December 2003 - cypherpunks-legacy

Re: info
by freeman＠MasPar.COM 17 Dec '03

17 Dec '03

> TAKE TWA TO CAIRO. ===== At the very least, it should have said "CASABLANCA"...

1 0

Re: Non-techie Crypto book?
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Maybe there's a book on "Privacy" out there that gives reasonably up-to-date coverage of crypto. I would love a book that covered all the sociopolitical cypherpunk issues like reputations and anonymity; agorics and pay-per-use; copyright, left and not; Chaum's distinction between Identification and Authentication; traceable vs. non-traceable emoney; smart cards and wallets; history of privacy invasion; history of public-key crypto and non-government cryptology; accelleration of technology that can be used for spying; the sorry present state of cellular phone privacy, Qualcomm's initiative; "digital license plates" as likely implied in various government proposals; etc. Has anyone read the Michael Marotta book? -fnerd quote me - - cryptocosmology- sufficiently advanced communication is indistinguishable from noise - god is in the least significant bits -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Crypto Controls in the USA
by Michael Johnson 17 Dec '03

17 Dec '03

Data Encryption Software and Technical Data Controls in the United States of America Copyright (C) 1994 Michael Paul Johnson PO Box 1151 Longmont CO 80502-1151 USA mpj(a)csn.org 303-447-7302 Distribute unmodified copies freely. 7 January 1994 1. Introduction 2. Problems with the Status Quo 2.1. Regulations Ignore Technology 2.2. Overly Broad Definition of "Encryption Software" 2.3. Overly Broad Definition of Export 2.4. Censorship and the First Amendment 3. National Security Issues 3.1. Signals Intelligence 3.1.1. Enemy Signals 3.1.2. Bugs & National Technical Means 3.2. Counter-Intelligence Activities 3.3. Our Military and Diplomatic Communications 3.4. Banking Transactions 3.5. Domestic Personal and Corporate Communications 3.6. Authentication in the Private Sector 3.7. Upholding the Constitution 3.8. Law Enforcement 3.9. Technology Base Migration and Loss 4. Technology Issues 4.1. Availability of Computers 4.2. Telephone Lines and Modems 4.3. The Internet 4.4. Information Services and Bulletin Boards 4.5. Books and Magazines 4.6. Availability of Encryption Software 4.7. DES is Dying 4.8. Unbreakable Encryption 5. Economic Issues 5.1. International Trade 5.2. Cryptographic Competition 5.3. Domestic Chilling Effect 6. Regulatory Issues 6.1. Clarity of Regulations and their Intent 6.2. The First Amendment 6.3. Enforcement 6.4. Consistency with Technology 7. Recommendations 7.1. Reevaluate National Security Impact 7.2. Deregulate Publicly Available Information 7.3. Deregulate Research and Publication 7.4. Replace DES with Better Public Standard 7.5. Control NSAs Cryptographic Technology 7.6. Alternate Intelligence Methods 7.7. Alternate Law Enforcement Methods 7.8. Clarify & Repair Export Regulations 1. Introduction The current status of the regulation of encryption software in the United States of America is, at best, confusing and harmful to business. At worst, the current status is harmful to National Security and violates U. S. Constitution. I invite you to study this issue with me. I present what I perceive to be the problems and the issues that must be considered, then suggest some solutions. Even if you don't fully agree with all of my statements, I hope that they prove helpful to your own understanding of this situation. 2. Problems with the Status Quo I perceive several problems with the current International Traffic in Arms Regulations (ITAR) far beyond typos like the reference to $120.10(d), which doesn't exist, in $120.10(1). These problems are severe enough that I hope that they will be rectified soon before they do even more damage. All of the problems with the ITAR mentioned here have to with encryption software, as defined in the ITAR. 2.1 Regulations Ignore Technology The ITAR ignores the fact that software, like other technical data, can exist in a multitude of forms, many of which know no national boundaries. The ITAR ignores the fact that much of what is prohibited to be exported exists in unlimited quantities outside the USA. The ITAR hurts U. S. Business but doesn't significantly reduce the availability of strong encryption technology outside the USA. The ITAR ignores the widespread use of purely electronic means to distribute software, such as the Internet, Computer Bulletin Board Systems (BBS), and commercial information services (such as CompuServe). The ITAR ignores the fact that shareware publishing, which is a form of Constitutionally protected publication, propagates software all over the world with no formal distribution mechanism. 2.2 Overly Broad Definition of "Encryption Software" "Encryption software" is defined in $121.8(f) and $121.1, Category XIII(b) to include not only computer programs designed to protect the privacy of information, but all of the technical data about those programs. This naturally includes a great deal of material in any large library or book store. William B. Robinson, Director of the United States Department of State, Bureau of Politico-Military Affairs, Office of Defense Trade Controls, states in his letter to me of 30 November 1993, that "the exemptions listed in $125.4 for technical data do not apply to cryptographic software and source code." I conclude, therefore, that the ITAR implies that the majority of the libraries and larger bookstores in the United States stock "munitions" on their shelves for anyone to read. 2.3 Overly Broad Definition of Export $120.17 of the ITAR makes it clear that allowing a foreign person to read a book containing encryption software constitutes export. Therefore it seems possible that some perverse person might state that all of the libraries and bookstores that contain any book on cryptography must register as an exporter of munitions. This situation gets even more interesting in its electronic analogies. However, restricting domestic distribution of technology that is perfectly legal and useful within the USA just because a foreigner might see it is not only unreasonable, it could probably not stand a Constitutional challenge. 2.4 Censorship and the First Amendment The ITAR does make some acknowledgment of the fact that not all of the publications that it calls "encryption software" need be subject to export restrictions, but doesn't even come close to defining the difference. All it does is set forth a censorship procedure called a "Commodity Jurisdiction Procedure" (see $120.4). >From what I know of the First Amendment and Constitutional case law (I'm not a lawyer, but I took a class on the subject), the only way the Federal Government can legally take away U. S. Citizen's rights to freedom of speech or freedom of the press is when there is a clear danger that is caused by that expression, or a significant infringement of the rights of another person. The classic examples of this are yelling "FIRE" in a crowded theater, or committing libel or slander. In the case of technical data concerning encryption software that is already in the "public domain" (as defined in the ITAR for technical data), the damage (or benefit), if any, is pretty much already done and further publication probably makes little difference. I believe that any definition of what is a munition that makes the nation's bookstores and libraries appear to be exporters of munitions is not just ridiculous, it is unconstitutional. When I tried to get clarification from the Department of State on what the rules that they applied when performing their censorship role (Commodity Jurisdiction Proceeding) were, all I got back was two letters, one that clarified a point made muddy by a typo in the ITAR and gave no help beyond the ITAR itself, and one form letter that said that the Department of State would not deal with hypothetical questions (even though most of my questions weren't purely hypothetical). This serious Constitutional question casts doubt on the enforceability of any of the regulations in the ITAR against any encryption software. It could be difficult to prove that the publication of a particular piece of technical data or computer program caused specific, measurable damage resulting from intentional export without a license (even if you could figure out who exported it). Yet, there cannot be any restriction to U. S. Citizen's freedom of speech and freedom of the press unless it can be proved that damage resulted from that speech. 3. National Security Issues "National Security" means a lot of things. It means maintaining the integrity and safety of our Constitution, our people, our land, and our environment. It means the ability to defend ourselves against anyone or any thing that would seek to harm us. Our freedom, constitutional democracy, and fairness to all citizens are our greatest protection against internal threats. This gives us the strength and will to have a strong diplomatic, economic, and military force to protect us against external threats. 3.1 Signals Intelligence In the context of encryption software, the most obvious connection to National Security (if you ask the NSA) is the impact on intelligence operations. In the process of spying on enemies, it is a lot safer to listen to what they are doing remotely than to send a person in to spy. The two main ways of doing this are (1) to listen to and/or alter signals that they generate for their own purposes, and (2) to listen to signals emanating from devices that we have placed for the purposes of listening. 3.1.1 Enemy Signals Enemy signals may include telemetry, radio transmissions on various frequencies for various purposes, telephone conversations, computer data links of various sorts, etc. These all may provide some kind of clue as to what evil deeds they may try to perpetrate on us next, or may indicate significant vulnerabilities for us to exploit in war time. The enemy knows that we know this, and will probably try to protect at least some of their signals using encryption, deception, jamming, or data hiding (steganography). It is possible that an enemy might use some of our own encryption technology against us. The enemy may either directly use a commercial product to hide the meaning of communications from us, or use some published technology originated in the USA and other free countries to build their own systems. They may also add their own secret innovations to what they learn from us. Of course, there is also the consideration that an enemy would prefer to use cryptographic technology of their own design. This would give them the advantage of not letting us know which algorithm they are using. It would also deprive us of the huge head start we have on cryptanalysis of things like the ancient Data Encryption Standard (DES). This may not be enough to stop me from protecting a proprietary cookie recipe with the DES algorithm (or the triple DES variant if the cookies tasted good and weren't fattening), but it would be a significant consideration for a nation planning to bomb Pearl Harbor. DES is probably a bad example, since everyone on planet Earth who really cares already has a copy of a program that does DES encryption, or can get one in a few minutes. Using a commercial product like a spread sheet or data base program that does encryption only as an extra feature against us is something of a problem for an enemy, since such products are not normally well suited to the applications needed in military and diplomatic situations. Imagine giving a field commander a laptop computer with a U. S. commercial spread sheet program on it to decrypt orders from his commander. I may underestimate the silliness of our enemies, but I don't think that this is likely. A much more tamper-resistant device with better key management would be much more appropriate for a military or diplomatic application. Use of our publicly available encryption design technical data in building more appropriate military communications security devices is a more likely threat in the case of a clever adversary. The only consolation in this case is that we also have access to this same data as an aid to cryptanalysis. In the extreme case, strong cryptographic technology could become so readily available and easy to use that most of the interesting signals generated by enemies for their own purposes are encrypted in such a way that we cannot decrypt or subvert the communications without stealing their keys. In that case, all nations might have to behave like gentlemen (and not open the other's mail or read their electronic communications). Then again, that is probably too idealistic to expect. It is more likely that mankind will only figure out other ways of spying on each other. 3.1.2 Bugs & National Technical Means Even if the enemy takes great care to protect the secrecy and integrity of their own communications channels, we can still spy on them. Listening devices can be made so small and have such inconspicuous output that they can be almost impossible to detect or jam when planted properly. It takes very little power to send a signal to a nearby relay to a satellite, and many varieties of listening devices can be used. Even if an enemy becomes wise to one kind, another kind may be in use. Suffice it to say that all the encryption technology in the world could not cut off this source of intelligence, since all valuable intelligence exists in the clear at some point. If it didn't, it would be of no value to the originator and intended recipient. Public use of strong cryptographic technology may limit the points where listening devices must be planted to be of value, but can never totally cut off this sort of intelligence. Increases in knowledge cryptography and steganography may help this sort of spying more than hinder it. 3.2 Counter-Intelligence Activities Increased public use of strong cryptography makes it easier for a spy to obtain a good cryptosystem. It also makes it easier to send encrypted messages without arousing suspicion. That is good for our spies, but bad for detecting spies in our own country. Then again, it would be a pretty inept spy (ours or theirs) who could not now obtain a good cryptosystem and send messages home without arousing suspicion, under conditions much worse than the USA right now. Of course, increased public use of strong cryptography also makes it harder for a spy to find valuable data to send back home. I think that the net effect will be that spies in the USA (and some other developed nations) will be harder to catch, but less effective. 3.3 Our Military and Diplomatic Communications The greatest contribution of cryptography to our National Security is in protecting our own military and diplomatic communications from eavesdropping or alteration. Communications of this nature must be private, must be authentic (not an alteration or forgery), and must not have been altered in transit. Increased public use of strong cryptography can only help us to keep our most sensitive communications private. This is because there will be more encrypted traffic to attempt attacks on, making traffic analysis harder. It also may be that discoveries made in the private sector help in the design and evaluation of military and diplomatic cryptosystems. 3.4 Banking Transactions We do so much banking electronically that failure to use strong cryptography to protect these transactions would be criminally negligent. It would be like not locking the vault and bank doors and not posting a guard. The importance of the integrity of our banking system to our economic well-being is obvious. The cryptographic protection must also be economical, just as the bank buildings, vaults, and other security systems must be, or the banks will not remain competitive. We must balance the cost of protection with the value of what is being protected. Strong cryptography usually doesn't cost much more to implement than weak cryptography, and may save a whole lot of money if it can prevent some fraud. 3.5 Domestic Personal and Corporate Communications Although there are strict and fairly consistent guidelines for the protection of U. S. Government classified information, the private sector is much more vulnerable. Some companies are very security conscious, but some are not. Those which are not are easy targets for foreign and domestic spies, either working for governments or competing corporations (or both). Encouraging good security practices in the private sector, including use of strong cryptography, use of good crosscut shredders, etc., makes the USA more secure against this threat. Protection of personal communications with encryption is good for privacy, just as locks on doors and curtains on windows are. It becomes very important in some cases, such as when a battered person is hiding from a stalker that is still at large, or when coordinating activities that might attract criminals like shipping diamonds. Encryption technology can help reduce crime, just like dead bolt locks. Just as I prefer to manage my own dead bolt keys, I'd rather not be forced to escrow a master key to my data with Big Brother. This isn't because I do anything evil with my dead bolts or cryptographic software, but because I love freedom. This preference is nearly universal among users of cryptography, and the countries and companies that cater to this desire will have a big economic advantage. 3.6 Authentication in the Private Sector Encryption technology is the only way to provide a signature on a digital document. Nothing is totally fool proof, but digital signatures, when done properly, are much harder to forge or refute than pen and ink signatures on paper. Electronic documents can be transmitted faster and with higher fidelity than faxes, and the ability to sign them will be a great aid to quickly and conveniently doing business with remote customers and suppliers. As contract case law and technology evolve, this will become more and more important to our economy. 3.7 Upholding the Constitution Citizens of the United States of America have a right to privacy guaranteed by the Constitution's Bill of Rights. This quaintly stated right to be secure in our papers and effects is highly cherished. The advance of technology has eroded privacy. Corporations like Tandy openly track their customer's names, addresses, buying habits, then shower them with junk mail. Credit bureaus keep massive amounts of (often incorrect) data on people all over the country -- information that is supplied to lenders and in the form of prescreened mailing lists for solicitors. Government organizations keep records of real estate transactions, census data, and other such records that are used by solicitors to pester owners of houses in selected neighborhoods. Hospitals keep your patient records on computer systems that can be accessed by many people. Cellular and cordless telephones are trivial to monitor without physically tapping any wires, and legislated privacy in these areas is unenforceable. Strong encryption can bring back part of the privacy that has been lost to technology. No law can keep spies and criminals from listening to phone calls made over radio links (including microwave and satellite links for normal phone calls), but encryption can make those calls unintelligible to criminals and other unauthorized listeners. 3.8 Law Enforcement The proper use of encryption technology by law enforcement officers helps deny knowledge of monitoring operations to criminals and fugitives. It helps them to keep records private and protect under cover agents. It helps prevent tampering and deception from being used against them in their own communications. Unfortunately, this is a two-edged sword. Strong encryption technology can also be used by criminals to thwart the efforts of law enforcement officers to gather useful information from court authorized wire taps. Strong cryptography also provides a "safe" way for a criminal to keep records of nefarious deeds that cannot be read by the police and used as convincing evidence leading to a conviction. Of course, fewer such records might be kept in the absence of strong cryptography, and some records kept in this manner might not be all that useful in obtaining a conviction. This is not very assuring to law abiding citizens and law enforcement officers, who want dangerous criminals to be caught well before they meet the Ultimate Judge in Heaven. Fortunately, most of the investigative tools available to law enforcement officials are not affected by strong cryptography. It is also likely that anyone stupid enough to engage in criminal activity is likely to screw up in some way that leaks information about their actions. Murder, terrorism, rape, and other violent crimes are not all that hard to commit (for those devoid of conscience or with the twisted conscience of a kamikaze), but these crimes are very difficult to get away with. 3.9 Technology Base Migration and Loss When a technology is discouraged by over-regulation, taxation, or other means, that technology becomes less profitable in the country where it is discouraged. Less profitable technologies are not invested in as heavily. Therefore, the technology in that country will tend to fall behind. Right now, it appears more profitable to develop an encryption product for sale in many other countries than in the USA because export of this technology from the USA is discouraged but import is not. An entrepreneur in New Zealand has an unfair advantage against one in the USA. The New Zealander is not required to cripple key lengths or deal with unreasonable and unreadable regulations like our ITAR. This means that encryption technology in the USA will tend to atrophy while it prospers in other countries. This is bad for National Security. 4. Technology Issues Any policy concerning encryption software that is to make sense must take into account the realities of the current state of the art in the applicable technologies. Failure to do so could at best lead to confusion, and at worst do much more harm than good. 4.1 Availability of Computers It doesn't take a lot of computing power to perform strong encryption (locking data up). It often takes a great deal of computing power to do serious cryptanalysis (unlocking data without the key). Strong encryption can be done with almost any microprocessor on today's market. The original IBM PC (now greatly outclassed by the current desktop computers) has more than enough computing power to lock up significant amounts of data so tight that all the spy organizations in the world combined could not unlock it for thousands of years or more. This class of computer is available in essentially any developed or semi-developed country in the world. 4.2 Telephone Lines and Modems There are still places in the world that don't have easy access to telephone lines, but they are growing fewer all the time. The places that do have telephones, computers, and modems are those places where encryption technology is the most useful. Be they friend or foe, these places all have one thing in common. They are only a telephone call or two away from strong cryptographic software if they know where to call, and it isn't that hard to find out. Since many telephone connections are by satellite, and since international telephone traffic is not routinely monitored and censored by most free nations, any technical data (including encryption software) can be transmitted across almost any national border unhindered and undetected. 