December 2003 - cypherpunks-legacy

Welcome to ChemWeb.com
by info＠chemweb.com 17 Dec '03

17 Dec '03

Dear Dr cypherpunks cypherpunks Congratulations. Your registration has been successful and you are now a member of ChemWeb.com, the World-Wide Club for the Chemical Community. Your free registration allows you access to all of the facilities at http://chemweb.com. You can now browse and search journals in the library, databases, the conference diary, the shopping mall, and the job exchange, as well as keeping up to date with the latest news from The Alchemist on-line magazine. If you ever forget your password or username, just send an e-mail to info(a)chemweb.com with your name/e-mail address, and we will help you find it, without you having to re-register. We are constantly improving the ChemWeb club site, and we welcome any suggestions you may have. I hope you find ChemWeb.com useful, and I look forward to seeing you there soon. Sincerely, Bill Town, Chief Operating Officer, ChemWeb, Inc.

2 1

ChemWeb password
by info＠chemweb.com 17 Dec '03

17 Dec '03

Dear Dr cypherpunks cypherpunks Someone has used our password utility located at http://chemweb.com/user_gateway/html/forgot_password.html to request that the password for your account be sent to this email address (the one that we have on file for your account). If it wasn't you, don't worry, because no one can ever get your password except you (we only mail it to the email address on file). Someone probably entered the wrong address by accident. If it was you, then here's the information that you've been waiting for. Your Member Name is: cypherpunks Your Current Password is: cpunks For additional help with technical problems, please see our online help guide at http://chemweb.com/help/html/index.html ChemWeb administration

1 0

ADV: We'll Pay You To Make Our Phone Ring
by 5dfs＠mail.gnosis.it 17 Dec '03

17 Dec '03

Dear Business Friend, You are receiving this offer because we have corresponded in the past, or because you have been referred to me as someone interested in business opportunities. If this message has reached you in error, please accept my apologies. To remove your address from future mailings, please reply with "remove" in the subject heading. ******************************** ALL YOU DO IS ADVERTISE OUR 800 NUMBER - THAT'S ALL ! * You get $100 for EVERY SALE plus ENDLESS RESIDUALS! * Just MAKE OUR PHONE RING ! * Easiest, most profitable business around * You can earn thousands of $$ your very first month ! * No selling required - our expert sales team closes sales for you * We send out huge checks weekly * No meetings, phone calls, no hassles * Advertise any way you want - email, flyers, classifieds, postcards, etc. If you are an average person like myself who has always wanted to generate a large easy income from home, but you don't want the hassles of inventory, marketing plans, or direct selling, then THIS IS FOR YOU. All you do is advertise our 800 number and your ID number, and our trained staff do the rest for you. Don't just take my word for it - listen to some amazing testimonials from existing members: 1-888-446-6951 (He made $10,000 his first month) 1-888-446-6949 (He erased all his debt in one month) 1-888-715-0642 (She averages $1,000 every week) 1-888-703-5389 (He can't believe it's this easy) You also have the peace of mind of offering one of the best products available: a lifetime membership in a discount service providing guaranteed low prices on over 250,000 products and services. Hotel & Travel Services, Major Appliances, Dentists, Legal Services, 7.5 cents/minute long-distance, Groceries... YOU CAN START TODAY - CALL NOW: 1-800-811-2141 (ID # 66078) 8am - 10pm CST Mon-Sat ***************** P.S. I am really excited about this and YOU souuld be too. I called and checekd this out it in not a two or 3 tier pusiness oppertuniety it is one level ONLY..you get payd for the people you bring in and have to do nothing else. The savings in they buying end of it is really great too from there catalog of 250,000 items is absolutely great also so I joined and hope you do to if not for the business end but for what you going to save buying alone it is worth it... THANKS FOR YOU TIME Michael T. Kacer reply to me with your # & e-mail and i will help u if i can

1 0

Re: "Export" controls
by Michael Motyka 17 Dec '03

17 Dec '03

> Their architecture has real $$ value because it cracks 99% of > "encrypted" traffic. > What type of attack was used in the famous test? Known plaintext? It gets a bit tougher in the real world doesn't it? > Offering the real stuff for sale in US requires some investment. > Really? > We are not talking here about free stuff. We are talking about > products that can be deployed by non-programmers, businesses etc., > that will be supported professionally > Every product I ever worked on started off as a big ugly prototype sprawled across a table top hooked to all sorts of life support systems. And not all products are taken to market by those who did the initial design work. License. For something like we're discussing here I think the *big* cash outlay comes post-prototype with mask, fab, plastics, production lines and marketing. Upfront it's mostly neurons. I expect it would be easier to convince a manufacturer to participate with a working prototype than it would with only an idea. > Hardware is overkill for the single voice line. PGPfone works fine > there. ^^^^^^^^ > No it is not. 500k gates may be too much but I maintain that you simply cannot trust the Wintel HW, Windows or anything you cannot analyze in detail and freeze. Besides, people like little palm-sized gadgets. > How much would you pay for transparent hardware/software solution that > encrypts all traffic between peer users > We all know the magic price points. But is that particular product all that interesting? Even if peer traffic is encrypted the system can be infected and can transmit anything ( disk, RAM eg ) to other adresses. I'm afraid I don't know enough about the networking stuff to feel that a system can be secured while it is on-line. Now an embedded system for secure e-mail that used a PC as a gateway might be kind of cool. You drop encrypted attachments onto a driver that sends them to the unit where you read them. Anything you enter and encrypt at the unit is presented as a file at the host to be attached and sent. USB would be plenty quick for that sort of stuff. You might say that it should be done on the host as SW or on another PC but we're back to the Wintel HW again. No thanks. I wonder what could be done with a palm pilot. Are full schematics and BIOS and driver code available? You *might* throw out everything but and build it there. You'd want to do some EMI testing. I still like my SCSI/IDE gizmo for off-line PC's. > The main problem with hard crypto is that it is so equalizing. Any > pauper can cheaply encrypt and make it hard for any government to > break. > Yes, and it needs to be priced accordingly. Although corporations do tend to spend nicely at times. The key, as with any business, identify your customers and make a product for them. Not easy, I admit. > This is not the case with guns, where more resources almost linearly > buy more power. > Gun talk is amusing. I agree that what is going on with gun law is disturbing but as far as disagreement with the Reptilians is concerned power is political. As soon as it becomes violent you've lost. Except in the event of a full-blown revolution. Then we all lose. > On the wild side, suppose that all crypto restrictions are terminated. > Some would say that now "they" can break all available stuff. In any > case the value of crypto products in the eyes of buyers would fall. If > it is legal it is no good. Most of the research would lose the best > people. > Don't you think that this sort of a poker bluff would be a little too much even for the boldest thinkers in gov't? The stuff they fear most would be commoditized and I think, in spite of your point, far more of it would exist than does now. Marketeers would reduce it to bullet items on packages but many engineers would deliver reasonable products within the cost constraints. > Cypherpunks would cease to exist. > Is that why CP exist? Because cryptography has some legal gray areas? I don't think so. Enough This is a painfully slow conversation.

