Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707 Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua(a)chromatic.com

1 0

Re: (2) LET'S MEET DIMITRI
by attila 17 Dec '03

17 Dec '03

In <Pine.SUN.3.91.961010143953.7428A-100000(a)crl.crl.com>, on 10/10/96 at 02:40 PM, Sandy Sandfort <sandfort(a)crl.com> said: . attila sez: . .> WOW! Dimitri as the featured roast, Dean Martin style, would be .> enough for me to seriously consider leaving my high desert Utah .> safe house! . .Will you pledge a few bucks, though? . after I figure out how to allocate the $400+ it takes to get out of here --the disadvantage of living nowhere: $119 each way just to deal with SLC for transfer plus SLC to SFO/SJO it's too late in the year to even consider crossing the sierras on my chopper, ...other than airplane, the sole means of transport. sold my category D twin tprop since I do not have a valid medical endorsement from the FAA or the required certified copilot for Cat II or IIIA landings if SFO is pure blind slop. so, it's commerical time. so far, being in the high desert away from population in an enclave of 100 families as ornery as I, has been a blessing. travel had become more than old. hopefully you can make this one hang together --particularly, if I can be the roastmaster --and choose the panel... <g>

1 0

Re: Why not PGP?
by apteryx＠super.zippo.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jim Ray wrote: >Rollo Silver wrote: [snip] >> 2. Suppose someone writes a program Z that has no expicit crypto code in >> it, but has hooks for installing one or another version of PGP. Given a >> copy of Z, someone in this country could install PGP he got from MIT, >> whereas someone in Europe could install the international version. >> Would export of Z violate ITAR restrictions? > >Yes. >JMR Does this mean that exporting Private Idaho, PGPfront, WinPGP, etc. would be a violation of ITAR because they function only when combined with PGP and contain "hooks" for using PGP? I don't recall any restrictions on who could download these files from their host sites. Mark -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMl6ZSN36bir1/qfZAQGUWAMAmbh59CK2wMBt/AVCEcwoiknVgIYMNRmS B2s4YJyvq5QQnUkynUcMSU17vltRhwQyapz22lg4rZZxYIoEC0P3vVDkH3mPCnnE qPSMtwtV+o1//cOQHjD7VfjeScO69R7u =Np5A -----END PGP SIGNATURE----- ----------------------------------------------------------------- Mark Heaney finger snipe(a)starburst.cbl.cees.edu for public key PGP Fingerprint= BB D8 9B 07 51 87 05 AC 47 7B F2 4F A6 AB 1A CD ----------------------------------------------------------------- You keep using that word, I dunna think it means what you think it means.

1 0

Re: BAY AREA CYPHERPUNKS SATURDAY 10/12 TRESSIDER HALL STANFORD
by Eric Chiu 17 Dec '03

17 Dec '03

At 01:06 AM 10/11/96 -0700, you wrote: >There will be a San Francisco Bay Area Cypherpunks meeting on Saturday 10/12 >at Stanford University. The meeting location will be the tables outside >Tressider Hall, where we've met for several previous meetings. >The canonical time is noon for lunch and milling around, and 1pm >for organized program. Bill - What time is the meeting? Eric Chiu IS-Finance and Adminstration Tel: 408-527-1665 Pager: 415-424-7282

