December 2003 - cypherpunks-legacy

Laws Outside the U.S.
by usura＠vox.xs4all.nl 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May) writes: : > It would be interesting for those in other jurisdictions to comment about : > how *their* rulers might view anonymous communications and strong crypto. : : I heartily agree with Duncan here! There has been very little said by : the good residents of France, Germany, Sweden, Holland, Italy, etc. : about just what the crypto-related laws of their countries are. [..] : So, I appreciate that some of our European readers may be tired of : hearing about U.S. policy or proposed laws, but the proper solution is : _competing speech_. That is, give us something new to talk about. Tell : us about what *your* country is doing. Tell us about any laws limiting : what kind of modems can be hooked up to your PTTs, as a concrete : example. Tell us about the raids on BBSs in Italy. Tell us about the : rumor that the Netherlands plans to ban unapproved crypto. There was a draft for a proposal for a law that would have outlawed crypto in the Netherlands. It would only be legal to use crypto if you had deposited the KEYs and if you had received a license. The use, trade and possesion of crypto was forbidden. It would be illegal (to dutch law) to have cryptosoftware available at some ftp-site (somewhere in the world) that would be accesable from the Netherlands (really!). (laws and enforcement of those laws are two -totally- different things in Holland :)) The draft was revoked, due to the huge amount of protest', the good thing is that we are in the proces of founding the dutch equivelant of the EFF: "de db.nl". -- Some loose thoughts any comments ? -- There are basicly four scenario's that a state can follow to regulate crypto: - outlaw it totally This was the path Holland choose briefly. - key depositing This is what the US is trying to do with Clipper et al. - try to develop a standart This is what the US did with DES and is trying to do now with Clipper. - do nothing The most prosperous scenario. Crypto use will boom, but lawenforcement agencies will be deprived from a useful tool, they can't bug phones any more. That will hinder their investigations but advancements in hardware/software could balance that: it is more easy to localise phonecalls, bugging equipment has become smaller and more powerful. Lawenforcement agencies have computerised databases that can link fingerprints, names etc in near "real-time". Large scale use of crypto could balance out some of the recent advancements in information technology that have given them a clear edge. -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

Re: On the crime bill and remailers
by Mike Markley 17 Dec '03

17 Dec '03

Hal <hfinney(a)shell.portal.com> writes: | | Black Unicorn <unicorn(a)access.digex.net> writes: | >I believe anonymous | >remailers have some use. But they are so targeted to prevent GOVERNMENT | >observation and intercepts, that they just plain look bad. | | I strongly disagree with this. Anonymous remailers as presently constructed | will be almost completely ineffective against any significant government | attempts to surveil email traffic. The government does have the resources | today to defeat most uses of remailers. Since present-day remailers lack | padding features, the correspondence between incoming and outgoing messages, | even with encryption, is relatively easy to establish. This is made worse | by the lack of general support for reordering, which renders the task | almost trivial. | | Instead, anonymous remailers are clearly targetted against non-government | traffic analysis, generally local associates, system operators, employers, | supervisors, and so on. They allow people to communicate without | repercussions and retribution at work or at school. They let people exchange | email in an insecure environment while hiding both the message address and | its contents. They allow whistle blowers to expose malfeasance without | being punished. These are the kinds of things the remailers are good for. | | Claims here that remailers are designed to support sedition or to | prevent government surveillance are both wrong and harmful. This kind | of material could show up at some future prosecution of a remailer | operator. It is important that we understand clearly what the capabilities | and limitations of current remailers are. | | Hal | Why not make distributed remailers then? You could set up a chain using either mail or ftp or ? that would take all messages and fragment them into nice 1K blocks and then either mail or otherwise transport the blocks to other physical machines, these machines would then follow the imbedded instructions on how to reassemble the blocks into a coherent message and mail it out. Admittedly there is no sure fire method to prevent someone from monitoring all of the traffic generated but it should be possible to generate so much traffic that just wading through the volume would take more time than is practical. Also by encrypting all packets going between remailers and making the packets uniform sizes should help make monitoring more difficult. I'm not sure that I'm worried about the government monitoring my communications as much as I'm worried about individuals with bad intentions monitoring my communications. Mike. ===================================================== Mike Markley <mmarkley(a)microsoft.com> I'm not a Microsoft spokesperson. All opinions expressed here are mine. =====================================================