1 0

Suggested Reading
by Jim Choate 17 Dec '03

17 Dec '03

Declarations of Independance: Cross-examining American ideology Howard Zinn ISBN 0-06-092108-0 $14.00 US ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

No Subject
by Xena - Warrior Princess 17 Dec '03

17 Dec '03

U.S. claims success in curbing encryption trade WASHINGTON (Reuters) - Clinton administration officials Thursday said they had persuaded other leading countries to impose strict new export controls on computer data-scrambling products under the guise of arms control. At a meeting Thursday in Vienna, the 33 nations that have signed the Wassenaar Arrangement limiting arms exports -- including Japan, Germany and Britain -- agreed to impose controls on the most powerful data-scrambling technologies, including for the first time mass-market software, U.S. special envoy for cryptography David Aaron told Reuters. The United States, which restricts exports of a wide range of data-scrambling products and software -- also known as encryption -- has long sought without success to persuade other countries to impose similar restrictions. ``We think this is very important in terms of bringing a level playing field for our exporters,'' Aaron said. Leading U.S. high-technology companies, including Microsoft Corp. and Intel Corp., have complained that the lack of restrictions in other countries hampered their ability to compete abroad. The industry has sought to have U.S. restrictions relaxed or repealed, but has not asked for tighter controls in other countries. Privacy advocates have also staunchly opposed U.S. export controls on encryption, arguing that data-scrambling technologies provided a crucial means of protecting privacy in the digital age. ``It's ironic, but the U.S. government is leading the charge internationally to restrict personal privacy and individual liberty around the world,'' said Alan Davidson, staff counsel at the Center for Democracy and Technology, a Washington-based advocacy group. Special envoy Aaron said the Wassenaar countries agreed to continue export controls on powerful encryption products in general but decided to end an exemption for widely available software containing such capabilities. ``They plugged a loophole,'' Aaron said. The new policy also reduced reporting and paperwork requirements and specifically excluded from export controls products that used encryption to protect intellectual property -- such as movies or recordings sent over the Internet -- from illegal copying, Aaron said. Encryption uses mathematical formulas to scramble information and render it unreadable without a password or software ``key.'' One important measure of the strength of the encryption is the length of the software key, measured in bits, the ones and zeros that make up the smallest unit of computer data. With the increasing speed and falling prices of computers, data encrypted with a key 40 bits long that was considered highly secure several years ago can now be cracked in a few hours. Cutting-edge electronic commerce and communications programs typically use 128-bit or longer keys. Under Thursday's agreement, Wassenaar countries would restrict exports of general encryption products using more than 56-bit keys and mass-market products with keys more than 64 bits long, Aaron said. Each country must now draft its own rules to implement the agreement.

1 0

Twofish/AES News
by Bruce Schneier 17 Dec '03

17 Dec '03

There are some new papers on the Twofish webpage. We have improved our performance numbers. On Pentium-class machines, key setup is faster. We also have large-RAM implementations, that speed key setup at the expense of 256K of RAM. We aso have a variety of performance options on smart cards, trading RAM off for speed. And finally, we have a new hardware implementation that reduces the total gate count. Details are in Twofish Technical Report #3: http://www.counterpane.com/twofish-speed.html Dave Barton has implemented Twofish in Delphi: http://www.hertreg.ac.uk/ss/d_crypto.html And finally, we have compared the performance of all AES submissions on 32-bit processors, smart cards, and hardware. Our results are in. http://www.counterpane.com/AES-performance.html As always, thanks for your support. Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis, MN 55419 Fax: 612-823-1590 Free crypto newsletter. See: http://www.counterpane.com

1 0

Make your own IQ test online!!! (Free+FUN)
by phormiga＠bigfoot.com 17 Dec '03

17 Dec '03

you can do it now! YouŽll know your IQ in a few minutes Go to http.//www.hormiga.org/iqt.htm FREE AND FUN YouŽll know your Intelligence Coeficent Spanish version http://www.hormiga.org/iq.htm

1 0

Mixmaster client 4 the Mac OS?
by Anonymous 17 Dec '03

17 Dec '03

I heard sometime last summer that the mixmaster client was being ported to the Mac. Does anyone know the status of this project?

1 0

ChemWeb password
by info＠chemweb.com 17 Dec '03

17 Dec '03

Your request for a ChemWeb password has been received. We will try to help you out as soon as possible. For additional help with technical problems, please see our online help guide at http://chemweb.com/help/html/index.html Thank you ChemWeb administration

1 0

Apology for mixup in press release mailing list
by Teemu Hukkanen 17 Dec '03

17 Dec '03

Due to an unsuspected flaw, our mailing lists were slightly misconfigured which allowed replies to the original press release email to be forwarded to all recipients in the list. -- postmaster(a)datafellows.com

1 0

Re: I Got Mine
by HyperReal-Anon 17 Dec '03

17 Dec '03

>Now there's a really intelligent response to the MIB! I think Blanc would >have done a better self-service to have responded that way. > >MAKE THEM GET A WARRANT! It's your ONLY legal defense against a fishing >expedition! It's our CONSTITUTIONAL RIGHT to require a warrant before >letting them in! We are NOT criminals just because we do not allow the MIBs >to make ILLEGAL and UNCONSTITUTIONAL searches of our properties! > >If they can't convince a judge AND obtain a specifically worded search >warrant then they are obviously fishing! Tell to go find a real deep lake... > >I also give the writer an A+ for the Clintonian and Reagonesque touches! > >APF The MIB have a convenient way around this. If you let them in voluntarily, they're nice. If you make them get a warrant, they come back, guns drawn. They barge in and tear the place up for hours. Maybe they'll hack down some of the walls to search for drugs. In the end, you have something which is a cross between a pile of papers, a bunch of dust, electronic parts, wiring, torn up books, destroyed furniture, and a pile of crumbled drywall to call home. Heil Klintonkov! Heil Reno! Heil Freeh! StatistMonger

3 2

Re: I Got Mine
by Albert P. Franco, II 17 Dec '03

17 Dec '03

>The MIB have a convenient way around this. If you let them in voluntarily, >they're nice. If you make them get a warrant, they come back, guns drawn. >They barge in and tear the place up for hours. Maybe they'll hack down some >of the walls to search for drugs. In the end, you have something which is a >cross between a pile of papers, a bunch of dust, electronic parts, wiring, >torn up books, destroyed furniture, and a pile of crumbled drywall to call >home. > >Heil Klintonkov! Heil Reno! Heil Freeh! > >StatistMonger > Unfortunately, this is true. That's why I loved the response given by Anon! It accomplished all the right things without giving them cause for coming back!! VERY, VERY GOOD! APF

1 0

ChemWeb.com
by Davina Heaven 17 Dec '03

17 Dec '03

Dear Dr Cypherpunks Thank you for your message to ChemWeb.com. Please enter your Member Name (user name) and Password exactly as shown below (please note that our system is case sensitive and will not tolerate spaces): Member Name: cypherpunks Password: crossfire If you have any further queries or comments, please do not hesitate to contact me again. Yours sincerely, Davina Heaven Customer Services ChemWeb Inc. 50 New Bond Street London W1Y 6HA Tel: +44 (0)171 499 4748 Fax: +44 (0)171 499 4102 http://ChemWeb.com World Wide Club for the Chemical Community > -----Original Message----- > From: cypherpunks(a)toad.com [SMTP:cypherpunks@toad.com] > Sent: None > To: info(a)chemweb.com > Subject: ChemWeb password > > Request for password: > > Full name: cypherpunks cypherpunks > Current e-mail: cypherpunks(a)toad.com > Other e-mails: > Member name: cypherpunks > Comment:

1 0

ChemWeb password
by info＠chemweb.com 17 Dec '03

17 Dec '03

Dear Dr cypherpunks cypherpunks Someone has used our password utility located at http://chemweb.com/user_gateway/html/forgot_password.html to request that the password for your account be sent to this email address (the one that we have on file for your account). If it wasn't you, don't worry, because no one can ever get your password except you (we only mail it to the email address on file). Someone probably entered the wrong address by accident. If it was you, then here's the information that you've been waiting for. Your Member Name is: cypherpunks Your Current Password is: crossfire For additional help with technical problems, please see our online help guide at http://chemweb.com/help/html/index.html ChemWeb administration

