December 2003 - cypherpunks-legacy

Public choice theory and the politics of antitrust
by Declan McCullagh 17 Dec '03

17 Dec '03

I wrote a little about public choice theory and the politics of antitrust in my article last week: http://cgi.pathfinder.com/netly/opinion/0,1042,1678,00.html Attached are excerpts from recent posts to a law and economics mailing list I'm on. I'm unsure of the reposting policy, so I'm deleting authors' names. Should be good reading anyway. -Declan === Assume for the moment that Microsoft is doing something wrong that the government should stop (a reach, I admit). If that is the case, how did the Justice Department come up with the figure of $1 million per day? Is that figure supposed to be compensatory, punitive, deterrent, or what? What goal is a daily fine supposed to accomplish that some more specifically-tailored remedy (injuntive relief, for instance) could not? Are there public choice explanations for what is driving this, and if so, what are they? === The Government's argument, I believe, is that Microsoft violated the consent order. A fine under these circumstances should punish the party that violated the order, deter it from violating the order again, and deter others from violating other orders. As for a public choice explanation, based upon the history of the present Administration, I suspect that one could be found in the records of the Federal Election Commission, i.e., I suspect that executives and shareholders of Microsoft's enemies have made far larger political contributions than Bill Gates and his colleagues. === Intel has in fact come under attack. The FTC has been investigating Intel for several months. The charge is similar to the rap on Microsoft - trying to dominate the inside of the computer by controlling the interface between the processor and "helper chips." The wonder is that Intel hasn't taken over the motherboard market - something that may also be more efficient, just as seemless integration of the operating system and browser and other applications is more efficient. Recall also that the FTC did in fact investigate Intel in the early nineties, though it filed no charges in the end. (I suspect that the FTC's institutional credibility is at stake. Since this is the second Intel probe, they're going to have come back with at least a symbolic consent decree.) Still, I would grant that the attack on Microsoft is more strident. Domestic political economy may play a role. Microsoft has vocal domestic competitors (Oracle, Netscape and Novell, for example). It's no coincidence that Republican Senator Hatch represents Novell's home state. Intel, in contrast, is viewed as the company that's keeping the foreigners at bay. Well yes, conduct and arrogance matter too. And sitting on a big pile of cash helps. That explains why a number of state AG's jumped on the anti-Microsoft bandwagon after the tobacco settlement. Finally, yes, Windows is a terrible operating system and almost everyone has an interest in seeing something better. (A confirmed Mac user, I compare Windows to the aliens in "Men in Black:" arthropod DOS stuffed into the skin of humanoid Mac.) Intel does have an incentive and the means to come up with a better operating system: Windows hurts the demand for its chips. Not surprisingly, Intel's Portland facility has 800 programmers charged with coming up with something as cool as the operating system developed by Next. Stay tuned. === [I interpret "substantial appropriable quasi-rents to be taxed away" as "campaign cash or political contributions to be expropriated as necessary by the government." --Declan] There are two reasons to go after a successful company. One possibility is that it has substantial appropriable quasi-rents to be taxed away. Even if a company's equity is high, it is not readily taxable if the assets can readily be withdrawn (e.g., Becker and Stigler's argument that Jews stayed out of agriculture because they could too easily be expropriated). The other reason for going after a successful company is to assist its competition. This may explain the attack on Microsoft ... and probably the attack on Milken as well, if you are persuaded, as I am, by Daniel Fischel's book on the case. === There has been a lot of talk about how hard Clinton has been on Microsoft. I wonder. Is it possible that Clinton has been soft on Microsoft? Hi-Tech generally has been very pro-Clinton, and contributed a lot of money to him. The fact that Justice is going after Microsoft now is not determinative. It seems to me that Microsoft was surprisingly arrogant in thinking it could get away with this blatant violation of the consent decree. THink of the Priest-Klein selection problem as applied here. PK implies that even if the judge is heavily pro-plaintiff, plaintiffs will win only 50 percent of the time in his court. The reason is that plaintiffs will bring even totally outrageous suits, knowing the judge might still rule in their favor. I suspect the same has happened with Microsoft. Confident that Clinton would block any response from Justice, they violated the consent decree. They still hope Justice will back down. So far, they are wrong (tho--has the fine been imposed yet, or has the judge delayed imposition?). The most humorous part is that Rush Limbaugh, a conservative Apple user, has been cheering for Microsoft, a notably liberal company. === > Can anybody give an efficiency explanation for this? Prima > facie, it is monopolizing conduct. Microsoft's absurd excuses are > that (a) Explorer is an integral part of Windows 95, and (b) > Allowing Netscape to come up automatically would spoil the integrity > of Windows 95. Microsoft's behavior is indeed puzzling. You would think that even though Windows has such a large market share, Microsoft would wish to enhance Window's appeal even further by making it as easy as possible for those who prefer Netscape to access Netscape easily. But, regardless of the wisdom of Microsoft's tactics, given what Eric reports about the DOJ's complaint against Microsoft, why the mighty brouhaha? Do computer users really need federal forces to help them put Netscape's icon on their Windows screen? === The DOJ wants Microsoft to be found in contempt for violating the '95 consent decree (Section IV (E)(i) of the Final Judgement) which prevents Microsoft from requiring OEM manufacturers to license other Microsoft products as a condition of recieving a license to install Windows '95 on the computers they produce -- is this not what "bundling" means? The icon business arises because three firms asked Microsoft to ammned the license agreement to allow them to remove the IE icon from the desktop and Microsoft refused to grant their requests. This is mentioned in the DOJ request for an order of contempt, but if Internet Explorer really is considered a separate product (and the DOJ claims it is) then Microsoft really isn't allowed to require firms to license it if they license Windows 95. Microsoft insists that requiring the licensing of Internet Explorer, sans icon, is still requiring the licensing of Internet Explorer, something they aren't allowed to do under the consent decree if IE is a separate product, but that it isn't a separate product so everything is just ducky. They also add that if Internet Explorer, sans icon, isn't licensed Windows won't work. They think it's silly to claim that the consent decree requires them to sell Internet Explorer, sans icon, as a part of Windows but prevents them from selling Internet Explorer, with icon, as a part of Windows. As to the why of it all... Microsoft believes, and the government agrees, that the browser itself is the seed of a new sort of operating system which will become a viable alternative to Windows 95. Microsoft says it wants reshape Windows into this new sort of operating system, the DOJ seems to want someone else to come up with it. From the DOJ's request to show cause why Microsoft should not be found in civil contempt: "Microsoft's aggressive and multi-faceted marketing of the Internet Explorer browser reflects its intense competition with other, competing Internet browsers, primarily the "Navigator" browser produced by Netscape Communications Corporation ("Netscape"). Microsoft believes that the success of competing browsers poses a serious, incipient threat to its operating system monopoly. Indeed, as Microsoft fears, browsers have the potential to become both alternative "platforms" on which various software applications and programs can run and alternative "interfaces" that PC users can employ to obtain and work with such applications and programs. Significantly, competing browsers operate not only on Windows, but also on a variety of other operating systems. Microsoft fears that over time growing use and acceptance of competing browsers as alternative platforms and interfaces will reduce the significance of the particular underlying operating system on which they are running, thereby "commoditizing" the operating system." And it's really hard for me to read this in any way other than "Microsoft is starting to realize that a web based operating system would be a better product than Windows 95 and is trying to create such an operating system, but we don't want them to because they're a monopoly." === > And about Congressional consistency: Let's suppose that Congress in July > of 1890 did indeed intend the Sherman Act to help consumers. Surely any > institution so fickle as to go from being consumers' friend to being > consumers' foe in a mere three months (by October 1890 when it hiked tariff > rates) is not an institution to be trusted with the awesome power to decide > which business practices do and do not constitute anticompetitive behavior. I would add: Why would anyone expect a Congress (1) in which a single majority party leader appointed the chairmen of each legislative committee (2) that used its committees to appoint the vast majority of federal workers (3) operating in an environment in which the pressure group had not yet emerged, to serve consumers? There is not only an antitrust myth, there is a myth among economists that the legislators of the period had any reason to make decisions based on the logic of economics. We might call this the legislature myth. The antritrust myth and the legislature myth seem to be stories we tell our little children in order to avoid scaring them. Unfortunately, many professional economists treat their students like little kids. === > So, you and I also agree that Congress often does stupid things. But what > is the alternative - do you know of a better system? Yep. A common-law system with no antitrust statutes. ===

