December 2003 - cypherpunks-legacy

Re: AT&T bans anonymous messages
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

How on earth can a service try to stop anonymous dealings. Well.. i can see HOW... because they say their just going to do it. Now.. I know theres such things as the internet task force....etc... Isnt there any groups out there whose _SOLE_ purpose is trying to protect rights in the online community?

1 0

Re: AT&T bans anonymous messages
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

> (ii) Members may not post or transmit any message >> which is libelous, defamatory or which discloses >> private or personal matters concerning any person. >> Members may not post or transmit any message, >> data, image or program which is indecent, obscene >> or pornographic. political figures..yep....out. the most recent Oj or whoever joke...out ANY ethnic joke...out. IE yo mam's so black she went to nightschool and they marked her absent..... OUT This cr*p is so unlimited as to what rights of ours it overruns on. Imagine this: a message posted appeals to 34,000 people that read it. 1 person is offended..complains.. Same thing happens again. The person's user access is cancelled. BS? You decide. My opinion is evident =-}

1 0

Re: domain name zapping threat by Internic
by Lynne L. Harrison 17 Dec '03

17 Dec '03

At 10:21 PM 6/25/96 GMT, Greg Miller wrote: > > Since the NIC charges $100 per registration, you can bet there will be >some legislation somewhere along the line. They must be makeing 5000-10000% >profit. Regarding NIC's policy concerning the taking away of domain names if X states Y usurped his trademark, there are at least 4 suits pending wherein the domain name owners/plaintiffs are challenging the alleged infringement, namely: First lawsuit - Roadrunner v. NSI background at: http://www.patents.com/nsi.sht complaint at: http://www.patents.com/nsicpt1.sht Second lawsuit - DCI v. DCI and NSI background at: http://www.patents.com/dci/dci.sht complaint at: http://infolawalert.com/source/src061496_dc_complaint.html Third lawsuit - Giacalone v. NSI et al. complaint at: http://zeus.bna.com/e-law/cases/giac.html Fourth lawsuit - Clue Computing v. NSI background at: http://www.clue.com/legal/index.html complaint at: http://www.clue.com/legal/complain.html Fun and games.... Regards - Lynne ************************************************************* Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; lharrison(a)mhv.net | - Survive; http://www.dueprocess.com | - Go to bed." ************************************************************* DISCLAIMER: I am not your attorney; you are not my client. Accordingly, the above is *NOT* legal advice.

1 0

Re: Leahy vs. Landers
by Deranged Mutant 17 Dec '03

17 Dec '03

On 25 Jun 96 at 17:58, John Young quoted Ann Landers: > ... The > Internet is tailor-made for con men, the lonely and the > bored. The word from here is beware. More on this subject > tomorrow. Gee? Is that why the DoD created ARPANet? To help con men (well, there's the $200 hammers, er "multivariable handheld impact devices") and all of those lonely gronks based on ships and bases in B.F.E... Seriously though...

1 0

Re: AT&T bans anonymous messages
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:02 AM 6/26/96, Intense wrote: >On Tue, 25 Jun 1996, Rich Graves wrote: > >> given username. If you send a message traceable to AT&T, they are held >> accountable. I think it's reasonable for them to demand that you make >> messages traceable to yourself so that you are held accountable. > >Under the common carrier law, i do not think that would apply I agree that ISPs are unlikely to be held liable for messages passing through their systems, but not because they have been determined to be "common carriers." So far as I know, no ISP has been so classified. (I'm not even sure what is involved in being classified as a common carrier. Perhaps someone out there knows about these matters.) However, it seems to me that the "Electronic Communications Privacy Act," the ECPA, gives an ISP a good defense. The ECPA forbids the interception of electronic mail (usual caveats about special exceptions), and so an ISP ostensibly is not supposed to be reading e-mail messages. Thus, an ISP would seem to have a pretty good defense in court, claiming that the ECPA explicitly precluded it from seeing what users were saying in e-mail. (But I am not a lawyer, and it would not surprise me at all if an ISP is someday held liable, despite the ECPA. "You can't read the mail, but you're still responsible. You should have known. Or at least we can go after you and shut you down.") --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Alternic.net (was domain zapping)
by William Knowles 17 Dec '03

17 Dec '03

With all the talk about InterNIC zapping domains, there should be some talk about other registries, Alternic.net : http://www.alternic.net is offering an alpha test for registering new TLD's and the prices are considerably less expensive than the Internic. William Knowles erehwon(a)c2.org finger for public key --Fwd-- A L T E R N I C . N I C Is proud to announce .NIC! The folks at alternic.nic (formerly alternic.net) are proud to announce alpha testing of the .NIC top level domain name served up by: MX.ALTERNIC.NIC at 204.94.42.1 Other names are served by .NIC... ---------------------------------------------------------------------- * ALTERNIC.NIC is being built to create a truly PUBLIC Network information center, for the benefit of all, on and off the net. * ALTERNIC.NIC is broadcast to disseminate information on Internet related issues, and to research new ideas on promoting the Internet. * ALTERNIC.NIC will promote the concept of Top Level Domainsi, and the de-centralization of name service. To this end, ALTERNIC.NIC will accept registrations for .NIC top level domains, as well as for administration of new top level domains. For now ALTERNIC.NIC will accept the existance of and promote a limitted number of top level domains. It should be recognized that at this point the concept of TLD diversification is EXPERIMENTAL. * ALTERNIC.NIC Will accept new TLDs or domain names which fit the following criteria: o The TLD or domain name must not already be registered. o DNS must be active for any TLD or domain names. o Payment of fees must be made to ALTERNIC.NET in advance. o Disputes between name holders may be handled several ways: + Release of domain name rights by existing name holder. If you want a name that's already registered, offer to buy the holder's rights. + ALTERNIC.NET will honour court orders from the jurisdiction which the domain name is currently registered in. + Sue ALTERNIC.NET. We're a privately held company, and do as we please. If you'd like to serve us with papers, it's dba A Towing Company, Inc., a Corporation registered with the Secretary of State of Washington State, USA. Of course, we'll have our corporate attorney counter-sue, and you can do it on our turf, OK --End Fwd--

