December 2003 - cypherpunks-legacy

Fairness, Justice, and Cypherpunks (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Tim, Forwarded message: > Date: Tue, 28 May 1996 13:55:36 -0700 > From: tcmay(a)got.net (Timothy C. May) > Subject: Fairness, Justice, and Cypherpunks > > Several recent messages have raised issues about "ownership of > information," "compilation of dossiers," and the (putative) imbalance > between personal power and corporate power (which some think justifies > denying corporations certain basic rights or Constitutional protections). > Businesses (and government) have no rights under the Constitution and should enjoy no rights under the Constitution. Rights are the sole purvue of real live human beings (ie individuals) and not groups or paper individuals (stupidest idea I have ever seen in the legal field). It is not reasonable to support a motion which allows a group to have the same or possibly more rights than the individuals that make it up. Business should not get the right to vote, they should be completely prohibited from being involved in politics even to the point of making contributions to politicians. Eisenhower once warned this country of the military-industrial complexes threat, we have ignored it to date. Jim Choate

1 0

NRC Report, 7, 8
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Part III Policy Options, Findings and Recommendations Chapter 7 Policy Options for the Future http://pwp.usa.pipeline.com/~jya/nrc07.txt (124 kb) Chapter 8 Synthesis, Findings and Recommendations http://pwp.usa.pipeline.com/~jya/nrc08.txt (134 kb) ---------- 14 (quite meaty) Appendices later today.

1 0

Re: opinions on book "The Truth Machine"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:53 AM 6/1/96, Adam Back wrote: >Tim May <tcmay(a)got.net> wrote: >> At 7:06 AM 5/31/96, Timothy C. May wrote: >> >It sounds like a "make.money.fast.by.promoting.this.book" scam to me. > >If you mean myself, this had not occured to me and I assure you I have >no connections with the author, and no interest in promoting sales of >his book. No, Adam, I certainly was not implying you are profiting from this in any way. Maybe the "make.money.fast" description was a poor one...what I meant to imply is that the book is being advertised widely (I've seen half a dozen announcements of it), and it reminds me of either the Craig Shergold or make.money.fast posts, not sure which. >The writing style wasn't great, and I'd agree there were plenty of >flaws, but what I was interested in was cypherpunks opinions on the >technology, rather than the quality of the book, or making money for The main technology, "the truth machine," is so bogus as to be boring. >The interesting technologies touched on were: > >- cheap video used by everyone to record their own lives A better treatment of this is in David Brin's "Earth." >That government might have a go at mandating a "voluntary" video >survielance set up doesn't seem that unrealistic in the current >political climate. Having just read your post on curfews my response >was what the fuck, are you serious? It totally amazes me that public >opinion has got to the stage that something like this would be >accepted. Sounds like a military dictatorship. Children first, >adults next? The level of peoples paranoia about reducing crime at >any cost has been severely underestimated. Surely that's way out of >line constitutionally? We agree. I once jokingly wrote a post about "position escrow," and I now fear it is not so far off. ("The Positional Update Tracking Zoner (PUTZ) meets law enforcement's legitimate needs, with proper court authority, to track the movements of citizen-units.") However, what you say below about being required to explain your movements to cops who stop you on the highway and then present "papers" to them within one week is truly horrifying, far beyond anything we yet have here in these beknighted states: >For instance I have been stopped by the police four times late at >night driving home, as I live some distance from the university. The >questions are basically what is your business (ie what are you doing >so late at night), and then they get you to take in your papers to the >police station within 1 week which is an inconvenience. Also the ... !!! Glad I don't live in Britain. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Optimism re NRC Cryptography Report
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

At 07.40 AM 5/31/96 -0700, tcmay(a)got.net wrote: >Unless laws are passed very quickly to outlaw the things we are involved >with, including such things as superencryption, steganography, anonymous >remailers, and digital money, I think we will "win the race to the fork in >the road." The "fork in the road" being the point at which the changes are >unstoppable. How fast is very quickly?