1 0

The Beeb speaks like a cypherpunk once removed...
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There's some discussion on the BBC about that Chinese businessman who's now in the klink for "conspiring against the state using the internet" :-). The Beeb has an internet correspondent, and he's, right now, talking about strong crypto, anonymous remailers, and quoting Gilmore's censorship is damage line. All without using the words "strong cryptography", or "anonymous remailers", or "John Gilmore". :-). He was talking about how the Chinese website was hacked within hours and painted over with pro democracy stuff and links to Amnesty International, among other things. All of this was in a favorable, horse is out of the barn, this is good for freedom, light. Cheers, Robert Hettinga -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNmfw9cUCGwxmWcHhAQEDEwf9H9xqZ2LU935VawA9ZwpzFPF2CKrl1xam jzGJX2uTOhiYGtkQhZ2hFY7/ISoNGXvinwHACycXVi5AdxR6//2tzr1szjk4bgB5 NvKW+1gJJWP5bD0Kz3JwYui3t2fAetjSg94HCxcWbSQM4NJVP6IBXyg48ZtGmkVE UqvhwYc41NHVDgZt/ist5EQEAWcWh3/qApEbeS8xG7SP4FZeCeogCidVmQuMWC1u sAQbrd5fdFdTcUs0feuk9zBpEklTe3AljfnDbfSEUpyok29L+9R3cqAyh/5GM0yd 3uVQTmqOSMLK0o+L9tuejgkaTGnI7Co2NXaYbh/jPKGzm/OAYr7/fQ== =FU5E -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Wassenaar Statement
by John Young 17 Dec '03

17 Dec '03

The Secretariat of The Wassenaar Arrangement has issued brief public docs on the recent meeting: http://jya.com/wa-state98.htm Only one brief mention of encryption: "8. The WA agreed control list amendments to take into account recent technological developments. The amendments to the lists included elimination of coverage of commonly available civil telecommunications equipment as well as the modernisation of encryption controls to keep pace with developing technology and electronic commerce, while also being mindful of security interests. Participating States also discussed the potential need for the WA and national export control authorities to respond quickly and effectively to the emergence of new technologies." Which appears to confirm that each state will implement and announce its encryption policy as it sees fit. The US has jumped to proclaim to its constituencies that it has won. Though it's the secret agreements that remain to be publicized. Note the gaps in the public docs and dissimulative assurances. We also offer a recent related message from Denmark on its fluid crypto policy: http://jya.com/dk-crypto98.htm

1 0

TESTING... Seems like I don't get all my mail...
by Jan Dobrucki 17 Dec '03

17 Dec '03

TEST TEST TEST TEST JDO

1 0

Surf the Web 20-Times Faster
by RealNetworks News 17 Dec '03

17 Dec '03

Dear RealPlayer User, Want to speed up your Internet connection without purchasing a new modem? Tired of long-download times and network problems? For a limited time, RealNetworks invites you to download PeakJet 2000-which can speed your web surfing up to 20-times faster-for only $14.95! Read on, or download now: => http://www.realstore.com/specials/onesurfing.html How does it work? PeakJet's technology automatically learns from your browsing habits. While you read through a page, PeakJet 2000 intelligently works behind the scenes and preloads and freshens links according to your interests. When you click, the next page appears almost instantly. All you do is download PeakJet 2000 and start surfing at lightening speed! PeakJet 2000 also offers these great benefits: - Speeds Web surfing up to 20-times faster without requiring a new modem-and works with any modem speed. - Maximizes idle modem time; intelligently preloads pages while you go about your normal browsing. - Economizes bandwidth by devoting cache to your favorite links or frequently visited Web pages. - Comes with a 30-day money-back guarantee. PeakJet 2000 was awarded a 5-star rating by ZDNet. For a limited time, it is only $14.95 - the lowest price for PeakJet 2000 anywhere! To download now, visit: => http://www.realstore.com/specials/twosurfing.html Thank you for continuing to use RealNetworks products. Maria Cantwell Senior Vice President RealNetworks, Inc. Seattle, WA USA ---------------------------- ABOUT THIS E-MAIL Participation in RealNetworks product updates and special offers is voluntary. During the installation of the RealPlayer software you indicated a preference to receive these e-mails. For information about unsubscribing from future announcements, do not respond to this email, instead visit: http://www.real.com/mailinglist/

1 0

joy of export, h/ware
by Anonymous 17 Dec '03

17 Dec '03

At 10:06 AM 12/3/98 -0800, Michael Motyka wrote: >> Their architecture has real $$ value because it cracks 99% of >> "encrypted" traffic. >> >What type of attack was used in the famous test? Known plaintext? It >gets a bit tougher in the real world doesn't it? Not really. >> Offering the real stuff for sale in US requires some investment. >> >Really? Interesting question. Open a delaware corporation and sell munition-quality gate arrays in the back pages of Popular Electronics or EE Times... keep us posted... >I expect it would be easier to convince a manufacturer to participate >with a working prototype than it would with only an idea. Duh :-) >> Hardware is overkill for the single voice line. PGPfone works fine >> there. ^^^^^^^^ >> >No it is not. 500k gates may be too much but I maintain that you simply >cannot trust the Wintel HW, Windows or anything you cannot analyze in >detail and freeze. Besides, people like little palm-sized gadgets. * 10,000 gates cost less than a paper clip. 500K is high for a block cipher. * If we don't find something to do with them, at the rate we're producing them, the earth will be covered with silicon and its compounds soon. :-) * Its not like we'd ever put floating point routines, or blitting routines, out of business by integrating those functions in Si, is it? Naah, we'd never accelerate encryption with hardware, the CPU is bored and has nothing better to do, and its soooo expensive to print chips.. (That being said, I'll point out to myself how many asics have been replaced by dsps...but not without some inefficiency) * PGPfone on a very fast cpu plus fast link is still less pleasant than a noisy cordless (no pun intended). * We'd never take encryption hardware through the same path as modems, would we? First used between companies, then used for remote access, eventually you can't buy a bloody machine without one. Getting cheaper, faster, closer to the motherboard, taken for granted by applications. Ever seen a 300 baud, 40 lb modem, cost probably $3000 in 1970 dollars? The final level of deployment is when garage-door-openers, car remotes, and childrens' toys (e.g., radio controlled cars) use encryption chips... or chips with encryption, anyway. >Now an embedded system for secure e-mail that used a PC as a gateway >might be kind of cool. You drop encrypted attachments onto a driver that >sends them to the unit where you read them. Anything you enter and >encrypt at the unit is presented as a file at the host to be attached >and sent. USB would be plenty quick for that sort of stuff. Yes, the PC can be used as an untrusted router if the encryption is done outside it. The outside encrypting unit should also perform NAT, otherwise the PC (doing the tunnelling) can broadcast traffic ('trap and trace' in the pots world) info. The lower power used in PDAs really helps keep the boys in the White Van Across the Street busy. Email is so low-bandwidth that software suffices. Secure video conferencing on your Dick Tracy (tm) telewatch needs h/w support. --- Is 5% of YOUR communications encrypted or anonymous in '98 ?? ---

1 0

Re: Wassenaar Statement
by Anonymous 17 Dec '03

17 Dec '03

If these reports are correct, the United States could end up being one of the countries with the most LIBERAL export controls. In the United States, it is currently legal to export any cryptographic software you like - as long as it is in printed form. This is because of fears of violating the First Amendment. Not all countries have such strong conventions for protecting the printed word. PGP source code is being exported in printed form, scanned in overseas, and then distributed from there. If the Wassenaar Arrangement prevents it from being exported from its current overseas distribution site, a solution can be to ship it in printed form from the U.S. to a wide range of other countries. As long as those countries don't prohibit domestic distribution of crypto software, strong cryptography can still be made available almost everywhere. The PGP source code books begin with a section that is, in effect, a "how-to" for printing software in such a way that it can be reliably scanned. Each page and each line has a checksum. The books come with a Perl script short enough to enter by hand that does basic checksum verification. This is used to read a second, longer Perl script that can do error correction; and this is then used to bootstrap into the full script which will read the books, create all the files, organize the directories, and reconstruct the entire source code tree. It may be that in the future this will be the most effective way to communicate internationally about security software. It would be good for other groups to become familiar with this technology which has been pioneered by PGP.