3 2

Re: AT&T bans anonymous messages
by Bill Stewart 17 Dec '03

17 Dec '03

My AT&T Worldnet material finally came, and I was similarly anti-impressed with the policies against anonymity, indecency, and other things that their lawyers probably told them would cause them less hassle to ban outright than to not mention until they get complaints later (sigh...) (To give them a small bit of slack, the service did come out just about when the CDA got signed, so it's no surprise they'd cover their <noun deleted>.) I know some Worldnet folks, and I'll try to work my way up the food chain to see if I can find who did it, and how flexible they are. There are also some worldnet.* newsgroups where this can be discussed; that'd be a good place for issues like alt.sexual-abuse.recovery and other politically correct reasons for anonymity. Adam Shostack asked what services it provides - the 5-hour-free/$20-unlimited service gets you PPP, a POP3 mailbox, and servers for DNS, NNTP, SMTP, and technical support. There are also business services that get you anything from raw SLIP to frame relay to with us installing and managing routers on your premises and doing primary DNS service. Tim wrote: >I agree with Hal's points, but I suspect that these technicalities will be >ignored when the first _complaint_ reaches the DeathStar's administrators. >"Your account has been cancelled." I'd guess that the first complaint will either be ignored (because they're busy trying to get the service on line and scaled up to 500,000 people) or else get the account squashed without a second thought (because they're busy trying to get the service on line and scaled up to 500,000 people), but the first few spams that cause mass quantities of complaints will start to get people thinking. >I suspect other major ISPs will adopt similar language, absent a vocal >lobbying group for anonymous messaging capabilities. If I remember right, Netcom doesn't permit remailers (or at least discouraged one or two of them), but they'd rather not know about content, don't censor users, and do censor spammers. Disclaimer: This posting is official policy for any shares of AT&T stock that I own, which will be listened to the next time the issue appears on shareholders' ballot question.... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

2 1

f-secure..
by Deranged Mutant 17 Dec '03

17 Dec '03

On 25 Jun 96 at 17:45, brian dodds wrote: [..] > at any rate - has anyone tried out that new f-secure by the folks who > brought us f-prot? "military strength internet encryption".. seems to be > an encrypted telnet, but i can't replace our server to test it.. No. I'll have to look for it. In the F-Prot does they explicitly endorse using PGP (esp. for sending infected files to them for analysis, as well as for checking signatures of binaries in the F-Prot package). They also do the same academic hedging about effectiveness of their anti-virus package that a good crypto package would use, so I suspect they're likely to produce a good crypto package. BTW, they're located in Iceland, at the complex.is domain. AFAIK, no export restrictions there. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

My testimony at Wednesday's Senate hearing on encryption policy
by Matt Blaze 17 Dec '03

