December 2003 - cypherpunks-legacy

THOSE DARNED HIT MEN
by Patrick J. May 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandy Sandfort writes: > SCENARIO ONE > > I set up a meat-and-potatoes escrow business. I keep my nose > clean. I honor my obligations. I build up a good reputation. > At some point, I'll be approached by a murderer and the person > who is hiring him or her. I'll accept the payment. When the > murder is committed, I won't pay off. The murderer will (a) sue > me (I don't think so), (b) damage my reputation (I'll leave this > one as an exercise for the student), or (c) murder *me* (ah, but > first he has to find me; in the world we posit, that won't be > very easy). If this scenario happens very often, it'll take all > the profit out of the murder business. Of course, the murderer > can get the money face-to-face from the customer, but then we're > back to today's square one. Regarding (b), why wouldn't reputation be as important to "Murder Escrows R Us" as to "Meat-and-Potatoes Escrow"? Certainly the smaller market will result in higher charges for customers of MERU, but I don't see a qualitative difference in operation. Also, there is no reason for MAPE to know that they are paying a killer. The escrow could be set up to pay off or refund when a trusted certification agency instructs MAPE to do so. It might be possible to spread the pieces around such that no one agent is aware that they are participating in a murder for hire. > SCENARIO TWO > > I set up a phoney murder-for-hire business. Someone contracts > with me to bump-off their rich uncle. The client deposits my > payment with a reputable escrow company, "Murder Escrows R Us." I > go to the uncle and tell him the whole deal. Using digital > technology, bribed coroners, etc., we fake his death. When the > news hits the Net, the escrow pays me off. The uncle comes back > to life, disinherits whomever he suspects wanted him dead. And I > laugh all the way to the digital bank. I create a new pseudonym, > place another murder-for-hire ad, and do it all again. Given our > Brave New World, nobody can touch me. This is a risk the customer is taking. I'd make sure to only hire killers certified by the Assassin's Guild, just as I'd only use an escrow agency certified by people I trust. I don't see this as a service that is sufficiently different in _kind_ to require protocols not required by other (pseudo)anonymous businesses. - ------------------------------------------------------------------------ A contract programmer is always intense. Patrick May pjm(a)gasco.com (public key available from servers) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

The National Research Council study of National...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: The National Research Council study of National Cryptography Policy Please redistribute this note to any party that you think might be interested. thanks. A STUDY OF NATIONAL CRYPTOGRAPHY POLICY September 14, 1994 Cryptographic technologies are critical to a wide variety of important military and civilian applications involving sensitive or classified information that must be protected from unauthorized disclosure. In addition, cryptography is a key component of most authentication technologies, i.e., technologies to guarantee the identity of a message's sender. National cryptography policy has important implications for U.S. economic competitiveness, national security, law enforcement interests, and protection of the rights of private U.S. citizens. In an attempt to clarify some of the relevant policy issues, Public Law 103-160 (passed by the U.S. Congress in November 1993) called for a comprehensive study from the National Research Council on cryptographic technologies and national cryptography policy. The study will commence in the first week of October 1994. As this study proceeds, the committee will make all feasible attempts to solicit a wide range of input and commentary from interested parties. Input will be presented to the committee through a mix of briefings, presentations, consultations, invited and contributed papers, and testimony at regional public hearings. In addition, members of the interested public are invited to submit input to the committee as described below. The study plans to address the following issues: * the impact of current and possible future restrictions and standards regarding cryptographic technology on - the availability of such technology to foreign and domestic parties with interests hostile to or competitive with the national security, economic, commercial, and privacy interests of the U.S. government, U.S. industry, and private U.S. citizens; - the competitiveness of U.S. manufacturers of such technology in the international market; - the competitiveness and performance of commercial U.S. users of such technology; - U.S. national security and law enforcement interests; * the strength of various cryptographic technologies known and anticipated that are relevant for commercial and private purposes; * current and anticipated demand for information systems security based on cryptography; * the impact of foreign restrictions on the use of, importation of, and the market for cryptographic technology; * the extent to which current cryptography policy is adequate for protecting U.S. interests in privacy, public safety, national security, and economic competitiveness; * strengths and weaknesses of current key escrow implementation schemes; * how technology now and in the future can affect the feasible policy options for balancing the national security and law enforcement interests of government and the privacy and commercial interests of U.S. industry and private U.S. citizens; * recommendations for the process through which national security, law enforcement, commercial, and privacy interests are balanced in the formulation of national cryptography policy. The study will be conducted by a 17-member committee (listed at the end of this document) that collectively has expertise in computer and communications technology; cryptographic technologies and cryptanalysis; foreign, national security, and intelligence affairs; law enforcement; science policy; trade policy; commercial and business dimensions of computer technology (hardware and software vendors, users of cryptographic technologies); and interests in privacy and civil liberties. A subpanel of the full committee will be cleared at the SI level and have access to all relevant information to ensure that the findings, conclusions, and recommendations of the unclassified report are consistent with what is known in the classified world. The project plan calls for the study to be delivered approximately two years after full processing of all necessary security clearances. However, the NRC will make every attempt to deliver the study sooner, and it currently believes that the core work of the study will be completed about 18 to 20 months after funding for the study has been received. Additional time will be devoted to dissemination of the study report and follow-up activities. The final report of the study committee is subject to NRC review procedures that ensure the objectivity and integrity of all NRC reports. The main text of the report will be unclassified; classified annexes (if any) will be made available only to those with the appropriate security clearances. PROVIDING INPUT TO THE COMMITTEE The questions that the study is expected to examine are provided above. Members of the interested public are invited to submit their views on these questions and any other questions that you believe the committee should be addressing through either of the channels below. If desired, requests for personal presentations to the committee should be submitted through these channels as well; the committee will respond affirmatively to as many such requests as possible, but time and resource constraints will limit the number of such requests that can be honored. Internet: send comments and other correspondence to CRYPTO(a)NAS.EDU. U.S. Mail: Cryptography Project Computer Science and Telecommunications Board National Research Council Mail Stop HA-560 2101 Constitution Avenue, NW Washington, DC 20418 COMMITTEE TO STUDY NATIONAL CRYPTOGRAPHY POLICY Kenneth Dam, committee chair, was Deputy Secretary of State (1982- 1985) and is currently the Max Pam Professor of American and Foreign Law at the University of Chicago Law School. General W. Y. Smith, retired, committee vice-chair, is president emeritus of the Institute for Defense Analyses, and has also served in a number of military posts including that of deputy commander in chief of the U.S. European Command in Germany. Lee Bollinger, formerly dean of the University of Michigan Law School, is currently provost of Dartmouth College and a constitutional scholar. Ann Caracristi, retired, was Deputy Director of the National Security Agency (1980-1982). Benjamin Civiletti was U.S. Attorney General (1979-1981), and is currently in private practice with the law firm Venable, Baetjer, Howard and Civiletti. Colin Crook is senior technology officer for Citicorp. Samuel Fuller is vice president of corporate research at Digital Equipment Corporation. Leslie Gelb is president of the Council on Foreign Relations. He served as Assistant Secretary of State for Politico-Military Affairs (1977-1980). Ronald Graham is a director of information sciences at AT&T Bell Labs and a professor of mathematics at Rutgers University. Martin Hellman is professor of electrical engineering at Stanford University. Dr. Hellman was one of the inventors of public key encryption. Julius Katz is president of Hills & Company, and was deputy United States trade representative (1989-1993). Peter Neumann is principal scientist in the Computer Science Laboratory at SRI International. He is the chairman of the ACM committee on computers and public policy, and a member of the ACM study group on cryptography policy. Raymond Ozzie is president of Iris Associates, a wholly-owned subsidiary of the Lotus Development Corporation. Iris Associates is the developer of Lotus Notes. Kumar Patel is vice chancellor for research at UCLA. Edward Schmults was Deputy Attorney General of the United States (1981-1984) and is a former senior vice president for external relations and general counsel for the GTE Corporation. Elliot Stone is executive director of the Massachusetts Health Data Consortium, which is responsible for the collection and analysis of the state's large health care databases. Willis Ware, retired, is with the RAND Corporation as senior computer scientist emeritus. He chairs the Computer System Security and Privacy Advisory Board which was established by the Computer Security Act of 1987. STAFF AND ORGANIZATIONS Marjory Blumenthal is director of the Computer Science and Telecommunications Board (CSTB). Herbert Lin is study director and senior staff officer of the CSTB. Inquiries about this study should be directed to him at 202-334-3191 or via Internet at HLIN(a)NAS.EDU. The National Research Council (NRC) is the operating arm of the Academy complex, which includes the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The NRC provides impartial and independent advice to the federal government and other policy makers, by applying top scientific and technical talent to answer questions of national significance. In addition, the NRC often acts as a neutral party in convening meetings among multiple stakeholders on various controversial issues, thereby facilitating the generation of consensus. Within the NRC, the CSTB considers technical and policy issues pertaining to computer science, telecommunications, and associated technologies as critical resources and sources of national economic strength. A list of CSTB publications is available on request to CSTB(a)NAS.EDU or by calling 202-334-2605.