1 0

Scienter and all that stuff
by TOMJEFFERSON＠delphi.com 17 Dec '03

17 Dec '03

Re. "Scienter" and all that stuff. Not being handicapped by a legal education, let me tell you how I believe it really is: The facts and the law only matter when the government doesn't have a hard on for you. If the government wants to get you [and, perhaps, if you're not a millionaire "sports figure"] it will get you. The crime bill just makes the task a bit easier. Example 1: Branch Davidians were sentenced to long prison terms for possessing weapons during commission of a crime, even though they were acquitted of the crime they were accused of committing while being in possession of the weapons. Example 2: The jury brought in the "wrong" verdict for the L.A. cops who beat Rodney King, so the feds just stepped in and tried 'em again. The constitutional prohibition against trying people twice for the same crime didn't bother the feds a bit. I know, I know, they were convicted of "violating the civil rights of". What's the difference? Pardon me for my lack of respect for the system. It went out the window when a bunch of drug cops broke into my 71 year old father's apartment by mistake and beat him unconscious for objecting. Outside of F. Lee Bailey's circle, cops and courts can basically do what they want, ignore your protests, and *get away with it*. The only difference between a "crip" and a cop is the color of the uniform.

5 4

Social dynamics and remailers
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Blanc Weber makes many excellent comments and raises good questions in the post titled "Re: Virtual assasins and lethal remailers" dated 9/18/94. I would summarize the gist of that post as questioning the value or even possibility of attempting to predict social dynamics. Today, Hal Finney writes: >Anonymous remailers as presently constructed >will be almost completely ineffective against any significant government >attempts to surveil email traffic.... >...Instead, anonymous remailers are clearly targetted against non-government >traffic analysis, generally local associates, system operators, employers, >supervisors, and so on. I think that here is an excellent example of how a consideration of social dynamics can lead to suggestions for action today. Even if we cannot really hope to control or predict the reactions of society, this shouldn't excuse us from doing what we can. In this particular case, Hal points out that it is really the relative insecurity of remailers today which makes them unthreatening to the government and society at large. If cypherpunks successfully deployed a network of remailers which used message padding, message reordering, etc. so that they were secure against even government level monitoring, then we could expect to see the government/society to become quite alarmed by them and attempt to regulate and control them... probably successfully. Anonymous remailers certainly are useful and valuable even in their current form. I perceive that many cypherpunks would not question the assumption that making them even more secure would obviously be a desirable thing. Yet it might be precisely this course of action which would most quickly lead to the rapid imposition of controls on their use. Doug ___________________________________________________________________ Doug Cutrell General Partner doug(a)OpenMind.com Open Mind, Santa Cruz ===================================================================

1 0

Re: art encryption...
by roy＠viewgraphics.com 17 Dec '03

17 Dec '03

While I was at the NAB (National Association of Broadcasters) show last year, I came across a company in the radio hall that had developed a way to mark audio so that if it was copied, it could be traced back to its original source. Sampling has made this a significant problem in the recording information. The person that I talked to did not say or seem to know much about the actual process used, but claimed that the signature could withstand sampling and manipulation. I don't remember the name of the company, but I think the name started with cyrpto Roy

