December 2003 - cypherpunks-legacy

more musings
by L. Detweiler 17 Dec '03

17 Dec '03

Included: - why PGP, not Moby Crypto, is (probably) the focus - including more juicy rumors about the *overall* customs office investigation - I open my mailbag and talk about Bidzos & the ITAR again - points and questions about grand jury investigations in general * * * First, some (e.g. Steve Bellovin) have raised the point that Grady Ward just days ago announced on the newsgroups that he was looking for people to `drop ship' Moby Crypto to in apparent violation of the ITAR. Now, this does sound very incriminating and subversive, but the fact is that our legal system grinds with the utmost sluggishness, as one lately rather vocal cypherpunk (to say the least) pointed out. I think it is *highly* unlikely that these subpoenas were due directly to this *particular* statement at all. The grand jury has probably been convened weeks, or at least many days, ago. There has already probably been some deliberations just to get a basic familiarity with the case -- remember, these are regular citizens as jurors, right? surely, all this cryptography and export business sounds pretty abstruse, bizarre, and convoluted -- even to people who dwell on it daily! Furthermore, other clues I've come across suggest that the customs' office investigation or inquiry has been in progress for *many months* if not even a *year*, and that this grand jury convening and subpoena serving is simply the latest development. Not only that, but at least one other highly prominent and reputable cryptographic company *apparently* has been `visited' under the same general inquiry -- moreover, the agents were requesting information on *PGP*. And get this: there was supposedly some confusion over PGP (private software by PRZ) and the public company itself by the visiting agents! This from a *top* source: ``When they came to see us, they already had a lot of documents from the net, but I don't think they knew how to make sense of them.'' Again, *all* this supports the conjecture that *international distribution of PGP* is the primary target and Moby Crypto, G. Ward mostly secondary, or perhaps even just a bystander. We track this stuff every day, but we have to understand that to government bureacrats and the average citizen, ``any sufficiently advanced technology is indistinguishable from magic'' -- A. C. Clark -- and the details of the last few year's `cryptographic fault slips & earthquakes' are very formidable, overwhelming, and sometimes impenetrable even to experts. In fact, if the specifics of the E911 document were confusing to a jury, imagine them trying to grasp the epic tale of PGP, RSA, PKP, NSA, ITAR, ad infinitum ad nauseam... * * * I've been getting a wide variety of hot and emotional reaction lately, both public and private, directly or indirectly, by prominent heroes and lowly villains, both electronic back-pats and flames. The last, from someone I deeply respect: >what's going on? > >It feels like you're inviting a flame war not much unlike our >favorite-enemy David Sternlight. Yikes. My stomach turns. This was apparently in reaction (the sole one so far, a wretched return) to my report that Bidzos of PKP believed that software was *specifically exempt* from the `public domain' exception clauses of the ITAR, commenting on H. Finney's exceptional and thoroughly researched (but of course not exhaustively authoritative by admission) ITAR analysis posted herein. The point of my posting was: I grudgingly accede that Bidzos is an *extremely knowledgeable expert* of the *highest caliber* on the ITAR code, and others should recognize this too. His company and its army of lawyers deals with it daily. They have explored every nook and cranny. They live and die by it. (In fact, I've urged him to share the company's extremely valuable knowledge and experience in the area with EFF this week--perhaps there is something already going on, I don't know.) Hence, if software is `exempt' from `public domain' exceptions to the restrictions on cryptographic export, according to Bidzos, that's quite shocking. So far no one has responded. Is the claim groundless? Or is there something in the ITAR that supports it? Cypherpunk extraordinaire H. Finney has tracked this very closely in his posting, but did not note any such exception. (I'm still trying to track down Bidzos' posting that claimed that PGP export was illegal under the ITAR, as well as possible archives for the ITAR itself. I hope some cypherpunk hears the call.) * * * S. Steele of EFF & others have been kind enough to correct some of my misunderstandings about grand jury investigations. Since nobody else has previously volunteered any information, I will feel free to ignore rude flames criticizing me for its ``obviousness'', which for some unfathomable reason have increased tremendously lately. I'm unfazed because I find this all a great educational opportunity. First, I was grasping at straws (I knew it, but I just wanted to know what could be done). Of course there's no such thing as a `overbroad subpoena' (although some warrants are ruled that). The grand jury investigation is simply a fact-finding mission to determine whether indictments are necessary. This is a bit surprising -- In a grand jury hearing, e.g. what PRZ and G. Ward face on Wednesday, the person summoned is *not* entitled to an attorney. The hearings are broad in their scope. She notes that `information that would be excluded from evidence in a trial is perfectly proper to put before a grand jury.' I still wonder what kind of legal tactics are available at this point in investigations of this type to the subpoenaed. I would like some more information on the following: how are jurors on the grand jury selected? by the head Attorney of the State? what are his requirements and constraints in selecting them? Is there any kind of judge involved at this point? (That reminds me -- I wonder why California of all places is the site of the grand jury. What is the significance of that? it is not the location of either PGP or Grady Ward. Isn't PKP in California? just curious :) Secondly, under what situations does the State Prosecutor have the authority to convene a grand jury? can he convene them anytime there is some suspicion? here is a situation where there can be a burden on the `subjects' *prior* to even there being a court trial. Everyone has to fly to California in this case -- not quite as simple as paying a parking ticket (note: Grady Ward was subpoenaed to appear, but PRZ was not so far, only the president of ViaCrypt, Leonard Mikus, although at this point it seems *highly likely* PRZ will be subpoenaed). This is one of those situations & compromises in our judicial system wherein people have to sacrifice some rights just to exist in the system, without even being accused (I certainly acknowledge that these tradeoffs are crucial to law enforcement and a functional judicial system, but its a delicate balance). Also, I'm curious: what is known about previous Customs investigations of this type? have there ever been grand juries convened before for cryptographic inquiries? what were the circumstances and cases? is this a typical thing for the Customs Office to be doing, or is this current situation fundamentally novel? Somehow, I just can't picture the Customs Office regularly going about and investigating and hassling cryptography companies. From my point of view, the present situation appears extremely unique, to say the least.

1 0

The FBI in Peace and War
by frissell＠panix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The boys (and girls) of TRAC do it again: Date: Wed, 23 Jul 1997 10:18:35 -0400 (EDT) From: TRAC <trac(a)MailBox.Syr.Edu> To: frissell(a)panix.com Subject: New TRAC FBI Web Site Apologies if this is a repeat message. The most comprehensive portrait of how the FBI enforces America's laws is now available at a new TRAC site on the World Wide Web. For immediate release. Check it out at http://trac.syr.edu/tracfbi/ Except when the FBI is leaking selected tidbits about the big case of the day, the bureau has for many years been the most secretive of the federal enforcement agencies. To a surprising extent -- given all the headlines -- reporters know very little about the operations of the federal government's most important investigative agency. What does the FBI do, and not do? How well does it do it? Where does the FBI train its enforcement fire? Which sections of the nation have the most FBI employees? Maps, charts, graphs, tables, and brief explaining texts. Drawn from internal administrative data of the Justice Department, the FBI, and many other sources. In very brief summary, here what's available. First, FY 1992-1996 data on FBI enforcement actions -- district by district -- for each of the nation's 90 federal judicial districts. Referrals, prosecutions, convictions, median sentences, etc. Both actual numbers and appropriate rates. On a per capita basis, which districts have the most FBI convictions? How does your district compare with other similar ones and for the nation as whole? The median FBI sentence in Maryland (Baltimore) is eight times longer than Northern California (San Francisco). How does the FBI compare with the DEA, IRS, ATF and INS in terms of referrals declined because they were legally insufficient? According to the judgements of assistant U.S. Attorneys all over the country, not very well. Second, the FBI has long kept the number of employees working in different parts of the country secret. But here are 1994 FBI staffing levels in each of the bureau's 55 districts. Actual numbers and per capita rates. The FBI district with its headquarters in Salt Lake City has more employees per capita than Detroit and Boston. Third, long term enforcement and staffing trends. Key changes in what laws the FBI has enforced from 1974 to 1996. FBI (or the predecessor agency) national staffing levels from 1908 on -- big spikes during World War Two, the Korean War, the Vietnam War and President Reagan's years. Fourth. Ever wondered whether your area might have a greater potential for white collar crime than other areas. Examine that question by comparing the number of banks, executives, doctors, and other indicators in your county with all the others. Although you can't count white collar crime, you can count white collars. Again, for immediate release at http: trac.syr.edu/tracfbi/ - -- David Burnham and Sue Long ------------------------------------------------------ TRAC is a non-partisan data gathering, research and data distribution organization associated with Syracuse University. TRAC has offices in Syracuse at: Syracuse University, 488 Newhouse II, Syracuse, NY 13244-2100 (315-443- 3563) and in Washington at: Suite 301, 666 Pennsylvania Avenue, SE 20003-4319 (202-544-8722) -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBM9aVxoVO4r4sgSPhAQHgUgP+Oq++9ZSpjjO5mL3eVuqsEthC5z8xeQq8 eBK1bY65mmrFcYgF5Rh5eCb66y3OqJqWWc7X+5M/7flgwWwgrETDixTC0YTl55Jt IS4JoCJK2bHCHmOZNc3KwFTYoi/Ugjusyn91mEKAiAPRLhOrS8XDwreaHkCE0ie9 5C/X3Ml/auQ= =KFxP -----END PGP SIGNATURE-----

1 0

Did I send you this???????
by justpat＠phantom.com 17 Dec '03

17 Dec '03

THE REAL HONEST-TO-GOD PURPOSE OF THE SECOND AMENDMENT "A well-regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed" -Second Amendment to the U.S. Constitution "This declaration of rights, as I take it, is intended to secure the people against the mal- administration of government." -Eldbridge Gerry Massachusetts Delagate to the Constitutional Convention August 17, 1789 Rock on, baby. It might be difficult to convince Buford T. Public of this fact, but the Second Amendment was never intended to allow him to keep rapid fire assualt rifles in his trailer so he could shoot every crack-addicted baby-raper that dares to set foot onto the 30 square yards Buford calls his own. No matter how much good ol' Buford may consider that a public service. No, the Second Amendment is much deeper than that. During the Constitutional Convention of 1787, the Anti-Federalists (the ones who thought that the Articles of Confederation, the joke under which our government was running at the time, were just fine, thank you, and any attempt at making a strong federal government would lead to tyranny) were against a permanent army because from their experience, it was much easier for a tyrant (or a tyrannical political party) to get control of a government when it has the support of the military. A permanent army would be able to keep an unarmed population under control with relative ease. To the Anti-Federalists, an unarmed population was virtually a guarantee of tyranny. Even the Federalists, the ones who saw that Britian and Spain were laughing their asses off at our Articles of Confederation, and would continue to do so until we developed a real manly government, never wanted a big army. They advocated only that army that was necessary to prevent other countries and wild Indians from invading us. Their chief fear was that a large peacetime army, standing around with nothing to do, will draw us into war just to justify their existance. (Can you say "JFK-Oliver Stone-Military-Industrial-Complex Theory"?) The Federalists accepted the necessity of a permanent army, but they and the Anti-Federalists made certain that Congress had to debate the needs and requirements of this army every two years. During the dealmaking of the Constitutional Convention, the Anti-Federalists more or less won on the issue of national defense. The new nation would not have an army during peacetime; it was up to the citizens to protect themselves from other governments and from their own. Why is this important nowadays? We already have a permanent military, and if they can't protect us from invasion, there's not a lot that good old Buford and his Uzis can do. Military hardware is just too powerful. Likewise, exchanging gunfire with the military as a way of expressing your distaste for what you feel is tyranny is just going to make Janet Reno pissed at you. You know how she gets. So if we can't fight, let's hide. Hide our records, our writings, our past and our future. Not from each other, baby, (that makes no sense) but from the government. There's nothing that says that you have to make it easy for the government to read your mail and tap your phone. The key issue behind any interpretation of the Second Amendment is not "Does Buford have the right to own another grenade launcher?", but rather "Do we as citizens have the right to defend ourselves against our government?"