1 0

Send email list - go to jail for life in China [/.]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://news.bbc.co.uk/hi/english/world/asia-pacific/newsid_224000/224907.stm > Cyber dissident awaits trial in China > By China Analyst James Miles > > A man is awaiting trial in Shanghai prison charged with using the > Internet to try to subvert the government. > > Patrick Lin, 30, was arrested in March for sending 30,000 Chinese > e-mail addresses to an Internet magazine run by Chinese dissidents > abroad. [text deleted] ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Ethical programming guild? [/.]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://slashdot.org/features/98/12/04/1158251.shtml > The following was written by Slashdot Reader James Moyer . > > In proposing this idea, I think that it would a little bit of > background would be appropriate. I am a student at Ohio State, and I > have a strong interest in civil liberties and privacy issues. In fact, > I am now in the process of organizing an on-campus student > organization to criticize Ohio State's overuse of the social security > number, biometric identification and other related issues to privacy > directly concerning the university. > > Here on Slashdot I use the nickname JimBobJoe posting from email > address vampire(a)innocent.com. > > I also consider myself a Libertarian, and from many of the postings on > Slashdot, it appears that there are quite a lot of Libertarians out > there too. There is no coincidence, in my mind, that some of the most > stringent privacy laws in the nation hail from a highly technical, > Libertarian state, being Washington state. In the same vein, it is > rather amusing to see countries such as Malaysia attempt to draw > computer professions into their country, where the severity of their > laws turn many away. [text deleted] ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

export of printed crypto [Was Re:Wassenaar Statement]
by Anonymous 17 Dec '03

17 Dec '03

The PGP source code is open, published in book form and this gets stronger 1st amendment protection. US crypto companies have also read the relevant portions of the EAR. Yet, none, to my knowledge, have tried this. Would any attorney reading the list care to comment? The EAR clearly states that printed crypto is not subject to the EAR whether the material is publically disseminated or not. Anyway, about one second after somebody did this another extra- constitutional "emergency" executive order would prohibit it. -Wassenaar >In the United States, it is currently legal to export any cryptographic >software you like - as long as it is in printed form. This is because >of fears of violating the First Amendment. Not all countries have such >strong conventions for protecting the printed word. >PGP source code is being exported in printed form, scanned in overseas,

1 0

Streams, Voice, and Sensitive Dependence
by Lee Davis 17 Dec '03

17 Dec '03

It is my understanding that the PGP algorithm is primarily intended as a block cypher. Therefore, wouldn't an Outer Block stream cypher be more effective for phone conversations? Both solutions require hardware for a practical (tolerably noiseless) implementation, so there's nothing to be gained by streaming data into a block format. In any case, there has been a lot of recent work in dynamic systems (Chaos), especially in the fast computations of Julia Sets. Has anyone seen a paper on exploiting the sensitive dependance in these systems for pseudorandom number generation?

2 2

Re: joy of export, h/ware
by Michael Motyka 17 Dec '03

17 Dec '03

>>What type of attack was used in the famous test? Known plaintext? It >>gets a bit tougher in the real world doesn't it? > > Not really. > Even if you don't know what you're looking for? Help me out with that one. > * PGPfone on a very fast cpu plus fast link is still less pleasant > than a noisy cordless (no pun intended). > You trust PGPfone on commercial HW enough to do your spy work with it? A system with dedicated audio compression ( http://www.dspg.com/ e.g. ) and a modem could probably be used to establish a secure, full-duplex link over the POTS. A microP, possibly with a small gate array to accel the crypto, would be able to handle the rest of job. Actually a pretty simple product. It could even use your dial-up account and be your internet phone. I know it has been done. I just won't be happy 'til it's in 50 million homes. > * We'd never take encryption hardware through the same path as modems, > would we? First used between companies, then used for remote access, > eventually you can't buy a bloody machine without one. Getting > cheaper, faster, closer to the motherboard, taken for granted by > applications. Ever seen a 300 baud, 40 lb modem, cost probably $3000 > in 1970 dollars? > Yes, I have. Fortunately encryption HW will not have to go through that sort of process. The frontier has been tamed, there are freeways everywhere - all you have to do is pick a lot and build. IOW - that 300 baud modem if done from scratch now would cost nowhere near $3000/unit. > The final level of deployment is when garage-door-openers, car > remotes, and childrens' toys (e.g., radio controlled cars) use > encryption chips... or chips with encryption, anyway. > The time is ripe. > The outside encrypting unit should also perform NAT, otherwise > the PC (doing the tunnelling) can broadcast traffic ('trap and trace' > in the pots world) info. > Clueless again! What is 'NAT'? > Email is so low-bandwidth that software suffices. > Absolutely. The issue there is more one of trustworthy HW and SW. Back to WINTEL/MICROSNORT. Again, !barf!.

1 0

Wassenaar Addendum
by John Young 17 Dec '03

17 Dec '03

Caspar Bowden in the UK says by telephone that a Wassenaar spokesman told him today that the WA org will issue next week a detailed "template" which specifies terms of the recent agreement to control encryption. It will go well beyond what has been heretofore generally agreed to by the member states under which there was a good bit of latitude for each to determine its own policy. This is an unprecedented united front by the members, and the paper will be a first for detailed export controls issued by the Wassenaar org rather than by each nation. When ready it will be put on the Wassenaar Web site: http://www.wassenaar.org. We've made a request to DoC for elaboration of the press release yesterday which featured David Aarons' general claims, but no response yet. The USG may not comment until the WA paper is issued. Caspar posted a capsule of his infor on UK Crypto: From: "Caspar Bowden" <cb(a)fipr.org> To: <ukcrypto(a)maillist.ox.ac.uk> Subject: News from Wassenaar Secretariat Date: Fri, 4 Dec 1998 16:23:58 -0000 Message-ID: <000101be1fa2$9da127e0$dc77e4d4@cpsb> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal Just talked to Dirk Weicke, Senior Adviser to Wassenaar Organisation. (Tel:+43 1 516360) No written details will be issued until next week, but gist is: *) No alteration to question of whether Wassenaar covers intangible exports. Up to signatory states to interpret and legislate. *) mass-market software, symmetric key length limited to 56-bits *) software generally available, but with other restrictive tests on end-user re-configurability, symmetric key length limited to 64-bits *) Assymetric key lengths (not sure how relates to above) limited to: RSA & Digital logarithm: 512 bits Elliptic curve : 112 bits -- Caspar Bowden http://www.fipr.org Director, Foundation for Information Policy Research Tel: +44(0)171 354 2333 Fax: +44(0)171 827 6534 ----------

1 0

Re: Streams, Voice, and Sensitive Dependence
by Jim Gillogly 17 Dec '03

17 Dec '03

"Lee Davis"<lee.davis(a)thomasmore.edu> skribis: > In any case, there has been a lot of recent work in dynamic systems (Chaos), > especially in the fast computations of Julia Sets. Has anyone seen a paper on > exploiting the sensitive dependance in these systems for pseudorandom number > generation? A number of attempts have been made to apply chaos to cryptosystems. The two that I've broken suffered from the same fault: although it's difficult to find the precise starting point (key) due to sensitive dependence, chaotic systems are by definition non-random, and have preferred orbits. If the cryptanalyst finds an orbit that's close to the one used by the actual key, the stream is mostly the same; this is good enough to hone the attack for the next pass. I'm not saying chaos has no applications in cryptography; only that the applications are not obvious. -- Jim Gillogly Trewesday, 14 Foreyule S.R. 1998, 19:37 12.19.5.13.7, 6 Manik 20 Ceh, Sixth Lord of Night

