December 2003 - cypherpunks-legacy

RSA chip spec dist. paused until tomorrow
by Lucky Green 17 Dec '03

17 Dec '03

Due to the overwhelming number of requests for the new RSA chip data sheets, I am moving from a fax to a web distribution. A fellow CP is currently scanning in the 28 page specs. We will post the URL tomorrow. If the chip and the RSA/DES ISA board (using the chip) currently in my possession work as well as I hope they do, either the company I work for or I will most likely distribute them. I have not yet received a request for the one loaner chip. Are there no hardware-hacking CPs in the SF Bay Area? That seems hard to believe. --Lucky

1 0

Re: Fear of Flying -- from HotWired
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 12 Sep 1996 12:03:18 -0700, Bill Frantz wrote: >>... former CIA director James Woolsey: responded with some seemingly >> gratuitous anti-Net >> rhetoric. Terrorists may use biological weapons like anthrax, he said. >> "Anthrax is colorless, odorless, and has a 90 percent lethality. One >> gram has 100 million lethal doses." Then Woolsey delivered the zinger: >> "The knowledge of how to make anthrax is widely available, including >> on the Internet." >Gee, biotech has come a long way. Now I can download the Anthrax DNA >sequence from the net and insert it in some carrier bacteria and start >making Anthrax bacteria. Neat! Now the bad news: the DNA replicator only works under Windows 95 and comes with buggy drivers! >Or did he mean I can chemically synthesize Anthrax toxin? Or did he mean I >can get information on culturing bacteria on the net, but must obtain a >sample of the bacteria from other sources? <sarcasm> I guess we need to ban all those "science" pages; after all, why would any non-terrorist want to learn about bacteria? </sarcasm> >BTW - My dictionary says that Anthrax is primarily an animal disease which >only occasionally infects humans. It sounds like a poor choice for bio-war >terror. Unfortunately, it can be very deadly. The idea here is that it rarely infects humans - in the normal course of events. If a determined biowarrior is trying to infect people, all bets are off. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

4 3

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Money Laundering Alert: August 1996 'Unauthorized' Banks Pose Laundering Threat They are subject to none of the recordkeeping or reporting requirements of the Bank Secrecy Act, receive no examinations from any banking regulator, and may be on your bank's currency transaction reporting exemption list. The Office of the Comptroller of the Currency refers to them as "entities that may be conducting banking operations in the U.S. without a license." Money launderers probably refer to them as dreams come true and, unless legitimate financial institutions are alert, can use them to place illicit proceeds into the financial system. They are "unauthorized" banks, and for the past five years the OCC has been disseminating advisories to legitimate U.S. banks - but not to consumers - in an effort to expose their existence and halt their illegal operations. These so-called "banks" offer a variety of banking services, often at lower fees and better interest rates than legitimate banks offer. What makes them different from a legitimate bank - and attractive to money launderers -- is that they are not licensed by any U.S. banking agency and thus do not have to meet regulatory standards. Because the OCC and other federal bank regulators are not investigative agencies, they can do little more than report these institutions to those who are. If the entities are found to be operating a bank without a license they can be prosecuted under the Glass-Steagell Act (Title 12, USC Sec. 378(a)(2)). Such prosecutions are rare. In one case in 1994, initiated by Federal Reserve Board examiners, the principals of Lombard Bank, Ltd., were charged with operating an unauthorized bank through a payable-through account at American Express Bank International in Miami. Lombard, which had been "licensed" in the South Pacific money laundering haven of Vanuatu, offered its Central American customers virtually full banking services in the U.S. through its PTA (MLA, Sep. 1994). Earlier this year, the OCC released a list of more than 50 "banks" known to be operating without authorization. OCC officials say the number grows steadily. Some of the "banks" say they are licensed by foreign countries or U.S. states to conduct banking business. Others, such as the Swiss Trade & Commerce Trust, Ltd., of Belize, continue to offer services in the U.S. despite edicts from foreign banking authorities to cease doing business. The unauthorized entities have a common trait. They usually have names that are similar to those of well-known legitimate institutions. The OCC list includes the Bank of England, a Washington, D.C., entity not associated with London's famous "old lady on Threadneedle Street" and Citicorp Financial Services, a Beverly Hills firm not associated with the better-known institution of that name. It also includes the First Bank of Internet, which heralds itself as the first bank in cyberspace. Through its periodic "special alerts," the OCC warns banks to "view with extreme caution any proposed transaction involving any of the listed entities." It makes no effort to educate members of the general public who unknowingly place their money and trust in those uninsured institutions. American Banker: Friday, August 30, 1996 Swift Near Alliance in Trade Document Automation By STEVEN MARJANOVIC Swift, the international banking telecommunications network, wants to play a bigger role in trade finance and the exchange of related documentation. Sources said the Brussels-based organization will soon take a position-- perhaps as early as its September board meeting-- on whether to work on trade automation in cooperation with another consortium, called Bolero. Such a move would involve an increase in nonbank participants on a bank-owned network that has approached such liberalization cautiously. Swift, formally the Society for Worldwide Interbank Financial Telecommunication, is used by 5,300 banks for exchanging messages in such areas as funds transfer, foreign exchange, and securities. The network averaged about 2.7 million messages a day in July, representing daily dollar volumes exceeding $2 trillion. Officials said Swift is nearing a decision to work with the Bolero Association, which is forming an electronic registry for the so-called "dematerializing" of trade documents. Swift could provide the "platform" for allowing banks and corporations to exchange such documentation as letters of credit and bills of lading. Bolero was formed in 1994 with funding from the European Commission, but has not formulated concrete operating plans. Its members include Citicorp, Barclays Bank PLC, and other multinational banks and corporations. Peter Scott, trade services market director at Swift, said it has been in discussions with London-based Bolero since December 1995 about joining forces to automate the exchange of trade documents. "Bankers are beginning to sense both the opportunities in those areas and the threats to them from an intermediary stepping in and potentially taking away the business," Mr. Scott said. Trade-document capability "is not a heavily utilized area within Swift at the present time," he said. The potential in automation is obvious to Bolero officials. At the New York Banktrade Conference recently, John McKessy, the association's North American representative, said the annual value of goods moved internationally approaches $4 trillion. He estimated current international trade requires some three billion documents to be issued and managed. The cost of dealing with paper alone eats up about 7% of the total value of those goods, as much as $280 billion, Mr. McKessy said. Bank revenues from issuing letters of credit last year were just over $1 billion, according to a soon-to-be-released survey by the U.S. Council on International Banking. Anthony K. Brown, senior vice president of trade services at MTB Bank, described trade transaction processing as "extremely cumbersome and tedious, prone to mistakes and delays (that) can be a hindrance to the completion of a transaction." MTB is a $400 million-asset merchant bank based in New York. About 80% of its $100 million in loans are trade-related. The paper-shuffling costs are not borne entirely by banks. Import/export companies, insurers, freight forwarders, and various government inspection agencies are also involved. "The question is whether Swift wants to do it," said Dan Taylor, president of the New York-based U.S. Council. "Swift is going to act fairly quickly on this," he added. Mr. Taylor said Swift officials will likely grapple once again with the political and philosophical issues of giving nonbanks more access to Swift, and to payment systems generally. In 1995, the network granted partial access to nonbanks after years of heated debate. "You always have this push and pull, where some banks would like Swift to do certain things" while others want the network to focus on the money transfer business, Mr. Taylor said. "If Bolero succeeds and Swift joins, I think it will move fairly rapidly, but I'm not sure that Bolero is going to be the only thing out there." He said Bolero might evolve using value-added networks - or intranets - like the IBM Global Network and General Electric Information Services Co., or perhaps even the Internet. Indeed, another member of Bolero, CSI Complex Systems Inc., New York, is apparently talking to several providers of private, value-added networks and may soon enter a contract with one. CSI letter-of-credit software leads the pack in banking, with about a 16% market share, Mr. Taylor said. The company recently formed a business unit called Electronic Documents International, which has developed an Internet-based system for initiating letters of credit. CSI spokesman George Capsis said the software, Import.com, creates "about 30 key documents involved in international trade." The Internet, enhanced with security features, may help the trade industry reduce paper-related costs, especially at smaller companies overseas. CSI managing director Andre Cardinale said customers need only to "dial into a bank's Internet server, pull up the Import.com application, and actually fill in the details to create a new letter of credit or an amendment to an existing one." While Bolero may find a place on the Internet or a GE-type network, Mr. Cardinale said the ultimate push may yet come from the banking industry working collectively through Swift. He said Swift opposition from nonbank constituencies that are concerned the telecommunications cooperative will be more sympathetic to banks when disputes arise. But "if Swift does it," he added, "it will bring banks into the universe far more - pardon the pun - swiftly." Crain's New York Business: August 26, 1996 Bloomberg to Detail Growth of Information Empire Michael Bloomberg made a name for himself on Wall Street with his trading acumen and mastery of the computer systems that were becoming crucial to success in the securities business. But no one suspected when he left Salomon Brothers in 1981 that in the next decade he would build the fastest-growing provider of financial information in the world. Mr. Bloomberg, whose company Bloomberg Financial Markets has estimated sales of $600 million, will be the keynote speaker at the fifth annual Crain's ''Growing a Business Expo,'' to be held this year on Thursday, Oct. 24. The event will take place at the New York Hilton & Towers from 8 a.m. to 1 p.m. It is presented by Citibank and co-sponsored by Con Edison and Empire Blue Cross and Blue Shield. Last year, more than 1,000 growing business owners and managers attended the expo, which provides information for companies operating in the city regarding potential suppliers, financial resources and government programs. The cost to attend the event is $45 and includes a continental breakfast. Individuals registering before Sept. 6 can bring a colleague for free. To register, call Flagg Management at (212) 286-0333. In addition to Mr. Bloomberg's speech, attendees will be able to attend seminars on financing and other help available from the city, financing techniques, energy cost savings programs and how to reduce health insurance costs. An expected 135 exhibitors will be offering products and services of use to growing companies. Crain's New York Business editors will discuss how a growing business can get coverage in Crain's and in other publications. The heart of Mr. Bloomberg's empire is a news gathering operation that sends information through 62,000 computer terminals installed on the desks of investment professionals around the nation. His company provides the latest financial news and sophisticated tools to analyze information. The company he has built is noted for its lack of bureaucracy despite its growth to 2,000 employees. Its hallmarks are hands-on leadership and an entrepreneurial atmosphere where employees receive perks such as free food. Mr. Bloomberg has extended his reach to include an all-news radio station in New York, WBBR; Bloomberg Personal TV; syndicated television shows; a monthly personal finance magazine; and a similar magazine for institutional investors. American Banker: Friday, September 6, 1996 America Online Opens a New Banking Channel By DREW CLARK Nineteen banks - national home banking stalwarts such as Citicorp and BankAmerica, plus a complement of less prominent regionals - have climbed onto the America Online bandwagon. Most already offer their customers several options for banking via personal computer and view America Online, with its six million subscribers, as a way to appeal to a broad cross-section of computer- literate consumers. Fourteen of the AOL banking partners will be delivering services through BankNow, a software package developed for the interactive network by Intuit Inc. The other five banks have opted to use their own software. One of them - Security First Network Bank, which operates entirely on the Internet - will invite AOL users in through their Web browsers. With its announcement this week, America Online Inc. takes its place among the many alternative "channels" for on-line banking. Many of the banks on AOL's list are simultaneously cooperating with other companies that are themselves competitors, such as Intuit and Microsoft Corp., suppliers of the Quicken and Money financial management software, respectively. Also crossing competitive lines, America Online said its subscribers will be able to bank from home with PC software from three suppliers other than Intuit: Checkfree Corp., Online Resources and Communications Corp., and Visa Interactive. "Everyone understands that there is competition in the home banking arena," said David Baird, general manager of the personal finance division at America Online, based in Dulles, Va. "To align ourselves with exclusively one company would be a mistake." Intuit can count on 14 initial bank users of BankNow. Spokesmen for the other three system vendors declined to say when they expect to have home banking products available for the AOL channel. Experts noted that AOL and Intuit could be a strong tandem, in that they dominate their respective businesses. Intuit's Quicken is the leading brand in personal finance software. The company claims more than 9 million active users and a market share of about 80%. America Online's subscriber base of six million is as big as those of its next two competitors, Compuserve and Prodigy, combined. The financial institutions currently offering BankNow are: American Express, Bank of Stockton (Calif.), Centura Banks Inc., Commerce Bank of Kansas City, Mo., Commercial Federal of Omaha, Compass Bank of Alabama, CoreStates Financial Corp., Crestar Financial Corp., First Chicago NBD Corp., Laredo (Tex.) National Bank, M&T Bank of Western New York, Marquette Bank of Minneapolis, Sanwa Bank California, and Union Bank of California. More plan to offer BankNow-based services through AOL later this year: BankAtlantic of Florida, Bank of Boston, First Hawaiian Bank, First Michigan Bank, Mellon Bank, Signet Bank, and U.S. Bank of Oregon. Unlike Quicken, BankNow software is available free to America Online subscribers. Banks' fees will vary. First National Bank of Chicago said it will charge $3.95 a month for on-line banking and $9.95 a month for other services that include bill payment. Centura Banks Inc. said it will offer on-line banking free, and charge $5.95 a month for bill payment. Intuit officials declined to disclose what its Intuit Services Corp. processing unit will charge to handle these transactions for banks. Some of Intuit's larger bank partners chose not to offer BankNow because they already promote their own PC banking programs. For example, Citicorp, First Union, and Wells Fargo each support Quicken, but passed on BankNow. Instead, they are paying a premium for a "button" on America Online's banking screen that will eventually link users to a proprietary home banking program. AP Online: Thursday, September 5, 1996 House Probes Money Laundering By ROB WELLS House Banking Committee members on Thursday urged a Treasury Department agency to step up its efforts to halt money laundering by Mexican drug lords. Rep. Spencer Bachus, R-Ala., urged the Financial Crimes Enforcement Network to put in place new regulations to plug a significant loophole that allows Mexico's drug dealers to place their ill-gotten profits back into the U.S. Bachus, chairman of the House Banking oversight subcommittee, said Congress gave authority to FinCen in 1994 to put in place new rules that would prevent drug dealers from using foreign bank drafts, a type of check, to evade currency reporting restrictions. ''That effort is long, long overdue,'' Bachus said. Rep. Henry Gonzalez, D-Texas, asked the agency to provide further details about suspected money laundering in his home town of San Antonio, particularly the source of a $3 billion cash surplus in the San Antonio Federal Reserve Bank. The issue arose as Bachus' panel began exploring the dramatic rise of narcotics traffic along the 2,000 mile long U.S.-Mexico border, and the ease with which drug dealers can ship their profits to the south. Money laundering refers to the practice by which drug dealers, mobsters and others funnel their illegal profits into the banking system through businesses or other means. Bachus said estimates of drug profits laundered through Mexico range from $6 billion to $30 billion per year. Stanely E. Morris, FinCen's director, defended his agency's record, saying a combination of new rules and tougher enforcement in the past decade has ''made it more difficult to launder money in the U.S.'' and increased the costs of money laundering. Morris' agency enforces the Bank Secrecy Act, a key weapon against money laundering. As for the new rules aimed at foreign bank drafts, Morris said the regulations are more difficult than first expected because such restrictions also could hinder legitimate commerce. He said the proposal would be released soon. FinCen is working on other fronts to combat money laundering, which includes a new computer system that tallies bank fraud to help regulators gain an early warning of money laundering. In addition, the Clinton Administration assisted Mexico in adopting new anti-money laundering rules earlier this year. And Treasury Secretary Robert Rubin convened a conference of 29 nations in December 1995 to focus on the money laundering problem. One committee member, Rep. Maxine Waters, D-Calif., addressed the political context of the hearings. Waters said she was suspicious that the Republican-led Congress was holding ''a rash of hearings this month ... on the subject of drugs just as Presidential candidate Dole tries to use the issue as part of his campaign strategy against President Clinton.'' Waters said if the GOP-led House ''is truly serious about the impact of drugs'' it should hold hearings about charges raised in a San Jose Mercury News investigative series last month concerning the role CIA-backed rebels in Nicaragua played in bringing crack cocaine and weapons to Los Angeles and other cities. Bachus told Waters the hearing wasn't motivated by politics and that he had personally been involved in anti-drug efforts prior to his election to Congress. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

The Near-Necessity of Health Insurance
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:49 PM 9/17/96, Simon Spero wrote: >I wouldn't be so proud of the US health care system; the actual quality >of care is really pretty awful, even with insurance. Even though the >NAtional Health Service in the uK is woefully underfunded, I've always >had much better treatment than I have from HMOs here; even seeing a >specialist privately, at home, with no insurance, is cheaper than getting >an X-Ray looked at by someone who once met a radiologist a cocktail >party. ... >There are ideological reasons that argue for rejecting such >compulsory schemes based on that element of coercion; it's hard to >make the case against purely on efficiency grounds. Personally, I have not been a patient in a hospital in my entire adult life. Nor have I seen a doctor, except for a mandatory college physical in 1970 and an insurance company physical in 1977. I just haven't broken any bones, had any serious illnesses, or felt the need to visit a doctor, an emergency room, or a walk-in clinic of any sort. I suppose I've been lucky. Also, I dislike hospitals and avoid doctors unless there seems to be a compelling need. So far, there has not been. And, no, I don't have any health insurance of any kind. However, I am thinking about getting some. Not so much because I'm getting older, but because I fear a new phenomenon: hospital emergency rooms refusing admittance of patients unless they can present the proper patient-unit ID card (showing one is enrolled in Blue Shield, Blue Cross, Kaiser, or whatever). My dentist's receptionist/bill handler already seems flustered that I am paying my dental bills with a check, rather than giving her my insurer's account number. I also learned from a "60 Minutes" report, since confirmed elsewhere, that large hospitals routinely negotiate large discounts with large insurers, e.g., Blue Shield, so that while the "list price" of a typical day in a hospital may be an exorbitant $1800 a day ($30 for an aspirin, $75 for the lights-out bed check, etc...it all adds up!), Blue Shield has negotiated a fee of less than a third of that.... In other words, the person who insures himself (through savings and investments) and who offers to pay for treatment out of his own funds, may be at a serious disadvantage. He pays the inflated rates for services, and may face delays in being admitted to a hospital. (This space reserved for Duncan and others to explain how one can offer to pay in Krugerrands and to negotiate with the hospital on the spot. Meaning no disrespect to Duncan, but I doubt it is this easy. The mind-set of hospitals seems to be that anyone without a valid patient-unit card is obviously a derelict and indigent. And while all hospitals are required to accept derelicts and indigents in suitable emergencies--not a law I agree with--it is not desirable that one be treated as a derelict and undesirable. I hope I am conscious enough to give the admitting staff my financial health information.) Anyway, I'm thinking of finally bowing to the inevitable and starting to fork out $200-300 a month for health care I am unlikely to routinely use. (Obviously the folks who use their insurance routinely, as one of my engineers once used to do (he'd take his kids to the hospital every time they sneezed), are being subsidized by those of us who avoid hospitals at all costs.) I'm not arguing for national health care, just noting that we effectively are getting it, between the "Poor People" having subsidized care and the "Rest of Us" in employer-funded or private health care plans. Cash is already dead at most hospitals. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

PGP in the workplace
by Rick Osborne 17 Dec '03

17 Dec '03

Here's one I figure you all would just love: Yesterday afternoon, I was told by some higher-level associates of mine (not Management level, mind you, just people higher on the food chain) that my use of PGP in the coporate environment was not appreciated and could result in my being looked upon *very* unfavorably by the managerial crowd. Without even delving into security reasons, I politely explained to them that due to my job (which has several crypto-related applications) I needed PGP to communicate with people and list-bots in the outside world (or they could gladly pay for my formal training). The just shook their heads and said "be careful, you've been noticed". I was then told to stop 'messing around' in my shell account. I asked what was meant by this, and apparently it had been noticed that I had done a few things, which I had done to simply check the security of my account, which could be viewed as 'inappropriate'. You know what they were? 1. I checked to see if the passwd file was available to anyone (was it shadowed, etc.). This was seen as an attempt to GET the passwd file, and thereby have access to sensitive data. 2. I change my password regularly (once a week). Now this may seem excessive (it apparently did to them), but you must understand that the entire IS department is extremely buddy-buddy here. Over half of the users have root passwords on any given system. I don't feel like sharing, horrible me. I guess my regular chaning of passwords was seen as a strain on the system (ha!), as they didn't elaborate *why* I had been flagged for this. Upon explaining to them that I was simply trying to make sure of my own security, I was told that I was to just assume that I was secure, and that *any* 'poking around' was found to be "highly aggravating" and could only only "exascerbate the situation further." Luckily, I had to get to class, so I cut the conversation before it could get any more out of control. Now, seeing as I'm fairly new to the Corporate world, but is this something common? I know when I was at college, poking around was expected and encouraged, as it helped find and plug holes in the system. But this is almost like some kind of protection racket here! ____________________________________________________________ Rick Osborne osborne(a)gateway.grumman.com "Yes, evil comes in many forms, whether it be a man-eating cow or Joseph Stalin, but you can't let the package hide the pudding! Evil is just plain bad! You don't cotton to it. You gotta smack it in the nose with the rolled-up newspaper of goodness! Bad dog! Bad dog!" - The Tick

3 2

RE: Workers Paradise. /Political rant.
by tob＠world.std.com 17 Dec '03

17 Dec '03

jbugden(a)smtplink.alis.ca writes: > I don't think that a reasonable person would argue that medical > insurance should be outlawed because everyone should take care of their > own needs. A social safety net is simply a form of health and life > insurance. Statistical arbitrage if you will. By spreading the risk you > minimize the cost. Yes, some people will take advantage of the system. > But like a virus, a robust system should be able to withstand this form > of attack. It's too bad you received such fingers-in-the-ears libertarian-scream responses to this. You deserved a better answer than that. Not that I entirely agree. Let me quote part of something I once wrote on essentially this topic: "With *real* insurance it's tough enough to root out fraud. How can an unwritten, virtual policy, knowable only through deduction, addressing our entire circumstances of birth, that the insured may deny contracting to or may disagree about what the terms were, be easy to sort out?" Tom

1 0

cypherpunk listserve usefulness
by Chip Mefford 17 Dec '03

17 Dec '03

As much as it shames me, I have recently discovered that by filtering messages from only 2 participants and setting body filters on 3 keywords have remarkably improved the usefulness of this listserve. As much as I do enjoy some of the filtered subject matter, I really feel it is very off subject and makes this listserver useless for the intended task. I guess that makes me a censor and it has me reexamining some things.