1 0

SPA sues C2, other ISPs and users
by Greg Broiles 17 Dec '03

17 Dec '03

According to a 10/10/96 press release, the Software Publishers Association has files copyright infringement suits against three ISP's and two individual users. The three ISP's were Community Connexion of Oakland, GeoCities of Beverly Hills, and Tripod of Williamstown, Mass. The two users sued were apparently customers of other ISP's who turned over their names & contact information to the SPA. The press release, located at <http://www.spa.org/piracy/releases/netpir.htm>, indicates: "Piracy has taken many forms on the Internet. These include making unauthorized copies of software available for download, the posting of serial numbers, cracker and hacker utilities and links to pirate FTP sites. Although many believe piracy is limited to "warez" or illegal copies of software, it extends beyond that narrow definition. Under the law, anyone who knows -- or should have known -- of the infringement and who assists, encourages or induces the infringement is liable for indirect infringement. In each of the actions SPA filed, at least two of the above infringements were present. " The SPA has apparently adopted two relatively aggressive litigation strategies - putting ISP's in the position of disclosing otherwise confidential customer information or being sued themselves, and treating peripheral data about copyrighted works like copyrighted works themselves (e.g., serial numbers). Particularly interesting is that they seem to be claiming that a *link* to a pirate FTP site is itself infringing (potentially contributory infringement). (My comments above are made solely from reading the press release.) It's inappropriate to expect Sameer or any other C2 employee/agent/representative to discuss the suit before they've had a chance to find and meet with an attorney; in some circumstances it might never be prudent for them to make a public statement about the suit. But it certainly couldn't hurt for people who've thought about signing up with C2 to do so now as a show of support, nor for existing users to renew their service early. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

7 6

EUB bank on PRI "Marketplace" tonight
by David Lesher 17 Dec '03

17 Dec '03

Heard a teaser that EUBank will be mentioned on Public Radio Intl's Marketplace tonight. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Burma bans modems
by John Fricker 17 Dec '03

17 Dec '03

From: George Sadowsky <George.Sadowsky(a)nyu.edu> Subject: Re: Burma Bans modems Here is the text of the web page referenced below: RANGOON, BURMA, 1996 SEP 27 (NB) -- Burma has made owning, using, importing or borrowing a modem or fax machine without government permission a crime, punishable by up to 15 years in jail, according to a report by United Press International. Burma's military government has imposed what's called "The Computer Science Development Law" which empowers the Ministry of Communications, Posts and Telegraphs to specify what exactly can be restricted, UPI reports. UPI quotes the government-run newspaper New Light of Myanmar as saying the same punishment is prescribed for anyone who sets up a link with a computer network without the prior permission of the ministry, or who uses computer network and information technology "for undermining state security, law and order, national unity, national economy and national culture, or who obtains or transmits state secrets." UPI reports that in July a diplomat, Leo Nichols, died in prison after he was sentenced to a lengthy term for illegal possession of fax machines. It's clear from this action that the SLORC, i.e. the "State Law and Order Restoration Committee" (sic!) understands full well the benefits and importance of the Internet and other forms of electronic communication to open societies, and is determined to deny these benefits to its citizens. Given its recent history and the quasi-imprisonment of Daw Aung San Suu Kyi, this new action is perfectly consistent with the government's previous abysmal record. Countries who would deny open Internet access to its citizens might well pause to consider if they wish to be associated with the current government of Myanmar in doing so. George Sadowsky, Director Voice: +1.212.998.3040 Academic Computing Facility Fax: +1.212.995.4120 New York University 251 Mercer Street George.Sadowsky(a)nyu.edu New York, New York 10012-1185 http://www.nyu.edu/acf/staff/sadowsky/ --j You can retrieve my PGP public key by sending mail with subject "send pgp key". Take a look at www.Program.com for a good programmer web site.