1 0

Re: MISC: thought for the day
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> In Starfleet, all communications are encrypted automatically. > Although there is no honor in knowledge gained through stolen > transmissions, some of our enemies have no honor. A true Klingon > does not "sneak"-he shouts into the face of his enemy. But I have > seen many types of dishonor, and so I am prepared for it. > -Lieutenant Worf,chief of security, U.S.S.Enterprise .... and of course > ``Gentlemen do not read each other's mail''. Henry Stimson, The classic Roman Republic policy on information from enemy traitors was to accept it, use it, kick the enemy's butt, and then kill the traitor. By the time of the Empire, haggling over price was a bit more flexible. After all, if you're trying to protect your own city, winning is everything. And if you're off trying to conquer other cities to increase the riches and power of the generals who run your army, honor's not a concept you want to over-analyze :-) For more precise references, and less cynicism, you'll need to contact my 8th grade Latin teacher... Pedantically, # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

Re: DEATH TO THE TYRANTS
by John Young 17 Dec '03

17 Dec '03

Tim May wrote: >By the way, I don't recall it being mentioned that [my] message from "IRS >Inspection" had an interesting subject line: DEATH TO TYRANTS. The six other headers received or forwarded here have the same subject: "Something of Interest." Further, Tim's message is so far the earliest of the batch: 12:18 compared to the next at 12:25 which went to a mail list based in Norway. Others followed at about 1 minute intervals, the last at 12:33. See the full headers at: http://jya.com/irs-header.txt BTW, Declan, did you not once write that IRS offices are down the corridor from yours? If so, would you care to ask the thieves their opinion of the spam, especially if they are the authors, sneaking into your box and lifting lists while you're sipping and baseballing with the brokers? Cite me as inquring an CU-FU, if you prefer to keep reportorial distance. Write up spam story, do, providing that you're up to snuff paying Crispin-bandit extortion. ---------- This is a resend of a message sent at 06:53 AM this morning, which did not make it through, at least not to me.