6 5

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Financial Times: Wednesday, September 4, 1996 IT: A Spider's Web for the Banking Sector Interview with Joseph De Feo By Paul Taylor The influence of network computing and other technologies extends into all aspects of the industry. Barclays' director of group operations and technology believes it will have a profound effect on traditional banking. 'It's going to change the whole way business is conducted,' he forecasts Joseph De Feo has built up a formidable reputation as an effective business leader and banking visionary since he joined Barclays Bank as director of group operations and technology nearly seven years ago. American-born Mr De Feo, who joined Barclays from merchant bankers Morgan Grenfell after spells with both Goldman Sachs, the Wall Street investment bank, and Chase Manhattan, the third-biggest US bank, is also widely regarded as one of the banking industry's most outspoken, and influential, IT users. He believes the main issue facing the banking industry is the impact of electronic delivery mechanisms and the changes which will be wrought by introducing electronic delivery to replace physical branch delivery in retail banking services. But although he believes changes in retail banking may be the most visible, he says the impact of the broader capability of networks and networking will be just as dramatic on the wholesale and investment banking business. "It is engendering a situation in which there will be a wholesale reconstruction of the value chains in the business model for the industry, where you could envision networks of specialist companies, each focused on a specific area - say research, analytics, trading, investment banking, distribution. . . "This sort of change has actually occurred in other industry sectors - the commodity end of the business is being concentrated into a smaller number of global producers, and the rest of the business is being fragmented among many thousands of very focused and specialised players." He believes that, faced with such challenges, banks will adopt different strategies. Some, such as JP Morgan in the US, will quit the "manufacturing" end of banking, and sub-contract out the processing. Others will specialise in transaction processing, in much the same way that National Westminster Bank is providing the back-office capability for supermarket chain Tesco's recently-launched loyalty card in Britain. Overall, he thinks the number of jobs in retail banking will fall as capital is substituted for labour. "I think the aggregate labour content in all aspects of the business will go down, but not at the same rate as it will in retail banking." In Britain, he warns, the adjustment will be disproportional, "because we hesitated on the capitalisation of the automation of the branch networks." Delaying automation of the traditional branch networks could also make it more difficult for the banks to respond to new and often lower-cost competitors, including retailers such as Marks and Spencer and Virgin which do not have the same infrastructure costs. In addition, he notes, it takes time to respond to new competition and new delivery channels. "You still have to support the branch network. The more inefficient that branch network is, the higher the burden of cost - so you are really stuck if you have huge costs." Unlike some of his colleagues, however, Mr De Feo does not believe that bank branch networks will disappear overnight. "When I first joined the group, lots of people were saying we need to cut the branch network in half in the long run. It was a real big issue - we were obsessed with the numbers of branches. I kept saying to them that you have to start on a more rational base and judge what is effective for the group to have as a physical branch distribution network." While he believes the bank's branch network is still costing a lot more, probably five or six times more, than it ought to, he argues that the decision on an individual outlet "could change very dramatically if the branch was much cheaper to keep open." "We have not closed nearly as many branches as people had originally thought we were going to, because the cost of us having an outlet open is much lower than many other banks," he says. Barclays has cut the cost of its branches "by reducing the labour content, by having more customer volume go though each branch, so that the effectiveness and efficiency of an outlet is improved." He notes that in the US, "if you count electronic branches, there are more branches opening - they are not closing branches. . . the individual cost of those locations is a fraction of what it is in this country." Even with the advent of electronic purses and smart cards, Mr De Feo believes there will still be a need for physical bank outlets. "We really need physical bits of paper in our hand to do business. . . so it is going to take a long time to get rid of the physical locations; probably 25-30 years." Ahead of that, he believes there could actually be an increase in bank outlets. "I would predict that you will see an increase in penetration in supermarkets of electronic branches, or [branches] where there is one person, in this country. "I think you will see more express branches like we have just put up in Tunbridge Wells, which will either be semi-manned or unmanned." He thinks these low cost "convenience branches" will be supplemented by telephone banking, or banking via a digital television or via personal computer. "We had better do it because we are going to struggle strategically to keep our branch identity, the way things are going," he says. "We have got strong branch identity in the industry, but that could be usurped very quickly, especially for the traditional products because we don't satisfy primary needs." Mr De Feo makes his point using a potential car buyer as an example. "If you need to borrow money for a car, it is not because you want to borrow money, it's because you want a car." If, as is beginning to happen, car manufacturers bundle in the financing, "why would you bother to go to a bank?" If the carmaker has a good credit rating, it can raise money cheaper than the banks - so it is sensible for the carmaker to arrange the finance because it can make an additional small profit on the loan. Like other large financial institutions, Barclays is a big IT spender. But does Mr De Feo think that the bank gets value for money? "I think that in Barclays we are now getting to the point where we are - and it shows in our results, and in the recognition we are getting, and the way in which the business attitude towards IT has changed. The level of suspicion that IT was sort of a thing that was on its own, and spending money because they wanted more toys, is dissipating. "If you look at the core businesses of the group, whether you are talking about BZW or the asset management business, we are now much more thoroughly integrated in terms of how technology is being used. We have still got a way to go because we are not on an appropriate strategic platform because the knowledge gap is still there and we need to understand better how these technologies are going to transform business. Sophisticated banking IT systems, such as those used in credit behaviour scoring, knowledge-based techniques and corporate lending assessment, are now commonplace. "IT has improved the quality of our lending, our decision-making, our communication with our customers, because it is clearly more objective. It is more explainable; it is not like I turned you down for a loan because I don't like the look of you." He believes the relationship between banks and the IT vendors has also changed. "It is a matter of choosing partners now," he says, "the functional differences are less significant in vendor selection than they used to be." Mr De Feo argues that one of the biggest challenges facing the financial services sector is ensuring that the wide variety of legacy systems work together. "That glue - how you get the network of these applications brought together - is extraordinarily important. Mr De Feo says that IT users need infrastructure standards which would allow different proprietary technologies to be brought together. "The Internet offers some of it but the Internet is weak in systems management and security. The most important aspect of the Internet is that it has given a glimmer of what is possible with network-based computing. "It is like a very weak light-bulb going on in an absolutely dark room, and what I worry about is that we will not be able to fulfil the promise because there are so many holes in the management and the security side of it. "We are OK now because it is being used as an information dissemination vehicle, and an e-mail vehicle, but when we start doing serious applications using that technology it's all going to bubble to the surface and we're going to see the same sort of problems with the Internet as enterprises are having in gluing together computer systems that were built on IBM or Digital Equipment technology." Eventually, Mr de Feo believes Microsoft will produce the "glue" to bind disparate systems together, but he cautions: "It is going to be very hard for Microsoft because it is going to push them into spaces they have never occupied before." Similarly, he believes that the real potential of network computing will only be realised if it enters the commercial sphere. He says: "That will only happen if the financial services element is solved. We have got to get all that sorted out, so all of this has got to be brought together at some point soon, otherwise things will go into a slowdown until they get resolved. "There are all sorts of initiatives to work on: the security, and work on the systems management, and so on. But the cohesiveness of those efforts is not apparent." Ultimately he believes network computing and other technologies will have a profound effect on traditional banking. "It's going to change the whole way business is conducted," he says. "The influences of all these technologies extends like a spider's web out into all aspects of the industry." Financial Times: Wednesday, September 4, 1996 Global Finance Sector Maintains Its IT Edge By Paul Taylor >From Internet banking and multimedia kiosks to electronic trading rooms and risk management systems, the future of the global financial services industry is inextricably linked to information technology. The financial services sector is already one of the biggest spenders on information technology -- spending made necessary not just to reduce costs, but also to maintain an edge in an increasingly competitive market where new entrants and new channels to market are eroding traditional boundaries. For example, in the insurance sector, Datamonitor, the market research firm, predicts that 95 per cent of the UK's largest insurance intermediaries will have direct operations by 1998. Datamonitor also believes that by 1998 some 70 per cent of insurance companies will have Internet sites. The intensification of competition within the financial services sector reflects the deregulation of the industry which has attracted new entrants. Other factors are globalisation and technology which have swept aside barriers to entry and lowered the cost of doing business. As a result, in order to thrive in the 1990s, financial service organisations are as much in the business of managing and manipulating information as managing and making money. "Our industry is information based - it is absolutely essential - and the relationship of technology management, technology usage and business management is one of the critical skills," says Joseph De Feo, director of group operations and technology at Barclays bank. "If people in financial services companies say they don't understand technology, or are afraid of technology, it is just like saying 'I am not qualified to do my job'," says Mr De Feo. The fate of many financial institutions, as they gear up to face this new competition, will depend on the successful deployment of data processing resources, telecommunications systems and software. "The financial services industry is faced with unprecedented challenges - increasing competition, a technology revolution, a highly unpredictable economic and political climate, consumerism and rapidly evolving legislation," said Andersen Consulting in a recent report*. John Reed, chairman of leading US commercial bank Citicorp, has expressed concern that banks and securities firms risk being reduced to "a line or two of application code on a network." Such concerns are understandable given the competitive pressures that banks and other financial institutions now face. "Financial services companies are trying to drive down or stabilise costs," says Ian Peackock, a consultant with Logica, the UK-based computer services group. "Another big area for them is systems integration." "When the banking history of this century is written, the decade from 1990 to 2000 will be seen as the defining moment," said Price Waterhouse in a recently published report on the challenge of virtual banking. "A new generation of non-bank competitors poised to harness new forms of technology could radically alter the structure of the traditional banking system as we know it. Today, opportunities are being exploited by software companies, consumer companies and even large and influential media owners. The threat to the traditional 'bricks and mortar' banking system is very real." In America, US telecoms group AT&T became the second-largest card issuer in the world with more than 15m accounts in just five years. Ford Motor, which now generates 20 per cent of its US revenues from financial services, now positions itself in the UK as "the branchless bank". Business Week magazine noted: "Banking is essential to a modern economy. Banks are not" -a view echoed by Bill Gates, chairman of Microsoft, who warned: "Banks are dinosaurs. Give me a piece of the transaction business and they are history." Meanwhile, the IT specialists at Deloitte & Touche argue that "Technology will change the retail banking industry fundamentally in the years to come." They believe that banks will lose their monopoly as centres for money transmission - in other words, the activity of transmitting money from one person or company to another will increasingly be carried out by a variety of competing providers. In addition, distribution channels for retail banking products will proliferate. "Whereas in the past the bank branch was the only channel for distributing most financial services products, in the future a number of different channels will continue to erode the branch's predominance," say Deloitte & Touche. Finally they argue that the fully integrated bank will fragment into specialist categories. Braxxon Technology, an IT management and systems consultancy, estimated recently that leading international banking institutions face a combined IT bill of $ 4bn to replace their existing global trading settlement systems for bonds and equities. After a survey of large banks, Braxxon concluded that the top 50 world investment banks would need a global investment of at least $ 80m each to replace existing settlement systems which have failed to keep pace with business and regulatory requirements. The survey also revealed that 30 per cent of banking systems are more than 10 years old - and three out of every five banks have already started replacing their systems. Financial institution spending on IT is also likely to be increased over the next few years in order to tackle issues such as the so-called millennium problem which affects older software, much of which is running on mainframe machines. Ultimately, as the worlds of information processing and financial services collide, most financial institutions realise that they have little choice but to increase their IT expenditure while ensuring that they use technology as efficiently as possible to deliver their customers fast, flexible and competitively priced services. *Financial Services in a Virtual World. Forbes ASAP: August 26, 1996 The Money Changers: Digital cash Innovators Sholem Rosen: Citibank V.P., Emerging Technologies SHOLOM ROSEN heads Citibank's emerging technologies group, which has devised a digital cash system. Rosen invented the technology, slated to be released in late 1998, that will make possible the electronic management of cash. The 55-year-old Rosen, a former math professor at Johns Hopkins University, talked with FORBES ASAP's Lee Patterson about Citibank's digital cash plan. ASAP: What has Citibank developed that's different from other electronic money technology? ROSEN: We've developed EMS, which stands for Electronic Monetary System. It allows you to transact personal or commercial business without the need of a third party. If you pay me $10 for a good or service, the money goes directly to me -- it doesn't go through a bank. EMS supports all currencies, so you could pay someone in yen, dollars or marks. In our system, the money circulates just like cash, except our "EMS note" carries a complete audit trail. If your e-money is lost or stolen, it can be redeemed. ASAP: Software companies are aggressively pursuing the electronic commerce and banking markets. How do you think Citibank's name will stand up to the likes of Microsoft or DigiCash? ROSEN: Citibank understands consumer marketing. Every card in my wallet has the Citibank brand name on it. You may not lie loyal to your bank yet, but the idea is to make you loyal by providing services that make your life a lot easier. If Microsoft or another software company wants to be a competitor, it's still going to have to sign up with banks to do business. Internet money is not going to be of any value if you can't turn it into real money you can use in the physical world. You have to go through the banking system to do that. ASAP: How did you feel a year ago when you heard the plans for a Microsoft/Intuit merger? ROSEN: Personally, I didn't think much of it at all. I believe banks are more concerned they'll be captive to what technology companies deliver to the consumer rather than having their businesses taken over. ASAP: But why will consumers come to Citibank for their technology needs when they can go to Microsoft or Intuit? ROSEN: Because Citibank has better technology. We give away our home banking software, and it's much more functional than anything you're going to pay to get from Intuit. Technology companies are definitely competition, but we have been approaching electronic money from an application standpoint and applying technology to it -- not the other way around. ASAP: Much of the focus of e-money technology centers on security. How secure is Citibank's system? ROSEN: Security has to be in the hardware, not the software. Our security is built into a proprietary chip we've developed. We're going to use cryptography that only national labs will be capable of breaking. I would let all the hackers in the world take their cracks at our system. ASAP: Will e-money replace the coin and papernote system we use today? ROSEN: We're not here to replace paper money. Our system will be valuable on the Net. Internet transactions are flaky now. We're trying to take the flakiness out of it. We want to give the user more of the feeling of trust and security experienced in the physical marketplace. ASAP: What's the federal government's role in electronic money? ROSEN: They're watching. They're letting people experiment. The official party line is "We're going to keep our hands off and our nose in." ASAP: Will digital cash make it easy to launder money or evade taxes offshore? ROSEN: It's true that with e-money, geography is gone. All the laws that have been created here and abroad have been based on geography. Two-thirds of our currency now is abroad. So what's the big deal if [e-money] moves abroad? With our system, the feds will have a lot more control over what's going on than they do with the present paper currency system. EMS notes will leave electronic audit trails, and their circulation can be blocked if the system detects that they've been tampered with or duplicated. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