1 0

Re: Laws Outside the U.S.
by Carl Ellison 17 Dec '03

17 Dec '03

>From: usura(a)vox.xs4all.nl (Alex de Joode) >Date: Tue, 20 Sep 94 22:24:56 +0200 >There are basicly four scenario's that a state can follow to >regulate crypto: > - outlaw it totally > - key depositing > - try to develop a standart > - do nothing >The most prosperous scenario. Crypto use will boom, but >lawenforcement agencies will be deprived from a useful >tool, they can't bug phones any more. I think this is wishful thinking on our parts. Crypto would have to be built-in and automatic (not even a button push required to activate it) before I think you'd see much of a user community. Even then, some people might encounter key exchange problems and beg for a button to *disable* crypto. Until you see a substantial percentage of the population using crypto, I don't think law enforcement will have any problem. They'll worry about drug dealers as a new potential threat, but have them read Kahn about Rum Runners (in a chapter with that in the title). -------------- To me, it's obvious that this isn't a real LE problem. That leaves open the question of why the US and others want to limit crypto. I think part of the answer comes from the USACM report, in the second paragraph of chapter 4. "The development of telecommunications in the 19th century, first via cable and later by radio, presented a challenge to national security so severe as to challenge the very notion of national sovereignty. Nations could still regulate the flow of people and products across their borders, but in a process that continues unabated, news, ideas, and information began to travel in channels far harder to control." This sounds like either a Cypherpunk or Clint Brooks wrote it. I'd guess the latter but I think they'd both be wrong. Since when have nations seen their people as imprisoned? We limit the speech of prisoners, but of citizens? When did nations ever care about limiting the speech of citizens, before the middle of this century (with the advent of OSS/CIA thinking)? Was travel prohibited? Were private conversations with foreigners prohibited? -------------- So -- the argument is bogus. Why advance it? My answer: because the Agency advancing it (with cypherpunks as unwitting accomplices) wants to create the perception of a threat of loss of power in those who have power (Congress, President) so that they'll give state-of-emergency powers to the appropriate Agency to fight back. Net result: no real threat; real increase in power for one Agency. +----------------------------------------------------------------------------+ |Carl M. Ellison Phone: (301) 854-6889 | |Trusted Information Systems, Inc. FAX: (301) 854-5363 | |3060 Washington Road | |Glenwood MD 21738 E-mail: cme(a)tis.com | | | |RIPEM MD5OfPublicKey: 39 D9 86 06 86 A9 F0 75 A9 A8 3D 49 58 9C 67 7A| |PGP 2.6.1 Key fingerprints: E0 41 4C 79 B5 AF 36 75 02 17 BC 1A 57 38 64 78| | 61 E2 DE 7F CB 9D 79 84 E9 C8 04 8B A6 32 21 A2| +----------------------------------------------------------------------------+

2 1

Re: META: Tim's FAQ, ftp to chaos
by Chael Hall 17 Dec '03

17 Dec '03

>About retreiving the gopher files via ftp: I'm not sure it is set up >for that yet. Chael has put in quite a bit of work over the summer, >including updating gopher daemon, and he did mention he would like to >make the heirarchy available via anonymous ftp, or perhaps move the >gopher directory (currently a subdirectory of my home) into the >anonymous ftp area. However, I'm not sure if this has been done yet, >or is doable, etc. > >If there is sufficient interest though, I could place the chapters of the >FAQ into the cypherpunks/incoming directory for the time being. > >-- >Karl L. Barrus: klbarrus(a)owlnet.rice.edu The Cypherpunks gopher hierarchy that was under Karl's home directory has been officially moved to ~ftp/cypherpunks. Gopher should work as normal and all of the files should be FTPable as well! Chael -- Chael Hall, nowhere(a)chaos.bsu.edu

1 0

Re: (fwd) "Will You Be a Terrorist?"
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Usura wrote: > Please keep in mind that the US jurisdiction doen't cover the whole earth. > > (There is life outside the US) Unfortunately, most of the remailers aren't.

1 0

Re: Laws Outside the U.S. (fwd) Re: Laws Outside the U.S.
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

|Date: Wed, 21 Sep 1994 10:16:35 -0400 (EDT) |From: Jeff Barber <jeffb(a)sware.com> |To: Hadmut Danisch <danisch(a)ira.uka.de> |Cc: cypherpunks(a)toad.com |Subject: Re: Laws Outside the U.S. |Hadmut Danisch writes: |> The EC forces their countries to |> equalize their laws in the sense of "what you can do in one country, > you can do everywhere". |> If France forbids the import of crypto software, but allows to sell it |> inside of France, then I can sue France, because the french programmer |> can sell his programs in France and I can't. |Isn't it inevitable that this will -- for the same reasons of equity |among the member countries -- evolve into a single set of laws governing |the *use* of crypto throughout the EC? Free movement of goods rules in the EC contain exceptions for public order and national security. National rules control in those areas. SOLONg

1 0

Re: Reserved DC-Net IP addresses
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

doug(a)OpenMind.com (Doug Cutrell): [I haven't seen this on the list yet, but it looks as if it was meant for all] > Subject: Re: Reserved DC-Net IP addresses > I think you miss the point... there is a need to have a specific > "broadcast" IP address that "speaks" for the whole DC-net. This is so that > someone from within the net can send a message anonymously to *outside* the > net. The members within the net could use standard IP addresses, I would > presume. Eric was talking about formally allocating a range of addresses for IP. That's like putting up an RFC for each remailer, to 'notarize' the fact that the remailer is not the real source. Any IP address can be the apparent source for the DC-Net messages. It only has to be acknowledged by all the participants (just as remailer users have to know about the mailer address). You may need to publicize a _disclaimer_ as IP packets don't carry Comment: lines. You don't need to formally allocate the address, though, and certainly shouldn't have to go to the IETF - that's hardly anarchy! One might have DCN IPs bouncing just as remailers do, and use DCNping to see which are up ;-) ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: Tedious Chomsky arguments, some small remailer relevance.
by chen＠intuit.com 17 Dec '03