1 0

Re: Mixmaster client 4 the Mac OS?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 X-Sender: loki(a)sirius.infonex.com Date: Fri, 4 Dec 1998 10:08:01 -0800 To: Robert Hettinga <rah(a)shipwright.com>, mac-crypto(a)vmeng.com From: Lance Cottrell <loki(a)infonex.com> Subject: Re: Mixmaster client 4 the Mac OS? Sender: <mac-crypto(a)vmeng.com> Precedence: Bulk Several people have offered, but none have produced a fully functional version. -Lance At 8:53 PM -0500 12/3/98, Robert Hettinga wrote: >--- begin forwarded text > > >Date: Fri, 4 Dec 1998 01:42:19 +0100 >From: Anonymous <nobody(a)replay.com> >Comments: This message did not originate from the Sender address above. > It was remailed automatically by anonymizing remailer software. > Please report problems or inappropriate use to the > remailer administrator at <abuse(a)replay.com>. >Subject: Mixmaster client 4 the Mac OS? >To: cypherpunks(a)toad.com >Sender: owner-cypherpunks(a)cyberpass.net >Precedence: first-class >Reply-To: Anonymous <nobody(a)replay.com> >X-Loop: cypherpunks(a)cyberpass.net > >I heard sometime last summer that the mixmaster client was being ported to >the Mac. Does anyone know the status of this project? > >--- end forwarded text > > >----------------- >Robert A. Hettinga <mailto: rah(a)philodox.com> >Philodox Financial Technology Evangelism <http://www.philodox.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' ---------------------------------------------------------- Lance Cottrell loki(a)infonex.com PGP 2.6 key available by finger or server. http://www.infonex.com/~loki/ "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ---------------------------------------------------------- --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Woops! Lest I forget... (was Re: dbts: Hettinga's Road Trip toLondon...)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Simon Fedida" <windjammer(a)cableinet.co.uk> To: "Duncan" <dgs(a)live.co.uk>, "Robert Hettinga" <rah(a)shipwright.com> Subject: Re: dbts: Hettinga's Road Trip to London... Date: Fri, 13 Nov 1998 20:24:36 -0000 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Robert - My name is Simon Fedida, a colleague of Duncan's. Don't forget you are giving a talk at the London Business School on Monday 23 November...so don't accept too many beer invitations on monday!! Looking forward to meeeting you Simon -----Original Message----- From: Robert Hettinga <rah(a)shipwright.com> To: Digital Bearer Settlement List <dbs(a)philodox.com>; dcsb(a)ai.mit.edu <dcsb(a)ai.mit.edu>; e$(a)vmeng.com <e$(a)vmeng.com>; cryptography(a)c2.net <cryptography(a)c2.net>; cypherpunks(a)cyberpass.net <cypherpunks(a)cyberpass.net>; mac-crypto(a)vmeng.com <mac-crypto(a)vmeng.com> : : <snip> --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

reptilian politicians
by Anonymous 17 Dec '03

17 Dec '03

>November 12th, 1998 the Toronto Board of Health announces they > want to ban private >owner ship of snakes, turtles, any and all exotic pets. >Reaction of pet owners was immediate. In this city of just under 3 >Million people, most said they would not abide by the law and >hide their beloved pets. In california, possession of a ferret is illegal. But its illegal for people eat california horses. Or burros, senators, and other asses. Those in the Ferret Underground (TM) find that horsemeat is now cheaper, and the furry ones love it. --Weasels ripped my flesh

1 0

Rememberance Day 1998.
by Jean-Francois Avon 17 Dec '03

17 Dec '03

================= forwarded from CFD V2 #696 ============ Date: Fri, 13 Nov 1998 06:03:49 -0600 From: Dan MacInnis <dan.louise(a)sympatico.ca> Subject: Rememberance Day 1998. It is past eleven O'clock here. It is November 11th, 1998. On this date every year my mind always returns to thoughts of my uncle, whose body, it's elements long ago returned to the earth, the dust undisturbed in a European grave, the man for whom I was renamed when the sad news reached my mother and grandfather on that early spring morning many years ago. Even as child their wet faces impacted me, forever. It drifted today to Ottawa, where I once stood cold but proud close to one Paul Hellyer, then Minister of National Defense under the Honorable Prime Minister Lester Bowles Pearson. It was Rememberance Day, Paul was delivering the obligatory service beside a Cenotaph, the soldiers, sailors and airmen stood at ease waiting for the ceremonies to end, pretending to listen to his resonant, educated voice. It was a bitter cold day, I knew they would prefer to be at their homes, or in their messes or just anyplace but on parade that day. I was proud to be associated with a government, indeed a country even, with such diversity, such room for individuals to work, play and overcome the challenges each would experience. It honestly was a Free Canada, individuals could aspire to whatever their imaginations deemed them worthy to become. Later that evening, at a Military function, a member of the RCAF suggested to me, each of us with the government issued glass in the right hand, white serviette properly wrapped around it to keep the hand warm and dry for handshaking, that someday he expected I would be Minister of National Defense. Sadly enough, we both believed it. But today is November 11th, 1998, at about 11:50 AM. My pride in the Liberal Party of Canada has been shattered. My belief that issues like Conscription, which polarized our founding peoples for two generations, would never surface, ever again, gone. My belief that MY PARTY stood for individual rights, the only force that would stand between the Elite's and the common person, gone. Forever. So it a doubly sad day for me. My uncle, and my Party. Bill C68 has intruded into the lives of so many Canadians, and if left to stand as is, will undermine everything I stood there that cold Ottawa morning to pay tribute, and everything my uncle died for in that foreign field so long ago. He died with no idea the rifle he carried to fight for our freedoms would become such a divisive symbol a few short years later. On this morning I shall not revisit the implications of C68. Rather, I will ask those struggling to preserve out heritage to continue the fight. Do not surrender. Then, when it becomes our time to let our earthly possessions go, when our bodies begin the journey back to the dust from whence they came and our spirits return to source, perhaps the cold white silk of the casket or the sides of the urn holding our ashes will be a bit warmer knowing we did all we could for those who follow. Anything less of us would be shameful.

1 0

RE: Rivest Patent
by Harvey Rook (Exchange) 17 Dec '03

17 Dec '03

It's a little bit more complicated than that. RC-6, which also uses data dependant rotations is patent free. Harv. > -----Original Message----- > From: Eric Cordian [mailto:emc@wire.insync.net] > Sent: Friday, November 13, 1998 11:25 AM > To: cypherpunks(a)cyberpass.net > Subject: Re: Rivest Patent > > > JYA writes: > > > Ron Rivest received on November 10 "US Patent 5835600: > > Block encryption algorithm with data-dependent rotations:" > > http://jya.com/rivest111098.htm (22K) > > So we can't use the rotate instruction with a data-dependent shift > count in a block encryption algorithm without a license from Ron? > > Foo on that. > > -- > Sponsor the DES Analytic Crack Project > http://www.cyberspace.org/~enoch/crakfaq.html >

2 1

Re: Info Age Crime Terror and War
by Ernest Hua 17 Dec '03

17 Dec '03

Tim May wrote: > At 9:09 AM -0800 11/13/98, John Young wrote: > > Senator Kyl has issued a long report, "Crime, Terror & > > War: National Security and Public Safety in the Information > > Age," ... > > http://jya.com/ctw.htm (97K) > > I'll address one section, near the end of the report: > ... While I wholeheartly believe that the open-minded and interested public would want to hear these mindless rants responded to with some rationality and reason, I don't believe, for a moment that Kyl & gang are serious about debating anything. (Ok, there is a TEENY chance he is just confused.) My money on the claim that these are yet more rhetoric thrown out to confuse as many people who are easily taken over by sound bites as possible. It's not as easy to explain the practical reasons why crypto restrictions are unenforcible and unreasonable, but it's easy to trumpet the national security cause and to raise the spectre of police not being able to protect lil' Johnny and Mary. What I was hoping for from the pro-crypto ads was something like this: 1. Lil' Suzy writes E-Mail to Lil' Mary to meet at the mall at some well-lighted public place. 2. Child molestor X intercepts E-Mail, but it's weak 40-bit encryption, and he breaks it. 3. Mr. X forges E-Mail from Mary to Suzy changing the meeting location to some dark corner A, and forges E-Mail from Suzy to Mary changing the meeting locaiton to some dark corner B. 4. Mr. X's co-conspirators, Mr. Y and Mr Z intercepts Mary and Suzy at the respective dark corners ... they scream for help ... no one answers at either location ... fade to black ... This is the sort of stuff that would really counter the stupid rhetoric from Sen. Kyl. Ern