1 0

Re: WSJ on "IRS-bashing"
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 04:01 PM 5/29/96 -0700, Rich Graves, who lives in a parallel universe where political correctness is no threat to liberty, and the FBI and BATF no threat to law abiding people wrote: > any such law > would be invalidated by R.A.V. v. St. Paul. The only exceptions are > restrictions on "fighting words" that meet the tests in Chaplinsky v. New > Hampshire and "hostile working environment" discrimination, which I assume > is what you're talking about, in some elliptical way. When I was looking for a house in Oregon, I pointed at the map and asked the real estate lady "Why are houses in this area cheap". She did not give a straight answer I pressed her, and then she then started asking me questions that indicated she suspected I was an agent provocateur from the government trying to entrap her into revealing forbidden information. I eventually discovered that the area in question was occupied predominantly by people of a particular ethnic group, but she was forbidden to tell me this information. This explanation of the price disparity did not occur to me until she started feeling me out to see if I was a cop. But Rich Graves does not regard that sort of thing as any violation on freedom of speech. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: [Off-Topic] "Curfews"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 31 May 96 at 19:08, Timothy C. May wrote: > This is off-topic for the list, but I want to share it anyway. It touches > on issues of increasing police surveillance, and also touches on the issue Not really too off topic at all, considering the surveillance state and GAK relate very much to what we're doing here. An aside: at the University I used to attend, there were field trips to this small museum on the campus by elementary school children, who apparently regarded the motion detectors for the automatic doors as being cameras which they'd happily wave hello to. Images of Huxley's Brave New World intermingled with Warhol's 15-minutes-of-fame stewed up with Orwell here.... > of "age credentials" (in the sense that how else is a cop who stops a young > person for "curfew violation" to determine if a violation has occurred when > most 14- and 15-year-olds carry no driver's licenses?) Since when are we now to carry ID everywhere. And of course the local police will (as usual) be selective about who they stop to ask about directions. Also note that a reasonable exception will be for kids to go to work or school-related activities (institutional), but nothing non-institutional such as a party at a friend's house (drugs or no drugs), band practice, etc. etc. > The "curfew" meme is spreading quickly, with Clinton calling for a federal > curfew, at least in cities, and Dole trying to outdo him with even more > draconian curfew laws. Many communities already have them, including San > Jose, New Orleans, and other large cities. And my own community, Santa Cruz > County, ironically begins a curfew program on Saturday, tomorrow. Some communities here in Long Island have them. Others have fought them, and I think a couple of attempts were struck down by courts. Also a blurb in the local papers about police not wanting the curfew here, believing it to be a waste of their time or unnecessary... (I'll have to dig the article up; I only rememebr it wasn't reassuring.) [..] > (Some purists claim that children are exempted from normal constitutional > protections, such as the right of free association, the right to be free > from unwarranted searches and seizures, the right of free speech, etc. > Especially this comes up in debates about rights in public schools (speech, > locker searches, movements are controlled, etc.). But I think a public A problem indeed. Children grow up used to the surveillance society and don't mind it when they become adults. Imagine a whole generation coming of age being told they are "criminals". Things will be very "interesting" (in the Chinese fortune cookie sense) during the next 10-20 years... > As I said, should such curfews become widespread, children will of course > need forms of age identification, and this opens yet another door for > universal I.D. cards. And for "travel papers." ...or they'll stay at home and net surf. Beware the Four (or six?) Horsemen... Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Arms Trafficker Page Made CNN!
by Vincent Cate 17 Dec '03

17 Dec '03

The Offshore Information Services Arms Trafficker page made CNN Computer Connection just moments ago. :-) The page: http://online.offshore.com.ai/arms-trafficker/ is now famous. :-) -- Vince

1 0

Re: Fairness, Justice, and Cypherpunks (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:49 PM 6/1/96, Jim Choate wrote: >Businesses (and government) have no rights under the Constitution and should >enjoy no rights under the Constitution. Rights are the sole purvue of real live >human beings (ie individuals) and not groups or paper individuals (stupidest >idea I have ever seen in the legal field). It is not reasonable to support This may come as a surprise to newspapers, which are corporations for the most part, and other publishing companies. Here we thought the First Amendment covered them. Apparently not. The government of the U.S. may freely tell "Time" magazine what to right, may tell "Wired" what official slant to put on a story, and what images "Playboy" may not publish. Oh, and the various religious institutions are clearly not covered, either, as they are groups. While _individuals_ are free to worship as they please, they'd better not form a church or synagogue, lest the government give them instructions on what to do. And the Fourth Amendment and other amendments don't cover small businesses, large corporations, etc., so the cops are perfectly free to knock the doors down, enter whenever they wish, force companies to quarter troops, seize property without due process,.... Is this what you're saying is the case, or is this what you want to be the case? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Interesting forum on CSPAN
by Mike Fletcher 17 Dec '03

17 Dec '03

Was channel surfing last night while MST3K was in a commercial and wound up watching a panel on CSPAN from the World Economic Forum on "Technology & Security". The pannelists were Nicholas Negroponte from MIT's Media Lab, John Barlow from the EFF, a Mike Nelson from the White House (no relation to MST3K's :), and two other people whom I can't for the life of me remember their names (one was from a security consulting firm, and the other was a lawyer from something like the "Bristol Group"). It was 3am, so sue me. :) I missed the first few minutes, but there was a bunch of administration encryption policy bashing from all sides. Nelson kept saying that the administration wanted to support "good strong encryption" and they wanted to be able to say (paraphrasing) "We think this is good. Use this." (Trust us, we're from a TLA. :) He also kept saying that (again, paraphrasing) "most encryption out there is no good". Which begs the question then why are they wanting to ban its use and export. Negroponte kept bringing up the point that their policy was based on the (flawed, as we all believe) assumption that no one outside the US could create good crypto. Other topics that were touched on were intellectual property rights and e$. It was interesting that the lawyer person agreed to a good extent with a lot of the remarks Barlow made. Overall it was pretty interesting (and not just to watch the White House guy squirm as his premises were invalidated out from under him :). CSPAN usually replays stuff like this at odd times during the weekend so you might want to keep your eyes peeled. --- Fletch __`'/| fletch(a)ain.bls.com "Lisa, in this house we obey the \ o.O' ______ 404 713-0414(w) Laws of Thermodynamics!" H. Simpson =(___)= -| Ack. | 404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43 U ------