17 Dec '03

In response to James Donald: The Hayek quote is correct, and an example of what Reinholdt Niebuhr called "manufacturing consent" (where have I heard this?). I am not going to get into your Chomsky argument, except to say that your excerpt explicitly contradicts your conclusions: > "The Chomsky reader" Pantheon books, 1987, p.201, quotes > a paper written by Chomsky in 1975: > > "When the *New York Times* editors and U. N. Ambassador > Moynihan castigate Idi Amin of Uganda as a "racist > murderer," perhaps correctly, there is a surge of public > pride throughout the country; and they are lauded for their > courage and honesty. No one would be so vulgar as to > observe that the editors and the ambassador, in the not > very distant past, have supported racist murder on a scale > that exceeds Amin's wildest fantasies. The general failure > to be appalled by their hypocritical pronouncements > reflects, in the first place, the extremely powerful > ideological controls that prevent us from coming to terms > with our acts and their significance and, in the second > place, the nation's profound commitment to racist > principle." For which you graciously provide a vigorous, trenchant "analysis": > 1. Whatever Idi Amin is, he is morally much better than > Moynihan and the NY Times editors. There is no mention anywhere of moral superiority. There is a statement of the demonstrable fact that "the editors and the ambassador, in the not very distant past, have supported racist murder on a scale that exceeds Amin's wildest fantasies," referring, perhaps, to the (then) recent Indonesian slaughter in East Timor, or to the secret genocide in Cambodia (the one that happened *before* Pol Pot), or to any number of other U.S.-_Times_-backed atrocities. > 2. Only a country steeped in racist principle will fail to be > appalled when hearing Idi Amin called a racist murderer, even > when he is. This is simply nowhere to be found. "The general failure to be appalled by their hypocritical pronouncements" clearly has nothing whatever to do with Idi Amin. I know that it's difficult for you to conceive, James, but life is not always a football game. Hating the Rams doesn't imply loving the Packers. > ** 3. Only powerful ideological controls can prevent the > public from being outraged when someone truthfully calls a > black man a racist murderer. This is the same as your #2, and again, it is neither said nor implied. I would suggest that you read the passage again, but I don't think it will help. You're evidently quite intent on tilting at Chomsky as some sort of symbol of all that is threatening to your special brand of proto-Malthusian machismo. And it's really an extraordinary conceit to suppose that anyone else cares. You say elsewhere: > This coming thread will actually have some very slight > relevance to remailers, (gasp) in that I point out that the > same reasoning that enables Chomsky to define the > government to be the people, and individuals to be the evil > Capitalist Conspiracy, can be used in the same way; to > conclude that the eradication of Remailers and eradication > of the sort of thoughts that remailers are often used to > communicate, and the eradication of the kind of people that > are on the cypherpunks mailing list, represents a triumph > for liberty and civil rights, a triumph that would prove > how far civil liberties have advanced from the bad old > days. Before doing the service of "pointing out" all of these grandiose things to us, perhaps you should work on your reading comprehension. Your original claim was: > Of course Noam Chomsky is optimistic - he favors limitless and > absolute state power and the forcible and violent silencing of all > those who deviate from political correctness. The "analysis" which you present, apart from being factually wrong in every imaginable way, does not move one inch toward supporting this. If the only purpose of your claim was to serve as a platform for launching vapid diatribes, then knock yourself out. Otherwise, we would all appreciate it if you'd stick to the point. This is the last I will say on the subject, unless the thread assumes the shape of something vaguely relevant. -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

Send Your Message to 50 Million---at "INSANE SPEED" !!
by owner-cypherpunks 17 Dec '03

