December 2003 - cypherpunks-legacy

Not That Smart Cards
by John Young 17 Dec '03

17 Dec '03

New Scientist, 12 October 1996, p. 21. Smart, but not that smart By Mark Ward Credit card companies are turning to smartcards to help them fight fraud. But manufacturing problems may mean that they are no more secure than existing cards. Conventional credit cards hold information in a magnetic strip that typically holds about 200 bytes of information -- enough for the card and version number, expiry date and owner's name. Smartcards have a built-in microprocessor that can handle several kilobytes of data, equivalent to pages of information. Having the tiny computer on board means that each card can have a unique identity, and this ought to help to protect the information held on it. But to give a card an individual electronic signature, its built-in processor has to do a long calculation. This is a time-consuming process, so some card manufacturers intend to issue cards with one of several thousand preprogrammed identities. Each card will therefore have thousands of duplicates, all of which will be vulnerable if a criminal cracks the code for any one of them. In 1994 the credit card companies Europay, Mastercard and Visa got together to draw up a common specification for smartcards, known as EMV The cards will rely for security on the RSA encryption algorithm. This uses two very large numbers, called keys. One is passed around in public and the other remains hidden in the card's memory. The keys are 155-digit prime numbers which are multiplied together to make an even larger number which is then used to code and decode the data on the card. The problem for card manufacturers is working out the large prime numbers in the first place. "Companies making smartcards turn one out every 15 seconds," says Dmitri Markikis, a security analyst at Mondex, a London-based company that is experimenting with smartcards as electronic purses. "But it takes longer -- estimates range from 6 to 30 seconds -- for the card to generate its RSA keys." To speed things up some manufacturers are considering generating 10,000 preset keys and inserting one as each card is made. Louis Guillou, a researcher at France Telecom's Commercial Centre for the Study of Television and Telecommunications highlighted the problem this summer at the Crypto 96 conference in California. The three EMV partners circulate over 800 million credit cards between them, yet are likely to use a limited population of keys. "Trying to reuse the keys several times is very dangerous," says Guillou. Card manufacturers say the problem will be solved as smartcards become more powerful. "Soon the processing power of a smartcard will be such that it will be able to overcome that kind of issue," says Cyril Annarella, a technical consultant for the French company Gemplus, which makes cards for the EMV members. [End]

1 0

Re: LET'S MEET DIMITRI
by Z.B. 17 Dec '03

17 Dec '03

On Sat, 12 Oct 1996, Ross Wright wrote: > On or About 12 Oct 96 at 11:28, Steven L Baur wrote: > > Tim's message: > > > Well, to one who inserts "(spit)" after nearly every name he cites, > > and critiques Hayek as "fucking unreadable. Shit.," I suppose Hayek > > must indeed seem unreadable. Shit. > > > > After all, Hayek rarely writes things like: "The senile Von Mises > > (spit) and his Sovok Cabal plotters...." > > > > As to "forcing" your students to read Hayek, just who is in charge? > > If you're the instructor, they can choose to read what you tell them > > to read, or be unprepared on the exams you give and possibly flunk > > the class. What part of "Required Reading" do you or your students > > not understand? > > > > --Tim (spit) May > > I had almost forgotten what started this war of flame. That's not so > bad. > Not very bad at all, considering all of the subsequent messages Vulis posted in response to that one. All of the (spit), (fart), and so on got annoying REAL fast, not to mention the anonymous Tim-bashing messages which he is probably doing as well. Zach Babayco zachb(a)netcom.com <-------finger for PGP public key http://www.geocities.com/SiliconValley/Park/4127 ----- If you need to know how to set up a mail filter or defend against emailbombs, send me a message with the words "get helpfile" (without the " marks) in the SUBJECT: header. I have several useful FAQ's and documents available.

1 0

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by nobody＠replay.com 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk> wrote: >The problem however, is finding a non-US site to hold the hot potato >once it has been exported. For example 128 bit Netscape beta was >exported a while ago. I don't see it on any non-US sites. You didn't look vary hard.

1 0

Re: NSA/GCSB spying shown on NZ television [RANT]
by Dale Thorn 17 Dec '03

17 Dec '03

Clint Barnett wrote: > has anyone seen the Mike Myers flic "So I Married An Axe Murderer"? > His "father" in the movie has an awesome theory about a group of the > 5 most powerful epole in the world running everything, including the > newspapers, known as the Pentavaret. The Vatican, the Queen, the > Gettys, the Rothchilds, and Colonel Sanders before he went tits up. > Not to discredit your information, but you just reminded me of it and > I thought it was funny enough to mention. And I thought this was well worth mentioning on the list: I am always amused (when I'm not absolutely hysterical) at how certain people can sit back and smirk at conspiracy "theories" like the "Bilderberg" agenda et al, then you look around and you see: 1. No major daily newspaper in the U.S. takes any interest at all when these most powerful and influential people meet to discuss the fate of the world. What a surprise, huh? 2. The same people who get on TV a lot and smirk at conspiracies that might be believed in by the little people, don't have any trouble believing in the wildest, craziest, most unbelievable conspiracy of all, as long as it's politically correct, and brings in lots of cash. Screw 'em.

2 2

CAG_eng (Crypto AG)
by John Young 17 Dec '03

17 Dec '03

Anonymous has provided an English translation of the recent article on Crypto AG and NSA in Der Spiegel. http://jya.com/cryptoa2.htm (English) http://jya.com/cryptoag.htm (German) CAG_eng --------- Recall that The Baltimore Sun published a similar report at the end of 1995, as first noted here by Peter Wayner, I believe. See the c'punk archives for more on The Sun article (try Altavista for "Crypto AG").