17 Dec '03

WRITTEN TESTIMONY OF DR. MATTHEW BLAZE BEFORE THE SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION, SUBCOMMITTEE ON SCIENCE, TECHNOLOGY, AND SPACE JUNE 26, 1996 Thank you for the opportunity to speak with you about the technical impact of encryption policy. It is a privilege to be here, and I hope my perspective will be useful to you. Let me begin by describing my own background and biases. I am a Principal Research Scientist in the area of computer security and cryptology at AT&T Research in Murray Hill, New Jersey. I also hold a number of ancillary appointments related to computer security; among others, I teach an occasional graduate course in the subject at Columbia University, and I serve as co-chair of the Federal Networking Council Advisory Committee subcommittee on security and privacy (which advises Federal agencies on computer networking issues). However, the views I am presenting here today are my own, and should not be taken to represent those of any organization with which I happen to be affiliated. I am a computer scientist by training; my Ph.D. is from the Princeton University Computer Science department, and my primary research areas are cryptology, computer security, and large-scale distributed systems. Much of my research focuses on the management of encryption keys in networked computing systems and understanding the risks of using cryptographic techniques to accomplish security objectives. Recent government initiatives in encryption, such as the "Clipper Chip," have naturally been of great interest to me, in no small part because of the policy impact they have on the field in which I work, but also because they present a number of very interesting technical and scientific challenges in their own right. My testimony today focuses on three areas. First, I will discuss the role and risks of cryptographic techniques for securing the current and future electronic world. Next, I will examine in more detail the security implications of the limitations imposed on US-based cryptographic systems through the government's export policies. Finally, I will discuss the technical aspects of the Administration's current approach to cryptography policy, which promotes "key escrow" systems. I THE INCREASING IMPORTANCE OF ENCRYPTION The importance of cryptographic techniques for securing modern computer and communications systems is widely recognized today. Evidence of the scope of this recognition can be found in the increasing number of hardware, software, and system vendors that offer encryption in their products, the increasing demand for high-quality encryption by users in a widening array of applications, and the growing, thriving community of cryptologic researchers of which I am a part. It is vital that those who formulate our nation's policies and official attitude toward encryption understand the nature of the underlying technology and the reasons for its growing importance to our society. The basic function of cryptography is to separate the security of a message's content from the security of the medium over which it is carried. For example, we might encrypt a cellular telephone conversation to guard against eavesdroppers (allowing the call to be transmitted safely over easily-intercepted radio frequencies), or we might use encryption to verify that documents, such as contracts, have not been tampered with (removing the need to safeguard a copy of the original). The idea that this might be possible is not a new one; history suggests that the desire to protect information is almost as old as the written word itself. Perhaps as a consequence of the invention of the digital computer, our understanding of the theory and practice of cryptography has accelerated in recent years, with a number of new techniques developed and many new applications emerging. Among the most important of the recent techniques is "public key cryptography." It allows secure messages to be exchanged without the need Modern cryptographic techniques are based on the application of simple, if repetitive, mathematical functions, and as such lend themselves nicely to implementation by computer programs. Any information that can be represented digitally can be protected by encryption, including computer files, electronic mail messages, and even audio and video signals such as telephone calls, radio, and television. Encryption can be performed by means of software on general-purpose computers, through special-purpose hardware, or by special programming of microprocessor-based electronic products such as the next generation of cellular telephones. The basic cost of encryption in terms of computational power required is quite low, and the marginal cost of including encryption in a software-based computer program or a programmable electronic product is essentially zero. Why, then, has encryption recently enjoyed so much attention? The reasons can be found from two perspectives: the technology of modern communication systems, and the new purposes for which we are relying on digital information. First, the technology and economics of modern communications and computing systems strongly favors media that have little inherent security. For example, wireless telephones have great advantages in convenience and functionality compared with their familiar wired counterparts and are comprising an increasing proportion of the telephone network. This also makes eavesdropping much easier for curious neighbors, burglars identifying potential targets, and industrial spies seeking to misappropriate trade secrets. Similarly, decentralized computer networks such as the Internet have lower barriers to entry, are much less expensive, are more robust and can be used to accomplish a far greater variety of tasks than the proprietary networks of the past, but, again, at the expense of intrinsic security. The Internet makes it virtually impossible to restrict, or even predict, the path that a particular message will traverse, and there is no way to be certain where a message really originated or whether its content ha Second, electronic communication is becoming increasingly critical to the smooth functioning of our society and our economy and even to protect the safety of human life. Communication networks and computer media are rapidly replacing less efficient, traditional modes of interaction whose security properties are far better understood. As teleconferencing replaces face-to-face meetings, electronic mail replaces letters, electronic payment systems replace cash transactions, and on-line information services replace written reference materials, we gain a great deal in efficiency, but our assumptions about the reliability of very ordinary transactions are often dangerously out-of-date. Put another way, the trend in communication and computing networks has been away from closed systems in favor of more open ones and the trend in our society is to rely on these new systems for increasingly serious purposes. There is every reason to believe that these trends will continue, and even accelerate, for the foreseeable future. Cryptography plays an important and clear role in helping to provide security assurances that at least mirror what we have come to expect from the older, more familiar communications methods of the not-so-distant past. II KEY LENGTH AND SECURITY The "strength" of an encryption system depends on a number of variables, including the mathematical properties of the underlying encryption function, the quality of the implementation, and the number of different "keys" from which the user is able to choose. It is very important that a cryptosystem and its implementation be of high quality, since an error or bug in either can expose the data it protects to unexpected vulnerabilities. Although the mathematics of cryptography is not completely understood and cipher design is an exceptionally difficult discipline (there is as yet no general "theory" for designing cipher functions), there are a number of common cipher systems that have been extensively studied and that are widely trusted as building blocks for secure systems. The implementation of practical systems out of these building blocks, too, is a subtle and difficult art, but commercial experience in this area is beginning to lead to good practices for adding high-quality encryption systems to software The most easily quantified variable that contributes to the strength of an encryption system is the size of the pool of potential values from which the cryptographic keys are chosen. Modern ciphers depend on the secrecy of the users' keys, and a system is considered well-designed only if the easiest "attack" involves trying every possible key, one after the other, until the correct one is found. The system is secure only if the number of keys is large enough to make such an attack infeasible. Keys are usually specified as a string of "bits," and adding one bit to the key length doubles the number of possible keys. An important question, then, is the minimum key length sufficient to resist a key search attack in practice. Last November, I participated in a study, organized by the Business Software Alliance, aimed at examining the computer technology that might be used by an "attacker" in order to determine the minimum length keys that should be used in commercial applications. We followed an unusually conservative methodology in that we assumed that the attacker would have only available standard "off-the-shelf" technology and is constrained to purchase in single-unit quantities with no economies of scale. That is, our methodology would tend to produce a recommendation for shorter keys than would an analysis using the more conventional approach of giving the potential attacker every benefit of the doubt in terms of technological advantages he might enjoy. Nonetheless, we concluded that the key lengths recommended in existing U.S. government standards (e.g., the Data Encryption Standard, with a 56-bit key) for domestic use are far too short and will soon render data protected under them vulnerable to attack with only modest Attempting to design systems "at the margins" by using the minimum key length needed is a dubious enterprise at best. Because even a slight miscalculation as to the technology and resources available to the potential attacker can make the difference between a secure system and an insecure one, prudent designers specify keys that are longer than the minimum they