December 2003 - cypherpunks-legacy

CFS source code available January 12
by Matt Blaze 17 Dec '03

17 Dec '03

Source code for version 1.0 of CFS, the Cryptographic File System, will be distributed upon request in the United States starting on January 12, 1994. CFS pushes encryption services into the Unix(tm) file system. CFS supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze, "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps. The version being released differs from the version described in the paper in a few ways: * The encryption scheme has been strengthened, and now provides approximately the security of 3-DES with the online latency of only single-DES. * Support for the smartcard-based key management system is not included. * A few of the tools are not included (in particular, cname and ccat). * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. CFS is being distributed as COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if it deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. (Note in particular that CFS has not been tested on either Solaris or Linux, and we have no plans ourselves to support either of these systems.) We really can't promise to provide any technical support at all, beyond the source code itself. Because of export restrictions on cryptographic software, we are only able to make the software available within the US to US citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. You may * not export it, in whole or in part, or cause or allow such export, * through act or omission, without prior authorization from the United * States government and written permission from AT&T. In particular, * you may not make any part of this software available for general or * unrestricted distribution to others, nor may you disclose this software * to persons other than citizens and permanent residents of the United * States. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please send email to: cfs(a)research.att.com DO NOT REPLY TO DIRECTLY TO THIS MESSAGE. Be sure to include a statement that you are in the United States, are a citizen or permanent resident of the US, and have read and understand the license conditions stated above. Also include an email address in a US-registered domain, and say whether you'd also like to be included on a developer/user mailing list that is being set up. For a number of reasons, I am unable actually send out code until January 12, 1994. Unless you specify some other format, you'll get a uuencoded compressed tarfile. I'll be at the January USENIX conference in San Francisco, and will announce CFS at the WIP session there. -matt

1 0

trust your government
by Brad Dolan 17 Dec '03

17 Dec '03

Re. government radiation experiments, radium dial painters, & Marie Curie. Many of the radium dial painters received _stupendous_ doses. So, I surmise, did Marie Curie. Marie Curie, unlike many of the dial painters, lived to a relatively ripe old age. She might done better if she hadn't added the dose of a zillion X-rays to the dose from her internal radium burden. Interestingly, her husband was killed when he was run over by a horse-drawn cart. Anyway, the recent revelations should remind anyone who needs it how much trust should be accorded government. I'll stop preaching to the converted. Regards, bdolan(a)well.sf.ca.us

1 0

_The_Hacker_Crackdown_, _Three_Years_Later_
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