4.3 The Internet The Internet has grown to such a large, international collection of high speed data paths between computers, that it has become, among other things, one of the most effective examples of international freedom of expression in existence. Physical distances and political boundaries become irrelevant. I can peruse data posted for public access on university and corporate computer systems on five continents and many islands, no matter if I'm in the USA or in Russia. This is a powerful research tool. News groups provide discussion forums for subjects technical and nontechnical, decent and obscene, conservative and liberal, learned and ignorant, from Animal husbandry to Zymurgy, and more. The Internet provides easy access to lots of strong cryptographic technology and software that can be reached from any nation with a connection to the Internet. A great deal of this data originated from outside the USA. The most complete and up to date collections of encryption software on the Internet are published for anonymous ftp from sites outside the USA. (Anonymous ftp sites are computer systems that allow anyone to log in with the name "anonymous" using the file transfer protocol program called "ftp" to transfer files to their own system). There are several ftp sites in the USA that carry some encryption software, and they have varying degrees of barriers to export. Some sites make no attempt at all to limit access to encryption software. Some sites are very effective at not allowing export, but are totally ineffective at distributing software domestically because of the hassles they impose on users (who can just as easily get the same stuff from Italy). The strongest barrier to export that I've seen used at a U. S. domestic ftp site for encryption software that doesn't totally defeat most of the advantages of this form of software distribution is the one used at rsa.com for the distribution of their RSAREF package and RIPEM. The idea is to force you to read a text file containing an anti-export warning before you can find the data you are after. The text file that contains the warning also contains the name of a hidden directory that changes periodically. The encryption software is in the hidden directory. Naturally, this doesn't prevent an unwelcome intruder from stealing the data anyway, but the moral barrier presented probably reduces the number of "exports" from that site initiated by people in other countries. I support RSA Data Security, Incorporated's right to publish this data, even though I have observed copies of this data on several foreign computer systems. I tried hard to think of a better solution (and even called the Department of State and the NSA for ideas), but there is basically no way to widely and freely publish any data in the USA without making it possible for a foreigner to steal that data out of the country. Even if the data is confined to physical packages and sold or placed in libraries only in the USA, there is nothing to prevent someone (either a U. S. or foreign citizen) from buying or borrowing a copy, then transmitting a copy of that copy out of the country. Even if positive proof of citizenship is required before release of the data, all it takes is one citizen to release a copy of the data outside the USA. You might argue that there would be a strong moral barrier against this, but remember that all it takes is one. What does it matter to someone if they send a copy of encryption software to a friend or relative in another country so that they can send private electronic mail back and forth? All it takes is one copy out of the country, and that copy can be copied any number of times. If rabbits multiplied so easily, we would all quickly drown in them. The bottom line is that the best solution to balancing freedom of the press and the ITAR for encryption software ftp sites is just an annoyance for the intended users and a way to make it impossible to prove that the operators of the site intended to break any valid law. This may or may not have any bearing on the proliferation of encryption technology outside of the USA. I am not a lawyer, but I know RSA Data Security, Incorporated, has lots of them, and I don't believe they would do anything stupid. 4.4 Information Services and Bulletin Boards CompuServe, America Online, Genie, Bix, Delphi, and other similar services offer massive amounts of data, including encryption software and technical data, to callers. They often act as common carriers between correspondents who carry this data themselves, and really don't know the contents of what they are carrying. Other times, they are well aware of what they have. For example, CompuServe publishes a magazine promoting some of the shareware that they carry, and featured some encryption software in an article in their November 1993 issue. These information services also serve customers outside of the USA. Indeed, it would be very difficult not to do so, even if they didn't want to bring some foreign money into their hands. Computer bulletin board systems vary in size from hobby systems running on a single PC in a home to large commercial systems. Some are run as a hobby, some as a means of providing technical support to customers, and some as profit-making information services. A very large number of these systems have encryption software on them with no export controls expressed, implied, or implemented. Indeed, many of the operators of these systems would laugh in your face if you claimed they were trafficking in arms. These systems are normally accessible from anywhere with a telephone, computer, and modem. 4.5 Books and Magazines Encryption software and technical data about it can be found in a large number of books and magazines in libraries, book stores, and by subscription in and out of the USA. Some of these have companion disks that can be ordered separately or that are bound in the back of the book. Some have associated postings on an information service. Some have printed computer program source code listings in them. In those rare cases where the book and disk sets are not distributed by the publisher outside the USA, it is almost certain that the books and disks will appear outside the USA, because most book stores don't restrict their sales to U. S. Citizens. Indeed, to do so sounds rather fascist and unamerican: "Let me see your citizenship papers before you buy a book!" This country is both more pleasant and a lot more secure without such nonsense. 4.6 Availability of Encryption Software There is already a large number of free or very inexpensive software packages available internationally from various information services, computer bulletin boards, Internet ftp sites, and commercial packages available off the shelf. These include: o Many DES implementations originating from many countries. o Several packages that implement the Swiss IDEA cipher. o Several packages that directly implement triple-DES. o Assorted implementations of published algorithms, some of which probably exceed DES in strength. o Assorted programs (such as utility packages, spread sheets, database programs, and word processors) that include some form of encryption that is incidental to their main function. The security of the encryption varies from so poor that it should be called false advertising (like that used in Microsoft Word), to probably good against all but professional cryptanalysts (like PKZIP), to fairly decent implementations of DES or better. o Numerous proprietary algorithms, many of which probably claim greater security than they merit, but some of which may be very good. o A few encryption packages that effectively use a combination of the RSA public key encryption algorithm and a block cipher (DES, triple DES, or IDEA) to encrypt electronic mail. o Several cryptographer's tool kits that implement large integer arithmetic over finite fields, fast DES, IDEA, and RSA implementations, and other data that facilitates including these functions in other programs. There are also a few cryptanalytical programs floating around internationally to assist in cracking insecure cryptosystems like the password protected files of Microsoft Word and WordPerfect. In most cases, this software encryption and cryptanalytical software cannot ever be eradicated (even if you think it should be), because there are so many copies held by people who think that this software is a Good Thing. Any one copy can be copied again as much as desired. Hiding software is much easier than hiding elephants. The bottom line is that the cat is out of the bag, so to speak, and no amount of regulation can ever put the cat and all its millions of kittens back in again. 4.7 DES is Dying DES was doomed to a limited lifetime from the beginning by limiting its key length to 56 bits. This was probably done intentionally, since there was much opposition to this decision at the time. It is also possible that this key length may have been an indication from the NSA that because of differential cryptanalysis, the strength of the algorithm didn't justify a larger key. Now a paper has been published that shows how DES can be cracked for an amount of money that is within the budgets of many nations and corporations (Efficient DES Key Search, by Michael J. Wiener, 20 August 1993). Schematic diagrams of showing how to build a device to accomplish this task are included in the paper, which has been distributed internationally electronically. I would be very surprised if one or more of the world's major intelligence gathering organizations had not already built DES cracking machines of greater sophistication than Michael Wiener's. The only reason that I say that DES is not totally dead is that it is still useful in some cases, for the same reason that physical locks that can be picked with a pocket knife or credit card in a matter of seconds are still sold and used. DES encryption does help keep unauthorized, honest, ladies and gentlemen out of your proprietary and personal data. When used in its triple DES variant, it might even keep dishonest people with big budgets and lots of motivation out of your private data. 4.8 Unbreakable Encryption One very well known algorithm (called the One Time Pad), when properly used (i. e. with truly random keys used only once), can never be broken by anyone, no matter what their computing power. The One Time Pad has been known to the general public for many years, but it has not caused the end of the free world. I've never heard of a case of it being used for any criminal activity except for spying (and there, I suppose, the use by "us" and "them" somehow balances out). The One Time Pad is still used to protect our most sensitive diplomatic communications. An implementation of the One Time Pad in software is trivial, as the following complete, non-hypothetical, Pascal program demonstrates: program one_pad; uses dos; var infile, keyfile, outfile: file of byte; plain, key, cipher: byte; begin if paramcount < 3 then begin writeln('Usage: one_pad infile keyfile outfile') end else begin assign(infile, paramstr(1)); reset(infile); assign(keyfile, paramstr(2)); reset(keyfile); assign(outfile, paramstr(3)); rewrite(outfile); while (not eof(infile)) and (not eof(keyfile)) do begin read(infile, plain); read(keyfile, key); {The following single line does the encryption/decryption.} cipher := plain xor key; write(outfile, cipher); end; close(outfile); close(infile); close(keyfile); end end. The whole One Time Pad program is short enough to be written from memory (for an experienced programmer, anyway). (For instructions on using the above program, see your local library or check out the sci.crypt Frequently Asked Questions document on the Internet.) It could be argued that the trivial program above isn't a complete encryption system, since it doesn't do any key management. Ladies and gentlemen, does this document contain a weapon of war or other munition, or is it just free exercise of the author's freedom of the press? Would the ITAR prohibit the export of this document or not? I claim that the U. S. Constitution specifically allows me to publish this document, no matter what the ITAR says. 5. Economic Issues While it seems clear that it is impossible to exercise our right to freely publish encryption technical data and software in the USA and at the same time prevent its export, it is very easy to economically damage the USA with encryption export controls. 5.1 International Trade It seems that the only encryption software that can be legally exported for profit from the USA is either (1) crippled to provide weak security (i. e. only a 40 bit key with RC-2 or RC-4), (2) limited in function to certain purposes that do not cover all market needs, or (3) limited in distribution to a limited market. Therefore, encryption software export is not a very lucrative field to enter. How can you compete with foreign competitors who need not cripple their products? 5.2 Cryptographic Competition There are sources of cryptographic software outside the USA where the encryption software is not crippled, and is available at a competitive price. Given a choice, the full-featured, secure software is more likely to win. This means that other countries will grow in this area and the USA will suffer economically. 5.3 Domestic Chilling Effect Export controls on encryption software discourage distribution of strong encryption software in the USA and encourage the weakening of domestic software to the same inadequate standards forced upon exported software. It seems better to buy (real or perceived) strong security from an external source than from a domestic, persecuted supplier. Even though it would be unconstitutional for the ITAR to disallow domestic distribution of encryption software, few people want to be harassed by the federal government or become a test case where the unconstitutionality of the ITAR is conclusively proven in court. 6. Regulatory Issues The International Traffic in Arms Regulations are designed to make the world a safer place by limiting the export of weapons and military equipment. It also regulates classified or otherwise non-public technical data about those weapons. Most of the items regulated have a whole lot more to do with the objective of limiting arms proliferation than encryption software and technical data. The subject of this document, however, is limited to a discussion of the regulation of encryption technical data and software. 6.1 Clarity of Regulations and their Intent For a regulation to be effective and enforceable, it must be clear. No one should be compelled to guess what the state requires or proscribes. Indeed, how could you be expected to follow a law you don't understand? There should be a clear way of telling what is and is not allowed without having to submit an item for censorship. The intent of the regulation should also be clear, so that a citizen could reasonably understand what the regulation is for. 6.2 The First Amendment The ITAR cannot override the Constitution of the United States of America, in spite of its current claims that indicate that it does. To the degree that it does violate the Constitution, it is null and void. Any limitation on the freedom of speech and freedom of the press of U. S. Citizens must be clearly linked with a severe danger or denial of rights to another person that can be proven in court. Worse things than encryption software have been upheld in court as Constitutionally protected expression. When balancing defense and intelligence considerations with the U. S. Constitution, it is important to remember that (1) the whole point of defense and intelligence operations is to protect and defend the Constitution and the people of the United States of America, (2) the Constitution is the Supreme law of the land, and (3) federal officials and military officers in the USA are sworn to uphold the Constitution. There is a theory among those involved in private sector cryptography in the USA that there is an official or semi-official policy of discouraging strong cryptography within the borders of the USA, while giving the appearance of supporting it. There is evidence to support this theory in certain documents recently obtained under the Freedom of Information Act by John Gillmore and released to the public. This theory also explains a whole lot of otherwise difficult to explain circumstances. Because such a policy, if openly stated, would sound stupid at best and like treason against the Constitution at worst, it is not openly stated as such. Export control regulations and patent law appear to have been used as tools to carry out this policy of discouraging strong cryptography for the general public. In the event this scandal is even partially true, then the policy must be reexamined. This policy might not exist, but some alternate explanations for some of the evidence is even more disturbing. 6.3 Enforcement A regulation that cannot possibly be enforced is of questionable value, at best. Ideally, it should be possible to detect all violations and demonstrate beyond the shadow of a doubt to a judge and jury that the violation was perpetrated by a specific person or persons. 6.4 Consistency with Technology Regulations cannot ignore technology, math and science. Regulations cannot redefine pi to be exactly 3, repeal the law of gravity, or stop radio waves at national boundaries. In the same way, regulations (like the ITAR) that treat public information like tanks, guns, and nuclear weapons make no sense. 7. Recommendations So far, I have pointed out problems and considerations that cannot be satisfied concurrently. On the other hand, it is possible to do much better than current regulations do. 7.1 Reevaluate National Security Impact A study of the total impact of public use of strong encryption software should be made that includes all of the considerations mentioned above, as well as classified data concerning just how much impact (if any) such software (which is widely available now and projected to increase in both quality and quantity) has on current U. S. and foreign intelligence operations. 7.2 Deregulate Publicly Available Information Export controls on publicly available information, including encryption software and technical data, are not only ineffective, unenforceable, unclear, and damaging to U. S. business interests, they are likely to be ruled unconstitutional in any serious challenge. Deregulating this information would help the U. S. economy, increase the use of strong encryption software in the places where it does the most good, and have minimal negative effects. Since so much strong encryption technical data and software is available now, it is unclear if any additional negative effects would even be enough to measure. The desired effects of better security and technology in the USA and a healthier economy would, however, be substantial. 7.3 Deregulate Research and Publication Research and publication of scholarly work in the international, public forums benefit the USA. The fact that this also benefits other nations does not diminish the value to the USA. This does not prevent the NSA from conducting classified research within its security boundaries that is not available to the international community. It does prevent the NSA or any other government agency from interfering with or discouraging any work in the field of cryptography outside its own facilities. The NSA should maintain technological superiority by its own merit, not by crippling all domestic competition. 7.4 Replace DES with Better Public Standard DES is old and its key length is too short. The public wants a more secure encryption standard that is fully public and can be used in software implementations. The Swiss IDEA algorithm is one likely alternative, but it would be better if an algorithm that is royalty-free (like DES) could be made an official standard. Clipper/Capstone key escrow is not the answer to this need, although it might be useful within the Federal Government. Several possible replacements for DES have been suggested. One that is much stronger than DES (and slightly stronger than IDEA) and can be used royalty-free is the MPJ2 Encryption Algorithm, which has been donated to the Public Domain by the inventor. Technical details on this algorithm have been published, and are available to U. S. Citizens in the USA. 7.5 Control NSA's Cryptographic Technology While it is unreasonable to think that the general public's cryptographic technology could possibly be confined to any one country, it is not so difficult to control the technology in a single organization such as the NSA. The NSA should be, with very few exceptions, a trap door for information on cryptography and cryptanalysis. They should strive to stay ahead of the general public in these fields, and should not confirm or deny what they can and cannot do to the general public without a conscious decision by competent authority to do so (for example, to endorse a DES replacement). In like manner, the NSA should not discourage or encourage any cryptographic technology outside of their walls but still inside the USA. Of course, even an endorsement by the NSA is suspect, since their charter includes reading other people's encrypted traffic. It would be better, in my opinion, to preserve the NSA as a national treasure of cryptographic expertise by dealing with public encryption standards totally within the Department of Commerce, National Institute of Standards and Technology (NIST). It is probable that someone in the USA (or another country) will independently invent something that someone inside the NSA has invented, and that person will be honored with fame and fortune publicly for what has already been done privately within the NSA. This should never be construed as an excuse to censure the public invention. Indeed, to do so would leak information about the NSA's technology level and capabilities to the outside world. 7.6 Alternate Intelligence Methods To mitigate the effect of the inevitable improvement in both the quality and availability of strong encryption software and hardware all over the world, it would be wise to invest in alternate intelligence methods, such as harder to detect and easier to place bugs. Subtle long range bug delivery mechanisms, relay devices, etc., could pay back great dividends in intelligence value for the money for use in those cases where strong encryption makes cryptanalysis impossible. 7.7 Alternate Law Enforcement Methods There are many ways to catch a crook, no matter how cryptographically sophisticated. After all, it is much easier to plant listening devices around a suspected drug trafficker, serial murderer, or whatever, in our own country (with a proper search warrant) than it is to try to figure out how to bug the command center of an enemy dictator surrounded by a loyal army. An encrypted phone conversation may actually lull the bugged suspect into a sense of false security, talking openly about crimes on a secure line. An encrypted telephone does a criminal little good if the room or car the phone is in is bugged. 7.8 Clarify & Repair Export Regulations My specific recommendations to clarify the export regulations with respect to encryption software, keep the encryption technology that we use for our own military and diplomatic communications safe, allow all reasonable commercial uses of encryption technology in the United States, to make the regulations much more enforceable, and to bring these regulations into compliance with the United States of America's Constitution follow. $ 120.10 (1) should be altered (by removing the exception for software defined in a nonexistent section) to read: (1) Information which is required for the design development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions and documentation. $ 121.1, Category XIII, subcategory (b), items (1), (2) and (3), should be modified to read: (b) Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefor, including: (1) Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software with the capability of maintaining secrecy or confidentiality of information or information systems originated by the U. S. Government or persons working under contract to the U. S. Government, except for those specific items intentionally released by the U. S. Government to the general public or independently developed by a person or persons outside of the U. S. Government. In case of any doubt about the status of any of these items, see $120.4. (2) Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software which have the capability of generating spreading or hopping codes for spread spectrum systems or equipment and which were originated by the U. S. Government or persons working under contract to the U. S. Government, and not independently developed outside of the U. S. Government. (3) Cryptanalytic systems, equipment, assemblies, modules, integrated circuits, components or software originated by the U. S. Government or persons working under contract to the U. S. Government, and not independently developed outside of the U. S. Government. The above changes have the effect of maintaining strict controls on the cryptosystems that we use in our own military and diplomatic service, but has no ill effects on the U. S. Constitution or economy. It also has the effect of costing less taxpayer money to support censorship (Commodity Jurisdiction) proceedings. $ 121.8 (f) should be modified to read (deleting the exception for encryption software): (f) Software includes but is not limited to the system functional design, logic flow, algorithms, application programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair. A person who intends to export software only should apply for a technical data license pursuant to part 125 of this subchapter.

