December 2003 - cypherpunks-legacy

Export control FTP servers
by Rich Salz 17 Dec '03

17 Dec '03

> I do what RSADSI does with ftp.rsa.com. It requires a cronjob >and sed. I didn't get the NSA to approve it, but I figure if it's good >enough for RSADSI it's good enough for me. I believe some of the following has been posted here before. The person to speak with is John Sonderman Office of Defense Trade Department of Compliance 703 875 6644 He's supposed to be Internet-aware. What's not common knowledge is that he's leaving by early December for budgetary reasons. If you're thinking of putting export controlled stuff up for FTP, you should probably contact John now. /r$

6 6

ecash protocol: Part 1
by Ian Goldberg 17 Dec '03

17 Dec '03

Well, I dropped off the net for a few days due to a midterm, but I'm back now... Last week, I was taking a look at the ecash protocol (no, I don't have a copy; I have a binary, which I can't even run...). I've managed to decipher a useful bit of the first message sent from the shop to the payer. It's the Payment Request, and contains the following information: o Header identifying packet as Payment Request o The integer 4 o The payment amount, in cents o The time (seconds since 1970) o The integer 79 o The name of the shop (payee) o A description of the item being paid for o An empty string o The integer 0 o End of Record marker I don't know what the 4, 79, empty string, and 0 are for. I assume one of them (probably the 4) is some indication of currency (US cents). I can provide a byte-level description of the record, if people want. I guess the important bit is that the payee, the item being bought, and the cost are sent _in the clear_. Some of the people I've talked to think this is a huge privacy breach, and some don't. You all can debate this now. Lucky can, if he wishes, add insight, and/or tell us what DC may do about this. I'll try to figure out the rest of the fields, and some of the other messages (like the payment itself). - Ian "Why exactly isn't DigiCash releasing the protocol? What about the source?"

5 5

Re: Are there enough FBI agents to handle Digital Telephony?????
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:05 AM 11/21/95 -0500, Peter Wayner wrote: >Has anyone ever done the math on the FBI's new wire tapping >proposals and determined whether they'll have enough agents to >do all of the listening? Doesn't a court ordered wire tap >require that people listen in and screen the recordings. Does No. Automatic equipment (pen registers) is almost as old as wiretaps. >12,500 agents would cost $1.2 bill on a year if they each cost >about $100,000 in salary and benefits. But we need to account >for vacations, shift work and testifying the trials of the drug >lords who are sent to jail. Let's assume that you only need >1/10th the people to handle the two evening shifts. That gives >you a cost of $1.4 billion before vacations. Adding 40% to cover >vacation and weekends puts you close to $2 billion. Let's round >up. The bodies are still needed for management, analysis, arrest, prosecution, and punishment. Until Robocop is deployed, the criminal justice system will be a labor intensive effort. This is still good news for us though. Anyone who's been in business (say George McGovern after his Connecticut inn bankruptcy) can tell you that people are the most expensive part of a business. You pay all that cash each year and at the end of the year you have nothing concrete to show for it. You are just buying time. Labor costs become more of a problem as the quantity and value of capital goods increases since the more slowly increasing factor (labor) is bid up. Thus people cost a lot more these days than they did in 1800 because capital goods (per unit) are much cheaper than they used to be. (Ignore temporary changes in returns to labor as women, 3rd world residents, or freed commie slaves join the labor force. They are quickly absorbed. Wants are unlimited.) Now the increasing cost of labor is not a problem if those workers are producing goods of value. They are "making" their own earnings. If they are in a parasitic profession, however, -- one that subsists on what it steals from others -- the rising cost of labor means that that institution has to steal more and more to keep up. Eventually, the speed of economic change can swamp the theft ability of such an organization. Such swamping occurs because market entities support their own growth or they don't grow. Since they lift themselves up, growth is unlimited. Parasitic entities on the other hand are limited by the strength and susceptibility of their host. Hosts may weaken if the parasite grows too much or it may find a way to cast off the parasite. No one rejects a market economic actor that is a potential customer or employer but parasites are rejected whenever possible. Market Earth on the nets gives us many opportunities to both fuel fast growth and shake off parasites. It is perfectly possible for markets to outbid the secret police for the labor of its agents given the compound growth rates that are a feature of friction-free capitalism. DCF "Don't call it Anarchy. Call it Disintermediation."