17 Dec '03

50 MILLION EMAIL ADDRESSES... EARN INSANE PROFITS WITH THE RIGHT FORMULA If you have a product, service, or message that you would like to get out to Thousands, Hundreds of Thousands, or even Millions of people, you have several options.Traditional methods include print advertising, direct mail, radio, and television advertising. They are all effective, but they all have two catches: They're EXPENSIVE and TIME CONSUMING. Not only that, you only get ONE SHOT at making your message heard, by the right people. The INTERNET, the "Global Communications Frontier" has changed this dramatically, including making countless individuals wealthy. "Electronic Marketing," as it's commonly referred to, has effectively leveled the playing fields of all types businesses. Gulf Coast Marketing has been in the online marketing business for 4 years. We can help make your goals come true. We have helped many individuals succeed in marketing their product effectively. It's very simple to do. In fact soon you will have the problem of what to do with all the cash you will make from sending out bulk email. Here are just a couple of many true success stories we have seen... " I was trying to market computer equipment on the Internet with limited success. I bought 5 million e-mail addresses and the Stealth Mass Mailer from Gulf Coast Marketing and within the first two weeks I sold over 500 modems. At a profit of $50 each I made over $25,000" T.S. --- Dallas I bought the Stealth Mass Mailer and 10 million e-mail addresses from Gulf Coast Marketing in March. Within two months I was making so much money that I was able to quit my job and do my internet marketing business full time." K.B. Web Page Designer--- FL Those were just two of the many success stories we hear everyday. It may all sound to good to be true. Well, we can tell you this. It really does work. Why else are so many individuals doing it? They are not just wasting their time. They are all making mega bucks. HERE'S THE BOTTOM LINE AND WHAT WE CAN DO FOR YOU Here is what you get when you order today! >> 50 Million Email Addresses... 1 per line in simple text format on a CD. Multiple files of 100,000 or greater (no codes needed to open files). You will receive email addresses of the following domains... AOL, PRODIGY, COMPUSERVE, DELPHI, GENIE, JUNO, PIPELINE, EARTHLINK, INTERAMP, MSN, NETCOM and MILLIONS OF OTHER MIXED EMAIL ADDRESSES (.com, .net). All names listed above are separated by domain name for your convenience. PLUS THESE BONUS SPECIALS... >> Stealth Mass Mailer Evaluation Version. A fully functional Mass E-mail program that will mail up to 250,000 messages per hour. With Stealth Mass Mailer you can send your message to millions of people every day. Imagine the response! AND Stealth Mass Mailer will disguise your dial-up account to make it untraceable. Never lose your dial-up account again. The registered version of Stealth sells for $399 The free evaluation version will work for 10 days after intallation before requiring registration codes. Plenty of time to send you offer to millions. >> "Floodgate" Bulk Email Loader Demo. This is the most popular bulk emailer in the world. You can test drive it for free. >> Winzip Self Extractor... This program will be needed when de-compressing a compressed file. It will come in handy when dealing with files of zip format. >> Over 1,000 Places To Advertise For Free! Plus Yet Another Bonus... "The Complete Internet Business Starter Kit" Includes "The Information Freeway" The most up-to-date information for marketing on the Internet. Also contains over 300 of the latest best selling reports. Comes with full reprint and resale rights YOU GET EVERYTHING FOR ONLY $499... UPDATE... SAVE $200 AND ORDER WITHIN 5 DAYS! >>> NOW ONLY $299! We have previously sold the Starter Kit alone for over $200. Now you can have the complete package for the low price of only $295! All lists are completely free of any Duplicates. We also on a continual basis, add New Names and Remove Undeliverables and Remove Requests. The result is the Cleanest Email Addresses Available Anywhere to use over and over again, for a FRACTION of the cost that other companies charge. Typical rates for acquiring email lists are from 1 cent to as high as 3 cents per email address - that's "INFORMATION HIGHWAY" ROBBERY!. Don't even hesitate on this one or you will miss out on the most effective way to market anywhere..PERIOD! Start earning mega money and get started now! If you have any further questions call our Marketing Department at: 504-757-1686 To order our email package, simply print out the EZ ORDER FORM below and fax or mail it to our office today. We accept Visa, Mastercard, AMEX, Checks by Fax and Mail. _________________ EZ Order Form _____Yes! I would like to order your 50,000,000 email addresses Plus all the bonuses for only $299. ***********SPECIAL BONUS OFFER***************** Order the registered version of Stealth along with the 50 Million E-mail addresses and we'll knock $100 of the price. Thats right. Stealth retails for $399. If you order the complete package of the registered version of Stealth Mass Mailer that will send up to 300,000 messages per hour and you can have the whole package for just $599. Thats a savings of $100. $$$$$$$$$$ AND $$$$$$$$$ When you order the complete package including the registered verion of Stealth......We'll give you the $350 E-Mail Pro Extractor software absolutely FREE. E-Mail Pro will not only extract thousands of new addresses from the online services and the internet, it is the perfect list management tool. I want the WHOLE Package for $599 plus shipping & handling ______ Send me the CD with 50 Million E-mail addresses only for $299______ *Please select one of the following for shipping.. ____I would like to receive my package OVERNIGHT. I'm including $15 for shipping. (outside US add an additional $20 for shipping) ____I would like to receive my package 2 DAY delivery. I'm including $10 for shipping. (outside US add an additional $15 for shipping) Foreign orders add $10. DATE_____________________________________________________ NAME____________________________________________________ COMPANY NAME___________________________________________ ADDRESS_________________________________________________ CITY, STATE, ZIP___________________________________________ PHONE NUMBERS__________________________________________ FAX NUMBERS_____________________________________________ EMAIL ADDRESS___________________________________________ TYPE OF CREDIT CARD: ______VISA _____MASTERCARD _____AMEX_____DISCOVER/NOVUS CREDIT CARD# __________________________________________ EXPIRATION DATE________________________________________ NAME ON CARD___________________________________________ AMOUNT $____________________ (Required) SIGNATURE:x________________________ DATE:x__________________ You may fax your order to us at: 1-504-757-9988 CHECK BY FAX SERVICES! If you would like to fax a check, paste it below and fax it to our office along with all forms to: 1-504-757-9988 ****************************************************** ***24 HOUR FAX SERVICES*** PLEASE PASTE YOUR CHECK HERE AND FAX IT TO US AT 1-504-757=9988 ******************************************************* If You fax a check, there is no need for you to send the original check. We will draft up a new check, with the exact information from your original check. If you feel more comfortable sending payment through the mail, please send all forms and Check or Money Order to: Gulf Coast Marketing 8867 Highland Rd. Suite 112 Baton Rouge, LA 70808

1 0

Re: The Crime Bill - text re intent requirement
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

In case anyone still doubts me... 103 P.L. 322 Sec. 120005. PROVIDING MATERIAL SUPPORT TO TERRORISTS. (a) Offense.--Chapter 113A of title 18, United States Code, is amended by adding the following new section: " Sec. 2339A. Providing material support to terrorists "(a) Definition.--In this section, 'material support or resources' means currency or other financial securities, financial services, lodging, training, safehouses, false documentation or identification, communications equipment, facilities, weapons, lethal substances, explosives, personnel, transportation, and other physical assets, but does not include humanitarian assistance to persons not directly involved in such violations. "(b) Offense.--A person who, within the United States, provides material support or resources or conceals or disguises the nature, location, source, or ownership of material support or resources, knowing or intending that they are ^^^^^^^^^^^^^^^^^^^^ to be used in preparation for, or in carrying out, a violation of section 32, ?6, 351, 844 (f) or (i), 1114, 1116, 1203, 1361, 1363, 1751, 2280, 2281, 2331, or 2339 of this title or section 46502 of title 49, or in preparation for or carrying out the concealment of an escape from the commission of any such violation, shall be fined under this title, imprisoned not more than 10 years, or both. "(c) Investigations.-- "(1) In general.-- Within the United States, an investigation may be initiated or continued under this section only when facts reasonably indicate that-- "(A) in the case of an individual, the individual knowingly or intentionally engages, has engaged, or is about to engage in the violation of this or any other Federal criminal law; and "(B) in the case of a group of individuals, the group knowingly or intentionally engages, has engaged, or is about to engage in the violation of this or any other Federal criminal law. "(2) Activities protected by the first amendment.-- An investigation may not be initiated or continued under this section based on activities protected by the First Amendment to the Constitution, including expressions of support or the provision of financial support for the nonviolent political, religious, philosophical, or ideological goals or beliefs of any person or group.". SOLONg

1 0

WSJ on RC4
by John Young 17 Dec '03

17 Dec '03

Thanks to David Sternlight for posting pointer to this. -------------------- The Wall Street Journal September 19, 1994 p. B10 -------------------- RSA Data Security Says Exposed Code Poses No Threat By Ralph T. King Jr. Staff Reporter of The Wall Street Journal The anonymous dissemination over the last several days of a software code used to safeguard the privacy of electronic messages in no way threatens the security of existing computer networks, according to the code's owner and encryption experts. However, the defiant act is expected to trigger a trade-secret dispute between the culprit and RSA Data Security Inc., the Redwood City, Calif., company that developed the code. The act also raises thorny legal questions about how public data networks, collectively known as the Internet, may be used. An unidentified person used the Internet to post RSA's encryption code, called RC4, on electronic bulletin boards. The RC4 code works something like a padlock. But knowing how the lock works isn't enough to open it. The system user has an individualized combination or key that prevents access by other parties to private computer messages. RSA's code product is incorporated in numerous popular software programs, including those of Apple Computer Inc., Lotus Development Corp. and Microsoft Corp. Some reports published over the weekend indicated that the disclosure might jeopardize the integrity of computer systems that are equipped with these programs. "This doesn't compromise systems that are in use," says Jim Bidzos, president of closely-held RSA. "This is a misappropriation of our intellectual property. It's a legal issue and it will be pursued." Mr. Bidzos also said officials at U.S. Customs Service and the Federal Bureau of Investigation are investigating the matter. One analyst noted that disclosure of the formula may benefit RSA because some users have questioned whether its code contains the equivalent of secret trapdoors enabling people familiar with it to eavesdrop on private communications at will. As a result, some computer operators have turned to an alternative code whose formula is publicly available. Now it will be clear to interested parties that no such trapdoors exist, Mr. Bidzos said. In any case, RSA is about to release a new encryption code for use with the latest computer-chip architecture, he said. One possible effect of the disclosure is to shed light on the extent of legal liability that applies to people who make copyrighted or protected material freely available on the Internet. Those who use such material under license typically sign nondisclosure agreements. In this case, someone apparently violated a nondisclosure pact and in effect invalidated the protections of RSA, the formula's owner. -------------------- END