1 0

Re: SPA sues C2, other ISPs and users
by Greg Broiles 17 Dec '03

17 Dec '03

At 08:45 PM 10/12/96 -0400, Matthew Ghio wrote: >gbroiles(a)netbox.com (Greg Broiles) wrote: > >> The SPA has apparently adopted two relatively aggressive litigation >> strategies - putting ISP's in the position of disclosing otherwise >> confidential customer information or being sued themselves, and treating >> peripheral data about copyrighted works like copyrighted works themselves >> (e.g., serial numbers). Particularly interesting is that they seem to be >> claiming that a *link* to a pirate FTP site is itself infringing >> (potentially contributory infringement). > >Claiming that a link to a pirate FTP site is illegal, is a fairly difficult >position to defend. It's not illegal to say "someone is selling stolen >property on the corner of First Street downtown". It's just a statement of >fact. They could try to argue that there was some intent to commit a >crime... but they'd have to have some real proof of that. We're not talking about a crime here, but a civil action. There is a doctrine in copyright law called contributory infringement, whereby a party who intentionally helps another party infringe on a third party's copyright can be held liable as a contributory infringer. In the Ninth Circuit, the standard for contributory infringement is "[o]ne who, with knowledge of the infringing activity, induces, causes, or materially contributes to the infringing conduct of another, may be held liable as a 'contributory' infringer". _Fonovisa v. Cherry Auction_ 96 C.D.O.S. 517 (CA9, 1996) <http://ming.law.vill.edu/Fed-Ct/Circuit/9th/opinions/9415717.htm>, citing to _Universal City Studios v. Sony Corp_, 659 F.2d 963, 975 (CA9, 1981), rev'd on other grounds 464 U.S. 417 (1984), adopting the standard from _Gershwin Publishing v. Columbia Artists_ 443 F.2d 1159 (CA2, 1971). California is within the Ninth Circuit; I presume that the suit against C2 was filed in California (probably Oakland), but I might be wrong. >Their claim that "peripheral data" is illegal is a rather novel idea, and >not supported (to my knowledge) by precedent. I don't think anyone could >argue that a serial number or password is by itself worthy of copyright >protection, since it lacks any creative expression, so they are claiming >it is "indirect infringement". Yes, this is the basic thrust of contributory infringement liability - that the defendant had an important part to play in the fact that infringement took place, without being the direct infringer. Contributory infringement (and its kissing cousin, vicarious infringement, whereby a person under the defendant's control infringes to the benefit of the defendant) are supported by precedent and have been for several years. For example: _Fonovisa v. Cherry Auction_, supra, where defendant swap meet operator leased space to vendors who sold illegitimate copies of musical works, and defendant was aware that those sales were taking place, plaintiffs had stated a claim for contributory infringement sufficient to survive Fed.Rul.Civ.Pro 12(b)(6) motion. _Sega v. Maphia_ 857 F.Supp. 679 (N.D.Cal. 1994), where defendant BBS sysops' role in "copying, including provision of facilities, direction, knowledge and encouragement" was sufficient to establish a prima facie case of contributory infringement; _ITSI TV Productions v. Cal. Auth. of Racing Fairs_ 785 F.Supp. 854 (E.D.Cal. 1992), finding no domestic contributory infringement where plaintiff had no evidence of defendant's mental state or knowledge with respect to direct infringements allegedly facilitated in Mexico, and hence no subject matter jurisdiction; _Demetriades v. Kaufmann_ 690 F.Supp. 289 (S.D.N.Y. 1988), adopting the _Gershwin_ standard, indicating ".. just as benefit and control are the signposts of vicarious liability, so are knowledge and participation the touchstones of contributory infringement", rejecting a theory of contributory infringement against defendants who only made two phone calls to ask about copying of architectural plans and did not provide the means or facilities for the actual copying; _Gershwin Publishing v. Columbia Artists Management_ 443 F.2d 1159 (CA2, 1971), finding contributory infringement where concert promoter generated demand for concerts, collected fees from performers who foreseeably performed copyrighted works without license, and collected payments from independent organizations it created to produce those shows; The famous (well, sort of :) _Universal City Studios v. Sony_ case where the Supreme Court ruled that "time-shifting" videotaping of TV shows was not an infringement was based on a contributory infringement theory. It would have been impractical for Universal City Studios to find and sue individuals who taped occasional TV shows for later viewing; so instead they went after someone worth suing, the people who made the VCRs. The language in the SPA's press release - "Piracy has taken many forms on the Internet. These include making unauthorized copies of software available for download, the posting of serial numbers, cracker and hacker utilities and links to pirate FTP sites. Although many believe piracy is limited to "warez" or illegal copies of software, it extends beyond that narrow definition. Under the law, anyone who knows -- or should have known -- of the infringement and who assists, encourages or induces the infringement is liable for indirect infringement. In each of the actions SPA filed, at least two of the above infringements were present." seems to imply that they may be thinking of contributory contributory infringement - e.g., if (directly) distributing serial numbers or cracking software is contributory infringement*, materially contributing to that material contribution is also infringement. But this seems awfully attenuated from the actual harm. (I don't see much controversy about the idea that putting copyright-protected software up for FTP without the copyright holder's permission is illegitimate; and the notion that merely providing a link to someone else's site is infringement (or even a "material contribution") seems to go much too far. Is a link to a site which links to a site which infringes an infringement? How many links is enough to escape liability? How many links are there between any two web pages, cf. "six degrees of separation"? :) * (because it "materially contributes" to the creation of an unauthorized copy, since the copy of a program being executed in RAM is distinct from an on-disk copy and without cracking software or serial numbers there will be no RAM copy and potentially no initial infringement. _MAI v. Peak_ 991 F.2d 511, 518 (CA9, 1993) cert dismissed 114 S.Ct. 671 (1994) and _Triad Systems v. Southeastern Express_ 95 Daily Journal D.A.R. 11821, 95 CDOS 6890 (August 31, 1995), also see <http://www.io.com/~gbroiles/triad.html> for my own crankiness about _Triad_) >A few months ago I saw Sameer grumbling about people "not paying for >Apache-SSL". Now SPA claims he's operating an ISP to promote piracy. So >first he's a software publisher and now he's a software pirate. Uh, yeah, >whatever. Obviously SPA is on a PR campaign here which defies all >conventional logic. It looks to me like they're trying to achieve results through fear and intimidation that they can't reach via persuasion; e.g., they are trying to create a climate where ISP's turn over user information without a fuss because they don't want to be sued themselves; and where users (and home page "publishers" or authors) are afraid to even discuss infringement, or do anything even close to the conceptual lines between fair use, noncommercial alterations of works (a la _Galoob v. Nintendo_ 964 F.2d 965 (CA9, 1992), where defendants' marketed a "Game Genie" which altered the play of Nintendo cartridges used in concert with it, held to be noninfringing), and infringement. There are some situations where "cracker" software cannot be characterized as inherently illegitimate - many people may want to disable copy protection on software they've legitimately purchased (or "licensed", if that's your view on the shrink wrap question) because it's annoying or incompatible with their hardware configuration. A person with a legitimate copy of software on CD-ROM may want to use it on their non-CD capable laptop, or use it over a nonstandard network. For example, my legitimate copy of Warcraft II won't run unless it sees its parent CD in my CD-ROM drive; which means I can't start a music CD of my choice in the CD-ROM drive and then run my legal copy of Warcraft. (But I probably should be working anyway.) Assuming the user is otherwise playing nicely (e.g., one license per user, blah blah blah) there's no reason to think that disabling copy protection is somehow illegitimate. But it's getting late. More tomorrow. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