1 0

Re: Java & Netscape security [NOISE]
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 17 Nov 1995, Dr. Dimitri Vulis wrote: > m5(a)dev.tivoli.com (Mike McNally) writes: > > Frederick B. Cohen writes: > > > This is baloney. When you work for Netscape or Sun and speak about > > > your company's products, you are representing the company whether you > > > disclaim it or not. > > > > Baloney. > > Fred is right. I used to work for Goldman Sachs & their internet usage > policy stated that when you write to Internet or Usenet from a GS account, > it will reflect on the firm no matter how you disclaim it. I think this is true, and is where we start to get into reputations and trust. If someone from Goldman Sachs posts to a Usenet group discussing abortion or gun-control, and says that: "These opinions are my own and not my employers." Then, we can accept that, no matter how silly their opinions are. But there is a difference in the way we look at it if someone from Goldman Sachs posts to misc.invest.stocks instead and says that the Goldman Sachs Strip Coupon Fund is better than the one from Merrill Lynch -- that it's safer and produces higher returns because Goldman uses cubic spline interpolation methodologies to interpolate the yield curve, while Merrill Lynch doesn't. There is a difference here. In the first case, the poster is not commenting about anything to do with their work, -- it really is just one man's opinion -- while in the second they are actually commenting upon something their employer is selling. If the employee tries to add, "these opinions are my own, and do not reflect the opinion of my employer" then we have a huge credibility problem. You really can't have it both ways. You can't post officially and unofficially at the same time, unless it really does have nothing to do with your work. If you post from Sun Engineering, and you are posting to a group that focuses on Sun, and you are talking about a Sun product, then people are going to take your comments as an official statement from Sun. You are that product's spokesperson, whether you disclaim or not, and should act accordingly. No matter what, that's the way people are going to see it. It's a huge responsibility ... it's not like speaking candidly at an open Member's table at the Rideau Club or anything, like that. Sun and Netscape and AT&T should know this. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

3 3

Re: Virus attacks on PGP
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 14:52 11/20/95 -0800, Thomas E Zerucha wrote: >... The code can also be cross compiled >and burned onto a CDROM which would make it difficult to infect. Certainly having PGP run from a CDROM or other read-only device would be a big help. Even better would be to have all the privileged code also run from a read-only device. Bill Frantz

4 3

Re: "Junk E-Mail"
by Rich Salz 17 Dec '03

17 Dec '03

>RICO is very serious stuff. Criminal prosecution under the terms of the Like Operation Rescue? Wrong again, Alice.

1 0

Re: "Junk E-Mail"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Mon, 20 Nov 1995 hallam(a)w3.org wrote: > I think it would be better to slap a RICO suit onto the company > concerned. It sound to me like an attempt to gain financial advantage > through threatening behaviour. Where I come from that means jail time. RICO is very serious stuff. Criminal prosecution under the terms of the Racketeer-Influenced & Corrupt Organizations Act is reserved for very serious situations indeed. It's true "rubber hose" stuff. It was intended as a tool for use against mobsters, but US attorneys have used it against white-collar criminals. I think, you'd have to have strong evidence of an ongoing "criminal enterprise", which I don't think you have with junk e-mail. I doubt that there are many experts in RICO as it applies to computer law. I really don't know if the laws pertaining to breaches of computer security would be applicable, or not, or how RICO really does work or fit. Although the armchair solicitor in me might speculate that you'd have to show some form of organized collusion or somesuch to breach computer or network integrity to prosecute under RICO. And you'd have to show -- I'm uncertain if the standard is beyond a reasonable doubt or not -- that it was at some point willful and well-organized. I suppose that is a moot point though, when we're talking about pre-trial forfeiture of all assets -- right down to the food in the refrigerator. I doubt at that point that a trial would be forthcoming. It really does reinforce the maxim, that it's best not to fight a battle that you cannot win. RICO is very persuasive that way. I'm certain that there will be those who would say that it's not administratively possible to apply RICO to this situation. Most legal advisers would probably say that it can't be done, but I suppose then, that would be the time for the clarion call, "Then get me a lawyer who says it CAN be done." Personally, however, I'm unconvinced, and would defer to those much more knowledgable in such matters. Although, in all honesty, RICO and computer networks in the same sentence literally scares the be-jeebers outta me. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

cryptl99.zip Free encryption library for DOS/UNIX/Windows (fwd)
by Enzo Michelangeli 17 Dec '03