American Banker: Tuesday, September 10, 1996 Two German Companies Tap U.S. Smart Card Market By VALERIE BLOCK Two German smart card manufacturers that have set their sights on the United States are finding the market big enough for two different strategic approaches. Gieseke & Devrient America Inc., subsidiary of a German currency printer, has become a major supplier of Visa Cash cards, firmly entrenching itself in the world of banking applications. Orga Card Systems Inc., whose German parent is owned by three corporations in that country, is going after the telecommunications industry here. In August, Orga secured a million-card minimum commitment from Omnipoint Corp. for the new digital mobile phone technology known as personal communication services. The deal, covering the New York area, could mean as many as three million cards over three years. Smart cards, with embedded computer chips, contain customer account information and would be used to activate the mobile phone. Orga inked a deal last fall with American Personal Communications, another provider of personal communications services, to supply smart cards for its Sprint Spectrum service in the Washington area. "We're big in telecommunications," said Holger Mackenthun, president of the U.S. Orga operation in Paoli, Pa. "That's where most of the (smart card) applications are." Benjamin Miller, chairman of CardTech/SecurTech, the Rockville, Md.- based conference organizer, called Orga a "major worldwide player" in global standard for mobile telecommunications, or GSM, the international version of the digital mobile phone network. Gieseke & Devrient, with a 150-year history of currency printing,"is tied culturally to the financial industry," said Joseph Schuler, senior vice president of Schlumberger, a leading French smart card company with operations here. Schlumberger and its home-country competitors, Gemplus and Bull Group, supply the lion's share of smart cards in the United States and around the world. Still, Mr. Schuler said the expansion of the U.S. market will create opportunities for all the manufacturers. In Supplying 800,000 cards to NationsBank for the Olympics Visa Cash pilot in Atlanta, Gieseke & Devrient established a firm alliance with Visa. It is vying to participate in the New York smart card test scheduled to begin early next year with Visa, MasterCard, Citicorp, and Chase Manhattan Corp. The German company also supplied card-dispensing machines to Wachovia Corp. for the Atlanta pilot and 5,000 Visa Cash cards for BankAmerica Corp.'s limited-edition Olympic series. R. Kirk Brafford, program manager, Gieseke & Devrient in Reston, Va., said since his hiring in 1994, he has laid groundwork, established relationships, and generally spread the word about the company. "Things started to kick in last fall with Visa Cash," he said. While profits have not yet materialized for U.S. operations, its German parent, Gieseke & Devrient GmbH posted $240 million in card revenues for 1995. Orga's German parent, Orga Kartensysteme GmbH, garnered $85 million in card revenues for 1995. Mr. Brafford said Gieseke & Devrient has been a global standard for mobile telecommunications pioneer in Germany and elsewhere. It competes for personal communication services applications as well as prepaid phone cards and other telecommunications applications, but it has been held back by a fastidious "quality orientation," said Mr. Miller. Over-the-air initialization for digital mobile communications had not been standardized, so Gieseke & Devrient didn't offer the feature that other companies, like Orga, promoted through proprietary means. Mr. Brafford said a standard was recently put in place, and the company will offer the feature soon. He also said the organization is working with several satellite communications companies to supply smart cards for their activation systems. Orga -- owned by Preussag, a giant German steel maker; Bundesdruckerei, a federal printing company comparable to the U.S. Mint; and Detecon, a consultancy owned by Deutsche Telekom, Deutsche Bank, and Dresdner Bank -- was formed 11 years ago as a smart card producer for global standard for mobile telecommunications and prepaid phone applications. It has been less aggressive in the financial services industry. Several industry sources said Preussag is dissatisfied with the company and wants to divest. Mr. Mackenthun said the steel maker may indeed sell its shares to the other two owners, to better concentrate on its core business. Orga also suffered a setback in its attempt to secure a card manufacturing base in the United States. It announced a joint venture last year with Kirk Plastic Co., which could have given Orga a U.S. presence similar to those of Gemplus or Schlumberger. That deal fell through, and last month Kirk Plastic, the second-largest bank card producer in the United States, was sold to Francois-Charles Oberthur, a French currency printer that co-owns a smart card operation with Bull Group. Kirk Hyde, president of Los Angeles-based Kirk Plastic, said Orga was stumbling in the banking arena, but other observers said financial differences split the companies. Though Orga supplied 20,000 reloadable, stored-value cards for MasterCard's Australian smart card pilot, the company is not bidding on the New York test. Mr. Mackenthun said that was because it cannot produce cards and personalize them here. Still, Mr. Mackenthun is optimistic that Orga will either purchase another plastics maker or set up personalizing facilities of its own in the near future. Gieseke & Devrient acquired Security Card Systems of Toronto earlier this year and has a plant in Mexico City. It expects to purchase a U.S. facility as well. Through its Toronto facility, it will manufacture cards for Mondex's Canadian issuers. InformationWeek: September 9, 1996 Wall Street Sharing Data To Get An Edge By Udayan Gupta If you listen to all the media stories about Wall Street and technology, you may come away convinced that preparing systems for the year 2000 is subsuming all other technology projects in the financial community. Nothing could be further from the truth. Sure, making the year 2000's two-zero datefields work is a nagging headache. But a bigger concern for Wall Street is how to keep pace with technology without tearing apart the whole organization. How does a company adopt the latest systems and software, train users, and still not miss a beat in its regular business? The choice for many financial services companies is to expand the use of and access to technology within the organization, focusing on connectivity and improved productivity. "We aren't slowing down on the introduction of technology. We simply are stepping up our technology training," says Howard Sorgen, CIO at Merrill Lynch & Co. in New York. Speed and data availability have been the key competitive elements for financial services companies. To gain an edge in these areas, companies have experimented with a wide array of technology. But such experimentation has takenplace with little internal coordination, leaving large financial institutions with disparate and confusing systems. Not surprisingly, financial services companies are consolidating their technology, says Jim Ogorchock, business development manager for financial services at EMC Co., a Hopkinton, Mass., data storage provider. Consolidation has meant finding ways to disseminate data and information across the enterprise and making data easier to use, he explains. There is greater emphasis on data warehousing, for example,and on finding ways to make data more accessible. ESI Securities Co., a New York broker that specializes in trading technology, is also looking for ways to make data more accessible to more people. "We have moved from being a linear information process to an integrated process," says Jeanne Murtaugh, ESI's vice chair. Instead of different people handling data at various points in the chain, one person can have access to all data at once, dramatically cutting the time it takes to act on the data. At many financial institutions, the focus is on expanding choice and connectivity, says Murtaugh. ESI has found that there is big demand for its trading products and services because they give users greater flexibility and are compatible with other systems. Not The Enemy Connectivity also is being sought through the Internet, says Matt de Ganon, president of K2 Systems, a New York Internet access designer. "Financial services companies are recognizing that the Net isn't an enemy competing to provide services. It's an additional conduit," de Ganon says. He adds that a growing number of financial services companies are willing to use the Internet to provide data to investors. The Internet is also seen as a transactional tool, one that allows data gathering and information dissemination at a more rapid and cost-efficient rate. Equifax Inc., for example, plans to make credit data available to its subscribers on the Net, providing easier access to the data at vastly reduced prices, says Dan McGlaughlin, president and chief technology officer of the Atlanta company. Equifax keeps credit information on nearly 200 million U.S. consumers. Acceptance of the Internet as an integral business tool is only part of the change at financial services companies. Many of them are abandoning proprietary software and hardware for more generic solutions, especially if those solutions provide the choices and connectivity that companies need. Technology users are searching for a common platform that can provide ready solutions and is easily scalable, says Jonathan Wolf, VP of marketing and sales for Track Data, a New York provider of market data systems. Increasingly, IT executives at financial services companies are looking at a Windows NT environment, Wolf says. Many of the companies that traditionally havehad Unix environments-such as First Boston and J.P. Morgan-are looking for greater connectivity. They are implementing off-the-shelf solutions instead of insisting on proprietary systems, Wolf adds. Nowhere is this desire for choice and connectivity more intense than at Merrill Lynch, the financial services company with the highest annual IT expenditure. This month, Merrill Lynch will launch Trusted Global Advisor, a technology platform for its financial consultants. The system consists of 25,000 IBM multimedia PCs using the Microsoft Windows NT operating system and linked by 1,200 servers. Using the NT platform "allows us to buy our applications rather than build," says CIO Sorgen. Merrill Lynch still uses Unix for industrial-type applications such as data-intensive analytical computation, but NT will become the norm for retail applications, he adds. By turning to off-the-shelf applications, Merrill Lynch hopes to cut the cost of technology consultants. In order to hasten the use of new technology, the company relied heavily on outside consultants. Indeed, almost 20% of the company's IT expenditures over the past five years went to pay for outside help, says Sorgen. Now Merrill Lynch is looking to widely available solutions and in-house training to sharply reduce its technology personnel cost. Keeping Control Not that the company wants to avoid everything proprietary. Merrill Lynch is following the lead of financial institutions such as Citibank in offering its retail customers an online service with a wide range of uses-from stock quotes and other financial information to direct orders to financial consultants. But instead of making the online service available on popular online networks, Merrill Lynch plans to maintain control over its customers' data. "You really don't want to allow sensitive data to pass across the Net without the development of some real security safeguards," says Sorgen. Just down the block from Merrill Lynch, American Express is taking a slightly different tack. It, too, is focusing on technology integration, but American Express wants to create a global platform that is both easy to use and scalable. American Express already has invested heavily in its ExpressNet and is focusing on developing a World Wide Web site for its small- business customers. In late July, it announced a joint venture with Microsoft to develop a travel service on the Internet (IW, Aug. 5, p. 35). Channel Change CIO Allan Loren says American Express is focused on two main goals:reengineering the company and helping to deliver new products. "We're changing distribution channels," says Loren, emphasizing the use of the Internet in helping distribute new products and expand the transactional capabilities of the company. Nearly half of IT expenditures at American Express is going toward reengineering and new product development, Loren estimates, and about 40% is being used to maintain its technology operations. The rest is being used to determine new directions for the company in a highly charged and competitive business environment. For other financial services companies, the technology challenge has been to find expanded use for data and consequently develop a broader range of products,says Equifax president McGlaughlin. Investment in technology at Equifax is related to moving away from mass-marketed, commodity information to more customized information solutions, he says. The company also is attempting to create more real-time data. Its data gatherers use notebook computers to record and transmit data, and the company plans a major investment in parallel processors to handle the bigger volume of data it hopes to soon generate. Three years ago, all of Equifax's data was stored in mainframes, available only to Equifax technical staff. Now, says McGlaughlin, with the mainframes replaced by servers and networked PCs, nearly two-thirds of the data is at customer terminals. "We're much closer to the leading edge now," he says. "New technology has allowed us to free up our resources and devote more of them to developing applications rather than storing data." Too often in the past, technology investment has meant large computers and proprietary software, resulting in systems that didn't allow enterprisewide use of technology. The front and back offices remained separate entities. Now, with the expanded availability of application software-ranging from enterprise resource planning to object-oriented databases-it has been possible to gradually merge the front and back offices and give users more data and more tools with which to use data. The result, industry executives say, isn't simply improved productivity but also sharply reduced costs to the entire enterprise. Reuters: Wednesday, September 11, 1996 Industry Groups Lobby for More Encryption Exports By Aaron Pressman A broad coalition of corporations went to Capitol Hill on Tuesday to lobby in favor of relaxed export restrictions on computer encoding technology. On Thursday, the Senate Commerce Committee will mark-up the Promotion of Commerce Online in the Digital Era Act of 1996 known as Pro-CODE, a bill that would abolish most export restrictions. Under a Cold War-era munitions statute, only weak encryption programs created in the United States can be sold abroad, although domestic use of encryption is not regulated. Companies in the high-tech industry argued they are losing business to foreign competitors who are not bound by U.S. export restrictions. And multinational companies in other industries said the the restrictions hamper their ability to conduct business overseas. "We are at a competitive disadvantage vis-a-vis our foreign competitors and that is an unacceptable situation," Gregory Garcia, director of international trade affairs for the American Electronics Association, said at a press briefing here. The Pro-Code bill, sponsored by Republican Senator Conrad Burns of Montana, Democratic Senator Pat Leahy of Vermont and others, has bipartisan support in the Commerce Committee. "We support the Burns bill because it does enable companies to utilize encryption technology securely which is vital if we're going to compete in a very tough global marketplace," Victor Parra, president of the Electronic Messaging Association, said. The association represents companies that rely on electronic communications, including Exxon Corp , Citicorp and Boeing, Parra said. Encryption programs use mathematical formulas to scramble information and render it unreadable without a password or software "key." Earlier this week, Senator James Exon, the Nebraska Democrat, came out against the current bill in a letter to Commerce Committee chairman Sen Larry Pressler. Exon will likely offer amendments at the mark-up, an aide to the senator said. The Clinton administration opposes the Pro-CODE bill, arguing that export of encryption technology would hamper law enforcement and intelligence gathering operatiobns. The House Judiciary Committee will hold a hearing on a similiar measure on September 25. Financial Times: Thursday, September 12, 1996 Japan on the Fast Track for the Electronic Purse By William Dawkins LONDON-- Japan yesterday belatedly joined the international race for a cashless society, when Nippon Telegraph and Telephone, the telecommunications giant, unveiled what it claims will be a secure yet confidential electronic purse that could be used by any bank account holder. The electronic money system, developed with the help of a think-tank attached to the Japanese central bank, aims to provide consumers with a "smart" card which would be used to buy goods and services in shops, vending machines or over the Internet and could be topped up by being plugged into a cash dispenser or telephone. In common with some other systems, the Japanese version would also give customers personal digital signatures, to stem fraud. Smart cards contain computer microchips - rather than the magnetic strip that has become the industry standard - which enable them to be used not only to carry out financial transactions but also to store data. The NTT card is similar to other electronic purses, such as the one being tested by Mondex, a UK-led global consortium of 17 banks, which has run a trial of its card in in Britain for more than a year. The market for electronic purses is being contested by global credit and charge card organisations Visa, MasterCard and Europay, which are all holding trials of their own cards. What NTT claims is unique about its plan is that it envisages the establishment of a digital central bank, which would issue electronic cash on the cards to customers in co-operation with the retail banks where they hold accounts. The aim, said Mr Hiroshi Yasuda, an NTT executive, is to enable participating banks to issue compatible electronic purses, thus avoiding the competition over technical standards which has dogged other systems. Mondex, for example, does not comply with technical standards for chip cards set by Europay, MasterCard and Visa. Some critics of Mondex say it will falter internationally because of this non-compliance. However, Mondex says standards are important only in that card-users and retailers do not want to have multiple point-of-sale terminals to accept the cards. Understandably, NTT wishes to retain technical mastery of the system, which is why it has applied for a Japanese patent for the computer software that would enable the digital central bank and private sector banks to operate together. Electronic purses operators across the world say that it will take at least a decade for consumers to make the switch in large numbers. The change is likely to take longer in Japan, where consumers and companies favour paper money. Most small and medium-sized companies still pay suppliers in paper, delivered in person. Banks refuse to set up standing orders. Cash is instead sent by post. Credit and charge cards are not widely accepted. The average citizen's wallet bulges with cash, not cards. The NTT proposal is the strongest of several rival and incompatible Japanese experiments, carried out by the Ministry of International Trade and Industry and the Ministry of Posts and Telecommunications. NTT will ask the ministries to adopt its system, to pave the way for a single standard cashless nation. William Dawkins --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Los Angeles Times: Monday, August 26, 1996 Credit Sting Involves Hacker And Citibank Cardholders By JIM NEWTON, TIMES STAFF WRITER When U.S. Secret Service agents set a trap for a young computer operator who had expressed an interest in stealing credit information, they baited it well: with real credit card numbers from real customers. The young man, Ari Burton of Las Vegas, went for it, was arrested and was charged with possession of stolen credit information--charges to which he ultimately pleaded guilty. That ended the case against Burton, but the cardholders' information did not stay secret with the Secret Service. Detailed credit histories of 35 Citibank cardholders, none of whom gave their permission for their files to be accessed, ended up with the defendant, his lawyers and anyone else who got a copy of the case file. Included in it: names, addresses, home phone numbers, Social Security numbers, credit card numbers, available credit lines and outstanding balances--more than enough for anyone to run up huge tabs on unsuspecting customers. The cardholders were never warned that their information had been used in a sting, or that it had subsequently been shared with the defendant and others. In fact, a few of the cardholders only learned of the disclosure when the defendant's father wrote asking whether they had authorized the release of the information. Others found out just last week, three years after the information was first released, when contacted by The Times. Told of their unwitting involvement in a federal sting, many were furious. "I'm upset, I'm real upset," said Joe Becker of Costa Mesa. "I want to know how this happened." "I never authorized anything like that," said Sarah DiBoise, who lives in Atherton. "I am certainly bothered by it." And Sam Zadeh, who lives in New York, deplored what he called the "bank and law enforcement agency invading our privacy." The same revelations that left cardholders smoldering also raised troubling questions about the conduct of the government and of the bank that released private information to the Secret Service. Some of those questions ripple into delicate areas of criminal law--topics such as the right of defendants to evaluate evidence against them and the right of uninvolved citizens to maintain their privacy while federal agents try to corral bad guys. Why, lawyers, cardholders and others asked, would the Secret Service use real cardholder information for sting operations? And even if, for legal reasons, it feels compelled to use actual credit histories, why not seek permission from cardholders first? Finally there is this question: How many cardholders nationally are exposed to disclosure of their credit information through government operations? Authorities in some other parts of the country say they do not use real credit information, and Citibank stresses that the Burton case was an aberration. But investigators and prosecutors in Las Vegas said the techniques used to nab Ari Burton are employed in other instances. In fact, Secret Service agents in Las Vegas say the use of real credit information is forced upon them by federal law requiring authorities to demonstrate that a suspect actually possessed something illegal in order to win in court. "In something of this nature, the crime is the illegal obtaining of what is called the access device," said Jerry Wyatt, assistant special agent in charge of the Secret Service office in Las Vegas. "Unless the access device is a real number, it's just a number." Following that theory, some authorities argued that if the Secret Service had supplied Burton with fake credit card information, Burton could not have been found guilty of attempting to steal real credit card histories. But that reading of the law is hotly contested by experienced lawyers. Although it is a violation of federal law to have unauthorized possession of an