1 0

U.S. Attorney Morgenthau on Money Laundering
by David Watts 17 Dec '03

17 Dec '03

New York Times November 9, 1998, Monday Editorial Desk On the Trail of Global Capital By Robert M. Morgenthau What are the five largest financial centers in the world? Many will name New York, London, Tokyo and Hong Kong. But how many will guess the fifth? It's the Cayman Islands -- or so, at least, its Government claims on its Web site. It's certainly the case that huge companies -- including hedge funds like Long-Term Capital Management -- have made the Caymans their nominal home. And bank regulators in the United States have confirmed that bank deposits on the islands now total about $500 billion, twice the amount of four years ago and more than the amount on deposit in the New York Federal Reserve District. That is about $14 million for every man, woman and child in the Caymans. The financial community there consists of 575 banks and trust companies. More than 20,000 corporations are chartered on the Caymans. What draws so many capitalists to so unlikely a spot? Secrecy, for one thing. In the United States, capital markets are regulated by requiring transparency in financial dealings. The Caymans, by contrast, have no such openness, no tiresome restrictions on the pursuit of wealth. With respect to regulation, the Caymans have won the race to the bottom. Take, for example, Long-Term Capital Management, which had to be bailed out earlier this year. The fund's basic operations are conducted in Connecticut, but it is chartered in the Cayman Islands. The fund kept the details of its borrowings and investments secret -- a result not obtainable where there must be concerns for the curiosity of regulators. The results were disastrous. No one knew the absurd extent to which Long-Term Capital's confident superstars were leveraging their assets -- until the bubble burst. The Caymans' financial secrecy laws make it easy to hide suspect dealings. It is now well known that the Bank of Credit and Commerce International, whose collapse in 1991 was the biggest banking scandal in history, took advantage of those laws. Beyond the assistance they lend to criminals, secrecy laws aid reckless acts by high-rolling entrepreneurs. But in fact, most of the ''offshore'' Cayman banks are run not from the islands, but from New York. Amazingly, the Cayman Government Web site itself boasts that, of the 575 banks and trust companies ''based'' in the islands, a full 106 actually have a physical presence there! Resort to these institutions is a simple charade. What would happen if a determined American bank inspector flew to the islands and demanded to see the books of one of these institutions? He would be arrested. It's the law. There is yet another explanation for the remarkable blossoming of financial institutions in the Cayman Islands. The islands have no income tax, no capital gains tax, no value added tax, no sales tax, no inheritance tax and no tax treaties. Sophisticated Americans place billions in Cayman investment vehicles like Long-Term Capital that are carefully structured to reduce American tax liability. Citizens of other countries invest billions there so their incomes will be exempt from American taxes. Commendably, the Treasury Department recently resolved to study ways to keep sham transactions from having an impact on tax liabilities, and the Group of Seven industrialized nations has said that hedge funds should ''possibly'' be subject to disclosure rules. But those are only tentative steps. More can be done. The Cayman Islands are a British dependency, and both the governor and the attorney general are appointed by the British Government. This means Britain can end the laissez-faire practices of the islands. And since, from a financial perspective, the islands are an American dependency, Washington can also stop the offshore shenanigans -- for instance, by imposing more prudent oversight of lenders doing business with Cayman entities. The Caymans are only part of the problem. The Isle of Jersey, the British Virgin Islands, Cyprus, Antigua, Liechtenstein, Panama, the Netherlands Antilles, the Bahamas, Luxembourg and, of course, Switzerland all offer ''offshore'' sanctuary. Until action is taken to eliminate these havens, taxpayers and honest players in the financial markets will be at a very unfair disadvantage. _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

nCipher joined KRAP/GAK drive too?
by Adam Back 17 Dec '03

17 Dec '03

This arose out of a discussion on ukcrypto about NAI (which PGP Inc is now part of) having recently rejoined the KRA list -- I notice that nCipher are on it too, and there was a earlier exchange on ukcrypto about nCipher... ========= nCipher too are now on the KRAP list (wonder how long for?) Bruce Tober forwards from www.kra.org: > [...] > nCipher Corporation Ltd. nCipher fairly recently made some press release that was commented on on this list as sounding a bit in favour of UK/DTI/GCHQ GAK attempts. Then they claimed that it was just being read incorrectly and the text was neutral and the title that was badly chosen and by hired PR. So nCipher guys, how do you explain the membership of KRAP away? >From the last list discussion, Ian Jackson, who works for nCipher wrote: : We do not have any weakened or GAK products. The Marketing Director : has assured me that we have no plans to produce any. also: : So, in summary, there are no artificial restrictions on the sizes of : keys which can be used, generated or stored by our units, and no : backdoor GAK or key recovery facilities. given the KRAP membership one might have cause to be worry that this may not still be true. Perhaps people using recent nCipher boards or with recent software upgrades ought to read the specs real closely -- to see if it admits to encrypting stuff to GCHQ also! Ian also wrote (in a post marked as not an official nCipher statement): : I personally would feel that putting deliberate backdoors or other : similar things into our products would be highly unethical and I would : have nothing to do with it. and: : This has nothing to do with the spooks or escrow or anything of the : kind. That's what GAK and KRAP is all about -- putting backdoors into products which the government and secret service groups like GCHQ, NSA and ECHELON get the keys to. and: : I do believe that the personal views of senior management at : nCipher - particularly towards the technical end - are opposed to : escrow et al. Perhaps those technical types could have a go at prevailing over whichever marketing type or suit decided to sign up for KRAP. This is not intended to attack Ian, as he seemed pretty much against GAK, and Niko van Someren to some extent too. Not so sure about the other non technical can Someren, but clearly someone in nCipher thinks KRAP and GAK are a good marketing ploy. Otherwise, I figure you're better off giving money to DEC alpha than supporting GAKkers. Alpha's run SSLeay pretty fast. Adam ========= and a second post, with more specifics: ========= I wrote: > nCipher too are now on the KRAP list (wonder how long for?) here we go: http://www.ncipher.com/news/files/press/97/keyrecov.html since May 97! contains such gems as: : We are delighted to support the Key Recovery Alliance," said : Alex van Someren, President of nCipher. so that pin-points at least one GAK enthousiast at nCipher. It also makes for some rather strange contradictions. The flap about nCiphers apparent whole-hearted support for DTI GAK attempts was May this year -- nCipher had already been a paid up KRAP member for a whole year. press release continues (least there is any confusion as to what KRA as an organisation is about): : Encryption makes information readable only to a person holding a : unique "key" which will unlock the data. Encryption is critical to : ensure the security of sensitive information that is either stored : electronically or sent over public networks such as the Internet. : Key recovery is a new method that allows for authorized access : to encrypted information without the need to store or "escrow" : any encryption keys with a third party. Key recovery is an : effective tool to meet commercial, private and institutional needs. institutions obliquely mentioned being presumably the likes of GCHQ and NSA? yet Ian was saying: > : So, in summary, there are no artificial restrictions on the sizes of > : keys which can be used, generated or stored by our units, and no > : backdoor GAK or key recovery facilities. saying there were no key recovery facilities, and : We do not have any weakened or GAK products. The Marketing Director : has assured me that we have no plans to produce any. and no plans to install any. yet this is what KRA is all about, and they were signed up to it already at that time. I suppose someone is now going to try to claim that KRA is all about key recovery for commercial purposes, but not for government -- but this is not the way I understand that KRA came into being at all. I think it is very much a NSA led attempt to further the clipper attempts. If I recall it started in the wake of the NSA/NIST attempts at clipper IV (or whatever number it was at by then) to coerce companies into including software based key escrow. Probably tied up with the permission to use marginally higher key lengths if the company can demonstrate to NSA a plan to introduce GAK in two year time scale (within the US), though I may be forgetting the details. Anyone like to clarify KRAs aims and history? Adam