1 0

HIT MEN
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Okay, back to basics. David Merriman wrote: But if the system is set up for total anonymity, _who would know_ that an escrow agent was the "bag man"? Just like no one would know who the contractee was, or the contractor: The escrow agent is a publicly known entity. That's how it gets a reputation. How do you imagine an escrow agent could get a reputation for being a murder's bag man if it didn't advertise as such. If it advertises as such, I believe most people would refuse to do any business with it. If it doesn't advertise, how will it get those sorts of clients? There is no reputational incentive to perform the loathsome service, and plenty of incentive to (a) just keep the money, or (b) blow the whistle to the cops and the intended victim (and keep the money). Please note, this was all intuitively obvious from my previous post. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

HIT MEN
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Patrick May accidentally sent this post only to me. In a subsequent note, he asked me to forward it to the list. My response will come in my following post. S a n d y * * *

1 0

National Research Council study of cryptography
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

Subject: The National Research Council study of National Cryptography Policy To interested parties: The committee membership for the NRC's study of national cryptography policy has been finalized, and the project description and final list of committee membership is attached. I specifically call your attention to the part of the project description that invites members of the interested public to submit views on the questions the study will be addressing. The National Research Council appreciates your interest in this project. Please redistribute this message to anyone you think may be interested. A STUDY OF NATIONAL CRYPTOGRAPHY POLICY September 14, 1994 Cryptographic technologies are critical to a wide variety of important military and civilian applications involving sensitive or classified information that must be protected from unauthorized disclosure. In addition, cryptography is a key component of most authentication technologies, i.e., technologies to guarantee the identity of a message's sender. National cryptography policy has important implications for U.S. economic competitiveness, national security, law enforcement interests, and protection of the rights of private U.S. citizens. In an attempt to clarify some of the relevant policy issues, Public Law 103-160 (passed by the U.S. Congress in November 1993) called for a comprehensive study from the National Research Council on cryptographic technologies and national cryptography policy. The study will commence in the first week of October 1994. As this study proceeds, the committee will make all feasible attempts to solicit a wide range of input and commentary from interested parties. Input will be presented to the committee through a mix of briefings, presentations, consultations, invited and contributed papers, and testimony at regional public hearings. In addition, members of the interested public are invited to submit input to the committee as described below. The study plans to address the following issues: * the impact of current and possible future restrictions and standards regarding cryptographic technology on - the availability of such technology to foreign and domestic parties with interests hostile to or competitive with the national security, economic, commercial, and privacy interests of the U.S. government, U.S. industry, and private U.S. citizens; - the competitiveness of U.S. manufacturers of such technology in the international market; - the competitiveness and performance of commercial U.S. users of such technology; - U.S. national security and law enforcement interests; * the strength of various cryptographic technologies known and anticipated that are relevant for commercial and private purposes; * current and anticipated demand for information systems security based on cryptography; * the impact of foreign restrictions on the use of, importation of, and the market for cryptographic technology; * the extent to which current cryptography policy is adequate for protecting U.S. interests in privacy, public safety, national security, and economic competitiveness; * strengths and weaknesses of current key escrow implementation schemes; * how technology now and in the future can affect the feasible policy options for balancing the national security and law enforcement interests of government and the privacy and commercial interests of U.S. industry and private U.S. citizens; * recommendations for the process through which national security, law enforcement, commercial, and privacy interests are balanced in the formulation of national cryptography policy. The study will be conducted by a 17-member committee (listed at the end of this document) that collectively has expertise in computer and communications technology; cryptographic technologies and cryptanalysis; foreign, national security, and intelligence affairs; law enforcement; science policy; trade policy; commercial and business dimensions of computer technology (hardware and software vendors, users of cryptographic technologies); and interests in privacy and civil liberties. A subpanel of the full committee will be cleared at the SI level and have access to all relevant information to ensure that the findings, conclusions, and recommendations of the unclassified report are consistent with what is known in the classified world. The project plan calls for the study to be delivered approximately two years after full processing of all necessary security clearances. However, the NRC will make every attempt to deliver the study sooner, and it currently believes that the core work of the study will be completed about 18 to 20 months after funding for the study has been received. Additional time will be devoted to dissemination of the study report and follow-up activities. The final report of the study committee is subject to NRC review procedures that ensure the objectivity and integrity of all NRC reports. The main text of the report will be unclassified; classified annexes (if any) will be made available only to those with the appropriate security clearances. PROVIDING INPUT TO THE COMMITTEE The questions that the study is expected to examine are provided above. Members of the interested public are invited to submit their views on these questions and any other questions that you believe the committee should be addressing through either of the channels below. If desired, requests for personal presentations to the committee should be submitted through these channels as well; the committee will respond affirmatively to as many such requests as possible, but time and resource constraints will limit the number of such requests that can be honored. Internet: send comments and other correspondence to CRYPTO(a)NAS.EDU. U.S. Mail: Cryptography Project Computer Science and Telecommunications Board National Research Council Mail Stop HA-560 2101 Constitution Avenue, NW Washington, DC 20418 COMMITTEE TO STUDY NATIONAL CRYPTOGRAPHY POLICY Kenneth Dam, committee chair, was Deputy Secretary of State (1982- 1985) and is currently the Max Pam Professor of American and Foreign Law at the University of Chicago Law School. General W. Y. Smith, retired, committee vice-chair, is president emeritus of the Institute for Defense Analyses, and has also served in a number of military posts including that of deputy commander in chief of the U.S. European Command in Germany. Lee Bollinger, formerly dean of the University of Michigan Law School, is currently provost of Dartmouth College and a constitutional scholar. Ann Caracristi, retired, was Deputy Director of the National Security Agency (1980-1982). Benjamin Civiletti was U.S. Attorney General (1979-1981), and is currently in private practice with the law firm Venable, Baetjer, Howard and Civiletti. Colin Crook is senior technology officer for Citicorp. Samuel Fuller is vice president of corporate research at Digital Equipment Corporation. Leslie Gelb is president of the Council on Foreign Relations. He served as Assistant Secretary of State for Politico-Military Affairs (1977-1980). Ronald Graham is a director of information sciences at AT&T Bell Labs and a professor of mathematics at Rutgers University. Martin Hellman is professor of electrical engineering at Stanford University. Dr. Hellman was one of the inventors of public key encryption. Julius Katz is president of Hills & Company, and was deputy United States trade representative (1989-1993). Peter Neumann is principal scientist in the Computer Science Laboratory at SRI International. He is the chairman of the ACM committee on computers and public policy, and a member of the ACM study group on cryptography policy. Raymond Ozzie is president of Iris Associates, a wholly-owned subsidiary of the Lotus Development Corporation. Iris Associates is the developer of Lotus Notes. Kumar Patel is vice chancellor for research at UCLA. Edward Schmults was Deputy Attorney General of the United States (1981-1984) and is a former senior vice president for external relations and general counsel for the GTE Corporation. Elliot Stone is executive director of the Massachusetts Health Data Consortium, which is responsible for the collection and analysis of the state's large health care databases. Willis Ware, retired, is with the RAND Corporation as senior computer scientist emeritus. He chairs the Computer System Security and Privacy Advisory Board which was established by the Computer Security Act of 1987. STAFF AND ORGANIZATIONS Marjory Blumenthal is director of the Computer Science and Telecommunications Board (CSTB). Herbert Lin is study director and senior staff officer of the CSTB. Inquiries about this study should be directed to him at 202-334-3191 or via Internet at HLIN(a)NAS.EDU. The National Research Council (NRC) is the operating arm of the Academy complex, which includes the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The NRC provides impartial and independent advice to the federal government and other policy makers, by applying top scientific and technical talent to answer questions of national significance. In addition, the NRC often acts as a neutral party in convening meetings among multiple stakeholders on various controversial issues, thereby facilitating the generation of consensus. Within the NRC, the CSTB considers technical and policy issues pertaining to computer science, telecommunications, and associated technologies as critical resources and sources of national economic strength. A list of CSTB publications is available on request to CSTB(a)NAS.EDU or by calling 202-334-2605.