access device--another name for a credit card number--it also is against the law to attempt to possess such a device, even if that attempt turns out not to be successful. Legal experts said agents could make up fictitious customers and generate false credit histories, then use that information in sting operations. Even without a handoff of real credit information, prosecutors still could charge the objects of the stings with attempting to steal credit card numbers, an approach that might slightly complicate criminal cases but that would protect cardholders. Wyatt said he was not familiar enough with the facts of the Burton case to know why that approach was not adopted. Nor could he say how many cases each year involve the knowing transfer of actual credit information from the government to criminal suspects--only that such cases are not unusual. At the U.S. attorney's office in Las Vegas, the chief of that office's criminal division agreed that other tactics might have minimized the risk to cardholders in the Burton case, but he said the Las Vegas office typically uses real credit card numbers of actual cardholders in luring suspects such as Burton. "We're sensitive to disclosing too much personal information," said John Ham of the U.S. attorney's office. "But whenever we charge credit card cases, we include names and numbers." As for its role, Citibank acknowledged releasing the files to the government but defended its actions by saying it meant no harm and by stressing that its customers' privacy is its highest priority. "We would never do anything to jeopardize our customers," said Maria Mendler, a spokeswoman for the bank, which has a reputation for vigorous protection of its cardholders' privacy. She acknowledged that real information was supplied in the Burton case, but she said the bank did not intend for that information ever to surface in a court file or otherwise become available to the defendant and others. In 1993, the bank also defended its actions in a letter to a lawyer by noting that while information had been released, it had not been done to hurt anyone. "We submit that the actions as alleged do not include the requisite element of an intention to do harm to those customers whose information was disclosed," an associate general counsel for Citibank wrote at the time. Those explanations hold little sway with Citibank customers, however, many of whom complained that if their personal credit histories were going to be used in a sting operation, they at least deserved to be notified so that they could apply for new card numbers once the operation was over. Instead, sensitive information about them and their credit has been kicking around a court file for more than three years--available to, among others, Burton, a man who has admitted that he tried to steal credit information. There is no evidence that Burton or anyone else used the card information gathered in that case to ring up bills, but that, too, is little comfort to the cardholders. "Financial information is private, and I have a right to privacy," said Becker, one of those whose credit information was used by the Secret Service. "I'm worried about how this information might be used now that it's out there." Experienced defense and civil rights lawyers, who are used to analyzing government conduct and subjecting it to harsh scrutiny, said they were taken aback by the actions of the Secret Service and Citibank in the Burton case. "I would think these people could sue for invasion of privacy," Century City defense lawyer Harland W. Braun said of the cardholders. Paul Hoffman, a Los Angeles civil rights lawyer, said he too was surprised by the use of private information in a sting. "It does seem amazing to me," he said. "These people have rights, too." Legal experts with both defense and prosecution backgrounds acknowledged that problems might have confronted the Secret Service had it tried to avoid offending customers by fabricating card numbers or inventing fake credit histories. But they said those problems probably could have been overcome, and added that in any event, they did not pose enough of an obstacle to justify accessing credit information without permission. "The answer to that is you get real people who are willing to have their credit cards used that way," said Hoffman. "If you're doing a sting in a house, it doesn't mean you go into a neighborhood and take a house. Why should this be different?" Complicating the issue still further is a decision by the prosecutor in the case. Once the Secret Service and Citibank had used real credit histories to bait the trap for the sting, the U.S. attorney in Las Vegas was presented with a case in which the evidence against the defendant involved personal information whose disclosure might harm innocent citizens. That type of situation can pose a difficult dilemma for a prosecutor: Federal rules require that prosecutors share evidence with their defense counterparts so that defendants know what they might face at trial, and failing to do so can allow suspects to go free. On the other hand, disclosing the information might put other people at risk. In general, careful prosecutors tend to err on the side of providing information to the defense even if it may create hazards for others. In the Burton case, however, some experts argue that the privacy rights of the cardholders should have outweighed the defendant's right to confront the specific identifying information; an edited list of cardholder information should have sufficed in a case such as this one, they said. The solution, according to those experts, would have been for prosecutors to ask the judge to impose a protective order that would have shielded the personal, private information from either the defense lawyer or from the defendant himself. But others maintain that Burton's lawyers were entitled to the information because it was evidence against Burton, and therefore evidence that his lawyers had a right to assess and consider in deciding their legal strategy. Ham, the chief of the Las Vegas office's criminal division, echoed that view, saying his office had no choice. "We have to provide documents that support the charges," he said. If prosecutors had not done so, he added, a judge undoubtedly would have forced them to. Ham said no protective order was sought to keep the information from being shared with people other than the defense lawyer. The prosecutor, said noted Los Angeles defense lawyer Donald Re, "probably had the obligation to provide the material in discovery." Re added, however, that a protective order might have been tailored to allow Burton's lawyers to review the material on the condition that they not share it with anyone else, including their client. Because there was no such order, Burton effectively received the same information in discovery that he had sought illegally. Within a month of being arrested, the same government that was charging him with a crime provided him with the list of cardholders and their personal information. "They handed it right back to me," Burton said in an interview. At the same time, Re and others stressed that the prosecutor's decision was a close call and difficult to second-guess. Far more troubling, they said, were the actions that led to it: the bank's disclosure of the material and the Secret Service's decision to hand it over to a suspect. And given the statements by investigators and prosecutors that the techniques used in the Burton case are widely practiced in other investigations, many experts warned that ill-advised government practices may be putting cardholders across the country at risk. "There are a lot of situations where they create a scenario like this where you want to show actual possession, not just an attempt," said Re. "But in those situations, you get consent from somebody. You have a security officer who sets up an account, and you use that account number in the sting. Then there's no harm, no foul. "But you don't give out real information," Re added. "That's just crazy." USA Today: Wednesday, August 28, 1996 Citibank Tightens Rules on Disclosure to Law Enforcement By Jeff Mangum Stung by a sting that nabbed a Las Vegas man for possession of stolen credit information, Citibank says it has changed how it works with law enforcement agencies. Citibank agreed in 1993 to give the U.S. Secret Service credit card information on 35 customers, without their knowledge, to help catch a man who eventually pleaded guilty. Customers' names, addresses, home phone numbers, Social Security numbers, credit card numbers, available credit lines and outstanding balances ``ended up with the defendant, his lawyers and anyone else who got a copy of the case file,'' the Los Angeles Times reported Monday. ``Citibank trusted that the criminal justice system would keep this information safe and confidential,'' the bank said Tuesday. ``As it turned out, that was a mistake.'' Citibank says a relative of the defendant subsequently contacted the affected customers, asking them to join a class-action lawsuit against the bank. That, spokesman Mark Rodgers says, prompted Citibank to contact the customers and change its policy in 1993. ``Were we to consent to a similar operation (now), for example, we would only do so with the express consent of that customer,'' Citibank said Tuesday. Federal law generally prohibits disclosure of financial records. But there are exceptions. ``The general rule of thumb is there has to be a subpoena or a person's consent,'' says Mitch Montagna, a spokesman for AT&T;Universal Card. The American Bankers Association says ``99.9% of the time, customer information is safe and secure.'' Denver Post: Tuesday, September 10, 1996 Editorial U.S. Invades Privacy in Nevada Credit-Card Sting Americans who say they worry about invasions of their privacy have a new reason to fret: In a recent case, the federal government and a major bank willingly gave a suspected crook the credit card numbers and personal histories of citizens -- without their permission or knowledge. The breach of privacy in this Las Vegas, Nev., case was egregious and outrageous. The Clinton administration should reprimand the agents involved, and Congress should amend the laws so that such an affront to citizens' rights never reoccurs. In the case, U.S. Secret Service agents wanted to snare a computer operator who had expressed interest in illegally obtaining credit-card information. They asked Citibank for the names, addresses, Social Security numbers and other credit information on some of the bank's card holders. Citibank complied with the request - but never got the card holders' permission to divulge such personal information, according to a story in the Los Angeles Times. In other words, law enforcement agents handed a suspected credit swindler the very information he would need to carry out a crime. The suspect ultimately pleaded guilty to some of the charges. Many of the card holders heard that their personal records were used to bait a credit-card sting only when the defendant's father contacted them. Others learned about the episode through a newspaper reporter who was covering the case. In theory, there are laws to protect consumers from people prying into their credit histories without their permission. Obviously, these statutes aren't nearly strong enough. American Banker: Monday, September 16, 1996 FUTUREBANKING Mondex, Moving Fast, Sees Long Trek To a Worldwide Cash Alternative By JEFFREY KUTLER Exactly a year passed between the start of the Mondex trial in the southwest England town of Swindon and the creation of Mondex International, the banking consortium that hopes to use the smart card system as the basis for a global alternative to cash. That was fast according to the calendar. It was also an eternity. During those 12 months, National Westminster Bank, the new payment technology's inventor and champion, rode a roller coaster between self- congratulation and a skeptical press, between the celebration of an unprecedented accomplishment and a storm of criticism from within its own industry. Even with the formation July 18 of Mondex International, enthusiastic backing from banking powers as diverse as Wells Fargo Bank and Hongkong & Shanghai Banking Corp., and the current cloning of Swindon in the Canadian city of Guelph -- it relates locationally to Toronto as Swindon does to London - the Mondex eternity continues. The emotional pendulum still swings at Natwest Group headquarters in London. And emanating from Natwest and from within the Mondex project is a mix of messages that underscores how truly groundbreaking is their attempt. Win or lose, whether or not they are understood or praised by their peers, the founders of the Mondex project have risen above the almost weekly cycles of technological change and quarterly pressures on earnings with a longer-term perspective antithetical to the traditional ways of bankers and the banking industry. "Natwest recognizes that Man does not live by short-term profits alone," group chief financial officer Richard K. Goeltz said in a recent interview with American Banker. "There are things we have to bequeath to our successors." Mr. Goeltz -- who moved to New York this month as chief financial officer of American Express Co. -- and others close to Mondex want the world to recognize how far they have come in a year. But the Mondex promoters are quick to point out that it is actually Year 6 since Natwest began to fund them. Today they look at a 10- or 15-year horizon. (Natwest will recover most if not all its development cost by issuing about $150 million of stock in Mondex International. The bank expects to collect further royalties as the system rolls out. Partner bankers do not begrudge Natwest its return for risk taking.) One gets the sense that Natwest's leaders were so well primed for the long haul that it would take more than a few technical glitches and negative newspaper stories to get their goat. Mr. Goeltz dismissed the sniping from more tradition-bound competitors as "slings and arrows" that never hit their mark. Mr. Goeltz and other insiders knew, long before the Mondex International membership roster became public, that the concept was attracting interest. "Broad-scale cooperation" was a prerequisite, written into Natwest's business plan, and 16 other "global founders" who came forward July 18 found the case compelling enough to want to join in the marathon. "This is a process of change management - it's not like flicking a switch," said Roy S. Pratt, deputy chief general manager of Mondex UK Ltd., the British franchise co-owned by Natwest and Midland Bank Ltd. "Our job is not to say, 'This is how it will be.' It is about trends and responsiveness. To say anything is cast in stone at this point would be presumptuous." Mr. Pratt, 49, spent 31 years at Midland Bank before being "seconded" to Mondex UK in 1994. His banking jobs were in treasury, asset/liability, and portfolio management. He said his nontechnological background enabled him to see the complexity of the phenomenon, to confront necessary questions about the known and unknown quantities of a reinvented payment system. "People always want to ask about take-up (acceptance) rates, how fast this will happen, but I am reluctant to make blanket statements," Mr. Pratt said. "Mondex will mean different things to different people. It will not be the same at Exeter University (where it is being introduced this fall) as it is in Swindon. "There is not one proposition or growth rate. What is a critical mass for one segment will be different in another. A carpark will not be the same as a bus. You might call each a micro-Mondex economy. "This is a change process that will be based on value exchange on a just-in-time basis," Mr. Pratt continued. "It is not a product like a loan or deposit package, or even a payment mechanism. It is not mono-dimensional. "And it's not just an issue for bankers. We respect the integrity of the payments process, but we also have a responsibility to society." Such words are hardly bankerly. To be sure, Mondex has rigorous underpinnings. The bankers' thought processes are logical. The strategic plans passed muster with "some of the most sophisticated, hard-nosed bankers in the world," Mr. Goeltz said. "Mondex does have tremendous social implications, not least in terms of what it can do for welfare payments and pensions," Mr. Goeltz said before his recent departure for American Express. By automating cash "it reduces friction in the economy. "But the implications for society were not the motivation for Mondex. It was to serve customers better and generate a return for shareholders. "What's interesting about Mondex was not the technology," Mr. Goeltz went on. "The technology was a facilitator. This is one of the few products I've seen in which all three participants in the value chain -- banks, retailers, and customers -- benefit." The enthusiasm carries over to outsiders - even some who have been lumped among the critics - to a point. "The richness, the robustness of the technology, is fantastic," said H. Eugene Lockhart, president and chief executive officer of MasterCard International. (MasterCard held negotiations with Natwest to buy into or participate in Mondex, but at the same time its European affiliate, Europay International, was developing the competitive Clip electronic purse system.) For more than two years, Mr. Lockhart has insisted on seeing smart cards' "business case," and even as MasterCard launches experiments around the world he is still not completely satisfied. "Let's assume there is a business case," he said. "The opportunity is that we have this new technology platform that can do a lot of things, stored value being only the first manifestation. "But there is a big problem: How on earth do you grow that system in millions of other cases just like Swindon?" Swindon, for now, is "the case." Mondex UK's overly optimistic projection of 40,000 cardholders in the city of 190,000 people set off the bad press. In reality, the 10,000 that signed up within 12 months weren't bad news at all. That's almost 25% of the combined Natwest-Midland customer base in the area. Mondex said its surveys showed 66% of the cardholders said they preferred Mondex to cash. Average card loads were the equivalent of $35 to $45, and the majority of transactions were under $7.50. Perhaps more to the point, it is hard to find a storefront, public phone, or any type of payment device in the commercial center of Swindon that does not accept Mondex. The banks signed 600 merchants, double the number accepting MasterCard and Visa, which stands to reason for a cash replacement. "You can actually go cashless," said Mark Gordon, Mondex International's head of marketing. "It's not a big deal when you present Mondex at the tills." While Mondex has been selective in its data disclosures -- no one denies that its transactions are a small percentage of the Swindon total -- Mr. Gordon and his team have been more than hospitable in letting the world come view Mondex. Banker delegations are commonplace, often gathering at the "Mondex Store" in the town center before setting out to observe and test merchant acceptance. Hardly a day goes by without the visit of a television crew. Many come from Asia, where Mr. Gordon believes "Mondex will really fly." (A Hong Kong pilot is set for late this year, and smart cards of various kinds are already prevalent in Singapore, Taiwan, and elsewhere in the region.) "They see this as a city of the future," he said, "like something out of 'Blade Runner.'" The Mondex staff tries to keep the visits unobtrusive, but some of the merchants were willing to pay the price of unanticipated stardom. "Our town center store is small," said Bob Upshall, manager of the Sainsbury supermarket, part of one of Britain's biggest chains. "Having Mondex raised our profile and provided a morale boost." At the corporate level, Sainsbury was eager to participate in Mondex because "it didn't want to be left behind." So the smaller, convenience-oriented Swindon outlet, which otherwise might have relied for years on older computers and point of sale equipment, got an upgrade on a par with many "superstores," and Mr. Upshall said, "My staff loved it. A positive staff is a plus for customer take-up." Sainsbury, a Midland Bank customer, invested 45 minutes per cashier in Mondex training and found the system was so easy to grasp that it didn't have to deploy, as anticipated, demonstrators in the checkout lanes. Mondex volumes were running at less than 0.5% of sales at the three Swindon stores -- slightly lower in the town center location than at the larger branches on the outskirts of town. Mr. Upshall said an incentive offer in May and June of a five-pound voucher (about $7.50) for every 50- pound ($75) shopping trip brought in transactions well above the average ticket of five pounds in-town and 30 pounds ($45) elsewhere. "Whether smart cards will be in Mondex or other forms, they are here to stay," Mr. Upshall said. He gauged customer reaction as "very positive," though mainly among early adopters. He himself likes Mondex as a consumer -- "I use it in the canteen all the time" -- and as a merchant, because it streamlines the cash-handling tasks that require two to three full-time positions in the supermarket's back office. Nearby in McElroy's, a local department store, Vince Ayris accepts and encourages Mondex payments at his shoe repair and key-making stand. Mr. Ayris has been in the business 17 years, is a well-known man about town, and so strongly believes in Mondex that he essentially sold it to the local rugby club, where "we use it quite a lot. I find I'm more careful about spending money (with Mondex) than with cash, and it's easier than small change." Mr. Ayris admitted to being "a bit skeptical at first," but he has become so strong a booster that Mr. Gordon felt he had to deny that Mr. Ayris is in Mondex's employ. "I don't give money away to a bank like I do with a MasterCard or Visa discount," the merchant said. "There is no problem with fraud or counterfeit. "I have more over-ring errors on the till than on Mondex terminals. Every transaction is documented so disputes are more easily resolved" than with cash. And because the Mondex terminal is smaller than a cash register, "I have more room for selling product." Mondex is also proving itself at a multiplex movie complex, part of the MGM chain that Virgin Enterprises recently acquired. John Keil, the manager, said he "needed no convincing" to accept Mondex at every point of sale. "We saw the benefit immediately. Any way at all to take cash out of the system, the better. "The bigger the business, the more problem cash is," Mr. Keil went on. "Any major company sees the benefits in the technology." Like the supermarket, the MGM outlet easily won staff support. "Most of them are into gadgetry," Mr. Keil said. It also encouraged sales by cutting Mondex users' ticket price to about $4.90 from $6.80. The transactions are still a small portion of the 30% of in-person box-office sales done on plastic cards. (Another 30% are advance sales by phone; Mondex has not yet been accepted that way.) Mr. Keil said he is looking forward to having "one box" that can accept all cards. Even so, he said Mondex was "very flexible, requiring no change whatsoever to our system. It was slotted right in ... They made their system fit ours." "I think the system will take off eventually," Mr. Keil said. His only regret is that because he doesn't live in Swindon, he can't use Mondex more than he does. It is as if Mondex has succeeded at recruiting its merchants as change agents. Time will tell if they are still on board when Mondex begins costing them something. "The chip brings a fundamental change," said Mr. Pratt of Mondex UK. "You feel as if you are shaping the future. "When the market begins using it to create its own needs and to solve its own problems, that's when the real thrill will come -- and a surge in usage." --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