RE: RE: Binding cryptography - a fraud-detectible alternative to
by everheul＠mail.rijnhaave.nl 17 Dec '03

17 Dec '03

To explain the backround of "binding cryptography" once more; with respect to (interoperable, worldwide) security in the information society socities/governments have to achieve two tasks: 1. stimulating the establishment of a security structure that protects their citizens, but which does not aid criminals. 2. Coping with the use of encryption by criminals outside of this framework. An inherent problem with these tasks is that different socities/governments have different views on the matter. So to achieve the first task you'll need a concept behind the security structure that is flexible enough to incorporate *any* crypto policy, i.e. from liberal (Japan) to non-liberal (France). We believe that "binding cryptography" is flexible enough to achieve this: a liberal crypto policy might use no Trusted Retrieval Parties at all, while a very non-liberal country might want one (government controlled) TRP, a compliance check on all network traffic and a ban on other crypto. With binding cryptography the issue on a crypto policy becomes non-technical and politically debatable: which features does a country want and what implementation? Adam Back[SMTP:aba@dcs.ex.ac.uk] wrote: > This much is the same as clipper I, just the parties have been > renamed (TRP = split escrow key database holders, TTP = US > government). No it is not. Among other things: it is a international solution, it is based on Pub. Key. Enc. and it is flexible enough to follow private-sector developments. It is not a key-escrow solution, as *you* have (in principle) a very large choice in who to trust with your communication. Hal Finney[SMTP:hal@rain.org] wrote: >Another flaw with schemes of this time (in terms of failing to meet >their goals) is that they cannot detect superencryption and other >forms of non-standard encryption of the message body proper. All >they can really do is verify from the outside that the same session >key is encrypted for the two recipients (the intended recipient and >the Government Access to Keys Party - let's not abuse the term by >calling him a Trusted Third Party). But they can't be sure that the >session key is sufficient information to decrypt the message. We offered a solution for the *first* task not for the *second*; the point is that criminals(!) do not gain any real advantage from using the system in that way as they - among other things - still face the key-management problem. The above dicussions are only relevant in countries where the use of crypto outside the structure would be prohibited. BTW, it is by such discussions that I believe such a ban is ineffective and in fact counterproductive. Adam Back[SMTP:aba@dcs.ex.ac.uk] wrote: > The paper suggests that in one plausible implementation, the > checkers referred to could be network service providers: > > from the summary of the paper posted here: >: The idea is that any third party, e.g., a network or service >provider, > ^^^^^^^^^^^^^^^^^^^^^^^^^^^ >: who has access to components 2, 3 and 4 (but not to any additional >: secret information) can: : a. check whether the session keys in >components 2 and 3 coincide; : b. not determine any information on >the actual session key. > > This would allow for instance for a software only implementation of > a madatory key escrow system. The government in question could then > deputize ISPs to do their mandatory GAK compliance checking for > them. (Deputizing companies is a recent trend in law enforcment > techniques anyway). > > This would allow for instance IP level encryption, with > non-conforming encrypted packets being dropped by all ISPs in the > country in question. Something the Singaporeans might find useful. > The checking functionality could also be added to a key escrow > enabled router. > > For this kind of application, binding cryptography is spot on. Jim bell[SMTP:jimbell@pacifier.com] wrote: > I think the biggest problem with allowing "anyone" to check the > correctness of a key is that what is a technical possibility today, > will become a legally-mandated requirement tomorrow. What if > Internet backbone companies and/or ISP's were told that they had to > implement software check these keys, and if they discovered an > "incorrect" escrowed key, they were legally obligated to either > refuse to forward that message, and/or forward a copy of that > message to someone like Spooks(a)NSA.gov or Thugs(a)DOJ.gov. The information society is international by nature; we want to securely communicate with Singapore. If Singapore, a democratic country!, has such a crypto policy that they want the above control, then so be it. Don't blame "binding cryptography" for making that possible, but start a dialogue with your politicians on what features of the proposal are acceptable in your country. Some countries seem to have the philosophy that "law-abiding" citizens should have nothing to "hide" from their government, so should not use encryption at all. I think that that is not acceptable. The concept behind the third-party checking is that no "law-abiding" citizen should have any problem that abuse - and only that - of a *voluntary* system can be "seen" by many parties. If and *how* checking is done, is a matter of each society. The same concept holds for many things in life and is well accepted. For instance that is why cars have registration plates: if a car drives through after an accident on a *public* road, then by-standers (third parties) can observe that. I for one don't the information society to be the wild west, where anything goes. Of course, people are rightfully worried that such a checkable system might be abused by a totalitarian regime to control their citizens. However, as long as such a system is voluntary I see no problem. Signs in the USA indicate (cf. the NRC study & remarks of the president) that use of other systems will always be possible. Also, the above discussions already showed that if such a system is voluntary, then there are lots of way to go around it. Adam Back[SMTP:aba@dcs.ex.ac.uk] wrote: > As your paper describes, your system allows anyone to check the > correctness of the escrowed session key. Have you considered > modifying it so that the only person who can check is the owner of a > designated private key of a public/private key pair? This would > allow say for the TTP to check correctness, and not the TRP, nor the > public. I'm not sure of the usefulness of this, but it allows you to > select from the full spectrum according to requirements: > > a) no one can check, PGP second recipient (Carl Ellison, Bill > Stewart) b) recipient only can check (my suggestion) c) holder(s) of > designated keys can check d) anyone can check (your proposal) > > c) should be easy to acheive: restrict d) by having the sender > encrypt the escrowed session key a second time to this public key. Point a) can be circumvented too easily. How do you envision point b? Sending all keys (or a selection) to the recipient for checking is: impractical & dangerous (you want the distance between the actual communication and the guy that can decypher as large as possible). If you don't send keys, then abuse will only show up during a warrant. But that abuse will show up anyway.. So what is the use? Point c is a nice suggestion. Although I for one have no problem that anyone can see that I comply with the rules (..unless of course it is a non-voluntary system etc..). Adam Back[SMTP:aba@dcs.ex.ac.uk] wrote: > My assumption was that a TRP is a government front. (All of the > proposed clipper I escrow agents have been major US defense > contractors/government agencies, in addition the clipper I documents Bring in to action your politicians ("the voice of the people") to let the regulation on Trusted Retrieval Parties be as liberal as you find acceptable. Peter M Allan[SMTP:peter.allan@aeat.co.uk] wrote: > 1) What's in it for the user ? > 2) What happens when the Feds recover meaningless data? 1) They get *one* system set up by governments that will make it possible to securely communicate (and do with business) with the whole (democratic) world. Instead of several partial systems set up by private companies where responsibilities will be vague. I consider a certified public key as a digital passport; setting up the structure for passports is a task of governments. 2) Only during a warrant policemen will see that; what then happens must every society on his own decide. Probably nothing happens, as otherwise the investigation will probably be to disturbed. Best regards, Eric

