December 2003 - cypherpunks-legacy

Re: Fuck UseNet
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> So, basically, you're saying that the flight from censorship should > be toward a new CypherPunk 'home' where one is effectively censored > automatically unless one kisses the ass of a Cabal? Absolutely, It is really, as far as I see it anyway, just a stop-gap measure. The caballers haven`t got enough room to do their censorship on the 18000 or so big 7 groups so they decide to fuck up the alt. heirachy as well ;-) Hopefully Igor and co.`s network of Majordomo's should be fully operational soon (as I understand it two are up and a third is on it's way) then we can move back there. Might even get it finished before the 20th????? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Congress is at it again; renewed defenses of the CDA
by Declan McCullagh 17 Dec '03

17 Dec '03

Sen. Coats has been ranting about the CDA again. I have more in the Afterword section of http://netlynews.com/ -- "As the Supreme Court prepares to hear oral arguments next month in the Communications Decency Act case, morality crusaders in Congress are launching a renewed defense of the law..." -Declan ------------------------- The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: [Declan McCullagh: "A List Goes Down In Flames," from Netly]
by Timothy C. May 17 Dec '03

17 Dec '03

At 10:31 AM -0800 2/14/97, Martin Minow wrote: >What bothers me more than anything else about the "solutions" I've >seen proposed to the death of Cypherpunks is that they rely on >technology -- and reject human judgement -- to solve what is, in >reality, a social problem. (One can certainly make the same argument >about the V-chip, browser porn filters, and similar hacks.) Au contraire, Martin! Many of my posts have _explicitly_ pointed to the human filtering services offered by Eric Blossom, Ray Arachelian, and perhaps others. Arranging to have others edit or filter the information flow is a fine and dandy thing, and it's a very "anarchist" thing to do. The "anarchy" of the restaurant business, the book business, and so many other markets and sectors, where end-users are forced to look for filtering mechanisms (such as restaurant reviews, advice of their friends, advertisements, etc.) works pretty well. And, I believe, the Cypherpunks list was doing pretty well before the Moderation thing happened. The noise from the 'bots was no worse than the noise of 2-3 years ago from Detweiler. The claims that "the list has become unusable" were bogus, in my opinion. (Hence the claims that "you Cyherpunks only complain" are also bogus. I for one was not complaining and demanding that John and Sandy "do something" to "fix" the list. I accepted the nonsense spouted about me and John and others as just part of the chaos expected in any forum. I just filtered and deleted such nonsense.) It is true that some signal producers have either moved on to other things--in many cases to crypto-related companies directly or indirectly spawned by the Cypherpunks list and contacts!--or are not writing as many basic essays as they once did. Such is to be expected. People get tired of writing explanatory articles, and handling newbies. The key to improving signal is to increase the amount of signal, not to just suppress noise so as to make the S/N ratio look better. I can easily hit the "delete" key to remove noise, but I can't hit the "create" key to increase signal. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re:
by Omegaman 17 Dec '03

17 Dec '03

> > > Is it legal or illegal to send a > > PGP encrypted message from the US to someone in another country? > > Yes. > > No it's not. Where do you get this? It would be illegal to send them a copy of the PGP program. But sending encrypted messages is not illegal. Please, cite your source --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:"to get my public key | _London_Calling_ , 1980 ---------------------------------------------------------------------

1 0

Re: Moderation experiment almost over; "put up or shut up"
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Dave Hayes wrote: > You'll find those of us who -truly- want free speech are extremely > good at ignoring what we don't like. Not all of you freedom-knights are good at it at all. I would go as far as to say that only you, Dave Hayes, are good at it. - Igor.

1 0

Congress is at it again; renewed defenses of the CDA
by Declan McCullagh 17 Dec '03

17 Dec '03

Sen. Coats has been ranting about the CDA again. I have more in the Afterword section of http://netlynews.com/ -- "As the Supreme Court prepares to hear oral arguments next month in the Communications Decency Act case, morality crusaders in Congress are launching a renewed defense of the law..." -Declan ------------------------- The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Dave Hayes 17 Dec '03

17 Dec '03

> Dave Hayes wrote: > > You'll find those of us who -truly- want free speech are extremely > > good at ignoring what we don't like. > Not all of you freedom-knights are good at it at all. The "us" I mentioned did not refer to the freedom knights, but "those of us who -truly- want free speech"...a slight english parsing problem. The freedom knights are a subset of those who want free speech. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet It is our ability to act as ourselves, freely and of our own choosing, that is the greatest gift to mankind; my Creator, the sole being in the universe who legitimately had power over me, gave me that power freely in order to enable me to become what I am. -- Russ Allbery

1 0

Re: Feds OK 128-bit crypto amid protests
by Timothy N. Hill 17 Dec '03

17 Dec '03

At 19:14 -0500 97-02-13, Bradley Dunn wrote: >See: >http://www.news.com/News/Item/0,4,7925,00.html >for details. Thanks for the pointer. Note that, unlike the previous three recipients of crypto export licenses, Open Market did not enable government access to keys. Instead they went through the "expensive ... exercise" of convincing "government officials that the product could not be used to encrypt anything but specific financial numbers." - Tim Timothy N. Hill <tnh(a)acm.org> "We all love to instruct, Wellesley, Massachusetts though we can teach only <http://www.ma.ultranet.com/~tnh/> what is not worth knowing." PGP F058F75D 99C5122F 21C5BEF5 620C1D3C - Elizabeth Bennet

1 0

Re: Moderation experiment almost over; "put up or shut up"
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Dave Hayes wrote: > > Ok. I'll "put up". > > If the cypherpunks will have me, -I'll- run the cypherpunks > list. Those that know me know that I will *not* censor, moderate, or > otherwise alter the content (other than the stuff majordomo does with > "resend") of any messages to the list. I think that it is a great idea. If you want to contribute to the effort to keep the list, this is great. You could join the network of other cypherpunks mailing lists. There is a small list for discussing these networking issues, cypherpunks-hosts(a)algebra.com. It is not for crypto-discussions per se, but rather for discussing how we proceed with these lists. You can subscribe to it through majordomo(a)algebra.com. - Igor.

1 0

Re: Cypherpunks afraid of spam?
by Cynthia H. Brown 17 Dec '03

17 Dec '03

On Fri, 14 Feb 1997 aaron(a)herringn.com wrote: <explanation of anti-spam e-mail addresses snipped> > I put a spam-busted address in my .sig and give root(a)127.0.0.1 as my email > in the from: header. Sure, somebody out there is going to be unhappy with > me, but if they have a clue they'll figure it out. Meantime, the SpamBots > are bouncing mail to the admin of the site instead of to me. <evil grin> That's *much* better than the mundane c.y.n.t.h.b(a)i.o.s.p.h.e.r.e.dot.n.e.t =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb(a)iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within.