1 0

(Fwd) Developers Directory
by Deranged Mutant 17 Dec '03

17 Dec '03

I got the following 'junk' email so I bit. They asked for updated descriptions of software that I've thrown on the net, along with shareware/freeware/GPL/comm. ratings, etc. Also violence ratings... I set all my source codes to "Gruesome" <insert cheesy emoticon here> Interesting to see what proggies of mine they listed and what they didn't. --Mutant Rob ------- Forwarded Message Follows ------- Date: Sat, 1 Jun 1996 15:21:29 -0600 From: Author Database Maintenance <authors(a)exodus.pht.com> Subject: Developers Directory Dear Author, We're building a public database called the "Developer's Directory" which contains information about authors of shareware/freeware programs. We'd like to include you and some information about your programs. We'd sure appreciate it if you'd visit our website and help us fill in some info. http://pacific.pht.com/ [ my info deleted ;] Since this system is still in the testing phase, we'd like to hear your comments and suggestions. Please send them to: authors(a)pht.com Thank you! Koji Ashida --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: NRC Cryptography Report: The Text of the Recommendations
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 10:55 AM 6/1/96 -0700, watson(a)tds.com wrote: >Anybody know who the NRC is and whether they have any influence with anyone? They have influence in that their reports have a fair amount of credibility with the extra boost of NAS's "scientific authority." If one wanted to distinguish what they do with what the OTA did for instance, one could say that while the OTA generally had a very smart/competent staff (and had a turbulent, poorly managed history and political troubles) the NRC has the strength in that it is non-governmental and has the shroud of "scientific neutrality" about it it could hope to pull from its parent organization, the NAS. The NAS and NRC have interesting histories, the NAS was an honorary society that had some fundings for it snuck into an appropriations bill back in 1863, but generally it was not supported by the government aside from specific "contract" studies which the Congress might ask for. The NRC (known as the NDRC) was created as an advisory council under NAS to help the government with munitions research and development during WWI. Since, they conduct hoc scientific/policy studies to investigate a topic on Congress's behalf. Their "Realizing the Information Future" that came out a couple of years ago was highly regarded. For history on these topics I recommend: Hunter Dupree, Sciene in the Federal Government: A History to 1940, Harper & Row, 1974. Bruce L. R. Smith, American Science Policy Since World War II, Brookings Institution, 1990. >From their WEB page: National Research Council NRC Logo The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy's purposes of further knowledge and advising the federal government. Functioning in accordance with general policies determined by the Academy, the National Research Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The National Research Council is administered jointly by both Academies and the Institute of Medicine. Dr. Bruce M. Alberts is the chairman of the National Research Council. _______________________ Regards, Real generosity toward the future lies in giving all to the present. - Albert Camus Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Deranged Mutant 17 Dec '03

17 Dec '03

There was a story on CNN about how anonymous people on IRC (and other commercial online chats) giving stock tips is a Bad Thing (tm). Actually had some guy saying that a law should ban anonymous discussions of stocks online. Yeesh. What ever happened to caveat emptor? (Like a recommendation on IRC is automatically more trustworthy than overhearing a conversation in a public bathroom?) --Mutant Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: NRC Cryptography Report: The Text of the Recommendations
by medea＠alpha.c2.org 17 Dec '03

17 Dec '03

Dave Watson wrote: >Anybody know who the NRC is and whether they have any influence >with anyone? Dave, Maybe the following article might answer your question.... Medea +++++++++++++++Forwarded Article+++++++++++++++++++ WASHINGTON (Reuter) - Cryptography, the art and science of secret writing, has long been the province of soldiers, rulers and spies. But a study for Congress released Thursday said the U.S. government should promote widespread commercial use of such tricks to curb theft of computer data, wireless communications and other electronic information. A committee of the National Research Council, which gives science and technology advice under a congressional charter, said a broad use of cryptography would help the United States in many ways including making banking and telecommunications networks more secure and giving individuals greater privacy. In a report requested by Congress, the panel said no law should bar the manufacture, sale or use in the United States of any form of encryption -- mathematical formulas to scramble electronic data to thwart eavesdroppers. Largely siding with industry in a long tug-of-war with law enforcement officials, it also said export controls on encryption technologies should be "progressively relaxed but not eliminated." The Clinton administration and its predecessors have blocked the export of powerful cryptography, fearing it would hinder officials in thwarting terrorism and counter-espionage. Committee chair Kenneth Dam, a law professor at the University of Chicago, acknowledged that the spread of encryption technologies would make some law enforcement and spying tougher for the United States. "But the many benefits to society of widespread commercial and private use of cryptography outweigh the disadvantages," he said in a statement accompanying the report, entitled "Cryptography's Role in Securing the Information Society". The administration wants to set up government-approved repositories that keep copies of mathematical keys for decoding encrypted information so officials can lift the veil on secret communications if granted a court order. Industry executives and privacy advocates strongly oppose such "escrowed" encryption, arguing that reliable coding technology is critical for commerce and for privacy in the information age and on the Internet, the worldwide collection of computer networks. In its study, the committee said U.S. policy should take account of national security concerns but should be driven more by market forces than by law. "Since the committee believes that widespread deployment and use of cryptography are in the national interest, it believes that national cryptography policy should align itself with user needs and market forces to the maximum feasible extent," it said.