A daily warning regarding Timothy C. May
by nobody＠replay.com 17 Dec '03

17 Dec '03

Timothy C. May is a lying sack of shit.

4 3

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

AP Online: Sunday, September 15, 1996 Card Raises Privacy Issues By PATRICIA LAMIELL Big Brother is not watching. Or is he? Fears resembling those of the omniscient machine that spies on people in their homes in George Orwell's novel, ''1984,'' have found their way into a new technology entering the marketplace -- smart cards. These credit cards embedded with computer chips can store information from shoe size to credit history. But critics claim these cards will be used to compile dossiers on the people who use them. And now it's up to the Smart Card Forum, a family of companies driving development of smart card technology, to convince the public that Big Brother isn't watching, for smart cards are protected and confidential. ''There's a huge amount of misunderstanding, and that creates a huge amount of fear, about whether these products are going to decrease people's privacy or otherwise leave them unprotected,'' said John Burke, the forum's attorney and a partner at the law firm of Foley, Hoag & Eliot in Washington, D.C. Starting Monday in San Francisco, members of the Smart Card Forum will meet to discuss the latest technology and marketing programs necessary to put a smart card in every household. In many ways, smart cards resemble credit and debit cards that the market has grown accustomed to using. With a simple swipe, they too can substitute cash when buying everything from subway tokens to clothing and the purchase price is electronically deducted from the card using a special machine. But the smart card takes the technology further, embedding a computer chip into the card. that gives it much more memory and enables it to do simple math and process information, like keeping a bank balance or tracking frequent flier miles. The huge potential scope of the smart card has prompted some concerns about the privacy rights of users. By tracking small purchases, telephone and transportation records, they can document a person's everyday movements. That information could be useful to everyone from employers and family members to law enforcement officials and banks. Marketers might be very interested in records of purchases made with smart cards. But privacy experts question whether third parties should gain access to see such information. The American Civil Liberties Union of New Jersey is fighting a state proposal to encode fingerprints on smart card drivers licenses on the premise that it would treat as criminals people who are not suspected of a crime. ''We also oppose the requirement that other data be included'' on New Jersey drivers licenses, said David Rocah, an ACLU staff attorney in Newark, ''unless precautions are made to insure that third parties will not have access to that data.'' Others, however, counter the questions of privacy, claiming that owners can control what information goes onto them and with whom it is shared. They also point out that the information is electronically scrambled, or ''encrypted, '' making it very difficult to steal. The Smart Card Forum is working to create privacy guidelines that can keep pace with the fast-developing industry. Federal regulators, such as the Office of the Comptroller of the Currency, the Federal Reserve and the Federal Deposit Insurance Corp., are all considering whether and how to regulate smart cards. Smart cards are a huge business for companies like Texas Instruments Inc. and Motorola Inc., which make the chip. They could also be a boon for banks and other financial institutions that issue the cards for a fee, and for payments-systems networks like Visa and MasterCard, which earn a percentage of each transaction. ''This is a huge, huge market,'' said Peter Hill, executive vice president for technology at Visa International, one of the 225 corporate members of the forum. ''Cash transactions world-wide total about $8 trillion a year, of which 80 percent are for $10 or less.'' A number of big banks have run pilot programs to test consumers' acceptance of the cards. Some have teamed up with Visa and MasterCard to do market tests in Swindon, England, Canberra, Australia, and at the 1996 Summer Olympic Games in Atlanta. A test is planned by MasterCard, Visa, Chase Manhattan Corp. and Citicorp, in New York's Upper West Side later this year. So far the pilot projects, which have put about 50,000 smart cards in circulation worldwide, have had mixed results. Many worry consumers will not incorporate the cards into purchases they now make with cash, and that has left merchants wary about the cards also. To move beyond the arena of small purchases, members of the Smart Card Forum are developing technology to allow people to use home computers to pay for Internet purchases with these cards, and to download cash onto a smart card. Personal-computer makers have begun including chip readers in PCs for these purposes. Also in development are scores of non-financial applications, such as keeping drivers license and medical information, transferring government welfare or medical benefits, and making airline and hotel reservations. To Diane Wetherington, MasterCard's senior vice president for smart cards, the Forum's biggest task is not the social and legal issues surrounding the smart card, but getting consumers to use it for any and all financial transactions down to the 10-year-old's weekly allowance and merchants to accept it. ''The technology works, the product works,'' she said. ''Now it is up to the marketing associations and companies to really try to create global products from these.'' American Banker: Monday, September 16, 1996 FUTUREBANKING SET a Big Win for the Card Associations By JEFFREY KUTLER Whether for superstitious reasons or just to avoid the inevitable groans, experts in data security were long reluctant to use a certain, pertinent pun. But now it can be officially uttered: SET is set. Secure Electronic Transactions, the Internet payment protocol hashed out by MasterCard, Visa, and a sometimes unruly bunch of technology providers, went up on the card associations' Web sites in June in what was labeled as its final form. In other words, the standard was ready for prime time. Software developers could begin incorporating it in systems being designed for electronic transactions. And thus began something of a race to make SET-- secured card payments a reality, at least in a test mode, by yearend. The principals were too busy and running too fast to celebrate their hard-won accomplishment. There was far more work to be done, and in their haste to get to it they may never have adequately explained the document's true significance. The SET advocates met their objective. Getting past their internal divisions, they wrote specifications for on-line credit card transactions and were unanimous in their endorsement. Relying on data encryption and digital certification of buyers, sellers, and bank processors, they erected several barriers to electronic thievery. They did not make the Net safe for all commercial and monetary activity. Nor did they silence a number of critics who still raise warning-flags about the Internet's inherent vulnerabilities, even those addressed by SET. The development of the protocol was well-chronicled. Probably too well from the standpoint of MasterCard and Visa, which had hoped that their mid- 1995 move to cooperate -- on the assumption that payment security should not be a competitive venue -- would lead to a rapid conclusion of amicable, low-profile deliberations. The diplomatic initiative derailed in the fall of 1995 when Microsoft Corp., sitting on Visa's side of the table, failed to reconcile with the opposing camp that included two of Microsoft's market adversaries, International Business Machines Corp. and Netscape Communications Corp. After a couple of months of fence-mending, the negotiations were declared back on track Feb. 1. Within a month the working draft of SET was completed, supposedly drawing the best features from the initially separate MasterCard and Microsoft-Visa proposals. As the June deadline approached, most of the organizations directly involved in SET -- they included GTE Corp., Science Applications International Corp. (SAIC), and companies associated with the data encryption leader RSA Data Security Inc. -- announced they would provide products and services implementing the protocol. Verifone Inc. hit the ground running June 18 with a comprehensive electronic commerce package that it said would be the "first implementation" of SET, supported by numerous strategic allies from the SET circle and beyond. Said Verifone's Internet commerce division chief Roger B. Bertman, "This will help the industry benefit more quickly from increased Internet transaction volumes and allow us all to begin learning by doing." Verifone had reportedly pressed to join the SET team, only to run up against the members' desire to stay small. But Verifone was very plugged in, and Mr. Bertman's "learning by doing" could have been their motto. By implication, publication of SET was just one more beginning. At the heart of SET is data encryption technology, specifically that provided and championed by RSA of Redwood City, Calif. In the encryption field, science meets commerce. The plodding of the scientific method tempers businesses' drive to get products to the market. Further complicating any venture into encryption -- the mathematical technique for scrambling messages to prevent unauthorized reading -- is the overhang of public policy. RSA and its progeny have chafed at federally imposed limits on cryptographic systems, particularly on the length of the code-defining keys they can export. While most financial activities are not hindered by the government's concern about "strong encryption," any banking or payment-related activity is surely to be scrutinized by that industry's regulatory establishment. It is only 20 years since the advent of public key cryptography. Improvements have been continuous, at least theoretically enabling the guardians of secure data to stay a step ahead of criminal pursuers. That SET could come together in a few months of concentrated effort is testimony to the strength and durability of the concept. As in academic tradition, what is tested and proven wins out. MasterCard's and Visa's pre-SET attempts, Secure Electronic Payment Protocol and Secure Transaction Technology, "didn't incorporate enough of preexisting security standards," said Allan M. Schiffman, chief technology officer of Terisa Systems Inc., a Los Altos, Calif., company formed in 1995 by RSA and several other investors to develop secure systems for Internet commerce. "In dealing with crypto, it's nice for stuff to be out and analysts to take a shot at it," said Mr. Schiffman, whose company was intimately involved in SET and said back in April that it would build the protocol into its client and server toolkits. "Older standards that aren't broken are what crypto-developers want." SET's reliance on the proven didn't stop the sniping. Lee H. Stein, chairman of First Virtual Holdings Inc. in San Diego, designed his Internet commerce system such that payment data flow via a private communications channel rather than the World Wide Web. First Virtual is not yet ready to bank on encryption. SET may be a step in the right direction, but it didn't sway Mr. Stein. "Sensitive financial information is never to be on the Internet," Mr. Stein said at the Cyberpayments '96 conference in Dallas in June. "Has anyone here yet seen a hierarchical, encryption-based certification authority working at the consumer level?" Jerome Svigals, a California-based consultant and long-time advocate of smart cards, criticized the lack of portability of the customer certificates required for an SET transaction. Designed to be embedded in a personal computer, the certificates, or digital signatures, might better comport with the credit card transaction model by being stored on smart cards. Aharon Friedman, chairman and chief product developer of Digital Secured Networks Technology Inc. in Englewood Cliffs, N.J., has expressed concern about the software-only nature of SET. He said it requires a hardware component to be fully secure. Mr. Friedman, a one-time SAIC research physicist who founded his network security company last year, also said too much of an SET message is in clear text or subjected to "hash functions" that do not provide the high security levels of encryption. "Unlike hardware, software can be bypassed using a computer," Mr. Friedman said. He has suggested that a hardware-based approach be incorporated into SET at "a more elementary level" so that all the text can be encrypted. "He put it aggressively," Mr. Schiffman said of Mr. Friedman. "What he says is not wrong, but it was not unaccounted for" in SET revisions. Other SET defenders have pointed out that the three aforementioned critics have vested interests in, respectively, off-Internet payments, smart cards, and hardware. Mr. Friedman said he is a few months away from a hardware-software solution that would be economical for PCs and even laptop computers, but he was not ready to talk about specific pricing. More fundamentally, the SET group had to grapple with classic questions of appropriateness. The security measures had to fit the potential crimes, at a reasonable cost. As new electronic payment media develop, "people are going to realize that they can't guarantee 100% security," Geoffrey Baehr, a top network technology official at Sun Microsystems Inc., said at a banking conference earlier this year. "Instead, they will aim their development work at 100% acceptance of risk, and assume there is always some amount of fraud. "It happens, and there isn't much you can do about it other than best efforts." Focusing on the framework for card payments, the SET group put its best efforts toward standards for transaction software and the ever-critical authentication of cardholders, merchants, and banks, based on the digital certificates issued and maintained by "trusted parties." A big selling point is that merchants don't see buyers' credit card numbers; the system transparently validates them. RSA Data Security has a central, commercial interest in how SET develops and has taken on an associated, almost public-service responsibility for coordination. "SET is definitely the way to go to secure bank card transactions," said Kurt Stammberger, RSA's director of technology marketing. "We believe it will be huge. Otherwise we wouldn't have built a toolkit around it." Indeed, the "RSA Encryption Engine" brand will be on Verifone's software products -- vGate, vPOS, and vWallet -- the first of what should be many SET-related licenses. Because there will be a proliferation of on-line products, especially the virtual wallets at the consumer level, Mr. Stammberger said "RSA's role will be to make sure all the wallet implementations talk to all the merchant implementations and the banks." "Building cryptography is not trivial, but getting all the right people talking to each other can be even more of a challenge," Mr. Stammberger said. Meanwhile, Verisign Inc., spun off by RSA 17 months ago, is going after the certification piece of the business. In July it announced it was chosen by Visa International to provide Internet authentication through the member banks. Building a global infrastructure for the encryption-based certification product it calls Digital ID, Verisign views the Visa deal as a big mass-market opening for digital signatures. "The financial services industry is leading the charge in bringing Internet commerce to the consumer," said Verisign president and chief executive officer Stratton Sclavos, who has also signed breakthrough licensing pacts with Microsoft and Netscape. He expects market availability of his "high-volume, scalable-to-the-millions" product "as soon as SET is ready," by early next year. MasterCard designated the CyberTrust unit of GTE Corp., one of its partners in the SET project, as its private-label certificate provider. The announcement, within days of Visa-Verisign in late July, prompted some one- upmanship. MasterCard senior vice president Steve Mott predicted GTE would be "bigger, better, and faster" in the market. Visa U.S.A. president Carl Pascarella wanted to underscore that the Verisign-GTE face off means healthy competition, not a return to the earlier SET dissension. He said the card associations rejected the idea of a single certification authority because it could have been monopolistic. And while Visa members can now choose Verisign, and MasterCard members GTE, they could also be their own "CA" or pick from other suppliers. "Visa and MasterCard agreed to pursue different certification options," he said. "The technology will be more robust, and it will minimize the impact on issuers and acquirers. "Things are changing so fast, we don't want to be in the position of driving stakes into the ground. Our concern right now is to protect the banks, and SET does that." The Miami Herald: Monday, September 16, 1996 Firm Hopes Facial "Signature" to be Foolproof Don't look for twenty-something computer nerds at Identification Technologies International in Coral Gables. ITI, a high-tech firm founded in 1993, is run by David Bendel Hertz, an energetic septuagenarian. Hertz has held executive engineering positions at RCA and Celanese, has been a partner at the consulting firm McKinsey & Co. in New York and has taught business and law at the University of Miami. His latest venture focuses on a facial recognition system, with applications from building access to internet banking. "We are a start-up business, a research and development company," says Hertz, 77. "And now we're becoming an operative company." Hertz saw an opportunity in 1994. Conventional facial recognitions systems "were too slow and took too much computer memory," he says. And stored on a hard drive, the data were vulnerable to hackers. Hertz calls his solution One-to-One. It uses a camera to take a person's photo and compares it to a facial "pixel signature." The signature uses only 96 bytes of memory -- as opposed to 500 to 2,000 bytes in conventional systems -- and can be easily stored on a smart card. Hertz insists that even the most intelligent hacker won't be able to break into the system because the data is not available on a central computer system and a stolen smart card will not match the thief's facial characteristics. Hertz allows that ITI has spent more than $1 million so far, half from him and half from Peipers, a New York investment company. ITI offers its system in the form of a small black box, containing the camera and connected to a computer. One-to-One uses little memory because it focuses on specific characteristics, such as the position of the eyes and the form of the mouth, while older systems store a photo-like image of the face. "When we started," Hertz says from a University of Miami test lab, "the first thing we did was ask a plastic surgeon if there are sufficient differences between faces. "'Every face is different,' he answered. But what about identical twins, we wanted to know. "The surgeon said there are enough differences in their faces that some people -- like their mother -- always can recognize them." Using biometrics, the branch of biology that deals with data statistically and by mathematical analysis, One-to-One can recognize these differences as well as a mother. A niggling problem, however, is that the system may not recognize a characteristic that is not part of your signature, such as a new haircut or even a smile. So far, ITI has made 50 units, mostly for testing and evaluation. Priced at $2,000-$3,000, two of the units have been sold to Westinghouse Security Electronics, which does not manufacture facial recognition systems. Jorge Sousa, director of product development at Westinghouse's systems division, based in Santa Clara, Calif., says he is "convinced that biometrics has a future," and that his company is keenly interested in ITI's product. Citicorp is currently testing Hertz's system on its ATMs, and AktivNet, a Miami company, has agreed to try out 400 units in 1997 on its communications kiosks in airports and hotels geared to business travelers. Hertz has also presented One-to-One to the National Security Agency, which he says "exhibited high-level interest." ITI is being marketed in Europe, South Africa and the Middle East by a Dutch company, Digistration. Hertz sees customers ranging from airports to welfare agencies to sports arenas. "The market is large and growing every day," he says. David Leibowitz, managing director and analyst at Burnham Securities in New York, also sees a rising interest in sophisticated security systems. "There is every likelihood that more creative devices will be needed," said Leibowitz, who added that with the rise in crime and theft, "The security market is growing at a dramatic pace." Leibowitz points out that the security market can include everything from barbed-wire fences to combination locks to the high-tech devices manufactured by such companies as Sensormatic, Checkpoint and Knogo . "Should ITI's product prove itself in tests and go on to succeed in real-world applications," he said, "there is a good chance there would be a market for it." But he cautioned that between now and then, competitors may have developed similar or more innovative systems that affect ITI's potential to market its product. Hertz plans to hire 10 additional employees to market and distribute ITI products. They will join the 12 people currently on staff, an international group including a computer programmer, biomedical scientist and mathematical analyst. Their work has far-reaching implications: Hertz envisions a day when ITI develops systems and products that, for example, has the capability to "detect people in a crowd," to catch fugitives or help find missing persons. Retail Banker International: August 22, 1996 Chase Builds "Best Biometric" CHASE MANHATTAN is currently testing biometric voice printing for retail banking applications in two pilots in the New York area. The bank said these tests will be concluded before year-end, and could lead to the introduction of biometric voice printing in several retail channels as early as 1997. The two pilots now in progress are testing voice printing at branch offices, the most challenging environment for voice printing, due to ambient noise and distortion. Branch customers pick up a phone on the teller line and verify their identities instantly, saving the teller the time needed to check the validity of each customer's bank card. But the system's most dynamic application will be in remote delivery, and especially in phone banking, where customers' identities can be automatically verified as soon as they speak, allowing phone reps to call up all account data instantaneously. The bank expects to roll out voice printing first in high-risk wholesale operations, like funds transfer and treasury services, before introducing it to the retail side of the bank. "Voice is the best biometric," said Elizabeth Boyle, Chase VP for strategic implementation in New York. First, voice printing offers security in all channels, an advantage that techniques like fingerprinting and dynamic signature analysis do not enjoy. This means that customers can use the system for remote transactions and can open accounts without visiting a branch, for example. Second, customers are most comfortable with voice printing, which is considered far less intrusive that fingerprinting, for instance, and is completely invisible over the phone. Lastly, voice printing is the most effective security system, yielding the lowest percentage of false positives, and just as important, the lowest rate of false negatives. "We do not want to be in the position of telling customers that they are not who they are," Boyle explained. Chase's voice printing pilots use technology developed by Votan of Pleasantville, California, a firm currently under registration for an initial public offering valued at $30 million. Direct mutual funds provider Fidelity Investments is also working on the implementation of voice printing technology, and Citibank is currently running voice pilots by four separate vendors. Boyle said that twelve months ago, Chase decided against multiple- vendor pilots, believing the technology was changing too rapidly to make this approach economical. New York Times: Monday, September 16, 1996 Testing Whether Internet Readers Will Pay By MIKE ALLEN After extending its grace periods four times, The Wall Street Journal Interactive Edition says it will bar freeloaders from its World Wide Web site beginning Saturday. The results are being watched as a bellwether for prospects of charging for access to Web sites. Because of The Journal's fame and its high proportion of business users, founders of other sites figure that if The Journal does not succeed, they may have no chance of charging in the foreseeable future. Today's Web is a money pit, with sites getting some revenue from advertisers but virtually none from users. Nick Donatiello, a market researcher who surveys consumer attitudes about new technologies, said subscription fees might work in a special case like The Journal, but would remain rare. ``Consumers can surf the whole Web for less than $20 a month, so it's hard to convince them that they should pay for one little slice out of this enormous pie,'' said Donatiello, the president of Odyssey LP, a research firm in San Francisco. ``Paying for content is going to be dwarfed by having advertisers pay, not because the Web has a culture of free content, but because television has a culture of advertising-supported content.'' A message on the Journal's site (http://www.wsj.com) says, ``Avoid the rush and convert now to a paid subscription.'' The interactive Journal is charging $49 a year, or $29 to those who take the print Journal, which runs $164 a year. Neil F. Budde, the editor of the interactive edition, said many people were philosophically opposed to paying for information on the Web. But he said others would subscribe because of the site's features like Briefing Book, which offers news about a company, charts of stock performance and five years of financial data. ``These are not the people who have been on the Internet since Day One,'' he said. ``These are newer people, people who are in business, who say it's worth it not to have to look four different places on the Internet'' to find information that the Journal site pulls together. About 650,000 people registered during the interactive Journal's trial period. Thomas Baker, the business director of the interactive edition, said surveys of those users indicated 10 to 30 percent were willing to pay. ``If, at the end of the year, we had 20,000 to 25,000, that would be good,'' Baker said. ``We're realists. Our expectations are fairly modest. We look at this as a magazine start-up, and even successful magazines take a while to ramp up.'' Baker said only 20 to 25 percent of those surveyed subscribed to the print Journal. ``That helped allay people's fear of the cannibalization of the print readership,'' he said. When the site opened in April, it offered free access through July 31. That was extended to Aug. 31, then Sept. 21. The deadline to register was May 31, then June 30, then Aug. 1. There is still a loophole: Access to the on-line Journal is free through Dec. 31 to those who download the Microsoft Corp.'s Web browser, Internet Explorer. Also free: two-week trials of the Journal site. Barron's, a weekly that like the Journal is published by Dow Jones & Co., thought big when it announced its Web site in May, saying it planned to charge $99 a year for basic access, and even more for premium areas like an Investors Workstation. That would have made it the most expensive mass-market site on the Web. The plan has been rethought. Barron's Online (http://www.barrons.com) has remained free, and a spokesman said the future subscription price had not been determined. The Web site of The New York Times requires users to register but does not charge. About 600,000 have signed up since the site (http://www.nytimes.com) opened in January. ``Our view is that market share is a more important criterion for success than whether you can get a few people to pay for the service,'' said Martin A. Nisenholtz, the president of The New York Times Electronic Media Co. ``But we continue to evaluate our users' willingness to pay for information on line.'' The other best-known news sites, including those from CNN, USA Today, The Washington Post and The Los Angeles Times, are open to all. ESPN's site (http://espnet.sportszone.com) charges $39.95 a year for access to premium areas, including columnists. But that service, too, is free until the end of the year through Microsoft Explorer. Microsoft, meanwhile, has found an old-fashioned way to get some income from its on-line magazine, Slate: sell paper copies. Slate on Paper went on sale this month in many Starbucks coffee boutiques, and mail subscriptions are available. The 62-page digest of the on-line version is produced in Microsoft's print shop. The paper Slate is $29.95 a year. That's $10 more than the on-line version will be when it starts charging for access on Nov. 1. The site (http://www.slate.com) was started in June with great fanfare from traditional media, but it continues to be skewered in the on-line world. The September issue of Wired magazine inaugurated the Kinsley Deathwatch, a pool to predict when Michael Kinsley, Slate's editor, will return from Redmond, Wash., to the other Washington. Slate on Paper, which includes about one-third of the Web version, includes an editors' note heralding ``the transmutation of all-digital Slate to the fusty comfort of analog paper and ink.'' ``To the best of our knowledge, Slate on Paper is the first Webzine to reverse the process,'' the note says. ``Some say it is fitting for two companies so closely associated with the image of Seattle - Microsoft and Starbucks - to be be joining forces. Others say it is beyond parody.'' A parody site, Stale (http://www.stale.com) pretends to offer a printed version, ``thereby defeating the purpose of being on the Web.'' Rogers Weed, Slate's publisher, said the print edition was ``a bridge to the people that aren't on the Internet today.'' But how many Starbucks customers want Chechnya with their frappuccino? Even some of the chain's employees are puzzled. ``This is Starbucks coffee,'' said Carol Hensler, who worked at a store in Richmond, Va. ``We only have coffee and coffee products.'' --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

A Bizarre Increase in the Ad Hominems Here
by tcmay＠got.net 17 Dec '03

17 Dec '03

Must be the Ides of September, but there are several bizarre new attacks lately on this list, none of them to the point, just odd ad hominems: * Detweiler (vznuri(a)netcom.com) writes: "timmy waxes a widdle on AP" * Millie (pstira(a)escape.com) writes: "Timmy boy, I yelled at someone for this last week. And you supported my view. Never read Ayn Rand, eh?" (Sadly, a large fraction of the women who have posted on our list have written in this same kind of incoherent, rambling, makes-no-sense kind of style. I have no idea why the percentage of such events is so high.) * And of course Vulis has been posting his "farting" messages far and wide. Those who legitimately disagree with my arguments should of course continue to speak up. But those who confuse calling me "Timmy" with making substantive arguments need to go back to school. We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 7