1 0

Slack area behind files
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

Hal Finney brought up the problem of securely wiping files stored on a "compressed" disk a la Stacker, DoublesSpace, or (in my case) SuperStor. I have modified (my copy of) PGP so that the wipe function uses pseudo-random data rather than zeroes to over-write files. This change -should- appear in the next release of PGP. It's a fairly simple change. I'll supply source diff's on request. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Risk and Opportunity
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Peter Baumbach posted on Jan 3: I stumbled onto a pair of programs called seejunk.exe and prune.exe this past week. ... There is also an opportunity here. Encrypted information could be stored at the end of your files. In other words this is an opportunity for steganography. ... I don't have full access to the internet. If someone finds these programs on the internet, can they post the location here. If the files aren't on the internet, I can email them to anyone that wants to post them to the cypherpunk ftp site. A backlevel version (2.2) of PRUNE is available on internet at both GARBO and SIMTEL. prune22.zip GARB 9959 03-31-92 <fileutil> Overwrite unallocated "Tail End" of files, from Sydex " " " SIMT 9689 04-05-92 <dskutil> B Clear out unallocated bytes at the end of file To order from the GARBO e-mail server, To: mailserv(a)garbo.uwasa.fi Subject: garbo-request send pc/fileutil/prune22.zip However, there is a more recent version (2.3) on local BBS's here (San Jose). PRUNE23.ZIP DCTL 10504 03-29-93 Unbeknownst to you, DOS often puts data from your other files after the end of your files PRUNE allows you to clear this perhaps sensitive information out before you pass it on to your competitors. You know can pick the pattern to be written after the end-of- file, and there's now a "scan subdirectories " option too. Version 2.3 of a free Sydex utility. Files: 4 Oldest: 3/4/93 Newest: 3/4/93 " " " EGLN @ 10905 11-21-93 [same description] " " " FDUT 10737 11-20-93 " " " " " " SNKP 10504 07-11-93 " " " Two of the above BBS's also have the SEEJUNK utility: SEEJUNK.ZIP DCTL 9447 07-30-90 Lets you see the junk appended to your floppy " " " FDUT 9345 10-01-91 See the "junk" inside some of your executables. Key to BBS Codes DCTL DC-to-Light 408-956-0317 EGLN Eagle's Nest 408-223-9821 FDUT Flying Dutchman 408-294-3065 SNKP Snakepit (aka Micro-Medic) 408-287-2454 All of the above support at least 9600 bps V.32. I'll join Peter in offering to download & send copies of these programs to anyone who will put them on a public FTP site or mailserver. Another program similar to the above is WIPIT100.ZIP EGLN 14897 11-21-93 WIPIT v1.00 8/2/93 Wipe all free space on your disk to prevent Undeleting files. Free for personal use. which takes care of data left in free areas. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLS02UN4nNf3ah8DHAQEkUwP8CtNr9SFcW8B/hS2Qxu6EWM2KsTUuKKIj bDM7svpt9/p1ZBTulhmXWoLNMA6p3aBHt8TDHPzkJoJtoacXRMa3FK534ZYOu+fz 8DsJjN1Z3qWSaxqj6G+PAJtNYD6IdCFhfOEfw3ameA1n7xTXEx2AlyAa8YLJFBDp vGwO9JBPmpM= =03Dr -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: Non-techie Crypto boo
by Duncan Frissell 17 Dec '03

17 Dec '03

F >Maybe there's a book on "Privacy" out there that gives reasonably F >up-to-date coverage of crypto. I would love a book that covered all F >the sociopolitical cypherpunk issues like <The usual suspects elided> Give us a break. It takes a while to write a book and most of the concepts mentioned are too new for a book. In a sense, net developments move too fast for books and will probably never be adequately documented by that traditional form. Much as I love books... DCF Who would love to write a book but Usenet takes too much time. --- WinQwk 2.0b#1165

1 0

Softlock from alt.wired
by Hal 17 Dec '03

17 Dec '03

Saw this on alt.wired. They are creating electronic vouchers which you can use, in effect, to buy software on the net. I have more comments below: > Newsgroups: alt.wired > Path: portal!sdd.hp.com!sgiblab!swrinde!cs.utexas.edu!howland.reston.ans.net!newsserver.jvnc.net!jvnc.net!exit14tty21.jvnc.net!user > From: Schull(a)SoftLock.com (Jon Schull) > Subject: Re: Time for an Internet Electronic Funds Transfer Protocol? > Message-ID: <Schull-040194174238(a)exit14tty21.jvnc.net> > Followup-To: alt.wired > Sender: news(a)tigger.jvnc.net (Zee News Genie) > Nntp-Posting-Host: exit14-tty21.jvnc.net > Organization: SoftLock Services > References: <35218(a)mindlink.bc.ca> <2fnvni$99h(a)inca.gate.net> <CIysJ9.4yA(a)world.std.com> <pfarrellCIyuL0.Hr9(a)netcom.com> > Date: Tue, 4 Jan 1994 22:49:49 GMT > Lines: 46 > > > I think we at SoftLock Services are pretty much there already. > > We have an automated, 24 hour 800 number set up for sale of anyone's > products. > Dial 1-800-SoftLock. > > We respond to Email. (Send something to Intro(a)SoftLock.com) > > We take VISA, MasterCard, and SoftLock Vouchers. > (SoftLock Vouchers are pre-paid virtual certificates, redeemable by Email > for > anything we sell. Since you get to determine the value of the Voucher, > you > risk only the value of your Voucher.) > > We have a license from RSA to use the DES- and public-key-based RIPEM > for > secure Email transactions. And since we'll soon be selling Passwords by > return Email, the purchaser's risk and delay-of-gratification can be > virtually zero. > > And we give away the Tools for creating SoftLocked documents and > executables, > (freely copyable, partially encrypted, and instantly unlockable with a > workstation-specific SoftLock Password). So anyone can sell anything > online, > or off. For example, The SoftLock DOS document toolkit, for example, will > soon be available for free at popular internet sites, and can be ordered > for > $9.99 as ProductNumber 10011 from 1-800-SoftLock. > (When asked for a SoftLockID, you can press 30639668). > > P.S. We're still shaking this stuff down (and Passwords(a)SoftLock.com is > still in chains), but we're open for business. > > Please inform me or Staff(a)SoftLock.com now if you have any problems, > questions, or propositions! > ------------------------------------------------------------------------------ > A 400-line press-release, "SoftLock Services Introduces SoftLock Services" > is > automatically available from the Email robot at IntroLong(a)SoftLock.com. > > Jon Schull Schull(a)SoftLock.com (716)-242-0348 > "You trust your mother, but you still cut the cards. > SoftLock makes for a good game." I got the press release referred to. The business is to provide passwords to unlock advanced features of software products distributed like shareware. You can use a crippled version of the program for free, but to get the advanced features you call Softlock and pay them money, then they give you a code which unlocks all the program's features. Softlock takes a percentage of the fee and passes the rest on to the developer. This is not that new, but one thing they do have is a pre-paid voucher usable to purchase software password codes. When you buy a new password to unlock a program you can pay electronically by MC/VISA or by voucher. (You can also send checks and cash by postal mail.) Presumably these vouchers could be given as gifts, or exchanged in other ways. If Softlock eventually develops a good range of useful software, this could lead to a grass-roots form of electronic money. It would be backed by the Softlock software products, but could eventually be used to buy other things, because people would know that the vouchers were worth real products so they would accept them. This route to backing money seems to have less problems with the banking laws, etc. The specific Softlock vouchers are not anonymous, I'm sure. Anonymity would add a lot of overhead and complexity in working with them (see our earlier discussions of Chaumian cash). But they could be a start towards a net-wide electronic payment system. The Softlock people are somewhat crypto aware, accepting RIPEM messages, which is good if you want to send your VISA card number to them. I wonder if they might be interested in a more cryptographically advanced untraceable voucher system. Hal

1 0

GNN.Com, Mosaic, and Detweiler :)
by allan＠elvis.tamu.edu 17 Dec '03

17 Dec '03

I wonder how Detweiler spoofed the GNN.Com people to put his article in their GNN Magazine with the *obviously* phoney bio-blurb? just pondering.... -- Allan Bailey, allan(a)elvis.tamu.edu | "Freedom is not free." Infinite Diversity in Infinite Combinations | allan.bailey(a)tamu.edu "Liberty means responsibility. <> That is why most men dread it." <> I'd rather be a free man in my grave, --g.b.shaw <> Than living as a puppet or a slave...

