December 2003 - cypherpunks-legacy

Mailbombing
by jburrell＠ephsa.sat.tx.us 17 Dec '03

17 Dec '03

CS> 50 messages a day. I accidentally deleted some of my real mail CS> going through and deleting all yours. As I have said many, many CS> times, I thought I was subscribing to a periodic newsletter. CS> There was no warning that I would receive 50 messages a day, and CS> apparently no mechanism for gettin of the list once I was on. I CS> simply made ever more vehement requests to be removed from your CS> list. As each one was ignored, I stepped up the volume of my CS> requests. After about 10 days of no response (short of some CS> foul-languaged vicious flames from your readers furious because I CS> bounced one or two of their letters - but they couldn't CS> understand why I was unhappy about receiving 50 unwanted letters CS> a day). What you call a 'mailbomb' was the only action out of CS> everything I tried which actually got some response. Let's stay CS> clear on this: all I ever wanted, and all I want now, is TO BE CS> REMOVED FROM THIS LIST. I am still receiving How did you subscribe in the first place? Cypherpunks-request(a)toad.com? Wouldn't it make sense to mail that to get off? (Not saying that you DID use the request address) I don't blame the cypherpunk 'owner' NOT removing you. You post publicly to a list asking to be removed. You're not. So you mailbomb the list-owner? The fact that you weren't removed from the list (not going through the 'proper' channel) isn't an excuse to mailbomb the list. Let me get this straight. In all the replies you received to your public removal requests, not ONE said where to send the request?

1 0

Re: Dorothy Denning
by Black Unicorn 17 Dec '03

17 Dec '03

-> Chill... I thought that our prime objective was to defeat Clipper... even if you don't like Ross, he does have some pull with the people of this country, and that's what we need... we need the *PEOPLE* to fight Clipper. We need the fight not to just be "a group of civil libertarians", but the general populous. Maybe Ross isn't the answer, but at least I've taken a real step to try to oppose Clipper. What the hell have you done, Black Unicorn? Anthony <- In the circles I travel in Mr. Perot is considered a dangerous paranoid. I agree he has the ear of some *PEOPLE* (as you so nicely put it) but as much as you fear the branding of the anti-clipper movement as JUST "a group of civil libertarians," it is possible that there are other brands just as destructive to credibility. Mr. Perot is in my opinion represenative of one such brand. The Good Perot Keeping Seal might sink the "general populous" boat we would so much like to travel on. As far as your efforts in this matter v. mine, Anyone can post some messages to the list Mr. Ortenzi. -uni- (Dark)

1 0

Re: Standard for Stenography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

> Firstly, congratulations for Sergey Goldgaber's stubborn pushing of >this topic, for Bill Stewart's observation: "simple stego-programs, >stealthy encryption programs" I disagree with pretty much everything in your message, and since I'm the one who opened the topic and who is writing the code, my opinion would seem to count for quite a bit more than yours. I'm not going to repeat the reasons why the kind of standard you propose is a bad idea, you can fetch the messages as easily as I can. Cc:ed to the list only so that no one thinks Gary's proposal was accepted. The permutation idea remains the best. By the way, this discussion is an example of something I have labelled the "silence is invisible" phenomenon. It goes like this: there's a discussion; some of the participants work out an answer, and as far as they're concerned the discussion is over. However, other participants don't understand the answer, and keep on talking. In a physical meeting, the talkers would notice the annoyed looks on the faces of everyone else; or if the meeting had a good facilitator, he or she would catch on to the misunderstanding and correct it; but in cyberspace, those feedback mechanisms don't happen. --- Jef

4 5

PC Expo, Mac World, Comdex, etc...
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

If a few of us who have a bit of money to spend on disks and duplication could come together (or work apart) we could just go out infront of PC Expo, or any other expo and simply hand out free disks with stuff like PGP, SecureDrive and whatever else, maybe even include a flyer with info about getting more info on issues like clipper and such... Perhaps some sort of self running hypertext demo to show analogies, say via a caricature of Dorothy Denning or Billary Clingon trying to install bugs in the phones of the viewers, cameras in cable TV boxes, microphones in bathrooms etc, all bearing the word "Clipper" on them... :-) (The distribution method isn't my idea, a dude who runs or works for an internet mail/news only carrier approached me and gave me a flyer...) "Get your free PGP disks here, learn about how Uncle Sam is spying on your privacy, etc..." :-) Now for some rude awakenings to follow... are there any laws against handing out >FREE< disks to people exiting or entering a convention center? (hopefully not too many.) Putting up an informercial will reach a lot of people who couldn't care less. Putting this stuff in the hands of those who have the interests of big business will reach a wider bit of the people we need to reach.

1 0

What's Wrong with the List--Part 2
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

While I'm on a rant about what's wrong with the way the list is going, let me mention another serious problem: * People who want others to "do more." It seems that every few months someone starts loudly whining that others are not doing enough. This is very grating. For example, Detweiler started down his path to neurosis by begging and pleading for folks on the list to do more to help fulfill his vision of a "whisteblowing" group (note that others had discussed this idea, too, so Detweiler cannot claim all the credit). His pleas were eventually answered by Miron Cuperman, who went ahead and newgrouped "alt.whistleblowing" or similar. This is, by the way, now an essentially zero traffic group. More recently, "Xenon" got it into his head that the most important project in the universe was "Stealth PGP." Again, a good idea (and one that Phil Zimmermann, Kelly Goen, and others were calling by that exact same name more than a year ago). But Xenon figured that if he excoriated us enough for not immediately implementing his vision, we'd eventually work on it. He flamed out after a brief stint on the list and says he is now unsubscribed. (Which is too bad, as he had some good ideas. His problem is that he got _too excited_ about some particular ideas. Yes, getting "too excited" can be a problem: when one exhorts others to do the work one cannot or will not do oneself. In other words, badgering, lecturing, and moralizing. Xenon apparently came to see the lack of a rush to his flavor of steganography as some sort of failure of will by the Cypherpunks, and unsubscribed.) These are the dangers. Whenever I feel the urge to exhort others to work harder and longer at some task, I think about this situation. (I have no problem with political rants, exhorting folks to adopt my point of view on something. But I avoid--I hope--asking others to do work that I am unwilling or unable to do. It just isn't right. If one wants others to do something concrete, a less "bossy" approach is called for, and one should be prepared to give something in return.) Closely related to this issue is the habit some have of talking about what "we" have decided "our" goals are and how these goals of "ours" should be fulfilled. (As a sidenote, L. Detweiler kept asking what the "Cypherpunks goals" were and what the "leaders" expected to be done. When many folks told him in no uncertain terms just what kind of anarchy the List is, poor Detweiler just couldn't handle it. I think "control freaks" like Detweiler want plans, want others in harness to fulfill these plans, and want to boss others around.) I'll stop with the rants for now. Take my comments any way you like, but I hope they are taken in the spirit in which they are given--as honest observations of some of the problmes affecting a list with nearly 800 subscribers. Cheers! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