9 13

IT'S YOUR TURN! $50,000 in 90 Days, Guaranteed!!!
by 13281148＠usa.net 17 Dec '03

17 Dec '03

For those of us who HATE selling and who don't know a down line from a clothes line ..... You are about to make at least $50,000 - In less than 90 days. Read the enclosed program....THEN READ IT AGAIN!.... Please don't make the same mistake I made! I THREW this letter away at least twice before I took the time to read it. When I did, it dawned on me that this could work! Take a look for yourself! A copy of the letter I received is below. John My name is Christopher Erickson. Two years ago, the corporation I worked at for the past twelve years down-sized and my position was eliminated. After unproductive job interviews, I decided to open my own business. Over the past year, I incurred many unforeseen financial problems. I owed my family, friends, and creditors over $35,000. The economy was taking a toll on my business and I just couldn't seem to make ends meet. I had to refinance and borrow against my home to support my family and struggling business. I truly believe it was wrong for me to be in debt like this. AT THAT MOMENT something significant happened in my life and I am writing to share my experience in hopes that this will change your life FOREVER....FINANCIALLY!!! In mid-December, I received this program via email. Six months prior to receiving this program I had been sending away for information on various business opportunities. All of the programs I received, in my opinion, were not cost effective. They were either too difficult for me to comprehend or the initial investment was too much for me to risk to see if they worked or not. One claimed I'd make a million dollars in one year...it didn't tell me I'd have to write a book to make it. But like I was saying, in December of '92 I received this program. I didn't send for it, or ask for it, they just got my name off a mailing list. THANK GOODNESS FOR THAT!!! After reading it several times, to make sure I was reading it correctly, I couldn't believe my eyes. Here was a MONEY-MAKING PHENOMENON. I could invest as much as I wanted to start, without putting me further in debt. After I got a pencil and paper and figured it out, I would at least get my money back. After determining that the program is LEGAL and NOT A CHAIN LETTER, I decided "WHY NOT". Initially I sent out 10,000 emails. It only cost me about $15.00 for my time on-line. The great thing about email is that I didn't need any money for printing to send out the program, only the cost to fulfill my orders. I am telling you like it is, I hope it doesn't turn you off, but I promised myself that I would not "rip-off" anyone, no matter how much money it cost me!. In less than one week, I was starting to receive orders for REPORT #1. By January 13th, I had received 26 orders for REPORT #1. When you read the GUARANTEE in the program, you will see that "YOU MUST RECEIVE 15 TO 20 ORDERS FOR REPORT #1 WITHIN TWO WEEKS. IF YOU DON'T, SEND OUT MORE PROGRAMS UNTIL YOU DO!" My first step in making $50,000 in 20 to 90 days was done. By January 30th, I had received 196 orders for REPORT #2. If you go back to the GUARANTEE, "YOU MUST RECEIVE 100 OR MORE ORDERS FOR REPORT #2 WITHIN TWO WEEKS. IF NOT, SEND OUT MORE PROGRAMS UNTIL YOU DO. ONCE YOU HAVE 100 ORDERS, THE REST IS EASY, RELAX, YOU WILL MAKE YOUR $50,000 GOAL." Well, I had 196 orders for REPORT #2, 96 more than I needed. So I sat back and relaxed. By March 19th, of my emailing of 10,000, I received $58,000 with more coming in every day. I paid off ALL my debts and bought a much needed new car. Please take time to read the attached program, IT WILL CHANGE YOUR LIFE FOREVER! Remember, it wont work if you don't try it. This program does work, but you must follow it EXACTLY! Especially the rules of not trying to place your name in a different place. It doesn't work, you'll lose out on a lot of money! REPORT #2 explains this. Always follow the guarantee, 15 to 20 orders for REPORT #1, and 100 or more orders for REPORT #2 and you will make $50,000 or more in 20 to 90 days. I AM LIVING PROOF THAT IT WORKS !!! If you choose not to participate in this program, I'm sorry. It really is a great opportunity with little cost or risk to you. If you choose to participate, follow the program and you will be on your way to financial security. If you are a fellow business owner and you are in financial trouble like I was, or you want to start your own business, consider this a sign. I DID! Sincerely, Christopher Erickson PS Do you have any idea what 11,700 $5 bills ($58,000) look like piled up on a kitchen table? IT'S AWESOME! "THREW IT AWAY" "I had received this program before. I threw it away, but later wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get a copy, so I had to wait until I was emailed another copy of the program. Eleven months passed, then it came. I DIDN'T throw this one away. I made $41,000 on the first try." Dawn W., Evansville, IN "NO FREE LUNCH" "My late father always told me, 'remember, Alan, there is no free lunch in life. You get out of life what you put into it.' Through trial and error and a somewhat slow frustrating start, I finally figured it out. The program works very well, I just had to find the right target group of people to email it to. So far this year, I have made over $63,000 using this program. I know my dad would have been very proud of me." Alan B., Philadelphia, PA A PERSONAL NOTE FROM THE ORIGINATOR OF THIS PROGRAM By the time you have read the enclosed information and looked over the enclosed program and reports, you should have concluded that such a program, and one that is legal, could not have been created by an amateur. Let me tell you a little about myself. I had a profitable business for ten years. Then in 1979 my business began falling off. I was doing the same things that were previously successful for me, but it wasn't working. Finally, I figured it out. It wasn't me, it was the economy. Inflation and recession had replaced the stable economy that had been with us since 1945. I don't have to tell you what happened to the unemployment rate...because many of you know from first hand experience. There were more failures and bankruptcies than ever before. The middle class was vanishing. Those who knew what they were doing invested wisely and moved up. Those who did not, including those who never had anything to save or invest, were moving down into the ranks of the poor. As the saying goes, "THE RICH GET RICHER AND THE POOR GET POORER." The traditional methods of making money will never allow you to "move up" or "get rich", inflation will see to that. You have just received information that can give you financial freedom for the rest of your life, with "NO RISK" and "JUST A LITTLE BIT OF EFFORT." You can make more money in the next few months than you have ever imagined. I should also point out that I will not see a penny of your money, nor anyone else who has provided a testimonial for this program. I have already made over FOUR MILLION DOLLARS! I have retired from the program after sending out over 16,000 programs. Now I have several offices which market this and several other programs here in the US and overseas. By the Spring, we wish to market the 'Internet' by a partnership with AMERICA ON LINE. Follow the program EXACTLY AS INSTRUCTED. Do not change it in any way. It works exceedingly well as it is now. Remember to email a copy of this exciting program to everyone that you can think of. One of the people you send this to may send out 50,000...and your name will be on every one of them!. Remember though, the more you send out, the more potential customers you will reach. So my friend, I have given you the ideas, information, materials and opportunity to become financially independent, IT IS UP TO YOU NOW! "THINK ABOUT IT" Before you delete this program from your mailbox, as I almost did, take a little time to read it and REALLY THINK ABOUT IT. Get a pencil and figure out what could happen when YOU participate. Figure out the worst possible response and no matter how you calculate it, you will still make a lot of money! Definitely get back what you invested. Any doubts you have will vanish when your first orders come in. IT WORKS! Paul Johnson, Raleigh, NC HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU $$$$$$ Let's say that you decide to start small, just to see how it goes, and we'll assume you and all those involved send out 2,000 programs each. Let's also assume that the mailing receives a .5% response. Using a good list the response could be much better. Also many people will send out hundreds of thousands of programs instead of 2,000. But continuing with this example, you send out only 2,000 programs. With a 5% response, that is only 10 orders for REPORT #1. Those 10 people respond by sending out 2,000 programs each for a total of 20,000. Out of those .5%, 100 people respond and order REPORT #2. Those 100 mail out 2,000 programs each for a total of 200,000. The .5% response to that is 1,000 orders for REPORT #3. Those 1,000 send out 2,000 programs each for a 2,000,000 total. The .5% response to that is 10,000 orders for REPORT #4. That's 10,000 five dollar bills for you. CASH!!!! Your total income in this example is $50 + $500 + $5000 + $50,000 for a total of $55,550!!!! REMEMBER FRIEND, THIS IS ASSUMING 1,990 OUT OF 2,000 PEOPLE YOU MAIL TO WILL DO ABSOLUTELY NOTHING... AND TRASH THIS PROGRAM! DARE TO THINK FOR A MOMENT WHAT WOULD HAPPEN IF EVERYONE OR HALF SENT OUT 100,000 PROGRAMS INSTEAD OF ONLY 2,000. Believe me, many people will do that and more! By the way, your cost to participate in this is practically nothing. You obviously already have an internet connection and email is FREE!!! REPORT#3 will show you the best methods for bulk emailing and purchasing email lists. THIS IS A LEGITIMATE, LEGAL, MONEY MAKING OPPORTUNITY. It does not require you to come in contact with people, do any hard work, and best of all, you never have to leave the house except to get the mail. If you believe that someday you'll get that big break that you've been waiting for, THIS IS IT! Simply follow the instructions, and your dream will come true. This multi-level email order marketing program works perfectly...100% EVERY TIME. Email is the sales tool of the future. Take advantage of this non-commercialized method of advertising NOW!! The longer you wait, the more people will be doing business using email. Get your piece of this action!! MULTI-LEVEL MARKETING (MLM) has finally gained respectability. It is being taught in the Harvard Business School, and both Stanford Research and The Wall Street Journal have stated that between 50% and 65% of all goods and services will be sold throughout Multi-level Methods by the mid to late 1990's. This is a Multi-Billion Dollar industry and of the 500,000 millionaires in the US, 20% (100,000) made their fortune in the last several years in MLM. Moreover, statistics show 45 people become millionaires everyday through Multi-Level Marketing. INSTRUCTIONS We at Erris Mail Order Marketing Business, have a method of raising capital that REALLY WORKS 100% EVERY TIME. I am sure that you could use $50,000 to $125,000 in the next 20 to 90 days. Before you say "Bull", please read the program carefully. This is not a chain letter, but a perfectly legal money making opportunity. Basically, this is what we do: As with all multi-level business, we build our business by recruiting new partners and selling our products. Every state in the USA allows you to recruit new multi- level business partners, and we offer a product for EVERY dollar sent. YOUR ORDERS COME AND ARE FILLED THROUGH THE MAIL, so you are not involved in personal selling. You do it privately in your own home, store or office. This is the GREATEST Multi-level Mail Order Marketing anywhere! Step (1) Order all four 4 REPORTS listed by NAME AND NUMBER. Do this by ordering the REPORT from each of the four 4 names listed on the next page. For each REPORT, send $5 CASH and a SELF- ADDRESSED, STAMPED envelope (BUSINESS SIZE #10) to the person listed for the SPECIFIC REPORT. International orders should also include $1 extra for postage. It is essential that you specify the NAME and NUMBER of the report requested to the person you are ordering from. You will need ALL FOUR 4 REPORTS because you will be REPRINTING and RESELLING them. DO NOT alter the names or sequence other than what the instructions say. IMPORTANT: Always provide same-day service on all orders. Step (2) Replace the name and address under REPORT #1 with yours, moving the one that was there down to REPORT #2. Drop the name and address under REPORT #2 to REPORT #3, moving the one that was there to REPORT #4. The name and address that was under REPORT #4 is dropped from the list and this party is no doubt on the way to the bank. When doing this, make certain you type the names and addresses ACCURATELY! DO NOT MIX UP MOVING PRODUCT/REPORT POSITIONS!!! Step (3) Having made the required changes in the NAME list, save it as a text (.txt) file in it's own directory to be used with whatever email program you like. Again, REPORT #3 will tell you the best methods of bulk emailing and acquiring email lists. Step (4) Email a copy of the entire program (all of this is very important) to everyone whose address you can get your hands on. Start with friends and relatives since you can encourage them to take advantage of this fabulous money-making opportunity. That's what I did. And they love me now, more than ever. Then, email to anyone and everyone! Use your imagination! You can get email addresses from companies on the internet who specialize in email mailing lists. These are very cheap, 100,000 addresses for around $35.00. IMPORTANT: You won't get a good response if you use an old list, so always request a FRESH, NEW list. You will find out where to purchase these lists when you order the four 4 REPORTS. ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS!!! REQUIRED REPORTS ***Order each REPORT by NUMBER and NAME*** ALWAYS SEND A SELF-ADDRESSED, STAMPED ENVELOPE AND $5 CASH FOR EACH ORDER REQUESTING THE SPECIFIC REPORT BY NAME AND NUMBER ____________________________________________________ REPORT #1 "HOW TO MAKE $250,000 THROUGH MULTI-LEVEL SALES" ORDER REPORT #1 FROM: BC Enterprises 2899 Agoura Rd, #299 Westlake Village, CA 91361 ____________________________________________________ REPORT #2 "MAJOR CORPORATIONS AND MULTI-LEVEL SALES" ORDER REPORT #2 FROM: LDR Enterprises 204 High Ridge Dr Belleville, IL 62223 ____________________________________________________ REPORT #3 "SOURCES FOR THE BEST MAILING LISTS" ORDER REPORT #3 FROM: C & A Enterprises 1003 W Main #1B Vienna, IL 62995 ____________________________________________________ REPORT #4 "EVALUATING MULTI-LEVEL SALES PLANS" ORDER REPORT #4 FROM: Hill Enterprises 7060 W. Sheridan Rd. Suite 311 Chicago, IL ____________________________________________________ CONCLUSION I am enjoying my fortune that I made by sending out this program. You too, will be making money in 20 to 90 days, if you follow the SIMPLE STEPS outlined in this mailing. To be financially independent is to be FREE. Free to make financial decisions as never before. Go into business, get into investments, retire or take a vacation. No longer will a lack of money hold you back. However, very few people reach financial independence, because when opportunity knocks, they choose to ignore it. It is much easier to say "NO" than "YES", and this is the question that you must answer. Will YOU ignore this amazing opportunity or will you take advantage of it? If you do nothing, you have indeed missed something and nothing will change. Please re-read this material, this is a special opportunity. If you have any questions, please feel free to write to the sender of this information. You will get a prompt and informative reply. My method is simple. I sell thousands of people a product for $5 that costs me pennies to produce and email. I should also point out that this program is legal and everyone who participates WILL make money. This is not a chain letter or pyramid scam. At times you have probably received chain letters, asking you to send money, on faith, but getting NOTHING in return, NO product what-so-ever! Not only are chain letters illegal, but the risk of someone breaking the chain makes them quite unattractive. You are offering a legitimate product to your people. After they purchase the product from you, they reproduce more and resell them. It's simple free enterprise. As you learned from the enclosed material, the PRODUCT is a series of four 4 FINANCIAL AND BUSINESS REPORTS. The information contained in these REPORTS will not only help you in making your participation in this program more rewarding, but will be useful to you in any other business decisions you make in the years ahead. You are also buying the rights to reprint all of the REPORTS, which will be ordered from you by those to whom you mail this program. The concise one and two page REPORTS you will be buying can easily be reproduced at a local copy center for a cost off about 3 cents a copy. Best wishes with the program and Good Luck! "IT WAS TRULY AMAZING" "Not being the gambling type, it took me several weeks to make up my mind to participate in this program. But conservative as I am, I decided that the initial investment was so little that there was no way that I could not get enough orders to at least get my money back. BOY, was I ever surprised when I found my medium sized post office box crammed with orders! I will make more money this year than any ten years of my life before." Mary Riceland, Lansing, MI TIPS FOR SUCCESS Send for your four 4 REPORTS immediately so you will have them when the orders start coming in. When you receive a $5 order, you MUST send out the product/service to comply with US Postal and Lottery laws. Title 18 Sections 1302 and 1341 specifically state that: "A PRODUCT OR SERVICE MUST BE EXCHANGED FOR MONEY RECEIVED." WHILE YOU WAIT FOR THE REPORTS TO ARRIVE: 1. Name your new company. You can use your own name if you desire. 2. Get a post office box (preferred). 3. Edit the names and addresses on the program. You must remember, your name and address go next to REPORT #1 and the others all move down one, with the fourth one being bumped OFF the list. 4. Obtain as many email addresses as possible to send until you receive the information on mailing list companies in REPORT #3. 5. Decide on the number of programs you intend to send out. The more you send, and the quicker you send them, the more money you will make. 6. After mailing the programs, get ready to fill the orders. 7. Copy the four 4 REPORTS so you are able to sent them out as soon as you receive an order. IMPORTANT: ALWAYS PROVIDE SAME-DAY SERVICE ON ORDERS YOU RECEIVE! 8. Make certain the letter and reports are neat and legible. YOUR GUARANTEE The check point which GUARANTEES your success is simply this: you must receive 15 to 20 orders for REPORT #1. This is a must!!! If you don't within two weeks, email out more programs until you do. Then a couple of weeks later you should receive at least 100 orders for REPORT #2, if you don't, send out more programs until you do. Once you have received 100 or more orders for REPORT #2, (take a deep breath) you can sit back and relax, because YOU ARE GOING TO MAKE AT LEAST $50,000. Mathematically it is a proven guarantee. Of those who have participated in the program and reached the above GUARANTEES-ALL have reached their $50,000 goal. Also, remember, every time your name is moved down the list you are in front of a different REPORT, so you can keep track of your program by knowing what people are ordering from you. IT'S THAT EASY, REALLY, IT IS!!! REMEMBER: "HE WHO DARES NOTHING, NEED NOT HOPE FOR ANYTHING." "INVEST A LITTLE TIME, ENERGY AND MONEY NOW OR SEARCH FOR IT FOR THE REST OF YOUR LIFE."