1 0

Re: MAIL: crime and remailers
by Lile Elam 17 Dec '03

17 Dec '03

Wow, this just re-inforces my feelings that RSA is scum and Bidzos is at the heart of it and is extream slime and crud... I hated this jerk the first time I met him at a cypherpunks meeting some time ago... Wouldn't it wonderful if he would just crawl back under that scum rock that he came from... Maybe a sniper will hit him someday and free us from having to co-exist with this jerk... It sure is good to know that people don't live forever... :) I just had a terrible thought... what if he's *not* human!!!! the horror, the horror... -lile

2 1

Re: Reserved DC-Net IP addresses - NOT!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

>2) To be interesting, DC nets require physically secure transmission > between neighbors. Given that the internet is not physically secure, > I'm not sure DC nets are going to run on the bare net > any time soon. Presumably one time pads could be used to > implement DC nets in order to maintain "unconditional" security or > public keys could be used to maintain "good" security. > >Perry DC nets don't need _physically_ secure transmission between neighbors, by any interpretation I can think of. Ordinary crypto security, arranged separately from the DC net per se, should be sufficient. For example, swIPe could fit nicely with DC nets. Or any of the usual public key methods. Maybe this is what Perry meant, but some might think from his words that _physical security_ is needed. It is not. Rishab Ghosh in India and Mats Bergstrom in Sweden and Matthew Gream in Australia could all participate in a a Dining Cryptographers Net using only Diffie-Hellman to set up the initial keys. Or using their existing public keys. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

HIT MEN
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Jeff Barber thinks he might have me, but isn't sure enough to dispense with his dunce cap. No need to worry Jeff, I am right, but your reasoning is pretty good, to wit: ... It might be possible to construct [the deal] as "I authorize you to pay the other party if they can produce a certificate that, when decrypted with this key, produces this text." The production of that certificate might only be accomplished through the cooperation of the on-line coroner... Clever, but you have already identified your weak point--the on-line coroner. More on this later. About my SCENARIO ONE (cheating escrow) Jeff offers: Why can't I damage your reputation? Assuming: a)there exists a public place to cast aspersions on your business Granted for the sake of argument. b)that I have a receipt digitally signed by you indicating that you accepted the payment and contract from the two parties Sorry, no can do. Sounds like being an accessory to a crime to me. I wouldn't put anything in writing signed by my known public key, and neither would anyone else. What if our True Names ever became known? Shit happens, you know. c)that I can prove I have "executed" my end of the bargain (pun intended) Here's the rub. What would constitute proof? Not just the fact that the victim was dead--even of foul play. How do you prove, in the "public place" given above, that *you* did the dirty deed? I don't think you can. (And surely, you wouldn't try to argue that you didn't pay me simply because the contract was for murder -- I don't think your potential future clients would relish giving their escrow service the power to judge the moral virtue of their contracts.) I don't know. Some clients would like it, some wouldn't. The market would decide. Don't get too theoretical here. Remember, the vast majority of people think murder is a Bad Thing. I don't think they would give a rat's ass whether or not a murder got paid. This would be *especially* if the escrow passed on some of the dirty money to them in the form of reduced escrow fees. :-) In response to my SCENARIO TWO (fake murder) Jeff wrote: ... in order for this scheme to work, the coroner must be in the business of regularly publishing signed and certified death certificates on the net.... I'm assuming therefore that the life insurance companies and the like will exert sufficiently strong influence to ensure that your scenario is extremely unlikely.... Oh Jeff, you were doing so fine there for awhile. The insurance companies would want to ensure *just the opposite* as long as they were in on the gag. I (the fake murderer) would go to the insurance company as well as the rich uncle. Why? Because they offer rewards for "murderers" who *don't* kill policy holders. The insurance companies, of course, all work closely with the on-line coroner to produce false death certificates to screw over murderers, their clients and/or the escrow companies that do such business. Contrary to popular belief, coroners are against death. No coroner in his right mind would have any problem fooling the bad guys. No electorate, or the private equivalent, would mind a coroner who lied for a Good Reason like helping to prevent murders. Now how do I get this thing off my head ...) No rush, Jeff, you might want to post again on this topic. :-) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Encryption standards & procedures legislation
by gnu 17 Dec '03

17 Dec '03

The House Committee on Science, Space & Technology is thinking about legislation that would lay down the rules for the Federal Government with respect to encryption standards. On July 13, they released a draft bill, which hasn't been introduced as legislation; they are just passing it around for comment. The draft bill is available at ftp://ftp.eff.org/pub/EFF/Legislation/ Bills_by_name/encryption_standards_procedures_94_bill.draft. The draft has both good and bad ideas in it. But I'm writing to you to ask for ideas on what the RIGHT bill would be. Perhaps there should be no legislation about this at all. Perhaps there should be tight controls on encryption standards. There are a myriad of possible positions and side issues, like how would you enforce such a bill? What rights of public input and information should there be? How can the public prevent a rerun of Clipper, in which all the public input was accepted but ignored? What standards should the encryption algorithms themselves meet? Should these standards be mandatory for the federal govt? States? Banks? The public? Simply guidelines for voluntary use? Should anyone be liable if a standard, relied upon, is broken? Was known to be broken when proposed? If keys were released which violate someone's rights? If keys were stolen through inadequate security? Should there be tight procedures for escrowed encryption standards, but fewer controls on non-escrowed standards? What level of risk is acceptable in producing encryption standards? Should standards always be public, or can they be trade secret and/or classified? Must they be public domain, or can they be proprietary? Can NSA control a standard, or should some other agency? Should the people at NSA working on standards for non-classified use be available to the FOIA process, or can they remain behind the NSA's FOIA shield law? Must standardized encryption be exportable? Can export controls be based on non-public standards like RC2? Can a standard be adopted over the objection of NSA? Can a standard be adopted which increases the privacy, security, or accountability of the public even though it decreases the NSA's or FBI's ability to wiretap? Etc. Encryption standards range from algorithms (DES), to protocols (Secure IP, digital cash), to verification criteria (DES validation), to procedural issues (Clipper key access, creation and programming of Clipper chips). I've probably forgotten a few. So, please don't take the current draft as a starting point. Tell me what you think the legislation OUGHT to cover, and why. EFF will be talking to the committee over the next weeks and years. You can too, if you want; Tony Clark is the staff member who released the draft. I'm more interested in ideas -- "what might we be forgetting" -- than in detailed legislative language or anything like that. Thanks! The brainstorming that the net and the Cypherpunks did about Clipper issues raised issues that continue to be troublesome and useful. I'm hoping that we can do a similar job for issues related to encryption standards in general. Feel free to forward this message to other interested parties. I recommend sending ideas directly to me (gnu(a)toad.com) I will summarize the results. CC to cypherpunks(a)toad.com, sci.crypt, RISKS, or elsewhere, if you think it's worthwhile for the larger community to discuss your suggestions in detail rather than as part of discussing and elaborating the resulting summary of issues. John Gilmore Chair, EFF Board Crypto Committee