[NEWS] Crypto-relavant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Financial Times: Thursday, September 5, 1996 Banking on the Internet: Any Time, Anywhere By George Cole When Claus Nehmzow wants to check his bank statements or pay a bill, he simply switches on a personal computer. He can also transfer money between accounts and make electronic payments from almost anywhere in the world because his bank is on the Internet, the worldwide network of computers. Nehmzow, a principal with the management and technology consultancy firm Booz-Allen & Hamilton, says: "I live in England but my account is in the US. If I can find a computer that's linked to the Internet, I can access my account any time and anywhere." About 50m people have access to the Internet but this number is expected to reach 200m within two years. This huge audience, the ability to offer a 24-hour service across borders and the potentially enormous savings in operational costs, have prompted many banks and financial institutions to consider hooking up to the Internet. But while the Internet offers many advantages, one issue makes many banks nervous -- security. The potential of millions of people gaining unauthorised access to sensitive financial information on the Internet, and then using it to commit fraud is so great that few banks are prepared to offer online services. A survey by Booz-Allen found that more than 600 banks had sites on the Internet's World Wide Web. However, almost three-quarters of the banks simply used their sites as "electronic brochures" to promote their services. Only 2 per cent of European banks and 1 per cent of US banks offered full banking services on the Internet. "Security is holding back many banks, but the sheer economics of the Internet will see many of them offering services on it," says Michael McConnell, vice-president of Booz-Allen. "The cost of an Internet banking transaction can be measured in cents, while the same transaction at a bank branch costs dollars. You can't ignore these kind of savings." Piero Verdiani, vice-president of Olivetti Systems and Services' professional services division, says the Internet offers an average saving of $1.20 per transaction when compared with using a traditional bank branch. "For a customer who makes five transactions a week this works out at $300 a year. A bank with 100,000 customers could potentially save $30m a year," he says. Nehmzow believes that many of the concerns about security are more an issue of perception than of real obstacles: "People hear about hacking and get worried. Yet many people will happily give their credit card numbers over the phone, knowing that if anything should go wrong, their credit-card company will accept most of the liability. The same could happen with electronic banking." Some banks have opted for privately-owned online services rather than the Internet. The UK-based TSB bank, for example, offers its customers an electronic-banking facility called PC Banking, through the CompuServe online service. "It's a step-up from the Internet in terms of security, but in the long term, the Internet will be an important agent for financial services," says Bill Goodland, product manager for CompuServe's financial services division. Barclays is piloting a similar PC-based banking service for personal customers. The system, launched in February and developed with Visa Interactive, runs from Barclays software on a Windows-compatible PC and modem from customers' homes or offices. The attraction of the Internet is that users do not need to access proprietary PC banking software or special online services to carry out banking transactions. Nehmzow's electronic bank is the Security First Network Bank, based in Atlanta, Georgia. SFNB, which claims to be the first Internet bank, opened for service in October 1995. It has more than 2,000 customers, mostly professionals aged between 26 and 55. The SFNB uses a number of security features, which include issuing each customer with a personal identification number (Pin) and encrypting or scrambling any data that is sent over the Internet. The bank's internal computer network is protected by a "firewall" which filters all electronic traffic. This month, the US bank First City Bank and Trust plans to launch an Internet banking service using similar security facilities. In the UK, Midland Bank is working with Microsoft in order to offer Internet banking. Olivetti, and Sparekassernes Data Center, a consortium of 80 Danish savings banks, have formed a joint venture called FIT (Financial Internet Technology). FIT has developed E-Bank (Electronic Bank), a system which uses the Internet for banking from home, and offers various levels of security, including passwords, PIN codes and encryption. Some believe that Internet banking will take off when there is widespread use of a technology known as public-key cryptology. A key is a complex mathematical number that may be many hundreds of digits in length, creating hundreds of billions of potential combinations. The key is divided into a public key and a private key. The public key is available to anyone, and may be printed in a directory or even posted on to the Internet. The private key is kept secret by the owner. A message is sent to the owner by encrypting it with his or her public key. Only the correct private key can decrypt it. The public-key system also makes it possible to produce a "digital" signature. "This is important, because a bank will need to be confident that it is communicating with the genuine customer, and the customer needs to be certain that he's dealing with his bank," says McConnell. "It also provides proof that the customer authorised a particular transaction." A digital signature is created by the sender, who encrypts part of the message with his or her private key. The recipient of the message uses the sender's public key to decrypt the segment and thus confirm the identity of the sender. The system will automatically operate whenever a message is being sent or received over the Internet. Public-key systems will also be used for credit-card transactions. Visa International and Mastercard International have joined forces with a number of companies including GTE, IBM, Microsoft and Netscape to develop SET (Secure Electronic Transactions) which will allow users to make secure credit-card payments over the Internet: "It will mean that someone making a $ 10 transaction won't get billed for $10m," says Bernard Ovink, senior manager of Visa's electronic commerce division. SET is due to come into operation in late 1997. There are many encryption systems available, including several developed by RSA Data Security, based in Redwood California. RSA is providing the encryption technology for SET. The power of a key is measured in bits - an eight-bit key offers 256 possible combinations, while a 40-bit key has more than 1,000bn combinations. Some 40-bit keys have been cracked by cryptology enthusiasts, causing some to question the security of public-key systems. But McConnell says this fear is misplaced: "It took months to crack each key and a tremendous amount of computing power. But the question is: was it worth all the effort? It's like spending $100 to counterfeit a $ 20 bill." McConnell foresees a time when many people will have their own public and private keys: "I think you'll get an agency such as the Post Office distributing the keys to the public, and then financial organisations will use them to create online banking and other services. This is going to happen sooner than some people think." . American Banker: Thursday, September 5, 1996 OCC Allows Internet Access Plan, Eyeing Competitive Edge for Banks By OLAF de SENERPONT DOMIS A small bank in Pennsylvania has won the first regulatory approval to sell Internet access to the public, which could attract customers to on-line banking and other electronic services. The decision, released Tuesday by the Office of the Comptroller of the Currency, could help national banks compete with nonbank providers of on-line financial services, experts said. "The OCC is aggressively pushing the envelope with this decision, because it's allowing a service not directly related to banking," said Charles M. Horn, a partner at Mayer, Brown & Platt, a Washington law firm. "It is part of a natural progression toward letting banks expand the way they provide financial services." "The comptroller has recognized the critical importance of technology to the future of the banking industry," agreed Robert G. Ballen, a partner at the Washington law firm Schwartz & Ballen. "This is consistent with the comptroller's concern that banks be able to effectively compete with nonbanks." In an Aug. 19 letter to Apollo Trust Co. in Apollo, Pa., the OCC told the $105 million-asset bank it could sell general Internet access to anyone in its western Pennsylvania service area. The bank also was given permission to give free Internet access to schools, government offices, libraries, churches, and various nonprofit organizations. "We have a long-standing precedent of allowing banks to use the excess capacity of their physical facilities, and this ruling translates those old precedents into the technology world," Comptroller Eugene A. Ludwig said in an interview Wednesday. "Making sure that banks use things as efficiently as possible is a win-win for everybody - the bank, its customers, and the community. "This is very symbolic of how the use of the electronic media can help banks of all sizes provide products and services to customers." Viveca Ware, director of payment systems at the Independent Bankers Association of America, said, "Not only does this open the door for banks to compete with nonbank Internet service providers, it opens up a whole new realm for banks to offer new services to their communities." Separately, the OCC approved a request by Huntington National Bank in Columbus, Ohio, to enter into a joint smart card venture with the Student Loan Marketing Association and Battelle Memorial Institute, a Columbus, Ohio-based technology research organization. Huntington has said the venture, to be based in Columbus and named Cybermark, will develop, market, and maintain stored-value card systems for self-contained communities such as universities, hospitals, theme parks, and military installations. Apollo already allows its customers to transfer funds, apply for loans, and view account balances via the Internet. Apollo purchased powerful computer equipment to provide these services and has the excess capacity to provide a gateway to the Internet. Ray Muth, the bank's executive vice president, said Apollo plans to entice new customers to its computer banking products by offering Internet access. "This is an absolutely golden opportunity for us," Mr. Muth said in an interview. "We'll increase our profitability by developing new customer relationships." The OCC concluded that offering Internet access to the public is part of the business of banking because it satisfies three criteria. First, it allows banks to provide more convenient service to customers. Second, the OCC argued that full Internet access is needed to let banks market their electronic banking services. Third, the OCC said that because the computer hardware Apollo purchased had extra capacity, the bank ought to be able to use it profitably. In the interview, however, Mr. Ludwig said banks cannot purchase computer equipment solely to offer customers Internet access. News Release(Online Resources): Wednesday, September 4, 1996 Online Resources to Provide Transaction Link to AOL Online Resources & Communication Corporation, one of the leading providers of interactive financial services, announced today that it has entered into an agreement with America Online Inc., the world's largest consumer online service, to provide financial transaction capabilities to America Online's more than six million members. This agreement coincides with the launch of the AOL Banking Center, a focal point that gives AOL members access to financial institutions who participate in the AOL Banking Center. AOL members may visit their financial institution's virtual branch that resides within the AOL Banking Center. Online Resources will have a direct link to AOL, enabling clients who participate in the AOL Banking Center to offer real-time banking, bill payment and other transaction services to AOL members. "The power of transaction processing cannot be understated," said Online Resources CEO Matthew P. Lawlor. "The AOL members will return to their virtual branch again and again if it is their site for moving money, paying bills and getting current personal financial information. The cross selling opportunities for participating financial institution are enormous." Ted Leonis, president of the AOL Service Company, said, "Online Resources is one of the leading interactive financial services providers in the industry. Its focus on financial institutions and their transaction capabilities nicely complement our focus on consumers and their desire for value-added services." Online Resources provides consumer access to its financial institution customers through the PC via its PC Windows-based software or the World Wide Web, and through its ScreenPhone and touch tone telephones. AOL members requesting transactions or personal financial information from their virtual branch will seamlessly link-up to their financial institution through Online's Web site and return to the virtual branch in the AOL Banking Center when they have finished. America Online Inc., (NASDAQ Symbol: AMER), based in Dulles, Virginia, is the largest consumer online service in the world, with more than 6.2 million members worldwide. Through its services, AOL offers its subscribers a wide variety of services including electronic mail, conferencing, software, computing support, interactive magazines and newspapers, and online classes, as well as easy and affordable access to services on the Internet. Founded in 1985, AOL today has a global work force consisting of more than 5,000 people. Personal computer owners can obtain America Online software at major retailers and bookstores or by calling 800/827-6364. McLean, Va.-based Online Resources & Communications Corp. is a privately held company founded in 1989. It specializes in providing home banking, bill paying, investment and other financial services to financial institutions for resale under their own brand to consumers and small businesses. Online's clients include banks, brokerages, credit unions, ATM networks and other financial service providers. Currently, Online has 40 institutional clients. Online provides financial institutions with extensive support services, such as consumer marketing, call center bill paying software or service, security and communications network management. Users of Online's services may access their financial institution through a variety of devices, including the PC, conventional telephones or the company's low-cost ScreenPhone. Easy, low-cost access to a variety of interactive financial services is supported through either private commercial networks or through the Internet. Online's Web site is www.orcc.com. News Release (Sanwa Bank): Wednesday, September 4, 1996 Sanwa Among First In U.S. to Offer AOL Subscribers Intuit Software Sanwa Bank California today became one of the first banks in the United States to offer online banking and bill payment to the more than 6 million subscribers of America Online (AOL) through a new computer program developed by the nation's leading maker of personal financial software. Developed by Intuit Inc., which also makes Quicken(R), the nation's most popular personal finance software, the new service has been dubbed BankNOW(TM) and is available to current Sanwa Bank customers who are subscribers to America Online, as well as to new customers who sign-up with America Online and Sanwa Bank. In conjunction with the introduction of BankNOW, Sanwa Bank has established a site on America Online to give current and prospective customers product and service information, as well as a point-and-click option for opening a new account. The BankNOW software can be downloaded from Sanwa's site on AOL free of charge. Sanwa helped pioneer PC banking a year ago when it teamed with both Intuit and Microsoft Corp. to offer customers a PC home banking option. At the same time, it launched its site on the World Wide Web(http://www.sanwabank.com), one of the first to offer consumers the option of applying for loans, credit cards and other services through the Internet. "BankNOW is online banking software created expressly for convenience- oriented PC users who want a fast, simple and hassle-free way to conduct online banking and payment transactions," said Kathleen Graham, vice president for retail banking at Sanwa. "It is a natural outgrowth of our already state-of-the-art electronic banking capability." Sanwa customers who sign-up to use BankNOW will have the following options available: -- Access to accounts day or night. -- Reconcilement of accounts automatically. -- Review of account balances. -- Online transfers between linked accounts. -- Write checks and pay bills to anyone or any creditor in the U.S. -- Send e-mail to communicate with Sanwa. As an additional inducement to sign-up, and in conjunction with its One Market Value account, Sanwa is offering a package of incentives, including fee-free ATM withdrawals at all STAR(R) and CIRRUS(R) locations, fee-free online banking and bill payment for 12 months, free checking for a year, no-annual-fee credit cards and no-annual-fee overdraft protection. On the business side, Sanwa's small business customers also will benefit if they sign-up for the BankNOW feature. Current and new customers, who have standard small business accounts, will receive 12 months of free online banking through BankNOW. Among other available options to small business customers are a direct e-mail link to the Sanwa branch manager assigned to their account and online banking at the special reduced rate of $7.95 for the first 12 months. This special reduced price includes eight online banking sessions and 20 bill payments per month. "We believe this alliance will bring user-friendly electronic banking to millions of consumers -- both personal and small business -- who might not otherwise have ever considered it," said Doug Stewart, first executive vice president. "It is another step toward reinforcing our campaign to remain one of the leaders in electronic banking throughout the U.S." American Banker: Thursday, September 5, 1996 On-Line Banking: Comerica Worker Moonlights in Cyberspace By JENNIFER KINGSON BLOOM By day, Frank De Armas is a foot soldier in Comerica Inc.'s information systems department. By night, he sheds his pinstripes, grabs his mouse, and becomes host and editor-in-chief of The Internet Banker, an on-line magazine, bulletin board, and resource center for people interested in what banks are doing in cyberspace. "It's like a clearing house for information on banking," Mr. De Armas said. "It started out as a little, tiny, part-time thing, but it just keeps growing." So much so that Mr. De Armas, a senior applications engineer for Detroit-based Comerica, now spends four hours a night at his home computer maintaining the Internet Banker site. He said it takes an hour to check all his links to other bank-related sites and to make sure that all the banks clamoring to be connected are added to the growing list. The other three hours are spent compiling a daily on-line banking newsletter, assembling a quarterly journal, and responding to questions that readers tack onto the site's bulletin boards. "If I know the answer, I post it," he said. The site grew out of Mr. De Armas' development last year of Comerica's Web site. He wanted to keep track of what other financial institutions were doing on the Internet, adding bank- and financial-related sites as he came across them. Then other people discovered his site and started using it. What began as a research tool "has taken on a life of its own." Bankers use the bulletin boards for global shop talk. In a recent posting, a Missouri banking regulator wrote to ask about the delivery of electronic banking services to rural areas. An Israeli economics student asked if people think the Internet will make "normal banks as we know them today disappear." A New Zealand banker named Lew solicited tips on boosting staff morale during a merger. A banker from Connecticut named Tom responded that "communication" and dress-down days had helped morale during his bank's merger. Then Mr. De Armas weighed in. "Tom has a good point," he wrote. "Anything you can do to make the employees feel more at ease will help. Stress is a natural byproduct of mergers." Trading insights has been the hobby's greatest pleasure for Mr. De Armas, an affable 35-year-old who taught himself to program computers in the Basic language while on injury leave from the Army. Mr. De Armas now knows several programming languages, and is an on-line veteran. "I was probably one of the only ones who used to get on chat lines on Prodigy at 1,200 baud," he recalled. His Web site radiates enthusiasm for the medium. In a page of tips about how to design a good site, he offers suggestions on how to link an electronic-mail address to a Web page, deftly suggesting: "The HTML code for this is easy." (HTML, or hypertext markup language, is the design language for Web sites.) For the less computer literate, Mr. De Armas' site offers a readable electronic magazine -- which he writes and edits -- on Internet-related banking issues. A recent issue included a question-and-answer session with one of the designers of BankAmerica Corp.'s Web site and a review of the site -- both presented in Mr. De Armas' effusive style. "You can't help but be impressed with BofA's site," he wrote in his review. "I tested the response time of the site at 9,600, 14,400, 28,800, and of course our leased line. ... My congratulations to the staff of BofA for a fine site." Stephen Hugley, senior vice president and manager of information services at Comerica, calls Mr. De Armas "one of our more literate client/server technicians. "He was instrumental in putting together our Web site, and he is also instrumental in helping other areas of the bank when they have Internet- type questions or issues," Mr. Hugley said. "It's a joy to work with somebody like Frank because he really has a good vision of where the Internet is going and what it's value will be." The Internet Banker site (www.ddsi.com/banking/) which now fields more than 20,000 hits a week, has won two awards and garnered several speaking invitations for its creator. Mr. De Armas' wife, Janice, runs a companion Web site called Metro Online, which contains information and listings about Detroit-area happenings. "You meet all kinds of people on the Web - it's amazing," Mr. De Armas said. "Just think of it as a big neighborhood." Among his electronic acquaintances is Tony Plath, director of the University of North Carolina's Center for Banking Studies. Mr. Plath's banking students use the Internet Banker site to collaborate on projects. "The real value in Frank's Web board is that a lot of bankers are point- and-click type Web users - they don't know how to post their own home page in HTML, and they don't have time for it," Mr. Plath said. "This allows you to post messages that people can read and to maintain threads of discussion." Bradley Streeter, a community reinvestment and development specialist with the Kansas City, Mo., outpost of the Office of the Comptroller of the Currency, views the Internet Banker site as a "wonderful research tool." "I was interested in how banks are using the electronic forum to reach low and moderate-income people," he said. "It helped inform me on what other people are thinking about the issue." Bill Burnham, a banking consultant at Booz-Allen & Hamilton, uses the site regularly. "I check it because they catalogue the top 100 banks on the Internet," he said. "I refer people to it as well." Most of the site's content is free, but Mr. De Armas does charge for his daily newsletter. Colleagues at Comerica receive complimentary subscriptions. And he has been attracting sponsors to his banking site. One advertiser, the principal of a Detroit-based brokerage firm, said the response has exceeded newspaper ads. "I was amazed," said the principal, Michael H. DeLap. "I thought I would put something out there in cyberspace and never hear anything about it again." Mr. De Armas is not the first person whose professional interests led him to develop his own cottage industry. Comic strip fans can look to Scott Adams, the creator of "Dilbert," as someone who created an unlikely career out of a straitlaced corporate job - at Pacific Bell. Mr. De Armas said he is content to stay in banking and enjoy the kudos on his Web site. "They love it here at Comerica," he said. "My management is really happy. It showed a little initiative." --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: 56 kbps modems
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 16 Sep 1996 12:16:08 +0200, Gary Howland wrote: >craigw(a)dg.ce.com.au wrote: >> well here in Australia Telstra our national carrier only "garantees" >> 2400 baud to work. >As I am sure has been discussed at length before, baud does not equal >bps. AFAIK, V32bis is only 2400baud. This is correct. The difference is in the number of values for each of the 2400 signals sent per second. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

WARNING: Major Net-Abuse
by Z.B. 17 Dec '03

17 Dec '03

I don't know the full details about this, so I'll try to give as good an explanation as I can. Since sometime yesterday, someone has been posting huge binaries all over Usenet, usually to at least 20 groups at a time. The files are usually several thousand parts big at the least, and are posted to either groups in which people are likely to respond with emailbombs, or test groups that send you a reply if the message appears on them. What some $#&!@-heads are doing is changing the Reply-To headers to the addresses of people who they dislike or want to harass. See where I'm going now? 10000 posts to a test group with your address on it = 10000 emails in your inbox. I posted this because there are some people on both of these lists who might be the target of one of these spams, and you might want to get your killfiles ready, just in case. Thanks for your time, and sorry if I annoyed anyone with the off-topic post. --- Zach Babayco zachb(a)netcom.com <----- finger for PGP public key http://www.geocities.com/SiliconValley/Park/4127

1 0

Re: The GAK Momentum is Building...
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Tue, 17 Sep 1996 21:02:03 -0700, Lucky Green wrote: >>On Tue, 17 Sep 1996, Timothy C. May wrote: >> However, making the government a _required_ part of such plans implies a >> motive that is not at all the same as what companies wish (mostly, disaster >> recovery). > >The required part will come later. Meanwhile, many big players in the >industry are volunteering to include GAK for you. It seems that in order for this to work Net consumers must be convinced/coerced into accepting the GAK security features. What if, due to a grassroots uprising, Neters refuse to use products which require GAK or Net services which will only operate via GAK? Isn't there an great opportunity being created for S/Wan, Apache and its ilk and third-party (especially off-shore, non-COCOM, produced) security plug-ins? > >When I asked the fellow from HP that proposed the CommerceNet position >paper how the "voluntary key recovery" he was proposing on his slides >could possibly aid law enforcement against criminals who obviously >wouldn't "escrow" their keys, he said, and I am not kidding: > >"There are many possible interpretations of the words voluntary and >mandatory." I was the *only* person in a room full of people working in the >industry that seemed bothered by this. > >> Furthermore, the main worry (for me, at least) is that the government hopes >> to get its Clipper IV scheme accepted (by means of export laws) at some >> large fraction of important corporate accounts, not the least of which will >> be Netscape, Microsoft, IBM, Oracle, Qualcomm, and suchlike major players >> in the "infrastructure" business. Once most of these have "bought off" on >> GAK, pressure will be intense to universalize the process, to make it a >> felony _not_ to use a "Key Authority." > >That's exactly how it will be. Enacting laws which make criminals out otherwise upstanding citizens is the surest path to civil disobedience/unrest, disrespect for duly constituted government and more serious criminal behavior. I guess I and many friends will be on posters in the Post Office. -- Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to perscription DRUGS.

3 2

Re: Workers Paradise. /Political rant
by Llywarch Hen 17 Dec '03

17 Dec '03

"In July, Mr Lee [Kuan Yew, senior minister of Singapore] described an insight that came to him watching a sheepdog show in Australia. You start off with a group of young puppies, and 'weed out those who are not going to be successful . . . You either have those qualities or you don't.' It was, said Mr Lee, 'the simplest of all the lessons in life.' From _The Economist_, September 14th 1996. -- Llywarch Hen

1 0

Re: PGP in the workplace
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:20 AM 9/18/96, Rick Osborne wrote: >Upon explaining to them that I was simply trying to make sure of my own >security, I was told that I was to just assume that I was secure, and that >*any* 'poking around' was found to be "highly aggravating" and could only >only "exascerbate the situation further." > >Luckily, I had to get to class, so I cut the conversation before it could >get any more out of control. > >Now, seeing as I'm fairly new to the Corporate world, but is this something >common? I know when I was at college, poking around was expected and >encouraged, as it helped find and plug holes in the system. But this is >almost like some kind of protection racket here! Sadly, this is common. Anybody taking undo interest in security "must have something to hide." Be aware that the effects can be a lot worse than just "being noticed," or even of being dismissed. Companies have been known to call in the police. (And since you are posting with a "Grumman" account, this could trigger visits by the DIA and other such agencies.) This happened in a well-publicized case up north, and I am convinced (from reading some of the details) that the programmer was not doing anything criminal. Even many who worked with him have expressed the same views, that he was just an unusually curious and attentive security expert. Some of them tell me they--and their employer!--were surprised the case actually went to trial. But the DA decided, for whatever reason, to prosecute on felony charges. I can only speculate about the pressures, the desire for publicity in a trendy new area ("computer crime"), and about the relative importance of this employer to the local economy. So, don't get too curious. Don't change your passwords more than your neighbors do (or at least not more than 2.13 standard deviations more often than is the statistical average of all employee-units within 7 cubicles of you in all directions). And whatever you do, never, never, never point out security flaws. This is a sure sign of your guilt. Or your smarty-pants attitude, which is actually worse. (Never cast perls before swine.) (All of this is explained daily in "Dilbert," of course.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Codex Sample
by SpyKing 17 Dec '03

17 Dec '03

Attached... This communication is copyrighted by the author. 1996, All Rights Reserved. Interception, forwarding, posting/re-posting of all /or any part of of this message is a violation of U.S. Copyright laws and may result in civil or criminal action against violators. The Codex Surveillance & Privacy Newsletter - http://www.thecodex.com

1 0

Re: Quantum Computers
by Rick Osborne 17 Dec '03

17 Dec '03

I rather enjoyed this article, especially the part about: >It gets even wilder, because the quantum mechanical state of the >matter in the machine's memory determines the output, Seth Lloyd >of MIT thinks you could run the machine in reverse and the result >would be a quantum mechanical micromanipulator. This was great! So where do we plug in the nice hot cup of tea? ;^) I'm sorry if I seem to be making light of a very serious topic, but, last time I checked, computers don't have a reverse. Spam me, flame me, whatever, but as far as I know, the universe only goes in one direction. It's just a rehash of the old sci-fi dramas about building a computer that goes on and builds a smarter computer, ad infinitum. That's one of the problems of non-sentient things: they can't grasp anything beyond their scope. But, for argument's sake, let's assume: 1. This quantum computer, which looks startlingly like my HP48, has a slider labeled: FORWARD -- STOP -- REVERSE And the slider actually works. 2. We are working with a finite-state quantum computer (say 32 qbits worth). 3. There is NO error introduced into the system from any source, including itself. Okay, so I turn my little QC48 on, just to set a state, and then slam the slider into REVERSE. AT this point, it fizzles and dies. Why? Because of the same reason you can't just put the DES algorithm 'in reverse': the quantum equivalent of s/p-boxes. What am I talking about? I'm talking about a QUANTUM COMPUTER here. Remember it's greatest asset? It does every calculation at once. This is exactly why you can't go backwards. You have nowhere to go, because you have EVERYWHERE to go. Because at each 'quantum tick' of the 'quantum clock' EVERY possible operation is going on, each state has the possibility of leading to every other state. Now, let's throw out assumption #3, and deal with a slightly more realistic version of my QC48, the QC48SX. Because we're dealing with a computer that produces error in it's own system, the error is going to be relatively hard to keep track of. Notice that the error-correction schemes listed don't eliminate error, they just help thin it out. So you've got your result to the operation you just performed: OP1 + OP2 + OPERR = RESULT The error-correction protocol makes OPERR small, but it doesn't eliminate it. So this is when I throw it into reverse. (Sure, I could have kept track of all my operations up to that point and trace back along them with no problem, but I can only do that until the point at which I turned on my QC48SX, so let's just assume I didn't keep track.) I've got RESULT now, and with a reasonable degree of accuracy, I can statistically figure out what two states led up to that point, with a margin of error STATERR. This is made even tougher by the fact that there was an error (OPERR) in the system to begin with. Remember now, every state can lead to every other state, but let's assume we've got NSA-level statisticians here, and STATERR is relatively small. You now have STATERR*OPERR working against you. This is where working in a finite-state machine is good, as it keeps these values relatively small. But they are still there. These errors, in combination with the quantum-s/p-box factor, precludes you from going backwards with any degree of reliability. Like I said, I'm not trying to tear down anyone hopes and ideas, I just want to introduce a little *reality* into our system. ____________________________________________________________ Rick Osborne osborne(a)gateway.grumman.com "Yes, evil comes in many forms, whether it be a man-eating cow or Joseph Stalin, but you can't let the package hide the pudding! Evil is just plain bad! You don't cotton to it. You gotta smack it in the nose with the rolled-up newspaper of goodness! Bad dog! Bad dog!" - The Tick