1 0

PGP algorithm needed
by STEAKMAN＠delphi.com 17 Dec '03

17 Dec '03

I am currently working on an encryption program for the Apple II user's on the net (there's quite a few of us out there) but without the PGP algorithm it will be a useless utility. Can someone E-mail it to me, a long with an credits that should be included so as not to step on anyones toes. Thanks in advance... The SteakMan SteakMan(a)Delphi.Com Oh by the way, I had to drop from this list due to it's volume and my slailish 1200 baud modem snailish 1200 baud modem. Later D00dz

1 0

Re: Master Key: A Clipper Story
by doug＠netcom.com 17 Dec '03

17 Dec '03

> Somehow, I don't have a clue how, the algorithms >evolve to fit each piece of ciphertext. Several thoughts come to mind: - The difference between science fiction and fantasy can be very sharp. - If wishes were horses then beggars would ride. - Preaching to the choir is remarkably pointless. I would also add that genetic algorithms are much too nice to treat as mysterious magic that can solve any and all problems, but that's doubtless obvious. Doug

1 0

CNET editor endorses self-labeling, "news site" standard
by Declan McCullagh 17 Dec '03

17 Dec '03

Since the Supreme Court said the online world should be as free as print, and no self-labeling system exists for magazines or newspapers, why should the Net be any different? Why isn't the Net community opposing "mandatory voluntary" self-labeling systems as staunchly as newspapers and magazines would fight a similar requirement? It's best to ask these questions of Christopher Barr (chris_barr(a)cnet.com) editor in chief of CNET, who endorsed such a proposal in his column below. Barr says that he wants to ensure "that only real news organizations claim [the] privilege" of rating as news sites with RSACnews. But who decides what's a news site? Is CNET? pathfinder.com? epic.org, which the government treats as a news site when responding to FOIA requests? The Drudge Report? How about the NAMBLA News Journal? My report on the possible perils of such systems is at: http://pathfinder.com/netly/opinion/0,1042,1173,00.html -Declan **************** http://www.cnet.com/Content/Voices/Barr/072197/index.html rating online content can work (7/21/97) With the Communications Decency Act vanquished once and for all, it's time to explore alternatives for protecting our youth from inappropriate online content. As an independent content provider, CNET's position has always been to give the power to the reader (or the reader's parents) and not the government, to decide which sites have acceptable content. And now, President Clinton has been forced to come around to our way of thinking. After initially supporting the CDA, Clinton is recommending that sites rate themselves and that parents use filtering software to set limits for their children. Self rating systems allow sites to attach labels to themselves to indicate what kind of content the sites contain. The labels are interpreted via the Platform for Internet Content Selection (PICS) technology endorsed by the World Wide Web Consortium standards body. The PICS technology allows any group, such as the PTA or a church, to set content standards that can then be adopted by individual Web sites. There are already several rating services such as the Recreational Software Advisory Council on the Internet (RSACi), Safe For Kids, and SafeSurf. Early on, CNET supported the RSACi rating system and chose to rate both CNET.COM and NEWS.COM. Controlling content takes two things: content-ratings and filtering-software. A number of software programs, including Cyber Patrol, Cyber Sentry, Internet Explorer, and SurfWatch, already support PICS and can read the rating labels. Such software blocks out any sites that don't correspond to the ratings you've selected. For instance, if your rating system says that images with partial nudity are inappropriate, the software won't load those pages. To be sure, filtering- or blocking-software is not without limitations. A number of groups, including the American Civil Liberties Union and the Electronic Privacy Information Center, support the use of such software on principle, but they also point out that filtering software can be used to block any kind of content, not just sexually explicit material, and so it can end up restricting free speech. These groups are also fearful that a foreign government could use filtering software to control what content its citizens can access. These are just a few of the thorny issues that the technology introduces. Nevertheless, we at CNET feel that content ratings are the best alternative, and we'll continue to rate ourselves using the RSACi guidelines. But we also feel that different rating systems are necessary to cover different types of sites. For example, sites that carry news stories cannot be accurately rated under the RSACi standards. These were created to allow parents to block sites with nudity, sex, violence, and offensive language. But what happens when you visit a news site that publishes pictures from a war zone depicting death and destruction? Or a legitimate news story about an online scam involving pornography sites? Microsoft faces this dilemma: its Internet Explorer supports PICS but several of the rating systems unintentionally block access to its news site, MSNBC. Because of situations like these, we feel that bona fide news sites should be subject to different criteria. To that end, CNET is also a founding member of the Internet Content Coalition, which seeks to establish ratings for news sites and to make sure that only real news organizations claim this privilege. Users can then choose to allow access to news while selecting another rating system like RSACi that prohibits access to other kinds of sites. We intend to use the Internet Content Coalition's guidelines to rate NEWS.COM, while other of our sites, such as GAMECENTER.COM, will be rated using more restrictive systems. The success of any self-rating and filtering system depends on how well it works and how it's accepted and used. What's your opinion? Do you use filtering software? Should news sites have a separate rating? Email me and I'll put the responses in my next column. Christopher Barr is editor in chief of CNET. ###

2 1

remailer ideas
by L. Detweiler 17 Dec '03

17 Dec '03

T.C. May requests information on operator's remailer policies. I would like to go a step further and suggest that *all* operators *standardize* on a single email address for policy queries, in ping-like fashion. the user just sends mail to policies(a)remailer.com and gets back the policies. Of course, maybe that's not the best name, because some names are fixed. So maybe a standard header field request syntax. This sheet returned should include all the information about headers and cryptographic use, too. I would like it to have *standard headings* across remailers. That is, it would list categories and the variations that the particular remailer implements. His list of points is a good place to start of policy headings. Off the top of my head - remailer address header syntax how to cut and paste headers pitfalls cryptography support additional features oversight & logging etc. I'd also like some *history* of the remailer. Whose code is it based on? what modifications have been added? how reliable is it? -- even a standard `uptime field' or `% lost messages' would be interesting. are there any `close calls' in shutting it down? what kind of support does the operator enjoy? (e.g. sysadmin, student acct, etc.) If anyone would like to come up with a comprehensive `boilerplate' document, that'd certainly be useful. I think all this could increase the `userfriendliness' of the remailers and ultimately there use signficantly. just a humble suggestion from a fellow cypherpunk.

1 0

Master Key: A Clipper Story
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