2 2

More on the POLITICS of antitrust
by Declan McCullagh 17 Dec '03

17 Dec '03

Forwarded === At some points over the last decade, I would have said that the large-firm monopolization case was dead. We had learned our lesson - big-time trust-busting didn't pay. Mergers were OK and so were businesses that succeed by competing hard. The few initiatives didn't go very far: the early 1990s FTC investigation of Microsoft deadlocked; DOJ then wrested a largely cosmetic consent decree in 1994/95; the FTC looked at but then walked away from Intel. The political will to do any real damage seemed to be lacking, perhaps because these were successful export industries. Not so now. The events of the last few months suggest that the outlook is more serious both for Microsoft and for Intel, and further down the road, for firms like Cisco (king of the network routers) or Sun (if Java ever lives up to its hype). Money attracts politics (hence the bevy of attorney generals in action now), and we were foolish to expect otherwise. The implicit policy of going easy on America's information technology success stories has been abandoned. Aside from the competitor complaints and aside from the simple populist attack on wealth, another factor may play a role: populist resentment of the "digerati" (those who are computer savvy). (I intend a parallel with the late 1920s, when despite the general boom, large segments - the buggy whip manufacturers - complained about "profitless prosperity," laying the political groundwork for Hoover's veiled New Dealism. No, I am not predicting another Great Depression.) ===

1 0

Re: Covert Superhighway - the missing component? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 14 Jan 1998 17:36:13 -0800 > Original-From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: Covert Superhighway - the missing component? > - CU-SeeMe reflectors are fun, and you can stego a lot of traffic > inside your pictures. The problem here is the processor overhead requied to take advantage of a high frame rate. The startup costs are gonna be a bear. > Adam Back's idea of piggybacking on gaming nets could be > among the more interesting approaches, at least for games > that don't have a central control system. The problem here is that most gamers are responce-sensitive. They'll begin to wonder at some point where all that extra bandwidth is going. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: [POLITICS] 1 Question to Dr. Froomkin... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 14 Jan 1998 09:13:07 -0800 > Original-From: Bill Stewart <bill.stewart(a)pobox.com> > Subject: Re: [POLITICS] 1 Question to Dr. Froomkin... > > you and I are political theorists, and you're asking a political question, > though I'm not sure what kind of question you mean. Actualy I am more interested in the why's and wherefor's of the actual application and less in the theory. If the issue was only theoretical there wouldn't be over a million people in US jails and the other various excesses that are currently permitted. That is far from theoretical. > To a lawyer, the answer is that the Constitution ultimately means > whatever you can talk the Supreme Court into saying it means, That is one of the problem with the current approach. The Constitution is not taken to mean anything. A fundamental flaw, theoreticaly or practicaly. It is considered a document written by a bunch of long dead guys with little if any application for todays social structures. > So which question are you asking, and why? I'm asking Dr. Froomkin whether he accepts the Constitution as the defining document of the government (not just the courts which is implicit but unstated in your various questions) of the United States. I apologize if the question was unclear. I had intended to structure it in such a way that it was absolutely clear - it is a yes/no question after all. Why? Because I want to know. The answer would provide insight and might provide further information for future strategies. There is an old saying: Know thy enemy. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Bruce Sterling afficianado's...
by Jim Choate 17 Dec '03

17 Dec '03

FYI, Was in the bookstore today and noticed that Bruce Sterling's 'Artificial Kid' is back in print at $12.95. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

No Subject
by wabe 17 Dec '03

17 Dec '03

I like Crypto Kong. Easy to use, and cool name and little rose insignia. Private Idaho, on the other hand, was a pain and eventually I gave up. (I tried to install and use the 32 bit version.) -wabe --digsig EojdyErVslc/s6aQeIHwnOlMw3lUKJhdZc/ZeCNfe7H bPOgfo2WuJqphHEKAhe/nQIPFt1T6nTh8Ry5v9lp 47roQ27BeTu2jFYXmJJoIWdG9Lvnx+zmSiHoqscae

1 0

Symantec Norton, Your Eyes Only.
by Pearson Shane 17 Dec '03

17 Dec '03

Hey all, Just wondering what people think of this product? Good, bad or ugly? Is there an international version and a US version? If so, what limitations are in the international version? Many thanks...

1 0

Re: Public choice theory and the politics of antitrust (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 14 Jan 1998 18:28:50 -0800 > From: Tim May <tcmay(a)got.net> > Subject: Re: Public choice theory and the politics of antitrust > I think, Declan, that deleting the author's name is a Big Problem. > You have essentially made this author "Anonymous." Does knowing the name of who wrote a piece really have any bearing on the consistency of it? Is so then there would be a clear indication that there is a fundamental flaw with anonymous remailers and their place in society. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