1 0

Re: Non-techie Crypto book?
by Pierre Uszynski 17 Dec '03

17 Dec '03

Quoting fnerd (all quotes from his post): > Maybe there's a book on "Privacy" out there that gives reasonably up-to-date > coverage of crypto. I would love a book that covered all the sociopolitical > cypherpunk issues like [...] I don't know if a book is the right response (agreed with Duncan Frissell: writing a book takes so much time, and reading usenet already doesn't leave much :-), or if the cypherpunk archive is a step in the right direction, but there is a problem: The background relevant for an understanding of cypherpunks' concerns, hopes, tools, political and economical non-agenda, and technology is not something that can be acquired in one place, in a magazine article read in one hour, yet. There is not one such document to which we can point newbies that is a suitable introduction. Ideally, this document should also be online. It's something that came apparent to me when talking to friends about cypherpunkish issues, and then the main reason I attended Tim May's seminars at Stanford. The seminar was, roughly, to cover the issues, the techniques, and the potential/eventual political and economical consequences of crypto. The assumption was originally that the talk would skip the details of crypto algorithms, and the math behind them (if I remember well). And my conclusion was that a one hour seminar is not sufficient for even an introduction to that stuff, even to a theoretically bright audience. There is too much to cover. There is too little to start from. The seminar was ok for people who already were aware of the basics in privacy, public key crypto, crypto-politics, and computer networking. For them, the seminar kind of connected things together, showed the wider picture. But for others, not aware of privacy issues, not aware of even the existence of public key crypto, barely aware of computer networking, etc..., there is just too much, and lots of it just does not make sense. These others are amazed that "Porn" (That Major Evil ;-) can come unchecked from other countries on computer networks (heck some people don't even understand that not all countries give a damn about the US laws :-( For these same others, computer networks are still a very new notion. What proportion of TV journalists understands what computer networks are about? And finally, for the same people, crypto results such as unbreakable encryption, secret sharing, untraceability (a la DC-net), digital cash, remote coin flipping are utterly indistinguishable from magic. So much so that most would just not understand it is possible. And when they see and understand, say a demo of a DC-net, the consequences are still impossible to grasp. It's the same as trying to explain the Internet to a 1960's farm hand (no offense to farm hands). Some questions at the seminar showed this kind of symptom. All this leads me to the conclusion that if cypherpunks want to see more awareness of possibilities and issues, they should concentrate as much on generating a body of introductory documents, as on literally "writing code". Generating stuff suitable for publication in general distribution magazines would also help (and even potentially make some money). From the level of awareness we can see out there, even very basic articles should be acceptable by thousands of magazines and newsletters. A book would help, but barring that, random intro articles here and there would go a long way (BTW, Email and BillG just made the cover of The NewYorker, for those who don't know yet, and showed no awareness of privacy or crypto issues...) It also leads us to the many people that believe that there is a time constant dictating the adoption and understanding of new technology. It may not matter how much we want people to understand it. > Has anyone read the Michael Marotta book? What's this one about? Anybody has the full reference, and maybe a survey of the table of contents? > cryptocosmology- sufficiently advanced communication is indistinguishable > from noise - god is in the least significant bits ObRecommendedRead: Related to noise, communication, Kolmogorov complexity, and god in the least significant bits :-) and bad writing unfortunately :-( A science fiction story about SETI: Carl Sagan, Contact, 1985, 434pp, Pocket Books, ISBN 0-671-43422-5 Pierre Uszynski. pierre(a)shell.portal.com