17 Dec '03

Found on sci.crypt, apparently not yet posted on this list. I haven't examined it at all, caveat emptor. The size of the ZIP file is about 148 Kb. Enzo ---------- Forwarded message ---------- Path: news.hklink.net!hpg30a.csc.cuhk.hk!cuhknntp!news.uoregon.edu!cs.uoregon.edu!reuter.cse.ogi.edu!hp-cv!hp-pcd!sdd.hp.com!swrinde!newsfeed.internetmci.com!in1.uu.net!brighton.openmarket.com!decwrl!waikato!auckland.ac.nz!news From: pgut01(a)cs.auckland.ac.nz (Peter Gutmann) Newsgroups: alt.security,comp.security.misc,sci.crypt Subject: cryptl99.zip Free encryption library for DOS/UNIX/Windows Date: 20 Nov 1995 09:57:45 GMT Organization: University of Auckland Lines: 45 Sender: pgut01(a)cs.auckland.ac.nz (Peter Gutmann) Message-ID: <48pjep$7ge(a)net.auckland.ac.nz> NNTP-Posting-Host: cs26.cs.auckland.ac.nz X-Newsreader: NN version 6.5.0 #3 (NOV) Xref: news.hklink.net alt.security:6498 comp.security.misc:5814 sci.crypt:6827 [This was announced a few days ago, I've reposted it to a few crypto and security groups for people who don't read the archives groups] File name: ftp://garbo.uwasa.fi/pc/security/cryptl99.zip One line description: Free encryption library for Unix/DOS/Windows This encryption library provides a universal interface to a number of conventional-key encryption algorithms. The library currently supports encryption algorithms and modes of MDC/SHS CFB, DES ECB, CBC, CFB, OFB, PCBC, triple DES ECB, CBC, CFB, OFB, IDEA ECB, CBC, CFB, OFB, RC4, SAFER ECB, CBC, CFB, OFB, and SAFER-SK ECB, CBC, CFB, OFB. All encryption routines are accessed through a single standardised interface with parameters such as algorithm, mode and key size being selectable by the user. The library is supplied as source code for Unix, DOS, and the Amiga, and as dynamic link libraries for Windows and Windows NT. The design goal for the library was to create an easy-to-use, standardised interface to a number of popular encryption algorithms. Like the standard C file I/O libraries which work with FILE objects, this library works with an "encryption context" of type CRYPT_INFO. To encrypt data, you create an encryption context, load a user key into it, en/decrypt data, and destroy it when you've finished. This concept lends itself to implementation either as a C++ class or as C routines. The library has been written to be as idiot-proof as possible. On initialization it performs extensive self-testing against test data from encryption standards documents, and the API's check each parameter and function call for errors before any actions are performed, with error reporting down to the level of individual parameters. The library API serves as an interface to a range of plug-in encryption modules which allow encryption algorithms to be added in a fairly transparent manner. The standardised API allows any of the algorithms and modes supported by the library to be used with a minimum of coding effort. As such the main function of the library is to provide a standard, portable, easy-to-use interface between the underlying encryption routines and the user software. All code is plain ANSI C, with no machine or OS-specific functions or calls being used. Peter.