I bought Bruce Sterling's book, _The_Hacker_Crackdown_ when it was first published in November 1992. A lot of us followed along with the events outlined in the book in real time, so it was genuinely refreshing to see Bruce author an afterward, "...Three Years Later", in the electronic freeware release, which made its debut on The Well's gopher yesterday. The remainder of the book is available via gopher: gopher.well.sf.ca.us 70 follow the menu options to: /Publications/authors/Sterling/hc Cheers. 8<--------------------- cut here -------------------------- Bruce Sterling bruces(a)well.sf.ca.us Literary Freeware: Not for Commercial Use THE HACKER CRACKDOWN Law and Disorder on the Electronic Frontier Afterword: The Hacker Crackdown Three Years Later Three years in cyberspace is like thirty years anyplace real. It feels as if a generation has passed since I wrote this book. In terms of the generations of computing machinery involved, that's pretty much the case. The basic shape of cyberspace has changed drastically since 1990. A new U.S. Administration is in power whose personnel are, if anything, only too aware of the nature and potential of electronic networks. It's now clear to all players concerned that the status quo is dead-and-gone in American media and telecommunications, and almost any territory on the electronic frontier is up for grabs. Interactive multimedia, cable-phone alliances, the Information Superhighway, fiber- to-the-curb, laptops and palmtops, the explosive growth of cellular and the Internet -- the earth trembles visibly. The year 1990 was not a pleasant one for AT&T. By 1993, however, AT&T had successfully devoured the computer company NCR in an unfriendly takeover, finally giving the pole-climbers a major piece of the digital action. AT&T managed to rid itself of ownership of the troublesome UNIX operating system, selling it to Novell, a netware company, which was itself preparing for a savage market dust-up with operating-system titan Microsoft. Furthermore, AT&T acquired McCaw Cellular in a gigantic merger, giving AT&T a potential wireless whip-hand over its former progeny, the RBOCs. The RBOCs themselves were now AT&T's clearest potential rivals, as the Chinese firewalls between regulated monopoly and frenzied digital entrepreneurism began to melt and collapse headlong. AT&T, mocked by industry analysts in 1990, was reaping awestruck praise by commentators in 1993. AT&T had managed to avoid any more major software crashes in its switching stations. AT&T's newfound reputation as "the nimble giant" was all the sweeter, since AT&T's traditional rival giant in the world of multinational computing, IBM, was almost prostrate by 1993. IBM's vision of the commercial computer-network of the future, "Prodigy," had managed to spend $900 million without a whole heck of a lot to show for it, while AT&T, by contrast, was boldly speculating on the possibilities of personal communicators and hedging its bets with investments in handwritten interfaces. In 1990 AT&T had looked bad; but in 1993 AT&T looked like the future. At least, AT&T's *advertising* looked like the future. Similar public attention was riveted on the massive $22 billion megamerger between RBOC Bell Atlantic and cable-TV giant Tele-Communications Inc. Nynex was buying into cable company Viacom International. BellSouth was buying stock in Prime Management, Southwestern Bell acquiring a cable company in Washington DC, and so forth. By stark contrast, the Internet, a noncommercial entity which officially did not even exist, had no advertising budget at all. And yet, almost below the level of governmental and corporate awareness, the Internet was stealthily devouring everything in its path, growing at a rate that defied comprehension. Kids who might have been eager computer-intruders a mere five years earlier were now surfing the Internet, where their natural urge to explore led them into cyberspace landscapes of such mindboggling vastness that the very idea of hacking passwords seemed rather a waste of time. By 1993, there had not been a solid, knock 'em down, panic-striking, teenage-hacker computer-intrusion scandal in many long months. There had, of course, been some striking and well-publicized acts of illicit computer access, but they had been committed by adult white-collar industry insiders in clear pursuit of personal or commercial advantage. The kids, by contrast, all seemed to be on IRC, Internet Relay Chat. Or, perhaps, frolicking out in the endless glass-roots network of personal bulletin board systems. In 1993, there were an estimated 60,000 boards in America; the population of boards had fully doubled since Operation Sundevil in 1990. The hobby was transmuting fitfully into a genuine industry. The board community were no longer obscure hobbyists; many were still hobbyists and proud of it, but board sysops and advanced board users had become a far more cohesive and politically aware community, no longer allowing themselves to be obscure. The specter of cyberspace in the late 1980s, of outwitted authorities trembling in fear before teenage hacker whiz- kids, seemed downright antiquated by 1993. Law enforcement emphasis had changed, and the favorite electronic villain of 1993 was not the vandal child, but the victimizer of children, the digital child pornographer. "Operation Longarm," a child-pornography computer raid carried out by the previously little-known cyberspace rangers of the U.S. Customs Service, was almost the size of Operation Sundevil, but received very little notice by comparison. The huge and well-organized "Operation Disconnect," an FBI strike against telephone rip-off con-artists, was actually larger than Sundevil. "Operation Disconnect" had its brief moment in the sun of publicity, and then vanished utterly. It was unfortunate that a law-enforcement affair as apparently well-conducted as Operation Disconnect, which pursued telecom adult career criminals a hundred times more morally repugnant than teenage hackers, should have received so little attention and fanfare, especially compared to the abortive Sundevil and the basically disastrous efforts of the Chicago Computer Fraud and Abuse Task Force. But the life of an electronic policeman is seldom easy. If any law enforcement event truly deserved full-scale press coverage (while somehow managing to escape it), it was the amazing saga of New York State Police Senior Investigator Don Delaney Versus the Orchard Street Finger- Hackers. This story probably represents the real future of professional telecommunications crime in America. The finger-hackers sold, and still sell, stolen long-distance phone service to a captive clientele of illegal aliens in New York City. This clientele is desperate to call home, yet as a group, illegal aliens have few legal means of obtaining standard phone service, since their very presence in the United States is against the law. The finger-hackers of Orchard Street were very unusual "hackers," with an astonishing lack of any kind of genuine technological knowledge. And yet these New York call-sell thieves showed a street-level ingenuity appalling in its single-minded sense of larceny. There was no dissident-hacker rhetoric about freedom- of-information among the finger-hackers. Most of them came out of the cocaine-dealing fraternity, and they retailed stolen calls with the same street-crime techniques of lookouts and bagholders that a crack gang would employ. This was down- and-dirty, urban, ethnic, organized crime, carried out by crime families every day, for cash on the barrelhead, in the harsh world of the streets. The finger-hackers dominated certain payphones in certain strikingly unsavory neighborhoods. They provided a service no one else would give to a clientele with little to lose. With such a vast supply of electronic crime at hand, Don Delaney rocketed from a background in homicide to teaching telecom crime at FLETC in less than three years. Few can rival Delaney's hands-on, street-level experience in phone fraud. Anyone in 1993 who still believes telecommunications crime to be something rare and arcane should have a few words with Mr Delaney. Don Delaney has also written two fine essays, on telecom fraud and computer crime, in Joseph Grau's *Criminal and Civil Investigations Handbook* (McGraw Hill 1993). *Phrack* was still publishing in 1993, now under the able editorship of Erik Bloodaxe. Bloodaxe made a determined attempt to get law enforcement and corporate security to pay real money for their electronic copies of *Phrack,* but, as usual, these stalwart defenders of intellectual property preferred to pirate the magazine. Bloodaxe has still not gotten back any of his property from the seizure raids of March 1, 1990. Neither has the Mentor, who is still the managing editor of Steve Jackson Games. Nor has Robert Izenberg, who has suspended his court struggle to get his machinery back. Mr Izenberg has calculated that his $20,000 of equipment seized in 1990 is, in 1993, worth $4,000 at most. The missing software, also gone out his door, was long ago replaced. He might, he says, sue for the sake of principle, but he feels that the people who seized his machinery have already been discredited, and won't be doing any more seizures. And even if his machinery were returned -- and in good repair, which is doubtful -- it will be essentially worthless by 1995. Robert Izenberg no longer works for IBM, but has a job programming for a major telecommunications company in Austin. Steve Jackson won his case against the Secret Service on March 12, 1993, just over three years after the federal raid on his enterprise. Thanks to the delaying tactics available through the legal doctrine of "qualified immunity," Jackson was tactically forced to drop his suit against the individuals William Cook, Tim Foley, Barbara Golden and Henry Kluepfel. (Cook, Foley, Golden and Kluepfel did, however, testify during the trial.) The Secret Service fought vigorously in the case, battling Jackson's lawyers right down the line, on the (mostly previously untried) legal turf of the Electronic Communications Privacy Act and the Privacy Protection Act of 1980. The Secret Service denied they were legally or morally responsible for seizing the work of a publisher. They claimed that (1) Jackson's gaming "books" weren't real books anyhow, and (2) the Secret Service didn't realize SJG Inc was a "publisher" when they raided his offices, and (3) the books only vanished by accident because they merely happened to be inside the computers the agents were appropriating. The Secret Service also denied any wrongdoing in reading and erasing all the supposedly "private" e-mail inside Jackson's seized board, Illuminati. The USSS attorneys claimed the seizure did not violate the Electronic Communications Privacy Act, because they weren't actually "intercepting" electronic mail that was moving on a wire, but only electronic mail that was quietly sitting on a disk inside Jackson's computer. They also claimed that USSS agents hadn't read any of the private mail on Illuminati; and anyway, even supposing that they had, they were allowed to do that by the subpoena. The Jackson case became even more peculiar when the Secret Service attorneys went so far as to allege that the federal raid against the gaming company had actually *improved Jackson's business* thanks to the ensuing nationwide publicity. It was a long and rather involved trial. The judge seemed most perturbed, not by the arcane matters of electronic law, but by the fact that the Secret Service could have avoided almost all the consequent trouble simply by giving Jackson his computers back in short order. The Secret Service easily could have looked at everything in Jackson's computers, recorded everything, and given the machinery back, and there would have been no major scandal or federal court suit. On the contrary, everybody simply would have had a good laugh. Unfortunately, it appeared that this idea had never entered the heads of the Chicago-based investigators. They seemed to have concluded unilaterally, and without due course of law, that the world would be better off if Steve Jackson didn't have computers. Golden and Foley claimed that they had both never even heard of the Privacy Protection Act. Cook had heard of the Act, but he'd decided on his own that the Privacy Protection Act had nothing to do with Steve Jackson. The Jackson case was also a very politicized trial, both sides deliberately angling for a long-term legal precedent that would stake-out big claims for their interests in cyberspace. Jackson and his EFF advisors tried hard to establish that the least e-mail remark of the lonely electronic pamphleteer deserves the same somber civil-rights protection as that afforded *The New York Times.* By stark contrast, the Secret Service's attorneys argued boldly that the contents of an electronic bulletin board have no more expectation of privacy than a heap of postcards. In the final analysis, very little was firmly nailed down. Formally, the legal rulings in the Jackson case apply only in the federal Western District of Texas. It was, however, established that these were real civil- liberties issues that powerful people were prepared to go to the courthouse over; the seizure of bulletin board systems, though it still goes on, can be a perilous act for the seizer. The Secret Service owes Steve Jackson $50,000 in damages, and a thousand dollars each to three of Jackson's angry and offended board users. And Steve Jackson, rather than owning the single-line bulletin board system "Illuminati" seized in 1990, now rejoices in possession of a huge privately-owned Internet node, "io.com," with dozens of phone-lines on its own T-1 trunk. Jackson has made the entire blow-by-blow narrative of his case available electronically, for interested parties. And yet, the Jackson case may still not be over; a Secret Service appeal seems likely and the EFF is also gravely dissatisfied with the ruling on electronic interception. The WELL, home of the American electronic civil libertarian movement, added two thousand more users and dropped its aging Sequent computer in favor of a snappy new Sun Sparcstation. Search-and-seizure dicussions on the WELL are now taking a decided back-seat to the current hot topic in digital civil liberties, unbreakable public-key encryption for private citizens. The Electronic Frontier Foundation left its modest home in Boston to move inside the Washington Beltway of the Clinton Administration. Its new executive director, ECPA pioneer and longtime ACLU activist Jerry Berman, gained a reputation of a man adept as dining with tigers, as the EFF devoted its attention to networking at the highest levels of the computer and telecommunications industry. EFF's pro- encryption lobby and anti-wiretapping initiative were especially impressive, successfully assembling a herd of highly variegated industry camels under the same EFF tent, in open and powerful opposition to the electronic ambitions of the FBI and the NSA. EFF had transmuted at light-speed from an insurrection to an institution. EFF Co-Founder Mitch Kapor once again sidestepped the bureaucratic consequences of his own success, by remaining in Boston and adapting the role of EFF guru and gray eminence. John Perry Barlow, for his part, left Wyoming, quit the Republican Party, and moved to New York City, accompanied by his swarm of cellular phones. Mike Godwin left Boston for Washington as EFF's official legal adviser to the electronically afflicted. After the Neidorf trial, Dorothy Denning further proved her firm scholastic independence-of-mind by speaking up boldly on the usefulness and social value of federal wiretapping. Many civil libertarians, who regarded the practice of wiretapping with deep occult horror, were crestfallen to the point of comedy when nationally known "hacker sympathizer" Dorothy Denning sternly defended police and public interests in official eavesdropping. However, no amount of public uproar seemed to swerve the "quaint" Dr. Denning in the slightest. She not only made up her own mind, she made it up in public and then stuck to her guns. In 1993, the stalwarts of the Masters of Deception, Phiber Optik, Acid Phreak and Scorpion, finally fell afoul of the machineries of legal prosecution. Acid Phreak and Scorpion were sent to prison for six months, six months of home detention, 750 hours of community service, and, oddly, a $50 fine for conspiracy to commit computer crime. Phiber Optik, the computer intruder with perhaps the highest public profile in the entire world, took the longest to plead guilty, but, facing the possibility of ten years in jail, he finally did so. He was sentenced to a year and a day in prison. As for the Atlanta wing of the Legion of Doom, Prophet, Leftist and Urvile... Urvile now works for a software company in Atlanta. He is still on probation and still repaying his enormous fine. In fifteen months, he will once again be allowed to own a personal computer. He is still a convicted federal felon, but has not had any legal difficulties since leaving prison. He has lost contact with Prophet and Leftist. Unfortunately, so have I, though not through lack of honest effort. Knight Lightning, now 24, is a technical writer for the federal government in Washington DC. He has still not been accepted into law school, but having spent more than his share of time in the company of attorneys, he's come to think that maybe an MBA would be more to the point. He still owes his attorneys $30,000, but the sum is dwindling steadily since he is manfully working two jobs. Knight Lightning customarily wears a suit and tie and carries a valise. He has a federal security clearance. Unindicted *Phrack* co-editor Taran King is also a technical writer in Washington DC, and recently got married. Terminus did his time, got out of prison, and currently lives in Silicon Valley where he is running a full-scale Internet node, "netsys.com." He programs professionally for a company specializing in satellite links for the Internet. Carlton Fitzpatrick still teaches at the Federal Law Enforcement Training Center, but FLETC found that the issues involved in sponsoring and running a bulletin board system are rather more complex than they at first appear to be. Gail Thackeray briefly considered going into private security, but then changed tack, and joined the Maricopa County District Attorney's Office (with a salary). She is still vigorously prosecuting electronic racketeering in Phoenix, Arizona. The fourth consecutive Computers, Freedom and Privacy Conference will take place in March 1994 in Chicago. As for Bruce Sterling... well *8-). I thankfully abandoned my brief career as a true-crime journalist and wrote a new science fiction novel, *Heavy Weather,* and assembled a new collection of short stories, *Globalhead.* I also write nonfiction regularly, for the popular-science column in *The Magazine of Fantasy and Science Fiction.* I like life better on the far side of the boundary between fantasy and reality; but I've come to recognize that reality has an unfortunate way of annexing fantasy for its own purposes. That's why I'm on the Police Liaison Committee for EFF- Austin, a local electronic civil liberties group (eff- austin(a)tic.com) I don't think I will ever get over my experience of the Hacker Crackdown, and I expect to be involved in electronic civil liberties activism for the rest of my life. It wouldn't be hard to find material for another book on computer crime and civil liberties issues. I truly believe that I could write another book much like this one, every year. Cyberspace is very big. There's a lot going on out there, far more than can be adequately covered by the tiny, though growing, cadre of network-literate reporters. I do wish I could do more work on this topic, because the various people of cyberspace are an element of our society that definitely requires sustained study and attention. But there's only one of me, and I have a lot on my mind, and, like most science fiction writers, I have a lot more imagination than discipline. Having done my stint as an electronic-frontier reporter, my hat is off to those stalwart few who do it every day. I may return to this topic some day, but I have no real plans to do so. However, I didn't have any real plans to write "Hacker Crackdown," either. Things happen, nowadays. There are landslides in cyberspace. I'll just have to try and stay alert and on my feet. The electronic landscape changes with astounding speed. We are living through the fastest technological transformation in human history. I was glad to have a chance to document cyberspace during one moment in its long mutation; a kind of strobe-flash of the maelstrom. This book is already out-of- date, though, and it will be quite obsolete in another five years. It seems a pity. However, in about fifty years, I think this book might seem quite interesting. And in a hundred years, this book should seem mind-bogglingly archaic and bizarre, and will probably seem far weirder to an audience in 2092 than it ever seemed to the contemporary readership. Keeping up in cyberspace requires a great deal of sustained attention. Personally, I keep tabs with the milieu by reading the invaluable electronic magazine Computer underground Digest (tk0jut2(a)mvs.cso.niu.edu with the subject header: SUB CuD and a message that says: SUB CuD your name your.full.internet@address). I also read Jack Rickard's bracingly iconoclastic *Boardwatch Magazine* for print news of the BBS and online community. And, needless to say, I read *Wired,* the first magazine of the 1990s that actually looks and acts like it really belongs in this decade. There are other ways to learn, of course, but these three outlets will guide your efforts very well. When I myself want to publish something electronically, which I'm doing with increasing frequency, I generally put it on the gopher at Texas Internet Consulting, who are my, well, Texan Internet consultants (tic.com) This book can be found there. I think it is a worthwhile act to let this work go free. From thence, one's bread floats out onto the dark waters of cyberspace, only to return someday, tenfold. And of course, thoroughly soggy, and riddled with an entire amazing ecosystem of bizarre and gnawingly hungry cybermarine life- forms. For this author at least, that's all that really counts. Thanks for your attention *8-) Bruce Sterling bruces(a)well.sf.ca.us -- New Years' Day 1994, Austin Texas 8<----------------- cut here --------------------------------- ________________________________________________________________________ Paul Ferguson Sprint Managed Router Network Engineering tel: 703.904.2437 Herndon, Virginia USA internet: ferguson(a)icp.net