HUMOR: Sternlight on the CPSR Clipper Petition
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherpunks, And now for some humor amidst my rants. This is a post I did that makes light of David Sternlight's bizarre assertion that the anti-Clipper petition of the CPSR contains few valid signatures because he, David Sternlight, asked those who signed the petition to send him e-mail....and he only got 35 responses! QED, the CPSR either faked the signatures or others forged messages. (Sternlight even cites "cypherpunks" as likely culprits, noting that they are skilled at creating phantom identities....I guess Detweiler was listened to by at least one kindred soul.) The methodological flaws in Sternlight's line of reasoning are too obvious to go into here, and Sternlight has sunk to a new low in terms of respect. His claims that he was recently a senior government policy advisor give me new insights into why the government is as screwed up as it is. Finally, I've avoided flaming Sterno in public, and I had some qualms about kicking him while he's so much of a fool over this issue, but my satirical urges got the best of me. Here it is: Newsgroups: comp.org.eff.talk,alt.privacy.clipper,alt.security.pgp,talk.politics.crypto,alt.security.ripem,alt.fan.david-sternlight From: tcmay(a)netcom.com (Timothy C. May) Subject: Re: CPSR Clipper Petition test results Message-ID: <tcmayCM320o.6I0(a)netcom.com> Date: Thu, 3 Mar 1994 09:50:47 GMT Matt Austern (matt(a)physics2.berkeley.edu) wrote: : The US government claims that over 100 million people voted in the : 1992 Presidential election. Fewer than 50 people, however, personally : told me that they voted in that election. : It won't play, fellas. 50 people out of 100 million? Clearly, this : supposed "election" didn't really happen. This effect is far more widespread than you suspect. Several days ago I posted a request in rec.skate for people to send me e-mail if in fact they watched the Olympics--any or all of it. While the pundits at CPSR (Central Polling for Sports Research) would have us belief that _more than_ 100 million Americans (which is "many" but not "most") watched some or all of the Olympics, I received a paltry 3 responses, and one of these was a string of moronic insults, so I really only count 2 valid response. Could 100 million Americans have watched the Olympics if I only received 2 valid responses to my poll? My many years advising the government in senior policy postions, and my Ph.D in statistics tells me "Not on your life." Applying the Black-Scholes significance test (with a quartile scatter factor normalized to the Kolmogorov constant), I have concluded that the actual number of Olympics watchers was 135 plus or minus 7.32. I thus conclude that CBS, the Olympic Committee, the Tonya Harding Kneecapping Club, and the ever-treacherous CPSR are all lying to us! I will, however, not discuss this matter any further! (At least not until I do.) --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Hands On Action
by Greg - Kucharo 17 Dec '03

17 Dec '03

> Thanks for your posts Tim.They really got me motivated.Indvidual action gave > us the rights we now enjoy and are threatned.Invidual action will save them > from extinction.When George Washington got fed up with the British slagging > on his rights he didn't sit around a Mt.Vernon getting stoned with Martha > and saying how nice it would be if those lackeys down in Boston would kick > the Redcoats out.He got his musket,saddled his horse and marched his army to > get them out himself,and make way for The Constitution.I don't have a musket > or a horse,but I do have a computer,knowledge of programming and a Computer > Club.It took awhile,but the DeAnza Computer Club is now educated in PGP and > we now turn to our fellow students.As young Americans we arent as used to > being jerked around by our government,and we don't intend to start getting > used to it.I will probably spend a great deal of my adult life on the network > I'll need my rights in there just as much as outside. > Since I have educated my fellow club members and forwarded List posts to them > we are going to start writing crypto programs for use here on campus and on > our club machine.If everyone takes up Crypto arms,we can drive out the Redcoats > and make George proud.

1 0

DC 'punks meeting
by Pat Farrell 17 Dec '03

17 Dec '03

I'm willing to try to russle up a suitable place for a physical meeting in the DC area in parallel with next Sat's politically oriented left coast meeting. But the number of folks attending will change where I can hold it. If you are interested in attending a DC-area meeting next Saturday, 3PM EST until 5 or so, please send me email. Thanks Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: DC 'punks meeting
by Harry Shapiro Hawk 17 Dec '03

17 Dec '03

Pat Wrote: > I'm willing to try to russle up a suitable place for a physical > meeting in the DC area in parallel with next Sat's politically oriented > left coast meeting. But the number of folks attending will change > where I can hold it. I can't make that meeting, but I will be in the Baltimore area on the weekend of 19th. hakw Harry Shapiro Hawk Manager of Computer Services Warwick Baker & Fiore habs(a)uucp.warwick.com

1 0

Need info on Encyption book
by KEPERRIER＠setpoint.com 17 Dec '03

17 Dec '03

Hi all, I have joined the "Small Computer Book Club" and in their "Top 10 Best Sellers" is a book by Gilbert Held called _Top_Secret_ - Data Encryption Techniques. Below is the text description: "Learn how to get people the information they need...without prying eyes getting a look at it, too. This book/disk package introduces you to techniques you can use to secure messages transmitted over internal company networks or public electronic message systems. You'll learn how to protect your communications with techiques for transposing characters in text, replacing characters, with new ones, using arrays, and more. Plus, your free disk features source code for the book's enciphering programs. Softcover, with 3.5" disk. 218pp 1993." Has anyone heard of this book and is it with the $19.95 that they want for it? Thanks Kent Perrier keperrier(a)setpoint.com (work) kperrier(a)neosoft.com (play) Corporations don't have opinions, people do. These are mine. PGP 2.3a Public Key available by request

3 2

Re: Standard for Stenography?
by Hal 17 Dec '03

17 Dec '03

From: Jef Poskanzer <jef(a)ee.lbl.gov> > > > Firstly, congratulations for Sergey Goldgaber's stubborn pushing of > >this topic, for Bill Stewart's observation: "simple stego-programs, > >stealthy encryption programs" > > I disagree with pretty much everything in your message, and since I'm the > one who opened the topic and who is writing the code, my opinion would seem > to count for quite a bit more than yours. I'm not going to repeat the > reasons why the kind of standard you propose is a bad idea, you can fetch > the messages as easily as I can. > > Cc:ed to the list only so that no one thinks Gary's proposal was accepted. > The permutation idea remains the best. I share Jef's disagreement with the spectacularly bad "neon sign" steganography header, but I don't think Sergey's approach was correct and I hope he does not feel the issue is closed yet. Bill Stewart is IMO far more experienced and has far better understanding of the issue than Sergey, who has been a list member for only a few weeks and again IMO suggests a very naive security-through-obscurity approach. Bill Stewart, Norm Hardy, and other list members who have more experience and who have discussed these issues in the past will I think agree that the correct approach is to separate the function of the stegonography program to be a simple and clean insertion, and to have other components be responsible for assuring that what is inserted is statistically indistin- guishable from what is replaced. This notion that a "secret offset" will prevent the stego from being discovered is highly naive IMO. The correct approach is to make it so that the stego cannot be recognized even if the opponent knows where it is. Adding offsets is like attempting to "improve" regular RSA by putting a secret amount of noise padding at the front (not of a stego file, but of an openly encrypted file). This is unnecessary if you trust your encryption, and if you don't trust it then this approach should not make you trust it. Similarly, if your stego is so weak that knowing where it is in the file will allow the opponent to detect it, adding a random offset should not make you feel secure. The correct approach is to have statistical identity between what you are inserting and what you are removing. The stego program itself should then be as simple as possible. Now I will add my own little moral lesson, in the spirit of Tim and Jef. Sometimes when these discussions are re-hashed, old-timers are too busy or bored to join in. New list members express naive views that are not vigor- ously refuted. This is OK, but then some other new member takes these views to represent list consensus. I think it is great that Jef is working on a steganography implementation, but IMO the notion of "random offsets" is so fundamentally misguided that I hope he will reconsider. Hal Finney hfinney(a)shell.portal.com