1 0

A meme about politics of country X
by sw＠tiac.net 17 Dec '03

17 Dec '03

>My hunch is that most of the Western nations are looking for policy >guidance to Washington... Now there is a scary thought. We need a counter-meme. (Mike Godwin has a fun article about how he invented a counter-meme and watched it spread, in the latest *Wired*.) My meme is: "Boy, don't immitate what *Washington* (or insert your country's capital here) is doing, those Americans (or whoever) have let their government go *totally* haywire." This requires a little support. For America it's easy (your mileage may vary): "Americans all think they're outlaws and ignore what's going on in government. They just buy lawyers and accountants and don't think about it. The people in Washington get no feedback from the public so they watch TV for ideas. Bad cop shows, mostly." I think it works best if you only talk about one country this way in any given context. If two people use the same meme about different countries in the same context, they can say, "Is it that way *there*, too? Oh, my." --Steve - - - - - - - - - - Steve Witham's .sig contains four a's, one b, two c's, two d's, twenty six e's, six f's, two g's, three h's, ten i's, one j, one k, two l's, two m's, twenty n's, seventeen o's, one p, one q, five r's, twenty nine s's, twenty-one t's, four u's, six v's, twelve w's, four x's, five y's, and one z.

1 0

Re: Virtual assasins and lethal rema
by TJHARDIN＠delphi.com 17 Dec '03

17 Dec '03

Adam is absolutely right. A somewhat similar case comes to mind that happened a few years back. Remember the SOF contract cases? Ads for "high risk employment" were placed in SOF by hired killers & employers responded to mail drops. Although not as anonymous as what we are discussing, interception of those communications did not break those cases. It was good old fashioned police work combined with mistakes on the part of employers & employees. Only after the case was pretty well solved was the method of hiring revealed (by suspects talking.) SOF paid a big civil judgement & agreed to stop running personal employment adverts. Even if a killer is so anonymous that she can't be linked to a given crime by the employer who will talk 99.9% of the time any pressure is applied, she must still continue to accept various contracts. The police would then set up one of their stings & "hire" her anonymously for another job & snatch the killer up when she attempts to fullfill this contract. Likewise, the very first offer of employment may well be of this sort. All of this presupposes that there are still some police around, which I kinda hope they aren't. They have rarely been around when I needed them & with all the moraline addicts they have to fix they don't have time for real crimes against person & property anymore. tjh pgp261 available

1 0

Re: On the crime bill and remailers
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