1 0

The Internet Code Ring
by Anonymous 17 Dec '03

17 Dec '03

THE INTERNET CODE RING! An Interview with Phil Zimmerman, creator of PGP We were sitting in a circle on the floor at the Computers, Freedom, and Privacy conference, March '93 in San Francisco, St. Jude and I with Tom Jennings, Fen La Balme, et al, discussing encryption and other neophiliac rants when a dapper fellow wandered by with a beard on his face and a tie hanging from his neck. He picked up Jude's copy of bOING-bOING number 10 and glanced through it, clearly interested. I later learned that this was Phil Zimmerman, creator of PGP ("Pretty Good Privacy"), so I tracked him down and we talked for the record. Jon: I'm fairly nontechnical, and I'm also new to encryption. I spent some time recently on the cypherpunks' list, and I have a pretty good sense of what's going on, but maybe you can tell me in your own words how you came to write PGP, and what your philosophy is, especially with distribution. Phil: Well, okay. PGP, which means "Pretty Good Privacy" is a public key encryption program, it uses a public key encryption algorithm, which means that you can encrypt messages and you can send them to people that you've never met, that you've never had a chance to exchange keys with over a secure channel. With regular encryption, the kind that everybody has heard about, you encrypt a message, it scrambles it up, renders it unintelligible, and then you send it to someone else, and they can descramble it, decrypting it. They have to use the same key to decrypt it as you used to encrypt it. Well, this is a problem, this is inconvenient, because how are you going to tell them what that key is, what're you going to do, tell them over the telephone? If someone can intercept the message, they can intercept the key. So this has been the central problem in cryptography for the past couple of millenia. There's been a lots of different ways of encrypting information, but they all have this problem. If you had a secure channel for exchanging keys, why do you need any cryptography at all? So, in the late 1970s, somebody came up with an idea for encrypting information with two keys. The two keys are mathematically related. You use one of the keys to encrypt the message, and use the other key to decrpyt the message. As a matter of fact, the keys have a kind of yin-yang relationship, so that either one of them can decrypt what the other one can encrypt. So everybody randomly generates a pair of these keys, the keys are mathematically related, and they can be split apart like cracking a coin in half, and the jagged edges stick together just right. They can publish one of the keys, and keep the other one secret. Now, unlike cracking the coin in half, you can't look at the jagged edge, and figure out what the other jagged edge is going to look like. In fact, you can't look at the published key and figure out what the secret key is without spending centuries of supercomputer time to do it. This means that any time anybody wants to send you a message, they can encrypt that message with your public key, and then you can decrypt the message with your secret key. If you want to send them a message, then you can encrypt the message with their public key, and then they can decrypt it with their secret key. Everybody who wants to participate in this system can generate a pair of these keys, publish one of them, and keep the other one secret. Everybody's published key can end up in a big public key directory, like a phone book, or an electronic bulletin board, or something like that. You can look up somebody's public key, encrypt a message to them, and send it to them. They're the only ones that can read it, because they're the only ones that have the corresponding secret key. J: Are there any such directories now? P: Well, actually, there are starting to be directories like that. For PGP, there are some public key directories on Internet. You can just send an electronic inquiry saying "Give me the key for [somebody]," and it'll send you their key back, their public key. J: The convention I've seen has been the inclusion of the public key in an email message posted to a mailing list. P: You can do that, you can include your own public key when you send a message to someone, so that when they send you a reply, they'll know what public key to use to send the reply. But the problem...there is an achilles heel with public key cryptography, and I'll get to that in a minute. But first, let me explain authentication. If I want to send you a message, and prove that it came from me, I can do that by encrypting it with my own secret key, and then I can send you the message, and you can decrypt it with my public key. Remember I said that the keys are in this yin-yang relationship, so that either one can decrypt what the other one encrypts. If I don't care about secrecy, if I only cared about authentication, if I only wanted to prove to you that the message came from me, I could encrypt the message with my own secret key and send it to you, and you could decrypt it with your public key. Well, anyone else could decrypt it to, because everyone has my public key. If I want to combine the features of secrecy and authentication, I can do both steps: I can encrypt the message first with my own secret key, thereby creating a signature, and then encrypt it again with your public key. I then send you the message. You reverse those steps: first you decrypt it with your own secret key, and then you decrypt that with my public key. That's a message that only you can read and only I could have sent. We have secrecy and authentication. So you get authentication by using your own secret key to decrypt a message, thereby signing the message. You can also convince third parties like a judge that the message came from me. That means that I could send you a financial instrument, a legal contract or some kind of binding agreement. The judge will believe that the message did come from me, because I am the only person with the secret key, that could have created that message. Now, public key cryptography has an achilles heel, and that achilles heel is that, suppose you want to send a message to someone, and you look up their public key, on a bulletin board, for example. You take their public key and you encrypt the message and then send it to them, and presumably only they can read it. Well, what if Ollie North broke into that BBS system? And he subsituted his own public key for the public key of your friend. And left your friend's name on it, so that it would look like it belonged to your friend. But it really wasn't your friend's public key, it was Ollie's public key that he had created just for this purpose. You send a message, you get the bulletin board to tell you your friend's public key, but it isn't your friend's public key, it's Ollie's public key. You encrypt a message with that. You send it, possibly through the same bulletin board, to your friend. Ollie intercepts it, and he can read it because he knows the secret key that goes with it. If you were particularly clever, which Ollie North isn't because we all know that he forgot to get those White House backup tapes deleted...but suppose he were clever, he would then re-encrypt the decrypted message, using the stolen key of your friend, and send it to your friend so that he wouldn't suspect that anything was amiss. This is the achilles' heel of public key cryptography, and all public key encryption packages that are worth anything invest a tremendous amount of effort in solving this one problem. Probably half the lines of code in the program are dedicated to solving this one problem. PGP solves this problem by allowing third parties, mutually trusted friends, to sign keys. That proves that they came from who they said they came from. Suppose you wanted to send me a message, and you didn't know my public key, but you know George's public key over here, because George have you his public key on a floppy disk. I publish my public key on a bulletin board, but before I do, I have George sign it, just like he signs any other message. I have him sign my public key, and I put that on a bulletin board. If you download my key, and it has George's signature on it, that constitutes a promise by George that that key really belongs to me. He says that my name and my key got together. He signs the whole shootin' match. If you get that, you can check his signature, because you have his public key to check. If you trust him not to lie, you can believe that really is my public key, and if Ollie North breaks into the bulletin board, he can't make it look like his key is my key, because he doesn't know how to forge a signature from George. This is how public key encryption solves the problem, and in particular, PGP solves it by allowing you to designate anyone as a trusted introducer. In this case, this third party is a trusted introducer, you trust him to introduce my key to you. There are public key encryption packages currently being promoted by the U.S. Government based on a standard called Privacy Enhanced Mail, or PEM. PEM's architecture has a central certification authority that signs everybody's public key. If everyone trusts the central authority to sign everyone's key, and not to lie, then everyone can trust that they key they have is a good key. The key actually belongs to the name that's attached to it. But a lot of people, especially people who are libertarian-minded, would not feel comfortable with an approach that requires them to trust a central authority. PGP allows grassroots distributed trust, where you get to choose who you trust. It more closely follows the social structures that people are used to. You tend to believe your friends. J: Did you make a conscious decision up front, before you started programming PGP, that you were going to create something that would be distributed in this grassroots way, free through the Internet. P: Well, there were some software parts of PGP that I developed some years ago, as far back as 1986, that I developed with the intention of developing commercial products with it someday. Over the years that followed, I developed a few more pieces that I hoped someday to turn into a commercial product. But, when it finally came down to it, I realized that it would be more politically effective to distribute PGP this way. Besides that, there is a patent on the RSA public key encryption algorithm that PGP is based on. I wrote all of the software from scratch. I didn't steal any software from the RSA patent holders. But patent law is different from copyright law. While I didn't steal any software from them, I did use the algorithm, the mathematical formulas that were published in academic journals, describing how to do public key cryptography. I turned those mathematical formulas into lines of computer code, and developed it independently. J: Did you originally intend to license that? P: When I first wrote the parts of it back in 1986, I did. But I began in earnest on PGP in December of 1990. At that time, I had decided that I was going to go ahead and publish it for free. I thought that it was politically a useful thing to do, considering the war on drugs and the government's attitude toward privacy. Shortly after I stared on the development, I learned of Senate Bill 266, which was the Omnibus Anticrime Bill. It had a provision tucked away in it, a sense of Congress provision, that would, if it had become real hard law, have required manufacturers of secure communications gear, and presumably cryptographic software, to put back doors in their products to allow the government to obtain the plain text contents of the traffic. I felt that it would be a good idea to try to get PGP out before this became law. As it turned out, it never did pass. It was defeated after a lot of protest from civil liberties groups and industry groups. J: But if they could get away with passing it, they would still take the initiative and try. P: Well, yeah, actually...it started out as a sense of Congress bill, which means that it wasn't binding law. But those things are usually set to deploy the political groundwork to make it possible later to make it into hard law. Within a week or so after publishing PGP, Senate Bill 266 went down in defeat, at least that provision was taken out, and that was entirely due to the efforts of others, I had nothing to do with that. PGP didn't have any impact, it turned out, at all. So that's why I published PGP. J: Several of my friends are involved in cypherpunks, and I've been on their mailing list...are you affiliated in any way with cypherpunks? Are you getting their mailing list? P: I was on their mailing list for a couple of days, but I found that the density of traffic was high enough that I couldn't get any work done, so I had them take me off the list. J: The reason I bring cypherpunks up is that they seem to have almost a religious fervor about encryption <laughs>. I was wondering if you share that. P: I don't think of my own interest in cryptography as a religious fervor. I did miss some mortgage payments while I was working on PGP. In fact, I missed five mortgage payments during the development of PGP, so I came pretty close to losing my house. So I must have enough fervor to stay with the project long enough to miss five mortgage payments <laughter>. But I don't think it's a religious fervor. J: I'm impressed with the way encryption in general and PGP in particular have caught on with the press, how it's become within the last year. P: Well, PGP 1.0 was released in June of '91. It only ran on MS DOS, and it didn't have a lot of the features necessary to do really good key certification, which is that achilles' heel that I told you about. Theoretically, you could use it in a manual mode to do that, but it wasn't automatic like it is in PGP 2.0 and above. The current release of PGP is 2.2. It's a lot smoother and more polished that 2.0 was. 2.0 was tremendously different than 1.0, and the reason the popularity has taken off so much since September, when it was released, is because it ran on a lot of UNIX platforms, beginning with 2.0. Since the main vehicle for Internet nodes is UNIX platforms, that made it more popular in the UNIX/Internet world. Since Internet seems to be the fertile soil of discourse on cryptography, the fact that PGP 2.0 began running on UNIX platforms has a lot to do with it's popularity since that version was released...Tthat was in September of '92. J: The easiest way to get PGP is through FTP from various sites? P: Yeah. Most of them European sites. PGP 2.0 and above was released in Europe. The people that were working on it were out of reach of U.S. patent law...and not only are they out of reach of patent law, but it also defuses the export control issues, because we're importing it into the U.S., instead of exporting it. Also PGP 1.0 was exported, presumably by somebody, any one of thousands of people could have done it...but it was published in the public domain. It's hard to see how something like that could be published, and thousands of people could have it, and it could not leak overseas. It's like saying that the New York Times shouldn't be exported, how can you prevent that when a million people have a copy? It's blowing in the wind, you can't embargo the wind. J: And by beginning in Europe, you sort of fanned the flame that much better. P: Yeah. J: It seems to have spread globally, and I'm sure that you're hearing a lot about it, getting a lot of response. P: Particularly at this conference (CFP93), yes. J: Do you plan to do more development of PGP, or are you satisfied with where it is.... P: PGP will be developed further. My personal involvement is more in providing design direction and making sure that the architecture stays sound. The actual coding is taking place overseas, or at least most of it is. We do get patches sent in by people in the U.S. who find bugs, and who say, "I found this bug, here's a patch to fix it." But the bulk of the work is taking place outside the U.S. borders. J: Is there a Mac version as well as a DOS version now? P: Yeah, there is a Mac version...there was a Mac version released shortly after PGP 2.0 came out. Somebody did that independently, and I only found out about it after it was released. People have written me about it, and it did seem to have some problems. The same guy who did that version is doing a much improved version, Mac PGP version 2.2, which I believe should be out in a few days...that was the last I heard before I came to the conference. The second Mac development group, that's working on a very "Mac"-ish GUI, is being managed by a guy named Blair Weiss. That takes longer, it's difficult to write a good Mac application, so it's probably going to be a couple of months before that hits the streets. J: Were you involved in the UNIX version, too? P: I did the first MS-DOS version entirely by myself, but it's not that big a distance between MS-DOS and UNIX, so most of it was the same. The UNIX board took place soon after PGP 1.0 was released. After that, many other enhancements were added, and major architectural changes took place to the code, and that's what finally made its way out as version 2.0. J: You're doing consulting now? P: That's how I make my living, by consulting. I don't make anything from PGP. J: Do you think you'll just let PGP take a life of its own, let other people work on it from here out? P: Other people are contributing their code, and other people are adding enhancements, with my design direction. Perhaps someday I'll find a way to make money from PGP, but if I do, it will be done in such a way that there will always be a free version of PGP available. J: I was thinking of the UNIX thing, where everybody's modified their versions of the UNIX Operating System so that some [customized versions] weren't even interoperable. I was wondering if there was a chance that PGP would mutate, whether you're going to keep some sort of control over it, or whether people will start doing their onw versions of it.... P: Well, I don't know, that could happen. There are so many people interested in the product now, it's hard to keep track of everybody's changes. When they send in suggested changes, we have to look at it carefully to see that the changes are good changes. J: But you don't have some sort of structure in place where you do some kind of approval if somebody wants to make some kind of mutant version of PGP.... P: There is a kind of de facto influence that I have over the product, because it's still my product, in a kind of psychological sense. In the user population, they associate my name with the product in such a way that, if I say that this product is good, that I have looked at this and that I believe the changes made sense the last version are good changes, that people will believe that. So I can determine the direction, not by some iron law, not by having people work for me that I can hire and fire, but more by my opinion guiding the product. It would not be easy for a person to make a different version of PGP that went in a different direction than how I wanted it to go, because everybody still uses the version that I approved, so to be compatible...this has a kind of intertia to it, a de facto standard. PGP currently, I believe, is the world's most popular public key encryption program, so that has potential to become a de facto standard. I don't know what that means in comparison to the PEM standard. PEM is for a different environment than PGP, perhaps, although the PGP method of certifying keys can be collapsed into a special case that mimics in many respects the PEM model for certifying keys.