1 0

Re: Redundancy in XOR encryption
by Brian Durham 17 Dec '03

17 Dec '03

1 0

Re: Fear of Flying -- from HotWired
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Tue, 17 Sep 1996, Adamsc wrote: > >> On Thu, 12 Sep 1996 12:03:18 -0700, Bill Frantz wrote: >> >> >>... former CIA director James Woolsey: responded with some seemingly >> >> gratuitous anti-Net >> >> rhetoric. Terrorists may use biological weapons like anthrax, he said. >> >> "Anthrax is colorless, odorless, and has a 90 percent lethality. One >> >> gram has 100 million lethal doses." Then Woolsey delivered the zinger: >> >> "The knowledge of how to make anthrax is widely available, including >> >> on the Internet." >> >> >Gee, biotech has come a long way. Now I can download the Anthrax DNA >> >sequence from the net and insert it in some carrier bacteria and start >> >making Anthrax bacteria. Neat! > >Culturing and growing anthrax is painfully simple. No DNA required. > >> >BTW - My dictionary says that Anthrax is primarily an animal disease which >> >only occasionally infects humans. It sounds like a poor choice for bio-war >> >terror. > >Incorrect. It is highly problematic and very nasty when it is properly >delivered. The hardest thing about anthrax is to get an areosol fine >enough to present an inhalation risk. (This is why it does not >generally cause problems in humans- it's rare for it to get this fine). > Why not learn from the pros: IRAQI BIOLOGICAL WARFARE [BW) DEVELOPMENTS Filename:0119pgv.00p [ (b)(2) ] [ (b)(2) ] SUBJ: IRAQI BIOLOGICAL WARFARE [BW) DEVELOPMENTS 1. [ (b)(1) sec 1.3(a)(4) ] IRAQ ACQUIRED FORTY HIGH PERFORMANCE AEROSOL GENERATORS IN THE SPRING OF' 1990 OSTENSIBLY FOR SPRAYING CROPS WITH PESTICIDES. THE GENERATORS WERE CUSTOM BUILT TO DELIVER EITHER LIQUID OR DRY MATERIAL EITHER SIGNLY OR SIMULTANEOUSLY. THE GENERATORS CAN DISTRIBUTE FIFTY LITERS PER MINUTE [3-,0O0 LITERS PER HOUR OR APPROXIMATELY 800 GALLONS PER HOUR) THROUGH A CUSTOM DESIGNED NOZZLE[S] WHICH PERMITS THE AEROSOL TO BE ADJUSTED TO TEN DIFFERENT PARTICLE SIZES. THE DISSEMINATION OUTLET CAN BE ROTATED ONE HUNDRED AND EIGHTY DEGREES THEREBY ENABLING DISSEMINATION HORIZONTAL TO GROUND OR WATER SURFACES, OR UPWARDS AT AN ANGLE PERMITTING PREVAILING WINDS TO CARRY THE AEROSOL. THE IRAQI ENTITY WHICH ACQUIRED THE AEROSOL GENERATORS IS NOT KNOWN AT THIS TIME BUT COULD VERY WELL BE CONNECTED TO THE IRAQI BIOLOGICAL [ (b)(2) ] WARFARE BW PROGRAM. 2. THE AEROSOL GENERATORS ARE OF SUCH--SIZE TO FIT ON THE BACK OF A PICKUP TRUCK OR A SMALL ALL-TERRAIN VEHICLE, A SMALL BOAT, OR SMALL AIRCRAFT. THESE UNITS WOULD BE SUITABLE FOR THE DISPERSAL OF BW AGENTS IN EITHER LIQUID OR DRY FORM. THE ABILITY TO DISPENSE SIMULTANEOUSLY TWO BW AGENTS AT THE SAME TIME. SUCH UNITS, HOWEVER, WOULD THEMSELVES BECOME HEAVILY CONTAMINATED DURING USE AND WOULD REQUIRE DECONTAMINATION TO RENDER THEM SAFE. PERSONNEL OPERATING SUCH UNITS WOULD AT A MINIMUM NEED TO WEAR A PROTECTIVE OVERGARMENT A CHEMICAL AND BIOLOGICAL WARFARE MASK, AND UNDERGO THOROUGH DECONTAMINATION AFTER DISPENSING THE AGENT(S) . DECONTAMINATION OF THE AEROSOL GENERATORS AND TRANSPORT VEHICLES WOULD LIKELY HAVE TO ACCUR NEAR THE AREA OF OPERATION AT REMOTE LOCATIONS SO AS TO MININIZE INCIDENTAL CONTAMINATION OF IRAQI FORCES. 3. THE IRAQIS HAVE TWO CONFIRMED BW AGENTS--ANTHRAX AND BOTULINUM TOXIN. ANTHRAX CAN BE4 DISSEMINATED BY AEROSOL GENRATORS EITHER AS A FREEZE-DRIED POWDER OR AS A LIQUID SUSPENSION. THEORETICALLY BOTULINIUM TOXIN CAN BE DISPENSED AS EITHER A FREZE-DRIED POWDER, PROBABLY IN COMBINATION WITH A FILLER, OR AS A LIQUID. THE MORE LIKELY OF THE TWO CHOICES FOR BOTULINUM TOXIN IS DISSEMINATION AS A POWDER. POWDERS ARE EASILY MIXED WITH FILLERS, POSE A CONSIDERABLY GREATER THREAT THROUGH INHALATION, AND ARE BETTER ABLE TO WITHSTAND THE SHEAR FORCES EXPERIENCED WHEN DISSEMINATED THROUGH NOZZLES WITH A RELATIVELY SMALL ORIFICE. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to perscription DRUGS.

1 0

Re: Redundancy in XOR encryption
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > > > Compress P to get perfect compression (ie. 0 redundancy) > > Encrypt F (the compressed text) using a repeated key XOR > > > > of course this is all rather theoretical as there is no such thing as > > perfect compression, but I just thought it might be interesting to > > see if this is indeed strong, superficially it appears so to me... > > > > Paul: > I think that if the cryptanalyst knows that F has zero redundancy > that he can run searches from 0 to n bits for the key and have > the computer flag solutions that have zero redundancy. I never though of that. > I also think that a perfectly compressed file would have a relative > entropy value close to one also, hence the computer could flag possibles > that have both characteristics. yeah, these two are reasonably unlikely to occur together (only a reasoned guess, anyone got any comments on this?) so we really have a weakish system. > Hence, instead of searching for plaintext by counting coincidences, > we are searching the decrypts for solutions that have zero redundancy > and a relative entropy value close to one. How many solutions will > have both these qualities? I don't know. But if the compression method > is known, brute force will be tried, and only having to try to > decompress (read) data that has the resultant characteristics > of compressed information will speed things up by quite a bit. Yeah, this is still a form of brute force but I was thinking of this in terms of a smallish (sub 200 bit) key, so brute force against solutions with 0 entropy is a realistic possibility. anyone else got a faster way to attack this highly theoretical, will-never-be-implemented, type system?? I`d imagine there is some sort of way to measure the entropy "mixed in" by the XOR thus giving a foothold in the key, but I can`t think of anything right now, anyone got any ideas? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

1 0

Eudora 3.0 supports multiple tentacles
by Greg Broiles 17 Dec '03

17 Dec '03

Those of you who have or are tentacles (hee, hee) might take a look at the new Eudora 3.0 beta; it's got nice built-in support for multiple POP mailboxes/usernames, and keeps track of which identity received a messages, and sends replies from that identity (using the appropriate outbound SMTP server) so as not to confuse correspondents. It seems to be ideally set up for people who want to adopt an alternate nym for whatever reason. The filtering is also allegedly improved but I haven't fussed with that much yet. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Re: The GAK Momentum is Building...
by Greg Broiles 17 Dec '03

17 Dec '03

>>However, making the government a _required_ part of such plans implies a >>motive that is not at all the same as what companies wish (mostly, >>disaster recovery). > >the distinction lies in the terminology. what does it mean, "required >part of the plan". if it essentially amounts to nothing more than >the government saying, "you must give us keys when we present you >with a subpoena/warrant", then that's no different than the system >we have today. Hmm. The government sure is putting a lot of effort into moving us to a system that you say is "no different than the system we have today." As far as I can tell, you're the only one who thinks that. The government thinks that GAK is a big change, civil libertarians think GAK is a big change .. but you're welcome to call it "status quo" if it suits you. There's a world of difference between the government subpoena-ing something from me, where I can delay disclosure until I've exhausted my legal avenues to challenge disclosure, and the government demanding data from an at best disinterested third party who cares not at all if I get my day in court before they disclose. With the second scenario, I'm forced to try to "unring the bell", and somehow limit the spread of otherwise private/confidential data in a community (law enforcement) which is organized to collect and retain information. Ha, ha. Given today's Congress and Supreme Court, there's probably precious little chance that keys disclosed prematurely or erroneously won't be used to collect evidence which will be admissible despite the lack of meaningful opportunity to challenge the "recovery" of a key. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

SSN database scam?
by Gary Howland 17 Dec '03

17 Dec '03

Forwarded from www-security mailing list. Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 To: www-security(a)ns2.rutgers.edu Subject: Can you say "fraud"? (fwd) From: Mary Irene Wise <auntyem(a)umich.edu> Date: Tue, 17 Sep 1996 08:44:39 -0400 (EDT) Sender: owner-www-security(a)ns2.rutgers.edu This is probably a bit off-topic; if so I apologize. Can anybody comment on the item forwarded below my sig file? It claims there's a database w/ people's credit card no's etc on it and you have to give your name and social security number to get off of it. This strikes me as being a scam to get your ssn, but this went around at work and people are actually calling and giving it out. I know ssn's aren't really as secure as they're supposed to be, but still... So, does anybody know if this database is for real or if it's just a scam? TIA, Mary Wise --------------------------------- *** ------------------------------------ Mary Wise | Computer Systems Specialist * auntyem(a)umich.edu LSA Information Technology | homepage not availabe at this time 3557 LSA Bldg 1382 * University of Michigan | (313) 647-6230 * | --------------------------------- *** ------------------------------------ ---------- Forwarded message ---------- > > > Your name, social security number, current address, previous addresses, > mother's maiden name, birth date and other personal information > are now available to anyone with a credit card through a new Lexis database > called P-Trax. As I am sure you are aware, this information > could be used to commit credit card fraud or otherwise allow someone else to > use your identity. > > You can have your name and information removed from this list by making a > telephone request. Call (800)543-6862, select option 4 and > then option 3 ("all other questions") and tell the representative answering > that you wish to remove your name from the P-trax database. You > may also send a fax to (513) 865-7360 or 865-1930. Include your full name and >ssn in the fax. You can also send physical mail to > > LEXIS-NEXIS > P.O. Box 933 > Dayton, Ohio 45401-0933. > > Sending physical mail to confirm your name has been removed is always > a good idea. > > As word of the existence of this database has spread on the net, Lexis-Nexis > has been inundated with calls, and has set up a special set of > operators to handle the volume. In addition, Andrew Bleh (rhymes with > "Play") is a manager responsible for this product, and is the person > to whom complaints about the service could be directed. He can be reached at > the above 800 number. Ask for extension 3385. According to > Lexis, the manager responsible is Bill Fister at extension 1364. > > I called this morning and had my name removed. The representative will > need your name and social security number to remove you from the list. > I suggest that we inundate these people with requests to remove our > info from the list and forward this e-mail to everyone we know. > > >----- End Included Message ----- > > > >Cheers . . . > >"The backup procedure works fine, but the restore is tricky!" >_____________________________________________________________________________ > | _ \ Amanul Haque > | | \ \ Pencom System Administration > | |_/__/__ __ 9050 Capital of Texas Highway North, Austin, TX 78759 > | _/ ___/| \ Email: ahaque(a)pencom.com > | | \___ \| \ \ Pager: (708) 643-7331 > |__| /____/|_|__\___________________________________________________________ > Pencom Web Page : http://www.pencom.com > > > >------------- End Forwarded Message ------------- > > > > > -=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- Nancy L. Cassidy University of Michigan LS&A Budget & Finance Team 2557 LSA Bldg. 1382 Tel: (313) 764-6465 Fax: (313) 764-2697 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: A daily warning regarding Timothy C. May
by DMiskell＠envirolink.org 17 Dec '03

17 Dec '03

>Timothy C. May is a lying sack of shit. Right. And you had to insult him through use of anonymous mail. Boy, you're real brave, shedding the light to the rest of the cypherworld in such a manner. Apologies for the spam, but there was no address, obviously. -- If in fact we are the only intelligent life on this planet, why the fuck are we in this goddamn mess? -- Find my public key on the World Wide Web -- point your browser at: http://bs.mit.edu:8001/pks-toplev.html

2 1

The daily warning about Timmy May, the lying sack of shit
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Timmy May proves that the Midwestern gene pool needs some chlorine in it.

1 0

Re: Fear of Flying -- from HotWired
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:21 AM 9/18/96 -0400, Black Unicorn wrote: >> On Thu, 12 Sep 1996 12:03:18 -0700, Bill Frantz wrote: >> >Gee, biotech has come a long way. Now I can download the Anthrax DNA >> >sequence from the net and insert it in some carrier bacteria and start >> >making Anthrax bacteria. Neat! > >Culturing and growing anthrax is painfully simple. No DNA required. Sorry Unicorn, you missed my point. (1) You need DNA to grow bacteria. You can get the DNA two ways. (A) You get a sample of the beast, or (B) You get a DNA sequence and then regenerate the DNA. (I don't think B is technically feasable yet.) (2) You can't send samples of the beast thru the net. ------------------------------------------------------------------------- Bill Frantz | "Cave softly, cave safely, | Periwinkle -- Consulting (408)356-8506 | and cave with duct tape." | 16345 Englewood Ave. frantz(a)netcom.com | - Marianne Russo | Los Gatos, CA 95032, USA

2 1

Re: 56 kbps modems
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

if nothing else, the availability of 56kbps on an analog line might get the telcos to bring the isdn prices down to some reasonable level, which at the moment, it is not, at least not in nyc. -paul > From cypherpunks-errors(a)toad.com Tue Sep 17 18:21:03 1996 > From: Adamsc(a)io-online.com (Adamsc) > To: "Bill Stewart" <stewarts(a)ix.netcom.com>, > "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> > Cc: "Asgaard" <asgaard(a)Cor.sos.sll.se>, "Enzo Michelangeli" <enzo(a)ima.com> > Date: Tue, 17 Sep 96 12:22:15 -0800 > Reply-To: "Chris Adams" <adamsc(a)io-online.com> > Priority: Normal > X-Mailer: Chris Adams's Registered PMMail 1.52 For OS/2 > Mime-Version: 1.0 > Content-Type> : > text/plain> ; > charset="us-ascii"> > Content-Transfer-Encoding: 7bit > Subject: Re: 56 kbps modems > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1107 > > On Sun, 15 Sep 1996 01:31:19 -0700, Bill Stewart wrote: > > >and still get the original 56kbps back out. But if they can, well, > >yee-hah, ISDN is nearly dead :-) (Not totally dead; the signalling is > >still useful for some applications, the convenience of two channels on > >one wire pair is nice, and the fact that people can get 56kbps without > Also, can't you add ISDN b-channels ? (I.e. get another 64kps channel) > >the phone company's help will pressure them into offering ISDN for > >a lower price in areas where the Phone Company's idea of "all the market > >will bear" is substantially higher than voice pricing.) > > ISDN is more elegant; this sounds like a 'kludge' of sorts. OTOH, we've all > seen how well a cheap kludge can do, right? > > # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp > # cadams(a)acucobol.com | V.M. (619)515-4894 > "I have never been able to figure out why anyone would want to play games on > a computer in any case when the whole system is a game. Word processing, > spreadsheets, telecoms -- it's all a game. And they pay you to play it." > -- Duncan Frissell > > >

2 1

Re: The GAK Momentum is Building...
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Wed Sep 18 08:48:43 1996 Tim May wrote: <...> > (BTW, I predict that the tainted term "key escrow" is now gone from the > official lexicon. I haven't seen the Clipper IV proposal, but I surmise > that the baggage the term "key escrow" carries means that some more > benign-sounding term will be used in the final proposal. Something like > "Key Recovery System." You heard it here.) I agree, and hope so. "Key Recovery," while not as Orwellian-sounding as "GAK," is a step on the path to honesty WRT the English language, though it's important to continually point out, as Tim did in his post, that *access* -- rather than just recovery -- is obviously what Mr. Freeh wants. I'd count this likely change in terminology as a "cypherpunk victory," albeit a very small and certainly a very hard-fought one. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj/vsG1lp8bpvW01AQFkhwP/XEkJkdXwYsdSM8kn+B3bR/bCDXaKgkIE p63RgjQ5C60byufXqlqitvuJPMuS19MRxlF7UXsXJXKY6Jm92Q45sQtLICsMqXhP /iJwDVYaEuDj24cFycsZjZMeT+xxnuy+OCuhKIEgKF6gjh2uEZxbCellCqJ86TPF XfPiQiTPBDo= =B2hR -----END PGP SIGNATURE-----

5 4

SPAMS
by Stephan Schmidt 17 Dec '03

17 Dec '03

Hi, please focus on the UPPER written text at the bottom. I think they take it _much_ to easy. -stephan ---------- Forwarded message ---------- Date: Sun, 15 Sep 1996 17:55:57 +0000 From: Mailer <Mailer(a)aol.com> To: LISCIFI(a)AOL.COM Subject: Hi! Pardon the intrusion. Market study shows this may be of interest to you. If you have received this message in error, please hit delete. *********************************************************** A Personal Invitation Stop working for someone else! Put yourself in a position to leave the 9-5 grind behind!!! We invite you to listen to the most extraordinary and most powerful wealth building opportunity in the world and within a few minutes you will actually hear: * How you can make profits of $10,000 within the next 30 days! * You never have to leave your home! * A financial strategy 100 times more powerful than MLM or ANY OTHER BUSINESS! * Where you are paid directly and daily! (Don't wait for a company to pay you!) This is not MLM! This is not a pipe dream! This is a real business venture! 800-995-0796 Ext 9263. ************************************************************** ANY EMAIL ADDRESS PUBLISHED ON THE INTERNET THAT INVITES COMMERCIAL SOLICITATIONS IS DEEMED AS A COMMERCIAL ADDRESS, AND AS SUCH IS ELIGABLE FOR ETHICAL AND LEGAL EMAIL SOLICITATIONS FROM DIRECT ELECTRONIC MAIL MARKETERS. IF FOR ANY REASON YOU OBJECT TO RECEIVING THIS MESSAGE PLEASE POLITELY REQUEST REMOVAL FROM MY LIST BY CLICKING ON THE REPLY BUTTON AND ENTERING "REMOVE" IN THE SUBJECT LINE. IF YOU DO NOT DO SO, I MUST ASSUME YOU WISH TO RECEIVE FURTHER MAILINGS.

1 0

Cognitive Bias and Software Development
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

This reference was chopped from the bottom of a previous message. Communications of the ACM issue on Cognition and Software Development "Developers' thought processes are a fundamental area of concern. Cognitive scientists have discovered that people's intuitive inferences and probability judgments do not strictly conform to the laws of logic or mathematics, and that people are willing to provide plausible explanations for random events. This article examines the role these phenomenon might have in software development, ultimately concluding that what are cast as one-sided software development guidelines can be recast beneficially as two-sided trade-offs" Cognitive Bias in Software Engineering Webb Stacy and Jean MacMillian Communications of the ACM June 1995/Vol 38, No. 6 The article contains several good example of various classes of bias, including the representativeness, availability and confirmatory bias. While the article specifically adresses issues within the context of software development, all of these biases are general in nature and have correlates in other fields. Ciao, James Great minds think alike. Fools seldom differ. - Anonymous

1 0

Re: Spam blacklist project
by Duncan Frissell 17 Dec '03

17 Dec '03

hallam(a)ai.mit.edu writes: > Well if some people find it amazing that there are people out there > who agree with the 98.8% of people who did not vote Libertarian at the > last election then so be it. Course half the eligible population didn't vote at all obviously favoring market and personal approaches over political methods of governance. DCF

2 1

Mercenaries
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:40 PM 9/17/96, William Knowles wrote: >On Tue, 17 Sep 1996, Michelle Thompson wrote: > >> Interesting information from a friend of mine- >> >> >An american can not serve for pay for a position in another military >> >that could be filled by local populace. I may have my jurisdiction >> >wrong tho, this could be an international law not a US law. >> >Basically, you can't go be a grunt or an assasin in another country, >> >because they can find their own, As to Michelle's point that Americans cannot serve for pay in other militaries, there are all sorts of waivers and "look the other way"s involved. For example, the retired American officer who became the top military man in Estonia (or one of the Baltic States)--while still retaining his U.S. citizenship. >What about the French Foreign Legion? or the Volunteers for Israel, >which isn't really a fighting force, but Americans can help keep >the Israeli army at a ready state. Israel is one of several states which the U.S. allows dual citizenship with. For political reasons, because of America's extermination of the Jews in WW II (Whoops, we were on the other side...so why do we have such a cozy deal with Israel, but not with, say, France? Beats me. Politics.) Brian Davis, our former Prosecutor, can tell us how likely it is that any person would be charged and brought to trial for being a paid mercenary for some small country in the Third World. The CIA is often behind such mercenaries, so national security issues could make the issue murky. But the real reason such prosecutions are rare is that the government realizes how Orwellian it sounds to say: "You are being prosecuted because you were a mercenary for Oceania in its war with Eastasia. While Oceania was once our ally in our battle with Eastasia, and we endorsed and financed your role as a mercenary, we became allies with our great friend Eastasia and are now in a state of war with the tyrants of Oceania." >Explicit isn't a dirty word, Or is it? AOL has declared "explicit" to be a Banned Word, along with "pissant," "craps," and "cock," and numerous other such ordinary words. (So much for mentioning their pissant policies, a game of craps in Las Vegas, or a male chicken.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

RE: Redundancy in XOR encryption
by geeman＠best.com 17 Dec '03

17 Dec '03

in any practical or semi-practical application, you'll have to have a way to decompress the perfectly compressed data. A dictionary? A Huffman-tree-ish sort of thing? Are you going to transfer it out-of-band? **It** becomes the target of interest. ---------- From: paul@fatmans.demon.co.uk[SMTP:paul@fatmans.demon.co.uk] Sent: Tuesday, September 17, 1996 12:33 PM To: cypherpunks(a)toad.com Subject: Re: Redundancy in XOR encryption > > > > Compress P to get perfect compression (ie. 0 redundancy) > > Encrypt F (the compressed text) using a repeated key XOR > > > > of course this is all rather theoretical as there is no such thing as > > perfect compression, but I just thought it might be interesting to > > see if this is indeed strong, superficially it appears so to me... > > > > Paul: > I think that if the cryptanalyst knows that F has zero redundancy > that he can run searches from 0 to n bits for the key and have > the computer flag solutions that have zero redundancy. I never though of that. > I also think that a perfectly compressed file would have a relative > entropy value close to one also, hence the computer could flag possibles > that have both characteristics. yeah, these two are reasonably unlikely to occur together (only a reasoned guess, anyone got any comments on this?) so we really have a weakish system. > Hence, instead of searching for plaintext by counting coincidences, > we are searching the decrypts for solutions that have zero redundancy > and a relative entropy value close to one. How many solutions will > have both these qualities? I don't know. But if the compression method > is known, brute force will be tried, and only having to try to > decompress (read) data that has the resultant characteristics > of compressed information will speed things up by quite a bit. Yeah, this is still a form of brute force but I was thinking of this in terms of a smallish (sub 200 bit) key, so brute force against solutions with 0 entropy is a realistic possibility.