1 0

NSCP, PRZ Hit NRC Crypto Rec
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Netscape (WSJ) and PRZ (Globe) say the NRC crypto export recommendations don't go far enough. ---------- Wall Street Journal, May 31, 1996, p. B5. U.S. Strategy Should Promote Computer Codes Panel Says a Free Market Is Best Policy, Urges Easing of Export Curbs By John J. Fialka Washington -- The federal government should promote rather than discourage widespread commercial use of powerful codes that can protect electronic communications, a panel sponsored by the National Research Council recommended. The government also should relax its export controls on such codes, according to the 16-member panel, which included a mix of business, academic and government experts. The NRC is an affiliate of the National Academy of Sciences, a private, nonprofit organization that advises the government on scientific matters. Encryption coding software scrambles computer data by using mathematical formulas that can't be read if intercepted. Only personnel with the correct "keys" can access the data. More Study Needed The NRC study, which took 18 months to complete, calls for greater trust in freemarket demands for protection and less reliance on the U.S. National Security Agency and the Federal Bureau of Investigation to set the nation's code policy. It said the two agencies' recent promotion of "escrowed encryption," in which the government would hold a mathematical key to unlock codes, requires further study because it poses liability risks and introduces weakness into information protection systems. Kenneth W. Dam, a University of Chicago law professor who headed the panel, said changes are needed to counter "an explosion of computer-based crime" and other forms of espionage that threaten U.S. companies' ability to protect proprietary information, especially overseas. By promoting the use of more-elaborate codes, U.S. law-enforcement agencies would be better prepared to ward off hacker or terrorist attacks on the nation's electric power grid, banking and telecommunications systems and its air-traffic control networks, he added. Potential Problems Mr Dam said the widespread use of encryption by private business is "inevitable" and the government must "recognize this changing reality." The report noted that the FBI has argued for years that its law-enforcement efforts would be hampered if drug cartels and other organized criminals began using codes that couldn't be deciphered. Courtordered wiretaps, a major tool used to break organized-crime cases, could become useless, the FBI has contended. Edward Schmults, general counsel for GTE Corp. and a former deputy attorney general during the Reagan administration, said he and other panel members believe the FBI and other law-enforcement agencies would be helped more than hurt if legitimate businesses were better protected. "It's a balancing issue," he said. Spokesmen for the FBI and NSA referred questions to the White House, where an official said the Clinton administration disagrees with the panel's recommendation to relax export controls and wants to continue to explore the use of escrows by private industry to keep the keys to powerful codes. "We have equities to protect that the people who wrote the NRC report do not," he said. The administration, he said, still wants to review the export of more powerful codes on a case-by-case basis. The use of private, third-party escrows, he said, might be one way to protect the secrecy of companies while allowing federal agents with court orders access to code keys. New Markets Would Open The panel called for the U.S. to permit the export of codes containing a "56-bit" Data Encryption Standard algorithm. The algorithm, or formula, was developed by the National Bureau of Standards in 1975 and is 65,000 times tougher to break than current "40-bit" codes that are permitted for unlicensed exports. The panel estimated its recommendations would open up new markets for information security products, possibly increasing software-industry revenue "many tens of billions of dollars." Until now, export controls tended to set industry standards for a level of protection because companies were reluctant to use different systems for domestic and international applications. Jeffrey Treuhaft, director of security at Internet software giant Netscape Communications Corp., welcomed the report, but said exports shouldn't be limited to 56-bit keys. That would still blunt the competitive edge of U.S. software vendors, given that code-cracking computer power is multiplying, he said. "The U.S. has a lead right now and these arcane policies from the Cold War are giving U.S. industry cement shoes to compete with foreign competitors," Mr. Treuhaft said. "We can't run as fast as they ean." - Jared Sandberg in New York contributed to this article. [End] ---------- The Boston Globe, May 31, 1996, p. 36 Panel criticizes US government's encryption stand 'Net, cell phone security at stake, National Research Center says By Hiawatha Bray The Clinton administration's efforts to limit the sale of software that generates coded messages, already unfire from Congress and civil libertarians, is now facing criticism from a committee of the National Academy Sciences. The National Research Center, which gives science and technology advice under a congressional charter, yesterday said the government should promote the commercial use of encryption software to help cut down on the theft of computer data and other electronic communications. Law enforcement officials and intelligence agencies are worried about the development of cheap encryption grams, for fear it could become impossible to intercept a mobster's telephone call or read an enemy spy's electronic mail messages. But the center's report says that encryption software is essential for businesses and individuals who need to transmit confidential data using the Internet or cellular telephones. "On balance, the advantages of more widespread use of cryptography outweigh the disadvantages," the report says. Encrypted messages can easily be read by someone with the correct code "key." Without this key, it can take centuries of computer analysis to decode a message. The longer the key, the tougher it is to break the code. Under current federal law, US companies cannot export encryption programs that use keys longer than 40 bits. Computer experts say that 40-bit encryption systems are easy to break, and provide little security. As a result, many software companies that sell their products worldwide do not build in sophisticated encryption features. Industry experts say that this costs them millions of dollars in sales, as customers in foreign countries buy encryption software made outside the United States. The report urges a change in the federal law, to allow sale of an encryption system called DES that uses 56-bit keys. "Except in some very specialized situations, it gives adequate security," said council chairman Kenneth Dam, a law professor at the University of Chicago. The report also urges the administration to abandon efforts to force businesses and individuals to use "key escrowed" encryption software. Under this plan, companies could use encryption, keys of any length, but only if the keys were held in escrow, and could be made available to the government. The council urges the federal government to adopt key escrow to prove that the system is trustworthy. The report argues that many businesses will voluntarily adopt such a plan to guard against the loss of its encryption keys. A prominent critic of encryption policy was less than thrilled by-the council report. "It doesn't go far enough," said Philip Zimmermann, inventor of the Pretty Good Privacy encryption program. Zimmermann scoffed at the idea that DES encryption is secure enough for use by businesses. "It can be broken in seconds by the NSA [National Security Agency]," Zimmermann said. "All major governments can break DES. In fact, any Fortune 500 company can afford a machine that can break DES." But even if DES were secure enough, Zimmermann said he opposes any restrictions on the export of encryption software. [End]