>From: Black Unicorn <unicorn(a)access.digex.net> >Subject: Re: On the crime bill and remailers > >Anonymous must be a Baker & Botts associate. Now that's funny. >> 1) The act does not make it a per se offense to have a remailer. Below it is asked whether this is assertion or assumption. Neither. It is obvious. If the act wished to make running a remailer a per se offense it would simply say so. It doesn't say anything like that. [...much deleted. Time preses and this is unpaid...e$ anyone?...] > >Instead you might ask how the statute will be read in the context of the >differing language between the investigation threshold requirement and >the definition of offense. Why would one mention intent so explicitly >and the other ignore it? Did congress anticipate the difficulty of >showing intent in this type of prosecution and structure the act >accordingly? This would be my argument as a prosecuter. This argument is not frivolous. But I doubt it would work, particularly since the counterweight is constitutional due process. > >> 3b) Query: why would it be a violation of due process to >> have a ban on unknowingly aiding terrorists in the manner Mr. Unicorn >> wishes to read the satute? > >Ah, but the counter to this arguement (obviously structured well into the >statute) is that there will never be any investigation into the offense >without resonable facts to suggest intent. (This is the killjoy to the >due process arguement.) This won't work either. First, it is not "obviously structured well into the" badly drafted statute. Second, a limit on investigations does not in this world of police and prosecutorial discretion operate as a meaningful, or even mesurable, limit on prosecutions. Suppose the police get information in the course of a separeate investigation? Suppose they are following Carlos and see him go into your resturant? [...] > >You rely on the construction tending to constitutionality here, but it is >equally valid to construct the statute as meeting the due process >requirement via the investagatory intent requirement. This was my entire I disagree completely. See above. >point. Given the difference in the requirements between allowing >investigation and definition of offense, there is a basic imbalance in >the act. Why? Accident, poor drafting? Intent? Neither. A guess, and only that: the investigation limit (which I would argue is uneforceable) is intended as a signal to cops/sop to civil libertarrians that the act should not start witch hunts. > >> N.B. these problems could be cured, and due process observed, by finding a >> duty to make enquiry or imputing a negligence standard of some sort, but >> we do not see any hint of this in the statute. > >Exactly. So why are they not? Why is this never mentioned. I can only stupid drafters is the most likely explanation >believe that the structure of the statute is intended to provide this >arguement as a loophole. I'm not paranoid enough to want to claim that >this is to peg remailer operators specifically, (duh) but what are the >implications for a very soft offense definition in a federal crime bill? Standard operating procedure these days. Hmmm...maybe a literal-minded court is not so bad? [...] >> Ratzlaf v. United States, >> 114 S.Ct. 655 (1994) [summary quoted below], in which the Supreme >> Court imputed a scienter requirement into a money laundering >> statute which on its face required no such scienter at all. > >I have not had time to look at 31 USC 5324(3) in detail with reference to >this problem. Nor have I looked at the case. At first glance it looks >promising, but I remain a skeptic. It is too tempting to use the >language in the investigatory intent requirement to dismiss the >arguements you make. > I disagree. Intent from investigation won't cure the due process problem. Intent -- at a minimum in the sense of knowingly committing the act of aiding a terrorist, not necessarily in the sense of knowing that it is illegal to do so -- must be read into the offence itself. Only a very, very clear statutory command to the contrary would suffice to avoid this reading -- and then we have pretty much created a per se offense of running an open remailer since it is impossible to know who you are dealing with. I might add that I believe it would be a violation of the First Amendment to make running a remailer a per se offense, but that's not required for the argument [...] > >> //QUOTING-- >> SYLLABUS: > >> time it is called into play. Because currency structuring is not >> inevitably nefarious, this Court is unpersuaded by the United >> States' argument that structuring is so obviously "evil" or >> inherently "bad" that the "willfulness" requirement is satisfied >> irrespective of the defendant's knowledge of the illegality of >> structuring. > >In any event, this is the real key here. What do you think a judge will >find encrypted remailing rates on the "nefarious" scale? In context I >think it will be quite harsh. Especially given the very nature of the Given the importance of money laundering to drug deals, and the 1st Amendment aspect of remailing, I rate it at least a tie or better. [...] Since we are now being civil, I should note that the Ratzlaf case has been criticized by almost every commentator as wrongly -- even insanely -- decided, and I tend to agree with the critiques. Nevertheless, the decision is of a piece with other odd, hyper literal, statutory construction cases in the past two years and the odds are it will be followed. SOLONg

1 0

any CP going to the International Cryptography Institute this week?
by Carl Ellison 17 Dec '03

17 Dec '03

I have the program in front of me and it looks ominous. - Carl

2 1

Re: Scienter and all that stuff
by chen＠intuit.com 17 Dec '03

17 Dec '03

> In article <9409201859.AA00254(a)doom.intuit.com>, > Mark Chen <chen(a)intuit.com> wrote: > >> The facts and the law only matter when the government doesn't have > >> a hard on for you. If the government wants to get you [and, perhaps, > >> if you're not a millionaire "sports figure"] it will get you. The > >> crime bill just makes the task a bit easier. > > > >This is quite accurate. Howard Zinn makes the same point in > >_Declarations of Independence_. > > Where does Steve Jackson fit into this theory? > > I don't think it's nearly as black & white as you suggest: Our systems > are not monolithic and some consitutional and democratic principles do > still have some sway. Noam Chomsky discusses this when he talks about > reasons for optimism. > > Which is not to belittle the orginal point that we have reason to be > paranoid: it's just to say that we don't have total justification for > despair, either. Yes, it's often easy to identify a single piece of the overall dynamic and use it to account for everything that happens. I'm only saying that legal guarantees are not necessarily the last word about what the government can and can't do to you. Chomsky's optimism (as you know) doesn't stem so much from a faith that our legal system will one day start working properly, as from a faith that people are capable of evolving - an outlook that you and I seem to share, but that many on this list don't. - Mark - -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

Re: Virtual assasins and lethal rema
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