2 1

spooks
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

If there are any spooks on this list aren't they required by law to say that they are if somoeon asked if anyone on on th list was employed by CIA, DOD, FBI or NSA? Reuben Halper

3 2

Next Physical Gypherpunks meeting
by solovay＠math.berkeley.edu 17 Dec '03

17 Dec '03

Is it scheduled for March 5 or March 12th? --Bob Solovay

3 2

Forbes magazine against the Clipper?
by Mike Markley 17 Dec '03

17 Dec '03

I just noticed in the March 14, 1994 issue of Forbes magazine that there is a small blurb about Clipper/Skipjack. >From page 26 "HIGH-TECH SNOOPS" "The Administration is about to browbeat American computer manufacturers (as well as cable and telephone operators) into installing in its machines a special chip that would enable the government to eavesdrop on all computer and telephonic transmissions." It goes on to somewhat describe the governments theory on why they need to do this. Then the article says the following. "This is a really dumb idea. High-tech exports will be devestated. Foreigners aren't going to buy equipment with such a decoding device. More to the point, criminals and terrorists won't either." "The Clinton Administration promises that the enormous power that the Clipper Chip gives the feds will not lead to abuses of our privacy. Baloney." This is not a full reproduction of the article but covers the main direction of it. All quotes are fully intact and not paraphrased. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Mike Markley || The opinions here do not represent the mmarkley(a)microsoft.com || opinions of my employer. Attempts to || associate the two are pointless. "I want to look at life, In the available light" - Neil Peart -

1 0

Re: standard for stegonography?
by Sergey Goldgaber 17 Dec '03

17 Dec '03

On Tue, 01 Mar 94, you wrote: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Then that generator is used to make a *permutation* > of the bit locations in the image, and the file's bits are stored in > the permuted order. Will this be reversible? Will a plain-text header be neccessary for the intended recipient to how to reverse the function? > I'm not going to have ITAR problems with this, am I? RNGs are still > legal to export? Haven't you heard? Everything mathematical is under restriction now! ;) Sergey