1 0

POLI: Politics vs Technology
by Hal 17 Dec '03

17 Dec '03

From: Mike Ingle <MIKEINGLE(a)delphi.com> > But could the government ban a book today? Of course not, at least not > after one person typed it or scanned it into a computer. Technological > gains are permanent. The political approach is only useful as a > tactical weapon, to hold them off until technological solutions are > in place. If you want to change the world, don't protest. Write code! This position seems to be fast becoming cypherpunks dogma, but I don't agree. The notion that we can just fade into cypherspace and ignore the unpleasant political realities is unrealistic, in my view. Have people forgotten the Clipper proposal, with the possible follow-on to make non-Clipper encryption illegal? To the extent this proposal has been or will be defeated, it will happen through political maneuvering, not technology. Have people forgotten the PGP export investigation? Phil Zimmermann hasn't. He and others may be facing the prospect of ten years in prison if they were found guilty of illegal export. If anyone has any suggestions for how to escape from jail into cyberspace I'd like to hear about them. Mike's SecureDrive is a terrific program for protecting privacy. But if we want to keep keys secret from politically-motivated investigations, we have to rely on the very political and non-technological Fifth Amendment (an amendment which Mike Godwin of EFF and others contend does not actually protect disclosure of cryptographic keys). Again, we need to win political, not technological, victories in order to protect our privacy. I even question Mike's point about the government's inability to ban books. Look at the difficulty in keeping PGP available in this country even though it is legal. Not only have FTP sites been steadily closed down, even the key servers have as well. And this is legal software. Sure, this software is currently available overseas, but that is because PGP's only legal limitations are the U.S. patent issues. Imagine how much worse it would be if non-escrowed encryption were made illegal in a broad range of countries, with stringent limits on net access to countries which promote illegal software? Here again, these kinds of decisions will be made in the political realm. Fundamentally, I believe we will have the kind of society that most people want. If we want freedom and privacy, we must persuade others that these are worth having. There are no shortcuts. Withdrawing into technology is like pulling the blankets over your head. It feels good for a while, until reality catches up. The next Clipper or Digital Telephony proposal will provide a rude awakening. Hal Finney hfinney(a)shell.portal.com

1 0

Informed Consent
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

You know, this radiation experiment reminds me of another incident. A group of African-American men were injected, without their knowledge or consent, with live syphilis spirochaetes, and studied for a number of years. No attempt at therapy was ever attempted, as I recall, for these individuals. Here is a reference. <krlc> BRS Number: 000988639 Author: Jones, James H. (James Howard), 1943- Title: Bad blood : the Tuskegee syphilis experiment / James H. Jones. Impr/Ed: New York : Free Press ; Toronto : Maxwell Macmillan Canada ; New York : Maxwell McMillan International, c1993. New and expanded ed. Phys Desc: xv, 297 p. : ill. ; 24 cm. Subjects: Afro-American men -- Diseases -- Alabama -- Macon County -- History. AIDS (Disease) -- United States. Human experimentation in medicine -- Alabama -- Macon County -- History. Syphilis -- Alabama -- Macon County -- History. Syphilis -- Research -- Alabama -- Macon County -- History. Tuskegee Syphilis Study. Other Author: Tuskegee Institute. Notes: Includes bibliographical references and indexes. Language: eng ISBN: 0029166764 (pbk.) LCCN: 92034818

1 0

Re: Anonymous Video on Demand
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> It just occured to me that when this protocol is implemented with > RSA, it is subject to a minor (and unlikely) failure that can > allow Alice to determine which video Bob has selected (or at > least eliminate some of them). If each video keypair has a > different modulus and the one Bob selects has a larger modulus > than some of the "dummy" videos, then if the encryption of Bob's > session key with his selected video public key results in a > message that is close to the modulus itself, the keypairs with > moduli that are smaller than Bob's message can be trivially > eliminated as candidates. This protocol also assumes that all of the movies (or pieces of information) cost the same amount. Presumably in the video-on-demand business, a most movies would have the same cost or there would be a few 'levels' of costs with many movies in each 'level.' In that case you would only pick random 'padding' videos that have the same price. However, a video store could easily give all of the horror movies one price, all of the comedy ones another, all the pornos another, etc.... and at least be able to determine the general type of video the customer is purchasing. In a general information market type setup, I would expect that the value of different pieces of information would vary greatly. How would payment of the information be made? In a general information market setup, where the bits of information have varrying values you could do something like the following. in the oblivious transfer protocol, if the hardware used is implemented in tamper-proof chips, the price of each piece of information could be encoded with the information. The chip would store a running total of the prices of information successfully decrypted by the customer. At the end of the month, the box would send the total price to the vendor, which will bill the customer. Depending on the number of pieces of information purchased, the vendor would be able to infer more or less information on the types of info bought by the customer... Also, you could randomly purchase very cheap (or free and worthless) bits of information to make it more difficult for the vendor to figure out what you are interested in... andrew

1 0

Re: Anonymous video on demand
by Hal 17 Dec '03

17 Dec '03

Of course, with tamper-proof chips this problem can be solved easily. You don't need oblivious transfer. Rather, you get digital tokens from the video provider which you pass on to the tamper-proof decryption chip, where each token is worth a certain amount of decryption. Then you choose which movies you want to decrypt. The only question would be whether the tamper-proof chip would keep a record of your viewing habits. But you should be able to monitor anything it transmits (if it has to transmit anything) and it should not have to send any encrypted messages. So your secrets should be safe. One problem with this approach (and the other ones we have discussed) is that the vendor loses any information about which movies are most watched, which hurts his ability to set prices and choose which movies to carry. Perhaps he could resort to a separate anonymous public-opinion poll to determine this info (protected with is-a-person (is-a-customer?) credentials so that our friend Detweiler can't pseudo-spoof with his multiple tentacles ;-). Or, perhaps another approach is to have a different decryption key for each movie, and to simply sell those keys to anonymous buyers. They would then load them into their decryption boxes. This does seem vulnerable to pirating the keys, though. Piracy could be avoided if the decryption keys were stamped with the serial number of the particular tamper-proof decryption box they were for (so that they would only work with that one box). But then you lose the anonymity. I'm thinking that some form of blinding could be used to produce a key which would only be accepted by one box, but for which the movie seller would not be able to determine which box it was for. This is very similar to the requirement for electronic cash, and I think a similar idea would work. This solution also is a nice example of the uses of anonymous networks. I wonder whether the NII could support DC-nets? :) Hal