estimate is needed to resist attack, to provide a margin for error. Current U.S. policy encourages the designers of encryption systems to take exactly the opposite approach. Encryption systems designed for export from the United States at present generally must use keys no more than 40 bits long. Such systems provide essentially no cryptographic security, except against the most casual "hacker." Examples of 40 bit systems being "broken" through the use of spare computer time on university computer networks are commonplace. Unfortunately, it is not only users outside the U.S. who must make do with the inferior security provided by such short keys. Because of the difficulty of maintaining multiple versions of software, one for domestic sale and one for export, and the need for common interoperability standards, many US-based products are available only with export-length keys. There is no technical, performance, or economic benefit to employing keys shorter than needed. Unlike, for example, the locks used to protect our homes, very secure cryptographic systems with long keys are no more expensive to produce or any harder to design or use than weaker systems with shorter keys. The only reason vendors design systems with short keys is to comply with export requirements. The key length figures and analysis in this section are based on so-called "secret key" cryptosystems. For technical reasons, current public key cryptosystems employ much longer keys than secret key systems to achieve equivalent security (public keys are measured in hundreds or thousands of bits). However, virtually all systems that use public key cryptography also rely on secret key cryptography, and so the overall strength of any system is limited by the weakest encryption function and key length in it. III THE RISKS OF KEY ESCROW A number of recent Administration initiatives have proposed that future cryptosystems include special "key escrow" provisions to facilitate access to encrypted data by law enforcement and intelligence agencies. In a such systems, copies of keys are automatically deposited, in advance, with third parties who can use them to arrange for law enforcement access if required in the future. Several key escrow systems have been proposed by the Administration, differing in the details of how keys are escrowed, and who the third party key holders are. In the first proposal, called the "Clipper chip," the system is embedded in a special tamper-resistant hardware-based cryptosystem and copies of keys are held by federal agencies. In the more recent "public key infrastructure" proposal, keys are escrowed at the time a new public key is generated and are held by the organization (public or private) responsible for certification of the public key. Although the various key escrow proposals differ in the details of how they accomplish their objective, there are a number of very serious fundamental problems and risks associated with all of them. There are some appropriate commercial applications of key escrow techniques. A properly designed cryptosystem makes it essentially impossible to recover encrypted data without the correct key. This can be a double-edge sword; the cost of keeping unauthorized parties out is that if keys are lost or unavailable at the time they are needed, the owner of encrypted data will be unable to make use of his own information. This problem, of balancing secrecy with assurances of continued availability, remains an area of active research, and commercial solutions are starting to emerge. The Administration's initiatives do not address this problem especially well, however. The first problem with key escrow is the great increase in engineering complexity that such systems entail. The design and implementation of even the simplest encryption systems is an extraordinarily difficult and delicate process. Very small changes can introduce fatal security flaws that often can be exploited by an attacker. Ordinary (non-escrowed) encryption systems have conceptually rather simple requirements (for example, the secure transmission of data between two parties) and yet, because there is no general theory for designing them, we still often discover exploitable flaws in fielded systems. Key escrow renders even the specification of the problem itself far more complex, making it virtually impossible to assure that such systems work as they are intended to. It is possible, even likely, that lurking in any key escrow system are one or more design weaknesses that allow recovery of data by unauthorized parties. The commercial and academic world simply does not have the tools to analyze or des Key escrow is so difficult that even systems designed by the classified world can have subtle problems that are only discovered later. In 1994 I discovered a new type of "protocol failure" in the Escrowed Encryption Standard, the system on which the Clipper chip is based. The failure allows, contrary to the design objectives of the system, a rogue user to circumvent the escrow system in a way that makes the data unrecoverable by the government. Others weaknesses have been discovered since then that make it possible, for example, to create incriminating messages that appear to have originated from a particular user. It should be noted that these weaknesses have been discovered in spite of the fact that most of the details of the standard are classified and were not included in the analysis that led to the discovery of the flaws. But these problems did not come about because of incompetence on the part of the system's designers. Indeed, the U.S. National Security Agency is likely the most advanced cryptographic enterprise in the world, and is justifiably entrusted with developing the cryptographic systems that safeguard the government's most important military and state secrets. The reason the Escrowed Encryption Standard has flaws that are still being discovered is that key escrow is an extremely difficult technical problem, with requirements unlike anything previously encountered. A second problem with key escrow arises from the difficulty of operating a key escrow center in a secure manner. According to the Administration (for example, see the May 20, 1996 White House draft report "Enabling Privacy, Commerce, Security and Public Safety in the Global Information Infrastructure"), key escrow centers must be prepared to respond to law enforcement requests for escrowed data 24 hours a day, completing transactions within two hours of receiving each request. There are thousands of law enforcement agencies in the United States authorized to perform electronic surveillance, and the escrow center must be prepared to identify and respond to any of them within this time frame. If the escrow center is also a commercial operation providing data recovery services, it may also have tens of thousands of additional private sector customers that it must be prepared to serve and respond to. There are few, if any, secure systems that operate effectively on such a scale and under such tightly-constr A third problem with the Administration's key escrow proposals is that they fail to distinguish between cryptographic keys for which recovery might be required and those for which recoverability is never needed. There are many different kinds of encryption keys, but for the purposes of discussing key escrow it is sufficient to divide keys into three categories. The first includes keys used to encrypt stored information, which must be available throughout the lifetime of the data. The owner of the data has an obvious interest in ensuring the continued availability of such keys, and might choose to rely on a commercial service to store "backup" copies of such keys. A second category of key includes those used to encrypt real-time communications such as telephone calls. Here, the key has no value to its owner once the transaction for which it was used has completed. If a key is lost or destroyed in the middle of a conversation, a new one can be established in its place without permanent loss of informatio Unfortunately, however, the current Administration proposal exposes all three types of keys equally to the risks introduced by the escrow system, even though recoverability is not required for all of them. Partly this is because there is no intrinsic difference in the structure of the different types of keys; they are usually indistinguishable from one another outside of the application in which they are used. Finally, there is the problem that criminals can circumvent almost any escrow system to avoid exposure to law enforcement monitoring. All key escrow systems are vulnerable to so-called "superencryption," in which a user first encrypts data with an unescrowed key prior to processing it with the escrowed system. Most escrow systems are also vulnerable to still other techniques that make it especially easy to render escrowed keys useless to law enforcement. The ease of avoiding law enforcement when convenient raises an obvious question as to whether the reduced security and high cost of setting up an escrow system will yield any appreciable public safety benefit in practice. IV CONCLUSIONS AND RECOMMENDATIONS The wide availability of encryption is vitally important to the future growth of our global information infrastructure. In many cases, encryption offers the only viable option for securing the rapidly increasing range of human, economic and social activities taking place over emerging communication networks. It is no exaggeration to say that the availability of encryption in the commercial marketplace is and will continue to be necessary to protect national security. Unfortunately, current policy, through export controls and ambiguous standards, discourages, rather than promotes, the use of encryption. Current encryption policy is enormously frustrating to almost everyone working in the field. Export controls make it difficult to deploy effective cryptography even domestically, and we can do little more than watch as our foreign colleagues and competitors, not constrained by these rules, are matching our expertise and obtaining an ever-increasing share of the market. A large part of the problem is that the current regulations were written as if to cover hardware but are applied to software, including software in the public domain or aimed at the mass market. The PRO-CODE bill goes a long way toward moving the regulations in line with the realities of the technology.