1 0

Hello there! Re: Where does your data want to go today?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Someone who claimed to be David F. Ogren said on Sat, 1 Jun 1996: > > The brute force system decrypts the first, and second blocks (8 > > bytes each) of the cyphertext, XORs them, and compares the result > > with "PKZIP2.1". If the comparison is equal it has the key. > I will concede that having a known header, such as a PKZIP header, > does weaken a crypto to certain degree, but I still believe that it is > not a significant problem. Here's why: Why not simply use two session keys, and encrypt the headers with one while encrypting the actual data with the other? That seems to solve both problems, except that more CPU cycles are required.

2 1

NRC Report, Appendices
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Appendices A-D: http://pwp.usa.pipeline.com/~jya/nrca-d.txt (187 kb) With images of Tables D.1 and D.2 for Appendix D: http://pwp.usa.pipeline.com/~jya/nrcd1.jpg (101 kb) http://pwp.usa.pipeline.com/~jya/nrcd2.jpg (118 kb) Appendices E-N: http://pwp.usa.pipeline.com/~jya/nrce-n.txt (199 kb) ---------- Thanks to DN. ---------- APPENDICES A Contributors to the NRC Project on National Cryptography Policy B Glossary C A Brief Primer on Cryptography D An Overview of Electronic Surveillance: History and Current Status E A Brief History of Cryptography Policy F A Brief Primer on Intelligence G The International Scope of Cryptography Policy H Summary of Important Requirements for a Public-Key Infrastructure I Industry-Specific Dimensions of Security J Examples of Risks Posed by Unprotected Information K Cryptographic Applications Programming Interfaces L Laws, Regulations, and Documents Relevant to Cryptography M Other Looming Issues Related to Cryptography Policy N Federal Information Processing Standards