2 1

Re: Syrinx Remailer is no more
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is the kind of announcement which really needs to be authenticated. I will leave syrinx on my list until I see a signed message confirming this announcement. If we do not bother to authenticate this kind of message, why bother with all the crypto, here is the mother of all denial of service attacks. -Lance At 7:22 PM 11/21/95, Sam Kaplin wrote: >Effective immediately syrinx(a)c2.org is no more. I no longer have the >time to keep this remailer up and running. Perhaps somewhere down the >line I will set up another one. Please remove Syrinx from your chains. > >Sam -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMLK1+vPzr81BVjMVAQHgoAf/TpVsZ+St9vz4ix5PLaabP60ybJRATE+V t2iBxQmxRqhOcdVPZJU1An5pUdCOCgB3amLXNJXkMnoOasi/0ps3igOw0uFaFUf8 ZgCvM4MfNsdPfduCRfsb+5a1IvTkhmP6oapX9lUXDB5a4nHRQvtXkt96sg2hgaIj sqwPpGFaFvLhkiqQ971CL3+EV4+0GkZ3iH2g5pQ2BD6iACVBReINgCuyi/LiNbvZ yGBguPb38VTCDWbzancgQVrMEzTdwcQrmhfhHDO/5H5g6reWrEMioKGWScTZgxH1 fMs40LXxwu25cUziywYjgw9uhEEQu1K1GY7sVE3CoPPenRfcKAutsA== =c2AJ -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: toolkits?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... On Wed, 8 Nov 1995, Daniel R. Oelke, <droelke(a)aud.alcatel.com> wrote: > > Now were getting specific. These are things that us ordinary folk can do > > which show the 'leaders' how to follow. What software, hardware, > > applications, support and sysadmin experience is required and where is it > > available on what terms. What are the cash flow opportunities to support > > such services? By "cash flow-opportunities", is this the "opportunity-cost" of providing services?? The foregone profits of today. Or is this the future cash flow opportunities which could arise from this type of activity. The future assets of tomorrow? Essentially, doesn't all of this reduce to "valuing" in present dollar terms (i.e. attaching a discounted present value through some appropriate hurdle rate) to some level of future benefit. The real issue as I see it, is finding some way to actually "fund" that hazy discounted present value. > A good service would be to provide and support distribution of > of privacy enhancing tools to universities and companies that > want them. i.e. have people who will help set up firewalls, > PGP, encrypted telnet (pick your flavor), etc. As long as it of course *obviously* excludes product like Netscape Navigator -- the black-box code with significant security holes and flaws -- I'd have to agree that this is in fact a very good idea. But it requires forward-thinking. It's no different actually than paying someone for what they know, rather than paying them for what they do. > Yes - I know that most of this stuff is out there already, > but having people *willing* to integrate it for you without > charging an arm and a leg would go a long way towards convincing the > suits that this is a *good* thing. It sounds good on the surface. In fact the liason officer / integrator might even establish some valuable "working relationships". I think that this form of thinking is what will define who will be long term players in this industry -- and who won't. Those who are able to build "goodwill" will survive and flourish, while the others will flounder. If I may paraphrase, I believe that Dan is speaking possibly of loss-leader services. Services which do not in actuality show presently as "high value-added" under our antiquated systems of accounting and measurement. Services which might in fact reduce short-term "profits" because they are "current-expensed" rather than being recognized as the deferred assets, they in fact truly are. (Essentially, the same problem we've visited with R&D expenses. The problem where the "solution" is defined as cutting R&D expense, so that there is increased "profit", although long-term health and corporate competitiveness is actually weakened. A true management accounting paradox.) There should be a re-focus onto a horizon that is somewhat longer than the current quarter. Or the current day, for that matter, or the current moment. Unfortunately, these types of "forward-thinking" plans and projects all require current funds. Money. And lots of it, before they start showing and generating "measurable" returns. It really is the laying and strengthening of foundations. And who has the authority to spend any money on "wasteful" foundations?? If no one funds these types of projects, either jointly or individually, then these projects and bright ideas invariably go absolutely nowhere. > Dan > ------------------------------------------------------------------ > Dan Oelke Alcatel Network Systems > droelke(a)aud.alcatel.com Richardson, TX Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Applied Cryptography case filings on the Web
by Phil Karn 17 Dec '03

17 Dec '03

The government has filed its Motion to Dismiss, or In The Alternative, For Summary Judgment in the case of Karn vs State Dept. This case challenges the arbitrary Commodity Jurisdiction Request rulings made for the book Applied Cryptography and for a floppy disk containing the same source code printed in the book. I've begun scanning in and HTMLizing the various government documents, some of which are sizeable. As I finish them I'm putting them up on my web page. Please feel free to pass around this URL: http://www.qualcomm.com/people/pkarn/export/index.html --Phil

1 0

Re: Get your own ITAR
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

I just called this number and was given the following instructions: Fax your request to (703)875-6647 Attn Donna Davis, include your name and address. Allow 10-15 days for US mail or include your Fed-Ex account number for faster service. Enjoy, Dan > > 1 703 875 6644. > The kindly administrative assistant there will take your name and address > and send you a hardcopy of the ITAR regulations. I don't know about > overseas mailings. I also imagine you will have to wait until the current > US budget stale-mate is resolved. (Thanks to digest-reader walt(a)osf.org > for the phone number.) > /r$ > ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: "Junk E-Mail"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 21 Nov 1995, Rich Salz wrote: > >RICO is very serious stuff. Criminal prosecution under the terms of the > > Like Operation Rescue? My apologies, I'm sorry but I don't understand this reference. What does Operation Rescue have to do with the seriousness of RICO? What is Operation Rescue? I am definitely not an expert on foreign statute. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Are there enough FBI agents to handle Digital Telephony?????
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