1 0

RE: Workers Paradise. /Political rant.
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

snow <snow(a)smoke.suba.com> wrote: > Actually, don't some wealthy Canucks come south of the border for > certain treatments unavailable in the Great White North? Yes, some wealthy (and not so wealthy people) go south of the border for treatment. Some go because the treatment is unavailable here, others go if they chose not to wait for treatment here. The most common types of exported services are usually high cost and/or experimental but their availability is most often constrained by the low number of people who are qualified to render the service. Many services unavailable in a patient's local area are still covered by provincial health plans. This works when a patient has to travel from a remote region, to another province or to the U.S., and can cover experimental treatments. Some Canadian hospitals make use of U.S. care providers for services when a backlog exists in Canada. For example, Windsor has used Detroit MRI services to reduce waiting times. There are also people who go the other way (U.S. to Canada), usually when they have to pay their own bill. Detroit to Windsor is again not uncommon. > Are the PRICES as high in Canada as here? In general, prices are lower in Canada for the same level of care. I do not know if the underlying costs are also lower in general. Each province create a payment schedule for services that it reimburses. Hospitals bill the province for services, but all capital cost items (e.g. equipment, buildings) must be paid for from other sources (e.g. donation). Thus, we tend to have fewer capital intensive treatment facilities since the ROI is usually low. The figures that I have seen indicate that the U.S. pays 40%-50% more than Canada on overall health care services. Some of this is due to the rapid availability of higher cost/experimental services. Some of this is due to the higher cost of the administrative bureacracy. Due to the large difference in total costs, I do not think that travel in either direction significantly effects this number. Ciao, James Check out www.spinex.com for more effective alternatives to MRI for diagnosing spinal function at 1/20th of the cost. P.S. No, Canada is not perfect, and I don't know everything.

1 0

[joke, non-code] Re: Get this for a snake-oil example :)
by f_estema＠alcor.concordia.ca 17 Dec '03

17 Dec '03

On Wed, 18 Sep 1996, Benjamin Grosman wrote on coderpunks: > Hey there...thought I'd drop this in to you... > someone I know is in the process of being set upon by a shamster (well, ^^^^^^^^ Shamster: SHA-enabled biocomputing hamster. Distantly related to Shneier's DESosaurus. Cute, cuddly and mathematically secure and authentic. I leave to the imagination its input and output processes. Eats snake oil for lunch.

3 2

Re: The GAK Momentum is Building...
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:49 PM 9/18/96, Declan McCullagh wrote: >On Tue, 17 Sep 1996, Timothy C. May wrote: >> >> (BTW, I predict that the tainted term "key escrow" is now gone from the >> official lexicon. I haven't seen the Clipper IV proposal, but I surmise >> that the baggage the term "key escrow" carries means that some more >> benign-sounding term will be used in the final proposal. Something like >> "Key Recovery System." You heard it here.) > >I agree, of course. But Gore's office has been telling me about the "Key >Recovery System" for months. It's nothing new in the DC cryptolexicon. Yeah, I shouldn't have added the "You heard it here" line, implying I had invented the term. As others have noted, this seems to be the new term for key escrow. The brainwashing must've taken hold on me, and as a good citizen-unit I had absorbed the message: "Key Recovery is Security, Ignorance is Strength." --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Cryptologie: Conference internationale - 25 SEPT - Paris
by Jerome Thorel 17 Dec '03

17 Dec '03

(message sent to interesting persons - bcc: field) Conference The Public Voice and the Development of International Encryption Policy Sponsored by Electronic Privacy Information Center Global Internet Liberty Campaign Internet Privacy Coaltion Open Society Institute - Soros Foundation Planete Internet September 25, 1996 Centre de Conférence Internationale 19 Avenue Kleber, Paris 16, France Program, registration and further information (English): http://www.epic.org/events/crypto_paris Or (French) http://www.netpress.fr/crypto PARIS, September 16 The international developement of the Internet leads governments, users organisations and corporations to find a compromise for the use and disposal of encryption, which allows to keep the secrecy of digital communications. Governments want to keep the possibility to intervene on communications in order to fight computer crime. The industry (private companies) search a way to keep an eye on their communications' integrity not to erode their competitivity. And privacy organisations want to preserve citizens' privacy and freedom of speech in expression networks such as the Internet. Before a meeting of governmental experts (under the auspices of the OECD Sept 26, 27 in Paris), the Electronic Privacy Information Center, a Washington, DC-based organisation, asked scientists, international right jurists and associations to meet on September 25 for a conference. The conference will stresses on legal aspects of computer-based secrecy, based on propositions made by some countris to create a regime of "encryption under conditions" (encryption under control), on the Trusted Third Party Services (TTP) scheme. Companies that will keep encryption keys of corporations and individuals would have to keep them at disposition of law enforcement authorities. Who will play this TTP role? Which garanty for end users? EPIC asked the world's most valuable experts to answer these questions. PROGRAM SUMMARY find the whole and last one at http://www.epic.org/events/crypto_paris/schedule.html Cryptographers: Zimmermann (PGP Inc), Diffie (Sun, pub-key system inventor), Anderson (Cambridge U., UK), Blaze (Bell Lab), etc. Scientists and experts: Horibe (Hitotsubashi U.), Carpenter (IAB), Simons (ACM), etc. Privacy advocates from EPIC (Rotenberg, Banisar), ACLU (Steinhardt), Privacy International (Davies), and French League for Human Rights. Officials and/or governmental experts from : OECE crypto & security ad hox commissions, Attorney General Dept and High Court (Australia), Economic Ministry (Germany), Austrian Law Institute, etc. CONTACTS FOR INFO & REGISTRATIONS USA: EPIC: Mark Rotenberg <rotenberg(a)epic.org>, Dave Banisar <banisar(a)epic.org>. 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax) FRANCE Planete Internet (Net Press), Paris: Xavier Cany <cany(a)netpress.fr>, Jerome Thorel <thorel(a)netpress.fr>. 191 Av. Aristide Briand, F-94230 Cachan. +33 1 49 08 58 33 (tel), +33 1 49 08 58 31 (fax). Jerome Thorel * Planete Internet Journaliste / ID#72052 * Editor / Redak chef 191 Av. A. Briand * Tel : (331) 49085830 94230 CACHAN * web : www.netpress.fr

1 0

Re: SSN database scam?
by Jim Byrd 17 Dec '03

17 Dec '03

At 01:22 PM 9/18/96 +0200, Gary Howland <gary(a)systemics.com> forwarded: >Forwarded from www-security mailing list. [snip] >Can anybody comment on the item forwarded below my sig file? It claims >there's a database w/ people's credit card no's etc on it and you have to >give your name and social security number to get off of it. This strikes >me as being a scam to get your ssn, but this went around at work and >people are actually calling and giving it out. I know ssn's aren't really >as secure as they're supposed to be, but still... I happen to work for Lexis-Nexis, but I don't speak for the company. Yes, P-Trak is real, it was recently made available to our customers. It is NOT a scam to get SSNs. Lexis-Nexis is a large and reputable company, best-known for its huge legal database system, Lexis. The Nexis side has news reports from a large variety of sources. P-Trak originally made SSNs available, but Lexis-Nexis removed this feature in response to protests.

2 1

Macintosh Mixmaster port... Who's doing it?
by Myers W. Carpenter 17 Dec '03

17 Dec '03

Does anyone have any idea who might be attempting a Macintosh Mixmaster port? I and some other people were eyeing the idea. If you know who might be doing this port I would appreciate hearing from them. Thanks. myers

5 4

Re: The Near-Necessity of Health Insurance
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 18-SEP-1996 02:54:27.36 >Personally, I have not been a patient in a hospital in my entire adult >life. Nor have I seen a doctor, except for a mandatory college physical in >1970 and an insurance company physical in 1977. I just haven't broken any >bones, had any serious illnesses, or felt the need to visit a doctor, an >emergency room, or a walk-in clinic of any sort. I suppose I've been lucky. >Also, I dislike hospitals and avoid doctors unless there seems to be a >compelling need. So far, there has not been. While this is certainly your business, I would suggest at least one physical a year, including blood work, as a good preventative measure... I believe it _has_ been shown to extend lives; I can do a Medline lookup if desired. >In other words, the person who insures himself (through savings and >investments) and who offers to pay for treatment out of his own funds, may >be at a serious disadvantage. He pays the inflated rates for services, and >may face delays in being admitted to a hospital. [...] >(Obviously the folks who use their insurance routinely, as one of my >engineers once used to do (he'd take his kids to the hospital every time >they sneezed), are being subsidized by those of us who avoid hospitals at >all costs.) Actually, the major subsidy appears to be that employer-paid health insurance isn't a taxable benefit. The status regarding self-insured persons such as you is constantly changing, but they're looking at subsidizing that also. Essentially, taxes paid by those with low or no employer-paid health insurance are subsidizing those with high-cost employer-paid health insurance. -Allen

2 1

Re: Anthrax on the 'net [Was Re: Fear of Flying -- from HotWired ]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 17 Sep 1996 17:14:53 -0400, Mike Fletcher wrote: >>>Gee, biotech has come a long way. Now I can download the Anthrax DNA >>>sequence from the net and insert it in some carrier bacteria and start >>>making Anthrax bacteria. Neat! >> Now the bad news: the DNA replicator only works under Windows 95 and comes >> with buggy drivers! > Buggy drivers? But isn't that the point in this case? :) True, true... <g> And you *really* don't want to see what happens when it crashes! >> Unfortunately, it can be very deadly. The idea here is that it rarely infect >s >> humans - in the normal course of events. If a determined biowarrior is tryin >g >> to infect people, all bets are off. > > The Frank Herbert (of _Dune_ fame) book _White Plague_ comes >to mind. Basically a molecluar biologist's wife and kids are killed >by an IRA bomb while visiting Dublin. He snaps and creates a plague >which kills women (men are carriers) as revenge. All without using >that nasty Internet (in fact, the book was written back before even >ARPAnet). I remember reading this one. Very applicable! # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: Snake-Oil FAQ
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Dale Thorn <dthorn(a)gte.net> wrote: > > Krenn wrote: > > It would be nice to have a list of actual products which are deemed > > potential snake-oil. Such a list could be maintained anonymously > > through a nym to avoid all the annoying legal problems with commenting > > on another's product. Though truth is the best defense against libel > > charges, it would be very annoying to be sued or some such by some > > hairbrained snake-oil peddler. > > Think how much more annoying it would be if the shoe were on the other > foot. > Libel/Slander is very different from doing a review. Unfortunately, in todays legal climate, it is way to easy to find a lawyer that will harass someone for a negative review. Unless you are prepared to fight such a legal battle, it is much easier to do anonymous reviews, and build up a reputation as a good reviewer through use of signatures, etc. If you have a good product, and get negative reviews, the truth will come out eventually through other channels. Either the product really isn't good, or the reviewer loses his reputation and his messages descend into the noise. Thats life - deal with it! Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Re: SSN database scam?
by Jim Byrd 17 Dec '03

17 Dec '03

One thing people forget is that Lexis-Nexis is hardly the first company to offer this kind of service. Several years ago, there was a controversy when Lotus planned to offer this kind of information on CD-ROM. The main competition of Lexis-Nexis, West Publishing Company ("Westlaw"), offered this kind of service before Lexis did. The last I heard, it was possible to get SSNs via Westlaw. I don't know if this is still true. I checked with a friend of mine, and got this response: "Westlaw offers access to several databases (including its PEOPLE-CB and INFOAM databases). They provide a person's "Credit Bureau Header," which contains social security number, previous address(s), telephone number(s), spouse name, date of birth, related names/aliases, and the date the report was filed." I happen to work for Lexis-Nexis, but I don't speak for the company. I work in a very different part of the company, and don't know the people involved with P-Trak.

1 0

Edited Edupage, 17 Sept 1996
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 18-SEP-1996 05:39:23.00 >************************************************************ >Edupage, 17 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >************************************************************ >THE BOTTOM LINE ON ELECTRONIC LIBRARIES >A former Public Library Association official estimates the cost of wiring >the nation's libraries at somewhere between $2- and $3-billion -- "a sum >nearly equivalent to that spent by the philanthropist Andrew Carnegie during >the great spurt of library building," notes journalist Nicholas von Hoffman. >But, "being able to afford the hardware is one thing," says a senior VP of >New York Public Library's Research Libraries. "Being able to replace it >year after year and being able to afford the staff to help people use it is >another. We could put workstations everywhere, but we don't have enough >staff. The equipment is on a three-year, six-thousand-dollar replacement >cycle. If people are using things like the World Wide Web, we need one >staff member out on the floor for every 20 workstations in use... Right now >we have 250 workstations for the public, so one staff member for every 20 >workstations becomes a major investment." (Architectural Digest Oct 96 p130) I would suspect that one of the following will take place: A. Libraries will not wind up getting Internet access subsidized to any great extent, since they can't afford to pay for the rest of it. B. Libraries will get Internet access subsidized, but won't be able to use it a lot so the subsidy may eventually go by the wayside due to lack of political support. C. Libraries will get everything subsidized. -Allen >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >************************************************************ >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >John McCarthy (if your name is John McCarthy; otherwise, substitute your >own name). ... To cancel, send a message to: listproc(a)educom.unc.edu with >the message: unsubscribe edupage. (If you have subscription problems, send >mail to manager(a)educom.unc.edu.)

1 0

XPA_nix
by jya＠pipeline.com 17 Dec '03

17 Dec '03

WSJ and WaPo have reports on Panix-jamming by info-request bombardment, and Bell Labs security expert Bill Cheswick's attempt to solve it. Cheswick opines,"This is the first major attack of a kind that I believe to be the final Internet security problem." ----- http://jya.com/xpanix.txt XPA_nix

4 4

(fwd) Global Alert: GERMAN GOVERNMENT PUSHES BLOCKAGE OF NETHERLANDS WEB SITE
by Alex Le Heux 17 Dec '03

17 Dec '03

Path: xs4all!felipe From: felipe(a)xs4all.nl () Newsgroups: xs4all.announce Subject: Global Alert: GERMAN GOVERNMENT PUSHES BLOCKAGE OF NETHERLANDS WEB SITE Date: 18 Sep 1996 17:28:31 GMT Organization: XS4ALL, networking for the masses Lines: 118 Approved: the boss Message-ID: <51pbfv$anu(a)news.xs4all.nl> NNTP-Posting-Host: xs1.xs4all.nl X-XS4ALL-Date: Wed, 18 Sep 1996 19:28:31 MET DST X-Newsreader: NN version 6.5.0 #4 *** GLOBAL ALERT *** FOR IMMEDIATE RELEASE SEPT. 18, 1996 - Please redistribute this document widely with this banner intact - Redistribute only in appropriate places & only until 15 October 1996 GERMAN GOVERNMENT PUSHES BLOCKAGE OF NETHERLANDS WEB SITES. At the behest of, and in response to legal threats from, the German government, internet providers in Germany have blocked the Dutch Web site Access For All (www.xs4all.nl) removing German users' access to the entire xs4all system. The German government demanded this action because xs4all hosts a Web "home page" with so-called left-wing political content that, though fully legal in the Netherlands, is allegedly illegal in Germany. (see: http://www.anwalt.de/ictf/p960901e.htm) As a result of this action, *all* xs4all web sites, including several thousand that have nothing to do with the offending home page, are unavailable to readers in Germany. Please send a letter of protest to the German ambassador in your country, ask your foreign minister to protest officially to the German government, and distribute this alert as widely as possible online and to the press. Referring to article 19(2) of the International Covenant on Civil and Political rights, which Germany ratified in 1973, we, the undersigned organizations, consider this censorship an illegal act. Additionally, the value of attempting to ban content the German government finds offensive is highly questionable. The proper response to offensive expression is more and better expression, and prosecution of offending criminals, not censorship. As a result of the overly broad censorship measure which targets an entire Internet access provider instead of a specific user, all 3000 and more Web site hosted by xs4all are virtually inaccessible in Germany. The loss of clients who market in Germany has resulted in economic damage to xs4all. The immeasurable harm of censoring thousands of other users for the speech of one is even greater. Access for All, though it has expressed willingness to assist the Dutch police in identifying online criminals abusing the xs4all system, has a policy against censoring its clients. Mirroring this position, at least one German Net provider has responded to the government demands with skepticism, pointing out that their compliance with the censorship request may cause them to violate contracts with their own German users, and that the government's liability threats are tantamount to holding a phone company liable for what users say on the telephone. Instead of the futile act of censorship that has simply drawn increased attention to the offending material and resulted in its widespread availability on other sites throughout the world, the German government should have acted through legal channels and asked the authorities in the Netherlands to cooperate in determining what legal action, if any, was appropriate. We are concerned that German internet providers have cooperated so easily with government censorship efforts. Some level of cooperation was probably assured by underhanded and rather questionable police threats of system operator liability for user content, but we must urge more resistance on that part of Net access providers to such online censorship schemes. As with libraries, there are many who would censor, but there is a responsibility on the part of providers of access to information, to work to protect that access, else libraries, and Internet service providers, lose the reason for their existence. We ask that the German government refrain from further restrictive measures and intimidation of internet providers and recognize the free, democratic, world wide communications represented by the Internet. All governments should recognize that the Internet is not a local, or even national, medium, but a global medium in which regional laws have little useful effect. "Top-down" censorship efforts not only fail to prevent the distribution of material to users in the local jurisdiction (material attacked in this manner can simply be relocated to any other country), but constitutes a direct assault on the rights and other interests of Internet users and service providers in other jurisdictions, not subject to the censorship law in question. For press contacts, and for more information about the Internet, see the homepages for the signatories to this message: DB-NL (Digital Citizens Foundation in the Netherlands) * http://www.xs4all.nl/~db.nl ALCEI - Electronic Frontiers Italy * http://www.nexus.it/alcei CITADEL-E F France *http://www.imaginet.fr/~mose/citadel CommUnity (UK) * http://www.community.org.uk Electronic Frontier Canada * http://www.efc.ca/ Electronic Frontier Foundation (USA) * http://www.eff.org Electronic Frontiers Australia * http://www.efa.org.au/ Other signatures: NLIP, Dutch Foundation for Internet Providers * http://www.nlip.nl Internet Providers Rotterdam * http://www.ipr.nl Digitaal Werknet Nederland * http://www.dwn.nl Foebud e.V, foundation to promote free datatraffic, * http://www.zerberus.de National Writers Union (UAW LOCAL 1981 AFL-CIO) * http://www.nwu.org/nwu/ Nizkor Project * http://www.nizkor.org/ Internet Access Foundation (NL) * http://www.iaf.nl/ Digitale Stad Venlo * http://www.dsvenlo.nl CSO * http://www.canucksoup.net/ -- Felipe Rodriquez - XS4ALL Internet - finger felipe(a)xs4all.nl for http://xs4all.nl/~felipe/ - Managing Director - pub pgp-key 1024/A07C02F9 pgp Key fingerprint = 32 36 C3 D9 02 42 79 C6 D1 9F 63 EB A7 30 8B 1A -- /// I dabble in techno-house and sometimes, /// I do that badass hip-hop thang... /// But the F U N K gets me every time!

1 0