1 0

Internet World article on Clipper
by Mike Godwin 17 Dec '03

17 Dec '03

A Chip Over My Shoulder: The Problems With Clipper Column for July 1994 issue of Internet World By Mike Godwin "Only in a police state is the job of a policeman easy." --Orson Welles Your government is deeply troubled by the possibility that you can keep a secret. Or, to put it more precisely, the government is disturbed by the prospect of widespread powerful encryption tools in individual hands. Once you can keep your communications and data truly secret, officials worry, the value of wiretapping, an important law-enforcement and intelligence tool, will evaporate. It's unclear whether the government's arguments are valid. But regardless of whether they are, the government's latest efforts to prevent us from adopting powerful and uncrackable encryption technologies raise serious questions about personal liberty, the role of government, and the possibility of privacy in the 21st century. If you're not already familiar with these efforts, here's an update. The Clinton Administration has embarked on an ambitious plan to prevent a mass market for uncrackable encryption from arising. The first step in this plan has already been announced: the Administration has called for the entire federal government to adopt the Clipper Chip--an encryption standard with a "back door"--for communications and data security. In addition, the government has declared its intention to use every legal method short of outright prohibition to discourage alternative forms of encryption technology. "Just what is this Clipper Chip?" you may be wondering. The short answer is: the chip is an encryption device, developed to National Security Agency specs, that keeps your communications and data secret from everyone ... except the government. To understand how the chip works, you need to look at what officials call its "key escrow encryption method." Manufactured by a private company called Mykotronix, the chip uses an NSA-developed algorithm called "Skipjack, " which, by all accounts so far, is a remarkably powerful algorithm. But the chip also includes the "feature" that its primary encryption key can be divided up mathematically into two "partial keys." The government proposes that each partial key be held by a separate government agency--the Administration has picked the Department of the Treasury and the National Institute of Standards and Technology (NIST)--from which the keys can be retrieved when government officials obtain a wiretap order. The NSA and the FBI love this idea. With the Clipper Chip in your phone or computer, they believe, you have the power to keep your information private from crooks and industrial spies and anyone else who wants to pry--except of course for law enforcement and the NSA. Law enforcement and intelligence agencies would be barred from seeking those escrowed keys in the absence of legal authorization, normally a court order. "And of course you needn't worry about us," say government officials. "We're here to protect you." Chips Off the New Block The current initiative has been a long time coming. It was in April of last year the Clinton Administration first announced Clipper--the announcement was met with a public outcry from civil-liberties and industry groups. Civil libertarians were concerned about the government's insistence on its need to prevent citizens from having access to truly unbreachable privacy technologies. Computer and telecom industry leaders worried about a standard that might crush a potentially vital market in such technologies. At first the Administration expressed a willingness to listen. The Digital Privacy and Security Working Group, a coalition of industry and public-interest organizations headed by the Electronic Frontier Foundation, outlined its objections and expressed the hope of engaging in talks with the Administration about the issue. In early February of this year, however, the Clinton Administration and various agencies announced to the world that, in spite of the grave misgivings of civil-liberties and industry groups, it would be proposing the Clipper Chip's encryption scheme as a new Federal Information Processing Standard (FIPS). The standard, stresses the government, will be entirely "voluntary"--but the government plans to use export-control laws and other methods to frustrate the market for any competitive form of encryption technology. Current export-control laws restrict the sales in foreign controls of encryption hardware and software. The laws have not been entirely effective in keeping commercial encryption technologies out of foreign hands--it's possible these days to buy encryption products in Moscow, for example. But the laws do succeed in deterring the American software industry from developing powerful and easy-to-use encryption products, since any company that does so is denied the right to sell the product on the global market. Still, if Clipper is voluntary, you may ask, what does it matter to *individuals *what standard the government adopts? The government also adopted the ADA programming language, after all, yet there are still people programming in all sorts of languages, from BASIC to C++. The answer is simple--"freedom of choice" is meaningful only if there are real choices. The government's export-control strategy is designed to make sure that there aren't any choices. If commercial software companies aren't allowed to sell encryption to the world market, they're unlikely to develop strong, easy-to-use alternatives to Clipper. And that means individuals won't have access to alternatives. Now, it's perfectly possible, in theory, to thwart the government-approved Clipper scheme by using a non-commercial encryption application, such as PGP, to pre-encrypt your messages before sending them through Clipper-equipped devices. But PGP and other products, because of their slowness or difficulty, are never likely to expand beyond the circle of hobbyists that enthusiastically support them. For encryption products to give rise to a genuine consumer market, they have to be quick and almost transparently easy to use. The government knows this, which is why their focus is on nipping (clipping?) the commercial encryption software market in the bud. It's the commercial market that really matters. The government's side When asked to substantiate the need for Clipper, or the threat of unbreakable encryption, the government often talks about crime prevention. As a practical matter, however, wiretaps are almost always used *after* crimes are committed--to gather evidence about the individuals the government already suspects to have been involved in a crime. So, the hypothetical cases involving nuclear terrorism or murder-kidnappings aren't really convincing--it's the rare case in which a wiretap prevents a crime from occurring. As a practical matter, the single most important asset to law enforcement is not wiretaps but informants. And nothing about unbreakable encryption poses the risk that informants are going to disappear. One of the more rational statements of the government's case for Clipper comes from my friend Trotter Hardy, a law professor at William and Mary, who writes: "The government's argument, I take it, is that the benefit is law enforcement. That strikes me as at least as great a benefit as minimum wage laws; perhaps more, since it protects everybody (at least in theory), whereas [minimum] wage laws primarily benefit their recipients. Maybe EPA regs are the better analogy: everybody gets reduced pollution; with Clipper, everybody gets reduced criminal activity. Is that not a reasonable trade-off?" But the problem is that the government refuses to be forthcoming as to what kind of trade-off we're talking about. According to government statistics, there are fewer than 1000 state and federal law-enforcement wiretaps per year, and only of a minority of these wiretaps leads to convictions. Yet we are being asked to abandon the chance for true privacy and to risk billions of dollars in trade losses when there has never been shown to be any crime associated with uncrackable encryption whatsoever. And we're also being asked to believe that the kind of criminals who are smart enough to use encryption are dumb enough to choose the one kind of encryption that the government is guaranteed to be able to crack. Moreover, there are fundamental political issues at stake. This country was founded on a principle of restraints on government. A system in which the privacy of our communications is contingent on the good faith of the government, which holds all the encryption keys, flies in the face of what we have been taught to believe about the structure of government and the importance of individual liberty. In short, the government fails to make its case in two separate ways--pragmatically and philosophically. Trotter goes on to write: ".... I don't think the government cares whether an accountant in India can password protect a spreadsheet. I would guess that even Clipper or DES [the government's current Digital Encryption Standard] or whatever would be more than enough protection for such a person. I think the government cares that it be able to detect foreign intelligence that is relevant to US security or interests. I am not sure where I come out on the question, but at the very least it seems to me that the government is reasonable in this desire." Yet there are some premises here that need to be questioned. Do we really suppose that "foreign intelligence" is dependent on the American software industry to develop its encryption tools? Diffie-Helman public-key encryption and DES are already available worldwide, yet Microsoft can't export software that contains either form of encryption. No, the real issue is that, to the extent that a mass market arises for encryption products, it makes the NSA's job more difficult, and it may at some future time make some investigations more difficult as well. When asked to quantify the problem, however, the government invariably begs off. Instead, government spokespeople say, "Well, how would you feel if there were a murder-kidnapping that we couldn't solve because of encryption?" To which my answer is, "Well, I'd feel about the same way that I'd feel if there were a murder-kidnapping that couldn't be solved because of the privilege against self-incrimination." Which is to say, I understand that limits on government power entail a loss in efficiency of law-enforcement investigations and intelligence-agency operations. Nevertheless, there is a fundamental choice we have to make about what kind of society we want to live in. Open societies, and societies that allow individual privacy, are *less safe*. But we have been taught to value liberty more highly than safety, and I think that's a lesson well-learned. What's more, we need to be able to engage in rational risk assessment, and that's something that the government resists. Instead, the government subscribes to the reasoning of Pascal's Wager. Pascal, you may recall, argued that the rational man is a Christian, even if the chances that Christianity is true are small. His reasoning is quasi-mathematical--even if the chances of Christianity's truth are small, the consequences of choosing not to be a Christian are (if that choice is incorrect) infinitely terrible. Eternal torment, demons, flames, the whole works. This is precisely the way that the government talks about nuclear terrorism and murder-kidnappings. When asked what the probability is of a) a nuclear terrorist, who b) decides to use encryption, and c) manages otherwise to thwart counterterrorist efforts, they'll answer "What does it matter what the probability is? Even one case is too much to risk!" But we can't live in a society that defines its approach to civil liberties in terms of infinitely bad but low-probability events. Open societies are risky. Individual freedom and privacy are risky. If we are to make a mature commitment to an open society, we have to acknowledge those risks up front, and reaffirm our willingness to endure them. We face a choice now. After a century of technological development that has eroded our ability to keep our personal lives private, we finally possess, thanks to cheap computing power and advances in cryptography, the ability to take privacy into our own hands and make our own decisions about how much, and how well, to protect it. This prospect is frightening to a government that has come to rely on its ability to reach into our private lives when it sees the need to do so. But I have faith that our society is not dependent on our government's right to mandate disclosure of our personal records and private communications--that a mature society can tolerate a large degree of personal privacy and autonomy. It's a faith I hope you share.

1 0

Re: Need info on Encyption book
by lefty＠apple.com 17 Dec '03

17 Dec '03

>Has anyone heard of this book [_Top_Secret_ - Data Encryption Techniques] and >is it with the $19.95 that they want for it? Only if you have a pressing and immediate need for a doorstop, or need special help solving the "Cryptoquotes" in your local paper. Based on my inspection of a copy at a local bookstore, it's utter and complete rubbish. Spend the extra thirty bucks and get a copy of Bruce Schneier's book _Applied Cryptography_ instead. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Dorthy Denning
by a2＠ah.com 17 Dec '03

17 Dec '03

Robert Cain writes: > exist and that liklihood is very small. Persuasion is not working and > the press has been whipped into a near hysterical state over this by we > and our friends (yes, we on the internet are considered to be the force > that has derailed their hopes and that was unforseen.) > How did it happen that "we on the internet" was an unforseen force? The first answer is obvious: they didn't realize that cohesive action would arise out of the internet. The second is not so obvous, but illuminates part of the Clipper strategy: The Clipper promoters assumed the the issue to be beyond most citizen's technical horizo. However, the unexpected thing which happened was that the initial few who did understand rapidly interneted the information to others.i Without the internet, the information, and opposition, would have spread more slowly. Cain observes that Denning and friends are afraid of the *unknown* that will come out of the new communications technologies. The reaction to Clipper, and how developed, should convince them they are right. -a2