1 0

No Subject
by Dave Banisar 17 Dec '03

17 Dec '03

cpsr.digex.net> Date: Sat, 8 Jan 1994 00:04:16 -0500 From: Dave Banisar <cpsr(a)access.digex.net> To: Cypherpunks(a)toad.com Cc: Dave Banisar <banisar(a)washofc.cpsr.org> Subject: CFP 94 Draft Program CFP '94 THE FOURTH CONFERENCE ON COMPUTERS, FREEDOM AND PRIVACY MARCH 23-26, 1994 CHICAGO PALMER HOUSE HILTON "CYBERSPACE SUPERHIGHWAYS: ACCESS, ETHICS and CONTROL" SPONSORS ASSOCIATION FOR COMPUTING MACHINERY SPECIAL INTERESTS GROUPS ON: COMMUNICATIONS (SIGCOMM) COMPUTERS AND SOCIETY (SIGCAS) SECURITY, AUDIT AND CONTROL (SIGSAC) JOHN MARSHALL LAW SCHOOL, CENTER FOR INFORMATICS LAW PATRONS & SUPPORTERS (as of 15 December 1994) AMERICAN EXPRESS CORP. BAKER & McKENZIE EQUIFAX, INC LEGAL TRUSTEES, JERSEY, LTD. (UK) MOTOROLA, INC NATIONAL SCIENCE FOUNDATION (PENDING) WIRED MAGAZINE COOPERATING ORGANIZATIONS AMERICAN BAR ASSOCIATION SECTION OF SCIENCE AND TECHNOLOGY AMERICAN CIVIL LIBERTIES UNION COMPUTER PROFESSIONALS FOR SOCIAL RESPONSIBILITY ELECTRONIC FRONTIER FOUNDATION GEORGE WASHINGTON UNIVERSITY INSTITUTE for COMPUTER and TELECOMMUNICATIONS POLICY IEEE COMPUTER SOCIETY IEEE-USA COMMITTEE ON COMMUNICATIONS AND INFORMATION POLICY LIBRARY AND INFORMATION TECHNOLOGY ASSOCIATION PRIVACY INTERNATIONAL U.S. PRIVACY COUNCIL UNITED AIRLINES IS THE OFFICIAL AIRLINE FOR CFP'94 Fourth Conference on Computers, Freedom and Privacy Chicago, Il., March 23 - 26, 1994 CFP'94 "Cyberspace Superhighways: Access, Ethics and Control" General Chair George B. Trubow Center for Informatics Law, John Marshall Law School Executive Committee George B. Trubow Chair, CFP'94 Lance J. Hoffman George Washington University Chair, CFP'92 Bruce Koball San Francisco, CA Chair, CFP'93 Conference Treasurer Robert Ashenhurst University of Chicago Special Promotions Patric Hedlund Sweet Pea Productions Alan Whaley The WELL, San Francisco Manager, Volunteers and Conference Office Judi Clark ManyMedia, Palo Alto Chair, Student Writing Competition Gene Spafford Purdue University Co-Chairs, Student Scholarship Program John McMullen Marist College James Thompson Northern Illinois University ^LProgram Committee David Banisar Computer Professsionals for Social Responsibility Jerry Berman Electronic Frontier Foundation Robert Belair Mullenholz and Brimsek Roger Clarke Australian National Univesity Mike Godwin Electronic Frontier Foundation Mark Hellmann Pattishall, McAuliffe Linda Knutson Library & Information Technology Association Dennis McKenna Government Technology Magazine Michael Mensik Baker & McKenzie Ron Plesser Piper and Marbury Priscilla Regan George Mason University Lance Rose LOL Productions Marc Rotenberg Computer Professionals for Social Responsibility Robert Ellis Smith Privacy Journal James Thompson Northern Illinois University Alan F. Westin Columbia University Conference Administration by John Marshall Law School: Arrangements Director, RoseMarie Knight Publicity & Publications, John McNamara Financial Officer, James Kreminski Program Coordinator, Gary Gassman "CYBERSPACE SUPERHIGHWAYS: ACCESS, ETHICS and CONTROL Cyberspace, Information Superhighway, National Information Infrastructure, Open Platforms, Computer and Communications Revolution, Electronic Networks, Digital Data Bases and Information Society are words and phrases common to the rhetoric of our modern era. The relationships between and among individuals, society, nations, government entities and business organizations are in constant flux as new stresses and alliances change the old "rules of the game." Today's challenges are to define what is the "game," who owns the "franchises," who can play, what are the rules and who calls the shots. Information and communications technology raise new issues for freedom and privacy in this new era. Such questions are on the agenda as the participants in CFP'94 consider the alternatives and seek some solutions. Come, join in the dialogue that will help to shape the world's future! PRE-CONFERENCE TUTORIALS On Wednesday March 23, the day before the formal conference begins, CFP '94 is offering a number of in-depth tutorials covering a wide variety of subjects on five parallel tracks. These presentations will be interesting, educational, thought-provoking and often controversial. The tutorials are available at a nominal additional registration cost. CONFERENCE NEWSPAPER On each of the three days of the conference, a daily newspaper will appear to highlight what has transpired and announce important coming events. The staff of "The Decisive Utterance," The John Marshall Law School's student newspaper, is providing this service. CONFERENCE RECEPTION AND TECHNOLOGY DISPLAY On Wednesday evening, from 6:00 p.m. - 9:00 p.m., you are invited to meet new and old friends and colleagues at an opening reception at the John Marshall Law School from 6:00 p.m.-9:00 p.m. The School is only two blocks from the conference hotel. A state-of-the-art computer lab will be used to demonstrate high-tech applications in academia and registrants will be invited to take part. ^LSINGLE-TRACK MAIN PROGRAM The technological revolution that is driving change in our society has many facets and we are often unaware of the way they all fit together, especially those parts that lie outside one's own daily experience. An important goal of CFP '94 is to bring together individuals from disparate disciplines and backgrounds and engage them in a balanced discussion of CFP issues. To this end our main program, starting on Thursday, March 24, is on a single track enabling registrants to attend all sessions. The concurrent Birds- of-a-Feather meetings Thursday after 9:15 p.m. are exceptions. BIRDS OF A FEATHER SESSIONS (BoF) CFP '94 will provide a limited number of meeting rooms to interested individuals for informal "Birds of a Feather" sessions after the formal program Thursday, from 9:15 p.m. - 11:15 p.m. These sessions will provide an opportunity for special-interest discussions. For further information or to request a BoF contact CFP '94 Program Coordinator, Gary Gassman, at the John Marshall Law School (6gassman(a)jmls.edu) MUSEUM OF SCIENCE AND INDUSTRY GALA Registrants are invited to a very special reception and buffet at Chicago's famed Museum of Science and Industry where they also will be treated to a private showing and demonstration of the MSI's newly-opened Communications and Imaging Exhibits. These multi- million dollar presentations occupy 15,000 sq.ft. of museum space and required three years to develop. "Communications" is a panoramic display of how technology has transformed our lives by dissolving distance and and making connections; visitors can even enter the unreal world of virtual reality. "Imaging" is a mind- boggling journey through modern applications of imaging technology. Visitors can even play the role of brain surgeon, using radiosurgery made possible by 3-D imaging, or explore imaging in forensic science by using MRI, fingerprint enhancement, face aging and other modern technologies to solve a crime! REGISTRATION WILL BE LIMITED CFP '94 registration will be limited to 550 attendees, so we advise you to register early to assure admission and to take advantage of the early registration discounts. MEALS AND RECEPTIONS A key component of the CFP conferences has been the interaction between the diverse communities that constitute our audience. To promote this interaction CFP '94 provides three luncheons, three receptions and three evening meals with the price of registration. EFF PIONEER AWARDS All conference attendees are invited to the EFF Pioneer Awards Reception sponsored by the Electronic Frontier Foundation on Thursday evening. These, the third annual EFF Pioneer Awards, will be given to individuals and organizations that have made distinguished contributions to the human and technological realms touched by computer-based communications. CONFERENCE BUSINESS OFFICE The Conference business and registration office will be open from 8:00 a.m. until 9:00 p.m. on Wednsday thru Friday, and until 6:00 p.m. on Saturday, for registration and general information. NOTE: The following program content and schedule is subject to change. The Information Superhighway is a fast track! Wednesday, March 23, 1994 Pre-Conference Tutorials 9:00 a.m. - noon Cyberspace Law for Non-Lawyers This tutorial presents an outline of the law for laymen, dealing with Constitutional and legal issues that confront those concerned with privacy, crime, and freedom of expression in cyberspace. There will be summaries of recent cases, legislative proposals and government activities. Mike Godwin, Online Counsel, EFF Rules of the Road for Network Travelers. (CLE Credit Approved) The information superhighway presents a variety of rights and risks. Learn about the legal issues of computer networks, services and bulletin boards, including on-line property rights; protecting personal privacy and business information; electronic publishing and multimedia rights; viruses, adult materials and other no-nos. Lance Rose, Attorney and Author of "Syslaw." Get Mad, Get Motivated, Get Moving! The focus of this panel is on citizen action for privacy protection: how to reach and organize constituents; support legislation or other privacy protection measures; conduct public education activities; use the technology in program activities, etc. Robert Ellis Smith, Privacy Journal Exploring Internet: A Guided Tour This tutorial gives participants a practical introduction to the most popular and powerful applications available via the world's largest computer network, the Internet. There will be hands-on demonstrations of communications tools such as e- mail, conferencing, Internet Relay Chat and resource discover, and navigations aids such as Gopher, WAIS, Archie and World Wide Web. Extensive documentation will be provided. Mark Graham, Pandora Systems Using the Freedom of Information Act The Federal FOIA is the principal focus of this tutorial though some attention is given to the use of state FOIAs. The session will cover procedures for making requests, identifying the information desired, differences between electronic and hard copy responses, and the appeals process within agencies and the courts. David Sobel, Counsel, Computer Professional for Social Responsibility 2:00 p.m. - 5:00 p.m. Cryptography: What, and How? Data encryption is in the cyberspace limelight as perhaps the only technique to ensure digital privacy and security; it is also the subject of sharp debate regarding control of the development and use of the technology. This tutorial will display what encryption is, how it works, and some of the options for its use. Computer animations and graphic displays will be used to help make cryptography comprehensible; the audience will engage in some hands-on encryption exercises. Mark Hellmann, Pattishall, McAuliffe et.al, Chicago Electronic Detectives: Critical Issues for Public and Private Investigators. Both governmental and private sector investigators have unprecedented access to "open" sources that were practically inaccessible a few years ago. This information environment poses opportunities and risks that will be the focus of this program. Investigative techniques via networks will be demonstrated and the legal, ethical and practical issues will be explored. Actual case-studies will be utilized. Michael Moran, CCO; Michael Robertson, CFE Hi-Tech Intellectual Property Law Primer (CLE Credit Approved) This panel will cover the special problems in patent, copyright and tradmark law engendered by computers and digital technology, with attention to the impact of recent cases. The differences in European protection will be surveyed as well as technology export restrictions. Raymond Nimmer, University of Texas Law School Leslie A. Bertagnolli, Baker & McKenzie, Chicago ^L Transactional Data Analyses: Making FOI Access Useful Electronic communication, coupled with federal and state Freedom of Information Acts, has made a great deal of data available to the public regarding the activities and policies of government enforcement and regulatory agencies. Knowing how to evaluate and use this information is critical to understanding and demonstrating what the data really means. The Transactional Records Access Clearinghouse (TRAC) of Syracuse University uses its various knowledge-bases to demonstrate the power of transactional data. Colorgraphics and analytic techniques are combined in demonstrations of how otherwise drab statistics can be displayed dramatically to aid in policy analyses and advocacy. David Burnham, former New York Times Investigative Reporter; Susan Long, Co-director, TRAC, SUNY-Syracuse Election Fraud and Modern Technology There has been increasing attention, in the U.S. and abroad, to the use of modern technology in the electoral process. Buying votes, stealing votes, changing votes -- whether in the environment of punch-cards or fully automated voting machines -- is the subject of this tutorial. Mock elections will be staged in which the participants have roles in planning to perpetrate as well as prevent vote fraud. Voter registration, phone-based voting, cryptography and verification are among the strategies and technologies to be considered. Russel L. Brand, Reasoning Systems. SPECIAL EVENTS ON WEDNESDAY, Mar. 23: Noon - 4:00 p.m., Privacy International Business Meeting This meeting, at the John Marshall Law School, begins with a buffet luncheon. Non-members interested in learning about P.I. and the Illinois Privacy Council are invited to be guests for lunch and a briefing. Guest space will be limited so attendance on a "first come" basis MUST be confirmed by March 8, 1994. 