Has anyone ever done the math on the FBI's new wire tapping proposals and determined whether they'll have enough agents to do all of the listening? Doesn't a court ordered wire tap require that people listen in and screen the recordings. Does this have to be in real time? I can't remember, but I think there is a fairly onerous evidentiary chain required to use this technology. For instance, if 1% of America is on the phone during the peak hours of the day, then that puts 2.5 million Americans on the phone or 1.25 million conversations. If the FBI wants access to 1% of that, that is still 12,500 simulataneous conversations. That would seem to imply 12,500 people to listen to the tapes, right? Would that take agents off the streets? 12,500 agents would cost $1.2 billion a year if they each cost about $100,000 in salary and benefits. But we need to account for vacations, shift work and testifying the trials of the drug lords who are sent to jail. Let's assume that you only need 1/10th the people to handle the two evening shifts. That gives you a cost of $1.4 billion before vacations. Adding 40% to cover vacation and weekends puts you close to $2 billion. Let's round up. So it would cost $2 billion just to use the information here. This leads me to believe that they're thinking of building automatic voice recognition equiptment in the future. What does anyone think of the numbers? -Peter Wayner

6 5

toolkits?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

[note cunning copy of Alice type quoting style, and cunning use of the same remailer as the last in the chain] On Tue, 21 Nov 1995, Russell Nelson wrote: > anonymous-remailer(a)shell.portal.com writes: > > Alice here ... > > How do we know this for a fact? We don't. As an incentive for Alice to generate herself a PGP key, I hereby place Alice on notice that if she doesn't sign her next post, and provide a PGP key, I will create one for her, and steal all the postive (?) reputation that she has developed so far. You have 24 hours Alice, otherwise a key gets posted to here, and to the keyservers with your nym on it. [someone masquerading as] Alice de 'nonymous ... [who will soon steal her nym (as an experiment in Nym misappropriation, and reputation theft from those who don't use authentication). Evolution in action :-)] ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Are there enough FBI agents to handle Digital Telephony?????
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Has anyone ever done the math on the FBI's new wire tapping >proposals and determined whether they'll have enough agents to >do all of the listening? Hettinga's Corollary to Gilmore's Law ("Censorship is Damage") In a geodesic network, one node can't route all the traffic. It will choke. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

FW: Electronic Commerce and the Internet (6/96 CACM)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text From: Fisher Mark <FisherM(a)is3.indy.tce.com> To: www-buyinfo <www-buyinfo(a)allegra.att.com> Subject: FW: Electronic Commerce and the Internet (6/96 CACM) Date: Tue, 21 Nov 95 09:21:00 PST Encoding: 61 TEXT >From the net-happenings list... ========================= From: Gleason Sackman <sackman(a)plains.nodak.edu> Date: Mon, 20 Nov 1995 10:36:42 -0600 (CST) Subject: WWW> CALL FOR PAPERS: Electronic Commerce and the Internet From: raustin(a)netcom.com (Rick Austin) Date: Fri, 10 Nov 1995 03:11:56 GMT Call for Papers: Interested authors are encouraged to submit manuscripts for feature articles on Electronic Commerce and the Internet. Six papers are sought for a special feature for the June 1996 issue of the Communications of the ACM (CACM). Co-Guest Editors for the feature are Rick Austin and Ray Pyle of the Bell Atlantic Internet Services Center. Guidelines: Articles should be written for a general audience consisting of a range of experience and backgrounds, but aimed at the general practitioner. 7000 to 10,000 words 3 to 5 graphic inserts (optional) Topics: Internet Security Electronic Commerce Security Digital Signature Digital Cash Firewalls and gateways MIME and attachments Integrated EDI/Internet Effectiveness of the Internet for commerce Advances in Electronic Commerce Etc. Schedule: Finished manuscripts and Author Bio due December 1, 1995. Editors comments back by December 15, 1995 Photo Ready copy due Jan 10 1996. Mail or Email to Raymond Pyle 13100 Columbia Pk E47 Silver Spring, Md. 20904 raymond.h.pyle(a)bell-atl.com ====================================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Using anon.remailers
by Eric Anderson 17 Dec '03

17 Dec '03

Would someone point me to where I can read about how to use the cypherpunk and mixmaster type of anon.remailers? Thanks, Eric