1 0

Washington Post Op/Ed on Bobby Ray
by Anonymous 17 Dec '03

17 Dec '03

extracted from: The Washington Post Sunday, 2 January 1994 pages C1, C2 Outlook; Commentary and Opinion The Pentagon's Secret Garden With Inman's Arrival, Will The 'Black Budget' Grow? by Bill Sweetman Bobby Ray Inman, defense secretary-designate, is not merely the first career military man to hold that position. He is also a lifetime intelligence professional, with a background in cryptography -- which, apart from the operation of covert agents in hostile territory, is the most jealously guarded of all intelligence activities. When Inman ran the National Security Agency, it was a felony to disclose that the multibillion-dollar agency existed. Inman will not find himself lonely in this latest of the several administrations in which he has served. Indeed, the rapid tapping of Inman to replace Les Aspin follows other signs that the Clinton administration shares the previous regime's enthusiasm for secret weapons and covert operations. Since the Berlin Wall came down, the Pentagon has lifted the curtain an inch on a couple of secret projects (a Stealth ship and a tactical missile) but dozens remain hidden -- including, probably, the 4,000-mph spy plane called Aurora and other exotic aircraft. Inman's rise parallels the growth of the secret military, the so-called "black world" that exists within the Pentagon and the defense industry. Although estimates vary, it is likely that more than $15 billion of the Pentagon's annual research, development and production budget is spent on secret projects: about 16 percent of the total and much more than most countries spend to equip their entire armed forces. Secrecy costs billions. The fortified buildings, guards and the vetting bureaucracy are only the start. Newly hired people spend weeks doing nothing, waiting for their clearances. The cost of shuttling workers from Las Vegas and California into remote sites is enormous. Documents and data must be tracked with maniacal care from the printer to the shredder. Ben Rich, former chief of the Lockheed Skunk Works, reckons that the toughest "special access" security rules add 10 to 15 percent to the cost of a project, implying that the Pentagon spends $1.5 billion or more per year on enforcing those rules. The Soviet Union has come apart. Iraq was defeated using (apparently) unclassified technology. If the black world has invented anything newer and more exotic -- which it certainly should have done, with all that money -- America's future adversaries will probably not be able to do much about it even if they know it exists. When the Senate holds hearings on the Inman nominations later this month, it will no doubt wish to consider more than the defense secretary-designate's tax liabilities, "comfort level" with the president or even his prior record in the service of his country. One question in particular that should be asked of Inman is, quite simply: From whom, exactly, is the black world still keeping secrets? Whether we will get an answer is uncertain. Inman is, as a former intelligence officer notes, "steeped in the cult of intelligence." He was the first intelligence professional to be appointed special assistant to the chief of naval operations. He is one of only two Navy intelligence men to be made full admirals. He has been head or deputy chief of four intelligence agencies: NSA, CIA, the Defense Intelligence Agency and the Office of Naval Intelligence. In the early Reagan years, Inman's differences with his boss at the CIA, Bill Casey, have been attributed to Casey's covert operations. The codebreaker Inman, by contrast, leans toward "technical means" of intelligence-gathering: satellites and massive computer data banks. Inman's links to James Guerin, the now-jailed arms wheeler-dealer, and to Guerin's failed International Signal & Control (ISC) conglomerate, provide interesting fodder for Aurora observers. Inman went from the CIA to ISC as a member of an independent proxy board responsible for ensuring that no military secrets passed from ISC's U.S. subsidiaries to its non-U.S. headquarters. In 1992, Inman wrote a letter to the sentencing judge attesting to Guerin's "patriotism," and other ISC defendants have claimed that the company's actions were influenced by the CIA. Although ISC is usually described as a maker of cluster bombs, one of its major subsidiaries was the Marquardt Company. Now owned by Kaiser, Marquardt is the most experienced U.S. developer and producer of ramjets -- engines exclusively used for hypersonic aircraft and missiles. Inman, of course, got his first high-level job, the NSA directorship, from Jimmy Carter. It was Carter, not Reagan, who started the black world's expansion; and when Inman arrives at the Pentagon he will find, in the next-door office, William J. Perry, the Carter appointee who was most closely associated with the black world's growth. In 1976, before Perry was undersecretary of defense for research and engineering, the Stealth project was not even classified. Perry, who earned the title of "the godfather of Stealth," was instrumental in the decision to fast-track Stealth into service, over the doubts of many service chiefs -- and to bury in the Pentagon basement. The new administration promptly removed the project from the civilian-headed Defense Advanced Research Projects Agency and gave it to the Air Force, which concealed its existence. By 1978, Lockheed had a contract for an operational stealth fighter, the F-117, and the Air Force was writing requirements for a Stealth strategic bomber, to become the B-2. Although fighter and bomber projects had never been secret in peacetime, Carter's Pentagon hid both of them. After Reagan's inauguration in 1981, Perry was the only senior Carter appointee to remain at the Pentagon, serving for several months as an advisor to incoming Defense Secretary Caspar Weinberger and helping to get the B-2 project rolling. Perry, who returned to the Pentagon in January 1993 as Clinton's deputy defense secretary, should have a comfortable relationship with Inman, for Perry has long-standing connections to the secret world. In 1964, Perry helped found ESL Inc. (now part of TRW), to develop and produce the electronic eavesdropping equipment that provided Inman and his codebreaking colleagues with their raw material. Perry was ESL's president until he went to Washington in 1977. Perry and Inman are not the only Clinton appointees with black-world credentials. Air Force Secretary Sheila E. Widnall was, for six years, a trustee of the Aerospace Corp., a unique half-billion-dollar-per-year nonprofit organization that provides management and technical support to the Air Force space program -- well over half of which involves black reconnaissance projects that support the CIA and NSA. Secrecy is sometimes necessary, in military affairs, to protect lives in combat. In the intelligence world, lives are often at stake, even in peacetime. But the intelligence community still tags as "secret" information that has already been revealed or can be inferred from observations and from physics (such as the orbits and basic capabilities of spy satellites). The professionals argue that any doubt in an adversary's mind about what you know helps them do their jobs -- which is why the details of "technical means" are so carefully protected. But why they do not consider, and should be made to consider, is the damage that secrecy does to the credibility of the military and hence to its effectiveness in an open society. One example concerns 3,900 acres of public land in the Nevada desert that the Pentagon wants to close under armed guard. The land is adjacent to the Switzerland-seized tract that the Air Force uses for training and where the Department of Energy tests nuclear weapons. A letter from Air Force Secretary Widnall to Interior Secretary Bruce Babbitt says that the land is needed "for the safe and secure operation of the activities on the Nellis range." Widnall's explanation is vague to the point of deceptiveness. The land grab has nothing to do with safety, and everything to do with preventing ordinary U.S. citizens -- who can now easily take a hike to a vantage point on the adjacent public land -- from seeing an Air Force flight-test base known as Groom Lake. But Widnall can't tell Babbitt that, because, officially, Groom Lake does not exist -- never mind that a Russian satellite photo of the base is reproduced in the instructions for the Testor Corp.'s newest Aurora hobby-kit model. No material cleared by the Air Force, even if it concerns events of almost 30 years ago, can mention the base as anything other than "a remote facility." The seizure confirms that Groom Lake is not a monument to the Cold War, but an active flight-test center. It also confirms that the Soviet Union -- as the only nation that posed a direct threat to the United States -- never was the only target of the ultra-tight security that surrounds the Pentagon's gigantic secret or "black" budget. In the Pentagon, however, secrecy is often equated with efficiency. A high-ranking defense executive, an engineer who has worked with the CIA and on Stealth projects, observes that "Bill Perry is in favor of skunk-works projects, created and developed by small teams." Given the Pentagon's own massive bureaucracy, the maze of procurement rules and Congress's insatiable appetite for oversight, secrecy may be the only way for this to work, as it was when Lockheed's Skunk Works created the U-2, SR-71 Blackbird and F-117. Some projects are also concealed for their own protection, the same executive explains: "When you have really radical solutions, the inertia of the establishment is so great that spend all their energy fighting to stay alive." The tank and the submarine, for example, are classic examples of breakthrough ideas that faced strong opposition. The executive compares the black world to Australia -- a place where unique creations can evolve to their full potential without being gobbled up by an established predator. The 535-member board of directors on Capitol Hill does not always help. Some people in Congress try hard to come to grips with the issues. Some find that a new weapon's military utility correlates to the number of jobs it brings to their district. Others are know-nothings who regard military leaders as incompetent, but who would have a hard time explaining how an airplane stays up, let alone how it could be made invisible to radar. Given the erratic behavior of the Washington machine, it is hardly surprising that the professionals sometimes feel justified in stringing razor wire across the kitchen door, the better to keep a hundred amateur cooks away from the soup kettle. Inman's appointment could be good or bad news for those pressing for fewer secrets in the post-Soviet world. Like many intelligence professionals, Inman may believe that unlocking the vaults would be a mistake; his "comfort level" discussions with Clinton may have included an understanding that the White House would respect that view. On the other hand, Inman may have decided that the demise of the Soviet Union does permit more openness, or that it requires radical change to the intelligence structure. In that case, Inman -- as a military man and intelligence professional -- is in a much better position to lead the spooks and soldiers through such changes than Aspin would have been. Inman's confirmation hearings are our only chance to find out which way he plans to go. The opportunity should not be missed.