1 0

D.Denning Reply
by bsteve＠zontar.attmail.com 17 Dec '03

17 Dec '03

Here is Dorothy Denning's reply to my response to her Newsday article. The shocking features are that she does not seem able to differentiate legality from morality, and doesn't seem to believe that law should flow from a popular majority, but from the state. Sure sounds like she wants a police state to me. Steve Blasingame bsteve(a)zontar.com -------------------- From daemon Mon Feb 28 09:06:58 1994 Date: Mon Feb 28 11:25:34 -0500 1994 From: netcomsv!chair.cosc.georgetown.edu!denning Subject: Re: Newsday Editorial To: internet!attmail!zontar!bsteve Reply-To: netcomsv!chair.cosc.georgetown.edu!denning (Dorothy Denning) Thanks for your comments. I have tried to address the law enforcement issues you raised in a more thoughtful way in the attached. Dorothy Denning --------------- Encryption and Law Enforcement Dorothy E. Denning Georgetown University February 21, 1994 Summary Although encryption can protect information from illegal access, it can also interfere with the lawful interception of communications by government officials. The goal of this report is to describe the effect of encryption technology and the government's new Escrowed Encryption Standard [EES] on law enforcement, mainly from the perspective of law enforcement. The information presented here was obtained from public documents and testimonials by law enforcement officials, from private conversations with people in the FBI and other law enforcement agencies, and from comments I received by people in law enforcement on an earlier version of this report. Some of this research was performed in conjunction with my earlier study of the FBI's proposal on Digital Telephony [DT, Denning]. The following summarizes the key points, which are discussed in greater depth in the sections that follow: 1. The need for wiretaps: Court-authorized interception of communications is essential for preventing and solving many serious and often violent crimes. Electronic surveillance not only provides information that often cannot be obtained by other means, but it yields evidence that is considerably more reliable and probative than that obtained by most other methods of investigation. No other investigative method can take its place. 2. The threat of encryption to lawful surveillance: Because encryption can make communications immune from lawful interception, it threatens a key law enforcement tool. The proliferation of high quality, portable, easy-to-use, and affordable encryption could be harmful to society if law enforcement does not have the means to decrypt lawfully intercepted communications. Although encryption of stored files is also of concern, 99% of the issue is telephone communications (voice, fax, and data). 3. Digital Telephony: Encryption is not the only threat to lawful electronic surveillance. Advances in telecommunications also threaten the ability of law enforcement to conduct authorized interceptions. 4. Encryption policy and the EES: The government's Escrowed Encryption Standard offers a balanced solution to the encryption problem that takes into account the equities of public safety, effective law enforcement, and national security along with those of privacy, security, and industry success. The technology and accompanying procedures provide strong encryption and a high level of security, while accommodating the need for real-time or near real-time decryption of intercepted communications. The program is the best known solution, at least for the intended initial application, mainly voice, fax, and data encryption over the public switched network. 5. Criminal use of Non-EES Encryption: Although some criminals may seek to use other forms of encryption, the escrowed encryption standard may succeed and become ubiquitous as the chief form of encryption, making it much harder for criminals to evade interceptions by using non-standard, non-interoperable encryption. 6. International problem: The impact of encryption on law enforcement is an international problem. The U.S. government exercised strong leadership by recognizing the problem and developing a solution before it becomes serious. 1. The Need for Wiretaps Law enforcement views court-authorized interception of communications as essential for preventing and solving many serious and often violent crimes, including terrorism, organized crime, drugs, kidnaping, major white collar crime brought against the government, and political corruption [DT, DT Cases, Kallstrom]. In testimony before the Computer Systems Security and Privacy Board, James Kallstrom, former Chief of the FBI's Engineering Section, estimated that wiretaps are used in excess of 90% of all cases involving terrorism, often with the result of preventing a terrorist act. For example, in a Chicago case code-named RUKBOM, the FBI successfully prevented the El Rukn street gang, which was acting on behalf of the Libyan government, from shooting down a commercial airliner using a stolen military weapons system [Kallstrom, DT Cases]. Examples of other terrorist attacks successfully prevented with the help of electronic surveillance include the bombing of a foreign consulate in the U.S. and a rocket attack against a U.S. ally. Electronic surveillance is used against organized crime, widespread fraud, bribery, and extortion. It was used to help solve a case involving corruption associated with organized crime control of the International Longshoremen's Union, which cost the citizens of New York city 10-12 cents on every dollar spent on consumer items coming through the port of New York, and to help solve another case involving organized crime control over the construction trade of New York City, which had led to 3-5% of all construction contracts being escalated by that percentage [Kallstrom]. Evidence obtained from electronic surveillance in a case involving the Concrete and Cement Workers Union prevented an economic loss to the public of $585 million [DT Cases]. According to the FBI, the hierarchy of La Cosa Nostra has been neutralized or destabilized through the use of electronic surveillance, and thirty odd years of successes would be reversed if the ability to conduct court-authorized electronic surveillance was lost. Almost two thirds of all court orders for electronic surveillance are used to fight the war on drugs, and electronic surveillance has been critical in identifying and then dismantling major drug trafficking organizations. In an operation code named "PIZZA CONNECTION," an FBI international investigation into the importation and distribution of $1.6 billion worth of heroin by the Sicilian Mafia and La Cosa Nostra resulted in the indictment of 57 high-level drug traffickers in the U.S. and 5 in Italy [DT Cases]. The FBI estimates that the war on drugs and its continuing legacy of violent street crime would be substantially, if not totally, lost if law enforcement were to lose its capability for electronic surveillance. Wiretaps are used for cases involving murders and kidnapings. As the result of wiretaps, sufficient evidence was obtained to arrest and convict a serial-murderer who had been operating for three to four years, and to locate and subsequently convict two other persons who had been involved with the murders [DT Cases]. By intercepting voice, fax, and communications on a local bulletin board system, the FBI prevented the proposed kidnaping and murder of a young child for the purpose of making a "snuff murder" film [Kallstrom]. Through wiretaps, the FBI prevented a group from bombing a man's house and killing him and his family [Kallstrom]. Electronic surveillance has been used to investigate aggravated governmental fraud and corruption. A recent military-procurement fraud case ("Ill-Wind") involving persons in the Department of Defense and defense contractors has so far led to 64 convictions and about $260 million in fines, restitutions, and recoveries ordered. In another case, U.S.District Court Judge Robert Collins was convicted of soliciting and accepting bribes [DT Cases]. John Kaye, Prosecutor for Monmouth County, New Jersey, reported that almost every police officer indicted in his county has been indicted because of a wiretap [Kaye]. In the decade from 1982 to 1991, state and federal agencies were granted 7,467 court orders for interceptions under Title III of the Omnibus Crime Control and Safe Streets Act and equivalent state statutes. At the end of 1991, these had led to 35,851 arrests and 19,259 convictions. Convictions resulting from interceptions conducted in the last few years are still accumulating, as trials regarding those subjects are held. Because the number of arrests associated with wiretaps is a small fraction of all arrests each year, some people have questioned whether wiretaps are necessary or worthwhile given the availability of other investigative techniques. By law, wiretapping cannot be used if other methods of investigation could reasonably be used instead. Such