1 0

Fwd: Corporate Crime and CDT Funding on behalf of so-called medical privacy
by JWRCLUM＠aol.com 17 Dec '03

17 Dec '03

--------------------- Forwarded message: From: gcook(a)tigger.jvnc.net (Gordon Cook) Sender: med-privacy(a)essential.org Reply-to: gcook(a)tigger.jvnc.net To: med-privacy(a)essential.org (Multiple recipients of list) Date: 95-11-20 22:44:48 EST The following article appeared in the current issue of Corporate Crime Reporter (Volume 9, Number 44, November 20, 1995, page one). It is redisseminated on the Internet with the permission of CCR. SELF-PROCLAIMED "PUBLIC INTEREST" GROUP HEAVILY FUNDED BY COMPUTER, TELECOMMUNICATIONS, DATABANK CORPORATIONS THAT WOULD BENEFIT FROM "MEDICAL PRIVACY" LEGISLATION GROUP SUPPORTS -- EQUIFAX, TRW, DUNN & BRADSTREET IN THE MIX The Center for Democracy & Technology (CDT), a self- proclaimed "public interest organization," is in fact heavily funded by large private computer, telecommunications, and databank corporations. Funders of CDT, a two-year old Washington, D.C.-based advocacy organization, include Dunn & Bradstreet Corp., Equifax Inc., and TRW Information Services, three large databank corporations that stand to benefit from federal legislation CDT actively helped shaped and is shepherding through Congress. This year, CDT has received $699,643 from more than 30 large corporations, including $100,000 from Microsoft, $75,000 from AT&T, $60,000 from Bell Atlantic, $50,000 from Apple Computer, $25,000 from IBM, $10,000 from TRW Information Services, $10,000 from Dunn & Bradstreet, $5,000 from Direct Marketing Association, and $5,000 from Equifax Inc. (For a complete list of CDT's funders, see At A Glance, page 16) At a hearing before the Senate Labor and Human Resources Committee last week, CDT deputy director Janlori Goldman said that CDT "strongly supports" legislation, S. 1360, sponsored by Senators Robert Bennett (R-Utah) and Patrick Leahy (D-Vermont), because it represents "the most comprehensive and strong privacy bill the Congress has yet considered in this area." But opponents of the bill argue that the legislation is not a privacy statute at all, but instead is a vehicle that would legitimize the creation of large computerized databanks of personal medical information, thus benefitting those companies like TRW and Equifax that give financial support to CDT. The legislation would allow for broad, unauthorized searches of those databanks, opponents claim. In an interview, Goldman told Corporate Crime Reporter that all of CDT's corporate funding is earmarked for other projects and that none of the corporate funding is supporting her work on the medical privacy bill. "The corporate funding is not related at all, in any way shape or form to my work on this bill," Goldman said. "The reason we are doing this bill is that I've worked on privacy issues for a decade. The most important privacy issue to work on is the passage of the medical records privacy legislation. That is a very sincere issue for me." "None of the corporate support that CDT gets is related to my work on this bill," Goldman emphasized. "None. Zippo." CDT's executive director, Jerry Berman agreed. "We have no funding for the medical privacy project -- zero," Berman said. But critics of the CDT's position on the legislation were skeptical. "During the Senate hearing this week, Senator Bennett was angered at the suggestion that S. 1360 was an industry bill," said Jamie Love of Ralph Nader's Center for Study of Responsive Law. "He claimed that he had widely consulted with privacy groups and patient advocates. CDT's Janlori Goldman was the key person who decided who was in the loop, and who was not in the loop on this issue. Groups that were not receptive to the idea of massive database systems of personal medical records were excluded from deliberations." "To find out that CDT has been funded by companies such as Equifax, TRW, Dunn & Bradstreet, IBM and the telephone companies is remarkable, because these are among the groups who have the most at stake in legitimizing and preserving the current system of maintaining and managing medical records," Love said. "I think that Janlori Goldman should have mentioned