1 0

RFD: Developing Nations and crypto (based on excertp from Edupag
by Deranged Mutant 17 Dec '03

17 Dec '03

An interesting possibility: information tech expands and 'centers' in third-world/developing countries, since (1) they need to skip industrial techs to catch up to N.America, Europe, etc. (2) they aren't bogged down in older ways of doing business, communicating, etc. (3) 'emerging democracies' might embrace crypto tech as a safeguard against Orwellian practices, to use digital authentication to protect from fraud, etc. (4) cheaper costs for rent, wages, etc. [though in many cases exploitavily cheap] may outweigh building an infrastructure from scratch, (5) building an infrastructure from scratch has advantages of building in flexibility towards uses that were not built into older structures in N.Am, Eur., etc. (6) desire for investment (7) desire for skills or tech to drive education etc. in region ------- Forwarded Message Follows ------- From: Edupage Editors <educom(a)elanor.oit.unc.edu> [..] DEVELOPING NATIONS SEE BRIGHT FUTURE IN SMART CARDS When it comes to full-scale trials of smart card technology, developing countries such as Zambia and Thailand are way ahead of the U.S. The new payment systems are finding greater acceptance in countries where traditional banking practices are not so firmly entrenched. "No one's in a hurry for a new payment system here because our system already works," says a U.S. programmer who designed Zambia's smart card system. "Our country is expanding, and we don't have enough banks and no automated teller machines... The lines are very long," says a spokesman for the Zambian embassy in Washington. And smart cards provide valuable access to other technological advances: "Developing nations are using smart cards to leapfrog the need to build telecommunications infrastructures," says a Visa VP. (Investor's Business Daily 25 Jun 96 A8) [..] Educom Update ... is our twice-a-month electronic summary of organizational news and events. To subscribe, send mail to: listproc(a)educom.unc.edu with the message: subscribe update Charles Revson (if your name is Charles Revson; otherwise, substitute your own name). [..] --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Grubor remailer? (Was Re: Lucifer remailer)
by Anonymous User 17 Dec '03

17 Dec '03

>Hm, is that Dr. John Grubor's domain (aga(a)dhp.com)? > >That will make a nice anonymous remailer... NOT! Thank you. dhp is not "Grubor's domain," it's just a Pittsburgh ISP with liberal terms of service (which is why it can run remailers). Perhaps you're thinking of "manus.org"? check out http://www.dhp.com/amusement.html for some background on dhp's attitude -not a DHP user or sysadmin

1 0

CIA Fears UmpTeen InfoNukes
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, June 26, 1996, p. B7. Head of C.I.A. Plans Center To Protect Federal Computers By Tim Weiner Washington, June 25 -- Alarmed at the growing threat that computer hackers pose to national security, the Director of Central Intelligence today announced plans to create a "cyberwar" center to protect the bits and bytes that weave the nation together. The United States cannot be brought to its knees by a madman with a modem. But the Director, John M. Deutch, said the nation's intelligence agencies were alert to the threat of "very, very large" attacks on the computers that run Defense Department war rooms, power plants, telephone systems, air traffic control centers and international financial transfers. "The electron," Mr. Deutch warned, "is the ultimate precision-guided weapon." Mr. Deutch said he was seeking to create a cyberwar center at the National Security Agency, the giant electronic eavesdropping branch of American intelligence. He said the center could focus the Government's previously scattershot efforts to understand and combat the threats posed by governments, terrorist groups and mischievous teen-agers. Mr. Deutch's first public statement about information warfare came in testimony before Senator Sam Nunn, the Georgia Democrat who called a hearing of a Senate Governmental Affairs subcommittee to discuss the little-understood, highly classified problem. "There are some who believe we are going to have to have an electronic Pearl Harbor, so to speak, before we really make this the kind of priority that many of us believe it deserves to be made," Mr. Nunn said. "Do you think we're going to need that kind of real awakening, or are we fully alerted to this danger now?" Mr. Deutch replied: "I think that we are fully alerted to it now. I don't know whether we will face an electronic Pearl Harbor, but we will have, I'm sure, some very unpleasant circumstances." He added, "I'm certainly prepared to predict some very, very large and uncomfortable incidents." Mr. Deutch said cyberwar could become a 21st-century national security threat second only to nuclear, biological and chemical weapons. Potential attackers may already possess the sophisticated techniques they would need to bring off a cataclysmic crash, many experts believe, but they still lack the deep knowledge of their targets and direct access to the computer systems they would seek to disable. Military and civilian organizations are increasingly dependent on evermore complicated and interlinked systems. They run the risk of understanding the threat less and less as it becomes more and more complex Mr. Nunn and Mr. Deutch suggested. Senator Nunn also said intelligence agencies have communications problems with banks, telecommunications companies and other business ventures vulnerable to cyber attacks. "There's a great reluctance by the private sector to discuss the threat that they've faced or even the attacks that have already occurred," he said, "because they fear that the word would go out they're vulnerable, and therefore could destroy or damage consumer confidence and thereby cost them business." "At some point," the Senator added, "there's got to be communication here." [End]

4 3

Senate Crypto Hearing being "Cybercast" now!
by bobpal＠cdt.org 17 Dec '03

17 Dec '03

SENATE ENCRYPTION HEARING BEING "CYBERCAST" LIVE ON THE NET NOW! Wednesday June 26, 10:30am EDT | 7:30am PDT | 14:30 GMT HotWired WiredSide Chat http://www.hotwired.com/wiredside/ Senator Conrad Burns (R-MT) is chairing a hearing regarding cryptography policy before the Senate Subcommittee on Science, Space and Technology. The hearing is being "cybercast" now on HotWired's WiredSide Chat. Netizens concerned about privacy and security on the Internet are participating in the hearing; they are submitting comments and questions, and discussing the hearing with others online. Witnesses that are testifying now include: * Phil Zimmermann, Inventor of PGP * Whit Diffie, Father of Public-Key Cryptography * Jerry Berman, Executive Director, Center for Democracy and Technology * Matt Blaze, Cryptographer * Phil Karn, Cryptographer * Barbara Simons, Chair of US Public Policy Committee, ACM * Marc Rotenberg, Director, Electronic Privacy Information Center HOW TO JOIN THE HEARING LIVE ONLINE Point your web browser at: http://www.hotwired.com/wiredside/ To listen to the hearing, you will need to have RealAudio properly installed on your computer in order to participate in this event. (You can download RealAudio software *FREE* by visiting [http://www.realaudio.com/] In order to participate in the accompaning chat session (and to ask questions of the witnesses) you will need to be a member of HotWired. Membership is *FREE*! Visit http://www.hotwired.com/ for details. If you do not have RealAudio capability, you can still participate in the online discussion. Telnet to talk.com and log in with your HotWired member name and password. The hearing is being brought to you by HotWired, DIGEX, the Voters Telecommunications Watch, and the Center for Democracy and Technology. ----- Bob Palacios, Online Organizer/Sysop Center for Democracy and Technology <bobpal(a)cdt.org> 1634 Eye Street, NW Suite 1100 Washington, DC 20006 http://www.cdt.org/ (v) +1 202 637 9800 http://www.cdt.org/homes/bobpal/ (f) +1 202 637 0968 The CDA fight continues! Visit http://www.cdt.org/ciec/