normal investigative methods usually include visual surveillance, interviewing subjects, the use of informers, telephone record analysis, and Dialed Number Recorders (DNRs). However, these techniques often have limited impact on an investigation. Continuous surveillance by police can create suspicion and therefore be hazardous; further, it cannot disclose the contents of telephone conversations. Questioning identified suspects or executing search warrants at their residence can substantially jeopardize an investigation before the full scope of the operation is revealed, and information can be lost through interpretation. Informants are useful and sought out by police, but the information they provide does not always reveal all of the players or the extent of an operation, and great care must be taken to ensure that the informants are protected. Moreover, because informants are often criminals themselves, they may not be believed in court. Telephone record analysis and DNRs are helpful, but do not reveal the contents of conversations or the identities of parties. Other methods of investigation that may be tried include undercover operations and stings. But while effective in some cases, undercover operations are difficult and dangerous, and stings do not always work. Law enforcers claim that no other method can take the place of wiretaps [Kallstrom]. Each court order must provide evidence for the need to wiretap by demonstrating that normal investigative procedures have been tried and have failed or reasonably appear unlikely to succeed or would be too dangerous [USC 18, DDKM]. This does not mean that the other methods are not used in those cases, as indeed they are, but only that they are inadequate to successfully investigate and prosecute the cases. Wiretaps not only provide information that cannot be obtained by other means, but yield evidence that is considerably more reliable and probative than that obtained by most other methods of investigation. A wiretap is also less dangerous than sending in a civilian informant or undercover agent who is wired since the risk of discovery puts that person's life in jeopardy. Finally, a wiretap may be less invasive of privacy than placing a bug in a subject's home or using an undercover agent to establish an intimate relationship with the subject. Although the number of arrests from wiretaps is relatively small compared to the total of all arrests, those criminals that are arrested and convicted with the aid of wiretaps are often the leaders of major organized crime, drug trafficking, and terrorist groups. In reviewing a proposal for a wiretap, law enforcement agencies determine whether the subjects of the proposed interception are worthy targets of investigation and whether the interception is worth doing. The law enforcement community views electronic surveillance as essential to effective law enforcement, and law enforcement as essential not only to public safety and our economic well-being, but to a free society. In his remarks at the Computer Ethics Conference, Alan McDonald of the FBI summed it up: "We have been fortunate as a society to enjoy unparalleled freedom. It has resulted because we live under a compact of ordered liberty. One need only consider the number of countries where law enforcement is ineffective and where the violence and corruption of organized crime reign to see true diminishments of freedom, liberty, and personal privacy" [McDonald]. 2. The Threat of Encryption to Lawful Surveillance Encryption has been available to criminals for a long time. Until recently, however, voice encryptors were extremely bulky and the quality of the voice low, so criminals who tried encryption would typically cease using it [Kallstrom]. But recent advances in encryption technology are leading to products such as the AT&T 3600 Telephone Security Device that are small, portable, easy-to-use, affordable, and have high quality audio. Law enforcers expect that criminals will flock to such devices, not only to hide their communications from the government, but to safeguard them from their competitors [Kallstrom, Meeks]. The effect could be that criminals are able to make their communications immune from government search and seizure even under probable cause of criminal activity. The proliferation of such encryption products ultimately could be harmful to society if government officials do not have the means to decrypt lawfully intercepted communications, at least in most cases. On behalf of the National District Attorney's Association, President Robert Macy writes: "In an increasingly dangerous world, law enforcement cannot afford to be blindfolded by advanced technologies including encryption devices" [Macy]. Roy Kime, Legislative Counsel for the International Association of Chiefs of Police, makes the analogy that people in law enforcement are being "outgunned" by the criminals with respect to advances in technology [Kime]. In testimony before Congress, Donald Delaney, Senior Investigator with the New York State Police, said he believed that if we adopted an encryption standard that did not permit lawful intercepts, we would have havoc in the United States [Delaney]. Although there are no "dead bodies" as yet, Kallstrom believes there will be a "horror show" if the encryption that proliferates in the market does not factor in an equity for law enforcement [Kallstrom]. Criminals can use encryption to conceal stored information as well as communications. In a child pornography case on the West coast, encrypted data files have slowed down the investigation of a large international ring dealing with child pornography and the possible smuggling of children [Kallstrom]. However, although law enforcement is concerned about the use of encryption to conceal computer files, their primary concern is with communications, particularly telephone conversations. This is because intercepts play a much more important role in investigations than documents. Real-time intercepts pick up the criminal dialogue, the plotting and planning that glues crimes together. By revealing conversations about possible future activities, wiretaps also may be used to prevent crimes from occurring. Thus, while being able to decrypt files is valuable, 99% of the issue today is telephone conversations [Kallstrom]. In addition, while communications over high speed computer networks are expected to become an issue, the primary concern today is with voice, fax, and data over the public switched network (telephone system). 3. Digital Telephony Encryption is not law enforcement's only concern about wiretaps. They are also concerned about changes in telecommunications technologies. Many of the new digital-based technologies and services such as ISDN, fiber optic transmissions, and the increasing number of mobile telecommunication networks and architectures cannot be tapped using the traditional methods used to intercept analogue voice communications carried over copper wire. In addition, increases in transmission speed have made interceptions more difficult. Although it is technically feasible to intercept the new communications, not all systems have been designed or equipped to meet the intercept requirements of law enforcement. According to the FBI, numerous court orders have not been sought, executed, or fully carried out because of technological problems. To address these problems, the Department of Justice proposed Digital Telephony legislation [DT] that would require service providers and operators to meet their statutory assistance requirements by maintaining the capability to intercept particular communications. So far, the proposal has not been introduced in Congress. 