in her Senate testimony that CDT was funded by corporations who have an interest in this issue." "If CDT were doing its job, TRW and Equifax wouldn't want to give it money," Love added. Harold Eist, president-elect of the American Psychiatric Association, said that "any datagathering and large computer company would clearly benefit from legislation that drives large amounts of individually identified data about American citizens into data banks without the knowledge and permission of those American citizens." "Selling that information would represent a gold mine for those companies," Eist said. "It is not surprising that an organization with a disingenuous name -- Center for Democracy & Technology -- would be supporting a bill with a disingenuous name -- The Medical Records Confidentiality Act," Eist said. "In fact, this bill represents an effort to give away the privacy of American citizens without their knowledge." "My understanding is that Janlori Goldman was involved in writing the bill," Eist said. "It seems to me that as a former civil libertarian, she should know very well that there are loopholes in that bill regarding protections to privacy that you could drive a Mack truck through." "Unless people can be assured that their privacy will be protected, there is little or no chance that they will reveal the kind of tormented and dark secrets that they have to reveal to recover from their illnesses," Eist said. "Confidentially is the sine qua non of medical treatment, and especially if it is psychiatric medical treatment." A driving force behind the effort to derail the Bennett/Leahy bill is Denise Nagel, a Boston physician who organized the Coalition for Patient Rights of New England "to restore confidentiality to the doctor-patient relationship." Nagel refused to comment on CDT's funding. At the Senate hearing last week, Nagel told the committee "I have no industry ties." Nagel charged that S. 1360 was written "to advance the interests of certain segments of the computer, telecommunications, data processing and health-care industries." "With this bill they would be able to careen full speed ahead to develop data networks that will give innumerable people access to our medical records legally and without our knowledge," Nagel said. "I am convinced that S. 1360 is not at all primarily concerned with the confidentiality of medical records," Nagel told the committee. "It is just the opposite. It talks about informed consent, but then authorizes the creation of databases without patient knowledge or consent. It talks about individual rights, and then allows police broad authority to search databases directly instead of obtaining a specific record from the patient's doctor. It talks about civil and criminal sanctions, and then pre-empts all common law and most existing and future state statutes. It talks about ensuring personal privacy with respect to medical records, and then sets a ceiling rather than a floor on medical confidentiality." AT A GLANCE: CENTER FOR DEMOCRACY AND TECHNOLOGY FUNDING, 1994- 1995 American Advertising Federation 500.00 America Online, Inc. 25,000.00 Apple Computer Inc. 50,000.00 AT&T 75,000.00 Bell Atlantic 60,000.00 Business Software Alliance 6,000.00 Cellular Tellecomm Indust Assn 10,000.00 CompuServ 30,000.00 Delphi Internet Services Corp 10,000.00 Direct Marketing Association 5,000.00 Dunn & Bradstreet Corp 10,000.00 EMA 5,000.00 Equifax Inc. 5,000.00 John Gilmore 2,500.00 Hartford Foundation 153,000.00 IBM 25,000.00 Information Technology Industry 5,000.00 Interactive Digital Software 5,000.00 Lotus 6,250.00 MARC 80,000.00 MCI Telecommunications 15,000.00 Microsoft 100,000.00 National Cable Television Assn 15,000.00 Netscape Communications Corp 5,000.00 Newspaper Association of Am 5,000.00 Nynex Government Affairs 25,000.00 Pacific Telesis 25,000.00 Prodigy Service Company 10,000.00 Software Publishers Assn 10,000.00 Time Warner Inc 5,000.00 TRW Information Svcs 10,000.00 US Telephone Association 10,000.00 US West Inc 10,000.00 Total Funding 814,020.00 Received 1994 114,377.00 Received 1995 699,643.00 Total Funding 814,020.00 Russell Mokhiber russell(a)essential.org voice: 202/429-6928