1 0

[ISN] Privacy Group Pushes For Hearings on ECHELON (fwd)
by Jukka E Isosaari 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 13 Nov 1998 06:52:45 -0700 (MST) From: mea culpa <jericho(a)dimensional.com> To: InfoSec News <isn(a)repsec.com> Subject: [ISN] Privacy Group Pushes For Hearings on ECHELON Push for hearings on Echelon: Global spy system needs scrutiny, says rights group http://www.worldnetdaily.com/bluesky_exnews/19981112_xex_push_hearing.shtml Stephan Archer In an effort to create some accountability between the country's citizens and the National Security Agency's top-secret global surveillance system known as Echelon, the Free Congress Foundation is urging that congressional hearings be held concerning the NSA's use of the system. Originally, Echelon was designed to spy on the Communist Bloc during the Cold War. However, since the end of the Cold War, the NSA has used it for other questionable purposes that include spying on the citizens of U.S. allies as well as the citizens of other countries, commercial spying, and even domestic spying. In essence, Echelon works through a series of high-tech spy facilities located primarily in five countries: the United States, Canada, England, New Zealand, and Australia. These countries, which are sworn to secrecy about the project in a secret agreement known as UKUSA, all actively take part in this encroachment of privacy into the lives of the people of the world by collecting virtually all fax transmissions, e-mails, and phone calls. Not even cellular phone calls escape the grasp of the Echelon system. "Obviously, we need to have these capabilities," said Wayne Madsen, who worked in the National COMSEC Assessment Center at the NSA's Fort Meade, Maryland, facility back in the 1980s and is currently a senior fellow at the Electronic Privacy Information Center. As an example of our country's need for the system, Madsen said, "No one can argue about using the system to counter terrorism. Where people will have a problem is where Echelon is used for political and business interests." The Echelon system gets most of its data by collecting all transmissions handled by the Intelsat and Inmarsat satellites, which are responsible for much of the electronic communication that takes place between countries. Earth-bound communication is sucked up and absorbed by other spy satellites that the NSA has launched into space. "It's a huge vacuum cleaner," said Madsen. Once these spy facilities collect the phone calls, e-mails, and faxes, of virtually everyone on earth, the Echelon system sorts them through a kind of filter system known as the Echelon dictionary. This dictionary looks for "flag" words in all of the transmitted communication. While it lets a majority of all collected material pass through its filter, it tags those that may pose a threat and tracks all subsequent communication coming from the source of the original "flagged" message. Concerning Echelon's inherent intrusion on people's privacy, Patrick Poole, the deputy director for the Center of Technology Policy at the Free Congress Foundation, said, "While we understand the need for the intelligence power embodied by Echelon, the indiscriminate use of Echelon presents major threats to liberty not only to U.S. citizens but to citizens around the world." And this threat is real. The foundation's report states that U.S. leaders have, in fact, already abused this awesome technology. For example, the report states the following: "In September 1993, President Clinton asked the CIA to spy on Japanese auto manufacturers that were designing zero-emission cars and to forward that information to the Big Three U.S. car manufacturers: Ford, General Motors and Chrysler." "You can assume that all major U.S. corporations are fed items of interest (via Echelon) from time to time to give them a leg up on international competitors," said Madsen. Although this may be seen as a strategic corporate weapon for American businesses, in reality, it's an example of technology that can get out of hand. For example, former Canadian spy Mike Frost stated in his book, "Spyworld," that in 1981, there was an "accidental" cell phone intercept of the American ambassador to Canada that resulted in the U.S. getting outbid by the Canadians in a grain deal with China. The deal brought in $2.5 billion for the Canadian Wheat Board. With this kind of abuse of Echelon's power, the question as to whether or not the U.S. government has been using this power for political purposes can be easily raised. This question is seemingly answered in the foundation's report. "The discovery of domestic surveillance targeted at American civilians for reasons of 'unpopular' political affiliation -- or for no probable cause at all -- in violation of the First, Fourth and Fifth Amendments of the Constitution is regularly impeded by very elaborate and complex legal arguments and privilege claims by the intelligence agencies and the U.S. government," the report says. When asked if the system has been used by the U.S. government to spy on its citizens, Madsen told WorldNetDaily that he was sure it has been. "I don't believe that the NSA or the current Administration would hesitate to use this system on American citizens for their own agendas," he said. Outraged by this flagrant abuse of power illustrated by our country's elected officials, Poole said, "While the U.S. is the prime mover behind the Echelon system, it's shameful that the European Parliament is the body holding the constitutional debate in regards to Echelon today." A September 1998 report for the European Parliament by the Omega Foundation said, "Within Europe, all e-mail, telephone, and fax communications are routinely intercepted by the United States National Security Agency. According to the Omega Foundation report, it is this ability of the NSA that brings major concern to the European Parliament. In an effort to bring the issues surrounding Echelon to the forefront of American politics, the Free Congress Foundation plans to send out a report about Echelon to all of the 500 policy organizations in the U.S. as well as to select members of Congress. These select individuals include members from both the House and Senate intelligence committees as well as House and Senate Constitution subcommittees. Copies of the report will also be sent to the congressional leadership of both parties. Although the foundation is hoping to get some action out of these members of Congress, Poole said that support at the grassroots level of our nation's political structure will be a must if this issue isn't to end up buried by the intelligence committees. "For there to be any account and oversight to the Echelon system, the American people are going to have to contact their elected representatives in order to investigate the abuses that we know have occurred in regards to the Echelon system," Poole said. See Free Congress Foundation's report on Echelon at: http://www.freecongress.org/ctp/echelon.html -o- Subscribe: mail majordomo(a)repsec.com with "subscribe isn". Today's ISN Sponsor: Repent Security Incorporated [www.repsec.com]

1 0

Enter Symbol's Developer Contest at the Palm Computing Platform Developer Conference!!! (revised message)
by palmdeveloper＠palmdevcon.com 17 Dec '03

17 Dec '03

Symbol announces the first annual Symbol SPT 1500 Developer Contest!!!!! You could win a Toshiba Tecra 780 DVD 266 MHz Pentium II Notebook by developing the Best SPT 1500 Application or You could win a EXP PC Card DVD Traveler Bundle by developing the Best Riverbed Scout MTS Application or the Best Puma Satellite Forms Application or the Best IDEAM EZTrak Application. Other cool prizes will also be awarded. Everyone who participates will receive a t-shirt. You must be a registered attendee of the Palm Computing Developer Conference to participate. Winners will be announced at the Conference on December 4. For more details on the contest, and to register for the conference, point your browser to http://www.palmdevcon.com.

1 0

Enter Symbol's Developer Contest at the Palm Computing Platform Developer Conference!!! (revised message)
by palmdeveloper＠palmdevcon.com 17 Dec '03

17 Dec '03

Symbol announces the first annual Symbol SPT 1500 Developer Contest!!!!! You could win a Toshiba Tecra 780 DVD 266 MHz Pentium II Notebook by developing the Best SPT 1500 Application or You could win a EXP PC Card DVD Traveler Bundle by developing the Best Riverbed Scout MTS Application or the Best Puma Satellite Forms Application or the Best IDEAM EZTrak Application. Other cool prizes will also be awarded. Everyone who participates will receive a t-shirt. You must be a registered attendee of the Palm Computing Developer Conference to participate. Winners will be announced at the Conference on December 4. For more details on the contest, and to register for the conference, point your browser to http://www.palmdevcon.com.