3 2

Re: SPA sues C2, other ISPs and users
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:34 AM 10/13/96 -0700, Greg Broiles wrote: >In the Ninth Circuit, the standard for contributory infringement is "[o]ne >who, with knowledge of the infringing activity, induces, causes, or >materially contributes to the infringing conduct of another, may be held >liable as a 'contributory' infringer". _Fonovisa v. Cherry Auction_ 96 >C.D.O.S. 517 (CA9, 1996) But how will a civil action be effective as soon as millions of people have 10 mb/s full-time net connections and can be their own ISPs and judgment proof at the same time? DCF

1 0

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Steve Shear <azur(a)netcom.com> writes: >> >The problem however, is finding a non-US site to hold the hot potato >> >once it has been exported. For example 128 bit Netscape beta was >> >exported a while ago. I don't see it on any non-US sites. This is >> >due to Netscape's licensing requirements, you need a license to be a >> >netscape distribution site, the license doesn't include the right to >> >mirror non-exportable versions on non-US sites. >> >> That's one good application for remailers, and .warez newsgroups. at. > >I don't know of any advertised files by email services using nym >servers, where the file request, and the files are both sent via >remailers. > >The problem with this is currently is that the nym servers couldn't >stand up to the scrutiny if SPA or whoever got interested. The >message flood attack on the nym would reveal the services host. > >The BlackNet architecture solves this problem by posting requests >encrypted with the services key to a newsgroup, but USENET newsgroup >disitribution time is slow (*), and people are spoilt these days with >WWW, and expect results now, not days later. Has anyone tried this to see whether the LOS would or wouldn't be acceptable? > >The requested file can be posted via mixmaster. You would want to use >a different, random chain of remailers each time. A reverse message >flood could reveal the host also, as you can request lots of copies, >and the service will blindly serve the files. (If someone wants to >discover the service host, they send 1000s of requests, then sit back >and watch which user sends most data into the remailer net.) On a related note: I've been charged with developing an Internet service which needs to assure its clients of anonymity. However, we fear some clients may abuse the service and we wish to prevent the abusers from re-enrollment if terminated for misbehavior. (In your example, it would be the person(s) trying to discover the service host via flood). My thought was to base enrollment on some sort of 'blinding' of their certified signature (e.g., from Verisign) which produces a unique result for each signature but prevents the service from reconstructing the signature itself (and thereby reveal the client's identity). I'm calling this negative authentication. Have you come across anyone who has considered this problem or another one which is mathematically very similar? > >To combat this the service could impose a limit on the number of >copies it would serve per day. This allows a denial of service >attack, if someone wants to stop anyone else getting a copy, they just >saturate the service. Still an improvement over no limit. If the service could negatively authenticate users it would need such limits and might not be subject to such attack. > >Of course Ross Anderson's `eternity service' provides the general case >solution for distribution of such data. It is complex to implement >well though. I've never heard of the eternity service. Where can I get more information? BTW, would Eric Hughes' Universal Piracy System also solve such a situation, by distributing or parking snippets of encrypted file data across many 'cooperating' ftp (or whatever access/storage mechanism) sites. Perhaps the negative authentication approach would help here too by preventing flood/denial of service attacks against the 'key' sites. If only snippets of encrypted data are stored on any one host it might make the SPA's goal even more elusive legally. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

5 4

Re: SPA sues C2, other ISPs and users
by azur＠netcom.com 17 Dec '03

17 Dec '03

>>A few months ago I saw Sameer grumbling about people "not paying for >>Apache-SSL". Now SPA claims he's operating an ISP to promote piracy. So >>first he's a software publisher and now he's a software pirate. Uh, yeah, >>whatever. Obviously SPA is on a PR campaign here which defies all >>conventional logic. > >It looks to me like they're trying to achieve results through fear and >intimidation that they can't reach via persuasion; e.g., they are trying to >create a climate where ISP's turn over user information without a fuss >because they don't want to be sued themselves; and where users (and home >page "publishers" or authors) are afraid to even discuss infringement, or >do anything even close to the conceptual lines between fair use, >noncommercial alterations of works (a la _Galoob v. Nintendo_ 964 F.2d 965 >(CA9, 1992), where defendants' marketed a "Game Genie" which altered the >play of Nintendo cartridges used in concert with it, held to be >noninfringing), and infringement. In Sameer's case they may not get far with forcing him to reveal user identites since any one of them with intelligence is probably using ecash or money orders for payment (something he encourages to protect anonymity). Where's Eric Hughes' Universal Piracy System now that we need it? PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