MASTER KEY ~~~~~~ ~~~ by Infocalypse an36586(a)anon.penet.fi September 21, 2002 This file contains important information regarding the Skipjack standard encryption system. Please read this file through before coming to any conclusions. Please do not ask me who I am. I have no intention of revealing my identity. I will start at the beginning. The Skipjack encryption system, initially known as Clipper, was first publicly announced in mid- 1993. After an initial storm of controversy died down, escrow agents were selected and the chip went into production in early 1994. Several major hardware vendors used Skipjack, and sales began to accelerate in the third quarter of 1994 as business users recognized the advantages of the convenient, inexpensive, and highly secure system. By the first quarter of 1995, Mykotronx could no longer keep up with the orders, and demand was still increasing rapidly. Several other electronics companies came forward, arguing that they could manufacture Skipjack chips more cheaply than Mykotronx, in larger volume, and with at least equal security. The NSA hesitated to give more companies its classified algorithm, but at the same time, they certainly did not want Skipjack to die from lack of available hardware just as it was becoming a standard. After a delay and threats of restraint-of-trade lawsuits, NIST released a set of security requirements. Any company which met them could receive the classified algorithm and make Skipjack chips. Numerous companies jumped in immediately. By Christmas 1995, the price of Skipjack chips had fallen sharply. Secure telephones were rapidly becoming a consumer product, just as the telecom companies started their Christmas advertising drive. Remember these slogans? "This Christmas, Give The Gift Of Privacy. AT&T Secure Telephones!" "Motorola Secure Cellular Network. Because It's Nobody's Business But Yours!" The promotion worked - secure phones were the hottest-selling product of the season. At the start of 1996, there was an installed base of over ten million, with no end in sight. Companies were making secure faxes, secure modems, secure LAN's, and secure microwave systems. The long-awaited crypto revolution had begun, and NSA was thrilled. Skipjack would soon be used for all types of business communications as well as telephones - everything which needed protection could be taken care of with a single solution. At the time, I was a senior in college and working evenings for a company which had just received its security clearance. I did not have access to any classified data; my job was to operate and maintain their front-end system, which took orders, kept track of stock, etc. There was a separate, isolated LAN for the classified work of designing and programming chips. The company tried to follow all of the technical rules, but the people were hackers and businesspeople, not spooks. And most security problems are people problems. My boss did have a security clearance. He was working late one Friday on one of the classified machines used to write microcode. When everyone else had left, he asked me to fix a problem with the network. That was a violation of security, but I did know more about networks than he did, and all the classified data was supposed to be locked up for the weekend. The safe had a time lock, which could not be opened until Monday. My boss had made a mistake while he was logged in as root, and he did an excellent job of hosing the file server. He was not supposed to have the root password at all. He'd had an argument with his supervisor about computer access. The supervisor refused to give him the password, so he stole it. Now his ass was on the line - if the file server wasn't fixed by the next morning, he was history. He didn't exactly admit it all at once, but that's what happened. We took a look at the damage, and began the long, slow job of recreating the filesystems, reinstalling Unix, restoring the data from backup tapes, and, most importantly, hiding the evidence. By 8 o'clock, we were both starved. I was doing most of the work - he was watching, reading manuals, and sweating bullets - so he decided to go for food. While waiting for a backup tape to run, I opened the desk drawer out of boredom, and - whoops! - there was a manual stamped SECRET. Some programmer was using it to write the microcode for a new low- power CMOS Skipjack chip, and he hadn't locked it up. After all, this is a secure building. Nobody without a security clearance is even allowed in this room, right? So what's the big deal? People problems! I couldn't resist taking a look, and there was a complete description of the Skipjack algorithm, among other things, with each page marked SECRET at the top and bottom. I had about 20 minutes until my boss returned. There was a Xerox machine, warmed up and ready to go, in the next room. What would you do? So I stood there, turning pages and hitting the button, listening to my heart pound, waiting for the click of the outer door as my boss walked in. I wasn't hungry any more. If I heard that click, I had just enough time to toss everything behind the copier, run back to the workstation, and hope to put the manual back later. But there was no click. By the time my boss returned with a pizza, the copies were in my car and the manual was in the drawer. My appetite returned with a vengeance as the adrenaline wore off. By 2 am, the machine was restored to normal. My boss shook my hand and thanked me, and then I went home and passed out cold. The next day, I woke up around noon and took a look at my loot. The algorithm strongly resembles DES. It's a highly improved DES, of course, but the structure is similar. It uses 32 rounds, and an 80- bit key, and they process the key before using it to eliminate weak keys. I started coding it at home in C to hack around with, not having any particular plans as to what I'd do with it. I was just enjoying the thrill of having something few others had. The program worked, but it was horribly slow. Skipjack is optimized for a pipelined hardware implementation, using 32 processing elements, one for each round. Even a good software implementation is almost uselessly slow. Once I had the basic electronic-codebook function working, I started implementing the rest of the Skipjack protocol around it. After a month of on-and-off hacking, I had a complete software clone of a Skipjack chip, which could be assigned any serial number and device-unique key. Without the family key, however, there was no way to create a proper LEAF. The version of Skipjack in this file is much improved, but similar in structure, to the original. For a long time, that was all I did with it. Without hardware, it wasn't fast enough for a no-LEAF secure telephone. I scanned the copies I'd made, encrypted the image files, and made a bonfire with the paper copies. Not the kind of thing one should keep around. Then I started experimenting with a programming technique called genetic algorithms. These are algorithms which evolve their outputs by creating successively better results. Multiple results are generated and evaluated, the best are copied, the rest erased. The remaining ones are then "crossed", simulating sexual reproduction, and the cycle repeats. Looking for an application, I decided to see how far a genetic algorithm could go in attacking Skipjack. At the time, I'd have been thrilled if it broke one round. What happened next - I didn't do it! I didn't know then and don't know now how it works. Using keys as the strings my algorithm would create was no good. Genetic algorithms make incremental progress; with crypto, if one bit is off, it's useless. Instead, my strings were programs written in a little interpreted language, specifically designed for cryptography. The genetic algorithm would evolve programs. This approach has been used for various things in the past. I started out with less than a round, with only the first transformation of the first round. The genetic algorithm wrote a program to solve that, no problem. But as I made it harder, using more of the round, it failed to progress. So I tried something new: there are programs which clean up spaghetti code, making readable and usable code out of it. They are used to make 30-year-old Cobol maintainable. I used one to take the most successful programs which evolved, clean them up, and add them to the language itself as new commands. When it got to the second round, the blocks out of which those programs were built included the most successful methods used against the first round. This way the program could build on its own successes. The computer ran 24 hours a day, and it progressed as far as the fifth round. I was surprised that it worked at all, but I didn't know if five rounds was good or bad. There has never been any public research with Skipjack, but DES is much easier to break if fewer rounds are used, so I assumed I hadn't really done much. Before leaving for a weekend, I made several changes to the program: improvements to the crossover routines, removing old, nonuseful commands added by the evolver, and code which increased the difficulty, one piece of one round at a time, each time the programs were successful. There were a few other changes. There were also several bugs in the program, including at least one wild pointer which scrambled some of the evolved functions. How these bugs affected the ultimate outcome, I don't know. Something like Frankenstein's lightning, I suppose. When I got back Sunday evening, I turned on the monitor and couldn't believe it. It had gone through all 32 rounds - cracked the code! Impossible, had to be a program bug. So I encrypted some text using the function I'd written, fed it in, and went to bed. The next morning, I expected the program to be crashed. Instead, there was the key. Somehow, I don't have a clue how, the algorithms evolve to fit each piece of ciphertext. They go down, like a diver taking treasure from a sunken ship, and pull those patterns to the surface. I've never been able to trace it. All the data looks random, but the solution emerges in the end. Much like neural networks: they can solve a problem, but they can't tell you how they did it. That's one reason why people don't trust neural nets. The next day, I kept trying it with different pieces of text. Imagine opening your trunk and finding it stuffed with cash - I kept opening it and looking to see if the money was really there. Sometimes it was faster than others, but it always worked as long as there was a pattern to the plaintext. I started acquiring equipment and components. 32 RAM-based logic array chips, similar to PAL's but using SRAM instead of ROM. One for each round. These I connected to form the equivalent of a Skipjack chip, equally fast but fully controllable. A used minivan. Nonmetallic composites are popular for car bodies - they may stop a bullet, but radio signals go right through them. No need for visible antennas on the outside. A new 8-gigabyte hard drive. Plenty of RAM for a disk cache. A software encryption program - I wasn't about to use Skipjack, and my hard drive would need encrypting. A small microwave dish and receiver - they've replaced cable, carrying TV and all kinds of data transmissions. Encrypted with Skipjack, of course. By this time, mid-1997, Skipjack had already gone global. Most of the money transferred around the world moves by Skipjack. Almost all large corporations use it for their voice, data, and fax networks. It has been designed into the lowest levels of the new Information Superhighway under construction, and has replaced RIPEM as the official privacy standard on the Internet. Each country keeps escrows for all chips manufactured and used within its borders. These are used for national law enforcement. The United Nations has a master escrow, containing all of the keys in the world. This is used to police international terrorism, arms and drug trafficking, etc. There are, of course, very strict rules governing when and to whom the UN will release keys. This system works very well. It has put the squeeze on drug money like nothing that came before it, because the large cash transaction stands out in a world of electronic money. All major crimes are difficult - the Mafia is nearly extinct. ATM and credit card fraud are almost a thing of the past - the Skipjack smart card has replaced the mag stripe and the card number. New phones have a slot, rather than a built-in chip, allowing people to carry their identities wherever they go. I didn't counterfeit electronic money - that would eventually be noticed, and besides, I'm not a thief. Nor did I secretly transfer money to myself. I just drove to New York, one of many places where information worth billions of dollars moves everyday over microwave beams. Then I parked in the path of one, turned on my inverter - connected to four marine batteries; running out of power during a hot intercept is highly annoying - and powered up my scanner. Having cracked the family key, I could quickly extract the serial number from each transmission. The hardest part is deciding what, out of the gigabytes flowing by, to tap. Once I choose a transmission, I feed it to the genetic algorithm. If I get anything interesting, I keep that serial number, and I know to tap that chip again when I see the serial number. Perhaps I intercept the draft of your lousy quarterly earnings report, bouncing from one suit to another as they try to cover their asses. Then I sell your company short. Or if I intercept good sales figures, I buy your stock. Sometimes I buy options, although it's easier to lose your shirt that way. They aren't all winners - the market reacts strangely sometimes - but enough of them are to make me a millionaire in a couple of years. Besides, it wouldn't work if all my picks were accurate. Someone would get suspicious. I've really made very poor use of my luck. A corporation could have practically taken over the world. But it would have been detected eventually. By keeping it small and being careful, I've been successful. For the last five years, I've lived as a parasite, feeding on information and using it to my advantage. For a while, I went through a voyeuristic phase, driving down the freeway, tapping phone calls at random. That didn't stay interesting for very long; most phone calls are boring. So why am I revealing this now? Why would I give up my master key? Not willingly, I assure you. But I feel that I have no choice. Recently, there have been two unexplained crimes: large amounts of money have been electronically transferred from corporate accounts, simply vanishing. In both cases, the police have suspected an inside job. MIS and finance managers were arrested - and released, because there was absolutely no evidence against them. There was, in fact, no evidence at all. The money was just gone. The police may suspect an inside job, but I think otherwise. I am very familiar with such crimes, because I spent much of that first year planning them, thinking about how they could be accomplished. Someone else, I am convinced, has discovered the master key. I would suspect an organization, not an individual. Either they have corrupted the escrow system, or they have cracked the code too. And they do not intend to stop at personal wealth. From an offshore base, they could, in one day of frantic activity, hold the world economy hostage. Or they could drain us more slowly, over a period of a few weeks. The thefts were intended to provide them with capital and experience for what could be the greatest heist in the history of money. So what can I do to prevent this? I could go to the NCPI - the National Cryptography and Privacy Institute, formerly the NSA - and show them my system. They might throw me in the slammer for espionage and securities fraud. More likely, they would make me a deal - my freedom for my silence - and begin the long process of designing a new encryption algorithm. But they would not believe me when I told them that someone else had also cracked the code. The idea is almost too horrible for them to contemplate - the whole world runs on Skipjack - and without convincing evidence, there is no way they would believe me. I don't have any convincing evidence. Action has to be taken now, before it's too late, and there's only one way to cause that. Tell the secret. Publish the algorithm, publish the method of breaking it, and of course, publish this file, so people will understand why I did what I did. I will be flamed, called every name in the book and some that will be made up for the occasion. They may try to hunt me down. There will be chaos for a few days, maybe a few weeks. The world financial system will grind to a halt, as programmers work frantically around the clock. Software cryptography will have to be quickly installed, until a new hardware system can be designed. For now, incompatibility will return, efficiency will be reduced, and a lesson will be learned. Hopefully, the NCPI will not make the same mistake twice. Hopefully, they won't classify the algorithm next time. --==<< Infocalypse >>==-- (Binary file transmission follows this message)

1 0

Rating online content can work
by Steve Schear 17 Dec '03

17 Dec '03

Since the Supreme Court said the online world should be as free as print, and no self-labeling system exists for magazines or newspapers, why should the Net be any different? I don't believe that a self-rating system is either practical or desirable. Enactment of any laws to put teeth into Internet self-ratings will almost certainly run afoul of Constitutional challenges, and without such laws compliance and thus widespread acceptance is unlikely. Quite full of youself, aren't you Mr. Barr? I have no doubt that the definition of what qualifies as a bona fide news organization is in the eye of the beholder. I certainly would not class CNET with any of the major US newspapers, magazines nor the WSJ. Be careful where you tread, lest CNET and other Internet Content Coalition members be judged as relatively no more than garage-shop operations unworthy of the protections you so clearly covet. --Steve PGP mail preferred, see http://web.mit.edu/network/pgp.html RSA PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear (N7ZEZ) | Internet: azur(a)netcom.com 7075 West Gowan Road | Voice: 1-702-658-2654 Suite 2148 | Fax: 1-702-658-2673 Las Vegas, NV 89129 | ---------------------------------------------------------------------

2 1

Master Key: A Clipper Story
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