TJHARDIN(a)delphi.com writes: >Adam is absolutely right.... Even if a killer is so anonymous that she can't >be linked to a given crime by the employer who will talk 99.9% of the time >any pressure is applied, she must still continue to accept various >contracts. >The police would then set up one of their stings & "hire" her anonymously >for another job & snatch the killer up when she attempts to fullfill this >contract. Likewise, the very first offer of employment may well be of this >sort. Once again (and hopefully for the last time!), I reiterate that it is the person *placing* the contract who is at zero risk (except for the risk of losing their digital cash). Stings can be set up to catch the killer, but providing the person doing the hiring trusts no one but himself, there is no risk to him. To the extent that there is *any* risk to this person, the goals of crypto anarchy have not been met. This pertains to every conceivable security leak that might affect the person placing the contract. Doug ___________________________________________________________________ Doug Cutrell General Partner doug(a)OpenMind.com Open Mind, Santa Cruz ===================================================================

2 1

HTTP authentication efforts
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

Howdy guys 'n gals. As much as I'd love to rant about Detweiler getting an account on Colorado Supernet, I must put aside my insidious remarks for the time being. Does anyone know, on the off-chance, who is currently working on HTTP authentication processes for web browsing and Mosiac? Pointers appreciated. _______________________________________________________________________________ Paul Ferguson US Sprint Managed Network Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com

1 0

Reserved DC-Net IP addresses - NOT!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes): > Speaking of long-term integration on the internet, might it not be a > good idea to get some IP address range assigned for dc-net use? I don't agree. Apart from the IP address crunch that already poses a problem for the IETF, I don't see why DC-Nets should be limited to specially allocated addresses. DC-Nets should be implemented a layer over protocols such as IP, or as extensions to them. It should be possible for _anyone_, regardless of IP address (officially allocated DC-Net number) to connect with _any_ others on a DCN, with some software or other interfacing. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

3 2

Re: Scienter and all that stuff
by chen＠intuit.com 17 Dec '03

17 Dec '03

James Donald writes; > L. Todd Masco writes > > I don't think it's nearly as black & white as you suggest: Our systems > > are not monolithic and some consitutional and democratic principles do > > still have some sway. Noam Chomsky discusses this when he talks about > > reasons for optimism. > > Of course Noam Chomsky is optimistic - he favors limitless and absolute > state power and the forcible and violent silencing of all those who > deviate from political correctness. > > If I was campaigning to make a the US a totalitarian terrorist > state, I would be full of optimism. Before this gets out of hand (which it certainly will), I very gently suggest that you read something which Chomsky has written before favoring us all with your opinions. -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

Re: On the crime bill and remailers
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hal said: > I strongly disagree with this. Anonymous remailers as presently > constructed will be almost completely ineffective against any significant > government attempts to surveil email traffic. The government does have > the resources today to defeat most uses of remailers. Since present-day > remailers lack padding features, the correspondence between incoming and > outgoing messages, even with encryption, is relatively easy to establish. > This is made worse by the lack of general support for reordering, which > renders the task almost trivial. Although it does seem that the government ought to be able to track remailer traffic, is there any evidence that they are actually doing it in the real world? I've seen posts on usenet which would have presumably provoked a reaction from police, but I can't remember hearing of any cases in which such surveilance occured. == Alex Strasheim alex(a)omaha.com -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLn9tpREpP7+baaPtAQHrewQAvJW8zUIQb57XwHHsdGC7gJo9UyFfds4o hu1vTUEsZvzyYJL7BIVgDEnHowVZ6vWyKky2QW+CiYli6Ulo8zFN5zoeWS09vLx2 /pANQPxXC+o61C1rypiR85D/esJ7a7ZRJu8OI5sa98+eLmDDad/j/768OMmFwR8c iI8ZnV2PCbQ= =DwQt -----END PGP SIGNATURE-----