1 0

Re: Good Bye Cypherpunks!
by Vin McLellan 17 Dec '03

17 Dec '03

Tim May asked: >And was my article the kind of "sludge of spam" and "contentless >name-calling" you thought the Moderation experiment was all about? No. It definitely was not. >And what of the four or five of my posts a week ago which never made it to >either the Main list or the Flames list? The contained no "sludge of spam" >nor "contentless name-calling." What they dealt with was a claim (like this >one) that some posts were not being passed on to either of the two lists, >and that perhaps a conflict of interest was developing. > >Does this still match your "understanding of Sandy's effort"? Sadly, no. _Vin

1 0

Re: Private property & the cypherpunks list(s) (fwd)
by Kent Crispin 17 Dec '03

17 Dec '03

Jim Choate allegedly said: > > > Forwarded message: > > > Date: Thu, 13 Feb 1997 02:08:21 -0800 > > From: Greg Broiles <gbroiles(a)netbox.com> > > Subject: Private property & the cypherpunks list(s) > [...] > > What I really find interesting is that in the 3 years SSZ has been up and > the 8 mailing lists (with about 300 subscribers total) nobody has ever > complained about the public domain policy and nobody has ever put a > copyright header on their messages. All these lists are technical and > several of them are directly involved with technical development of > projects, some for commercial apps. > > > Jim Choate > CyberTects > ravage(a)ssz.com > > Jim, if I put "Copyright (c) 1997 by Kent Crispin. All Rights Reserved." in my .sig, would that constitute a "fair-use header"? In general, I rather like your policy. -- Kent Crispin "No reason to get excited", kent@songbird.com,kc@llnl.gov the thief he kindly spoke... PGP fingerprint: 5A 16 DA 04 31 33 40 1E 87 DA 29 02 97 A3 46 2F

1 0

EuroGAK
by Secret Squirrel 17 Dec '03

17 Dec '03

An EU insider writes (paraphrased): As you say, an EU policy on cryptography requires the utmost care. We have been following US initiatives closely. The USG's latest proposal attempts to balance the need for security with the need to tackle crime. Some EU Member States have begun work possibly leading to Government access to keys (where legally authorised). Various conventions and laws set out rights for the citizen and these will be respected. It is not suggested that access should include signature keys, only those for message confidentiality (as with police search powers). comment: The term "Government access to keys" is used. No mention of mandatory GAK, or the (in)effectiveness of GAK against crime. He refers to "message confidentiality ... police search powers" by which he perhaps means wiretap, rather than search. Or perhaps he means storage as well as messages. His "signature keys" does not specify the plan for a dual-purpose key, but my guess is they would wish to obtain a dual-purpose key if interested in its cyphertext.

1 0

Cypherpunks afraid of spam?
by aaron＠herringn.com 17 Dec '03

17 Dec '03

[Fairly prominent Cypherpunk I'll decline to name- I don't mean to ridicule him personally, just his (distressingly common) attitude] >Just for the record. I will not post to USENET given the spamming that >seems to go to IDs that appear there. [chuckle] Just add an anti-spam segment to your email address. example: jsmith[at]foo.com Most people worth talking to have enough of a clue to replace [at] with @. if your software requires an apparently valid email address, try jsmith(a)NOSPAM.foo.com I put a spam-busted address in my .sig and give root(a)127.0.0.1 as my email in the from: header. Sure, somebody out there is going to be unhappy with me, but if they have a clue they'll figure it out. Meantime, the SpamBots are bouncing mail to the admin of the site instead of to me. That may not be enough if you're already in the spamming lists. Try using 'positive' filtering- instead of filtering to eliminate unwanted mail, filter email from regular correspondents into a 'approved' directory, and leave the rest in the inbox to pick through later. It seems very strange that the denziens of this list, reputed to be gutsy enough to take on the FBI, NSA, CIA, and White House, would be scared away from a discussion forum (Usenet) by uninvited email. We'd better hope they never figure out Cypherpunks, Guardians of Privacy and Defenders of Free Speech, are afraid of spam. (And supposedly the 'Moderation experiment' is over, so this won't get kicked onto the -flames list, although it's more ridicule than flame...)

3 2

Re: [Declan McCullagh: "A List Goes Down In Flames," from Netly]
by Declan McCullagh 17 Dec '03

17 Dec '03

Mike sheds more heat than light on the issue. Gilmore does not always represent the EFF; not every action of his is an EFF action. As for the "rift," may observers said at the time that DT was a Jerry Berman "appeasement and capitulation" scheme. Note Berman no longer works at EFF. Note EFF is no lnoger in DC. And yes, I've read Tim May's essay on his EFF membership. I probably would have had the same reaction. -Declan On Fri, 14 Feb 1997, Mike Duvos wrote: > John Gilmore <gnu(a)toad.com> writes: > > [Fluffy Gilmore apologia by Declan expunged] > > Two small points. > > 1. The rift between Gilmore/EFF and Cypherpunks is hardly > of recent origin, and dates back to when the EFF first > demonstrated to horrified Cypherpunks that its policy > would be one of appeasement and capitulation towards > clearly unacceptable legislation. This is all in the > archives, including Tim May's essay on why he chose not > to renew his EFF membership. > > 2. The article fails to mention Gilmore's new nickname. :) > > -- > Mike Duvos $ PGP 2.6 Public Key available $ > mpd(a)netcom.com $ via Finger. $ > > >

1 0

Re: [Declan McCullagh: "A List Goes Down In Flames," from Netly]
by Omegaman 17 Dec '03

17 Dec '03

> The only other alternative I can see would be to limit membership -- > but not limit what members might write. The notion that there are "members" in some kind of formal fashion is inherently un-cypherpunk in my book and would most likely be rejected. > Having been "on" the net for over 15 years -- and with experience in > both ends of the censorship/moderation problem (I'm probably the > only Cypherpunks member to have had a book "banned in Boston"), I'm > sorry that a handful of sociopaths managed to destroy this > experiment in anarchy, but I suspect that this was inevitable. In your 15 years on-line you should KNOW that it's an inevitable cycle inherent to anarchic forums like cypherpunks. But the notion that cypherpunks is dead and destroyed is silly. Cypherpunks will (and already are) reform and renew as is, I believe, necessary. Whether or not the name cypherpunks is used and embraced is irrelevant. Those interested in cryptography as a tool of personal privacy and freedom will inevitable congregate in the self-organizing fashion that "cypherpunks" have always recognized. The "human judgement" you are referring to is leadership. Leadership is not necessarily anathema to cypherpunks. Leadership is provided by those who try to post signal and ignore the noise. Those who continue to push the discussion forward. People inevitably tire of robust forums such as this. The sociopaths and the leaders come and go in waves. Let the forum mutate in whatever way it chooses. --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:"to get my public key | _London_Calling_ , 1980 ---------------------------------------------------------------------