1 0

Class III InfoWar
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

Feel Free To Distribute Widely: Class III Information Warfare: Has It Begun? The June 2, 1996 Sunday Times from London front page headline reads: "City Surrenders to L400 million Gangs" And HERF Guns, Electromagnetic Pulses and sophisticated logic bombs may be responsible. At InfoWarCon II, Montreal Canada, I made reference to investigations I was conducting regarding concerted and organized attacks on up to 43 financial institutions in Europe and the US; an example of Class III Information Warfare. This issue of London Sunday Times brings a glimpse of the story that will eventually be told. The first attack in my files dates to January 6, 1993. A trading house in London was blackmailed into paying L10million to unknown extortionists who demonstrated they could crash the company's computers at will. The next incident in the Times article is also in my files: January 14, 1993 where similar demonstrations and demands were made for this time L12.5Million. And so is the next, January 29, 1993 and another L10Million siphoned off by the bad guys. According to my figures and those in the Times article, hundreds of millions of pounds have been paid ransom in what is clearly an example of Class III Information Warfare. According to officials in Washington, Whitehall, London, City of London Police, the National Security Agency, Kroll Associates, Bank of England and others (in the article) the threats are credible. The attackers have the clear ability to bring trading and financial operations to a halt - exactly when they say they will. "Banks, brokerage firms and investment houses in America have also secretly paid ransom to prevent costly computer meltdowns and a collapse in the confidence among their customers," sources said in the article. The article discussed the advanced information warfare techniques used by the perpetrators. "According to the American National Security Agency (NSA), they have penetrated computer systems using 'logic bombs' (coded devices that can be remotely detonated), electromagnetic pulses and 'high emission radio frequency guns' which blow a devastating electronic 'wind' through the computer systems." [For a complete description of HERF Guns (coined by Schwartau in 1990), see "Information Warfare: Chaos on the Electronic Superhighway," Thunders Mouth Press, 1994] The perpetrators have also left encrypted messages, apparently bypassing the highest security levels of the systems, leaving messages such as "Now do you believe we can destroy your computers?" The NSA and other officials believe that four gangs are involved; probably one from the US and probably one from Russia. But, because the crimes are international, national borders still prevail, making investigation more difficult. Investigations and official inquiries have been in progress for some time according to the article. Now, for a few things you will not see in the articlem, but will hopefully [if I am lucky] come out in the near future. The number of attacks is way above 40. They have been known about for almost three years, but only recently have people been willing to come out of the closet and discuss this highly sensitive issue with the media. Long briefs and analyses of these events have been submitted to high level officials and select business persons for at least a year, but to no avail. [Security by obscurity reigns all too often.] Banking is not the only industry that has been attacked and the attacks have been spread around Europe as well as Australia. As an industry many of us have said that the only way something will really be done is if we experience a Computer Chernobyl [Peter Neumann Phrase as I recall] or as I first said in Congressional Testimony, An Electronic Pearl Harbor. Are these events the harbinger of strong reaction by the community at large? As events unfold and more information is permitted to be disseminated over the next few days and weeks, we will see. We have essentially solved the issues of confidentiality and integrity. But, I have maintained that the real problem is going to be Denial of Service. These events are unfortunate, but clear examples of that reality. A Bank of England official also said of the incidents, "it is not the biggest issue in the banking market." Hmmm. I have to think about that. Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

2 1

Re: [Off-Topic] "Curfews"
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:08 PM 5/31/96 -0700, Timothy C. May wrote: >(Some purists claim that children are exempted from normal constitutional >protections, such as the right of free association, the right to be free >from unwarranted searches and seizures, the right of free speech, etc. I'm afraid that some courts have explicitly held that "the child does not have a right to liberty but only a right to custody." That is old law, however. Kids have lost many rights recently too including gun rights, etc. >So Santa Cruz begins its own fascist crackdown on the free movements of >persons. The "curfew" begins Saturday night. Of course curfew laws only control the inarticulate and scruffy. Well dressed children (coat and tie for the boys dress or suit for the girls) who can claim that they are out doing tons of protected things like work and school and worship and political campaigning and "trying to save street children for Jesus" will not be picked up. They can also say things like "Ossifer, I'm peaceably assembling to petition the government for redress of grievances. It's in the First Amendment. You could read about it and everything." Home schooled children face this problem frequently and can usually find something to say. Kids older than 15 or so can claim to be "emancipated minors." Parents can emancipate their children by signing a simple declaration to back up this claim. A good idea in any case. You don't want to be accused of "owning slaves just like Thomas Jefferson." Parents can also give their kids blanket notes of permission to be out on the streets. DCF "Whose children never got stopped by cops because at 14 they passed for 21. Clothing and bearing alone can do it."

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 06:44 PM 6/1/96 +0000, Deranged Mutant wrote: >There was a story on CNN about how anonymous people on IRC (and other >commercial online chats) giving stock tips is a Bad Thing (tm). >Actually had some guy saying that a law should ban anonymous >discussions of stocks online. > >Yeesh. What ever happened to caveat emptor? (Like a recommendation >on IRC is automatically more trustworthy than overhearing a >conversation in a public bathroom?) One of the oldest tricks for running a stock up (or down) is to put rumor teams on elevators in the financial district of major cities. All day long, they ride up and down elevators having whispered, but not unintelligable, conversations about the target company. Of course, they "accidentally" drop what sounds like important insider information. Just think how much more efficient the Net can be for such activities. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Compressed data vulnerable to known-plaintext?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Someone who claimed to be Mark M. said on Sat, 1 Jun 1996: (I said:) > > Why not simply use two session keys, and encrypt the headers with one > > while encrypting the actual data with the other? That seems to solve both > > problems, except that more CPU cycles are required. > > An easier solution would be to just strip of the headers. If the header is > always the same, then it is redundant. If it varies, then it cannot be used > as known-plaintext. But then you still have the problem of identifying the contents. If there were no headers, one could not tell if the message was compressed using ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor, or even if it was left alone. One could also not tell if the decryption happened successfully. ( * Yes, I know tar is not compression. )

2 1

Reply to anonymous ping.
by daemon＠anon.penet.fi 17 Dec '03

17 Dec '03

Your code name is: an611909(a)anon.penet.fi.