CFP: DECEPTION, FRAUD and TRUST in AGENT SOCIETIES Workshop at AA'98
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text To: e$(a)vmeng.com Subject: CFP: DECEPTION, FRAUD and TRUST in AGENT SOCIETIES Workshop at AA'98 Mime-Version: 1.0 Date: Wed, 14 Jan 1998 15:30:24 -0500 From: Mary Ellen Zurko <zurko(a)opengroup.org> Sender: <e$(a)vmeng.com> Precedence: Bulk DECEPTION, FRAUD and TRUST in AGENT SOCIETIES Workshop at the Second International Conference on Autonomous Agents (AA'98) <http://www.cis.udel.edu/~agents98> FINAL CALL FOR PAPERS Description of the workshop: The aim of the workshop is to bring together researchers that can contribute to a better understanding of trust and deception in agent societies. Most agent models assume secure and reliable communication to exist between agents. However, this ideal situation is seldom met in real life. Therefore, many techniques (e.g. contracts, signatures, long-term personnel relationships) have been evolved over time to detect and prevent deception and fraud in human communication, exchanges and relations, and hence to assure trust between agents. In recent research on electronic commerce trust has been recognized as one of the key factors for successful electronic commerce adoption. In electronic commerce problems of trust are magnified, because agents reach out far beyond their familiar trade environments. Also it is far from obvious whether existing paper-based techniques for fraud detection and prevention are adequate to establish trust in an electronic network environment where you usually never meet your trade partner physically, and where messages can be read or copied a million times without leaving any trace. Trust building is more than secure communication via electronic networks, as can be obtained with, for example, public key cryptography techniques. For example, the reliability of information about the status of your trade partner has very little to do with secure communication. With the growing impact of electronic commerce distance trust building becomes more and more important, and better models of trust and deception are needed. One trend is that in electronic communication channels extra agents, the so-called Trusted Third Parties, are introduced in an agent community that take care of trustbuilding among the other agents in the network. For example, in some cases the successful application of public key cryptography critically depends on trusted third parties that issue the keys. Although we do not focus in this workshop on techniques for secure communication (e.g. public key cryptography), we would welcome analyses about the advantages and limitations of these techniques for trustbuilding. The notion of trust is definitely important in other domains of agents' theory, beyond that of electronic commerce. It seems even foundational for the notion of "agency" and for its defining relation of acting "on behalf of". So, trust is relevant also in HC interaction; consider the relation between the user and her/his personal assistant (and, in general, her/his computer). But it is also critical for modeling groups and teams, organisations, coordination, negotiation, with the related trade-off between local/individual utility and global/collective interest; or in modelling distributed knowledge and its circulation. In sum, the notion of trust is crucial for all the major topics of Multi-Agent systems. Thus what is needed is a general and principled theory of trust, of its cognitive and affective components, and of its social functions. Analogously the study of deception not only is very relevant for avoiding practical troubles, but it seems really foundational for the theory of communication. First, because it challenges Grice's principles of linguistic communication; second, because the notion of "sign" itself has been defined in semiotics in relation to deception: "In principle, Semiotics is the discipline studying whatever can be used for lying" (U. Eco). Thus not only practical defences from deception (like reputations, guaranties, etc.), but also a general and principled theory of deception and of its forms (including fraud) are needed. We would encourage an interdisciplinary focus of the workshop as well as the presentation of a wide range of models of deception, fraud and trust(building). Just to mention some examples; AI models, BDI models, cognitive models, game theory, and also management science theories about trustbuilding. Suggested topics include, but are not restricted to: * models of deception and of its functions * models of trust and of its functions * models of fraud * role of trust and trusted third parties (TTP) in electronic commerce * defensive strategies and mechanisms * ways to detect and prevent deception and fraud WORKSHOP ORGANIZATION The full-day workshop will be aimed at creating an informal atmosphere for stimulating discussions, interdisciplinary exchange and deep understanding of each other's pespective. We plan to have both: Paper presentations: Long presentations (25-30 min) of the accepted papers, plus 10-15 minutes for discussion (possibly with discussants). Plenary discussion at the end. Panel sessions: A couple of topics will be selected for a focused discussion. Some of the attendees will be requested to participate as panelists. The panels chairs will circulate prior to the workshop a list of questions for the panelists. The accepted papers will be published in the workshop proceedings. The publication of a revised version of the accepted papers is being negotiated with a high quality publisher. SUBMISSION: CRITERIA, FORMATS, PROCEDURE The workshop welcomes submissions of original, high quality papers addressing issues that are clearly relevant to trust, deception and fraud in agent-based systems, either from a theoretical or an applied perspective. Papers will be peer reviewed by at least two referees from a group of reviewers selected by the workshop organizers. Submitted papers should be new work that has not been published elsewhere or is not about to be published elsewhere. Paper submissions: will include a full paper and a separate title page with the title, authors (full address), a 300-400 word abstract, and a list of keywords. The length of submitted papers must not exceed 12 pages including all figures, tables, and bibliography. All papers must be written in English. * The authors must send by email the title page of their paper by January 15th. * Submissions must be send electronically, as a postscript or MSword format file, by January 20th. * The authors must also airmail one hard copy of their paper to two of the organizers as soon as possible after the electronic submission. * No submissions by fax or arriving after the deadline will be accepted. SUBMISSION ADDRESS for the electronic submission Rino Falcone falcone(a)pscs2.irmkant.rm.cnr.it tel. +39 - 6 - 860 90 211 for the airmail hard copy Babak Sadighi Firozabadi Department of Computing - Imperial College 180 Queen's Gate - London SW7 2BZ - U.K. and (notice "and") Cristiano Castelfranchi National Research Council - Institute of Psychology Viale Marx, 15 - 00137 Roma - ITALY tel +39 6 860 90 518 IMPORTANT DATES Deadline for the electronic title page January 15, 1998 Deadline for Paper Submission January 20, 1998 Notification of Acceptance/Rejection March 1, 1998 Deadline for camera-ready version April 1, 1998 Workshop May 9, 1998 PROGRAM COMMITTEE Phil Cohen Dept. of Computer Science and Engineering, Oregon Inst. of Science and Tech., USA Robert Demolombe CERT/ONERA, France Andrew J I Jones Dept. of Philosophy - Univ. of Oslo, Norway Anand Rao Australian AI Institute, Melbourne, Australia Munindar Singh Dept. of Computer Science - North Carolina State University, USA Chris Snijders Dept. of Sociology, Utrecht, The Netherlands Gilad Zlotkin VP Engineering, Israel Gerd Wagner Inst.f.Informatik - Univ. Leipzig, Germany Cristiano Castelfranchi (co-chair) National Research Council - Institute of Psychology- Rome, Italy Yao-Hua Tan (co-chair) EURIDIS - Erasmus University - Rotterdam - The Netherlands Rino Falcone (co-organizer) National Research Council - Institute of Psychology- Rome, Italy Babak Sadighi Firozabadi (co-organizer) Department of Computing - Imperial College - London - UK ========== Rino Falcone IP - CNR National Research Council Division of "Artificial Intelligence, Cognitive Modeling and Interaction" Viale Marx, 15 00137 ROMA email: falcone(a)pscs2.irmkant.rm.cnr.it or falcone(a)vaxiac.iac.rm.cnr.it tel: ++39 6 86090.211 fax: ++39 6 86090.214 ========== -- See <http://www.cs.umbc.edu/agentslist> for list info & archives. ---------------------------------------------------------------------- Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk/ info(a)hyperion.co.uk ---------------------------------------------------------------------- Full-Strength Cryptographic Solutions for Worldwide Electronic Commerce http://www.c2.net/ stronghold(a)c2.net ---------------------------------------------------------------------- Like e$? Help pay for it! For e$/e$pam sponsorship or donations, <mailto:rah@shipwright.com> ---------------------------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

RE: rant on the morality of confidentiality
by Wayne Radinsky 17 Dec '03

17 Dec '03

The reason morality is impossible to nail down is because it does not exist al all in any absolute sense, at least as far as science is concerned. If you declare, for example, that "murder" is "wrong" you are always left with dilemmas, such as whether soldiers who kill during a war are doing something "wrong". According to the principle of natural selection, all people, including scientists, exist purely to maximize their own inclusive genetic fitness. "Fit" means that an organism is well adapted to it's environment, so "maximizing inclusive genetic fitness" means having the maximum number of offspring which are themselves fit. Keep in mind that all natural selection really does is decide which genes are allowed to propagate, and since genes are just digital information stored on DNA molecules, what we call "life" is really just a complex interaction of matter/energy which determines which bits of information continue to exist over time. The underlying reason people benefit by promoting themselves as moral people, in general, is because of the benefit of what evolutionary psychologists call reciprocal altruism. With reciprocal altruism, both parties benefit if they are in a non-zero-sum situation. Because most situations are non-zero-sum and the benefits are so great, everyone has a stake in promoting themselves as a good reciprocal altruist, in other words, a good, trustworthy, moral person. This is how natural selection explains the existence of the concept of "morality". So it is a myth that scientists live to find deep truths or to benefit humanity. They may do those things, but their real goal is maximizing their own inclusive fitness. However, it may profit them if everyone else believes they live to find deep truths or to benefit humanity. Natural selection has created human beings, and the concept of "morality" in our minds, because moral justifications benefit the people promoting them -- which ultimately benefits their genes. The only way out is to believe in the afterlife, and religion, and that life has meaning beyond the genes and material world. Doing so doesn't make moral dilemmas go away, and you never know, people may just be believing such things for the benefit of genes, after all natural selection has no real concern for "truth". Wayne ---------- From: Blanc[SMTP:blancw@cnw.com] Sent: Wednesday, January 14, 1998 7:20 PM To: waynerad(a)oz.net Subject: Re: rant on the morality of confidentiality >X-Authentication-Warning: netcom5.netcom.com: vznuri@localhost didn't use HELO protocol >To: Tim May <tcmay(a)got.net> >cc: Bill Stewart <bill.stewart(a)pobox.com>, Blanc <blancw(a)cnw.com>, > cypherpunks(a)cyberpass.net, vznuri(a)netcom5.netcom.com >Subject: Re: rant on the morality of confidentiality >Date: Wed, 14 Jan 98 15:07:48 -0800 >From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> > >timmy predictably states the case for moral relativism. > >>I think it's an error to use "moral" or "immoral" as a modifier for "science." >> >>It's a matter of opinion/ethics as to whether some science is "for immoral >>purposes," but calling something "immoral science" is fraught with trouble. >> >>To a vegetarian, any science related to meat production is "immoral science." > >well, the concept of "criminality" is likewise fraught with trouble. >what is criminal and what is not? obviously some definitions stretch >the limits. is a jaywalker a criminal? a political dissident? ok, how >about an axe murderer? similarly, I think your predictable opposition >to the use of the word "immoral" is specious. > >moreover, I think such a misunderstanding, or worldview, is >detrimental to human welfare in general. I think all the evil >government scientists I've been referring to recently would >very much agree with you on rejecting ideas of "morality" and >"conscience". a person does not need an infallible definition >of morality to navigate the world, imho, but a person that has >none, or rejects any such attempt, is part of the problem and >not part of the solution, imho. > >>Personally, I don't view scientific experiments done on condemned prisoners >>as immoral. If a human being has already been sentenced to die, and, for >>example, accepts some payment (perhaps for his heirs) to die in some >>scientifically interesting way, why call it "immoral"? > >oh, well, lets see, you have a very obvious glitch in your reasoning. >you presume the prisoner gives his permssion. now lets see, assume he >doesn't? just to pop a hypothetical example out of the blue, >say someone named timmy gets arrested for gun violations and >gets thrown in jail temporarily. would it be immoral for the >police to remove his organs? perhaps without his permission? >perhaps without anesthetic? if not immoral, what? criminal? criminal >but not immoral? > >>While I would not have, I hope, worked in a Nazi death camp, the science >>obtained is undeniably real science, some of the only solid data we have on >>freezing humans, on exposing them to pathogens, etc. > >I've seen your defense of these experiments before-- its a topic of >interest for you for obvious reasons; it presents a possible glitch >in your moral relativism. > >I don't think BWs claim that there is a difference between >immoral scientists and immoral science. immoral science is what >immoral scientists practice. what's the point? my personal point >is that if we had a culture of people who were concerned about >morality, perhaps we would have institutions that reflect >integrity. > >contrary to most here, I believe that our institutions >are correctly representing the people of a country-- their thoughts, >their motivations, their concerns. its key to the philosophy of >disenfranchisement, apathy, and nihilism (and anarchism) to >claim that the government is not representing the people. what >is the evidence for this? > >because the government is corrupt, >the people are not necessarily corrupt? because the government >is greedy and full of powermongers, the population is not >full of greedy powermongers who would do the same given the >opportunity? government is a mirror into our psyches that >few people care to gaze on, precisely because we are not >the fairest of them all. > >we've got the government we deserve, and it reflects our >own pathologies within our psyches back to us. it reflects our >laziness and apathy, our cynicism, our alienation, our >withdrawal. and it takes a person who can master themselves >to face up to this simple truth-- something that most everone of our >country has failed to admit. > >when we begin to ask questions like "what is integrity" and >"what is moral" and come up with serious answers, our world >will improve. it will degenerate otherwise, and has given us >a tremendous existence proof of that fact to date. > >but just remember, again, that I'm aimlessly ranting here, and there's no >need to take any of this seriously <g> > > >