1 0

Best Death Threat Yet II
by L. Detweiler 17 Dec '03

17 Dec '03

Here is another interesting death threat. You might have noticed that the previous one I posted had the header line from anon.penet.fi, `x-anonymously-to: an12070'. It would appear on the surface that I posted something that came from anon.penet.fi, was sent to ld231782(a)longs.lance.colostate.edu, and used the an12070 alias, thereby in posting it compromising my pseudonym. There are some interesting possibilities at this point. * The message was exactly as it appears, proving I am indeed an12070. * I changed the header line so that, where before it was addressed to an[x] where [x] is my anon.penet.fi alias, it became `x-anonymously-to: an12070' I guess the question is: am I stupid? Would I deliberately do this to further the L.Detweiler == S.Boxx speculation or make such a spectacular blunder? Do you trust me not to change headers of mail I post? Do I care if people think I am an12070 or that if my identity is compromised? Am I in a mischievous mood? Did I make up the entire message to gain sympathy? Would I do something that puerile? I suppose you will have to ask an55805(a)anon.penet.fi. But what if *I* am an55805, and I sent myself that death threat? That would be very amusing, wouldn't it? an55805 might even claim that he sent me *both* letters, and that both are real. It seems to me that the only person that can resolve this is determining who an55805(a)anon.penet.fi is. But if it is not me, this person is guilty of sending one of the most grisly and overt death threats I have ever received. I doubt it would be illegal but it could get the person in hot water. an55805, why don't you post here and settle this once and for all? Who are you? Did you send me that mail? Can you prove you are not me while at the same time hiding your identity? To add some more interesting fuel to the fire, I will post another message. This one was addressed as `x-anonymously-to: ld231782(a)longs.lance.colostate.edu'. This message, of course, has nothing to do with whether I am posting through an12070. You are free to make your own decision as to what is real, and what is not. Too bad that in cyberspace, no one knows if you are a liar. BTW, I want to reiterate that I have never threatened N.Sammons, and if he claims that I have, please post the mail. I admit I was extremely upset at him and yelled at him for throwing me off the Colorado Cypherpunks list without telling me and claiming that everyone on the list asked him to without any evidence, and telling others that he did tell me, but I am over it. Even though you haven't apologized, I forgive you Nate. ===cut=here===

1 0

cyberanarchy RULEZ!!!
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

When my son appeared home from work last Tuesday evening just as the 10 p.m. news was beginning, I was pleasantly surprised to see him. Earlier in the day he told me he'd be home around 11 since he was scheduled to be one of the `closers' at Chuck E. Cheese that evening. I hated it when he was scheduled to close on school nights, and I told him so that afternoon. But since his fellow employees and manager had been so kind to him during a recent illness, and since he hadn't been able to earn much Christmas money, I didn't say much more. So when he came in and said, ``Hey, someone else wanted to close tonight, so I didn't have to stay,'' I knew I could lock up and go to bed a little earlier than I'd planned. Then the news bulletin came on: ``There has been a shooting at Chuck E. Cheese pizza parlor in Aurora.'' I yelled and my son came out of the bathroom with his toothbrush still in his mouth. He sat on the edge of the rocking chair watching and waiting for more information. Then he said, pointing his finger at me and shaking, ``I bet I know who it was...'' I questioned him about what he had seen and dialed the police department. The police spoke with him and said they'd send out a detective. Then my son told me about the people who were still at the restaurant when he left. Bobby -- the nicest guy in the world, he said. Sylvia -- a lot of fun. Ben, oh yeah, he was in the game room. Colleen -- she was working the show room. And Marge -- did you know she liked weird pizza -- like spinach and stuff? He spoke about each one as we waited for more information. In the meantime, we heard helicopters and sirens waited for more word. The early reports were sketchy ... Several people had been shot ... Some were still in the restaurant, some were being wheeled out on stretchers .... More on the morning news, they said. We looked at each other in disbelief. I knew that my son had missed being one of the victims by minutes, maybe just a couple of minutes. No one in our family slept well that night. At about 4:30 a.m., I got up. I had been having nightmares anyway, and I wanted to make sure that whatever the news was, I knew it before my son did. I'll help him through it, I thought. He was sleeping on the floor in his brother's room. He didn't want to be alone. As I looked at the front page of the newspaper, I felt some relief that at least some of the people had survived. But then I turned on the early news and learned that all the victims had been shot in the head and that two were dead: Marge and Colleen. I held my sides and wept. My son heard me and came out to watch the news. He urged on those still living: ``Come on, Sylv, come on ...'' I prayed hardest for Bobby. He had offered to close for my son. I didn't know if I could handle it, or how my son would feel, if he didn't make it. But as that day wore on -- that horrible day -- two more would die. There but for the grace of God, I thought. I kept picturing my son's face as he talked to the TV reporters. My child is in shock, I thought. And here I am at work, trying to act as though my world has not been blown apart as well. After a few short hours, I decided I should go home -- I wanted to be there when he came home. I wanted to hold him and tell him I love him. After my son arrived home, the phone rang and rang. People from all over the country were calling to make sure that he was OK. He told his story over and over again. He needs help, I can see, but I don't know how to give it to him. It's so hard to imagine the pain felt by the families of Colleen, Sylvia, Ben, and Marge. I've thought often about how horrible that night was for them and about how hard it will be in the future. It's hard for me to even imagine the depth of my own son's pain. No one taught me how to help my child through a mass murder. I can't explain to him why the police say they are going to call and then don't. I don't know why the alleged murderer was allowed to threaten people for months without anyone challenging him. I'm not sure that it would happen again tonight. Most of all, I'm scared to admit that most people won't attach any responsibility for the situation to anyone but the killer. No parent, no school official, no juvenile or adult law enforcement agency, no former employer recognized and took responsibility for the potential danger of this situation. Maybe that is today's truth. We have become very adept at avoiding responsibility for much of anything. I'm angry at s many people -- and I'm angry with myself. Our young people need our help. They are living through these horrors because we are allowing them too, mostly because we are just too busy to care. They did not, in their short lives, create this violent, irresponsible society. We pretend not to see that we sell them the means of their destruction. I realize that my nerves are raw right now. I just hope that as the days and months go by that we do something meaningful to show our kids that we really mean to help them end the violence that threatens their generation. I am sorry, too, son. I haven't done enough so far. But that doesn't mean that I can't do more now. Please help me. We all need to speak up when we see something going very wrong. If we are going to effect an real change, I'll need your energy and commitment to push me. And I will take responsibility for my part. It isn't too late, son. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

INFORMED CONSENT
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Nobody wrote: You know, this radiation experiment reminds me of another incident. A group of African-American men were injected, without their knowledge or consent, with live syphilis spirochaetes, and studied for a number of years. No attempt at therapy was ever attempted, as I recall, for these individuals. . . . Actually, this is wrong on two counts. One, the men were not injected with syphilis; they had already contracted it when they went into the program. Two, in most cases, they *were* given therapy. What was withheld was penicillin. The subjects who were treated, were given relatively ineffective and dangerous mercury therapies. Not as bad as Nobody said, but more than bad enough. As an aside, I was watching a documentary on this sad chapter of American history and they interview the guy who blew the whistle on the study. He was a San Franciscan I have known for several years. In all that time, I thought he was just another Second Amendment, gun nut, fellow traveller. You know, you never know. S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Current Operational Status
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

We (operation Cyberanarchist Repression and Poison) thought you might like an update of our current status and future plans. We have been extremely busy! So much has happened lately! Remember when we said, > You have 24 hours before we >launch our next cyberspatial strike. That was a reference to Operation Tick-Tick-Tick. We were really delighted with the outcome of this attack, we made very significant gains in our campaign, and there were some stellar fireworks. The sequence of Usenet posts equating cyberanarchists with drug users and Sodomites found great response. The Cyberanarchist glossary was unchallenged! We nailed the szabo(a)netcom.com tentacle mercilessly, and he is afraid to show his sickly green face any more. The Pit Bull (His Royal Eminence) showed up to make a fatal mistake in exposing the Szabo tentacle, and we nailed him some too (his brilliant smear tactics give us more ideas ourselves!). As usual, Emminent Eric has been rather quiet. We did spoof him spectacularly with that Apology feint. `I never wanted a brainwashed follower.' `Democracy stinks.' `I am the anti Christ.' Ha, ha. Tantalizing Timmy showed up a bit `out there' to further whine, evade, and threaten, and tell us that he doesn't know anything about drugs! He says he has a gun, and isn't afraid to use it! Fantastic! `The rumors about high level conspiracies and drug use are false' he says. Ooops, have you talked to Ingenuous John? (hee, hee). You guys really have to work on getting your stories straight. It's pretty pathetic. As for the BS, we don't know who it is you saw at your last Cypherpunk party and their California IDs. Must have been some cardboard cutouts! Oh, what fun. This is all in addition to the shrapnel wounds on the public lists (we have no comment on the private ones!). We appreciate your feedback in all areas. What did you think of the delightful poetry? How about the Nazi Espionage story? That brought tears to our eyes when we thought how much your own Big Macs have surpassed the Fuhrer in their own present glories and future ambitions. Perhaps the people `out there' on Usenet will be similarly impressed ... ? === Nevertheless, the Big Macs don't seem to understand that we have long since lost interest in the tentacle exorcisms, although we like to continue to play to keep our practice. We have graduated to the Big Leagues and they are still scratching their crotches in the minors. Full fledged exposure! The Cypherpunk Credit union for money laundering! the black markeeting! the tax evasion! The lies in the media! The secret mailing lists! Thank you so much for finally coming clean (or at least opening a few windows to diminish the stench) in some key areas. Our next projects should help encourage you to continue this wonderful Glasnost, where before we had the KGB. Once again, we remind you that you can relent and surrender at any time. Some of the things we are interested in at the moment: 1. Further information on the media deceptions in Wired and NYT. These are very difficult to unravel. 2. A complete status report of the TX bank and CA credit union. Maybe some more info on the `real' Chaum link. 3. A complete comment by the Big Macs on their knowledge and involvement in pseudospoofing and all the `quasi-legal' activities. 4. A complete list of all the secret mailing lists. Your subscribers to this list would probably be interested in this too, why not post it publicly? After all, they don't know that all the *real* development is being done under the table. Kind of ironic, too, how long people were asking for a `list split', not knowing that it had already been done in secret. Ah, a pity, but that is your modus operandi. But, since in the true spirit of warfare we must be prepared for any eventuality, including the continued persistence and tenacity of the enemy. So you know, here are some of the operations we are planning over the coming weeks and months, listed in scale of seriousness and potency. Operation SQUISH - a very sophisticated and comprehensive simultaneous attack on many fronts that will involve a `grass roots' approach vs. the last `top down' attack in the newsgroups. Medusa keeps asking for our complete knowledge. This will lay it all out on the table for everyone to examine -- a complete list of tentacles, Small Fries, Big Macs, Poison Needles, Medusa Sisters, and Medusa. It will also be a bit disorienting for you in the spirit of our favorite tactics of `polymorphic paragraphs'. You really seem to get a buzz from that. If you think that the last Usenet strike was bad, wait 'til you see what happens with this one! Operation Octopus - this is the multiple pseudonym and agent project. We plan to have at least a dozen (hence the name) posting simultaneously to many different lists and the newsgroups. But the overhead on this is very significant, and it will take us awhile to gear up and build the infrastructure to the point we can `engage'. You have seen more of these agents lately `out there', but our coordinated attack will take some more planning. Hopefully, these operations will crack the nut. It is already wobbling, splintering, chipping, and shaking. But this is a tough nut to crack. The following operations are far more insidious and devastating. We have been hinting about them in various places. They are our `secret weapons' -- the will require some further developments, but will be immensely effective in destabilizing your technology and `movement'. Operation Duplicity - extremely top secret. Let's just say, you will be seeing double, and triple, and quadruple, and ... Operation Apocalypse - extremely top secret. Let's just say, Robert Morris and Richard Depew would be proud ... Of course, in the meantime your list will be subject to the same drizzle of froth that has you so excited lately. And we'll probably recycle some of our better artillery to strategic positions `out there' on Usenet some more. We wish to thank T.C.May personally for all the stellar ideas in Reputation Assault and Cyberspatial Sabotage. What's good for the criminal is good for the police, so to speak! Finally, just to let you know, we are going to take a momentary breather here and scale back all the current operations somewhat to reorganize and retrench before the next onslaught, so enjoy the respite. Happy New Year! p.s. you might want to see this below. This software and attack report was part of our last strike, Operation Tick-Tick-Tick. The software for the new operations is far more complex (you know how difficult it is e.g. to track multiple identities well), partly the reason for the delay. === #!/bin/csh -f sleep 518400 echo insider echo `date` nick "Cryptoanarchist Assassination Squad" send ./insider& sleep 86400 #1 day echo glossary echo `date` nick "T.C.Hughes" send ./gloss1& send ./gloss2& sleep 86400 echo szabo echo `date` nick "GCHQ" send ./szabo& sleep 86400 echo druggies echo `date` nick "Pablo Escobar" send ./druggies& sleep 86400 echo homo echo `date` nick "A.Pervert" send ./homo& sleep 86400 echo tcmay echo `date` nick "The Allied Forces" send ./tcmay& sleep 86400 echo conspiracy echo `date` nick "S.Boxx" send ./conspiracy& === insider Mon Dec 13 15:58:36 UTC 1993 [1] 8930 [1] + Done send ./insider glossary Tue Dec 14 15:58:57 UTC 1993 [1] 10919 [2] 10920 [2] + Done send ./gloss2 [1] + Done send ./gloss1 szabo Wed Dec 15 15:59:26 UTC 1993 [1] 13139 [1] + Done send ./szabo druggies Thu Dec 16 15:59:52 UTC 1993 [1] 15347 [1] + Done send ./druggies homo Fri Dec 17 16:00:31 UTC 1993 [1] 17894 [1] + Done send ./homo tcmay Sat Dec 18 16:03:15 UTC 1993 [1] 20016 [1] + Done send ./tcmay conspiracy Sun Dec 19 16:03:52 UTC 1993 [1] 21253 ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Technology vs. Politics
by Mike Ingle 17 Dec '03