1 0

Re: crypto restrictions
by Vin McLellan 17 Dec '03

17 Dec '03

Anand Abhyankar <anand(a)querisoft.com> asked: >1) is it illegal to develop an encryption tool (s/w) outside the US >which uses > 40 bit size session keys and then import that s/w inside of >the US. > >anand.... Hi Anand, Nope! Unless there are export controls in India, your wizards in Bombay or Dehli (pardon, I forget) can offer their US customers the full and unrestricted product of their creativity and genius in algorithms, crypto implementations, and/or crypto protocols. There are no restrictions on encryption software being _imported_ into the US, nor are there (at the moment <sigh>) any legal (as opposed to patent or copyright) restrictions on any encryption software of any strength being _used_ in the US. For that matter, there are no restrictions on encrypted data being transmitted across the US border. And (while it may require a license, apparently an exemption for the product, as opposed to a sales-by-sale license) there are seemingly no -- or at least less -- restrictions on the use of specialized encryption products (within the US) which can generate a "self-decrypting" secure packet which can be transmitted (cross-border, outside the US) and opened, anywhere, by a recipient who has been provided with a password/key out of band. That is how RSA's SecurPC has been able to offer full 128-bit RC4 encryption to secure US-to-Anywhere international file transfers. (As with DES, the US Govt is apparently trying to control the export of a full implementation package -- not the international distribution of a widely-known algorithm, per se. As I understand it, the self-decrypting PCSecure packet does not contain the user interface which allows automatic encryption, the interface can only decrypt. The RC4 algorithm, of course, has to be included in the transmission, and it is inherently reversible -- only the user interface is "crippled" to restrict its use to encrypt. Corrections welcome, if I don't have this exactly right.) The international traffic in self-decrypting "128-bit" products is separate and distinct from the issues involved in the recent modifications of the US export regs, which allow vendors to get approval to export a 56-bit secret-key encryption product (eg. RC4, RC5, or DES) only if the vendor submits a concrete plan, and schedule of implementation, to redesign their (export) product to require key-escrow or trusted-party key-recovery/storage. (In addition whatever recovery key is required by corporate backup policies, this is also, obviously, a mechanism for GAK, "government access to keys" --under US law, hopefully with a court warrant -- and/or whatever backup/key-recovery/GAK-access mechanism might be required various other nations in which those products will be imported, used, or transhipped from.) And with those GAK-adapted implementations, the US govt. will then approve, for the first time, general export of robust 128-bit secret-key products... as they reportedly have for Open Market's SSL, and TIS and Digital crypto products. I hope this is helpful, Suerte, _Vin

1 0

Re: Good Bye Cypherpunks!
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Vin McLellan wrote: > > It's always interesting to see how another person, particularly a > writer, filters and reshapes an experience you shared with them . > Differences in the telling are inevitable -- but I perceived the recent > experience of the C'punks List quite differently than what Declan described > and implied in his column. > > My understanding of Sandy's effort, for instance, was that he was to > filter out the sludge of spam and contentless name-calling with which some > idiots were flooding the list. My impression was that he was passing along > any posts with content (ideas, pro or con, on almost anything) but filtering > out the empty obscene name-calling and slurs (many of which seemed anon or > forged, with varied and misleading titles, to duck my kill-file filters.) May I ask you, what is the basis of "your understanding"? Did you form your impression upon reading only the materials from the list that was filtered by Sandy? Or you also read the flames and unedited lists? In the latter case, you have no basis for any claims regarding Sandy's policy. I do have a list of subscribers to the unedited list, and you were not on it. > I, for one, was appreciative. > By the logic of Tim and others, a clever and dedicated crusade > against Cypherpunks by any minimally-organized group, bir or small -- your > local coven, CoS, RC bishops, FBI, Romanian Govt, , whomever! -- could have > destroyed the List at any time in the past. But of course. > I'm glad they never realized > how vulnerable we were; I've enjoyed this Community greatly in its current > manifestation. Maybe they realized it and were not really bothered by this list because of this lameness. What if all these anti-government rants were just feeding the illusion of grandeur. > I also hate to think of how gleeful the sociopaths who mail-bombed > us into the choice of submission or suicide must be today. I think it is a > particularly henious crime to destroy a virtual community; something akin to > book-burning, but maybe more like arson -- like burning village schools. It is because you wanted to take everything from them. > There was a willful attempt to destroy C'punks, an attack of depth and > volume which led many of us (even those who had ignored at least three > earlier efforts to offer filtered subsets to the List) to welcome the > Moderation Experiment. Unfortunately, the attempt at moderation just twisted > our own energies against ourselves. We were, perhaps predictably, quite > easy to manipulate. It is a question of what you think is manipulation. > If I have any criticism of John et al, it is that our List-Owner (a > statement of function, rather than property) never gave the List Community > an overt option to vote for minimal moderation. A tactical error. That > that allowed the anarchists, nihlists, and others pure of heart to focus > their ire on toad.com and Sandy -- rather than on those of us who (when John > finally acted) might have gladly re-subscribed to another version of the > List in order to obtain minimal spam and slur filtration. Yes, if moderation created a new place in cyberspace, it would have been less controversial. - Igor.

1 0

DES and RSA crypto hardware from the free world
by Peter Gutmann 17 Dec '03

17 Dec '03

I've just got the details on two new crypto chips produced by the Dutch company Pijnenburg Custom Chips B.V. These are the PCC 201 bignum coprocessor and the PCC 101 DES-with-everything processor (the official names are slightly different :-). The PCC 101 sells for approximately US$27, the PCC 201 sells for approximately US$50 (for people who aren't familiar with the market for these things, these are very good prices, especially for the 201). The PCC 201 is officially a "Large number modular arithmetic coprocessor" which is designed to perform the operations: A^x mod N AB mod N C mod n very quickly for quantities of up to 1024 bits. Typical procesing times for 1K-bit operands is 40ms, for 512 bits it's 12ms when clocked at 25 MHz. Unfortunately you can't directly chain them for larger operands, although it's possible to use two 201's and some software tricks for CRT decrypts to stretch the operand size to > 1024 bits. The way the 201 works is that you load the fixed components (exponent and modulus for A^x mod N, modulus only for AB mod N and C mod N) into one of three sets of on-chip registers, and then use them to perform arbitrary numbers of operations on data. This means that for something like a micropayment application you would load the necessary private key components once and then generate signatures at the (theoretical) rate of 25 a second. To date the cost of this kind of hardware has been such that the most viable solution was to run racks full of cheap P5 boards booting a bare-bones RSA-processing application through a network card, but with the PCC 201 you could populate a board with 201's and a few microcontrollers a la a Wiener machine and use these as a payment transaction processing engine. They'd also make fairly cool SSL co-processors for web servers. The PCC 101, officially a "DES encryption device", does DES, 3DES (EDE with 2 or 3 keys), and DESX in ECB, CBC, CFB, OFB, and MAC modes at a maximum rate of 132 Mbits/s (16.5 Mbytes/sec) for single DES, or 1/3 that for 3DES, when clocked at 33 MHz. It's possible to load either single or triple-DES encrypted keys which are then decrypted using onboard key encryption keys (KEKs). The chip contains onboard storage for 24 keys, 3 KEKs, 4 IV's, and 2 DESX keys (pre/post-whitener). Processing is done in a 3-stage pipeline, so once you feed in 3 64-bit blocks it churns out a new result every 16 clocks (this also allows overlapped I/O operation). You can add an external battery to save the internal state when power is removed, so you could keep your keys permanently stored onboard (although given that these keys can be recovered given enough money and effort I'm not sure if this is a good thing). The PCC 101 is available in 44-pin PLCC/TQFP packages, the PCC 201 is available in 68-pin PLCC and 80-pin TQFP packages. The PCC 201 contains a multiplexed address/data bus and a few control signals (most of the pins are unused), the PCC 101 contains data and address ports and a few control signals. They look fairly easy to interface. There's an ISA evaluation board available which contains the PCC 201 and the slightly older PCC 100 (predecessor of the 101) and some test software. Note that this is an evaluation board only, Pijnenburg make the chips but don't sell general encryption cards. A fast PCI card containing these chips and drivers for various common operating systems and MSDOS is currently being designed by an international cabal. This will be a PCI 2.1-compliant card containing a PCC101, an optional PCC201, and possibly a few other things (we're still arguing about the design). I'll be writing DOS and Win16 drivers for it, and someone else will do an NT and possibly Linux driver (again, it's still at the design stage). cryptlib (http://www.cs.auckland.ac.nz/~pgut001/cryptlib.html) will probably end up having native support for it when it's ready. Pijnenburg don't have a web page yet but are working on it, I'll post the details here when it becomes available. Until then you can contact them at asic(a)pijnenburg.nl. The only slight problem is that they're subject to the Dutch governments export rules (the usual Wassenaar stuff) which means that if you're not using it for an authentication/integrity-only application or a financial application, you'll probably need to go through some paperwork to show that it's for your use only and you won't be passing it on to your friend Jose from Columbia. Pijnenburg have a standard Statement of Application which people can use as to write their own statement for export approval. These chips look *very* promising. Who needs Clipper, or HP's Clipper-under-another-name, when you can get triple DES from the free world at prices like this? Peter.