6:00 p.m. - 9:00 p.m. Conference Reception All CFP registrants are invited to a reception and open house demonstrating the John Marshall Law School's recently opened computer lab. This also is an opportunity to "network" the old-fashioned way, meeting old friends and making new ones while enjoying the reception and buffet. This state-of-the-art facility will display information and communications technology being used in the educational environment. Guests also may participate in hands-on demonstrations of the technology under the tutelage of JMLS faculty and staff. ^L(Wed. Special Events, Cont'd) 9:15 p.m. - 11:15 p.m. "CFP SOAPBOX SQUARE" On Wednesday, March 23, from 9:15 p.m. to 11:15 p.m., "CFP Soapbox Square" will be open. This is a chance for those who have something to say publicly to say it and to hear response from others! Those interested in making a brief statement (3 minutes) at this meeting must file their request and describe their topics by 5:00 p.m. on Wednesday. Discussion time for various topics will be allocated based upon the number of topics and the number who have asked to speak. Requests to speak can be made at the time of pre-registration or at the conference site. Thursday, March 24, 1994 8:30 a.m., CFP'94 Official Opening Welcome to the Conference: George B. Trubow, General Chair Welcome to Chicago: Hon. Richard M. Daley, Mayor (Invited) 9:00 a.m. Keynote Address: Mr. John Podesta, Assistant to the President, Washington, D.C. 10:00 a.m. Break 10:30 a.m. The Information Superhighway: Politics and the Public Internet. The Administration and Congress propose policies that will lead to a digital multimedia highway. How can the road be built at affordable cost while serving the public interest and our constitutional values? Chair: Jerry Berman, Electronic Frontier Foundation 12:00 p.m. Lunch Speaker: U.S. Senator Paul Simon (Invited) 1:30 p.m. Is It Time for a U.S. Data Protection Agency? Beginning with the Privacy Act of 1974, proposals to establish an oversight body for data protection have been offered but not adopted; another proposal is currently pending in Congress. Against a background of almost twenty years experience under the Privacy Act, the panel will consider whether the current political, economic and technological mileau favors establishment of a data protection agency. Chair: Priscilla M. Regan, George Mason University 2:45 p.m. Break 3:00 p.m. "Owning and Operating the NII: Who, How, When?" The National Information Infrastructure is an important initiative for the present Administration. This panel will explore policy and technical issues such as equity and access, connectivity and standards, funding and regulation, privacy and security, ownership and operation. Chair: Marc Rotenberg, Computer Professionals for Social 4:15 p.m. Break 4:30 p.m. Data Encryption: Who Holds The Keys? Recent attempts, led by federal law enforcment agencies, to control the development and dissemination of strong cyptography programs has engendered considerable discussion and disagreement. The interests of law enforcement agencies may conflict with the need for data security and personal privacy demanded by users of electronic networks. This panel will evaluate proposals to deal with the question. Moderator: Willis Ware, Rand Corporation 5:30 p.m. Adjourn 6:00 p.m. EFF Awards Reception Once again, the Electronic Frontier Foundation hosts a reception prior to its annual Pioneer Awards presentation. All CFP attendees are invited to enjoy the recepiton and congratulate the new honorees. 7:00 p.m. Conference Banquet (Speaker to be announced) 9:15 - 11:15 p.m. "Birds-of-a-Feather" sessions run concurrently. Friday, March 25, 1994. 8:30 a.m. Keynote: David Flaherty, Data Protection Commissioner, Victoria, British Columbia 9:15 a.m. Health Information Policy The Clinton Health Reform Plan, and variations on that theme, stress the use of information technology to help the efficiency and effectiveness of health care. Expert consultation, improved service delivery through new technology, and improvements in the processing of health insurance claims bring promise of cost cuts as well as the possibilities of threats to personal privacy. This panel of experts will form the "CFP Group" to explore these promises and threats. Chair: Robert R. Belair, Mullenholz & Brimsek, Wash., D.C. 10:30 a.m. Break 10:45 a.m. Can Market Mechanisms Protect Consumer Privacy? When does protection of consumer privacy require legal standards and government regulation and when can bargains and agreements in the market suffice? What role do new technological options for individuals and organizations play in facilitating private choice and market transactions? Is "ownership" of personal information a useful concept or a dead end for privacy protection in an information age? Chair: Dr. Alan F. Westin, Columbia University Noon Lunch, Speaker: Philip Zimmerman, PGP 1:30 p.m. Creating an Ethical Community in Cyberspace The fundamental ethical questions posed by the "settlement" of cyberspace are not new. What is new is that the relationship between behavior and the ethical conceptions by which we judge behavior shift and become more ambiguous and vague. This sessions examines the ethical dilemmas brought about by the "colonization" of cyberspace that must be resolved to establish and maintain a stable, humane environment. Chair: Prof. James Thomas, Northern Ilinois University 2:45 p.m. Break 3:00 p.m. Standards for Certifying Computer Professionals The subject of licensing of computer professionals is receiving increased attention by professional organizations and by state legislatures. Both the ACM and IEEE have proposals under study, and perhaps a half-dozen states are considering licensing bills. This panel will consider the pros and cons and suggest some standards for certification. Chair: Donald Gotterbarn, East Tennessee State Univ. 4:15 p.m. Break 4:30 p.m. Hackers and Crackers: Using and Abusing the Networks This session will explore issues surrounding the "fringe" of network use. What can and should be exchanged? Who will monitor "appropriate" use? What's the current difference, if any, between "hacker" and "cracker"? What should be expected and accepted regarding the role of law enforcement agencies? 5:30 p.m. Adjourn 5:45 p.m. Buses begin departing for the Chicago Museum of Science and Industry for a private reception and demonstration at the Communications and Imaging exhibits. 9:00 p.m. Buses begin departing for return to the Palmer House and Chicago's "Loop." ^L Saturday, March 26, 1994 9:00 a.m. The Role of Libraries on the Information Superhighway As the information landscape changes dramatically the historic role of libraries as the "information commons" is challenged. How will the Carnegie ideal of free, public access be implemented by the library community? Should it be? This panel will consider policy for an information network in the public interest. Moderator: Tamara J. Miller, President, Library and Information Technology Association 10:15 a.m. Break 10:30 a.m. International Governance of Cyberspace: New Wine in Old Bottles -- Or Is It Time For New Bottles? Much discussion transpires between members of the Economic Community, the O.E.C.D., the Council of Europe, and the United States, regarding data protection, intellectual property rights, transborder data flow, the mediation of disputes, etc. This panel will consider whether existing mechanisms can solve the problems or a new structure for the governance of cyberspace is needed. Chair: Ronald L. Plesser, Piper and Marbury Noon: Lunch Speaker: Simon Davies, Director General, Privacy International 1:30 p.m. The Electronic Republic: Delivery of Government Services over the Information Superhighway State and local governments use computer networks to deliver a wide range of services and information to the public; electronic "kiosks" are moving to "government by ATM." How will this interaction between government and the people affect the process of American government in the future? Chair: Dennis McKenna, Publisher, "Government Technology." 2:45 p.m. Break 3:00 p.m. Education and NREN, K - 12 Internetworking is a very new technology being rapidly deployed to conventional classrooms, a very old technology. The panel will explore the clash of contradictory assumptions embedded within these systems -- a clash which has profound implications for the future of both the network and the classrooom. Chair: Steven Hodas, NASA NREN Project 4:00 Break 4:15 p.m. Guarding the Digital Persona After this panel has established the threats to personal privacy from individual profiling and target marketing, and a regime to legally recognize and protect an "electronic personality" is put forth, Bruce Sterling will offer to explain why much of that worry is misdirected! Chair: Roger Clarke, Australian National University 5:30 p.m. Adjournment Featured Speakers Confirmed as of 12/15/93 Philip Agre, Dept. of Sociology, U. of Cal., San Diego David Banisar, Computer Professional for Social Responsibility Robert R. Belair, Mullenholz & Brimsek, Washington, D.C. Jerry Berman, Executive Director, Electronic Frontier Foundation Leslie A. Bertagnolli, Baker & McKenzie, Chicago Andrew Blau, The Benton Foundation, Washington, D.C. Dr. Herbert Burkett, GMD, Koln, Germany Jeffrey Chester, Director, Center for Media Education Roger Clarke, College of Commerce, Australian National University Ellen Craig, Commissioner, Illinois Commerce Commission Simon Davies, Director General, Privacy International, London David Flaherty, Data Commissioner, British Columbia Oscar H. Gandy, Media Studies Center, Columbia University Donald Gotterbarn, East Tennessee State University Allan Hammond, New York University Law School Steven Hodas, NASA NREN Project, Washington, D.C. David Johnson, Wilmer, Cutler & Pickering, Washington Steven Kolodney, Dir., Information Technology, State of California Curtis Kurnow, Landels, Ripley & Diamond, San Francisco Kenneth Laudon, School of Information Systems, New York University Lee Ledbetter, HDX Jay Lemke, School of Education, City University of New York Duncan MacDonald, V.P. & Gen. Couns., Citicorp Credit Services Shirley Marshall, Public Sector Marketing, IBM Dennis McKenna, Publisher, Government Technology Magazine Michael Mensik, Baker & McKenzie, Chicago Raymond Nimmer, University of Texas Eli Noam, Columbia University School of Business Michael North, President, North Communications Ronald L. Plesser, Piper and Marbury, Washington, D.C. Marc Rotenberg, Computer Professionals for Social Responsibility Rohan Samarajiva, Department of Communication, Ohio State Univ. David Sobel, Computer Professionals for Social Responsibility Bruce Sterling, Sci-Fi Writer and Journalist, Austin, Texas Connie Stout, Texas Education Network James Thomas, Department of Sociology, Northern Illinois University Greg Tucker, Head of the Business School, Monash Univ., Australia Bruce Umbaugh, Old Dominion University Patricia Valey, Acting Director, Office of Consumer Affairs Maarten van Swaay, Dept. of Computer Science, Kansas State U. Daniel Weitzner, Sr. Staff Counsel, Electronic Frontier Foundation Alan Westin, Columbia University Christine Zahorik, Staff, Senate Committee on REGISTRATION Register for the conference by returning the Registration Form along with the appropriate payment. The registration fee includes conference materials, three luncheons (Thursday, Friday and Saturday), a reception, open house and buffet (Wednesday), a reception and banquet (Thursday), and a gala reception and buffet at the Museum of Science and Industry. Payment must accompany registration. REGISTRATION FEES If paid by: 7 February 8 March On Site Early Regular Late Conference Fees $315 $370 $420 Tutorial Fees $145 $175 $210 Conf. & Tutorial $460 $545 $630 Save by Registering Early! FP '94 SCHOLARSHIPS The Fourth Conference on Computers, Freedom and Privacy (CFP '94) will provide a limited number of full registration scholarships for students and other interested individuals. These scholarships will cover the full costs of registration, including luncheons, two banquets, and all conference materials. Scholarship recipients will be responsible for their own lodging and travel expenses. Persons wishing to apply for one of these fully-paid registrations should contact CFP '94 Scholarship Chair: John F. McMullen CFP '94 Scholarship Committee Perry Street Jefferson Valley, NY 10535 Phone: (914) 245-2734 or email mcmullen(a)mindvox.phantom.com HOTEL ACCOMMODATIONS CFP'94 will be held at the Palmer House Hilton, a venerable Chicago landmark in the "Loop." This spacious and comfortable facility is easily accessible from the O'Hare International and Chicago Midway airports, and is only 2 blocks from The John Marshall Law School. Special conference rates of $99/night, single or multiple occupancy, are available. Our room block is guaranteed only until March 1, 1994, so we urge you to make your reservations as early as possible. When calling for reservations, please be sure to mention CFP'94 to obtain the conference rate. Hotel Reservations: Palmer House Hilton, 17 E. Monroe, Chicago, Il., 60603. Tel: 312-726-7500; 1-800-HILTONS; Fax, 312-263-2556 REFUND POLICY Refund requests received in writing by March 8, 1994 will be honored. A $50 cancellation fee will be applied. No refunds will be made after this date; however, registrants may designate a substitute. OFFICIAL AIRLINE CFP'94 is proud to have United Airlines -- Chicago's Own -- as our own exclusive official airline! United will give our conferees a 5% discount off any published United or United Express airfare, including First Class, or 10% off the new BUA fare when purchased at least a week in advance of travel. Call toll-free 1-800-521- 4041 to make reservations and be sure to give our CFP'94 ID Number: 541QI. REGISTRATION NAME (Please Print) TITLE AFFILIATION MAILING ADDRESS CITY, STATE, ZIP TELEPHONE E-MAIL PRIVACY LOCKS: We will not sell, rent. loan, exchange or use this information for any purpose other than official Computers, Freedom and Privacy Conference activities. A printed roster containing this information will be distrusted at the conference. Please indicate if you wish information to be excluded from the roster: ( ) Print only name, affiliation and phone no. ( ) Print name only ( ) Omit my name from the roster ( ) I would like to attend the Privacy International luncheon and briefing at noon on Wednesday, March 23. (Your attendance as a guest of P.I. and the Illinois Privacy Council MUST be confirmed by March 8, and is on a "first come" basis.) "CFP Soapbox Square" ( ) I would like to make a formal statement (3 mins.) during "CFP Soapbox Square" to be held from 9:15 p.m. - 11:15 p.m. on March 23. My topic: ( ) I plan to attend "Soapbox Square" but do not wish to make a prepared statement, though I may join in the discussion. REGISTRATION FEES If paid by: 7 February 8 March On Site Early Regular Late Conference Fees $315 $370 $420 Tutorial Fees $145 $175 $210 Conf. & Tutorial $460 $545 $630 Note: If you have registered for the Tutorials, please select one from each group: 9:00 A.M. - 12:00 NOON ( ) Cyberspace Law for Non-Lawyers ( ) Rules of the Road for Network Travelers (CLE Credit) ( ) Citizen Action: Get Mad, Met Motivated, Get Moving! ( ) Exploring Internet: A Guided Tour ( ) Using FOIA 2:00 P.M. - 5:00 P.M. ( ) Cryptography: What, and How? ( ) Introduction to Hi-Tech Law (CLE Credit) ( ) TRAC: Evaluative Data Analysis ( ) The Electronic Detective" Online Investigations ( ) Electoral Fraud PAYMENTS TOTAL AMOUNT Please indicated method of payment: ( ) Check (payable to JMLS-CFP '94) ( ) VISA ( ) MasterCard Credit Card # Expiration Date Name on Card Signature *********** George B. Trubow, Professor of Law Director, Center for Informatics Law The John Marshall Law School 315 S. Plymouth Ct. Chicago, IL 60604-3907 Fax: 312-427-8307; Voice: 312-987-1445 E-mail: 7trubow(a)jmls.edu ***********