MASTER KEY ~~~~~~ ~~~ by Infocalypse an36586(a)anon.penet.fi September 21, 2002 This file contains important information regarding the Skipjack standard encryption system. Please read this file through before coming to any conclusions. Please do not ask me who I am. I have no intention of revealing my identity. I will start at the beginning. The Skipjack encryption system, initially known as Clipper, was first publicly announced in mid- 1993. After an initial storm of controversy died down, escrow agents were selected and the chip went into production in early 1994. Several major hardware vendors used Skipjack, and sales began to accelerate in the third quarter of 1994 as business users recognized the advantages of the convenient, inexpensive, and highly secure system. By the first quarter of 1995, Mykotronx could no longer keep up with the orders, and demand was still increasing rapidly. Several other electronics companies came forward, arguing that they could manufacture Skipjack chips more cheaply than Mykotronx, in larger volume, and with at least equal security. The NSA hesitated to give more companies its classified algorithm, but at the same time, they certainly did not want Skipjack to die from lack of available hardware just as it was becoming a standard. After a delay and threats of restraint-of-trade lawsuits, NIST released a set of security requirements. Any company which met them could receive the classified algorithm and make Skipjack chips. Numerous companies jumped in immediately. By Christmas 1995, the price of Skipjack chips had fallen sharply. Secure telephones were rapidly becoming a consumer product, just as the telecom companies started their Christmas advertising drive. Remember these slogans? "This Christmas, Give The Gift Of Privacy. AT&T Secure Telephones!" "Motorola Secure Cellular Network. Because It's Nobody's Business But Yours!" The promotion worked - secure phones were the hottest-selling product of the season. At the start of 1996, there was an installed base of over ten million, with no end in sight. Companies were making secure faxes, secure modems, secure LAN's, and secure microwave systems. The long-awaited crypto revolution had begun, and NSA was thrilled. Skipjack would soon be used for all types of business communications as well as telephones - everything which needed protection could be taken care of with a single solution. At the time, I was a senior in college and working evenings for a company which had just received its security clearance. I did not have access to any classified data; my job was to operate and maintain their front-end system, which took orders, kept track of stock, etc. There was a separate, isolated LAN for the classified work of designing and programming chips. The company tried to follow all of the technical rules, but the people were hackers and businesspeople, not spooks. And most security problems are people problems. My boss did have a security clearance. He was working late one Friday on one of the classified machines used to write microcode. When everyone else had left, he asked me to fix a problem with the network. That was a violation of security, but I did know more about networks than he did, and all the classified data was supposed to be locked up for the weekend. The safe had a time lock, which could not be opened until Monday. My boss had made a mistake while he was logged in as root, and he did an excellent job of hosing the file server. He was not supposed to have the root password at all. He'd had an argument with his supervisor about computer access. The supervisor refused to give him the password, so he stole it. Now his ass was on the line - if the file server wasn't fixed by the next morning, he was history. He didn't exactly admit it all at once, but that's what happened. We took a look at the damage, and began the long, slow job of recreating the filesystems, reinstalling Unix, restoring the data from backup tapes, and, most importantly, hiding the evidence. By 8 o'clock, we were both starved. I was doing most of the work - he was watching, reading manuals, and sweating bullets - so he decided to go for food. While waiting for a backup tape to run, I opened the desk drawer out of boredom, and - whoops! - there was a manual stamped SECRET. Some programmer was using it to write the microcode for a new low- power CMOS Skipjack chip, and he hadn't locked it up. After all, this is a secure building. Nobody without a security clearance is even allowed in this room, right? So what's the big deal? People problems! I couldn't resist taking a look, and there was a complete description of the Skipjack algorithm, among other things, with each page marked SECRET at the top and bottom. I had about 20 minutes until my boss returned. There was a Xerox machine, warmed up and ready to go, in the next room. What would you do? So I stood there, turning pages and hitting the button, listening to my heart pound, waiting for the click of the outer door as my boss walked in. I wasn't hungry any more. If I heard that click, I had just enough time to toss everything behind the copier, run back to the workstation, and hope to put the manual back later. But there was no click. By the time my boss returned with a pizza, the copies were in my car and the manual was in the drawer. My appetite returned with a vengeance as the adrenaline wore off. By 2 am, the machine was restored to normal. My boss shook my hand and thanked me, and then I went home and passed out cold. The next day, I woke up around noon and took a look at my loot. The algorithm strongly resembles DES. It's a highly improved DES, of course, but the structure is similar. It uses 32 rounds, and an 80- bit key, and they process the key before using it to eliminate weak keys. I started coding it at home in C to hack around with, not having any particular plans as to what I'd do with it. I was just enjoying the thrill of having something few others had. The program worked, but it was horribly slow. Skipjack is optimized for a pipelined hardware implementation, using 32 processing elements, one for each round. Even a good software implementation is almost uselessly slow. Once I had the basic electronic-codebook function working, I started implementing the rest of the Skipjack protocol around it. After a month of on-and-off hacking, I had a complete software clone of a Skipjack chip, which could be assigned any serial number and device-unique key. Without the family key, however, there was no way to create a proper LEAF. The version of Skipjack in this file is much improved, but similar in structure, to the original. For a long time, that was all I did with it. Without hardware, it wasn't fast enough for a no-LEAF secure telephone. I scanned the copies I'd made, encrypted the image files, and made a bonfire with the paper copies. Not the kind of thing one should keep around. Then I started experimenting with a programming technique called genetic algorithms. These are algorithms which evolve their outputs by creating successively better results. Multiple results are generated and evaluated, the best are copied, the rest erased. The remaining ones are then "crossed", simulating sexual reproduction, and the cycle repeats. Looking for an application, I decided to see how far a genetic algorithm could go in attacking Skipjack. At the time, I'd have been thrilled if it broke one round. What happened next - I didn't do it! I didn't know then and don't know now how it works. Using keys as the strings my algorithm would create was no good. Genetic algorithms make incremental progress; with crypto, if one bit is off, it's useless. Instead, my strings were programs written in a little interpreted language, specifically designed for cryptography. The genetic algorithm would evolve programs. This approach has been used for various things in the past. I started out with less than a round, with only the first transformation of the first round. The genetic algorithm wrote a program to solve that, no problem. But as I made it harder, using more of the round, it failed to progress. So I tried something new: there are programs which clean up spaghetti code, making readable and usable code out of it. They are used to make 30-year-old Cobol maintainable. I used one to take the most successful programs which evolved, clean them up, and add them to the language itself as new commands. When it got to the second round, the blocks out of which those programs were built included the most successful methods used against the first round. This way the program could build on its own successes. The computer ran 24 hours a day, and it progressed as far as the fifth round. I was surprised that it worked at all, but I didn't know if five rounds was good or bad. There has never been any public research with Skipjack, but DES is much easier to break if fewer rounds are used, so I assumed I hadn't really done much. Before leaving for a weekend, I made several changes to the program: improvements to the crossover routines, removing old, nonuseful commands added by the evolver, and code which increased the difficulty, one piece of one round at a time, each time the programs were successful. There were a few other changes. There were also several bugs in the program, including at least one wild pointer which scrambled some of the evolved functions. How these bugs affected the ultimate outcome, I don't know. Something like Frankenstein's lightning, I suppose. When I got back Sunday evening, I turned on the monitor and couldn't believe it. It had gone through all 32 rounds - cracked the code! Impossible, had to be a program bug. So I encrypted some text using the function I'd written, fed it in, and went to bed. The next morning, I expected the program to be crashed. Instead, there was the key. Somehow, I don't have a clue how, the algorithms evolve to fit each piece of ciphertext. They go down, like a diver taking treasure from a sunken ship, and pull those patterns to the surface. I've never been able to trace it. All the data looks random, but the solution emerges in the end. Much like neural networks: they can solve a problem, but they can't tell you how they did it. That's one reason why people don't trust neural nets. The next day, I kept trying it with different pieces of text. Imagine opening your trunk and finding it stuffed with cash - I kept opening it and looking to see if the money was really there. Sometimes it was faster than others, but it always worked as long as there was a pattern to the plaintext. I started acquiring equipment and components. 32 RAM-based logic array chips, similar to PAL's but using SRAM instead of ROM. One for each round. These I connected to form the equivalent of a Skipjack chip, equally fast but fully controllable. A used minivan. Nonmetallic composites are popular for car bodies - they may stop a bullet, but radio signals go right through them. No need for visible antennas on the outside. A new 8-gigabyte hard drive. Plenty of RAM for a disk cache. A software encryption program - I wasn't about to use Skipjack, and my hard drive would need encrypting. A small microwave dish and receiver - they've replaced cable, carrying TV and all kinds of data transmissions. Encrypted with Skipjack, of course. By this time, mid-1997, Skipjack had already gone global. Most of the money transferred around the world moves by Skipjack. Almost all large corporations use it for their voice, data, and fax networks. It has been designed into the lowest levels of the new Information Superhighway under construction, and has replaced RIPEM as the official privacy standard on the Internet. Each country keeps escrows for all chips manufactured and used within its borders. These are used for national law enforcement. The United Nations has a master escrow, containing all of the keys in the world. This is used to police international terrorism, arms and drug trafficking, etc. There are, of course, very strict rules governing when and to whom the UN will release keys. This system works very well. It has put the squeeze on drug money like nothing that came before it, because the large cash transaction stands out in a world of electronic money. All major crimes are difficult - the Mafia is nearly extinct. ATM and credit card fraud are almost a thing of the past - the Skipjack smart card has replaced the mag stripe and the card number. New phones have a slot, rather than a built-in chip, allowing people to carry their identities wherever they go. I didn't counterfeit electronic money - that would eventually be noticed, and besides, I'm not a thief. Nor did I secretly transfer money to myself. I just drove to New York, one of many places where information worth billions of dollars moves everyday over microwave beams. Then I parked in the path of one, turned on my inverter - connected to four marine batteries; running out of power during a hot intercept is highly annoying - and powered up my scanner. Having cracked the family key, I could quickly extract the serial number from each transmission. The hardest part is deciding what, out of the gigabytes flowing by, to tap. Once I choose a transmission, I feed it to the genetic algorithm. If I get anything interesting, I keep that serial number, and I know to tap that chip again when I see the serial number. Perhaps I intercept the draft of your lousy quarterly earnings report, bouncing from one suit to another as they try to cover their asses. Then I sell your company short. Or if I intercept good sales figures, I buy your stock. Sometimes I buy options, although it's easier to lose your shirt that way. They aren't all winners - the market reacts strangely sometimes - but enough of them are to make me a millionaire in a couple of years. Besides, it wouldn't work if all my picks were accurate. Someone would get suspicious. I've really made very poor use of my luck. A corporation could have practically taken over the world. But it would have been detected eventually. By keeping it small and being careful, I've been successful. For the last five years, I've lived as a parasite, feeding on information and using it to my advantage. For a while, I went through a voyeuristic phase, driving down the freeway, tapping phone calls at random. That didn't stay interesting for very long; most phone calls are boring. So why am I revealing this now? Why would I give up my master key? Not willingly, I assure you. But I feel that I have no choice. Recently, there have been two unexplained crimes: large amounts of money have been electronically transferred from corporate accounts, simply vanishing. In both cases, the police have suspected an inside job. MIS and finance managers were arrested - and released, because there was absolutely no evidence against them. There was, in fact, no evidence at all. The money was just gone. The police may suspect an inside job, but I think otherwise. I am very familiar with such crimes, because I spent much of that first year planning them, thinking about how they could be accomplished. Someone else, I am convinced, has discovered the master key. I would suspect an organization, not an individual. Either they have corrupted the escrow system, or they have cracked the code too. And they do not intend to stop at personal wealth. From an offshore base, they could, in one day of frantic activity, hold the world economy hostage. Or they could drain us more slowly, over a period of a few weeks. The thefts were intended to provide them with capital and experience for what could be the greatest heist in the history of money. So what can I do to prevent this? I could go to the NCPI - the National Cryptography and Privacy Institute, formerly the NSA - and show them my system. They might throw me in the slammer for espionage and securities fraud. More likely, they would make me a deal - my freedom for my silence - and begin the long process of designing a new encryption algorithm. But they would not believe me when I told them that someone else had also cracked the code. The idea is almost too horrible for them to contemplate - the whole world runs on Skipjack - and without convincing evidence, there is no way they would believe me. I don't have any convincing evidence. Action has to be taken now, before it's too late, and there's only one way to cause that. Tell the secret. Publish the algorithm, publish the method of breaking it, and of course, publish this file, so people will understand why I did what I did. I will be flamed, called every name in the book and some that will be made up for the occasion. They may try to hunt me down. There will be chaos for a few days, maybe a few weeks. The world financial system will grind to a halt, as programmers work frantically around the clock. Software cryptography will have to be quickly installed, until a new hardware system can be designed. For now, incompatibility will return, efficiency will be reduced, and a lesson will be learned. Hopefully, the NCPI will not make the same mistake twice. Hopefully, they won't classify the algorithm next time. --==<< Infocalypse >>==-- (Binary file transmission follows this message)

1 0

Re: Public-Key Crypto Toolkit
by Timothy Newsham 17 Dec '03

17 Dec '03

> THUS SPAKE Mike Ingle <MIKEINGLE(a)delphi.com>: > # Any ideas as > # to what language/method would be best for implementing a PK toolbox? This > # could really get the "Cypherpunks write code" ideal moving. Anyone want to > # help? > > Yeah, let's write some code! > > "TCL" is my language of choice for this -- it was designed specifically > for wrapping other libraries and embedding inside other tools. good choice, I think a crypto library written for TCL or TCL/TK would be nice. > I've been wanting to build the crypto-toolkit, too, and have started with RSAREF wrappers. > > There's a nice TCP module for TCL that lets you implement clients and > servers. There's also the "TK" X-windows toolkit, for seamless graphical > interfaces to TCL stuff. > > Ftp to sprite.berkeley.edu and ftp down TCL or TK (which will include TCL). > (A lot of people may suggest perl, but perl was designed with a different > set of goals in mind.) I havent had alot of luck getting different add ons compiled for tcl/tk, perhaps because I use one of the newer versions of tcl, the tcp module was one of them. > strick > strick(a)versant.com What we need most of all is an interface. This is basically what you are proposing. Since tcl add-ons are usually written in C I think it would be best off to start with a C library calling interface. Once this is made, you could build a tcl shell (or a wish shell) on top of it. I expressed what I would like to see in a C library interface a few days ago. It would be based on PGP routines and the PGP "shell" would be re-implemented over it. I have gotten no feedback on the idea at all. Are there any members of the PGP team on this list? If not how could I get in touch with them? This is an idea I really would like to see done, and which would pave the way to coding alot of applications and interfaces to PGP. I would gladly work on such a project myself, but I am afraid if I do my code will be both un-exportable and non standard and will hence go unused. ...