2 1

Electric Communities notion of identity
by Bill Frantz 17 Dec '03

17 Dec '03

Tim may wrote: >I haven't checked on them in the last few months, but "Electric >Communities" (www.communities.com) was doing some interesting work on >adding security and market mechanism extensions to Java, in a superset >language they called "E." > >Many Cypherpunk list members, past and present worked on aspects of this, >including Chip Morningstar (one of the founders), Doug Barnes, Norm Hardy, >Bill Frantz, Mark Miller, etc. They can speak up and say more. E is a language which supports optimistic distributed programming. It produces .class files which run on unmodified Java Virtual Machines. More information is available from http://www.communities.com Perhaps of more interest to cypherpunks is the model of identity implemented in what is called today EC-Habitats, our graphical "world". (See the web pages for more details.) The model is quite similar to the model used by James A. Donald's Crypto Kong. Identity is a public key. You prove who you are by showing that you hold the private key corresponding to that public key. All of this key stuff is hidden by the user interface. What the user sees is: You meet someone "in world" and give them a nickname. When you meet them again, the software knows that it is the same "person", and refers to them by your nickname for them. Thus people can develop and maintain reputations for each other. ------------------------------------------------------------------------- Bill Frantz | | Periwinkle -- Consulting (408)356-8506 | All politicians should ski.| 16345 Englewood Ave. frantz(a)netcom.com | | Los Gatos, CA 95032, USA

1 0

RE: rant on the morality of confidentiality (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Note that any errors in transcription are mine, I had to re-edit this to get it to fit on a 80 column screen. Forwarded message: > From: Wayne Radinsky <waynerad(a)oz.net> > Subject: RE: rant on the morality of confidentiality > Date: Wed, 14 Jan 1998 20:32:15 -0800 > The reason morality is impossible to nail down is because it does not exist > al all in any absolute sense, Morality is an individuals or societal groups beliefs of right and wrong. Of course there is no more absolute right morality than there is a right flavor of ice cream, this entire line of reasoning is a non sequitar. Ethics is the issues of what is correct or permissible in relation to a particular human activity such as scientific research or law. When you use 'science' and 'morality' in a comparison you are in actuality comparing apples and oranges. Science is related to *how* one does a particular activity, it is not concerned in the least with *why* that activity should (not) be done in the first place. Science and its philosophy are *not* applicable to all areas of human discourse anymore than the Bible is applicable as a methodology to study quantum physics or aerodynamics. > at least as far as science is concerned. Science isn't concerned with right, wrong, morality, etc. It *is* concerned with a systematic way to ask questions in a *specific* area of discourse. To apply science to religion is as much a disservice to science and religion as it would be to try to apply it to art. > According to the principle of natural selection, all people, including > scientists, exist purely to maximize their own inclusive genetic fitness. Exactly whose theory or principle of natural selection? At the current time I am aware of several different theories that fit the data but which in many aspects are mutualy exclusive. This is entirely too broad a statement to have reasonable merit. We simply don't know enough about what is going on with the processes of life to justify this sort of leap. > Keep in mind that all natural selection really does is decide which genes > are allowed to propagate, Natural selection isn't doing anything. It is a term we apply to a process we observe occurring. That process seems to occur at several levels besides just the genes. > and since genes are just digital information stored on DNA molecules I'm afraid it's a bit more complicated than that. We start with the base pairs, which really are informationaly isolated from the codons which are triplets of base pairs which form a 'word' in the genetic code. It is of some import to realize that the genetic code itself is *not* dependant on the actual mechanism of expression, in other words you can talk about the genetic langauge without any reference to the base pairs themselves. It is the codons that are important. There is a fundamental symmetry break at that level. Each of the codons is mapped to one of 20 amino acids. Since there are 4 bases arranged in 3's there are 64 combinations. This means that for any particular amino acid there is more than one way to code it. There are also several 'stop' codes which break the transcription process as well. >, what we call "life" is really just a complex > interaction of matter/energy which determines which bits of information > continue to exist over time. That works equaly well as a definition of the cosmos. Keep this up and you'll become a pantheist...;) > The underlying reason people benefit by promoting themselves as moral > people, in general, is because of the benefit of what evolutionary > psychologists call reciprocal altruism. With reciprocal altruism, both > parties benefit if they are in a non-zero-sum situation. Because most > situations are non-zero-sum and the benefits are so great, everyone has > a stake in promoting themselves as a good reciprocal altruist, in other > words, a good, trustworthy, moral person. This is how natural selection > explains the existence of the concept of "morality". Oh boy... Not all moralities or religions accept the premise of altruistic behaviour. Further, if you look at the prisoners game, you actualy accrue more from intermittent moral behaviour than from consistent moral behaviour. Human morality has no place in any consistent theory of natural selection that I have ever seen. Please explain how a moral theory as you propose will increase the participants likelyhood for reproduction? Further, if you look at primate research (both non-human and human) what you find is a tendency for promiscuity in both sexes. Males tend to be 'in heat' at all times while females (at least when they are just entering the mating group) tend to follow a estrus or lunar based cycle. Recent studies of primates in Africa have found that the previous theory that band members don't intermingle is actualy incorrect. Upon extended monitoring they find that when the females go into heat each month they sneak off and mate with outlying members of other bands (who are usualy un-paired males). They intentionaly hide this activity from their band mates because if caught they will face a physical assault and potentialy death. This raises the question of whether chimps have morality under your view because it is clearly a measure of right and wrong. Are you willing to give chimps some sort of equal status to humans as a result? Studies of human females find this same sort of behaviour in the young just entering the mating pool. Studies find that young women tend to wear more provocative clothing and explore non-familiar peer groups in relation to their menstrual cycle. > So it is a myth that scientists live to find deep truths or to benefit > humanity. Absolutely, unfortunately the fallicy with such an assertion have nothing to do with the reasons you expound. > They may do those things, but their real goal is maximizing their own > inclusive fitness. So being a scientist increases ones probability for mating? Please be so kind as to offer some proof. Do scientist tend to have more offspring than non-scientist? I think you will find that the actual studies show that the more intelligent and well educated tend to have *fewer* children. This would seem to run contrary to your hypothesis. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: how to release code if the programmer is a target for coercion (fwd)
by Ryan Lackey 17 Dec '03