1 0

TWP on CIA Info Gears
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The latter part of this article elaborates the NYT report today. The Washington Post, June 26, 1996, p. A19. CIA Gears Up to Thwart 'Information Attacks' Deutch Lists Computer Break-Ins, Terrorism as High-Priority Potential Threats to National Security By R. Jeffrey Smith CIA director John M. Deutch warned yesterday that the country is likely to experience some a very large and uncomfortable" disruptions of vital computer systems at the hands of foreign terrorists or hostile nations in coming years, but pledged a major new U.S. effort to detect and combat the threat of computer break-ins. "We have evidence that a number of countries around the world are developing the doctrine, strategies, and tools to conduct information attacks" on military-related computers, Deutch told a hearing of the Senate Permanent Subcommittee on Investigations, while declining to name these nations. Deutch added that he is convinced that foreigners are becoming increasingly aware "that advanced societies, especially the United States, are increasingly dependent on open and potentially vulnerable" computers to control electric power, airplane traffic, telecommunications and financial operations -- posing an attractive target for virtually "any nation or foreign terrorist organization." Emphasizing that the Clinton administration has just begun to grasp the dangers involved and begin working on the problem, Deutch said "we are not well-organized as a government to address these issues" and cautioned that making vital computers much less vulnerable to attack may take decades. "The electron is the ultimate precision-guided weapon," Deutch said, but "it is not [a problem about] which it's absolutely apparent ... the best way to proceed." Deutch said he nonetheless had already drawn up plans to create an office at the National Security Agency to be called the Information Warfare Technology Center, which will focus on analyzing the risks that foreign hackers pose to U.S. computers and help create new methods of investigating and defending the U.S. against electronic break-ins. Deutch also said that he supports creating a "real-time response center" for any major domestic or foreign attacks against civilian computers under the supervision of the Justice Department, as well as a separate, Defense Department center for responding to attacks on military-related computers. Deutch disclosed that the intelligence community conducted an extensive survey last year of the risks of an attack on computers controlling U.S. telephones, the electric power grid, oil refineries and other utilities. He said the results are classified, but added that a new, broader estimate of the threat is to be completed by December. He also said the intelligence community has begun to hunt more diligently for evidence of any foreign intent to attack U.S. computers, any sign of foreign sponsorship for U.S.-based computer hacking activities, and for any indication that foreign organized crime figures are becoming involved in attacks on computers at U.S. financial institutions. The Defense Intelligence Agency, moreover, is trying to develop a way to predict a major "information warfare attack" against the United States, Deutch said. One obstacle is that banks and other private institutions have been reluctant to divulge any evidence of computer intrusions for fear that it will leak and erode the confidence of their customers. Deutch said "the situation is improving" but that more cooperation was needed from major corporations, and said the CIA remains willing to share information with such firms about the risks they might face. Although he declined to cite any specific examples of computer warfare, Deutch said he would list it as the second most worrisome threat to U.S. national security -- just below the threat posed by foreign chemical, nuclear, and biological arms. In answer to a question from Senator Sam Nunn (D Ga.) about whether the government was aware of the danger, Deutch said, "I don't know whether we will face an electronic Pearl Harbor, but we will have, I'm sure, some very unpleasant circumstances in this area or our allies will.... I'm certainly prepared to predict some very, very large and uncomfortable incidents in this area." [End] Final notice: Wash Post on the Web at: http://www.washingtonpost.com

1 0

Re: CIA Fears UmpTeen InfoNukes
by Alex de Joode 17 Dec '03

17 Dec '03

Mike sez: [..] : By the way, there was a thing in the Yahoo/Reuters feed about "attacks" : on DoD computers; apparently British police arrested a "hacker" the : other day. Anyway, the article included a claim that there have been : 250,000 attempted break-ins on DoD computers over the past year. : Does anybody know how they count that? 'telnet nsa.gov 25' and you will be added to the count .... -- -AJ-

2 1

Lucifer remailer
by lucifer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have just finished setting up a Mixmaster and cpunk remailer at lucifer(a)dhp.com. The PGP key and Mixmaster key are below. lucifer lucifer(a)dhp.com 6e57353149a1175f11aba72cedee02fd 2.0.3 - -----Begin Mix Key----- 6e57353149a1175f11aba72cedee02fd 258 AATvJVbP8R9tUF6R9zjSbRdDaz2j1INJvkVI6L6I 5F65Q7lRCoOl8+TCi+HgUo1AErYsLPpHpI1l4F9I RUqvH/fvR7GuqgIJc+RsGyQPPG0dpL5lHt2ppdmW wcTX85ZKRK242SW1hTih43IaCmXr+i1zX6+QZsr1 MtAqwDlyDgoU0QAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - -----End Mix Key----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzHPdZkAAAEEAK3rI5oq3dwDV5inleitjy03JvhBD/GtbRRDO1noLUnRf4FV CmCfGJrqitHtIBqhA+hIRBcNRo7J48Yiu6ctda29xe/rEy3QdSKHpZhstsV+hzw3 42Lhogm1cW2QPrvjJQUgU5mpKR9qKn7KQLBcVz/Mx1EvX4aMGJ2oJ1gRbIg5AAUR tCRBbm9ueW1vdXMgcmVtYWlsZXIgPGx1Y2lmZXJAZGhwLmNvbT6JAJUDBRAxz3vx nagnWBFsiDkBAfUAA/9ufh0GPUo6uR4/5/tbbFKyQs8fW0NmDkrU+xni7QNmKKUj qC7lJ/MHPxRGzuXaYE+k9I8NmI1DxyzdWlRX/X6uwcwYPOxa/+CI9HUAkcB/Q/N8 GZJckumcU7hlMim08lFJQjsEWxNyqKefAeOAKQ5v5xt3rmpPDmHrXbOuJ104Ng== =dFZY - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdFhcZ2oJ1gRbIg5AQGqSwP9HzVjkvkN4oBIHh5AzvsKZoZG+zMvId7Z +LlvpSOSyXm+Vaxga28jBL03JIN8j6+yJtZy1h07VlYYwnhhBrhnIufeq+mO+ea6 k/ymFcUFsfM4jnf5jvaHKJTMULnmL3wspWzBKl3CRkQ2e238ozx8IWdhTxxdD9vj aO3vQZHHFTI= =/ICd -----END PGP SIGNATURE-----