1 0

EPIC letter to CNET.COM and the Internet Community (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 23 Jul 1997 21:30:26 -0400 From: Marc Rotenberg <rotenberg(a)epic.org> To: fight-censorship(a)vorlon.mit.edu Cc: chris_barr(a)cnet.com Subject: EPIC letter to CNET.COM and the Internet Community To Mr. Barr of CNET.COM and the Internet Community, On July 21 Christopher Barr, editor in chief of CNET, endorsed Internet rating schemes in a column titled "Rating Online Content Can Work". http://www.cnet.com/Content/Voices/Barr/072197/index.html In this column, Mr. Barr says A number of groups, including the American Civil Liberties Union and the Electronic Privacy Information Center, support the use of such software on principle, but they also point out that filtering software can be used to block any kind of content, not just sexually explicit material, and so it can end up restricting free speech. I want to be clear that EPIC, both a plaintiff and counsel in the challenge to the Communications Decency Act, does not support the use of blocking software in principle or practice. We do not support rating systems for the following reasons. First, we believe that the fundamental purpose of a rating system -- to allow one person to decide what information another person may receive -- is contrary to the character of the Internet and the principles of openness and individuality found in a free society. Unlike search engines that allow individuals to select information based on their preferences and desires, rating systems impose one person's or one organization's viewpoint on another. Such techniques could be used as easily by governments against citizens and employers against employees as they could by parents against children, as was made clear by one of the PICS creators in an early paper on the topic. Second, we have already seen rating systems used to block access to information that could in no reasonable way be considered indecent. Rating systems have blocked access to political organizations, medical information, and unpopular viewpoints. In public libraries and public schools such techniques violate well established First Amendment freedoms. Such products should be roundly criticized by Internet publishers, not endorsed. Third, we believe that over time rating systes are likely to make it easier -- not more difficult -- for governments around the world to enforce content-based controls on Internet content. This process is already underway in many countries which are now considering PICS-based schemes to implement national content controls. Further, our reading of the Supreme Court's opinion in Reno V. ACLU is that content based controls would be upheld in the US once rating systems and means for age verification and widely available. It was the nature of the Internet, and not the availability of rating systems, that produced the wonderful outcome in that case. But once voluntary standards are in place, statutory controls will surely follow. We recognize that the availability of material that some might consider offensive poses a difficult problem for on-line information providers. We further recognize that there is indeed some material on the Internet that is genuinely abhorrent. But we do not believe you can hide the world from your children. We should help our children to understand the world, and then help them make it better. Good parenting is not something found in a software filter; it takes time, effort, and interest. And it takes trust in young people to develop within themselves judgment and reason, and the ability to tell right from wrong. We also caution against any efforts to distinguish between bona fide news organizations and others. The framers of our First Amendment wisely drew no such distinction, and thus we have avoided the process of licensing and government approval that othe countries have pursued. News organizations that today seek to draw such a line may in the future find themselves placed on the wrong side. These are difficult issues. It is not easy today to criticize the ratings proposal which has recently received White House endorsement. This fact alone should give those who value free speech and who opposed the Communications Decency Act reason to think twice. It is also the reason that we applaud the American Library Association for its principled opposition to the use of software filters in libraries. We hope other organizations will join with EPIC, the ACLU, and the ALA and recognize that we all have a common interest in the protection of intellectual freedom and the openness of the Internet. We will continue to offer information about the PICS debate at our web site -- www.epic.org -- so that individuals and organizations that provide information online can make fully informed decisions about the desireability of rating systems. Finally, we hope CNET.COM will reconsider its position on the rating issue. In the end, it will be the decisions of individual Internet news organizations and other online publishers that will determine the openness and accessibility of the Internet for us all. We share a common interest in preserving the free flow of information across the Internet. Sincerely, Marc Rotenberg, director EPIC ================================================================== Marc Rotenberg, director * +1 202 544 9240 (tel) Electronic Privacy Information Center * +1 202 547 5482 (fax) 666 Pennsylvania Ave., SE Suite 301 * rotenberg(a)epic.org Washington, DC 20003 USA + http://www.epic.org ==================================================================

3 2

Timing of Moby subpoena
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

From: smb(a)research.att.com > Ward posted a note that (in essence) asked for help in evading the ITARs. Since Moby Crypto is, as I understand it, composed of material which is generally available all over the world, it may not be necessary that it be exported from the U.S. in order to exist in a foreign country. One should be careful about accusing others of conspiracy to violate the ITARs, even qualifying it with "in essence". > Face it -- if Ward *wanted* to generate a test > case, he couldn't have done a much better job; a private note to the > authorities could have been ``misfiled'', but an announcement to tens > of thousands of readers around the world? C'mon -- they may or may not > be stupid, and they may or may not be paranoid, but their entire raison > d'etre is to wield power, and Grady just slapped that authority in the > face. Spitting at your local traffic cop would have been a lot safer. The note that Steve is referring to is presumably this. Note the date: > Newsgroups: talk.politics.crypto > From: grady(a)netcom.com (Grady Ward) > Subject: Want to drop-ship Moby Crypto? > Message-ID: <gradyCDCqqr.MpC(a)netcom.com> > Date: Tue, 14 Sep 1993 16:20:50 GMT > > Is there anyone receiving this feed outside the > United States who would like to act as my foreign > drop-ship agent for Moby Crypto? > [...] I think the relative timing of this announcement and the subpoena makes it questionable whether the subpoena was in response to this posting. According to Ward's later post: > Newsgroups: comp.org.eff.talk,sci.crypt,alt.security.pgp,talk.politics.crypto > From: grady(a)netcom.com (Grady Ward) > Subject: Re: *FLASH* Moby SUBPOENA served > Message-ID: <gradyCDHKDC.3Lu(a)netcom.com> > Date: Fri, 17 Sep 1993 06:51:11 GMT > [...] > At 10:30 PM EDT Thursday, 16 Sept 1993 Theodore R. Siggins, > special agent for the Department of Treasury, U.S. > Customs Service office of enforcement for > Austin, TX (512) 482-5502 served the following > subpoena: This is two days after Ward's message, which is pretty fast response for law enforcement. But this is the date of service. The subpoena had to be issued and signed before this. Did that occur after Ward's Sep 14 posting? It's not 100% clear, but what the subpoena itself, as posted by Grady, says is: > This subpoena is issued on application of the United States of America > Michael J. Yamaguchi > United States Attorney > > Assistant U.S. Attorney > William P. Keane > 280 S. First St., Suite 371 > San Jose, CA 95113 > (408) 291-7221 > s/a Robin Sterzer, Customs > 93-1348(SJ) 93-1(SJ) > > 9 September 1993 If Sep 9 is the date on which the subpoena was actually issued, this was five days before Grady Ward's post which supposedly triggered the subpoena. Unless the Feds are prescient, they must have been planning to subpoena Austin Code Works about Moby Crypto, PGP, and RSA long before Ward's post. Hal hfinney(a)shell.portal.com

1 0

Re: Standard Headers for Anonymous Remailers
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

> From: mentor(a)indial1.io.com (Loyd Blankenship) > > One of the big problems is anonymous bombardment of a > helpless newsgroup. This (and the problem of auto-screening anonymous > mail) could be solved if there was a standard header keyword (or maybe > even a new header field) that could be screened from a newsgroup. > [Any thoughts?] Yeah, some thoughts, > From: greg(a)ideath.goldenbear.com (Greg Broiles) > > If a significant fraction > of the net community responds to wider access to anonymity by filtering out > anonymous mail, my prediction (and suggestion :) is that people [...] > will resort to mail which is non-obviously anonymous. The possibilities for 1) (more or less) anonymous posting, 2) forged headers, 3) general obnoxiousness 4) automatic abuse of netnews facilities, 5) secret or forged "identities", all already exist on netnews. Many have already been used in offensive action as in the following recent examples (I'd welcome more data and pointers about these and similar cases, and some of these may have been rumors only. I'm also sure some good ones happened before my time :-) 1) anonymous posting services (penet), 2) forged headers are very popular of course, and do not really surprise anybody anymore, 3) I'll avoid naming examples of direct obnoxiousness, thank you :-) 4) (semi-?)automatic newsgroup re-creation after rmgrouping (Becker), 4) post-moderation via cancel messages (who was that guy again?), 5) SRIA vote-taker, accused of being the same person as the main proponent of the group (with syslogs as evidence), 5) "It was not me, I left my terminal logged on..." 5) suspect votes from generic accounts, all posted at the same time... And some other mechanisms scream for new forms of abuse :-) It's amazing that everybody is resisting the temptation... The responses have been: - A few flame wars (some pretty entertaining), - The most exposed newsgroups, like religious groups, are systematically moderated (to improve signal to noise ratio, but also to try to prevent attacks), - The most obnoxious people have been posting away under their own name, proudly disdaining (that we know of) the possibilities of technology :-) - and overall, the net as we know it goes on, with just some minor flamage overhead. So, as you can see, I'm pretty optimistic (I actually found most of these actions at least interesting, if maybe ...errr... crude). I do not think you really want to go to the trouble of really preventing people from posting (more or less) anonymously if they want to simply because that's too much trouble. One the other hand, most offensive action on the net has in the past been proudly done under the perpetrator's real name, or under Real Thin disguise. Of course, if it's possible, it will happen, and so eventually netnews will have to shut down for a few days under an attack of the magnitude of the one that stroke down the Internet itself. And somebody will end up in court... It's not also that I deny groups the right to express their disgust towards anonymous posting, but rather that I think they are wasting their time until much more infrastructure is available for accountability (that may not be so far away, but that's a different story). A remailer "tag" would help (at least politically), but at this stage, would be deceiving in that it does not really solve any user's problem (if there ever was any). Still, delusion and all, it may make remailers more socially acceptable... errr... tolerable :-) It could also create a distinction between "nice" remailers (obediently tagged) and "naughty" remailers (proudly un-tagged). Pierre "What emphasys?". pierre(a)shell.portal.com