17 Dec '03

>>But could the government ban a book today? Of course not, at least not >>after one person typed it or scanned it into a computer. Technological >>gains are permanent. The political approach is only useful as a >>tactical weapon, to hold them off until technological solutions are >>in place. If you want to change the world, don't protest. Write code! >This position seems to be fast becoming cypherpunks dogma, but I don't >agree. The notion that we can just fade into cypherspace and ignore >the unpleasant political realities is unrealistic, in my view. >Have people forgotten the Clipper proposal, with the possible follow-on to >make non-Clipper encryption illegal? To the extent this proposal has been >or will be defeated, it will happen through political maneuvering, not >technology. Yes, when something fascistic like Digital Telephony or Clipper comes along, we have to fight it. But if we win, it will just return the next time something scares the government. There can be no permanent victory through politics. The only way to win permanently is to hold them off through politics and public opinion long enough so that everyone has encryption and is using it. If it's widespread enough, it will be impossible both technically and politically to stop it. Stalin refused to build a phone system in the Soviet Union, because he considered it subversive. Could the government take away all our phones today? >Have people forgotten the PGP export investigation? Phil Zimmermann >hasn't. He and others may be facing the prospect of ten years in prison >if they were found guilty of illegal export. If anyone has any >suggestions for how to escape from jail into cyberspace I'd like to hear >about them. Yes, we have to mobilize around the Zimmermann case, and if he actually goes to trial, I'm going to send in my contribution and try to get others to do so. Perhaps the next version of Secure Drive should have a request of the form: if you like this product, please send a contribution to the Phil Zimmermann Defense Fund. They may be able to single out individuals who have put themselves on the spot, but they can't stop the technology. >Mike's SecureDrive is a terrific program for protecting privacy. But >if we want to keep keys secret from politically-motivated investigations, >we have to rely on the very political and non-technological Fifth Amendment >(an amendment which Mike Godwin of EFF and others contend does not actually >protect disclosure of cryptographic keys). Again, we need to win >political, not technological, victories in order to protect our privacy. And the next time there's a Red scare, or a Yellow scare, or any kind of scare, they will say "national security" or "public safety" and start putting people in camps, like the Japanese. Political victories are temporary. Whatever the Constitution says, the fact is it has been blatantly ignored every time the government imagined a threat, starting with the Sedition Act only a few years after the Bill of Rights was passed. The Supreme Court has never stopped one of those actions until after the scare was over. >I even question Mike's point about the government's inability to ban books. >Look at the difficulty in keeping PGP available in this country even though >it is legal. Not only have FTP sites been steadily closed down, even the >key servers have as well. And this is legal software. Yet almost everyone I talk to has a copy. It's on BBSes all over the country, and hundreds of thousands of people have it. Maybe millions, worldwide. I've sent it to many people by modem and on disks. It's even on CD-ROMs. Are they going to confiscate them all? What are they going to do, shoot everyone caught with a copy? That is bad for public relations. >Sure, this software is currently available overseas, but that is because >PGP's only legal limitations are the U.S. patent issues. Imagine how much >worse it would be if non-escrowed encryption were made illegal in a broad >range of countries, with stringent limits on net access to countries which >promote illegal software? Here again, these kinds of decisions will be >made in the political realm. >Fundamentally, I believe we will have the kind of society that most people >want. If we want freedom and privacy, we must persuade others that these >are worth having. There are no shortcuts. Withdrawing into technology >is like pulling the blankets over your head. It feels good for a while, >until reality catches up. The next Clipper or Digital Telephony proposal >will provide a rude awakening. Ultimately the people have to want it. Very true. And the best way to get them to want it is to provide it. Let them see how much more freely they talk when their mail is encrypted. How they can write and store what they want, when their hard drives are encrypted. If the public experiences real privacy, they will want it, and it will be harder to take away. They will even be willing to buy it. In the long run, PGP may well be the best thing that ever happened to James Bidzos, just like the pirating of Altair Basic was the best thing that ever happened to Bill Gates. Politics, the process of politics and the political mindset, is our enemy. Governments cannot create freedom; they can either leave it alone or take it away. We must prevent them from taking it away, until it is so widespread and universal that it can't be taken away. --- Mike

1 0

Help, I am moving...
by Jim choate 17 Dec '03

17 Dec '03

Would somebody please e-mail me the addresses and proceedures that I need to follow to unscubscribe this account and move to another account now and finaly my own internet machine in about 3 weeks. I realize this has been put out before but for some reason I never thought about saving them...(duh). Thanks for the help.

1 0

Jobba the Hunt
by Romana Machado 17 Dec '03

17 Dec '03

Friends, extropians, cypherpunks: The year is new, I hope to find a new job, too. If you are involved in, or know about, forward-looking projects that would interest me, I'm looking forward to hearing from you. IUve achieved quite a few personal goals recently: I've launched and publicized Stego, the first steganography tool for the Macintosh, developed a part time job as a print model, worked on various extropian essays, traveled and vacationed. Once again, it's time to find work, so I am posting my resume. Romana Machado 19672 Stevens Creek Blvd. #127 Cupertino, CA 95014 EMail: romana(a)apple.com Phone: (408)446-9486 Objective I am looking for an intellectually challenging opportunity as a Macintosh developer, or a combined software development/quality assurance position. I am available on a contract, consulting, or project- by-project basis. I am willing to telecommute, but not to relocate. Skills Software development, quality assurance, electronic mail systems, networking, database interfaces, device interfaces, object-oriented software design, Macintosh QA tools, PowerShare, Symantec C++, Think Class Library, MPW, C, Hypercard, Turbo Pascal, DOS. Experience Macintosh Software Developer, Paradigm Shift Research, Sep '93 - Present. Developer of Stego, the first shareware steganography tool for the Macintosh. Stego 1.0 is a data security tool that embeds data in Macintosh PICT files without changing their size or appearance. Stego was developed using Symantec C++ and the Think Class Library. Source code and software are available for review on request. Macintosh Quality Assurance Lead Engineer, Apple Computer, Inc. Nov '91 - Sep '93. Member of Macintosh Technology Group in Information Systems & Technology division. Lead QA engineer for a mail server gateway bridging AppleLink and PowerShare/PowerTalk. Authored comprehensive test plans based on IEEE specs for several products. Implemented automated and manual testing, maintained regular reporting. Provided general support to development engineer: installed PowerShare networks and gateways, created icons and graphic art for products, etc. Reviewed and corrected documentation. Tested gateway functions of PowerShare messaging and mail for PowerShare QA team. Also provided quality assurance engineering and testing for several database front-end products, including DAL Terminal 1.1, Data Browser 1.1, Software Asset Librarian, and Pablo 1.3. Macintosh Quality Assurance Engineer, Intuit, Menlo Park, CA. Dec '90 - May '91. QA engineering for Macintosh Quicken 3.0. Implemented structured test plan and tested user interface, report generation. Macintosh ROM Toolbox Test Engineer, Apple Computer Inc., July '89 - March '90. Test engineering and test tool development using MacApp. Tested File Manager, Sound Manager, Device Manager. Maintained regular reports with Radar. Database Programmer, Afghan Refugee Fund, Los Altos, CA. June '87 - May '90. Extensive programming of a large mail address database for a charity, using DBase III+ compiled using Clipper. Software Developer, Strategic Decision Group, Palo Alto, CA. March '89 - July '89. Developed a printing and graphics interface for SuperTree, a financial decision analysis system. Staff Engineer, Stanford University Department of Communication. Mar '88 - Nov '88. Designed and developed LiVE, a communications research tool that constructs video sequences using a laserdisk video player driven by an IBM AT computer. Developed graphics tools for data analysis for psychophysiology research. Developed Hypercard XCMDs that provide a direct interface to the Macintosh's four-voice synthesizer. Staff Engineer, Stanford University Psychophysiology Lab, June '86 - Mar '88. Developed custom software for psychophysiology research. Created graphics tools for visual analysis of data. Wrote applications that used a variety of low-level hardware device interfaces for multichannel analog-to-digital devices. Software Engineer, Greenleaf Science Software, Palo Alto, CA. Dec '85 - June '86. Member of startup team. Assisted in the development of a Apple II GS based physiological data recording system. Extensive structured programming in Apple Pascal. Education Bachelor of Arts in English, minor in Mathematics/Computer Science, San Jose State University, 1986. MPW, C++ classes at Apple Developer University, 1990.