1 0

Forged "unsubscribe"
by Timothy C. May 17 Dec '03

17 Dec '03

Though I am avoiding commenting on the continuing Vulis nonsense, something has come up which necessitates my comment. I received a message from majordomotoad.com saying that my (alleged/purported) message, "unsubscribe cypherpunks dlv(a)bwalk.dm.com", is being forwarded for processing. The full message is included below. It appears that someone is attempting to make it look like I am trying to unsubscribe Dmitri Vulis! I assure you all that I have sent no such message to majordomo(a)toad.com. I'm cc:ing Hugh Daniel to make sure he sees this. Perhaps he can look at the full headers and path information of the alleged message from me and figure out who is playing this kind of game. --Tim May >Received: from you for tcmay > with Cubic Circle's cucipop (v1.10 1996/09/06) Fri Oct 11 14:26:44 1996 >X-From_: Majordomo-Owner(a)toad.com Fri Oct 11 13:46:54 1996 >Received: from toad.com (toad.com [140.174.2.1]) by you (8.7.6/8.7.3) with >ESMTP id NAA13723 for <tcmay(a)got.net>; Fri, 11 Oct 1996 13:46:54 -0700 >Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id NAA00496; >Fri, 11 Oct 1996 13:53:05 -0700 (PDT) >Date: Fri, 11 Oct 1996 13:53:05 -0700 (PDT) >Message-Id: <199610112053.NAA00496(a)toad.com> >To: tcmay(a)got.net >From: Majordomo(a)toad.com >Subject: Your Majordomo request results: unsubscribe >Reply-To: Majordomo(a)toad.com > >-- > >Your request of Majordomo was: >>>>> unsubscribe cypherpunks dlv(a)bwalk.dm.com >Your request to Majordomo(a)toad.com: > > unsubscribe cypherpunks dlv(a)bwalk.dm.com > >has been forwarded to the owner of the "cypherpunks" list for approval. >This could be for any of several reasons: > > You might have asked to subscribe to a "closed" list, where all new > additions must be approved by the list owner. > > You might have asked to subscribe or unsubscribe an address other than > the one that appears in the headers of your mail message. > >When the list owner approves your request, you will be notified. > >If you have any questions about the policy of the list owner, please >contact "cypherpunks-approval(a)toad.com". > > >Thanks! > >Majordomo(a)toad.com > > > "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Crypto AG - Secret GAK Partner ?
by um＠c2.net 17 Dec '03

17 Dec '03

>> Some one recently gave me a copy of an article in Der Spiegel >> (unfortunately in german!) stating that Crypto AG of Switzerland >> had passed the keys to the German Govt without informing the >> customer. > >This is nothing new. But how about faxing the article to John Young, so >we all may benefit? There is no need to. They have an archive at http://www.spiegel.de/archiv/ (you have to register before you can use it). The article was in Der Spiegel 36/1996.

1 0

RE: "Internet II" and Clinton
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May * a government attempt to reassert some sort of control over the Internet, a la the "we paid for the Arpanet, so we can control what it's used for." ................................................................ That's also what I've been thinking about, regarding the efforts to get all the schools wired. "It's our project and we can control it if we want to." I could almost paranoically get cause & effect confused, thinking that the program for free internet access is merely an excuse for assuming the control over the internet that the governors are aspiring to achieve, rather than it being merely a contingent consequence of their involvement with it. I deplore the fact that so many people are lured into signing up for internet access ( Hurry, Hurry, you don't know what you're missing on Usenet!!!) without being mentally prepared for what they can expect to see there. Then they must suffer the shock of realization of what is available, free & uninhibited. (Ooops. "They didn't tell us about *that* stuff being there, (whine) take it way!") But you just have to know that, once the governors decide to become the Determining Factor in setting up everyone for internet access, they will also become the determining factor in what everyone gets to see, and therefore gets to post or send through the channels. .. Blanc

1 0

Prove it in Court First
by Duncan Frissell 17 Dec '03

17 Dec '03

>From the Software Publisher's Association Code of Conduct for ISPs: "It is also a violation of the copyright owners rights for an ISP to post, or to allow others to use its server(s) to post, materials, like serial numbers or cracker utilities, that make it possible for others to execute and use pirated software. Such acts, which either induce or materially contribute to copyright infringement by someone else, constitute contributory infringement, and expose ISPs to the same liability for damages, penalties and injunctive relief as a direct infringer." Here is how you violate the copyright of the book "Unix for Dummies" : 1) Get copy of book 2) Go to copy machine 3) Copy the book I hereby demand that you copraphageous cretins sue me immediately for providing this information. DCF

3 2

Re: AW: Binding cryptography - a fraud-detectible alternative to key-esc
by Hal Finney 17 Dec '03