1 0

Re: [Off-Topic] "Curfews"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:59 AM 6/2/96, Duncan Frissell wrote: >Of course curfew laws only control the inarticulate and scruffy. Well >dressed children (coat and tie for the boys dress or suit for the girls) who >can claim that they are out doing tons of protected things like work and >school and worship and political campaigning and "trying to save street >children for Jesus" will not be picked up. They can also say things like This, by the way, is the main thing that concerns certain civil rights groups (including the Santa Cruz chapter of the ACLU). They say they'll be monitoring enforcement patterns to see if more "children of color" are picked up than their percentage in the population represents. >"Ossifer, I'm peaceably assembling to petition the government for redress of >grievances. It's in the First Amendment. You could read about it and >everything." Personally, I liked my "religious exemption" example. The Baal worshippers can claim that they are engaging in their religion by grokking the darkness. If picked up and held, they can claim they are "being held without Baal." >to be accused of "owning slaves just like Thomas Jefferson." Parents can >also give their kids blanket notes of permission to be out on the streets. > Most of the ordinances, including the one here, specifically state that "blanket permission" by parents is not acceptable. They want _specific_ reasons for being out after curfew. (It's this taking control from both the kids and their parents and putting it in the hands of cops that really bugs me.) By the way, if being out after curfew is breaking the law, can I make a "citizen's arrest" of some of those nice young chicas in Watsonville? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RISKS: Pachinko card counterfeit background
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------ ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

RE: [Off-Topic] "Curfews"
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May Most of the ordinances, including the one here, specifically state that "blanket permission" by parents is not acceptable. They want _specific_ reasons for being out after curfew. ................................................................................... (sigh) Once again, the individual is backed up against the wall and made to answer to the State ("specifically") for their behavior in the world of human action. ("so who are you that I must explain myself to you?") I was considering the inclination of the list membership to focus upon technological, rather than political, solutions to certain social problems. Would a focus upon the idea of individual self-ownership & authority have any effect upon the State? (who *are* those people, anyway) The State resorts to the use of forcible methods in order to keep their non-valuable citizens in line. The citizens who feel themselves unfairly included resort to the use of technology to deal with impositions of the State upon them when their own ideas on morality are not accepted as legitimate. A lot of people talk about morality and justice, but really who gives a flip. The place of these ideas in the everyday life of each person reduces to irrelevance in the face of all the ignorance and cynicism, and in consideration of the alternative technologies which can be used in place of reasoning, when reasoning makes no difference (when you can't force people to think, as often happens). "I think it's time we re-evaluate the nature of our relationship". .. Blanc