1 0

Re: THOSE DARNED HIT MEN
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[I'm back to getting mail late, sometimes by days, as Netcom's overloaded servers bounce incoming mail, which means it gets resent some time later. For example, as I write this, I've seen Sandy's "HIT MEN" response to David Merriman, but not Merriman's post. This straggly situation puts me at a disadvantage, but I shall strive to overcome it.] Sandy Sandfort writes: >I don't buy it. Anonymous digital assassins, murder escrows and >all that work fine in an artificial, abstract, game-theory world. >I doubt we'll see much--if any--of it in the Real World. Why? >Because the market is too richly textured not to come up with its >own cultural, ethical and digital fixes. Of course the real world will evolve complex, richly-textured constructs. We all know that. I never presented a claim that the exact, and simple, behavior could be predicted. Markets just don't work that way. >Would you do business with a escrow that was the bag man for >contract murders? I wouldn't, you wouldn't and the vast majority >of people in the world wouldn't. That wouldn't stop some escrows >from performing that service, but it would run up the cost. When >the costs rise high enough, profitable opportunities are created >for false escrows to enter the business. That's just one problem >that can interfere with such an odious endeavor; there are more. I can't follow Sandy's logic here. That I wouldn't use such services, that Sandy wouldn't, etc., is hardly persuasive. Contract killings happen today, after all. Sandy says this "would run up the cost." But from what basis? I've made no predictions about the costs, either with or without the participation in such markets by Sandy or me! What the costs will be is unknown to me, and I don't plan to try to forecast the costs. All I claim is that anonymous escrow services "solve" the specific problem raised earlier about one or more of the parties welshing on the contract. A kind of 'clearing' mechanism. In any case, there are in fact "escrow agents" today for contract murders. Mob families act in this way, putting the "full faith and credit" of their organizations behind such hits. (I'm of course not saying that welshing never occurs, that snags never develop, etc. Like any market, imperfections exist.) The mob families are not cryptographically pseudonymous, naturally, but to the extent the code of omerta applies, the internal transactions and discussions are cut off from outside observation. Reputations matter. If it becomes known that Frankie the Lip took money and didn't make the hit he contracted to do, he'll not get many more jobs (and his Don may send him to sleep with the fishes, for undermining the market value of his own rep). And so on. I won't belabor the point about how organized crime works, except to say that contracts are routinely enforced by a mixture of things, with reputation an important constituent. Yes. the threat of ultimate violence is paramound, and this is of course lacking in the crypto case. So we have to examine areas where only "reputation" matters. I've done this in earlier posts on this very topic. >I think the best way to illustrate that the anonymous murder >business is nothing more than a bugaboo, is to set the best minds >on the planet--Cypherpunks--to work on the problem. Let's all >put our thinking caps on, and come up with answers to the follow >hypothetical situation: > >Let us assume a world with totally anonymous communications and >payments (strong crypto, remailers, digital cash, etc.). > >1) How would YOU scam money from the system without actually > knocking anyone off? Or in the alternative, > >2) How would YOU use technology to address the problem from > police/private investigator perspective? > >I'm betting that with no more than a few moments of thought, >Cypherpunks will come up with a ton of hacks. To get the ball >rolling, here are two from me: > >SCENARIO ONE > >I set up a meat-and-potatoes escrow business. I keep my nose >clean. I honor my obligations. I build up a good reputation. >At some point, I'll be approached by a murderer and the person >who is hiring him or her. I'll accept the payment. When the >murder is committed, I won't pay off. The murderer will (a) sue >me (I don't think so), (b) damage my reputation (I'll leave this >one as an exercise for the student), or (c) murder *me* (ah, but >first he has to find me; in the world we posit, that won't be (a) The party to the escrow transaction posts a transcript of the communications from the escrow agent, including his digitally signed statements, and produces proof that he upheld his end of the bargain. He then says: "Al's Anonymous Escrow" announced they were holding money for this job, as you can see. I did the job, as you can see from the digitized images I took at the scene, and now Al won't pay up. I call him a liar. I plan to move my business to "Murder, Incorporated," which seems to have a much better attitude." Al cannot deny that the escrow arrangement was made, due to the digital signatures (all handled via anonymous pools or similarly untraceable means, it should be emphasized, despite the obviousness). Al can of course claim that the hit was not made, that the presenter of the evidence was not the actual hitter, etc. (if the party to the signed transaction is also the presenter of the digitized image of the murder scene, for example, that would be mighty compelling evidence that the party was in fact centrally involved). (b) damage to reputation. Sandy leaves it as "exercise for the student," but I think the point I just made shows that fully pseudonymous agents can still present evidence to the court of public opinion and have their reputations influenced positively or negatively. Reputations will still matter. (Again, nothing in my arguments presumes to speak to what the market costs will be, how long it will take reputations to evolve, etc. I have some ideas, but won't make them right now.) (c) retaliating physically against the escrow agent. This is straw man, as we all know. >very easy). If this scenario happens very often, it'll take all >the profit out of the murder business. If an escrow agent does this very often, he'll lose all his business. Opportunity for an agent who takes his reputation more seriously to then gain market share. Just as with Swiss banks who can claim an account was closed by the customer. Since signatures are so easy to forge, relatively speaking, this ought to happen a lot, right? Of course, it happens almost not at all (so far as I've ever heard), because of the points about reputations, future business, etc. Lots of points here, and I'm not planning to get into a massive discussion of why and how illegal gambling (bookies, for example) works this way. (I'll just make the aside that Sandy's arguments apply to bookies the same way: bookmaking can't thrive, because some or most bookies will cheat their customers and their customers can't sue them, can't affect their reputation, and can't physically attack them. The key is that cheated customers can and will "spread the word." This applies, with some minor (but interesting) wrinkles, to crypto-mediated bookies. They're all closely related issues...) >SCENARIO TWO > >I set up a phoney murder-for-hire business. Someone contracts >with me to bump-off their rich uncle. The client deposits my >payment with a reputable escrow company, "Murder Escrows R Us." I >go to the uncle and tell him the whole deal. Using digital >technology, bribed coroners, etc., we fake his death. When the >news hits the Net, the escrow pays me off. The uncle comes back >to life, disinherits whomever he suspects wanted him dead. And I >laugh all the way to the digital bank. I create a new pseudonym, >place another murder-for-hire ad, and do it all again. Given our >Brave New World, nobody can touch me. This just says that standards of proof will be a factor, naturally, and that markets will take these into account. The phoney murder for hire business, call it "Sandy's Salvage Company," will start of with a very low reputation, as with any new outfit with little track record. The standards for proof, the fees paid, etc., will be proportionately affected. However, "Tim's Tribunal," which has had a 5-year record of "really and truly" offing dozens, and which has not been "caught" as being in any of the scams Sandy described, will demand and get a proportionately higher fee, and will face fewer delays in being paid. (Similar arguments apply to any of the parties, which is why I've followed Sandy's lead in switching the focus from how to handle cheating escrow agents to cheating contract killers.) I've written enough. I'm not persuaded by Sandy's arguments that the threat of cheaters is sufficient to derail these markets. It hasn't derailed them in the real world. It won't in the less traceable but even more reputation-critical crypto world. Again, I've made no claims to how ubiquitous such markets will be, or what the market dynamics will be. Only that strong crypto makes possible certain types of markets which are now very illiquid. The issue of "untraceable cheaters" comes up in many more areas than just contract killings: information markets, pseudonymous consulting, etc. This is why reputation, so important in the physical/legal world, is also so important in the crypto world. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: MAIL: crime and remailers
by Blanc Weber 17 Dec '03