[Book] The Cobweb
by Adam Shostack 17 Dec '03

17 Dec '03

Just finished with 'The Cobweb' by Neal Stephenson and his uncle,* writing under the nym Stephen Bury. The Cobweb is entertaining, and easily worth the $14 I paid. Its cpunk relevance is a little limited except for the Iowa deputy sheriff who figures out an Iraqi biolological weapons scheme in the US, while the CIA, FBI and NSA fight State, Agriculture and each other over how, or if, to react. Mercenary Soviet Antonov transport planes, stateless Kurds, and encrypted radio links all play their parts. We never do find out if the NSA can decrypt them in time. ISBN 0-552-37828-7. Bantam, Sept 1996. *I forget his uncle's name; hes a history professor who can't be seen writing books with a Sci-fi author like Neal. The usefulness of nyms. They also wrote 'Interface.' -- "Every year the Republicans campaign like Libertarians, and then go to Wasthington and spend like Democrats." Vote Harry Browne for President. http://www.harrybrowne96.org

1 0

Re: L.Detwieler
by Tom Lojewski 17 Dec '03

17 Dec '03

How do I get off this list? >To: cypherpunks(a)toad.com >Subject: Re: L.Detwieler >From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >Comments: Dole/Kemp '96! >Date: Wed, 09 Oct 96 18:11:29 EDT >Organization: Brighton Beach Boardwalk BBS, Forest Hills, N.Y. >Sender: owner-cypherpunks(a)toad.com > >"Butler, Scott" <SButler(a)chemson.com> writes: > >> Clipped from WELCOME TO CYPHERPUNKS >> >The cypherpunks list has its very own net.loon, a fellow named L. >> >Detweiler. The history is too long for here >> >> Can anyone give me the details of The History of this character and wot >> he is on about > >Is it time to update the welcome text and add yours truly to it? > >Timmy May is an asshole. > >--- > >Dr.Dimitri Vulis KOTM >Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps > > --------------------------------------------------------- Tom Lojewski - ProNet Consulting - lojewski(a)earthlink.net

3 3

Re: pgp, edi, s/mime
by Hal Finney 17 Dec '03

17 Dec '03

Thanks for the kind words about my participation with PGP Inc. My comment was really meant more as a disclaimer, though. Realize that I am now a corporate employee in the field rather than a hobbyist, so set your mental filters accordingly. Also, my activities right now are mostly a matter of helping with the finishing touches. Hard work over the past couple of years by Colin Plumb and Derek Atkins has produced the bulk of the code base for PGP 3 and the follow-on products. Still it is very exciting and gratifying for me to be working in this field which I love and which is so important, and I am enjoying it very much. Hal

2 1

Op-Ed piece
by azur＠netcom.com 17 Dec '03

17 Dec '03

We all complain how the media are actively ignoring the crypto issues during the campaign. Here's a chance for us to quickly do something with some impact beyond our group. I'm looking insert an (1000-2000 word) op-ed piece or letter to the editor in my local Sunday paper presenting a non-technical, Libertarian/cypherpunk, view of the present crypto situation, our objections to the government's proposals, etc. Does anyone have a suggestion on where to find such an animal? I'd rather not spend the next day or two writing one. Perhaps we could coordinate a plan to have the same piece inserted next Sunday in various newspapers. -- Steve

1 0

binding cryptography
by um＠c2.net 17 Dec '03

17 Dec '03

liberal (Japan) to non-liberal (France). We believe that "binding cryptography" is flexible enough to achieve this: a liberal crypto policy might use no Trusted Retrieval Parties at all, while a very non-liberal country might want one (government controlled) TRP, a compliance check on all network traffic and a ban on other crypto. I doubt that even French internet providers would want their routers to perform six modolo exponetiations and four modolo divisions whenever someone opens a secure socket... We offered a solution for the *first* task not for the *second*; the point is that criminals(!) do not gain any real advantage from using the system in that way as they - among other things - still face the key-management problem. The above dicussions are only relevant in countries where the use of crypto outside the structure would be prohibited. Of course, criminals do get real advantage from this system. They can use strong encryption for their messages and super-encrypt them using "binding" cryptography. So their illegal messages look perfectly inconnous as long as their government trusts in the "binding" property of this scheme. Only when the GAK key holder tries to decrypt a message, they notice that they cannot read it. Can you imagine that anyone would ever create a program that tries to look like a conforming implementation, but generates invalid "binding" data -- when it is so much easier to simply use PGP, and (if necessary) disguise that fact using the government-approved encryption software? I don't, so in my opinion the verification process is abolutely useless. One might say, binding cryptography, like several other cryptographic protocols, is a nice 'solution', but one with no corresponding 'problem' in the real world. :) It doesn't help in legitimate law enforcement, but it causes trouble to network operators and it deprives law-abiding citizens of their privacy. And criminals don't face "the key-management problem". In any GAK scheme, the official keys can be used to certify other un-escrowed encryption keys. Binding cryptography makes it just a little easier, because there is no need to create any "illegal" key pairs. Everyone can encrypt messages using the government-certified ElGamal keys, and then repeat that process, this time including the data required for goverment access. that use of other systems will always be possible. Also, the above discussions already showed that if such a system is voluntary, then there are lots of way to go around it. Criminals will always find ways around these systems -- even if they are mandatory. Just those who actually "have nothing to fear", will not go in the risk to use illegal encryption. So governments can wiretap law-abiding citizens, but not criminals. What useful is a system like that? -- one ring to rule them all, one ring to find them one ring to bring them all and in the darkness bind them in the land of mordor where the shadows lie.