1 0

Re: domain name zapping threat by Internic
by Herr Wendigo 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity claiming to be Bill Stewart wrote: : : Perhaps I'm misunderstanding your point. Because the root nameservers : provide name service for the top level domains, if you want to find : schmoe.org, you need to ask a nameserver for .org where it is, and to find : www.schmoe.org, you need to ask a nameserver for .org where to find a : primary or secondary nameserver for schmoe.org - so if the .org folks : decide to drop you, you become hard to reach, even if you've got : the primary and secondary name servers working just fine. The org. folks ARE the InterNIC. The machines on ROOT-SERVERS.NET are all fed by the NIC. My problem with the original statement was the implication that using your own nameserver as having zone authority was a bad idea. Not only is it a good idea, it is standard operating procedure. You're absolutely right about being "hard to reach" (a bit understated) if the NIC drops your record. Any recursive lookups will fail. : Now, you can improve your odds a bit by getting popular systems, such as : aol.com and compuserve.com to act as secondary nameservers for you - : you may lose connectivity to Europe, but you're in the cache for half : the Net that way... Well, if you decide to use AOL as your secondary, you will only be accessible (by name) outside of aol.com for about 48 hours after the NIC drops your records. After that, only users who use one of aol.com's name servers will be able to access your domain. Then, when someone else registers your domain, AOL will probably drop you like a bad habit (if they don't when the NIC drops you). I'm sure that AOL (or Compuserve, etc.) are not too keen on being the odd man out when the NIC and the rest of the world say XYZ.COM is owned by your competitor and AOL says it is owned by you. mark - -- Mark Rogaski | Why read when you can just sit and | Member GTI System Admin | stare at things? | Programmers Local wendigo(a)gti.net | Any expressed opinions are my own | # 0xfffe wendigo(a)pobox.com | unless they can get me in trouble. | APL-CPIO -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdFpaQ0HmAyu61cJAQEn+AP/Ttiw04EyeEQ4/6K19ZqXAbOui+zZ+fmu t/RJJGL834E/8yWB3xmbAmltDR+/V5T679iBUtw8Q+0CQEZOWwXeguRriILyabMn XRFdCP8+Cw5zvrz12BtIKYHCm4o9MG7or3BBbP3iHSF1ia6n2eMPwjRiaKrlqBYm Gqv9lThaoqU= =LD// -----END PGP SIGNATURE-----

1 0

Re: RFD: Developing Nations and crypto (based on excertp from Edupag
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:57 AM 6/26/96, Deranged Mutant wrote: >An interesting possibility: information tech expands and 'centers' in >third-world/developing countries, since (1) they need to skip >industrial techs to catch up to N.America, Europe, etc. (2) they >aren't bogged down in older ways of doing business, communicating, >etc. (3) 'emerging democracies' might embrace crypto tech as a >safeguard against Orwellian practices, to use digital authentication >to protect from fraud, etc. (4) cheaper costs for rent, wages, etc. >[though in many cases exploitavily cheap] may outweigh building an >infrastructure from scratch, (5) building an infrastructure from >scratch has advantages of building in flexibility towards uses that >were not built into older structures in N.Am, Eur., etc. (6) desire >for investment (7) desire for skills or tech to drive education etc. >in region Sadly, most developing countries (Third World, LDCs, whatever) have repressive governments of various stripes...few are libertarian. Several have embraced computer technology, but primarily as an instrument of social control. Singapore is an example of a country that jumped from former colonial status, surrounded by relatively poor (GNP) countries, to the "Information Age." And what is the result? What our own Sandy Sandfort dubbed "Disneyland with a Death Penalty." No spitting, no cursing, no long hair, no "Wall Street Journal," no pornography, no Internet free access, no dissension. And smartcards track the movements of all Citizen-Units. Not an encouraging example. As for the comment that "they aren't bogged down in older ways of doing business, communicating, etc." Well, some of these "older ways" include: - concepts about the ownership of property and transfers of title - contracts, and the ability to make and enforce them - understanding of the Uniform Commercial Code (the descendent of the "Law Merchant" which Western societies have embraced for centuries) - a stable middle class, solid educational facilities, and a tradition of business and technical achievement (These are all things which are missing in many Third World countries, for whatever reasons. Even in many Second World countries, such as the former U.S.S.R., and these lacks are making the development of modern economic systems problematic.) Certainly some small nations--perhaps island nations--can essentially jump directly to an "information based economy." The Cayman Islands and several other examples come to mind. I find it harder to believe that a _large_ nation is likely to make such a transition. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Life imitates art (InfoWar, Sunday Times article)
by Peter Trei 17 Dec '03

17 Dec '03

Winn Schwartau is much too modest. Following up on the alleged info-ransom attacks on European financial institutions, I've tracked down his entertaining fascinating resume at: http://www.homecom.com/people/schwartau-frame.html This led me to the most amazing discovery: Winn predicted the technologies used in the alleged attacks at least three years ago, in the self-published science fiction novel "Terminal Compromise." The text of this prescient work can be found on the web at: http://www.inform.umd.edu:8080/Educational_Resources/ReadingRoom/Fiction/Te… I won't quote from it (there are dire warnings against doing so in the intro), but here are some of the elements in which alleged real life is so closely imitating Winn's art: EMP bomb attacks against financial institutions chapter 11 "HERF" guns (described but un-named) chapter 16 info-ransom demands against large corporations chapter 17 ... and many others. If I had predicted the future so well and so far ahead, I'd be shouting it from the rooftops, and use the strength of the reputation I'd instantly establish to set up shop as a professional prognosticator (for fat fees). I wonder why Winn hasn't bothered to bring this to our attention - and I hope that Peter Warren and the editors of the London Sunday Times have heard about his astounding foresight. Winn, my hat's off to you, and my $7 "shareware fee" will be in mail as soon as I finish the book! Peter Trei ptrei(a)acm.org