1 0

Re:
by Cynthia H. Brown 17 Dec '03

17 Dec '03

On Fri, 14 Feb 1997, Omegaman wrote: > paul(a)fatmans.demon.co.uk wrote: > > > Is it legal or illegal to send a > > > PGP encrypted message from the US to someone in another country? > > > > Yes. > > No it's not. Where do you get this? It would be illegal to send > them a copy of the PGP program. But sending encrypted messages is > not illegal. Actually, Paul implied that it was both legal and illegal. I assume he meant that it is legal except where the *content* of the message contains something illegal (death threats against heads of state, etc.) But if you use strong encryption, who'll know? Cynthia =============================================================== Cynthia H. Brown, P.Eng. E-mail: cynthb(a)iosphere.net | PGP Key: See Home Page Home Page: http://www.iosphere.net/~cynthb/ Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within.

1 0

Re: Good Bye Cypherpunks!
by Adam Shostack 17 Dec '03

17 Dec '03

Michael Froomkin - U.Miami School of Law wrote: | Just for the record. I will not post to USENET given the spamming that | seems to go to IDs that appear there. Your postings appear on the web, as part of the cypherpunks archives at infinity.nus.sg. http://infinity.nus.sg/cypherpunks/current/0089.html There seem to be robots that search the web; I've never even read usenet from this account, and I get spam. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Fuck UseNet
by Kent Crispin 17 Dec '03

17 Dec '03

Toto allegedly said: > > Jeremiah A Blatz wrote: > > alt.cypherpunks has been newgroup'ed, and I belive rm'grouped. Smart, > > consiencous newsadmins probably did not honor the rmgroup, as > > alt.cypherpunks should be acceptable, but most newsadmins are too > > overworked to actually look at most of the crap that comes through. > > > Therefore, it would be a Good Thing to continue any discussion on > > alt.config, and convince any cabal'ers who rmgroup it to re-new it. > > Sending out boosters every couple of weeks wouldn't hurt, either. > > So, basically, you're saying that the flight from censorship should > be toward a new CypherPunk 'home' where one is effectively censored > automatically unless one kisses the ass of a Cabal? Pretty much, yes. The voting process for a comp group is better, IMO. But the distributed mailing list is by far the most interesting solution. Contrary to what some have claimed, it really isn't the same as usenet -- it allows for distributed control. There is no doubt that the operator of a mail list host should have the freedom to set his or her policies as they see fit -- it is their machine, and their responsibility. And contrariwise, subscribers should have the freedom to chose list hosts with compatible philosophies. -- Kent Crispin "No reason to get excited", kent@songbird.com,kc@llnl.gov the thief he kindly spoke... PGP fingerprint: 5A 16 DA 04 31 33 40 1E 87 DA 29 02 97 A3 46 2F