1 0

RE: RE: Binding cryptography - a fraud-detectible alternative to
by jim bell 17 Dec '03

17 Dec '03

At 11:48 AM 10/13/96 +0000, everheul(a)mail.rijnhaave.nl wrote: >To explain the backround of "binding cryptography" once more; with >respect to (interoperable, worldwide) security in the information >society socities/governments have to achieve two tasks: 1. >stimulating the establishment of a security structure that protects >their citizens, but which does not aid criminals. I think this is a phony distinction. Practically every product sold today could arguably "aid criminals." It isn't possible to prevent this. And that's the problem with your thinking above: If government argued that it had the authority to regulate any product that, arguably, "aided criminals," then it would automatically be able to regulate anything. > 2. Coping with the >use of encryption by criminals outside of this framework. > >An inherent problem with these tasks is that different >socities/governments have different views on the matter. Given that item we just read about Burma illegalizing the non-authorized use of fax machines and modems, that is a vast understatement! > So to achieve >the first task you'll need a concept behind the security structure >that is flexible enough to incorporate *any* crypto policy, i.e. from >liberal (Japan) to non-liberal (France). Just a second! WHy should technology bow to government policy? Until now, the microcomputer industry has pretty much developed and sold products without much or any (?) regard for what governmental policy would desire. In fact, it isn't even clear that governments have had much opinion about the direction that the microcomputer markets should go. Why should we start adjusting business policies and product capabilities in a way which is hostile to customers, just because the government wants this? > We believe that "binding >cryptography" is flexible enough to achieve this: a liberal crypto >policy might use no Trusted Retrieval Parties at all, while a very >non-liberal country might want one (government controlled) TRP, a >compliance check on all network traffic and a ban on other crypto. Why not ___NOT___ help these guys out? Do they somehow deserve to be assisted in the subjugation of their people? Does the name "Zyklon B" ring a bell? >With binding cryptography the issue on a crypto policy becomes >non-technical and politically debatable: which features does a country >want and what implementation? I would much prefer a situation where freedom is provided and/or guaranteed by technology, and it is NOT debateable! See, one problem is that contrary you your implication above, where you said that crypto policy becomes "politically debateable" (which implies that the ordinary people of a country have some input) the _reality_ is that any such decision will be made by a tiny number of bureaucrats, if they can get away with it. The US Clipper proposal was a classic example of this: There was absolutely no public discussion or debate on it before it was announced, and it was obviously intended to be a fait accompli. Further, nearly all non-governmental people who are aware of the crypto issue disagree with the government's policies in this matter. Clearly, you cannot imply that crypto will REALLY be "politically debateable"! >> For this kind of application, binding cryptography is spot on. >Jim bell[SMTP:jimbell@pacifier.com] wrote: >> I think the biggest problem with allowing "anyone" to check the >> correctness of a key is that what is a technical possibility today, >> will become a legally-mandated requirement tomorrow. What if >> Internet backbone companies and/or ISP's were told that they had to >> implement software check these keys, and if they discovered an >> "incorrect" escrowed key, they were legally obligated to either >> refuse to forward that message, and/or forward a copy of that >> message to someone like Spooks(a)NSA.gov or Thugs(a)DOJ.gov. > >The information society is international by nature; we want to >securely communicate with Singapore. If Singapore, a democratic >country!, has such a crypto policy that they want the above control, >then so be it. Don't blame "binding cryptography" for making that >possible, but start a dialogue with your politicians on what features >of the proposal are acceptable in your country. No, I think I _will_ blame your infernal invention for trying to make limited communication possible! There's no doubt that the leadership of places like Singapore might want to restrict communication, but on the other hand they also want to be connected to the rest of the world for "non-political" speech. In effect, they are forced to make a choice. Most countries, except for a very highly authoritarian few, will probably opt for connectivity and this will lead to increased freedom for the people in their countries. _YOU_ are trying to give those governments connectivity while maintaining tyranny. Are you proud of what you're doing? > >Some countries seem to have the philosophy that "law-abiding" citizens >should have nothing to "hide" from their government, so should not use >encryption at all. I think that that is not acceptable. The concept >behind the third-party checking is that no "law-abiding" citizen >should have any problem that abuse - and only that - of a *voluntary* >system can be "seen" by many parties. I think the terms "voluntary" and "abuse" are contradictory in your statement. If the system is "voluntary," then it is presumably "voluntary" to use a non-conforming system, right? And unless the government's goal is to harass or imprison or fine the user for not using that "voluntary" system, there is no purpose in knowing whether a person's use of encryption meets that "voluntary" standard. >If and *how* checking is >done, is a matter of each society. The same concept holds for many >things in life and is well accepted. I see: "How each society decides to use our thumbscrews is totally voluntary and up to each country!" Pardon me while I puke. > For instance that is why cars >have registration plates: if a car drives through after an accident on >a *public* road, then by-standers (third parties) can observe that. I >for one don't the information society to be the wild west, where >anything goes. I'm much closer to "the wild west" than you are, and I like it just fine. I prefer it much better than the tyranny of stratified societies that have enslaved people for over a thousand years. >Of course, people are rightfully worried that such a checkable system >might be abused by a totalitarian regime to control their citizens. >However, as long as such a system is voluntary I see no problem. Maybe you need to remember that the way governments use it, the definition of the word "voluntary" tends to pick up a rather Orwellian meaning. Also, you need to remember that the difference between a "voluntary" and a mandatory system may be as little as a single law passed in the middle of the night by a legislature. A law which you are intending to make possible! > Signs >in the USA indicate (cf. the NRC study & remarks of the president) >that use of other systems will always be possible. You seem to have ignored by conjecture, where I pointed out that Internet backbones and ISP might, hypothetically, be required to check keys and report "violations" to the government on a moment-to-moment basis. Further, they might be prohibited from forwarding messages that do not conform. This gets us back to the definition of the world "voluntary," again. Even if such an eventuality should occur, the government could cynically say that use of non-conforming forms of encryption were still "voluntary," because it's true you could use them. But they wouldn't be very useful if they didn't propagate on the Internet, now would they? >Also, the above >discussions already showed that if such a system is voluntary, then >there are lots of way to go around it. Not if the cooperation of everyone else is coerced! And moreover, not if they are coerced into not dealing with anybody who doesn't go along. You must really hate freedom, huh? Jim Bell jimbell(a)pacifier.com