4. Encryption Policy and the EES Law enforcement seeks an encryption policy that takes into account the equities of public safety, effective law enforcement, and national security along with those of privacy, security, and industry success [Kallstrom]. They support the use of encryption by law abiding citizens and organizations to protect sensitive information, and recognize the importance of encryption to safeguarding information assets [Settle]. They generally favor strong encryption over weak or "dumbed down" encryption [Kallstrom]. To implement lawful interceptions of encrypted communications, they need a real-time or near real-time decryption capability in order to keep up with the traffic and prevent potential acts of violence. Since there can be hundreds of calls a day on a tapped line, any solution that imposes a high overhead per call is impractical. These requirements for strong encryption and near real-time decryption led to the Escrowed Encryption Standard [EES] and its related key escrow system. Upon receiving a chip's unique key components from the two escrow agents, law enforcers can readily decrypt all conversations encrypted with the chip until the wiretap terminates, at which time all chip-related keys are destroyed. The escrow agents need not get involved in the decryption of each conversation, which would be overly cumbersome. Law enforcers consider the EES to be the best known approach for addressing the dual need for secure communications and court-ordered access, at least for the intended initial application, namely voice, fax, and data encryption of telephone communications transmitted over the public switched network. The EES will significantly enhance communications security by making strong encryption available in a way that makes illegal wiretaps virtually impossible, while permitting those that are lawfully authorized. The key escrow mechanisms and procedures are being designed to provide a high level of protection for keys and to protect against compromises or abuses of keys, thereby assuring that no person or entity, including government, can improperly access one's EES communications. Although there is no evidence of widespread abuse of wiretaps by law enforcement officials, the EES will effectively thwart any potential abuse, thereby providing greater protection from illegal government wiretaps than currently exists. The Presidential Decision Directive [PDD] on escrowed encryption is viewed as offering a balanced solution to the encryption problem that is consistent with basic tenets found in the Constitution and in the Bill of Rights, which does not grant an absolute right to privacy, but rather seeks to balance individual privacy with the need to protect society as a whole [McDonald]. William A. Bayse, Chief Scientist of the FBI, observed: "It is well recognized that Anglo-American law has historically balanced the personal privacy of the individual with the legitimate needs of Government. ... As can be seen from a review of the Fourth Amendment to the U.S. Constitution ..., an individual's privacy rights are not absolute, and they give way to more compelling Governmental rights when criminality is demonstrated or suspected." [Bayse]. Similarly, Alan McDonald noted "... the dictum of the Bill of Rights, and the Fourth Amendment in particular, is a balance between individual liberty and privacy and the legitimate need of Government to protect society as a whole -- a balance to prevent the tyranny of absolutist Government and the tyranny of lawlessness and anarchy. ... The electronic surveillance statutes, like the Fourth Amendment, are founded on the concept of balancing fundamental individual and governmental interests -- personal privacy and the public safety. ... Encryption technology creates no legal rights under our Constitution, the Fourth Amendment, or under our electronic surveillance statutes" [McDonald]. 5. Criminal Use of Non-EES Encryption Some people have argued that criminals will not use EES, but rather will use encryption methods that defeat law enforcement. While acknowledging that some criminals may use other means, law enforcers assume most vendors will not manufacture an encryption device unless they perceive a large, legal market [Kallstrom]. The hope is that the EES, or some other approach that takes into account the law enforcement equities, will proliferate in the legitimate encryption market in this country and become transparent, thereby cutting down on the availability and use of encryption that does not include the law enforcement equities [Kallstrom]. There is some evidence that through market forces and government purchasing power, the EES may become the de facto national standard for telephone encryption. When AT&T announced its 3600 Telephone Security Device in Fall 1992, the device used a DES chip for encryption, and did not include a capability for law enforcement access. Priced at $1200, it would have been attractive to criminals, and could have led to the promulgation of encryption technology that would have posed a major threat to law enforcement. However, when the government announced the key escrow initiative on April 16, 1993, AT&T simultaneously announced that the TSD would use instead the new Mykotronx MYK-78 chip, aka "Clipper", which uses the EES. The government ordered several thousand of the modified devices. Since EES products can be exported to most places, there is an additional incentive for vendors to incorporate the EES into their products rather than, say, the DES, which is subject to stricter export controls. However, there are other factors relating to the nature of the technology and to public acceptance that could interfere with widespread adoption of EES by vendors. Criminals need to talk with many people outside their circle in order to carry out their activities, for example to rent or purchase needed goods and services. To conduct those conversations, which may be incriminating, they will either need to use an encryption method identical to that used by the other parties or else forego encryption entirely. Assuming EES dominates in the legitimate market, criminals may prefer to use it over communicating in the clear since the EES will at least protect them from their competitors. Criminals are often sloppy in protecting their conversations from law enforcement, making incriminating statements over the phone while acknowledging their phones may be tapped. Even if criminals do not use the EES, the government's objective of making strong encryption available to the public in a way that is not harmful to society will be achieved. Criminals will not be able to take advantage of the strong algorithm to thwart law enforcement. Since it is extremely difficult to develop high quality, strong encryption products, law enforcement may be able to access many non-EES encrypted criminal communications. 6. An International Problem The impact of encryption on effective law enforcement is an international problem, and U.S. law enforcers have observed other countries looking at solutions based on "dumbing down" the encryption or on key escrow. The U.S. government exercised strong leadership by recognizing the problem and developing a solution before it became serious. While the U.S. solution will not necessarily provide an international solution, it as a starting point for solving a global problem. References [Bayse] Bayse, William A., Written statement presented at Part I of the Forum on Rights and Responsibilities of Participants in Networked Communities, panel on Privacy and Proprietary Interests, Computer Science and Telecommunications Board, National Research Council, October 1992. [Delaney] Delaney, Donald P., statement in "Hearings before the Subcommittee on Telecommunications and Finance of the Committee on Energy and Commerce, House of Representatives," June 9, 1993; Serial No. 103-53, pp. 163-164. [DDKM] Delaney, Donald P; Denning, Dorothy E.; Kaye, John; and McDonald, Alan R., "Wiretap Laws and Procedures: What Happens When the Government Taps a Line," September 23, 1993; available from Georgetown University, Department of Computer Science, Washington DC, or by anonymous ftp from cpsr.org as cpsr/privacy/communications/wiretap/ denning_wiretap_procedure.txt. [EES] "Escrowed Encryption Standard," Federal Information Processing Standard Publication (FIPS PUB) 185, National Institute for Standards and Technology, 1994. [Denning] Denning, D. E., "To Tap or Not to Tap," Comm. of the ACM, Vol. 36, No. 3, March 1993, pp. 25-35, 42-44. [DT] "Digital Telephony," U.S. Department of Justice, Federal Bureau of Investigation. [DT Cases] "Digital Telephony Case Examples," distributed with press packet for Presidential Decision Directive on "Public Encryption Management." [Kallstrom] Kallstrom, James K., Presentation at the Computer System Security and Privacy Advisory Board Meeting, National Institute of Standards and Technology, July 29, 1993. [Kaye] Kaye, John, Presentation at the Computer System Security and Privacy Advisory Board Meeting, National Institute of Standards and Technology, July 29, 1993. [Kime] Kime, Roy, Presentation at the Computer System Security and Privacy Advisory Board Meeting, National Institute of Standards and Technology, July 29, 1993. [Macy] Macy, Robert H., Letter submitted to the Computer System Security and Privacy Advisory Board on behalf of the National District Attorneys Association for June 2-4 Meeting, May 27, 1993. [McDonald] McDonald, Alan R., Written statement presented at 2nd National Computer Ethics Conference, April 29, 1993. [Meeks] Meeks, Bud, Presentation at the Computer System Security and Privacy Advisory Board Meeting, National Institute of Standards and Technology, July 29, 1993. [PDD] Presidential Decision Directive on "Public Encryption Management," and Statement by the Press Secretary, The White House, April 16, 1993. [Settle] Settle, James C., Presentation at INFOEXPO '93, Information Security and Virus Prevention Conference and Exhibition, National Computer Security Association, June 11, 1993. [USC 18] Title 18 USC, Sections 2510-2521. (These sections codify Title III of the Omnibus Crime Control and Safe Streets Act of 1968, as amended by the Electronic Communications Privacy Act of 1986.) ------------------------