17 Dec '03

Another flaw with schemes of this time (in terms of failing to meet their goals) is that they cannot detect superencryption and other forms of non-standard encryption of the message body proper. All they can really do is verify from the outside that the same session key is encrypted for the two recipients (the intended recipient and the Government Access to Keys Party - let's not abuse the term by calling him a Trusted Third Party). But they can't be sure that the session key is sufficient information to decrypt the message. The session key could itself be a PK encrypted form of the actual message session key, so that the true recipient would have to run the PK decryption algorithm through two iterations before he actually got the real message session key. Or the message could be simply superencrypted using a non-escrowed encryption system, then encrypted using the GAK technique so that it looks fine from the outside. These kind of techniques could be detected by the recipient, but as Adam Back points out there are much simpler techniques if we just want the recipient to be able to tell whether the key has been encrypted for the GAKP. For that matter if *he*'s really concerned about it he can forward the plaintext to whatever governments he likes. Hal

1 0

Constitutional Convention
by azur＠netcom.com 17 Dec '03

17 Dec '03

Have any on the list been following ballot measures aimed at term limits? In Nevada, one of (I believe 45 states) with such initiatives on the November ballot, the measure seeks to limit some state offices and requires the state to call for a Consititutional Convention to limit terms of Federal Senators and Reps. If these pass we could be in for some wild times as every disaffected group (e.g., pro-life) seeks to codify new Amendments in agreement with their pet cause. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Re: Burma bans modems
by azur＠netcom.com 17 Dec '03

17 Dec '03

> UPI reports that in July a diplomat, Leo Nichols, died in prison > after he was sentenced to a lengthy term for illegal possession of > fax machines. > > It's clear from this action that the SLORC, i.e. the "State Law and > Order Restoration Committee" (sic!) understands full well the > benefits and importance of the Internet and other forms of > electronic communication to open societies, and is determined to > deny these benefits to its citizens. Given its recent history and > the quasi-imprisonment of Daw Aung San Suu Kyi, this new action is > perfectly consistent with the government's previous abysmal > record. > Look, look, up in the sky! Its a B2, not its an F-117, no it AP-man! The Great Mandala is in motion. Ladies and gentleman place your bets. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

[RANT] Re: Why not PGP?
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: apteryx(a)super.zippo.com, cypherpunks(a)toad.com Date: Sat Oct 12 00:48:23 1996 Mark wrote: <snip> > Does this mean that exporting Private Idaho, PGPfront, WinPGP, etc. > would > be a violation of ITAR because they function only when combined with PGP > and contain "hooks" for using PGP? To the best of my understanding, "maybe, it depends" A lousy answer to a good question, and NOT legal advice of course. One of the big problems with regs. like ITAR (and others of questionable Constitutionality) is uncertainty. Certainty and simplicity would lead to less FUD, and hence less power on the part of regulators, so it's not in their interest to be definite or even rational. One of the things "it depends" on may be the time-proximity of an election, of course. Folks seem to have disturbingly short memories regarding governmental abuse these days. > I don't recall any restrictions on who could download these files from > their host sites. At least in the case of Private Idaho, which seems to be the standard for using & chaining remailers (with John Doe in a close second place) there seems to be no restriction. AFAIK, Joelm couldn't keep a program as nice and as widespread and as popular from getting exported no matter what he did. Joey Grasty tried (really!) to keep WinSock from getting exported, but it was overseas anyway, within days. [I didn't do it.] Is remailer software somehow different than remailer-using software under ITAR? Again, I don't know. <sigh> It is quite likely, IMO, that the next governmental attack on privacy will come on the chained, encrypted remailers, like WinSock, which I'm running as I type now. :) I am a strong believer in privacy, but only for peaceful and good purposes. Running a remailer, like running for office, is an experience that will change your outlook on things. I encourage doing both. As everyone knows, I would be likely to begin keeping logs and cooperate with law-enforcement (even the lying, "evidence" planting, biased assholes at B.A.T.F.) if I were to somehow discover violent abuse, like Mr. Bell's "assassination politics" scheme, going on inside WinSock. Presently, only a rejected message file is kept. With proper encryption and chaining, I am not sure how much good cooperation would do anyway, and I would be certain to take considerable pains to avoid compromising the privacy of legitimate users. OTOH, I would shut down, or go to jail for contempt, or both, rather than cooperate even one little bit in the enforcement of the failed, corrupting, tax-and-spend drugwar. I am sure that different remailer-operators all feel differently about the issue, and it is certainly a touchy one, but I am sure that some operators do agree with me. I will not initiate, or advocate, or abet violence in a failed attempt to achieve political or social goals, no matter who or what wants me to. I hope that abusers don't "ruin it for the rest of us." I would also hope (though it sometimes seems that no rational argument stands a chance) that those who are tempted by violent, simpleminded "solutions" would understand from recent and not-so-recent history that transforming jerks into martyrs is an incredibly simple way of cementing those jerks' policies *permanently* into law. There is no free political lunch -- peaceful change requires hard work and money. JMR One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Defeat the Duopoly! Vote Harry & Jo http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:jmr@shopmiami.com> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMl8jHG1lp8bpvW01AQFWnwP+MhhHkTt9f3GbkjPlf+w7aZuzPMEt5xEi vMDSiu5cHjXeCFKZgVlb/8jXfin7hiGjoEEeeq0ntIb0POTKfbFUI/EB3nURrj8u aABvshBGVOfLNJzO/+6nqAgJeVMgyhjJYBkjWSvuJDHhphCfUtpyLKkvI3V8Ps4k h8ZHM2t95q8= =K6Lo -----END PGP SIGNATURE-----