7 6

None
by nobody＠replay.com 17 Dec '03

17 Dec '03

> The NOTS materials were just posted again to a.r.s. via > huge.cajones.com Thanks for telling me where to find the NOTs; I always wanted to read about how to rid myself of body thetans. Now I have been enlightened by Hubbard's words and you are guilty of contributory copyright infringement. (The SPA told me so :)

2 1

Re: Fuck Cyberpromo
by Rich Burroughs 17 Dec '03

17 Dec '03

At 11:07 AM 10/13/96 CST, roy(a)scytale.com wrote: [snip] >Anyone on the list know of a good, heavy-handed collection agency that >would like to take this when it tops, say, $500? Why not just filter the shit? It's not like they're switching addresses or anything. All mail from that address just goes straight to my trash unread... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

4 3

Re: is there no end to AP & Creative Wiretap Arguments?
by jim bell 17 Dec '03

17 Dec '03

At 03:47 AM 10/12/96 +0000, attila wrote: > after months of patient explanations to Jim Bell and > sympathizers, going over the same points in 31 flavours, > the same arguments of what I would call "respectable" anarchy > (well stated by Tim May) rather than the "world at war" anarchy of > Jim Bell -- where are we?!? > > I read Jim's first "manifesto" at least 18 months ago; and, the > "refined manifsto" less than a month ago. I have yet to see an > application of civilization which brings AP society up to even the > level of Tombstone AZ just prior to the OK Corral. Be careful about the Wild West analogies. Current theory is that contrary to what Hollywood cooked up for our movie-viewing pleasure, it was a rather peaceful place most of the time. If anything, the reason that certain incidents (OK Corral) were so memorable is that they were, likewise, rare. > > Jim's theories all hinge on betting pools which supposedly can > be run like the lottery where the poor can share a ticket > (egalitarian, of course), anonyminity (which as an argument is > appropriate, but what for in a selfish immoral act?), and a > justice is served attitude, even if there are mistakes. I would be far more worried about "mistakes" if I hadn't already thought through it, and concluded that abuse and misuse and errors would be strongly deterred by the very structure of the AP system. It will most easily attack who coerce the most people, for example politicians, bureaucrats, and some government employees in general, precisely because the cost will be shared among hundreds or thousands. It will also fairly easily get rid of "common criminals," since most people have been a victim of crime at some point in their lives and would be willing to pay to prevent this in the future. However, using AP to attack undeserving people will be difficult precisely because it would be rather expensive, since the cost will presumably not be shared. True, it isn't any kind of centralized coercive control, but it is a excellent form of control, somewhat analogous to the "invisible hand" concept of free markets. The problem is, it's difficult for some people to comprehend the kind of distributed-control that free markets represent. > the whole concept of AP does not even support the concept of > "justice is expeditiously served!" it is a resort to the manners > of dogs and monkeys sitting at the same table --a spiteful, > arrogant player can move the betting pools to assassinate anyone. There is a powerful limitation as to how much one individual can manipulate the system, as I've previously described... And besides, the problem you describe already exists: Gang-related murders are an example. AP would eliminate the gangs, at least to the extent that they are a threat to others. > In other words, are we planning to use James Caan as the lead > runner in "Roller Ball" --except this time we're playing with a > "live" society for which we hold in common the utmost contempt? > > are we trying to return to the bread and circus mentality of > Rome on its deathbed and slide to subjecation by Attila the Hun > who was actually stopped from sacking Rome after the Pope so > impressed him with his regal robes.... deciding tribute from an > established dictatorship was more reliable? --and less costly?!? > > has anyone seen a single social moral fiber in Jim's often > passionate arguments for AP, I'm afraid yours is a vastly distorted question. Let's go back to the beginning, shall we? I've claimed that AP will: 1. Eliminate war and militaries. 2. Eliminate government and taxes. 3. Eliminate dictatorships and political tyranny. 4. Drastically reduce crime and the costs of crime. Add all this up, and presume that I think it's a good thing (I do) and how can you claim that this is not "a single social moral fiber"? Sure, you could claim that AP won't do these things, or not all of them, or not very well. I happen to believe it will. Even if you're partly right, at most you have a challenge to my judgment, not my morality or sincerity. > or even in the "results" in a society > which will never breed another leader: religious, secular, or even > political? What, exactly, is wrong with a society without leaders? Do we NEED leaders? I understand that people have probably gotten so used to the concept of having leaders around that its hard to imagine the alternative, but you're going to have to do better than this to support the existence of leaders. > does AP permit anything except slaves and drones which can > just as easily be replaced by robots? maybe noone will miss news > reports (as 'canned' as they are), This may sound odd, but what is there wasn't any news to report? Maybe that's exaggerating things a bit, there will always be weather and the occasional accident and other events. But watch the news for a while, and notice what a large fraction of it is government-related, politics-related, war-related, coercion-related, etc. > or movies which entertain or provoke? It's unclear why you think AP will prevent this? > or ice cream sundaes at the soda fountain? likewise... > ...and the disappearance of grocers, and doctors, and dentists > bringing forth a new age of subsistence farming and hunting for > the lucky few who might live to a readjusted live expectancy point > of 30 yrs, burning books and computer printouts for cooking and > warmth. Is this line of argumentation a throwback to the "we've got to have a dictator! How else will society operate?" > > why have books or knowledge when there is noone willing to > accept the responsibility of educating your children, the instructor > waiting for the parent of Dumb Suzy to avenge her failing grade? If it's a private, non-coerced school, why should this happen? > sacrificing 55,000 men and frying the brains of another > 1.5 million solely to fatten the industrial war machine? using > John Foster Dulles' "domino theory" to justify the carnage... BTW, in an AP society Vietnam couldn't ever happen, for at least a dozen reasons. > to bad I was still of an era which said 'you will serve if called' > and so stupid to take almost six years to get out. Would you > serve a country today which is rotten to the core? No, I won't. But I will be happy to help eliminate that rot. > "Assassination Politics" is nothing more than a childish game > which 'legalizes' killing anyone you wish. are AP's proponents so > naive they believe the bookies will not have any public person > assassinated by rigging the pools for their own profit? remember, > law enforcement ceased with the return of 'law of the jungle' > anarchy. "Laws" will no longer be enforced, it's true. However, legitimate interests will be defended and intiation of force will be punished. Jim Bell jimbell(a)pacifier.com