1 0

RISKS: Pachinko card counterfeiting update
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Tue, 28 May 1996 22:09:28 +0900 (JST) From: Chiaki Ishikawa <ishikawa(a)personal-media.co.jp> Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15) I would like to add some background as someone who has played in pachinko parlors in Japan. (The origin of the game of pachinko is rather vague. Some say it is based on the ball game popular after the WW-II in U.S.A.. Anyway, it is a gambling business.) The card in question acts as a kind of debit card inside the pachinko parlors. It was introduced a few years ago by an former police official, with the expressed intention of keeping the money flow easy to track. (I would say it was a ruse to make a few companies where the ex-police officials can find jobs after retirement from the office. But I digress.) The cards are sold to the pachinko parlors and the customers buy the cards from the parlors, and obtain steel balls to play the game by inserting the card into the slot next to the game machine. Pachinko gambling works as follows. When you win the game, the number of steel balls in your possession increases and the customer can exchange the balls with gifts. (Therein lies a complication. Japanese law prohibits gambling, and so exchanging the steel balls with real money is illegal. *However*, first exchanging the balls with gifts, and then exchanging the gifts with money at a third party outlet [which is quite likely to be operated by the parlor owner] has been allowed by the police.) Speaking of loophole! Some people do bring back the gifts to homes: depending on the places, parlors carry game-boy cartridges, latest bestseller books, snack food such as cookies, instant noodles, umbrella, purse, movie video tape, music CD, to name a few as gifts. But if the customer wants to exchange his/her win indirectly to money at the outlet, then he/she has to ask for special gifts used essentially as money tokens by these establishments. These are often a tiny gold/silver foil embedded in thin plastic slab, etc.. Each parlor/outlet pair uses different stuff. In my hometown, a special brand of silk stocking was used as money token. This whole thing is a farce in view of the anti-gambling law in Japan.) Back to the card: the cards in question are used by two leading card manufacturers. (There are another couple of late-entry companies whose cards are not known to be attacked yet.) The card is based on the design done by NTT Data. NTT is the Japanese equivalent of old Ma Bell in the USA. NTT Data is a company that specializes in computer software integration, communication and such. I believe it designs the telephone card (debit card used for pay-phone in Japan), too. The pachinko card is the size of name card and plastic. The details are not published. To the best of my knowledge, I think there is a magnetic strip that contains the card ID information such as its serial number and the amount of debit money. There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards. (I said "were" because 10,000 yen and 5,000 yen cards are no longer available.) Attack method: >From what I saw and read, the first card verification mechanism used by the pachinko game machine was so primitive to defy rational explanation: each time the card was used, a tiny hole was punched to indicate the amount left in the card. As the customer uses the card, the position of the punched hole on card shifts toward the zero position. Once there is a hole on the zero position, the card is no longer usable. The first simple attack as far as I can tell was to fill in the hole in the card with tiny plastic (essentially the chaff produced when the hole is punched was used to fill in the hole). I am not sure if such simple attack was possible, but it seemed possible really at the beginning with crude modification of the magnetic data. Then, of course, the magnetic information on the card was also modified in more sophisticated ways when the card was used. However, the bad people also learned and somebody stole the reader mechanism and figure out the part of the magnetically-coded information: the result was that bad people could buy the pristine 10,000 yen card and then uses up to 2500 yen of the debit amount legally and then "re-fill" the card to 9500 yen worth, thus gaining 2000 yen for free again and again. (Until 3000 yen was used from the 10,000 yen card, the physical hole was not produced on the card, and only the magnetic information was changed. Hence the mere counterfeiting of the magnetic information was necessary to "revive" the card. No physical re-filling of the card was necessary. Physically re-filling the hole is easy to spot visually and was avoided by the bad guys.) [I have to confess that the exact amount involved in the counterfeiting is a little uncertain. But the general idea still holds.] Similar attack was possible with 5,000 yen card. Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was small compared with the risk, the bad guys didn't attack these cards until lately. Now the situation is that of cats and mouse. New counterfeiting methods and counter-measures follow each other in rapid succession. I believe that the cloning of the card was also done. But I don't know the details. Now, the card companies and pachinko parlors stopped issuing 10,000 yen and 5,000 yen cards because the damage was so large. Also, they have installed special readers to verify the validity of the card by incorporating more vigourous checking not available on the readers next to the game machine: it used to be that the cards sold could by used by any pachinko parlors in Japan. Now cards sold elsewhere have to be verified with this machine before used at a local game parlor. Cards sold at the local parlor can be used without such checking. Already, there are reports of counterfeit-card usage: - either the cards are so sophisticated that they can pass the enhanced reader. - Or the bad guys buy the cards locally and then use some of the debit amount and then bring the cards to their factory to re-fill and re-use it at the local store again and again. The card companies have installed countermeasures in selected stores to the cloning of the card by checking the serial number of the card and stopped the operation of the whole game machines in the store if a card with the serial number of the previously used (finished?) card is ever inserted into the game machine. Another simple method of fooling the reader was also reported about a month ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the most expensive card after 10,000 yen and 5,000 yen card are gone) and rotates the strip to invert its direction and then reassembles the card again using cement or something. To my surprise, it was reported to be deemed valid by some readers (!?). Apparently some readers only check for the position of the hole on fixed position and fooled to believe the card is valid if the hole is not in the expected position, etc.. Once not so rigorous readers are distributed, it is very difficult to upgrade all of them in Japan, I guess. The problem is complicated in that the counterfeiting only damages the card company. The parlors report the amount of debit money used in their shops and then compensated for the amount (less the small surcharge by the card company.) This means that every time the counterfeit card is used the card company alone loses money and the local parlor doesn't lose. There have already been reports of the owners of the pachinko parlors involved in the usage of the counterfeit cards. These bad owners allowed the bad guys to use the counterfeit cards in their parlors and pass the used debit amount to the card company and getting compensated. In these cases, the bad guys bring back the money (by simply exchanging the phony debit money into the steel balls, and then without playing (they can play if they wish), exchange the steel balls to the special gifts, and then exchange the gifts with money. [Usually, buying the steel balls and then exchanging them with gifts, and subsequently with money leaves you less money than you started with. The house always wins. In this case, the bad guys started out with counterfeit debit money and ends up with real money, so it is OK for the bad guys.] The parlor also gets the money for the used debit money. So they win, too. Only the card companies lose. Counterfeiting probably has existed since the first money (or equivalent) was ever invented. But, it surprised me that NTT Data approached the whole scheme so naively, especially since there have been reports of telephone card counterfeiting in Japan before. Some of the counterfeiting methods reported seemed so simple, and I have a doubt whether NTT Data was serious enough to deter counterfeiting. At least, I can safely say they have underestimated the ingenuity of the counterfeiters badly and didn't learn from the counterfeiting of telephone cards very well. Ishikawa, Chiaki (family name, given name) Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa(a)personal-media.co.jp ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0