1 0

Re: AT&T bans anonymous messages
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 11:16 AM 6/26/96 -0700, Rich Graves wrote: >I see no excuse for the craven "indecency" and "personal >information" bits of the AUP, but... Plausible deniability. Currently, the majors don't want to be publicly associated with "naughty" uses of their networks. The do, however, want the lucrative fees generated by them. As a result, an enormous market niche has come open for "resellers" of 900/976 services. The majors can say, "We don't offer our services to THOSE types of services, but we are powerless to stop our resellers from doing that sort of business." The same rational applies to the Internet. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Alternic.net (was domain zapping)
by mccoy＠communities.com 17 Dec '03

17 Dec '03

John Fricker writes: > At 05:54 AM 6/26/96 -0400, Perry wrote: [...regarding alternte registries...] > > > >They can offer to sell you anything they like, of course, and you can > >pay them, but you don't get anything at all for the money. Domains > >registered with them don't appear in the real DNS. > > What constitutes "real DNS"? For 99.99999% of the Internet "real DNS" is defined by the root server list distributed with the most recent version of BIND. > DNS server administrators need only add one line to their named.boot file to > resolve .nic hosts. > > secondary nic 204.94.42.1 db.nic > > It's that easy! Sorry, but this only gives you domain name resolution for the .nic TLD, not the other new top-level domains they want to create or any domains that alternic is proposing to provide service for. To do that one needs to add an appropriate line into the root.cache file (or whatever the root server list is in your name server setup), at which point you are also trusting alternic with pointing you properly to any domain they get queried on. > The concept of centralized name resolutions is flawed and > only exists out of habit. It is not just about habit, it is also about trust. There are alternatives, but they need to be thought-out much more than this alternic stuff... jim

2 1

Re: The Reno Text URL.....
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Why, thank you very much for the kewl compliment. May I correct your correction of the URL for addres.txt: it should be "jya" not "jwa," to read: http://pwp.usa.pipeline.com/~jya/addres.txt Several c'punks have kindly noted my clumsy typing thumbs by breaking them. Regards, Kohn

1 0

Re: Life imitates art (InfoWar, Sunday Times article)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:26 PM 6/26/96, Peter Trei wrote: >Winn Schwartau is much too modest. I don't think so. Read on. >This led me to the most amazing discovery: Winn predicted the >technologies used in the alleged attacks at least three years ago, in >the self-published science fiction novel "Terminal Compromise." The text >of this prescient work can be found on the web at: ... >If I had predicted the future so well and so far ahead, I'd be shouting >it from the rooftops, and use the strength of the reputation I'd >instantly establish to set up shop as a professional prognosticator (for >fat fees). > >I wonder why Winn hasn't bothered to bring this to our attention - and >I hope that Peter Warren and the editors of the London Sunday Times >have heard about his astounding foresight. He _has_ been bringing it to our attention! In fact, he has been shouting it from the rooftops. He has sponsored at least two "InfoWar" and/or "InfoWarCon" conferences, including one in Europe and one in the D.C. area. Robert Steele was a co-sponsor. (There have been many announcements here and elsewhere on the Net about these conferences; I recall at least one subscriber of our list went to one of them.) He also wrote another book, "Information Warfare," and was essentially one of the main folks interviewed in a BBC special called "The I-Bomb" (Information Bomb), shown recently on A&E in the U.S. (I had about a minute or so on this show, much to my regret.) I have my doubts about "HERF" attacks being current realities, for various reasons (some of which I wrote about in a recent post here), and I have a few other doubts, but I certainly don't think Schwartau is being coy about his involvement in this whole thing. Whether it is hype to sell conference attendance seats, or to sell consulting work, or is real, or is partly real, or is imagined....well, I don't know. I suspect the recent riding of this bandwagon by Deutch and Perry is easily understandable: anything that triggers fear and uncertainty is good for those seeking more control of cyberspace. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: CIA Fears UmpTeen InfoNukes
by Clay Olbon II 17 Dec '03

17 Dec '03

Mike M Nally wrote: >By the way, there was a thing in the Yahoo/Reuters feed about "attacks" >on DoD computers; apparently British police arrested a "hacker" the >other day. Anyway, the article included a claim that there have been >250,000 attempted break-ins on DoD computers over the past year. > >Does anybody know how they count that? > >______c____________________________________________________________________ _ >Mike M Nally * Tiv^H^H^H IBM * Austin TX * pain is inevitable > m5(a)tivoli.com * m101(a)io.com * > <URL:http://www.io.com/~m101> * suffering is optional > Probably the same way other things are counted when used to make a political point (# of homeless people, # of date rape victims, etc.). Make a wild-ass guess based on a very small sample, then multiply by a factor of 10 or 100. I think lying with statistics has become a national pastime recently. I tend to not trust numbers issued by folks who stand to gain from the use of the numbers. Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

2 1

Re: CIA Fears UmpTeen InfoNukes
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 08:32 AM 6/26/96 Mike McNally wrote: >By the way, there was a thing in the Yahoo/Reuters feed about "attacks" >on DoD computers; apparently British police arrested a "hacker" the >other day. Anyway, the article included a claim that there have been >250,000 attempted break-ins on DoD computers over the past year. >Does anybody know how they count that? Nope, especially since they claimed a large percentage of those attacks went "unnoticed". I fail to see how they can know they happened if they went unnoticed. They also neglected to mention exactly what consitutes an "attack" or breakin attempt. Some people far more cynical than the average sheep would claim that report was used as a tool to justify new massive expenditures to congress and the public. //cerridwyn//

1 0