1 0

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Jim Bell <jimbell(a)pacifier.com> writes: >> At 08:49 AM 10/11/96 +0100, Adam Back wrote: >> > [...]. Microsoft's CAPI arrangement is that they will not >> > sign non-US CAPI compliant crypto modules (Examples of enforcement of >> > no-hooks interpretation). >> >> Does that fix the "export only the signature" problem (for the >> government)/opportunity (for the rest of us)? You know, present Microsoft >> with the software, don't tell them it's already out of the US, and they sign >> it. Export the signature only (who cares if this is legal!) and edit the >> international software to contain the signature. > >Export the lot, signature included :-) > >(I doubt exporting only the signature once the story came out would >offer you any more protection legally than exporting the software). > >As you say who cares if it's illegal: things get exported all the >time. > >The problem however, is finding a non-US site to hold the hot potato >once it has been exported. For example 128 bit Netscape beta was >exported a while ago. I don't see it on any non-US sites. This is >due to Netscape's licensing requirements, you need a license to be a >netscape distribution site, the license doesn't include the right to >mirror non-exportable versions on non-US sites. > That's one good application for remailers, and .warez newsgroups. at. >If the exported software is `PGP3.0 for CAPI' or whatever, I think it >should be fair to conclude it will be cheerfully mirrored by all, and >Phil Zimmermann won't be complaining. (PGPfone is on ftp.ox.ac.uk, >plus other places, for example.) So yes, I agree, for software with >appropriate distribution licenses. > >Another approach, which has been discussed lately is the use of a >patch to usurp Microsoft as the signatory for CAPI modules. I wonder >what Microsoft would say about an unauthorised patch, to fix an ITAR >induced `bug' in windows. Bill Gates doesn't sound pro-GAK. If they >aren't going to complain, perhaps such patches could be distributed >widely outside the US also. > >The new owner of the CAPI signatory key would need a good reputation, >and presumably a policy of signing any (non-GAKked) CAPI modules >signed by microsoft, and anything else that anyone wants signed. > An excellent suggestion.

6 6

[URGENT] Secure envelopes
by nobody＠replay.com 17 Dec '03

17 Dec '03

There's a rumor that Timmy C. Mayflower sells his dead relatives as fertilizer as they constitute the best shit in California.