4 3

Re: Scienter and all that stuff
by John Young 17 Dec '03

17 Dec '03

Responding to msg by jamesd(a)netcom.com (James A. Donald) on Tue, 20 Sep 3:22 PM > >Of course Noam Chomsky is optimistic - he favors >limitless and absolute state power and the forcible >and violent silencing of all those who deviate from >political correctness. > >If I was campaigning to make a the US a totalitarian >terrorist state, I would be full of optimism. I respectfully suggest that that's not what Chomsky advocates. He makes superior detailed analysis and criticism of authoritarian government by brilliantly attacking weak-willed ideologues of all political persuasions which hide under skirts of tyrants. On the contrary, his optimism, it seems to me, derives from his own hard work and original thinking not from parroting any party line. With this he is in the company of original thinkers like Karl Hess, Murrary Bookchin and others who have garnered the courage to grow beyond the simple faith of left-right comforts and conceits. Their writings have a generosity of scope and purpose that exemplify how to assess specific problems and to prescribe remedies, and thereby perhaps help us break free of the mesmerizing, melodramatic defecations of partisan politics. Or so I optimistically muse. John

1 0

Re: On the crime bill and remailers
by Hal 17 Dec '03

17 Dec '03

From: greg(a)ideath.goldenbear.com (Greg Broiles) > In general, scienter/mens rea requirements mean that you must have intended > a particular action (or failure to act) - the question is about your > understanding of the facts of a particular situation, not the legal status > of a particular situation. Given your example, it's illegal to drive > across the border, knowing your pickup contains ammunition - whether or > not you believe your actions are legal. It's not illegal to drive across > the border with a box full of ammunition if you thought you were carrying > a box full of clothes. > > The old saw "ignorance of the law is no excuse" is basically accurate. > Good-faith reliance on legal advice from competent counsel won't even > save you. (but it might get you a malpractice judgement/settlement). I don't know how true this is in general, but my research into the arms export question indicated otherwise. Here is part of a posting I sent to CP some time last year concerning a case in which the defendant did in fact drive to Mexico with a truck load of ammunition: > In U.S. v Lizarraga-Lizarraga, the appellate court wrote (in 541 F2d 826), > > "At trial and on appeal, the defendant admits that he purchased the > ammunition and that he intended to export it to Mexico. His defense is > bsed on the contention that he had no knowledge that his conduct violated > the law. Hence, the appellant claims that to be found guilty under > 22 U.S.C. 1934 [the predecessor to 22 U.S.C. 2778], the government must > prove that he intended to violate the statute.... We agree, and hold > that he was entitled to a specific intent instruction. Accordingly, we > reverse his conviction and remand for a new trial." > > The court discusses several reasons for concluding that "willfully" > implies a need to show specific intent, among them that the articles on > the Munitions List are not obviously illegal to export, finally concluding: > > "Accordingly, we hold that in order for a defendant to be found guilty of > exporting under 22 U.S.C. 1934, the government must prove that the > defendant voluntarily and intentionally violated a known legal duty not > to export the proscribed articles, and the jury should be so instructed." Perhaps the arms export laws are worded differently than some others and so the more stringent rules apply. Hal

2 1

SHAMELESS PLUG
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Mark Chen wrote the follow about the scienter thread: ... Howard Zinn makes the same point in _Declarations of Independence_.... he concludes that law is made not by legislators and judges, but by the policman's club. But less and less every day. As Duncan and I--the official "Pollyannas of Privacy"--have been telling you, technology is on our side. As it advances, technology continues to shift the balance of power from the State to the individual. For my vision of technology in the service of civil liberties, see my upcoming article, "Support Your Digital Police," in the "Idees Fortes" section of December's Wired. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: SHAMELESS PLUG
by chen＠intuit.com 17 Dec '03

17 Dec '03

Sandy Sandfort writes: > Mark Chen wrote the follow about the scienter thread: > > ... Howard Zinn makes the same point in _Declarations of > Independence_.... he concludes that law is made not by > legislators and judges, but by the policman's club. > > But less and less every day. As Duncan and I--the official > "Pollyannas of Privacy"--have been telling you, technology is > on our side. As it advances, technology continues to shift the > balance of power from the State to the individual. Which is why, even with their exceedingly feeble perception of what these technologies portend, authoritarian structures are thrown into fits of nearly hysterical apoplexy when confronted by Things Crypto. > For my vision of technology in the service of civil liberties, > see my upcoming article, "Support Your Digital Police," in the > "Idees Fortes" section of December's Wired. I'm there. - Mark - -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0