1 0

RRE: Cybersitter
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 14-FEB-1997 05:21:41.54 To: IN%"rre(a)weber.ucsd.edu" CC: Subj: Cybersitter [Forwarded with permission.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Thu, 30 Jan 97 08:23:58 -0500 (EST) From: kkc(a)COMPETITOR.NET(K.K. Campbell) Subject: Cybersitter & Wallace ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WHO'S WATCHING THE 'WATCHERS'? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by K.K. CAMPBELL Net.column The Toronto Star Thursday, January 30, 1997 One of the most controversial aspects of cyberspace is censorship. A widely accepted solution to eliminating the "unwanted" is self-imposed censorship, through special software which blocks out types of content not desired. The appeal of these programs is that people needn't rely on distant authority to dictate acceptability. We police ourselves; or at least we have some control over how we will be policed. The news media have generally blessed "blocking software" with unexamined sprinklings of warm praise. After all, who dares suggest that stopping your 5-year-old from seeing graphic gore, violence or sex is bad? What could go wrong with that? But, now critics are starting to ask, who is "watching the watchers?" Could these watchers themselves develop more "creative applications" for their power to silence? Could they apply their own personal prejudices, or even their own hidden agendas? Or is that paranoid nonsense? Ask U.S. author Jonathan Wallace (jw(a)bway.net) Wallace says California's Solid Oak software, which produces Cybersitter blocking software, has added his site to its "block list" in retaliation for critical remarks he made about the company. Solid Oak claims 900,000 registered Cybersitter users. Wallace, a New York-based software business executive and attorney is co-author of the book _Sex, Laws and Cyberspace_ (Henry Holt, $34.95). Net.column will discuss the book with its author next installment. He's also editor of the monthly Webzine _The Ethical Spectacle_, which focuses on "the intersection of ethics, law and politics in our society." The Webzine recently asked readers to not purchase Cybersitter because of continuing reports of Solid Oak's "unethical behavior." "In the book," Wallace says in a press release explaining his current attitude to Cybersitter, "we took the position -- naively, I now think -- that use of blocking software by parents was a less restrictive alternative to government censorship. We never expected that publishers of blocking software would block sites for their political content alone, as Solid Oak has done." Solid Oak unequivocably denies there is a political agenda of any kind et work. "Absolutely, 100 per cent not," Marc Kanter told the Toronto Star in a phone interview. Kanter is Solid Oak's vice president of marketing. "There is no hidden political agenda." Kanter says someone criticizing Cybersitter would not be blocked. He says Wallace's site is blocked because it "links information on how to hack Cybersitter. We do not allow our customers to have hacking information for the program." Wallace told The Star that's not true. "There's no such information on my site, nor is there on Peacefire's. I link to some pages maintained by Glen Roberts, who -- along with some political commentary on Cybersitter, and analysis of its blocking policy -- offers a (legal) work-around. However, since his site is separately blocked by Cybersitter, there is no reason for them to block my site as well." Kanter dismisses Wallace's complaints. "The guy didn't do any homework," Kanter says. "There are a few people who are right-wing activists who are out there that are trying to defame the filtering program. This is what leads to stories like you are doing -- and hopefully you are not supportive of their actions." Wallace didn't know what to make of that. "I've been called a communist, a socialist, and a wild-eyed civil libertarian, but no one has ever called me right wing before," he says. "Kanter has obviously never read _The Ethical Spectacle_." While Cybersitter, with fanfare, claims its mission is to block Web sites containing pornography, obscenity, gratuitous violence, hate speech, criminal activity, etc., an increasing number of investigative Net.journalists also claim Cybersitter, without fanfare, blocks access to Web sites based on political criteria. FOR OUR OWN GOOD This brouhaha began last summer when CyberWire Dispatch revealed Cybersitter blocks sites based on political agenda, such as the feminist National Organization for Women (www.now.org) Dispatch journalist/editor Brock Meeks asked Solid Oak CEO Brian Milburn (bmilburn(a)solidoak.com) about that. "Milburn isn't shy about it," Meeks reported. "He was outright indignant when he originally told Dispatch: 'If NOW doesn't like it, tough'." Solid Oak threatened to sue Dispatch for its article, but things quieted down. In December, the issue erupted again when 18-yearold Bennett Haselton (bennett(a)peacefire.org) wrote an article about the company's selection of blocked sites: "Cybersitter: Where Do We Not Want You To Go Today?" (www.peacefire.org/censorware/CYBERsitter.html) Haselton takes computer science and math at Vanderbilt University. "Peacefire" is his own creation, a teen cyberrights group, average age 15. According to various Net.journalists, Solid Oak now threatened Bennett with a lawsuit and even tried to get the Peacefire site booted from its host system (media3.net) by telling Media3 that Haselton was making it "his mission in life to defame our product" by "routinely" publishing names of sites blocked by Cybersitter. (It should be noted it's easy to figure out which sites are blocked, the software provides an output list. Try "playboy.com" -- blocked. Try "whitehouse.com" -- okay. Try "peacefire.org" -- blocked. Try "now.org" -- blocked.) Unsuccessful in his pressure against Media3, Milburn instead included the peacefire.org domain in Cybersitter's block list. On Dec. 9, HotWired picked the story up (www.wired.com/news/story/901.html) NetAction Notes (www.netaction.org) quickly followed suit. Haselton told his story to the Electronic Frontier Foundation and the EFF assured him it would represent him, should Solid Oak deliver on its threat to sue. On Dec. 20, The Netly News (http://netlynews.com) continued the investigation of Cybersitter. Aside from the irony of Cybersitter censoring the newsgroup alt.censorship, it "blocks dozens of ISPs and university sites such as well .com, zoom.com, anon.penet.fi, best.com, webpower.com, ftp.std.com, cts.com, gwis2.seas.gwu.edu, hss.cmu.edu, c2.org, echonyc.com and accounting.com. Now, sadly, some libraries are using it." BLACK LIST TO BLOCK LIST Wallace read the reports of legal threats against the teenager and thought "Milburn was acting like the proverbial 800-pound gorilla." So Wallace added a link on _The Spectacle_'s homepage called "Don't Buy Cybersitter." "I wrote the company," he says, "informing them of my actions and telling them that they misrepresent their product when they claim it blocks only indecent material, hate speech and the like." Wallace says Solid Oak responded by adding his Webzine to its block list. Learning of this, Wallace wrote Milburn and Solid Oak tech support. "I pointed out that _The Spectacle_ does not fit any of their published criteria for blocking a site," he says. "I received mail in return demanding that I cease writing to them and calling my mail 'harassment' -- with a copy to the postmaster at my ISP." Kanter acknowledges this. "He spoke to us more than once or twice -- he continued to send mail -- mail like that is considered 'not wanted' and is automatically sent back." By the end of our phone conversation, Kanter had dropped the "right-wing activist" explanation of who was behind the Cybersitter complaints and offered a new one: "Some of this rhetoric was started by someone we believe to be a highly -- how do you put it? -- a highly homosexual individual, who did not believe we should have the right to block any sites or links to alternative lifestyles. That's how a lot of this got started." Why is the National Organization for Women site blocked? "Very simple. It contains links to gay and lesbian hardcore material. I was on their page this morning, and there is a lot of offensive material linked directly. Just go to their links page and start looking at 'gay' and 'feminism.' Our parents don't want that kind of stuff." I asked if he really meant "hardcore" -- suggestive of full-penetration images/stories. "Yes, by links through links," he clarifies. If someone followed the links starting at now.org, they'd eventually find hardcore sexual material. Kanter says parents are not permitted to know which sites Cybersitter blocks. "That list is not given to anybody under any circumstances -- including law enforcement agencies that have requested it." He says it's to prevent the list from "getting into the wrong hands." It would be a cybermap to naughtiness for some kids. And parents aren't allowed to remove blocked sites from Cybersitter, although they can add to the list. Cyber-rights activists claim the incident underscores warnings they've issued for years: While censorship software may first aim to protect children against "pornography," it can quickly be adopted for political agendas. _The Ethical Spectacle_ is at www.spectacle.org. Solid Oak's Web site can be found at www.solidoak.com. -30- Copyright 1997 K.K. Campbell