1 0

Online: The Gore'y Details
by James D. Wilson 17 Dec '03

17 Dec '03

AL GORE IN CONVENTION CENTER CP'sters: in case you hadn't heard: (6-Jan-94) U.S. News & World Report will host a live conference with U.S. Vice President Al Gore in the CompuServe Convention Center on 13-Jan at 5:30 p.m. EST (23:30 CET). Gore will be typing responses to member questions and comments direct from the White House offices. Advance reservations are required. Members may submit questions ahead of time for the moderator to ask during the conference. Submit questions in the U.S. News Online Forum's (GO USNFORUM) Message Section 2, "Washington/Politics." Members who do not access the Convention Center by 5:20 p.m. EST (23:20 CET) may lose their reservations. Please note that Mr. Gore's schedule is subject to change. To make advance reservations and to access the conference, GO GORE. The Convention Center is a part of CompuServe's extended services.

1 0

No Subject
by blankenm＠seq.oit.osshe.edu 17 Dec '03

17 Dec '03

subscribe blankenm(a)seq.oit.osshe.edu

1 0

PGP key servers
by L. Detweiler 17 Dec '03

17 Dec '03

Uh, I must have missed something, but a lot of the servers seem to be down. Is there a problem here?

1 0

T-Shirt Ordering Information
by Christian Void 17 Dec '03

17 Dec '03

"Cypherpunk Criminal" T-shirt Ordering Information --------------------------------------------------------- Part I: Where to get a preview of the design The front of the t-shirt can be obtained via anonymous FTP at netcom.com in pub/cvoid/cypherpunks. The filename is "front.gif" which is based on Jef Poskanzer's "CRYPTO-DATA" DOT warning logo (this file is available as well as "logo.gif"). The back of the t-shirt consists of the upper banner, "cypherpunks(a)toad.com", and the lower banner, "There is safety in large numbers". In the middle is a listing of 7-digit primes in a large block. The typestyle is Fusion and Fusion bold. Outputting this to a GIF is next to impossible due to the resolution needed to reproduce the text. Trust us, it's cool. Part II: What kind of t-shirt is it? What color? Sizes? Custom? Availability? The t-shirts are Hanes Beefy-T's, which are a very strong and durable. The t-shirts will be black, with white and yellow screened on to it. We were unable to come up with a practical way to customize the t-shirts on an individual or group basis, so we opted for this design instead. We will only be making as many as we get orders for, and have no plans to do a second printing. Sizes available are S, M, L, and XL. We may be able to get XXL, XXXL and XS shirts as well. We will post an update in regards to the additional sizes. Part III: How much do they cost? Ordering deadline? The t-shirts will cost $10 each, which will include shipping and handling to anywhere you want them sent (except Mars). We will be accepting orders until February 15th. The t-shirts will be shipped out before February 28th. Part IV: Ordering Information Please make all Money Orders out to "Inky Fingers" (the screening company we use). Please specify the number of t-shirts, and what size you need, and where you want them shipped. We cannot (for obvious reasons) accept personal checks. Cashier's Checks and Money Orders only, please. Orders can be mailed to: V/M/R Attn: Cypherpunks T-Shirt P.O. Box 170213 San Francisco, CA 94117-0213 If you have any further questions, you can send me e-mail here at <cvoid(a)netcom.com> or <cvoid(a)albemuth.tatertot.com>. Anyone who sent e-mail in regards to this will also get this e-mailed to them directly, in case they do not have access to the list. Feel free to forward this to any interested parties. Thanks. -- Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

Crypto not being used where needed
by Mike Ingle 17 Dec '03

17 Dec '03

At CES someone was showing a cellular credit card machine. It had an antenna and a regular card reader, and was battery powered, so it could be used anywhere. The machine was designed to be used in taxicabs, at swapmeets, and wherever there were no phone lines available. I asked the rep about its security - does it use encryption? No, it does not use encryption. It sends your credit card number and expiration date over the cellular link in clear. Most credit card machines use low-speed modems which are trivial to intercept. This one is probably no exception. Here is a case where DES is badly needed and not being used. If this machine becomes popular, thieves will be trailing taxicabs with scanners and tape recorders.