1 0

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

about this meeting you all are having. once you have had the meeting will those of us that are un able to attend for one reason or another, be able to find out what went on??? ie a sort of points made at he meeting and other general info, in a post to this list. i would love to be there. but i don't have access to the irc. and my computer time is whenever i get the chance. thanks charles the monster maker

2 1

Clipper Radio Debate Tonigh
by Dave Banisar 17 Dec '03

17 Dec '03

Clipper Radio Debate Tonight Clipper Debate on CBS Radio Tonight The Clipper Chip will be debated on CBS National Radio on Thursday, March 3. Dorothy Denning, professor of computer science at Georgetown University, will argue is favor of the Clipper proposal Marc Rotenberg, CPSR Washington director, will argue against the Clipper proposal. The program will run on 150 CBS radio stations across the country between 8 pm and 9 pm EST. Internet users interested in more information about Clipper, should explore the CPSR Internet Library at CPSR.ORG. Clipper materials may be found at cpsr/privacy/crypto/clipper or by sending email to clipper-info(a)cpsr.org.

1 0

YA semi-novice question
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

Can someone please tell me how 3-way calling would work under Clipper (or other encrypted phone system)? That is, I'm Alan talking to Betty. During the conversation Clive calls me and I want to "add" him so that we have a 3-way conversation. How do the key/session exchanges happen? --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168 Page: 617-945-1842 na53607(a)anon.penet.fi We are Chaos Boys. We are coming to a paradigm near you.

2 1

Re: PC Expo, Mac World, Comdex, etc..
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

That internet guy who handed out the flyer was in NYC. at the last internet expo at Javitz. I don't know how much setting up a booth would cost, however, doing it that way is not as effective as simply handing out disks to every Joe Yuppie who goes out the door. People will visit whatever booths they are interested in. However someone handing out disks as to those who walk out is far more likely to get the disks accepted as they are freebies. Especially if the target is ignorant to crypto and Billary. :-) At some point he may try the hypertext thinggie, if it sparks some interest he may look and use the software. If he doesn't recycle the disks, he may pass them on to others... At some point some big cheeze will get his hands on it, and start worrying about how the WireTap act, Clipper and other issues may affect his company. (Don't forget to include a mention that we suspect that Clipper has other back doors beside the key-escrow and "Imagine how much damage a hacker who tripps over this back door can do to your COMPANY!!! The old FUD method...) Disks, in bulk are cheap and we can get them preformatted. I have (a long time ago) written a disk image duplicator program called DIM (BTW: I lost the sources to the most recent version, so I don't plan to update it anymore) but we can use it to mass duplicate disks. If we could get just four-five folks in every expo to chip in $20 do the duplication and distribution, we can have an effective awareness raising campaign.. MEI Microcenter sells preformatted (DOS) disks in bulk for $0.39 cents! Two $20 contributions can buy about 100 disks! That's quite a lot of people to wake up. The biggest problem is designing the software to be in the form of animation so it'll be watched. Plain text is nice too, but not everyone has the time to read. Most folks like TV and like to vegetate infornt of the TV. If we can have a self running animated demo of sorts (without having to install to the guys hard drive!) and still have enough room for neat stuff like PGP and SecureDrive and such, we have got it made. Another issue is printing flyers to go with the disks so we can get them interested in viewing/copying the disks. (Perhas include a program to duplicate the disks on the demo disk so that the DOS virgins can spread the disk...) Also, we need to have professional looking labels on the disks. I'd be weary of accepting a disk that has a cheap looking label. My 1st reaction would be "Is this a trojan???" Quality control and virus checking MUST be included in the package. Perhaps when the program 1st runs it can do a CRC of all the files on the disk to make sure that they have not been altered and tell the viewer of this... Once we have the collection of programs ready, I can ftp a disk image over to a few FTP sites so that other cypherpunks can join in on the fun. (Also a postscript file for the flyers and such...) 1st things 1st, I reccomend that Secure Drive 1.3x and PGP 2.3x and PGPShell are on the disk. Are there any other crypto packages that your average y yuppie, (possibly ODS virgin) would find useful? Remember that we need enough space on the disk to include clipper articles. We probably can't distribute the New York Times articles, so we'll have to write our own (and insert the FUD factor!!!) We need to write/use a freeware hypertext/hypermedia program to list, print, and extract those files. A small disk copy program can be included which would simply read in the whole disk, ask the viewer for a blank, formatted disk and write to it. We can use the user's hard drive for temp space (check the DOS TEMP variable 1st!) possibly XMS and EMS so that the user doesn't have to swap disks. Batch files are neat but may not always work right on every machine. Keep in mind that with the DOS wars we can't use any special features found in any DOS above 3.30 (DR DOS, IBM DOS, MS-DOS, etc.) We should use EGA/CGA for the demo, (check for EGA and use it!) and use highly compressed, or better yet vector images for the animation so that we don't fill up the disk quickly. We could use text mode graphics and ANSI like pictures, but we'd need our own display program as not all machines have ANSI installed, and we can't ask a DOS virgin to do that. We also don't want to modify the user's hard drive if we can help it as that would keep their fears down.

1 0

Having Meetings is the Most Important Issue
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

(I'm copying the main list as well, as I make some points about the general idea of having local gatherings. I suspect more detailed comments on the mechanics of arranging the meetings, establishing the links, etc., should best be kept on the cypherpunks-meeting-planners(a)ah.com list.) Thanks, Eric, for creating this sub-list. I don't plan to do most of my writing here, though. (Praise the stars.) I've been engaged in a dialog with Pat Farrell about planning the D.C. meeting, getting a place, etc. It sounds like the EFF venue may be the best solution. Let me very briefly make again some of the points I made to Pat and Eric: - having any meeting at all is much more important than whether it is linked partly or fully to the Bay Area meeting. Even if only 5 people show up, this is a start. (I agree that 5 people in attendance does not justify elaborate preparations, special conference rooms, etc. Hence, folks may want to rendezvous at a pizza place or similar. If attendance grows, you can then think of larger, better-connected places.) - most geographic areas are, for whatever reason, not having any meetings at all. This is really too bad, as the physical Cypherpunks meetings in Mountain View have really been important in "gluing together" many activities, and the 5 hours of discussions and debate amongst 20-40 people is very invigorating (few fall asleep, unusually). (If the Bay Area can draw as many as 50 people to a meeting--as our last two meetings have done--then I'm convinced the other major tech areas could draw at least 10 folks each. Maybe not at first, but maybe even than 10 as time goes on.) - the phone or MBONE or whatever link between the groups need not last for long...just long enough to establish a sense of connectivity and community and to discuss certain items of mutual interest. The last time we linked, last April, the main intersite link was for not much more than an hour, as I recall. (It worked well, with Derek Atkins, Mike Godwin, and others in Cambridge, and a bunch in the Northern Virginia area.) - even a brief call-in period would be nice. That is, we could allocate some time, say, 2 p.m. PST, for brief call-ins from folks who want to update the main group (Bay Area, by history and default) on what they're doing and get verbal feedback. Ten minutes per call, several calls perhaps. (Just an idea, perhaps for future meetings....just don't give Detweiler our number!) - regarding travel distances....I'm not too sympathetic. I drive 50 miles over dangerous mountain roads to get from Santa Cruz to the meeting site, Eric Hughes drives 40 miles from Berkeley, John Gilmore 40 miles from San Francisco, and others are as far away as Santa Rosa, about 60-70 miles north. And we do it each and every month! - so, I'm enthusiastic that finally the remote sites will begin to take off. Colorado seems already to be rolling along, and D.C. (which was planned by them to have a natural focus on lobbying and education of Congresscritters) may be reawakening from its slumber. - anybody heard anything from Austin lately? Cheers! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

re the use of clipper and other laws to imprison people for use of any code not the clipper.. why not just make jails everywhere and put everyone in one and then let out only those that are working for the gov't and other "good folks" and leave the rest of us in jail. if this happens. where i have no freedoms i'll just disappear. can't find me in the mountains and though i might spend my time in labs i have also spent time on lonely hill tops looking at nature and being away from it all free our lines, or someone else will enslave us charles the monster maker

1 0