17 Dec '03

> man in the middle attack on people signing code How would you do this? There is code. You sign that code with your personal pgp key, which you are assumed to keep secure. Cases: A) The code is authentic, but backdoored: you will look at it when verifying it and refuse to sign it, optionally posting how it is flawed to the world. B) The code is not the actual code used in the product, but unbackdoored: In this case, you sign it, but when someone tries to compile, the real code is not signed, and thus the attacker is no better off. C) The code is not the actual code used in the product, and is backdoored: The NSA is really stupid, then. D) The code is the authentic code, and is unbackdoored: you win. The only attacks would be if you could sneak a bug by the verifiers. With modern execution environments, it is *possible* there could be unintended consequences to almost anything. That's why I think one of the first pieces of code verified should be the JVM. Another attack would be having 5 NSA agents sign a piece of code, but you could prevent that by having the list made up of distinct well known individuals who are unlikely to all be bought -- if the NSA wants to give $100m each to the most frequent 100 posters on cypherpunks, I want to get in line :) -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/

1 0

Re: how to release code if the programmer is a target for coercion (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Sorry Ryan, I'll need more context to answer this one. Would it be too much to ask for more than a fragment of one sentence...:( Forwarded message: > Subject: Re: how to release code if the programmer is a target for coercion (fwd) > From: Ryan Lackey <rdl(a)mit.edu> > Date: 15 Jan 1998 01:41:01 -0500 > > man in the middle attack on people signing code > > How would you do this? There is code. You sign that code with your personal > pgp key, which you are assumed to keep secure. Cases: I've probably sent out somewhere in the neighborhood of 40+ messages in the last two days, several have related to signing documents in different contexts. I don't recognize this particular fragment. Sorry, I don't memorize my traffic nor do I keep archives of it and I'm way to lazy to go searching the cypherpunks archives at 2am. I'm assuming this has something to do with the eternity server/black_net discussion that has been going on. So I'll take a stab at it, not that it may make any sense in the actual context ... - You generate the code and sign it - You deliver the signed code to a data haven server of some architecture (note that you don't know where it is or who runs it, I'll assume you use some particular usenet newsgroup as your drop point) - Somebody else comes along and sees a list of available items and selects yours (again through a usenet based request mechanism). - They receive the code signed with 'your' key and decide they want to verify the signing (through yet another usenet channel). The problem with this model is in the second step. What is to keep them from removing your signatory, moding the code, and then resigning it. If the recipient desides they want to check the sign they have two choices: - select an anonymous key that has been previously stored on some sort of key server. (if they are running a eternity server blind they could be running a key server blind as well, it follows that at least some of the users of your software wanting to verify the signing will go to this server and hence have corrupted code, if we're using the usenet model this is even more likely since they could be running a feed point for other usenet feeds downstream and hence capture many if not all requests for the product, especialy if they were the only server to actualy carry a copy.) - contact you the author directly (I'm assuming of course you were silly enough to put a publicly available key directly traceable to yourself on it in the first place) in which case they simply intercede from a upstream tap and verify their request in your behalf. In either case there is no guarantee that what comes off the server is what you the source put on there. Hence the long term security of the key is compromised. In particular, in the second case, since they already know who provided the illicit data to the server there motive is clearly to track the users. This breaks the anonymity of the data haven. Implicit in a workable data haven model is the goal of both source and sink anonymity. This means that any signed data on the server must provide a mechanism for the user to verify the sign by access to a suitable key to generate the appropriate hash and compare it to the one that the server delivered. If they match you should have the correct unadulterated document. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

BAY AREA CYPHERPUNKS MEETING, SATURDAY 1/17, OAKLAND
by Bill Stewart 17 Dec '03

17 Dec '03

The January Bay Area Cypherpunks Meeting will be Saturday afternoon at C2 Software's office in Oakland. Agenda: Export Laws - Lee Tien and Greg Broiles Work in Progress Lots of discussion from RSA Conference. Time: 12-6pm followed by dinner - program starts at 1:00 Location: C2Net Software, Inc. 1440 Broadway Suite 700, Oakland, CA Phone: (510) 986-8770 Fax: (510) 986-8777 Public Transportation - about two blocks from the 12th St BART station. This is the best way to get there from San Francisco, and parking for BART trains is easy. :-) Driving - From South - take 880N to Broadway exit, about .9 mile, park From San Francisco - Take the Bay Bridge to Grand Ave, turn right on Telegraph and continue on Broadway. Map URL: http://www.mapblast.com/yt.hm?FAM=mapblast&CMD=GEO&SEC=find&IC=0%3A0%3A5&IC… Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

Re: how to release code if the programmer is a target for coercion (fwd)
by Ryan Lackey 17 Dec '03

17 Dec '03

Jim Choate writes: > more than a fragment of one sentence...:( > I'm assuming this has something to do with the eternity server/black_net > discussion that has been going on. So I'll take a stab at it, not that it > may make any sense in the actual context ... Yes, you guessed right :) > > - You generate the code and sign it > > - You deliver the signed code to a data haven server of some architecture > (note that you don't know where it is or who runs it, I'll assume you > use some particular usenet newsgroup as your drop point) > > - Somebody else comes along and sees a list of available items and selects > yours (again through a usenet based request mechanism). > > - They receive the code signed with 'your' key and decide they want to > verify the signing (through yet another usenet channel). > > The problem with this model is in the second step. What is to keep them > from removing your signatory, moding the code, and then resigning it. If the > recipient desides they want to check the sign they have two choices: The problem reduces to one of distribution of public keys. In my model (er, actually Lenny Foner's model, in this case), you distribute something that has intrinsic verifiability -- the eternity source. So whether or not rdl's eternity-dds signing key is compromised is irrelevant to the users -- in fact, the assumption is that since I am a known target, I've been killed or compromised. So, there's this potentially untrusted code out there. People who have known public keys then inspect and sign the code. It is assumed these people have distributed their public keys far and wide, signed by lots of people, etc. As long as you can assume the "PGP web of trust", the distributed software signing thing works. I agree that the current state of PGP use is probably not enough for the "PGP web of trust" -- I've *never* used a key and found it signed by anyone I know. However, I think even the current system puts a pretty high barrier to fraud, and if there started to be fraud, people would start signing each other's keys. A keyserver serving keys like "rdl's eternity-dds release signing key" might be subject to traffic analysis, true. However, as you suggest, you could put the keyserver inside Eternity. Then, the problem just gets shifted -- now you need (a) pgp signing key(s) which has/have signed all of those keys. I think it is unreasonable to think merely signing a key (and distributing your own personal key securely) will be a felony before anything has been done with that key. More to the point, I think it is unreasonable to think the government will go after people purely for signing the source code to a piece of software -- signing does not imply you use it, does not imply that you wrote it, does not imply anything other than that you've looked at it, verified it, and signed it. The government would do just as well to track down the posters to cypherpunks and kill them. -- Ryan Lackey rdl(a)mit.edu http://mit.edu/rdl/