1 0

RRE: Fear and Loathing at the FCC
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 14-FEB-1997 07:16:51.99 To: IN%"rre(a)weber.ucsd.edu" CC: Subj: Fear and Loathing at the FCC [Forwarded with permission. This is the closest thing I've found to real research on the FCC-access-charges-for-ISP's action alert you have no doubt seen recently. Right or wrong, this was an incredibly badly designed alert. Please let me recommend that you *never* forward any kind of alert message unless it is signed, includes detailed background information or at least a URL that points to background information, and includes a time-out date. For more information on the proper construction of Internet action alerts, see http://communication.ucsd.edu/pagre/tno/january-1994.html#action ] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Thu, 13 Feb 1997 20:18:54 -0600 From: Patrick Douglas Crispen <crispen(a)campus.mci.net> Subject: TOURBUS -- 13 FEBRUARY 1997 -- EDUPAGE / FEAR AND LOATHING AT THE FCC /~~~~~~~~~|~~~~~~~~~~~~/~~~~~~~~~|~~~~~~~~~~|~~~~~~~~~~~~/~~~|~~\ | FREE FUGEES CD - WIN AT WWW.MEDIADOME.COM / | \ |__________|__________/___________|__________|__________/ | \ / /______|-----\ | Haven't come to Mediadome(sm) yet? We're still |//////| | | giving away free Fugees CDs. Just sign up for |//////| | | our digital dispatch-better hurry, only 4 more |//////| | | days! Come see our Fugees Webisode & play the |//////| | | 'Video' game - based on the Fugees' hit song & |//////| | | video, 'Ready Or Not'- only at www.mediadome.com |//////| | ~~~/~~~\~~/~~~\~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/~~~\~~~~~ \___/ \___/ T h e I n t e r n e t T o u r B u s \___/ TODAY'S STOP: EDUPAGE / FEAR AND LOATHING AT THE FCC TODAY'S ADDRESSES: http://www.worldvillage.com/wv/hotel/tourbus/archives.htm http://www.educom.edu/web/edupage.html http://www.eff.org/papers/eegtti/eeg_83.html#SEC84 http://www.fcc.gov/isp.html Hi, kids! Put your seat belts on, because our latest adventure is about to get under way! Before we pull out of the terminal, though, can I interest anyone in a magazine or two? :) +--- HUGE TOURBUS SAVINGS ON THE HOTTEST MAGAZINE SUBSCRIPTIONS! ----+ Time, Newsweek, Money, PC Magazine, ZD Internet, Net, Yahoo, and tons more! Plus, pick from 50 FREE subscriptions. Send email now to: +-------------------- ( tourbus(a)magazines.com ) ---------------------+ By the way, I have a sinking feeling that a few of you may want to forward part of today's post to some of your friends. I would be happy if you did this -- just make sure that you give credit where credit is due. :) EDUPAGE ------- I think I am losing my mind. I distinctly remember pulling our little bus of Internet happiness into Edupage before, but for the life of me I can't find a copy of that post anywhere in the TOURBUS archives (which, by the way, can be found on the World Wide Web at http://www.worldvillage.com/wv/hotel/tourbus/archives.htm) Anyway, Edupage is an absolutely wonderful, free, e-mail-based "summary of news items on information technology, and is provided three times each week as a service by Educom -- a consortium of leading colleges and universities seeking to transform education through the use of information technology." Edupage is actually a misnomer, because Edupage doesn't really talk about education. Rather, Edupage send you one paragraph summaries of technology stories printed in leading newspapers and magazines (like Business Week, Information Week, Forbes, etc.). Each issue of Edupage usually contains between 6 and 10 of these summaries. If you want to subscribe to Edupage (remember, it's FREE), just send an e-mail letter to LISTPROC(a)EDUCOM.UNC.EDU with the command SUBSCRIBE EDUPAGE YOURFIRSTNAME YOURLASTNAME in the body of your e-mail letter, replacing YOURFIRSTNAME and YOURLASTNAME with your first and last names. You can also find Edupage on the Web at http://www.educom.edu/web/edupage.html Edupage is clearly one of my favorite resources on the Net. It provides cutting-edge technology information in a size that is easy to digest, and as a professional college student I *often* find myself quoting and applying the information that I have found in Edupage. FEAR AND LOATHING AT THE FCC ---------------------------- Over the past couple of weeks, you may have received e-mail letters telling you that Many local telephone companies have filed a proposal with the FCC [The United States' Federal Communications Commission] to impose per minute charges for Internet service. They contend that use of Internet has or will hinder the operation of the telephone network. At first, I thought that this was simply a new version of the old "modem tax" hoax (http://www.eff.org/papers/eegtti/eeg_83.html#SEC84) that has been floating around the Net since *1987*. After all, the current FCC story has all of the markings of a classic urban legend: 1. It uses official-looking language; 2. It mentions a government agency or an organization with which everyone is familiar; 3. It contains a plea for you to take some sort of immediate action; and 4. It requests that you forward the warning letter to as many people as possible. Besides, according to an article that appeared in this morning's Edupage, ONLINE COMPANIES ASK TELCOS, "WHERE'S THE BEEF?" Tired of telephone companies' complaints that Internet usage is overwhelming their network capacity, the Internet Access Coalition has released findings contending that Net usage is, in reality, a bonanza for the Bells. The study found that local carriers received a total of $1.4 billion in 1995 in revenues resulting from the installation of second lines in homes, while spending only $245 million to beef up their networks for the additional usage. A Bell Atlantic spokesman says the real problem is that the telcos have no idea when a line will be used for data rather than voice, and thus tied up longer. Both sides agree that the ultimate solution is higher capacity networks. (Business Week 17 Feb 97) Well, out of curiosity -- and out of a deep-felt desire to avoid studying for the two major economics tests that I have next week -- your fearless bus driver decided to call the FCC in Washington to see if anyone there was willing to talk about this rather explosive issue. Unfortunately, I soon discovered that the FCC only has one employee, she is a secretary, and her job is to transfer all incoming telephone calls into voice mail hell. :) Actually, I talked to some nice people at the FCC who faxed me a 10 page explanation of what's *really* going on. Unfortunately, the 10 page explanation was written in "FCC-ese," so I am going to have to translate their explanation into English for you (and I can assure you that, since I know *NOTHING* about telephony, my translation will probably contain a few inaccuracies; if it does, please let me know). First, some local telephone companies have indeed asked the FCC to allow them to assess a per minute access charge on the telephone lines used by Internet Service Providers. Local telephone companies currently charge long-distance carriers (like AT&T and MCI) an interstate access charge for the long-distance traffic that travels over their local lines, and the local telephone companies would like to see this charge extended to include the high-speed lines that your local Internet Service Provider uses to access the Internet. In December, the FCC rejected the telephone companies' request and tentatively concluded "that the existing pricing structure for information services should remain in place." In other words, the FCC has tentatively concluded that Internet service providers should *NOT* be subject to the interstate access charges that local telephone companies currently assess on long-distance carriers. The FCC now seeks the public's comments on this conclusion. Unfortunately, the "warning" letter that is currently circulating around the Internet gives the impression that some sort of sinister operation is afoot here, that the FCC and the telephone companies are trying to sneak this proposal through without anyone noticing, and that it is up to each and every one of us to stop the evil FCC. What garbage. In fact, the FCC has, at least tentatively, REJECTED the telephone companies' proposal. The FCC is now simply asking you if you agree or disagree with their decision. The most disappointing aspect of this whole situation is that because of the misinformation that has been distributed across the Internet over the past couple of weeks, the FCC has received 100,000+ e-mail letters, most of which flame them for making a decision that EVERYONE AGREES WITH! Hands down, the flaming of the FCC is one of the Internet's most shameful acts ever. I also discovered another thing about the FCC that increased my respect for their organization one-hundred-fold. Part of the 10 page explanation that the FCC sent me states that their "existing rules have been designed for traditional circuit-switched voice networks, and thus may hinder the development of emerging packet-switched data networks." Because of this, the FCC is also seeking the public's comments on the implications of the Internet and its usage through the public switched telephone network. Folks, *ANY* government agency that stops and says 'hey, we can ALWAYS use some more information so that we are better prepared for whatever happens in the future' has earned my respect and admiration. By the way, most of the information that I have shared with you today can be found on the FCC's "ISP" homepage at http://www.fcc.gov/isp.html If you would like to send your comments to the folks at the FCC (the deadline for comments about their decision not to impose interstate access changes on Internet service providers is Friday, February 14th), make sure that you check the FCC's ISP Web page first. At the bottom of this page are some pretty specific instructions on what you need to put in the subject line of you e-mail letter before you submit it to the FCC. Personally, I'm going to leave the poor folks at the FCC alone for a while. They seem to be doing a great job in the face of unnecessary (and misinformed) opposition. TODAY'S ADDRESSES ----------------- http://www.worldvillage.com/wv/hotel/tourbus/archives.htm http://www.educom.edu/web/edupage.html http://www.eff.org/papers/eegtti/eeg_83.html#SEC84 http://www.fcc.gov/isp.html That's it for this week. Have a safe and happy weekend, and make sure that you visit all 3 sponsors who made today's TOURBUS post possible: Mediadome, Magazines.Com, and ... *--------------------------- MASS MUSIC -----------------------------* More Music For Your Money! Over 185,000 Titles Just A Click Away. FREE Weekly Music Zine - Buy 7 Get 1 FREE Everyday - Treasure Hunt! TOURBUS Rider Discount code: SAVENOW! use it and save 5% *------------------( http://www.Mass-Music.com )-------------------* -------------------------------- TODAY'S SOUTHERN WORD OF THE DAY -------------------------------- LAYMAN (noun). A tart fruit. Usage: "Hunny, git me some more of that layman aid!" (Special thanks goes to Tom Bates for today's word) YOU CAN FIND ALL OF THE OLD SOUTHERN WORDS OF THE DAY ON THE SOUTHERN WORD HOMEPAGE AT http://ua1vm.ua.edu/~crispen/word.html ====================================================================== Join : Send SUBSCRIBE TOURBUS Your Name to LISTSERV(a)LISTSERV.AOL.COM Leave : Send SIGNOFF TOURBUS to LISTSERV(a)LISTSERV.AOL.COM Info : On the Web at http://www.worldvillage.com/tourbus.htm Advertising: E-mail BobRankin(a)MHV.net w/ Subject: SEND TBRATES =--------------------------------------------------------------------= For info on my new book "Atlas for the Information Superhighway" send an e-mail letter to LISTSERV(a)UA1VM.UA.EDU that says GET ATLAS INFO F=MAIL in the body of your e-mail letter ====================================================================== TOURBUS - (c) Copyright 1997, Patrick Crispen and Bob Rankin All rights reserved. Redistribution is allowed only with permission. Send this copy to 3 friends and tell them to get on the Bus! (\__/) .~ ~. )) /O O ./ .' Patrick Douglas Crispen {O__, \ { The University of Alabama / . . ) \ crispen(a)campus.mci.net |-| '-' \ } http://ua1vm.ua.edu/~crispen/ .( _( )_.' '---.~_ _ _& Warning: squirrels.