DB Technology
by L. Todd Masco 17 Dec '03

17 Dec '03

For a good example of DB/Expert system technology used for good instead of evil ("A power so great...") check out ringo(a)media.mit.edu, body of mail "join". You tell it your musical preferences and it suggests albums that others with a similar taste to yours liked. It'll also tell you what to avoid. I intend to honor its advice, to avoid Neil Diamond, Tiffany, and Barry Manilow. -- Todd

1 0

Re: Virtual Assassins & lethal remailers
by TJHARDIN＠delphi.com 17 Dec '03

17 Dec '03

Subject: Re: Virtual assasins and lethal remailers (Doug Cutrell) doug(a)OpenMind.com writes >>TJHARDIN(a)delphi.com writes: >>Adam is absolutely right.... Even if a killer is so anonymous that she can't >>be linked to a given crime by the employer who will talk 99.9% of the time >>any pressure is applied, she must still continue to accept various >>contracts. >>The police would then set up one of their stings & "hire" her anonymously >>for another job & snatch the killer up when she attempts to fullfill this >>contract. Likewise, the very first offer of employment may well be of this >>sort. >Once again (and hopefully for the last time!), I reiterate that it is the >person *placing* the contract who is at zero risk (except for the risk of >losing their digital cash). Stings can be set up to catch the killer, but >providing the person doing the hiring trusts no one but himself, there is >no risk to him. To the extent that there is *any* risk to this person, the >goals of crypto anarchy have not been met. This pertains to every >conceivable security leak that might affect the person placing the >contract. >Doug Sorry to have to repost on this, I only meant to make a brief point. To the following --> >the person *placing* the contract... is at zero risk To this entire point I must say Au Contraire!The person at greatest risk *is* the person placing the contract. This is the employer whom I said would fold under pressure 99.9% of the time. If the police are still around,they will use the classic investigatory method of cui bono? Who benefits? Who has motive?This was Adam's point & the one I was emphasizing. Even if the payment is untraceable, the police have often succeeded in bluffing suspects into confessing to crimes for which strong suspicions existed, but evidence proving guilt was entirely lacking. This will not change as human nature will not fundamentally change. As far as the assassin being unable to link the employer to the crime, or know who hired her, this is fine in theory, but it is likely that she two will ask the same question regarding the job, cui bono? & coming to the same conclusion. When arrested later for some other offense, merely providing law enforcement with the time, place, victim, & payment for various jobs will be enough to convict or scare most employers into confessing. After all the impatient heir will no longer be able to claim that Uncle Scrooge was a tragic victim of random violence. Now I know the idea is to reach a state where police forces no longer exist. But let's be realistic. -Publicly Supported- morality or Political Correctness Cheka's such as we know today will hopefully cease to exist, but it is extremely likely that Private Police squads will be hired by individuals & groups for protection & revenge. Such units/individuals have a long history in this country, & I knew (verrry casually- we frequented the same Houston New Wave hangout, Rudyard's in the early 80's) a hired killer named David West who was tripped up by a femme fatale hired by a private dick named Clyde Wilson who was hired by the victims' other daughters to get at the daughter who arranged their parents' murders. The case was solved entirely by these private cops & only turned over to HPD for arrest & prosecution. I am sure that if no HPD or State of Texas existed, the "good" daughters would have paid Clyde Wilson for more than just investigation. Actually, the natural condition of humans in anything more complicated than a small scale subsistence bands seems to be not living under powerful states, but rather private armies, condottieri, vendettas, etc. This was the state of affairs in the Italian Renaisance & which one of us would choose the deadly dull certainties of the Middle Age's dogmatic fideism over the brilliant explosion of that great liberation of the human spirit & potential? No one reads Aquin-ass- anymore or even knows who he was but the Borgias, Machiavelli, & Michelangelo are still remembered, read with profit, & restored...respectively even now. tjh 2.61 available