1 0

BXA Wassenaar Rule
by John Young 17 Dec '03

17 Dec '03

BXA published today its interim rule for implementing the Wassenaar Arrangement: http://jya.com/bxa-wa-rule.txt (354K) Or compressed, self-extracting Zip: http://jya.com/bxa-wa-rule.exe (80K) ---------- Federal Register, 15 January 1998 [Excerpt] [[Page 2452]] Bureau of Export Administration _______________________________________________________________________ 15 CFR Parts 732, 740, 742, 743, 744, 746, 762, and 774 Implementation of the Wassenaar Arrangement List of Dual-Use Items: Revisions to the Commerce Control List and Reporting Under the Wassenaar Arrangement; Rule DEPARTMENT OF COMMERCE Bureau of Export Administration 15 CFR Parts 732, 740, 742, 743, 744, 746, 762, and 774 [Docket No. 971006239-7239-01] RIN 0694-AB35 Implementation of the Wassenaar Arrangement List of Dual-Use Items: Revisions to the Commerce Control List and Reporting Under the Wassenaar Arrangement AGENCY: Bureau of Export Administration, Commerce. ACTION: Interim rule with request for comments. ----------------------------------------------------------------------- SUMMARY: Representatives of thirty-three countries gave final approval July 12-13, 1996 in Vienna, Austria to establish the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies. The thirty-three countries agreed to control all items in the List of Dual-Use Goods and Technologies with the objective of preventing unauthorized transfers. They further agreed on a target date of November 1, 1996, for implementation of the Wassenaar Lists. The purpose of this interim rule is to make the changes to the Commerce Control List necessary to implement the Wassenaar List. In addition, this interim rule imposes new reporting requirements on persons that export certain items controlled under the Wassenaar Arrangement to non-member countries in order to fulfill the information exchange requirements of the Wassenaar Arrangement. The Department of Commerce, with other concerned agencies, is reviewing the Export Administration Regulations to determine whether further changes will be required to implement the information sharing provisions of the Wassenaar Arrangement and to make the necessary adjustments to existing country groups. This rule also revises part 740 of the EAR by removing License Exception availability for certain items controlled for missile technology reasons. Although the Export Administration Act (EAA) expired on August 20, 1994, the President invoked the International Emergency Economic Powers Act and continued in effect, to the extent permitted by law, the provisions of the EAA and the EAR in Executive Order 12924 of August 19, 1994, as extended by the President's notices of August 15, 1995, August 14, 1996 and August 15, 1997. DATES: This rule is effective January 15, 1998. Comments on this rule must be received on or before February 17, 1998. ADDRESSES: Written comments should be sent to Patricia Muldonian, Regulatory Policy Division, Bureau of Export Administration, Department of Commerce, P.O. Box 273, Washington, DC 20044. FOR FURTHER INFORMATION CONTACT: James Lewis, Director, Office of Strategic Trade and Foreign Policy Controls, Bureau of Export Administration, Telephone: (202) 482-0092.

1 0

Sealand (was Re: (eternity) autonomous agents)
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Lucky Green wrote: >Sealand, about which I wrote about on this list before, was an example >that should be studied by the offshore advocates. Based in an old >oilrig housing platform, Victorian sea-fort, AFAIR. >some unlucky investors attempted to establish >their own country. They began issuing stamps and passports for their >"country". As any reasonable person should have expected, nobody would >move their mail and nobody recognized their passports. Which wasn't the point; the majority of those they sold were just for fun, not serious attempts at being recognized. However, I noticed a newspaper article over Christmas about a woman who's selling professional-looking passports in the names of countries which no longer exist or changed names; the intention, presumably, being that immigration officials won't realise that the passports aren't real. >They went bankrupt. I'd be interested to know where you got your information from, because both Strauss ('How to start your own country') and the Micronations Web page tell different stories; that Sealand was set up mostly for fun by a couple of guys who made a lot of money from pirate radio and it lasted at least fifteen years. Of course this doesn't detract from the main point, which is that you won't get away with offshore data-havens unless you are able to defend them against invaders; Strauss claims Sealand was invaded by some German businessmen at one point, and any such data-haven will soon be visited by cops or warships. Mark

2 1

AT&T Database Reveals Unlisted Names From Numbers
by Robert Hettinga 17 Dec '03

17 Dec '03

Yet another reason for cash settled IP telephony? Actually, you can trace an IP address just as well, can't you?... Cheers, Bob Hettinga --- begin forwarded text Resent-Date: Wed, 14 Jan 1998 19:06:14 -0800 (PST) X-Authentication-Warning: weber.ucsd.edu: procmail set sender to rre-request(a)weber.ucsd.edu using -f X-Authentication-Warning: weber.ucsd.edu: Processed from queue /usr/spool/mqueue/rqueue Date: Wed, 14 Jan 1998 18:58:10 -0800 (PST) From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: AT&T Database Reveals Unlisted Names From Numbers Resent-From: rre(a)weber.ucsd.edu Reply-To: rre-maintainers(a)weber.ucsd.edu X-URL: http://communication.ucsd.edu/pagre/rre.html X-Mailing-List: <rre(a)weber.ucsd.edu> archive/latest/1803 X-Loop: rre(a)weber.ucsd.edu Precedence: list Resent-Sender: rre-request(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 14 Jan 98 12:38 PST From: privacy(a)vortex.com (PRIVACY Forum) Subject: PRIVACY Forum Digest V07 #02 PRIVACY Forum Digest Wednesday, 14 January 1998 Volume 07 : Issue 02 ---------------------------------------------------------------------- Date: Tue, 13 Jan 98 10:05 PST From: lauren(a)vortex.com (Lauren Weinstein; PRIVACY Forum Moderator) Subject: AT&T Database Reveals Unlisted Names From Numbers Greetings. In a memorable scene from the 1975 film "Three Days of the Condor," CIA agent-on-the-run Joe Turner, played by Robert Redford, monitors a phone line with a telephone test set (known in telco parlance as a "butt set" or more popularly a "butt-in"). After taping and determining the touch- tone digits being dialed, he makes a call to an "operator" who provides the name and address of the party associated with that dialed number. His exchange with that operator was completely authentic. For decades telephone companies have operated "Customer Name and Address" bureaus, known colloquially as "CNA" bureaus. Presented with a phone number, the CNA operators provide name and address data, even for unlisted or non-published numbers. This service was and is ostensibly only for telephone company use. The telcos rightly considered this information sensitive, and CNA access numbers were always subject to frequent changing, but still leaked out. They were highly coveted by private detectives, phone phreaks, and others, for various investigative or even harassing purposes (few things can upset a person who thinks they have an unlisted number more than a bizarre call from an unknown person in the dead of night who knows their name...) Over the years, telephone subscribers have become more aware of the various commercial and other purposes to which their telephone listings have been subjected, and increasing percentages of folks have unlisted ("non-published" or "non-pub") numbers. In states like California, the majority of numbers are non-pub. Telephone company literature usually states that a non-pub status (for which subscribers now typically have to pay an extra monthly fee) also protects them from so-called "upside-down" listings and services--essentially published versions of CNA that provide listings in telephone number and/or house address order. Clearly the telcos realize that people are still very sensitive about their names and/or addresses being looked up by number. So it was with considerable concern late last year when I learned of an easily accessible AT&T database that provides a major portion of CNA--the provision of names from numbers, even for unlisted or non-published numbers. I have been engaged in a dialogue with various AT&T officials concerning this database since then. Getting an official response has taken some time (the holidays didn't help of course), and I've been told that I'm the first person to ever bring this issue to their attention (a familiar enough refrain when it comes to privacy issues...) The database in question is a "service" (which AT&T says is greatly appreciated by their customers) which ostensibly exists to allow automated access to number information by business customers. AT&T long distance business customers, upon calling their designated customer service number from their bills, enter a typical complex voice mail maze. After entering their main AT&T account number into the system, one of the choices available relates to "if you do not recognize a number on your bill." Choosing this option drops the user into an automated system which allows the direct entering of phone numbers. For each number entered, the system then attempts to read out (using a voice synthesizer) the name associated with that number. An option is also available to spell out the name, since text-to-speech handling of proper names can be less than optimal (remind me to tell the story of my "Touch-Tone Unix" synthesizer system from the '70's someday). The number entry/readout sequence can be repeated (apparently) as many times as desired. The need for a customer to find out who is associated with a truly unknown number on their bill can be a real one. Unfortunately, this database has a variety of negative characteristics: -- The database does not limit lookups to numbers actually on the customer's bill! Any numbers can be entered, and the system will usually provide the associated name, even if they are not on the current (or any) bill. Presence or absence from the bill is totally irrelevant. -- The database provides data for unlisted or non-published numbers just as happily as for listed numbers. This includes corporate internal numbers, modem and fax lines, residential second lines, and so on. -- For listed numbers, the database sometimes provides not the name associated with the listing, but rather the name of the *person* who is apparently the "billing contact" for the listed entity and usually has nothing whatever to do with the listing itself! To quote from the official response I received from the AT&T media relations representative with whom I have been in contact about these concerns: "As a matter of policy, AT&T safeguards customer information from unauthorized access. It is also our policy to allow business customers to access their account-billing records to check the accuracy of their records and to request changes, as necessary, by using an automated system. Until now, questions such as yours have never come up, so we want to thank you very much for bringing your concerns to our attention. ... The system has been in use for several years and, in our search for ways to improve the accuracy, timeliness and cost- effectiveness of the services we offer customers, we had already begun evaluating a number of options. Your inquiry has hastened our considerations of new ways to offer capabilities that our business customers value while safeguarding private customer information from unauthorized access. So, again, we thank you for bringing this issue to our attention." What this really means in terms of actual changes is decidedly unclear. No date is specified for any alterations, nor have they explained in any manner what sorts of customer privacy changes (if any) will be made, nor how any new system might differ from the current one. In the meantime, I have been told that they do not intend to alter the operations of the current database in any manner. I have suggested suspending or limiting the current system as a clear move to help protect telephone subscribers' privacy. AT&T has chosen not to do so. They point out that the database is not "intended" for other than the lookup of unknown numbers on the bills, and that they consider any other use to be improper. However, such improper uses will continue to be completely possible under the current system. My overall impression is that AT&T feels people aren't concerned about number to name lookups, and that AT&T doesn't see what harm such information could do in any case. This sort of "What harm could it do?" attitude is one that PRIVACY Forum readers have seen repeatedly with commercial databases of various sorts. It of course is important that persons make their feelings about such issues known once they come to light. If people don't bother to complain, faulting the commercial database policies themselves becomes considerably more problematical. Others may agree, or perhaps disagree, with AT&T's apparent attitudes about this matter. It seems likely that more persons expressing their opinion, either positive or negative about the system, would be useful to AT&T in helping to gauge public feelings about such matters. AT&T has told me specifically that the appropriate venue for such opinions would be AT&T Executive Resolution, at (908) 221-4191 (8-5 PM Eastern--I'm told that collect calls are accepted during those business hours). All too often, we see that the implementation of potentially useful services is done in a manner that produces undesirable (and often unintended) negative privacy side-effects. A key issue is to what extent an entity responds to privacy concerns, even when they might not agree with them, after they've been made aware of the issues. So far, I'm afraid that AT&T's response to this situation has not been stellar. --Lauren-- Lauren Weinstein Moderator, PRIVACY Forum http://www.vortex.com ------------------------------ End of PRIVACY Forum Digest 07.02 ************************ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Joe Bress
by bill payne 17 Dec '03