1 0

RRE: USACM analysis of Commerce Dept crypto export proposals
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 14-FEB-1997 08:14:58.81 To: IN%"rre(a)weber.ucsd.edu" CC: Subj: USACM analysis of Commerce Dept crypto export proposals =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Thu, 13 Feb 1997 22:15:40 -0500 From: Lauren Amy Gelman <gelmanl(a)GWIS2.CIRC.GWU.EDU> [...] February 12, 1997 Nancy Crowe Regulatory Policy Division Bureau of Export Administration Department of Commerce Room 2705 14th Street and Pennsylvania Ave., N.W. Washington, D.C. 20230. Docket No. 960918265-6366-03 Dear Ms. Crowe The United States Public Policy Committee for the Association for Computing (USACM) welcomes this opportunity to submit our views on the Interim Rule issued by the Department of Commerce with regard to "Encryption Items Transferred From the United States Munitions List to the Commerce Control List." The USACM believes it is in the best interest of the U.S. government to promote the widespread use of strong encryption. >From our perspective the Interim Rule fails to recognize the legitimate needs and interests of academic, professional, scientific, and ordinary users of telecommunications technology. Thus, the Interim Rule must be modified before it can resolve the many problems with the current export controls on encryption technologies. Introduction and Summary The Association for Computing is an international professional society whose 76,000 members (60,000 in the U.S.) represent a critical mass of computer scientists in education, industry, and government. The USACM provides a means for promoting dialogue on technology policy issues with United States policy makers and the general public. We have identified a number of serious problems with specific provisions of the Interim Rule. As a professional society of computer scientists which produces a number of peer-reviewed technical journals, we are concerned that the Interim Rule will hamper both communication and education in our field. Part 7.34.3 (b)(3) which refers to the distinction between printed and electronic publications of cryptographic materials is unworkable under the new paradigms of electronic publishing and communications. Electronic media, including the World Wide Web, listserves, Usenet news groups, and video conferencing are becoming the prominent means by which scientists communicate. Provisions of the Rule, specifically Parts 7.34.9 and 744.9, which affect teaching cryptography to foreign students are vague and contradictory. Educational environments are not limited to academic institutions but also occur in national and industry labs and by distance education. Restrictions on cryptography exports must not interfere with the traditional freedom of access over digital networks which is indispensable to maintain motivated and effective academic and research communities. We also believe that the development of public policies and technical standards for communications technologies, such as a Key Recovery Infrastructure (KRI), raise vital issues of privacy, competitiveness, and scientific innovation. Parts 740.8 and 742.15 raise a number of troubling issues for the computing community. We believe it is unwise for the Commerce Department to link relaxing export controls on 56-bit encryption to the development of a KRI as both the desirability and the feasibility of such a system remains uncertain. Key recovery products have not yet been subject to the vigorous testing necessary for a proposed standard and there is little understanding of how such a system would operate and what controls would be needed to ensure that it remained secure. Also, Supplement No. 7 to part 742 (which requires that businesses who wish to export 56-bit encryption before 1998 submit a biannual business plan for developing key recovery products) will stifle the innovation of new cryptography technologies and discourage the process of scientific innovation. We believe the Commerce Department should not promulgate regulations which prohibit U.S. research and development from responding to market demands and limit the ability of Americans using new on-line services to protect their privacy. Analysis The USACM has identified electronic publication, education, research and development, key recovery, and privacy as problematic areas which need addressing. We have outlined our concerns below: Electronic Publishing It is unreasonable and unconstitutional to distinguish between printed and electronic distribution of encryption source code as set forth in the note to Part 7.34.3 (b)(2) and (b)(3). A Federal Court in California has ruled in Bernstein v. U.S. Department of State that source code is speech and is thus protected under the first amendment. This distinction is also currently being challenged in a federal court in the District of Columbia in Karn v. U.S. Department of State. The USACM joined the Electronic Privacy Information Center, the American Civil Liberties Union, and the Internet Society in submitting an Amici Curiae brief in the case which argued that such language is an impermissible regulation aimed at the suppression of expression. As computer scientists we see no practical reason why the Commerce Department should insist on creating a distinction when one does not exist. The ACM is the publisher of numerous scientific publications and conference proceedings. They range from our flagship journal Communications of the ACM (CACM) to the on-line, peer-reviewed journal Experimental Algorithms. All 76,000 members of ACM, including 15,000 members overseas, receive CACM by mail and have access to ACM's on-line publications. ACM foresees a time when all its publishing will be electronic and on-line. At that time, it will need interoperable encryption technology available in the U.S. and in its mirror sites abroad to dispense its material. Its subscribers worldwide will need access to secure, commercial encryption as well. An article which described the development of a new cryptographic algorithm would likely appear in one of the many technical journals or conference proceedings published by ACM or the Institute for Electronics and Electrical Engineers (IEEE), another international professional society. In fact a number of the groundbreaking articles in the field of cryptography science were originally published by ACM and IEEE. Publication of encryption algorithms is extremely important to the field of cryptography. In order for an algorithm to be trusted, it must be challenged. To do that, the code must be made widely available. Foreign members of ACM will be unable to access in electronic format the same articles they currently receive in the printed journal. And, it is technically impossible, at this late date, to partition ACM's publications into distinct paper and electronic (hence encryptable) media. Electronic communications, including the World Wide Web, list serves, Usenet news groups, and video conferencing are becoming the prominent means by which scientists communicate. Science is a global pursuit and there exists a open communications network between scientists in different countries. Part 734.2 which prohibits making cryptographic software available outside the U.S. will not only eliminate this international communication but also technical communication among U.S. scientists. In electronic communications it is not always clear to whom the information is being transmitted. WWW sites and Usenet news groups are accessible by anyone with a modem. Video conferences can be retransmitted overseas and moderated listserves are difficult to control. The Interim Rule refers to an individual taking "precautions adequate to prevent unauthorized transfer of such code outside the U.S." It is our belief that it would be impossible to be certain of any precautions taken. This will effectively eliminate all communications on electronic media that describe or discuss cryptographic source code. We believe the interim rule must be revised to eliminate the distinction between printed and electronic source code and to allow for open communications within scientific communities. Restricting these communications will retard the evolution of the science and the development of new algorithms and cryptographic devices. Education Many ACM members are computer science professors and teachers, so we are concerned about the contradictions in the proposed regulations with regards to education. A number of fields and sub-fields address cryptography as part of their curricula. Part 734.9 states that "Educational Information" is not subject to the new regulations if it is "released by instruction in catalog courses and associated teaching laboratories of academic institutions." Computer science, mathematics, engineering, and electronic security may all include technical instruction in encryption technologies and would be covered in U.S. university classrooms. However, questions arise with regard to distance and home or overseas education because of Part 744.9. It states that "No U.S. person may, without a license from BXA, provide technical assistance (including training) to foreign persons with the intent to aid