1 0

Re: "Junk E-Mail"
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Sten wrote: > They (as in, the government) has used the RICO laws against >Operation Rescue, an anti-abortion/pro-life (pick your term) group for >protesting/picketing abortion clinics and doctors who perform abortions. And for successfully encouraging the murder of doctors. >If they had prosecuted under statutes which applied to everyone, I >wouldn't have had a problem, but they are going after OR and similar >organizations for using tactics similar to those used by civil rights >protesters in the 60s. Who were systematically arrested, beaten, teargassed, wiretapped, and even occasionally shot at. I *know*--I got firehosed, beaten, arrested, and wiretapped for what I did. That's why I'm a Cypherpunk now. OR has received far better treatment than the civil rights protesters ever did--or did I miss the news items reporting that Terry Randall and Ralph Reed had been assassinated, and that their lieutenants had been bumped off in black-bag jobs, and that their colleagues were chained down to chairs *in court*? > 'Course, civil rights is Politically Correct. >Abortion rights is Politically Correct. Protesting abortion is >Politically Incorrect, therefore illegal. Do you usually send nursery rhymes to mailing lists?

2 1

Re: LACC: DEA Agents Accuse CIA of Tapping Phones
by Blanc 17 Dec '03

17 Dec '03

Brian B. Riley, CIA friend wrote wrote: >>[...] We've known for years now that >>the jackbooted thugs of the DEA are by far the most law-abusing, >>disrespectful, rights-sneering, down-and-dirty, life-threatening, >>hair-raising agents of the entire US Government. Bar none. They've >>got to be watched, because they're a nasty threat to individual >>liberty, and because they routinely interfere with the legitimate >>work of other American intelligence agencies. (And they've been >>monitored, by the way, since at least 1984, to my knowledge.) ........................................................ Well, there's watching, and then there's Just Watching. I would think that if some agency known to be so untrustworthy that it requires "watching", that it also deserves some action against its unacceptable activities immediately as they are discovered. It's rather ineffective to just passively monitor/watch what someone is doing, and keeps doing. This becomes more like voyeurism. Which recalls to mind the difference in the effect of surveillance upon different kinds of people: to those with personal standards for self-control/self-government, it is highly disturbing; to those with none, it is not even annoying. Just a comment on surveillance in general.

1 0

Proving I'm not Bob.
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

I had an idea for an advertising based net-payment scheme that has a particular security flaw making it totally untrustworthy unless it is possible to prove that you are not a particular person (the publisher receiving the ad money) when consuming (viewing or otherwise) the ads. All its other flaws seem to based on the same sort of identity denial problem. Damn! Any protocols, cryptographic or otherwise? TIA

5 5

Re: Are there enough FBI agents to handle Digital Telephony?????
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:05 PM 11/21/95, Peter Wayner wrote: >Has anyone ever done the math on the FBI's new wire tapping >proposals and determined whether they'll have enough agents to >do all of the listening? Doesn't a court ordered wire tap >require that people listen in and screen the recordings. Does >this have to be in real time? I can't remember, but I think >there is a fairly onerous evidentiary chain required to use this >technology. ... The manpower shortage can be solved by moving the listening step offshore, perhaps to one of the Carribbean islands that processes credit card slips. Even cheaper would be to subcontract out the listening to the relatively impoverished, but well-educated and English-trained, former Soviet bloc nations. For example, Romania or Bulgaria, or even Russia. They may still have the old listening infrastructure in place, although I hear that Stasi headquarters in the former DDR is now an acupuncture clinic. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: politics aren't all or nothing
by Blanc 17 Dec '03

17 Dec '03

Mark Hedges wrote about our reps in government: >They're really well educated people, for the most part --- >somewhere along the line they must have gotten that stuff about >"considering that you are incorrect" and the rest. .................................................... Most Senators & Representatives have been educated to know the answers to questions like: 5. How many branches of the federal government are there? 6. How many senators are there in the U.S. Congress? 7. How many years are there in a Senate term? rather than the answers to questions like: 3. What are the reasons for each of rights enumerated by the Bill of Rights? 4. What are the rights of the government? Does it have any? 5. What is the difference between rights and powers? So part of the problem is that conversations don't necessarly proceed along the same lines; that is, towards achieving the same end. A philosopher I read stated that the difference in certain controversies is that the parties are not aligned towards the same goals because they do not hold the same *values* (even before getting into a consideration of the means used to support those values). But I have noted that it is much easier to discuss anything with anyone who, regardless of their political or philosophical inclinations or past education, has an open, rational state of mind; i.e., someone who *thinks* about things, who is fearless about introducing facts into their mental content and will not back away from seeing the whole picture. Otherwise they will be moved to make decisions based on convenience, rather than on a wide perspective of what it will do to one's way of life in the future. Harried Congressmen who have too many decisions to make and inadequate background preparation and too little time to make those decisions, are not going to be as eager to reason on the meanings and significance and consequences of many of the bills and requests for government action which they receive, even if they *are* bright and educated. If I was in their position, I would think it would be imperative to know very quickly what to eliminate from serious consideration, even more than of calculating what sort of governing action to take. But they are elected to govern, and by jove, that is what they set themselves to do, regardless. Try to convince them that we don't need them all that much. <g> .. Blanc

1 0

toolkits?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... No, *I* am the real Alice, and I refuse to use PGP signing. Alice de 'nonymous ... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0