17 Dec '03

Thursday 1/15/98 6:54 AM Ray Sumser Arnold Intrater Jennifer Lipnick National Academy of Public Administration 955 L'Enfant Plaza, North SW Washington, DC 20074 202-651-8062 393-0993 FAX Former NAPA employee and lawyer Joe Bress' words, "Win or lose," to me spoke in your presence in ABQ caused some additional whistleblowing on Internet. A cypherpunk, I am guessing. I stayed off Internet for one year so as to be above suspicious. The attached letter to judge Edwards was mailed July 16, 1996. And received July 18, 1996. Moorer and other retired Navy brass, at a news conference, expressed grave suspicion over the FBI's recently concluded 18-month investigation of the disaster, in which the plane disintegrated July 17, 1996, en route to Paris and plunged into the Atlantic near Long Island, killing 230. They said a military missile explosion just outside the 747's forward cabin seems the likely cause. While the timing of my letter to Edwards was merely coincidence, I am concerned that whistleblowing may constitute a danger to public safety. Please help to get this matter settled. Thanks bill Title: Navy Brass Revive Missile Theory [Email Reply] Retired Navy Brass Revives Twa Missile Theory Officers Voice Suspicions Over Fbi's Findings By John Hanchette and Billy House Adm. Thomas H. Moorer, former chairman of the Joint Chiefs of Staff, on Jan. 8 called for new congressional hearings into last July's crash of TWA Flight 800. "It absolutely deserves more investigation -- a lot more," Moorer told Gannett News Service. "This time, I wouldn't let the FBI do it. I'd have the NTSB (National Transportation Safety Board) do it. I think Congress certainly should get more answers from the FBI." Moorer and other retired Navy brass, at a news conference, expressed grave suspicion over the FBI's recently concluded 18-month investigation of the disaster, in which the plane disintegrated July 17, 1996, en route to Paris and plunged into the Atlantic near Long Island, killing 230. They said a military missile explosion just outside the 747's forward cabin seems the likely cause. "All evidence would point to a missile," Moorer said. "All those witnesses who saw a streak that hit the airplane -- you have to assume it's a missile. In an investigation like this, you can't overlook anything." Moorer, an expert on missile weaponry, attended the news conference convened by a media critic group that scoffs at the official NTSB and FBI findings unveiled a month ago. Joseph Valiquette, FBI spokesman in New York, said the agency is "comfortable" with its conclusions that "there's no evidence a criminal act was responsible." 'A train wreck in the sky' The Navy officers -- who appeared with a veteran TWA pilot, two witnesses and members of Accuracy in Media, which coordinated the briefing -- said a new study of evidence from recovered Flight 800 data recorders rebuts the government's official story about fuel vapors exploding in a central tank of the jetliner after a spark from unknown causes. "This is either a train wreck in the sky, or an explosive device -- mid-air, outside the plane," said retired Navy Cmdr. William Donaldson, who flew 89 combat missions over Vietnam and for five years was a top Naval aviation accident investigator. Donaldson, who said he is not working for TWA or the passenger jet's manufacturer, Boeing, examined the mountain of material released in early December about the $100 million federal investigation. He particularly criticized one NTSB document reflecting flight-recorder data that was not discussed when the material was unveiled in Baltimore last month. Donaldson noted a line drawn through readings of the last five seconds of the doomed jet's flight, with a handwritten margin note reading "End of Flt. 800 DATA" -- except there are more revealing readings below it. He said he thinks this was an attempt to divert attention from the final readings on the flight recorder: "The only reason you put flight data recorders into an airplane at millions of dollars cost is to capture this last data line." He said NTSB officials later tried to convince the Navy dissidents it merely was transcript from an earlier flight -- a conclusion former TWA pilot Howard Mann said is "not possible -- it's erased -- there's just no way." The final readings show chaos in the sky -- with airspeed dropping instantly by almost 200 knots, the pitch angle jumping five degrees, altitude dropping 3,600 feet in about three seconds, the roll angle going from zero to 144 degrees (the plane almost inverted), and magnetic heading changing from 82 degrees to 163 degrees. The small vane that measures wind angle striking the nose -- situated on the left forward fuselage -- goes from 3 degrees to 106 degrees back to 30 degrees. Donaldson said all these indicate an extremely high-pressure wave coming from the lower left side of the plane's front. The measurements "indicate there was an explosion -- a big explosion -- outside the cockpit." Mann agreed with Donaldson's interpretations. Donaldson also said: * Divers found debris from the forward fuselage as much as 2,900 feet to the right of the extended flight path, suggesting it may have been propelled by an explosion from the plane's left. * Fuselage doors from near the front of the craft, later recovered, were bent and dented inward. * Subsequent tests Donaldson conducted showed fuel vapor in the empty center tank would not have been flammable enough to cause such an explosion, and there was nothing to ignite it. * More damage occurred to the left wing than the right. * The fuselage skin broke up in such a way as to suggest a pressure wave from the outside left front. "What you're looking at is the product of an explosion in the sky that totally destroyed the aircraft's ability to fly anywhere," he said. A digital animation computer rendering of the catastrophe -- prepared by the CIA for media use in early December -- sought to explain some of the physical forces on the flight data by showing the nose breaking off the huge aircraft and the body then climbing almost 3,000 feet before a huge petroleum explosion sends it fireballing into the sea. "There couldn't have been an aviator at CIA who had anything to do with that," said Donaldson. "They were laughed out of town by pilots." Eyewitness accounts Two witnesses from Long Island -- lawyer Frederick Meyer and furniture maker Richard Goss -- described what looked like a missile contrail rising upward in the sky before the TWA explosion. Goss said the FBI was interested and "very amazed," but later "there wasn't as much enthusiasm . . . I never heard from them again." Meyer, a helicopter pilot in Vietnam, was flying an Air National Guard helicopter on maneuvers when the disaster occurred in front of him: "I saw, what I swear to God, was military ordnance explode." Meyer said, "The aircraft I saw came out of the air like a stone. Nobody saw that aircraft climb a foot after it was hit. The CIA cartoon bears no similarity to what I saw." Meyer approached the FBI with his report, but said after two desultory interviews, agents never called back. He claims he knows several witnesses who called the FBI's 800 number with similar reports, but were not called back. The FBI, Donaldson said, "is holding the lid on 92 witnesses who allege they saw something go and climb to the sky. Most of those people are scared to death right now." Valiquette, the FBI spokesman, said, "We know there are always going to be people who will never accept our findings. And we're comfortable with that, too. . . . We went back and re-interviewed all those eyewitnesses. We plotted their positions, and there was a lot of analysis done. Today, we are comfortable with the results." The retired officers speculated a missile could have come from either a submarine or a buoy device developed by the Navy years ago to float attack missiles into position for launch from miles away. "One vital question we haven't attacked is the origin of that streak of light," Moorer said. "Where did it come from? Who fired it." For its part, the NTSB insisted after the briefing that "We have no physical evidence that a missile impacted TWA 800, or a fragment of a missile penetrated the aircraft." Navy Times, Jan. 19, 1998, Page 14 Posted here Jan. 15, 1998 Web Page: http://www.aci.net/kalliste/