1 0

archie search on pgp
by bart＠netcom.com 17 Dec '03

17 Dec '03

In response to the request I ran a search on the UNL archie server to see how many locations had pgp. The count of all versions and devivatives like docs and shells is 556. There is quite a bit of obsolete stuff though. >grep pgp10 pgp.lst |wc 40 265 2593 >grep pgp20 pgp.lst |wc 54 363 3440 >grep pgp21 pgp.lst | wc 74 518 4767 >grep pgp22 pgp.lst | wc 153 951 9042 >grep pgp23 pgp.lst | wc 36 252 2313

1 0

Standard Headers for Anonymous Remailers
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9309210809.AA08533(a)jobe.shell.portal.com> pierre(a)shell.portal.com writes: > > of the net community responds to wider access to anonymity by filtering out > > anonymous mail, my prediction (and suggestion :) is that people [...] > > will resort to mail which is non-obviously anonymous. Just to let you know, this *is* happening. I got so pissed off at the postings here from anonymous remailers that I've now put them in my kill file. (I gate this stuff into a local newsgroup and read it with a newsreader). Actually it wasn't the content of the articles that narked me, it was that I actually wanted to *reply* to the authors. However the subjects were way too off-topic to be worth responding to in public, which is the only option the anonymous remailers allows. I've no objections (and haven't kill'd) articles from penet etc that I can reply to. I'm not entirely happy with the whole concept of 'hit&run' anonymous remailers - they're only good for throwaway comments on public lists, or whistleblowing. That's not how they're being used - they're forcing people to have private conversations in public lists like this, which I think is unfair to the rest of the list community - I'm *sure* it's contributed to the number of people dropping off this list lately. G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

Master Key: A Clipper Story
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

For god's sake, how many copies of this trash are we going to get? If you're going to use anonymous remailers to mailbomb our list, at least learn to use them properly and just send us one copy! That makes three so far - two of them via the same remailer even! G PS To the person who was bragging about using a spelling checker to hide his anonymity, erm... have a closer look at your post, buddy! I don't think it would take more than 10 minutes with an index of all usenet postings over the last month or two to find you :) -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

Cabel TV's new specs require leaky encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Cablelabs, a reasearch institute for US cable companies, whose members provide 85% of the cable service in the US and 70% in Canada, has release their "Request For Proposals for a Telecommunications Delivery System over a Hybrid Fiber/Coax (HFC) Architecture" This RFP contains the final specs for a new multimedia architecture the cable companies intend to deploy. Here are some quotes: ".c4.11.7.1.1 Security System Objectives: The Offeror shall specify [..] whether it is possible to hide information in the digital signature number of which the signer would be unaware, which could conceal information. " Such as parts of the key? and under .c3.11.7.2 Privacy: " It should be possible to manage encryption keys and provide them to law enforcement agencies on demand." Big Brother is watching you. Through your TV. The full doccument is available at ftp://ftp.cablelabs.com//pub/RFIs/Telecom_RFP.MSWord -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

3 2

Put Us To Work For You TODAY!!
by info＠we-work-for-you.com 17 Dec '03

17 Dec '03

*** To be removed from all of our future e-mails please reply with a subject of 'remove' or to be added to a national remove list please visit http://www.iemmc.org for name removal information. *** Visit http://www.we-work-for-you.com TODAY!! How many times has opportunity knocked and you have not been at home? Today, please take a moment to OPEN THIS DOOR! For many years, I have been convinced that there is a business opportunity out there that any and everyone could take advantage of, because of the sheer simplicity of the business. I have found such a business opportunity! What if you could have your own HOME BUSINESS and you could hire sales people to do all of the selling for you with NO PERSONAL SELLING OF ANY KIND? This business has NO OVERHEAD, NO EMPLOYEES, NO SELLING, NO INVENTORY, NO MEETINGS, NO HASSLES, and did I mention NO PERSONAL SELLING OF ANY KIND!! The best part of this business is that you are not paying the thousands of people who will be SELLING FOR YOU! If you choose you can just sit back and cash your checks. Is this free money? Not exactly, but it's as close as it gets. You are going to be making money from other people's marketing efforts. The fact that you are reading this e-mail is proof that we will be working for you! It will only take a few minutes to look further at this AMAZING OPPORTUNITY!! Someone HAS to make money from our marketing efforts. This could be you! Please visit our Internet web site at : http://www.we-work-for-you.com or Reply to this e-mail with 'info' as the subject and you will quickly receive an informative e-mail reply. There is NO OBLIGATION for looking at our web site or replying to our e-mail so take a few moments to look at this INCREDIBLE BUSINESS OPPORTUNITY! Sincerely, Razor Sharp Financial Services ~ Helping People Achieve Financial Freedom info(a)we-work-for-you.com

1 0

Aust crypto regulations
by M.Gream＠uts.EDU.AU 17 Dec '03

17 Dec '03

I posted this to clarify some possible misconceptions, and ended it with a `teaser'. Since I'm sure it'll be of interest to readers here, here goes a forward (some headers elided): ---- begin include ---- From: M.Gream(a)uts.edu.au (Matthew Gream) Newsgroups: aus.computers.ibm-pc,alt.security.pgp Subject: Re: PGP for Oz users Date: 2 Sep 1994 11:58:42 GMT Vesselin Bontchev (bontchev(a)fbihh.informatik.uni-hamburg.de) wrote: > Actually, it seems that the Australian laws are not much better. A > colleague of mine there told me that he had to apply for an export > license even for his program that does only cryptographic checksums, > no encryption. That sounds bogus to me, at least from the information you've given me there. I've had the pleasure of being routed from our `Australian Trade Commission' through a number of channels to get to the `Defence Industry Development Branch' who furnished me with information relating to export of `Dual Use Technologies'. Having been informed first hand, and given the appropriate paperwork, I'm fairly confident in saying that there are no export restrictions on software (specific clause stating that mass market, public domain and "unsupported after installation" software is not covered by the Industrial List). There do exist restrictions on hardware. All of these restrictions are a direct result of our adherence with COCOM regulations (enacted through amendments to our Customs Act) -- and even so, export licences are required only for "certain" countries. The documentation relating to export guidelines is dated September 1992, I received it early 1994 and was informed that it was still "current". I have heard "on the net" (how's that for credibility ? :-), that the COCOM agreements are going to be abandoned, but as the software project I'm involved with isn't complete, I haven't looked into the matter since the initial investigation. I will do so when the time comes, or suitably motivated. I should also mention that in response to one of several questions I put to our Cwth Attorney General's Department, I received: ``Your third question concerns restricting [sic] on the production, export and import of cryptographic software and hardware. I note your familiarity with the Customs (Prohibited Exports) Regulations. I am not aware of any other legislation dealing particularly with cryptographic software and hardware.'' -- Steven Marshall, A/g Assistant Secretary, National Security Branch. Security Divison, Attorney General's Department, Commonwealth of Australia. personal correspondence, 26 May 1994. Getting back to the export guidelines, I have it with me here and I'll quote something interesting that may apply in this circumstance (whoever wrote this didn't seem pleased either, but it still got the Minister's seal of approval): ``United States of America Re-export Controls Exporters should be aware that authorities of the United States of America claim control over many exports from other countries, including Australia, where the goods are of US origin, include components of US origin, or were produced using US-origin technology. In such cases, under US export regulations, a US re-export licence may be required whether or not an Australian export licence is needed or has been granted. Although such US regulations are not valid in Australian law, the US authorities commonly penalise foreign companies which do not comply, by denying them access to US goods or technology in the future. Where a company has a presence in the US, legal action may lead to the imposition of fines and other penalties. Enquiries regarding re-export approval should be directed to the US Consulate in Sydney or Melbourne. The contact numbers are listed in Annex C.'' -- "Australian controls on the export of technology with civil and military applications" -- "a guide for exporters and importers" September 1992, Department of Defence, Canberra. pg 4. The question here is whether "US-origin technology" covers algorithms and conceptual systems (RSA for example). I'd be interested to hear about these apparent US prosecutions. Matthew. -- Matthew Gream <M.Gream(a)uts.edu.au> -- Consent Technologies, (02) 821-2043 Disclaimer: From? \notin speaking_for(Organization?) [cfqx103] ---- end include ---- -- Matthew Gream <M.Gream(a)uts.edu.au> -- Consent Technologies, (02) 821-2043 Disclaimer: From? \notin speaking_for(Organization?) [cfqx103]

1 0

Re: Alt.Gvmt.Bad.Bad.Bad
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Michael Conlen: Theft could be from thoes who do not protect there property and from thoes who do not respect others property, so can it also be said that 'bad government' can be from people not protecting there rights and people who have no respect for the rights of others? ............................................................... What should really be said is that theft does not happen of its own accord; someone must decide to accomplish the so-called criminal act. To describe theft as the result of another's inaction is to imply that human action of any kind is mostly automatic, that there is a pull like gravity which will cause action upon intelligence the way gravity affects inanimate objects, and that nothing better could be or should be expected from it. It is also to imply that the possession of intelligence is negligible because any opportunity for taking advantage of another's vulnerability will be irresistible to humans, as if they were basically scavengers looking for the spoils of other people's negligence. In which case, rather than speaking of bad government, the subject should be a question on the existence of intelligence & the possibility for morality. I don't know who would be qualified to discuss it, though, without the possession of the one and an appreciation of the other. Blanc

3 2

Re: OFFSHORE DIGITAL BANKS
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Wed, 31 Aug 4:8 PM >I'm not sure what John wants me to expand on here. >Others have noted the same sorts of things. Here are >some random, brief points: [Elision of US foreign interventions] >Is this enough of an expansion? As a newcomer to this list I'm interested your views, and those of others, on how crypto and related topics may be used in responding to US interventions abroad and their domestic consequences. Blending these views into discussions on other matters is just fine; I'll continue to pick out the parts that catch my eye. Much list discussion seems to focus on internal affairs of the US with periodic comments from those members outside. My sense is that our laments about internal abuses of the USG will not be answered until we address the external policies that are used to justify these abuses. Since so much of the power of the USG derives from "national security" responsibilities -- diplomacy, military, intelligence -- and because these have repeatedly been used to justify invasive policies, both domestic and foreign, I wish to learn more on what might be done through c'punks' activities to ventilate the secrecy cloak that shields such affairs from the public. Most of my recent posts have tried to raise queries along these lines whether about crypto anarchy, digicash or varieties of government. This follows my query a while back about how c'punks think US scientists and their technology may be redirected away from national security affairs, where the best and brightest have thrived in the last two generations, toward the needs of civil society, in the US and abroad. So you won't think this is an idle interest, I'll mention that I've been pursuing these topics, with others, for some 27 years in the NYC area in a public planning and development context, as we have waited for the Cold War squandering of surplus wealth to end so that more of these resources might go toward dealing with civil shortcomings, especially through non-governmental programs. Sorry for soapboxing, but this is from a long-time worker among NYC's richest and poorest wondering how long these worlds can be kept apart by the fictions of "national interests". John

1 0