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by jim bell 17 Dec '03

17 Dec '03

At 04:28 PM 10/13/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >It is unpublished, but he kindly allowed to me describe it in a paper I >wrote that discussed whether a bank would ever want to take the risk of >allowing bank accounts where it did not know the identity of the customer. Why should that be a problem? It's the customer's money, isn't it? It's not like the bank is making a loan. It's the customer who should be worried...about the bank's identity. Remember "plausible denial." Shouldn't we believe that if a bank cannot know its customer, likewise it isn't responsible for who that customer is? A bank's legitimate interests should not include acting as enforcer for the government, so any system that prevents this from happening is helpful. And I don't think that a bank can ever be embarrassed (assuming bank accounts are anonymous) by it being revealed that some particular bad guy kept his money there, any more than other cash-based (anonymous) businesses are embarrassed if it is revealed that some bad guy used their services. Jim Bell jimbell(a)pacifier.com

4 6

Re: [STEGO] Enigma
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timmy C[ocksucker] May is a phoney and a fraud.

1 0

Re: -No Subject-
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

Why not just make flute or netscape your shell instead of program manager? (Shell= line in system.ini) Ryan ---------- Previous Message ---------- To: cypherpunks cc: From: kpieckie @ Harding.edu (Compton) @ smtp Date: 10/11/96 11:12:03 PM Subject: -No Subject- Due to the high volume of mail from this list, I rarely get to read every message that comes through here. Thus, I ask a reply be sent to kpieckie(a)harding.edu directly rather than through the list. Please forgive the interruption if this message is slightly off-topic. The library here at Harding University is attempting to set up some internet computers that run Netscape only and do not allow access to anything else on the computers. We use a scripting program called Flute that hides the Program Manager (WFW 3.11) and reloads Netscape when it is nuked with Alt-F4. Another program removes the ability to use any of the netscape pulldown menus less help. The problem is the keyboard. If a user hit's Alt-F4 after Progman has loaded but before the Flute script executes, Flute is terminated and the user has access to the computer. Are there any programs that will disable Alt-F4 and Control-Esc in Windows? Where can they be attained? Freeware is preferable, shareware is fine, trial period is required for commercial products. Thanks. Kevin kpieckie(a)harding.edu

1 0

Re: BAY AREA CYPHERPUNKS SATURDAY 10/12 TRESSIDER HALL STANFORD
by Tom Lojewski 17 Dec '03

17 Dec '03

How do I get off this list? >X-Sender: erchiu(a)diablo.cisco.com >Date: Fri, 11 Oct 1996 11:54:43 -0700 >To: Bill Stewart <stewarts(a)ix.netcom.com> >From: Eric Chiu <erchiu(a)cisco.com> >Subject: Re: BAY AREA CYPHERPUNKS SATURDAY 10/12 TRESSIDER HALL STANFORD >Cc: cypherpunks(a)toad.com >Sender: owner-cypherpunks(a)toad.com > >At 01:06 AM 10/11/96 -0700, you wrote: >>There will be a San Francisco Bay Area Cypherpunks meeting on Saturday 10/12 >>at Stanford University. The meeting location will be the tables outside >>Tressider Hall, where we've met for several previous meetings. >>The canonical time is noon for lunch and milling around, and 1pm >>for organized program. > >Bill - > >What time is the meeting? >Eric Chiu >IS-Finance and Adminstration >Tel: 408-527-1665 >Pager: 415-424-7282 > > > --------------------------------------------------------- Tom Lojewski - ProNet Consulting - lojewski(a)earthlink.net

1 0

Clinternet?
by Tom Lojewski 17 Dec '03

17 Dec '03

How do I get off this list? >X-Sender: rah(a)tiac.net >Date: Fri, 11 Oct 1996 12:02:04 -0400 >To: cypherpunks(a)toad.com >From: Robert Hettinga <rah(a)shipwright.com> >Subject: Clinternet? >Sender: owner-cypherpunks(a)toad.com > >Hoo boy. > >I had the most amazing whiff of paranoia from the morning news. > >Clinton wants to buy the internet back for $500 million so he can watch us >better? > >Nawwww, 'course not... > >Cheers, >Bob Hettinga > >----------------- >Robert Hettinga (rah(a)shipwright.com) >e$, 44 Farquhar Street, Boston, MA 02131 USA >"The cost of anything is the foregone alternative" -- Walter Johnson >The e$ Home Page: http://www.vmeng.com/rah/ > > > > --------------------------------------------------------- Tom Lojewski - ProNet Consulting - lojewski(a)earthlink.net

2 1

Re: COMMUNITY CONNEXION SUED IN FRIVOLOUS LAWSUIT
by nobody＠replay.com 17 Dec '03

17 Dec '03

The SPA allegedly send sameer(a)c2.net a letter, demanding, among other things, that he "agree to implement monitoring procedures to prevent similar acts of copyright infringement and report those procedures to SPA." Under federal law (Electronic Communications Privacy Act) it is illegal to monitor users' actions unless there is a specific contract between the service provider to allow such monitoring, or a court of law has issued a valid search warrant. If the SPA did in fact send such a letter, what they are doing is illegal. They have alleged that a copyright violation has occured. If that were true and they had evidence to support that claim, then under federal law, they could have asked a judge to issue a search warrant to seize the infringing material and stop its distrubution, and/or they could have subpoenaed information about the alleged infringers from C2NET. But, because they did not have any evidence of a copyright violation, they could not get a search warrant. Consequently, they have attempted an illegal search, in violation of the ECPA. They threatened the CEO of C2NET with legal action if he did not assist them with their unlawful scheme. He rightfully refused, and now they are carrying out their threatened harassment against him. The lawsuit filed by SPA mentions no specific cases of copyright infringement, because, in all likelihood, there never were any. The SPA is merely going on a fishing expedition. The SPA should not be suing Sameer - Sameer and his users should be suing the SPA.

1 0