1 0

Re: On the crime bill and remailers
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 05:45 PM 9/20/94 -0400, John Young wrote: >Hal and Tim point to the vulnerability of the person running >the remailer to being threatened through the equipment owner Soon most remailers will be run on equipment owned by the operator. At the last NJ computer show I attended, I could have purchased a 486/66 with a paltry 250 meg HD for $999. Then all we have to worry about are the network connections but in a few years, we'll be able to do high-speed "dial up" connections from our home boxes to other (and different) systems anywhere on the nets. Hard to track. >This isolation and elimination (or co-optation) of a target has >worked again and again to destroy networks once they become >serious threats to law and order. They can afford to intimidate a few remailers but "enforcement doesn't scale well." (Another DCF quote.) Networks, software, and hardware scale much better than enforcement resources. Swamping effect. DCF

1 0

Re: Laws Outside the U.S.
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Germany: There is no restriction of import or use of cryptography ( _yet_ ). There are some restrictions about export and transmission of encrypted data: - Encryption soft/hardware can not be exported to communist countries (COCOM) without problems. I don't know exactly, whether it is forbidden, must be licensed, or must be registered in any way. - There are two kinds of amateur radio, the CB (citizen band) and the licensed amateur radio, which requires a personal license. On this licensed radio it is not allowed to send encrypted messages, but as far as I know nobody cares and nobody checks. The sense was to make you use the telephone and pay. - There was a restriction about the telephone net. You are not allowed to transmit anything but voice. I don't know what happened with that restriction since everyone uses fax and modem legally. At the moment they have a lot of problems with such laws. They have to decide whether they are valid or not, because most european countries have joined the European Community. The EC forces their countries to equalize their laws in the sense of "what you can do in one country, you can do everywhere". Sometimes this is very helpfull (e.g. use of modems. Most of them where illegal in Germany, meanwhile nearly all of them have a license), sometimes they have silly ideas (e.g. laws about ingredients of noodles or beer). If France forbids the import of crypto software, but allows to sell it inside of France, then I can sue France, because the french programmer can sell his programs in France and I can't. I'm sure we will get a special crypto law within the next years. Hadmut

3 2

Re: HTTP authentication efforts
by Mark Hittinger 17 Dec '03

17 Dec '03

> From: paul(a)hawksbill.sprintmrn.com (Paul Ferguson) > Does anyone know, on the off-chance, who is currently working on > HTTP authentication processes for web browsing and Mosiac? Cern probably has this already done and under wraps by now. In the USA the recent NCSA/Spyglass, Inc press release implies that Spyglass will develop an "electronic commerce" capability for Mosaic. Tuesday's Wall Street Journal has an interesting article (Sep 20 C1 bottom) about the mysterious DE Shaw company. For those of you who don't follow every vital scrap of information pryed out of DE Shaw - they are a stock market related firm with very heavy investment in computer hardware and brain power. The article quotes Shaw implying the development of yet another electronic market capability - "commercial use of the Internet". Perhaps Shaw is funding some of Spyglass? Its odd to see program trading gurus get side tracked on this. mark.h

1 0

HTTP authentication efforts
by michael shiplett 17 Dec '03

17 Dec '03

"pf" == Paul Ferguson <paul(a)hawksbill.sprintmrn.com> writes: pf> Does anyone know, on the off-chance, who is currently working on pf> HTTP authentication processes for web browsing and Mosiac? pf> Pointers appreciated. There is a www-security mailing list based at Rutgers (majordomo(a)nsmx.rutgers.edu; list name of www-security). From the introductory majordomo message: This list is intended for the discussion of World Wide Web security proposals, enhancements and issues. Ben Fried of Columbia posted to www-security some NCSA httpd/xmosaic patches to allow Kerberos 4 authentication. The University of Michigan is using these patches (with some bug fixes fed back to Ben) and a similarly patched lynx browser for authenticated web connections. I haven't looked at the code to know whether the network traffic is encrypted or not. michael

1 0