5 4

Beware of forged messages
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone recently posted a forged message with my name on it to the Cypherwonks list. In the future, all of my messages will be sent PGP-clearsigned. Please ignore (or mail to me) any messages which aren't - particularly if they appear to support Detweiler and his totalitarian schemes, which this particular forgery did. The header of the message in question was a byte-for-byte duplicate of an authentic header from a message I did write; apparently our favorite cyberspatial lunatic has moved beyond just signature blocks. -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLTDdcH3YhjZY3fMNAQGwigQAtPhZpZoC8SXR0tstHQgabIVLq04jzTNz kWOibwRd4Zvvs+tnxkKhkMQU2qR13e4Go0N/RV19cVpqA2Yr3DEnCkCbqKnVz54V qK6Pyu+fw3wNROobzCAsTZw25H4zRgqmxjkSW7hbIQVU35mZt+pLn23BKV+ck3L4 cdZeOer6Q7w= =MXpV -----END PGP SIGNATURE----- -- Greg Broiles "Sometimes you're the windshield, greg(a)goldenbear.com sometimes you're the bug." -- Mark Knopfler

1 0

Forged messages part of "Operation"?
by Mike Ingle 17 Dec '03

17 Dec '03

"greg(a)ideath.goldenbear.com" writes: >Someone recently posted a forged message with my name on it to the >Cypherwonks list. In the future, all of my messages will be sent >PGP-clearsigned. Please ignore (or mail to me) any messages which >aren't - particularly if they appear to support Detweiler and his >totalitarian schemes, which this particular forgery did. > >The header of the message in question was a byte-for-byte duplicate >of an authentic header from a message I did write; apparently our >favorite cyberspatial lunatic has moved beyond just signature blocks. This message forging may be about to become a major problem. In his last post "Current Operational Status", S.Boxx spewed forth: (I hereby flame myself for quoting Detweiler - so don't bother) ---snip---snip--- Operation Octopus - this is the multiple pseudonym and agent project. We plan to have at least a dozen (hence the name) posting simultaneously to many different lists and the newsgroups. But the overhead on this is very significant, and it will take us awhile to gear up and build the infrastructure to the point we can `engage'. You have seen more of these agents lately `out there', but our coordinated attack will take some more planning. Operation Duplicity - extremely top secret. Let's just say, you will be seeing double, and triple, and quadruple, and ... ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ---snip---snip--- If he starts flooding the newsgroups, what can we do about it? I'd watch for forged messages and posts, and if you don't have a key on the servers, check to make sure a forged one isn't posted. --- Mike

4 3

Twelve year flashback to Admiral Bobby Inman
by gnu 17 Dec '03

17 Dec '03

San Jose Mercury, January 8, 1982 (EIGHTY-two), page F-1 CIA boss assail high-tech leaks [The Washington Post] WASHINGTON -- Adm. Bobby R. Inman, deputy director of the CIA, Thursday predicted a "tidal wave" of public outrage and laws restricting scientists if scientists do not agree to voluntary "review" of their work by intelligence agencies. Scientists had better cooperate in making some of their papers secret voluntarily, or they will face tough laws restricting them, Inman told a panel session at the annual meeting of the American Association for the Advancement of Science. Scientists should beware that there are congressional investigations now in progress that will point up the "thoroughly documented" fact that in the buildup of Soviet defense capability "the bulk of new technology which they have employed has been acquired from the United States," Inman said. When the details of this "hemorrhage of the country's technology" come out in public, Inman said, there will be a "tidal wave" of public outrage that will lead to laws restricting the publication of scientific work that the government might consider "sensitive" on national security grounds. "The tides are moving, and moving fast, toward legislated solutions that in fact are likely to be much more restrictive, not less restrictive, than the voluntary" censorship system he has suggested, Inman said. When he was director of the National Security Agency, the codemaking and breaking intelligence agency, Inman led an effort to get prominent private researchers to submit their papers on the mathematical theory of codes to his agency before publication. The NSA also briefly put secrecy orders on some of the private code research in recent years. But in April 1981, cooperation among the National Science Foundation, the American Council on Education and the NSA resulted in a voluntary review system under which scientists can submit their papers to NSA for review and receive a judgement on whether they possibly contain information damaging to the national security. Since then, about 25 papers have been reviewed and none had problems, according to Daniel Schwartz, until recently chief counsel for the NSA. "There are other fields where publication of certain information could affect the national security in a harmful way," Inman said. These include the fields of "computer hardware and software, other electronic gear and techniques, lasers, crop projections and manufacturing procedures." ------- The above news article ran twelve years ago. His tidal wave of crypto censorship didn't appear; instead, a wave of support for free expression ran through the scientific and library community. About half of the technical societies amended their by-laws to disallow closed or censored meetings or conferences. I wonder if Admiral Inman feels the same way today, as he faces Senate confirmation hearings as Secretary of Defense. Will we be seeing the same sort of proposals? How does he feel about export controls on cryptographic software? What should be done with the Skipjack program? If you wonder too, please ask your Senator to ask him about it. Seriously. John

2 1

Re: Forged messages part of "Operation"?
by plaz＠netcom.com 17 Dec '03

17 Dec '03

>Mike Ingle says: >> If he starts flooding the newsgroups, what can we do about it? > >If he starts forging mail from other people, he's committing a crime >and we can get his system administrators to pull his account. > >Perry Any plans or tips on how to prove it in court? _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 "Subvert the domination paradigm!"

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

someone keeps sending me amusing messages encrypted with key ID 548D21. either you have failed to find my proper key ID or have succeeded in your practical joke.

1 0

Re: Crypto not being used where needed
by smb＠research.att.com 17 Dec '03

17 Dec '03

Although I sincerely agree that the data should be encrypted, is it really that easy to intercept cellular phone calls? I thought you had to go to considerably more effort than programming a scanner to pick up these transmissions - I don't know much about cellular phones, but I thought they hopped frequencies and so forth such that it was a real pain to listen in. Yes, it's really easy to monitor cellular calls. They only hop frequencies when you move between cells -- and most cop calls will be within a single cell, simply because most of the queries happen *after* they've pulled someone over. Things will change somewhat with the so-called personal communicators, since they'll use much smaller cells -- but the basic problem is still the same.

1 0

Re: Crypto not being used where needed
by peter honeyman 17 Dec '03

17 Dec '03

it is trivial to monitor cellular calls. until recently, bearcat scanners included this capability. and i have seen it done on an oki 900 handheld. peter

1 0

IIA, more info
by szabo＠netcom.com 17 Dec '03

17 Dec '03

This just in: -------->snip<-------- The message below was written by a friend who works at UUNET: --- begin included message --- Actually, we set them up. They appear to be real. Note, this is not an endorsement!!! I have no dealings with iia.org directly. I know only what I've heard around the office. They dropped big bucks for a router just for this service. The guy who sent that message appears to have been looking in all the wrong places. Military hosts tables are infamous for their incompleteness and for their tremendous lag time. Whois does indeed have this site's info, and has since December! The sender probably looked in the DDN whois DB which is only for MILITARY SITES. The correct site to check for everything else is rs.internic.net. [ken@rodan(tcsh):107] whois iia.org International Internet Association (IIA2-DOM) 30 South First Avenue Highland Park, NJ 08904 Domain Name: IIA.ORG Administrative Contact, Technical Contact, Zone Contact: Bochicchio, Charleen (CB45) char(a)JOY.ICM.COM +1 202 387 5445 (FAX) +1 202 387 5446 Record last updated on 01-Dec-93. Domain servers in listed order: MARY.IIA.ORG 198.4.75.9 NS.UU.NET 137.39.1.3 The InterNIC Registration Services Host ONLY contains Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Someone in our office did send for info and did receive it, though I do not know how long it took for them to reply. Ken Dahl ken(a)uunet.uu.net UUNET Technologies, Inc. ...!uunet!ken --- end included message --- BTW, I faxed the company an account request back in October (and again in November) but have yet to hear anything from them. Peter Johansson peter(a)cs.umbc.edu -------->unsnip<-------- Your guess is as good as mine! d3 `-{> ---- +------------------------------------------------------------------------+ | Pics OnLine MultiUser System 609/753-2540 HST 609/753-2605 (V32bis) | | Massive File Collection - Over 45,000 Files OnLine - 250 Newsgroups | +------------------------------------------------------------------------+

1 0

Re: Forged messages part of "Operation"?
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

Geoff Dale asks regarding forged signatures and id's: >Any plans or tips on how to prove it in court? Several of us on the list discussed this issue a month or so ago, covering everything from computer-based text analysis tools which derive the probability that two writing samples (one from a known author and one from an anonymous author) were produced by the same individual. Another list member indicated in private email that sentence length and grammar were also fairly invariant, so you could use those measures to build a case. If you'd like more information, I'd be happy to send you some of the list traffic from that discussion. The real question, as Tim May and others have pointed out numerous times, is whether involving the heat is the best way to take care of problems. If we can't learn to effectively stamp out blatant abuses ourselves, then there's no hope for evolving the net.community. I personally think Julf took a much-needed step in shutting down an12070, though there's still the matter of Colorado State. -- Best regards, Curtis D. Frye - Economic Analyst, Software Alchemist, Aspiring Author cfrye(a)ciis.mitre.org "If you think I speak for MITRE, I'll tell you how much they pay me and make you feel foolish."

1 0

Internet billing scam?
by szabo＠netcom.com 17 Dec '03

17 Dec '03

DNS indicated that this organization does in fact have one site, mary.iia.org. Even so, this is not enough for me to trust them with my credit line. This conclusion may apply to many other, more legitimate-looking operations that spring up in the near future. This demonstrates that privacy is only one reason to go to digital cash; the biggest reason may be the massive fraud commonplace in the current electronic system. Online billing is moving towards this incredibly insecure system where our $multi-thousand credit lines are exposed by giving out their short "keys" to numerous unknown entities. Nick Szabo szabo(a)netcom.com Forwarded from COMMUNET: Date: Tue, 4 Jan 1994 16:18:44 -0500 >From: Scott A. Ward 703-614-4719 <wards(a)AMOMEGA.ACQ.OSD.MIL> To: Multiple recipients of list COMMUNET Subject: Warning: International Internet Association A company calling itself the International Internet Association, and billing itself as "the largest non-profit provider of free Internet access in the world" has started advertizing in the Washington, D.C. area, and offering free Internet accounts to individuals who will FAX them, among other things, a credit card number. As an active member of the Member Council of the National Capital Area Public Access Network (CapAccess), I wanted to find more about this organization that supposedly has offices NOT THREE BLOCKS FROM CAPACCESS. Here's the result of my search for the IIA. 1. Their address, listed as "Suite 852 - 202 Pennsylvania Ave, N.W. Washington D.C. 20006", is actually a post office box at Mailboxes, Etc. 2. The company lists no incorporation, trademark or service-mark licenses. 3. They claim your E-mail address would be <userid>@iia.org. However: a. No iia.org is listed in the hq.af.mil hosts table b. No iia.org is listed in the acq.osd.mil hosts table c. No iia.org is listed is the INTERNIC 'whois' database d. No iia.org is listed using the INTERNIC 'netfind' Internet lookup In other words, IIA.ORG does NOT, at this time, exist. 4. Although they apologize profusely in the application, they state that "Without receiving a credit card number, the IIA _cannot_ process an account." 5. Although I have left a message on their voice-mail system, I have received no response from them. (they also apologize in the voice mail that, due to demand, they are operating at a 3-week backlog for applications.) I cannot judge an organization in advance. However, I do think it highly suspicious that, to use their propaganda, "The International Internet Association is able to make this service available through generous private donations, and the extraordinary dedication of its membership." I can say that I am not convinced this organization exists, and highly discourage any Internet user from sending information until you make certain that the IIA is real. =======================================================================

1 0