a foreign person in the development or manufacture outside the United States..." While Part 744.9 defines a U.S. person it does not define "technical assistance" or "training." It is uncertain whether a U.S. professor teaching a course in which foreign students are registered, or teaching a course in cryptography overseas would be "training" a foreigner to develop a cryptographic device if the course work was more detailed than "a discussion of information about cryptography." This would affect course studies as disparate as 'number theory' and 'local area networks'. Also, educational environments are not limited to academic institutions but are also found in national and industry labs. Many computer scientists receive their first hands on training after they graduate from their University. It is unclear whether this "training" or "technical assistance" is in violation of the Interim Rule. The intent of the training is give the new employee the practical tools necessary to participate in the field of cryptography science, and is not necessarily intended to be project or employer specific. While the General prohibition in Part 744.9 discusses the meaning of intent as applied to an academic setting, it is not clear if "academic setting" can be applied to instruction which occurs outside of the University environment. The argument made previously with regard to digital media also applies to education. As part of their course work, students often use electronic media as resources (WWW, digital libraries, CD-ROMs), as a communication device for the class outside the classroom (electronic mail, listserves), and to learn from listening to the discussions among research scientists (Usenet groups, listserves). Part 7.34.3 (b)(3) which covers encryption source code in electronic form or media will restrict these types of educational instruction. Instructors will be unable to take advantage of digital media in their courses. Students studying cryptography will be unfairly disadvantaged as they will be unable to access valuable resources even in the process of furthering their education. The USACM believes the contradictions in Parts 7.34 and 744.9 must be resolved in a clear manner so educators are not required to reduce the quality of their courses for fear of misinterpreting the Interim Rule. Specifically, "academic setting," "training," and "technical assistance" must be defined, and distance education, and academic research and communication must be addressed. Research and Development Encryption policies must reflect the needs of the global market. The international demand for products which incorporate strong cryptographic tools is growing. Such products are widely available and produced by a number of nations. U.S. scientists have been prominent in the development of current encryption technologies. The field has developed though research and development efforts along many different tangents, only one of which describes key recovery products. There is little evidence that the demand for cryptography tools is limited to those products which incorporate key recovery protocols. Part 742.15 (which states that businesses must submit a business plan for the development of key recovery products before they may export 56- bit software; the license must be renewed biannually until 1998 when only key recovery products will be allowed for export) will restrict the U.S. to producing only products which incorporate KRI protocols. Mandating that businesses develop key recovery products will also impede the natural market development of novel and innovative systems. Part 740 hypothesizes that a worldwide KRI will be desirable, feasible, and in place by 1998. However it is unclear whether key recovery is the best alternative. Research along new tangents will continue in non- industry and non-U.S. settings. A new protocol may be discovered which is considered a better choice for a worldwide infrastructure. There will exist a great market demand for variety in choosing a security system to fit the needs of the distinct commercial group. If this happens U.S. scientists and industry will be at a disadvantage as they will have only a core competence in key recovery protocols as per Part 740.8. There are a variety of commercial groups interested in utilizing the Internet for business interactions and transactions. Without interoperable encryption programs, commercial needs in an increasing global environment cannot be met. Supplement No. 4 to Part 742 states that a product can not interact with another product whose key recovery system has been "altered, bypassed, disabled, or otherwise rendered inoperative." This will be a major source of problems for researchers and educators, as well as government and commercial institutions. The result of a system not being able to talk to another system because of an intentional or accidental disabling of the KRI protocols can have a very large impact on telemedicine, research, government operations, and commercial enterprises. The USACM believes the Interim Rule should be rewritten to avoid dissuading innovation and development and eliminating the U.S.'s core competency in cryptography. It should also recognize the need for consistency in interoperable systems. Key Recovery The USACM recognizes that there is a real market demand for key recovery products from business and government employers. However, the viability of a KRI has not yet been determined. It has not yet been subject to the vigorous testing necessary for a proposed standard. There is little understanding of how such a system would operate and what controls would be needed to ensure that it remained secure. Part 740 describes the development of a Key Recovery Infrastructure within two years. We believe it is unwise for the United States to insist on the development of a untested, unproved technology for a worldwide infrastructure. The National Research Council report stated that a feasibility study needed to be performed on a smaller scale before key escrow could be seriously proposed for commercial applications. We believe this warning applies to KRI as well. While key recovery tools may be appropriate in some settings, we believe it would be wrong to impose such restrictions on users or businesses and the Interim Rule should not dictate that businesses limit their research to a potentially unworkable system. Privacy The USACM believes that certain principles should be reflected in a national cryptography policy. Encryption should be used for privacy protection and to encourage the development of technologies and institutional practices which will provide real privacy for the future users of the NII and real security for the protection of the system. The USACM believes that transferring the regulation of cryptography to the Commerce Department could establish United States leadership in protecting the privacy rights of its citizens. However the Interim Rule fails to do that. Conclusion We recognize that the government has a legitimate interest in protecting national security. However, whether or not the worldwide infrastructure is achieved, the role of national security agencies will remain difficult. The government's proposal to balance national security, business, and privacy interests by creating a Key Recovery Infrastructure within the next two years is overly aggressive. We suggest that the development of a policy that serves the long term interests of our nation's security will not be one based on a Key Recovery Infrastructure, but rather one that anticipates the widespread availability of strong encryption and the multifaceted demands of a global economy. Toward that end, the interests in protecting open research within the U.S. academic community will be crucial. Sincerely, Barbara Simons, Ph.D Chair, United States Public Policy Office for the Association for Computing The ACM, founded in 1947, is an international non-profit educational and scientific society dedicated to the development and use of information technology, and to addressing the impact information technology has on the world's major social challenges. The Association's activities include the publication of scholarly journals and the sponsorship of special interest groups (SIGS) in numerous disciplines. ACM has 76,000 members. The 60,000 who reside in the United States are academic, professional, scientific, and ordinary users of telecommunications technology and have a strong interest in the development of sound encryption policies. The USACM provides a means for promoting dialogue on technology policy issues with United States policy makers and the general public. We respond to requests for information and technical expertise from United States government agencies and departments, seeks to influence relevant United States government policies on behalf of the computing community and the public, and provides information to the ACM on relevant United States government activities. ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- Lauren Amy Gelman gelmanl(a)gwis2.circ.gwu.edu George Washington University gelman(a)epic.org Science, Technology, and Public Policy Program gelman(a)acm.org

1 0