1 0

Microsoft Metaphors
by Declan McCullagh 17 Dec '03

17 Dec '03

What are the best metaphors to use when talking about a browser and an operating system? Is the combination like a car and an engine, or a car and a roofrack? A pair of gloves? Or is it even useful to talk about a browser/OS metaphor in the case of Microsoft, since IE has been glued into the operating system in the form of .DLLs? Might that be more like the wheels of a car? -Declan

5 4

Microsoft Metaphors (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 15 Jan 1998 10:09:09 -0500 > From: Declan McCullagh <declan(a)well.com> > Subject: Microsoft Metaphors > What are the best metaphors to use when talking about a browser and an > operating system? Is the combination like a car and an engine, or a car and > a roofrack? A pair of gloves? It seem to me to be like a car and a road map. It simply lets you address the multiplicity of resources (ie destinations) out there in a convenient model. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Re: how to release code if the programmer is a target for coercion (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Ryan, Thanks for the clarification. I've added a few issues that have occured to myself and Doug Floyd (operator of the dh-l mailing list) during several short discussions we've had over the last year. Forwarded message: > Subject: Re: how to release code if the programmer is a target for coercion (fwd) > From: Ryan Lackey <rdl(a)mit.edu> > Date: 15 Jan 1998 05:19:25 -0500 > The problem reduces to one of distribution of public keys. Agreed. > In my model > (er, actually Lenny Foner's model, in this case), you distribute something > that has intrinsic verifiability -- the eternity source. If I understand this you mean to use the code itself as the key? So you require all the eternity servers to use the same source? Doesn't this imply at some point a single point of distribution and hence another point of attack? > So whether > or not rdl's eternity-dds signing key is compromised is irrelevant to > the users -- in fact, the assumption is that since I am a known target, > I've been killed or compromised. So, there's this potentially untrusted > code out there. I am unclear as to what you mean by 'known target', are you refering to a particular eternity server, the eternity server code itself, the document the user is looking for, or the provider of the document? I suspect the provider of the document. Doesn't the fact that you can't address issues of key validity become an issue? How does this model handle key aging or do you propose to leave the same keys out there for extended periods of time (ie decades after your death)? Doesn't this extended lifetime represent a threat to the validity of the keys since it provides mallet an exceptional period of time in which to mount the attack? Especialy since nobody is checking the keys? It further seems to me that the main motive of most law enforcement is going to be going after the user of the data the majority of the time since this is much more time critical than knowing who provided the data. After all simply knowing who did the original sourcing is not enough to remove the problem after the fact. Eternity servers are after intended to be long lived mechanism, this provides the authorities much time to follow the data and analyze the network traffic. Wouldn't it be important to provide some sort of delivery mechanism that provides a full encryption envelope around the data until it is delivered to alice? I recognize this exacerbates instead of alleviates the key server security issues. > People who have known public keys then inspect and sign the code. It is > assumed these people have distributed their public keys far and wide, signed > by lots of people, etc. As long as you can assume the "PGP web of trust", > the distributed software signing thing works. Ah, ok. So we again are assuming everyone is using the same particular piece of technology. In this model, would it not add security to the mechanism to have the eternity server deliver the encryption software (ie PGP)? How does this model handle the physical contact that is required in the PGP web of trust? In particular how does it verify that the actual physical contact occured? Can you address the key distribution mechanism and how it addresses the issue of a mallet producing their own key server with their own keys signed sureptitiously by their own multiplicity of 'nyms? Do you see a group of 'Johny Appleseeds' roaming the country in person dropping little dolops of signed keys off? Or, do you believe some sort of key verification service will need to be generated that compares keys for individual 'nyms on the various servers and publishes a list of keys that don't match (something that would to my thinking be prime data for a data haven server). Doesn't such a 'trusted' service have the same sort of 'user end' threats as the eternity servers themselves? Assume for a moment that mallet wants to monitor a particular alice. Alice makes her request which goes through mallets tap. Outbound traffic is uneffected so that the actual keys sent to the server are good. However, no the return stroke mallet intercept the traffic, provides their own bogus keys and signed document. How do you see alice finding a way to recognize this? The threat with this model is that alice might be turned and therefore condemn any co-participants in whatever activity alice is supposed to be involved in (eg ingesting lettuce or leading a freedom cell in Burma)? > I agree that the current state of PGP use is probably not enough for > the "PGP web of trust" -- I've *never* used a key and found it signed by > anyone I know. However, I think even the current system puts a pretty high > barrier to fraud, and if there started to be fraud, people would start > signing each other's keys. I agree with all the points but the last. When the cost becomes too high (ie inconvenient) they simply won't use it. I just can't seem to grasp why people would spend even more money (which would provide a flag via monitoring of funds) to physicaly meet a group of others who they probably don't know and therefore probably shouldn't trust at such a fundamental level. > A keyserver serving keys like "rdl's eternity-dds release signing key" might > be subject to traffic analysis, true. However, as you suggest, you could > put the keyserver inside Eternity. Then, the problem just gets shifted -- now > you need (a) pgp signing key(s) which has/have signed all of those keys. I believe it is a fundamental mistake to have the key server inside the eternity server, just as I object to anonymous remailers that provide such service. The key servers should be on different machines to provide physical independance & legal indipendance - these are long lived keys after all and there is no reason architecturaly to put the keys at threat if the data haven is at threat, and finaly technological indipendance - it should not require a upgrade of the eternity software (and visa versa) to upgrade the key server software. Another issue that was raised previously, neither I nor anyone else addressed it at the time, is this acceptance of latency of distribution. Since we are talking about providing potentialy damaging documents (to who is intentionaly left vague) doesn't this latency provide opportunities for attack? Unlike a remailer network where it defeats traffic analysis in the data haven model it seems like a perfect means to get the processing window to actualy mount a trace. Anyway, since I am still about 3-6 months from actualy implimenting any of my own Plan 9 based (network level anonymity) model this is all conjecture. Hope it provides at least a seed for something useful. Ta ta. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

FW: IRS/Co$ Secret Agreement web page (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

-----Original Message----- Subject: IRS/Co$ Secret Agreement web page http://www.primenet.com/~cultxpt/irs-cos.htm The IRS gave the Church of Scientology a sweetheart deal on October 1 1993, granting it privileges that no other tax exempt organization gets. The above web page includes the Secret Agreement, IRS tax code portions at issue, US Supreme Court ruling that the Secret Agreement violates, and other important information. I update it almost daily.

1 0

FBI to search school shooters computer [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > SUSPECTED HIGH SCHOOL GUNMAN TO MAKE COURT APPEARANCE > > FBI will search his computer for evidence of motive > > January 15, 1998 > Web posted at: 9:36 a.m. EST (1436 GMT) > > PADUCAH, Kentucky (CNN) -- The teen-age suspect in last month's > Kentucky school shooting was scheduled to make his first public > court appearance Thursday morning, as the FBI announced plans to > search the contents of his personal computer. > > Michael Carneal, 14, is accused of opening fire on an informal > prayer group in the lobby of Heath High School, where he was a > freshman. Three students were killed and five wounded in the > December 1 attack. > > Carneal was indicted as an adult on three counts of murder, five > counts of attempted murder, and one count of burglary. The > commonwealth's prosecutor has said he'll pursue the maximum penalty > of life in prison, which would mean Carneal, if convicted, would > have to serve 25 years before he could be considered for parole. > > In a search for a possible motive into the deadly shootings, the FBI > has agreed to search the contents of Carneal's personal computer. > Lobby Heath High School lobby where the shooting occurred ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0