17 Dec '03

From: Lile Elam Wow, this just re-inforces my feelings that RSA is scum and Bidzos is at the heart of it and is extream slime and crud... ........ Maybe a sniper will hit him someday and free us from having to co-exist with this jerk... ............................................................... Well, you know, there was that threat from the NSA guy to run him over . . . wonder if the offer still stands. Would that make you feel better? :>) Blanc

2 1

Re: MAIL: crime and remailers
by Lile Elam 17 Dec '03

17 Dec '03

>From blancw(a)microsoft.com Wed Sep 21 16:28:31 1994 > Well, you know, there was that threat from the NSA guy to run him over . . . > wonder if the offer still stands. >Would that make you feel better? > >:>) >Blanc Yes! I would feel like the air was cleaner and the skies bluer. :)

1 0

Re: HIT MEN
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >C'punks, > >Okay, back to basics. David Merriman wrote: > > But if the system is set up for total anonymity, _who > would know_ that an escrow agent was the "bag man"? Just > like no one would know who the contractee was, or the > contractor: > >The escrow agent is a publicly known entity. That's how it gets >a reputation. How do you imagine an escrow agent could get a >reputation for being a murder's bag man if it didn't advertise >as such. If the escrow agent has a reputation for reliability, honesty, integrity, etc, then the nature of the transaction is irrelevant. Any reasonably intelligent hit man would have sense enough not to commit all his 'business' to any single escrow agent, just as no reasonably intelligent C'punk would trust all his/her mail to a single remailer. I still don't see the problem: the whole process is anonymized. There is no reason that the escrow agent would have to know *why* the "money" is in escrow, nor who the financer is, nor who the recipient is to be. All that is necessary is for the hit man to provide suitably disguised/encrypted evidence that the terms have been met. Presumably, the person contracting the hit would be aware of how to go about setting all this up would have sufficient wit to establish a means of independent validation; if not, then the hit man would certainly have sufficient motive to do so :-) > If it advertises as such, I believe most people would >refuse to do any business with it. If it doesn't advertise, how >will it get those sorts of clients? The only *fundamental* feature of an escrow agency is it's reputation for reliability/stability/security/etc. The nature of the transactions simply don't matter, just as a remailer's reliability is based on it's up-time, cycle time, input/ouput isolation, etc, regardless of the nature of the messages passing through it. What sorts of clients? The ones that pay the escrow fee? Doubtless, the escrow agency would have a means of ensuring their own payment :-) > There is no reputational >incentive to perform the loathsome service, and plenty of >incentive to (a) just keep the money, or (b) blow the whistle to >the cops and the intended victim (and keep the money). Please >note, this was all intuitively obvious from my previous post. True enough - *but only as long as the nature of the service could be identified*, which would not apply to a properly operated escrow agency. Dave (adjusting Nomex undies under asbestos coveralls) Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: MAIL: crime and remailers
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>From: Lile Elam > >Wow, this just re-inforces my feelings that RSA is scum and Bidzos >is at the heart of it and is extream slime and crud... > ........ >Maybe a sniper will hit him someday and free us from having to co-exist >with this jerk... >............................................................... > >Well, you know, there was that threat from the NSA guy to run him over . . . >wonder if the offer still stands. > >Would that make you feel better? > >:>) >Blanc > > Only if it could be worked through an anonymous remailer system and blind escrow agent :-) Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: HIT MEN
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[For some odd reason, I'm only seeing Sandy's posts on this subject, not those of Merriman, Barber, or Mays.] >Patrick missed my irony. Murders can't hurt any escrow's >reputation. To do so, they have to admit to being murderers who >were stiffed by the escrow. NOT BLOODY LIKELY. For murder >escrows, a positive reputation is meaningless. They can't--nor >can anyone else--risk exposure of such negative information. >Escrows that admittedly engage in abetting criminal acts can have >NO MEANINGFUL REPUTATIONS. That's just not true. Currently, many organizations--some known widely, some shadowing, some essentially anonymous--count on their reputations for being efficient, cold-blooded murderers as a means to scare off competitors, increase their market value, etc. From Jamaican gangs who execute the families of their targets to the CIA's Phoenix Program operatives who mutilated their victims horribly, such "reps" are highly useful. To paraphrase Sandy, "BLOODY LIKELY." Admitting to engaging in a criminal activity is not at issue--remember, all parties are cryptographically protected and what they "admit" to doing cannot reflect upon their physical/legal identities, only their digital reputations. And those who contract for such services, via their pseudonyms, can "admit" to wanting to buy such a service. (The issue of whether a well-respected nym like "Locke" would want to publicize a failed hit on his arch-enemy "Demosthenes" is a separate issue, which I won't conflate with this one.) Gambling is illegal in most places, unless run by the state. And yet people gamble, illegally. They use bookies. Bookies who are doing illegal things, as the gamblers are. And yet if they get stiffed by a bookie, which _sometimes_ happens, they tell their friends, family, etc., and the reputation ripples spread. Taking Sandy's "For murder escrows, a positive reputation is meaningless. They can't--nor can anyone else--risk exposure of such negative information. Escrows that admittedly engage in abetting criminal acts can have NO MEANINGFUL REPUTATIONS." argument, are we to assume that this applies to illegal betting? That stiffed bettors won't speak up because there are "Escrows that admittedly engage in abetting criminal acts can have NO MEANINGFUL REPUTATIONS"? Crypto barely changes things, except to make outside interference less likely. If, for example, Black Unicorn offers to transfer 100 Ghost Marks to Pr0duct Cypher, for some C programming, and he doesn't feel he got his money's worth, he can publicize it. Maybe we believe Black Unicorn, maybe we don't. Maybe we ask to hear Pr0duct Cypher's side of the story. Maybe we suggest that SOLONg act as a third party escrow agent. And so forth. Not perfect, in some abstract sense of ultimate truth always coming out, but reputations do indeed matter. And whether the deeds contracted for are heinous or noble depends on your point of view. To William Colby and the Viet Cong, the taking of ears and other body parts by the Phoenix assassins was a fearsomely reputable thing to do, regardless of what the 4H Club in Skokie might have thought about it. If I contract with "Sandy's Salvage--You Pay, We Slay," I want to hear that they've got some satisfied customers. (Yes, flooding of reputations is an issue. Same issues as arise in DC Nets. Same kinds of solutions.) Again, I've written too much, so I'll stop for now. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 4

MAIL: Professional Crime
by Blanc Weber 17 Dec '03

17 Dec '03

From: David K. Merriman Only if it could be worked through an anonymous remailer system and blind escrow agent :-) ............................................................... Well, hey - a real working model! Something to measure the system against! Blanc

1 0