1 0

Subscription
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

A little while ago, my account name changed. I sent a message to cypherpunks-request asking for my subscription address to be changed. I got no response, and cypherpunks is not being delivered to my new account. (Don't know about the old one -- it's gone). So.... Does cypherpunks still exist, or did it get blown away by the TLAs while I wasn't looking? Is Eric on a protracted holiday and just not reading request mail? Did Toad go down? What gives? If anyone can set me straight, please mail me. Thanks.

1 0

Question for article
by pkalaher＠arhu.umd.edu 17 Dec '03

17 Dec '03

Hello; I read your postings in alt.wired with much interest. I am working on an article in the 'electronic frontier' vein, kind of like a cyber-gunslinger piece, and I'd love to have your input... Say someone fucks you over (real or imagined) or flames you severely. What sort of nasty things can you do to them or their data? You know, like e-mail bombings etc. I don't need particulars, since this is pointed at a mainstream audience. (It also might not get published if the technophobic editor(s) think its too risque, if you know what I mean.) I have some ideas already, but I'd like to hear from the pros. :-> Thanks in advance for your help. -pbk -- Patrick B Kalaher pkalaher(a)arhu.umd.edu When great changes occur in history, when great principles are involved, as a rule the majority are wrong. -Eugene Debs

1 0

Risk and Opportunity
by baumbach＠atmel.com 17 Dec '03

17 Dec '03

I stumbled onto a pair of programs called seejunk.exe and prune.exe this past week. It seems that files are stored on disk media in fixed units called clusters. Your file size is usually not an integral multiple of disk clusters in size, so the ends of your file is followed by random data to fill up that last cluster. Random is a bad choice of words though. I suppose each system is different, but under DOS, the extra fill data is a copy of a piece of whatever you had in memory at the time your system wrote the file. You could have information written to disk that you do not wish to have there, and seejunk.exe will show it to you ... and anyone else. prune.exe is the solution offered. Using this program, I wrote "This space intentionally left blank " repeating in the 5K of space sitting at the end of the doc file for these two programs. That was the risk and the fix available. There is also an opportunity here. Encrypted information could be stored at the end of your files. In other words this is an opportunity for steganography. You would have to be careful though; any disk operation involving that file could corrupt your encrypted data. I don't have full access to the internet. If someone finds these programs on the internet, can they post the location here. If the files aren't on the internet, I can email them to anyone that wants to post them to the cypherpunk ftp site. Peter Baumbach baumbach(a)atmel.com

2 1

Re: Question for article
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

>Hello; I read your postings in alt.wired with much interest. >I am working on an article in the 'electronic frontier' vein, kind of like >a cyber-gunslinger piece, and I'd love to have your input... Great, just the sort of publicity we need; we're out here on the frontier, alone with our reputations, and if you mess with us? We shoot you. > >Say someone fucks you over (real or imagined) or flames you severely. What >sort of nasty things can you do to them or their data? You know, like >e-mail bombings etc. I don't need particulars, since this is pointed at a >mainstream audience. (It also might not get published if the technophobic >editor(s) think its too risque, if you know what I mean.) I have some >ideas already, but I'd like to hear from the pros. :-> Bad angle, man. Some folks might get a kick out of screwing over someone else, but doing it invites the authorities to step in and put the handcuffs on all of us by restraining our access or tools (at least the legal ones). If it's only a flame and you're established - no problem, just ignore it or defend yourself once or twice and let it go. Besides, you're asking us to tell you the questionably ethical stuff we could theoretically do if we were motivated. I don't think we would be, except in an extreme case, so I would argue that the "rootin', tootin', quick-drawin' console cowboy" image you're trying to perpetuate is way off the mark. Also remember, the probable penalty for mail bombing or any data destruction is being forced off your account which means that you need to find alternative access or *be* *gone* *forever*. Access isn't as hard to come by as it used to be, but reputations are damn hard to live down. Magnetic media store bits reliably for about seven years, but our memories last much longer. -- Best regards, Curtis D. Frye cfrye(a)ciis.mitre.org "If you think I speak for MITRE, I'll tell you how much they pay me and make you feel foolish."

2 1

Here come the data fascists
by Brad Dolan 17 Dec '03

17 Dec '03

Well, here it comes guys: --------------------------------------------------------------------- LET'S MAKE SURE GOVERNMENT STEERS DATA HIGHWAY IN THE RIGHT DIRECTION San Jose Mercury News Sunday, January 2, 1994 By LAWRENCE J. MAGID (...) Do we really need Al Gore, Bill Clinton, Congress, the FCC, the FTC and countless other bureaucracies meddling in this new industry? The answer is a qualified yes. While industry will and should take the lead in developing new products and services, it is the role of government to take the long view to assure that these services are implemented in a way that is fair and fruitful. We don't need unnecessary bureaucracies, but we also don't want the educational equivalent of lead poisoning or data equivalent of gridlock. The government's role is especially crucial in a world where physical geographic borders are increasingly irrelevant. Think about the cybernetic equivalent of illegal immigration and smuggling. The Internet doesn't have border patrols to protect our intellectual property. The government must be involved, but, as the Vice President has promised, it must also leave lots of room for both entrepreneurs and the corporate giants to play their hands. (...) Lawrence J. Magid writes a telecommunications column weekly for the Mercury News and is author of ''The Little PC Book, a Gentle Introduction to Personal Computers.'' You can write to him via Mercury Center Online at LarryMagid or the Internet at magid(a)latimes.com. ---------------------------------------------------------------------------- Crypto? Why that would make it impossible for the data police to do their jobs! Anyway, only someone with something to hide would use crypto! Try to hold 'em off with this one, it worked elsewhere for a while: "When crypto is outlawed, only outlaws will have crypto". It's like listening to the raindrops at the start of a storm. Corporate America just woke up and realized we have a good thing that it doesn't control. It will soon rectify that. Pessimistically yours, bdolan(a)well.sf.ca.us

1 0

Re: Question for article
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>Say someone fucks you over (real or imagined) or flames you severely. What >sort of nasty things can you do to them or their data? You know, like >e-mail bombings etc. I don't need particulars, since this is pointed at a >mainstream audience. (It also might not get published if the technophobic >editor(s) think its too risque, if you know what I mean.) You can: - 1 - If the damage done you was real, not just an annoyance, then you might litigate. - 2 - Otherwise, or if there is reason to believe that it was without intent, then you could be a grown-up: live and learn. Purile retaliation is the demesne of bullies and children. >I have some ideas already, but I'd like to hear from the pros. :-> This sounds like people who study martial arts so they can `really kick some ass'. Serious students of many disciplines consider it for defense only. This is the case with the technology of privacy. You have seriously mistaken this list. This is not a list of `expert electronic vigalantes' who deal out home brew justice. This is a group of people with concerns about technological encroachment on personal privacy, and ensuring that the information age doesn't swallow law abiding citizens into a new world of glass houses. I am sorry to say I can easily imagine what you must have been reading to give you this impression. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

POLI: Politics vs Technol
by Duncan Frissell 17 Dec '03

17 Dec '03

H>Have people forgotten the Clipper proposal, with the possible H>follow-on to make non-Clipper encryption illegal? To the extent this H>proposal has been or will be defeated, it will happen through political H>maneuvering, not technology. If it got that far, a ban on unapproved crypto would be defeated by litigation not politicking. There is no chance that a crypto ban would be upheld by the Supremes these days. The courts have explicitly ruled that one can speak other languages (than English) if one wishes. Crypto is just another language. H>Have people forgotten the PGP export investigation? Phil Zimmermann H>hasn't. He and others may be facing the prospect of ten years in prison H>if they were found guilty of illegal export. I'd like to see some indictments first. The trial would be fun. Long sentences are unlikely in any case. H>If anyone has any suggestions for how to escape from jail into H>cyberspace I'd like to hear about them. The same way one survives and atomic bomb (for those who asked) by *not* being there when it goes off. Those indicted have two years prior to trial to leave the country. Anyone who can't figure out how to flee the jurisdiction in two years deserves prison. H>Mike's SecureDrive is a terrific program for protecting privacy. But H>if we want to keep keys secret from politically-motivated H>investigations, we have to rely on the very political and H>non-technological Fifth Amendment (an amendment which Mike Godwin of EFF H>and others contend does not actually protect disclosure of cryptographic H>keys). Again, we need to win political, not technological, victories in H>order to protect our privacy. Encryption alone will absolutely protect the 99.99% of communications that are never the subject of any government disclosure orders. Investigations take *serious* money. The government can only investigate (let alone prosecute) a very small number of individuals. Since much of their attention will necessarily be on others, the members of this list -- much less the general public -- have little to worry about. What's the big deal. Dan White emptied his revolver into the Mayor of the City of San Francisco, reloaded, and then emptied it again into the body of a member of the Board of Supervisors. For this crime, he served 5 years and 2 months. Since nothing we are doing is worse, we can't serve more than that amount of time. (I know, I know. Just kidding.) The criminal justice system is a pretty dull tool, however. The Feds have lost most of the big political cases that went to trial over the last few years. They lost all but one of the insider trading cases. They lost the BCCI case. They lost the Ollie North prosecution. They lost the Steve Jackson games case. In confrontations with the Feds, behave like the guy who was acquitted of insider trading in the Princeton Partners case -- wear a Cat hat reading "Shit Happens" to all the negotiating sessions. Remember too that in the absence of war, 99.99% of the damage "the government" does to you is actually self inflicted. Don't obey. Don't line up. Don't fill out the proper forms, properly. Don't give them your right name and address. Keep fixed in your mind the words of the first rebel, a fallen angel, who said, "Non Servatum" (I will not serve). DCF Who will request that the jury at *his* trial be required to watch Schindler's List. --- WinQwk 2.0b#1165

1 0

Clipper FOIA requests...
by a2＠ah.com 17 Dec '03

17 Dec '03

I would like to publicly thank John Gilmore for his tireless pursuit of this important issue. -a2

1 0

Clipper FOIA requests...
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

Arthur Abraham writes: > I would like to publicly thank John Gilmore for his tireless pursuit > of this important issue. Here here. Hip hip hoorah, and so on. I think it embodies the spirit in which this country was founded, a spirit that seems more and more remote nowadays. -- Mike McNally :: m5(a)tivoli.com :: Day Laborer :: Tivoli Systems :: Austin \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\_-u-t-a-o-h-r-s-c-l- -r-e- -e-t-c-e ///////////////////////////////////// j-s- -n-t-e- -i-k-y-g-e-n-t-n-a-l

1 0