1 0

Re: Why not PGP?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 10 Oct 1996 13:40:31 -0800, jim bell wrote: >>I don't intend to submit my present or future private PGP keys for key >>escrow (Is that what's called GAK?). To protect myself against forgetting >>my private key (which has happened once already) I'll no doubt some day put >>it on a floppy and put the floppy in my bank safe deposit box. >You still have to "remember" that long, non-memorizable key, although >something like that can be written on paper and well-hidden and/or split up >into parts. It's only value is to decrypt that bank-stored floppy. It'd be only 256 bytes or 512 hex digits. If it was *that* important, you _could_ memorize it! After all, some monks memorized the entire Bible. I knew guys who had pi memorized to over 300 places.... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: SPA sues C2, other ISPs and users
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:12 PM 10/11/96 -0700, Greg Broiles wrote: > >It's inappropriate to expect Sameer or any other C2 >employee/agent/representative to discuss the suit before they've had a >chance to find and meet with an attorney; in some circumstances it might >never be prudent for them to make a public statement about the suit. Is this good advice? When attacked, isn't it good to offer as strong a defense as possible including (but not limited to) verbal abuse, physical confrontations, countersuits, standing outside people's houses, picketing, letters, public appearances, urging other people to express their views, etc. What is lost by a complete defense. If you develop a nasty reputation, people eventually leave you alone. It doesn't even hurt you in court. See for example the new Milos Forman film "The People vs. Larry Flynt." In spite of Larry's tactics, Justice Rhenquist gave him the unanimous decision he wanted from the Supremes. DCF

1 0

Intel RICO Billed
by John Young 17 Dec '03

17 Dec '03

The Washington Post, October 12, 1996, p. A6. Clinton Approves Intelligence Spending Rise Bill Is Also Signed to Make Theft of Trade Secrets a Federal Crime President Clinton signed a bill yesterday that boosts intelligence agency spending and another that makes theft of trade secrets a federal crime. Clinton said he signed the 1997 Intelligence Authorization Act despite objections to three provisions, including one that establishes three new assistant directors of central intelligence under CIA Director John M. Deutch. Although the nation's intelligence budget is an official secret, it is reported to total about $30 billion for the 1997 fiscal year, up 4.9 percent from 1996. In a statement, Clinton said he would support Deutch in asking the next Congress to repeal the provision that created assistant directors for intelligence collection, analysis and administration. "I share his concern that these provisions will add another layer of positions requiring Senate confirmation" without a corresponding increase in the CIA director's authority to manage the intelligence agencies, Clinton said. The bill: + Gives the FBI power to subpoena local telephone records. + Authorizes the CIA and the National Security Agency to collect data on foreign citizens abroad for U.S. investigations. + Requires Senate confirmation of the CIA's general counsel. That is meant to prevent political influence over a position designed to block illegal covert operations. + Prohibits federal employment of senior intelligence officials for three years after their departure from government. It also prohibits the CIA from using American journalists as spies. But the restriction could be waived in extraordinary circumstances and the CIA still could have its agents pose as journalists. The bill would not prohibit journalists who choose to provide information from doing so. Clinton also signed into law the Economic Espionage Act of 1996, saying it strengthens protections against theft or misuse of proprietary business information. "It will help us crack down on acts like software piracy and copyright infringement that cost American businesses billions of dollars in lost revenues," he said. The law makes the theft of trade secrets a federal crime and provides financial penalties and prison sentences for specific acts of economic espionage. It also preserves the confidentiality of trade secrets in court proceedings. Clinton said the measure also eliminates gaps in the criminal laws that cover attacks against computers and the information they contain. [End]

1 0

Crypto: Systems & Application Developers Wanted
by SPYRUS 17 Dec '03

17 Dec '03

SPYRUS, the leading provider of cryptographic tokens (PC cards & Smart Cards), with associated systems and applications software, is looking for engineers with the following qualifications to work with our Secure Applications Group in San Jose, CA: * 5 or more years experience in systems and applications software design and implementation in C and C++. Assembler experience desired. * Minimum 3 years experience with Windows development including device drivers and VxD's, using Microsoft and Borland compilers, NuMega tools, etc. Windows MFC, NT kernel, and Unix (any versions) experience desirable. Mac experience a plus. * Cryptographic and other security software expertise highly desirable. Gregg Weissman SPYRUS San Jose, CA Voice: 408-432-8180 x225 Fax: 408-432-8415 email ASCII resume to: gweissman(a)spyrus.com - or - msutherland(a)spyrus.com see the SPYRUS page at http://www.spyrus.com

3 2