1 0

Re: DBS, Privacy, Money Laundering nonsense.
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:57 PM -0500 on 11/13/98, Black Unicorn wrote: > If only we could be rid of this pesky cash would could eliminate organized > crime forever. Reminds me of something Vinnie Moscaritolo, my alter ego and Samoan attorney, once said. "'If we could just pass a few more laws' we could all be criminals." Nonetheless, I think that DBS will be much more about economics than privacy or even law. The contrapositive of Unicorn's excellent rant is that the market for money "laundering" and financial privacy is a rediculuously small fraction of the market for economic efficiency. That digital bearer settlement gives us more or less perfect financial privacy if done under certain conditions is much more a happy accident than anything else, just like the cheapest way to do a transaction prior to blind signatures and hash collisions was with book-entry transactions instead of paper bearer certificates. I suppose it *might* turn out that you really *can* do an instantaneously executing, clearing, and settling on-line realtime book-entry transaction, for everything from pico- to quadridollars, and it would be cheaper, both macroeconomically and microeconomically, than a digital bearer one, but I just don't think it's possible at all. And, of course, we wouldn't have coach fare to Cleveland without a bunch of "fanatics" out there, prattling away about slipping the surly bounds of earth, the joy of flight, and all that... ;-). Thank god for the "fanatics", I say, but let's make sure we pay attention to Bill Bradley's adage that it's bad luck to be behind at the end of the game. Whatever is cheapest while still remaining a functional bearer protocol wins, in other words. And, in my book, "functional" means "functionally anonymous". It's just cheaper that way. Having a plane that actually flies is way cheaper than one which just goes fast down the runway, or even one which scoots along nicely off the ground, but only in ground effect. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNk0f7cUCGwxmWcHhAQErBQgAhaFscqaknL0EMnsiKMWYgoHntw88JE2Z 11K8/oyoG/dX8eus5Wqnh05eVY8JWGQ9Fu3C2uXPZbZCa5wh7tjrmIcWOTDgx8kC Sz11IJJLdcWrdTPw7a1sf/WwhyG4f7NVlyVGNqMVuGrBjImsC5TtG2yU39DVME08 ZR3bVdn6egcCDpve+E7RQ0LYWDHxitxYV3RIaCG/wj9zp5JrMPTAvIgbT+J62T8s bYUNJyf7XQnkcT5275VLAzFYy+3KBRuyp9k6uIhBaBGKBNRUw/wBwTB8NoBMPcd8 AT3276SNz1oBA+Z/R0JPRBrRkAfio2o3DFIXoC5NY49ikpBuyOEQHg== =R0aY -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

New Electronic Financial Services Links
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: johnmuller(a)mail.earthlink.net Date: Fri, 13 Nov 1998 16:11:55 -0800 To: e-carm(a)c3po.kc-inc.net, dbs(a)philodox.com, dcsb(a)ai.mit.edu From: John Muller <johnmuller(a)earthlink.net> Subject: New Electronic Financial Services Links Mime-Version: 1.0 Sender: <dbs(a)philodox.com> Precedence: Bulk List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> X-Web-Archive: http://www.philodox.com/dbs-archive/ New links that will shortly be added to the ABA Joint Subcommittee on Electronic Financial Services Web site (http://www.abanet.org/buslaw/efss) in no particular order: Dept. of Commerce request for input on data privacy principles "safe harbor" http://www.ita.doc.gov/ecom/menu.htm SEC announces 23 enforcement actions for Internet stock fraud http://www.sec.gov/news/netfraud.htm RISKS Digest Vol. 20 No. 6, Dan Geer - "Risk Management is Where the Money Is" http://catless.ncl.ac.uk/Risks/20.06.html European Commission proposes a directive on distance selling of financial services http://europa.eu.int/comm/dg15/en/finances/consumer/891.htm European Commission proposes a framework for the European financial services sector to facilitate cross-border operation http://europa.eu.int/comm/dg15/en/finances/general/fsen.htm European Commission press release: the EU Data Protection Directive takes effect http://europa.eu.int/comm/dg15/en/media/dataprot/news/925.htm Federal Reserve announcement on enhanced settlement services http://www.bog.frb.fed.us/boarddocs/press/BoardActs/1998/19981103/ Federal Reserve announcement of reduction in fees for electronic payment services http://www.bog.frb.fed.us/boarddocs/press/BoardActs/1998/19981104/ OTS policy statement on privacy of customer information http://www.ots.treas.gov/docs/77879.html Journal of Information Law and Technology issue on Globalisation and E-commerce http://elj.warwick.ac.uk/jilt/issue/1998_3/default.htm Papers from the 21st National Information Systems Security Conference http://csrc.nist.gov/nissc/1998/papers.html BCI - Northern Trust 2nd Circuit case under UCC Article 4A and common law seeking a return of funds from an electronic funds transfer http://www.law.pace.edu/lawlib/legal/us-legal/judiciary/second-circuit/test3 /97-7633.opn.html Hogan Systems v. Cybresource 5th Circuit decision on copyright and trade secret claims arising out of third party contractor use of software licensed to a bank http://laws.findlaw.com/5th/9710645CV0.html FTC comments on proposed UCC Article 2B http://www.ftc.gov/be/v980032.htm The ERISA Industry Committee comments to the IRS on the use of new technologies in retirement plans http://www.eric.org/testimony/technologies.htm Council of Europe - model contract clauses on transborder data flows http://www.coe.fr/dataprotection/ectype.htm E*Trade invests in International Securities Exchange, an electronic options exchange in development http://www.etrade.com/cgi-bin/gx.cgi/AppLogic+Home?gxml=pr111098c.html Electronic Markets Vol. 11 No. 3 on electronic contracting http://www.electronicmarkets.org/netacademy/publications.nsf/all_pk/929 Adrian McCullagh article on Trust in Electronic Commerce http://www.acs.org.au/president/1998/past/io98/etrust.htm CheckFree and others form the Electronic Banking Association http://www.e-banking.org/ John Muller johnmuller(a)earthlink.net "Things are not as they seem, neither are they otherwise" --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

DBS, Privacy, Money Laundering nonsense.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Black Unicorn" <unicorn(a)schloss.li> To: <tboyle(a)rosehill.net>, "dbs" <dbs(a)philodox.com> Subject: DBS, Privacy, Money Laundering nonsense. Date: Fri, 13 Nov 1998 22:57:51 -0600 Keywords: dbs MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: <dbs(a)philodox.com> Precedence: Bulk List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> X-Web-Archive: http://www.philodox.com/dbs-archive/ tboyle(a)rosehill.net comments: [...] > But I simply cannot comprehend the breadth of the agreement > on this dbs conference, and depth of conviction, that DBS money > should be designed with the **deliberate objective** of being > untraceable, for purposes of law enforcement or taxation. In the case of some DBS advocates you are overstating the matter. In the case of others, vastly understating it. > I have a lot of respect for you guys' intellect but I think > you're wrong on two fundamental points: > > 1. Rule of law. Money laundering is a critical piece in > organized crime. The democratic countries have banking laws. > Do you think these laws should be followed, or NOT? (Scurrying > of feet as all the DBS readers avoid answering.) Well let's examine this. The view that all democratic countries have banking laws really begs the question. "What are the differences between said laws." I can tell you with solid authority, they are many. I've often repeated this story here and elsewhere. It's all a matter of public record. Set the way-back-machine to just after Reagan has entered office. Ole Ron began to crack down on tax evasion and in particular offshore havens. Taxes would be cut, it was reasoned, but only if loopholes were filled and evaders rooted out. (Those of us old enough to remember might even recall nodding at the sense of it). This policy was particular hard on certain Caribbean nations. This was the time of operation Tradewinds (search for it in the congressional record) and other IRS black projects where the IRS actually violated local law to spy on foreign banks even going so far as to drug guards, steal the briefcases of banking executives, perform unwarranted searches, bribe foreign officials and all manner of nonsense to root out tax evaders which might also be U.S. citizens. For a long while there was a project which opened and Xeroxed all the incoming mail at JFK which appeared to originate from offshore havens. This wasn't in the 50's mind you, but the 80s. It was acts like these which prompted the Swiss to strengthen their banking secrecy during the Second World War. Just another day in the park in the U.S. Just recently this year Mexico nearly indicted several U.S. law officials for breaking Mexican law during the investigation of several Mexican banks. Clearly the practice hasn't abated much in the last 15 years.. (Note also that today all these methods (except for drugging guards maybe) have their legal equivalents in the United States, which is in itself a powerful statement). This continued for some time back when Ron was at the helm until the United States finally began to threaten to revoke the U.S. charters of certain banks it considered uncooperative. At this point a visitor, unannounced, flew into D.C. and literally dropped by the White House with no press coverage or fanfare at all in the late evening. That visitor was Margaret Thatcher and she proceeded to explain to Ron over the course of a few hours that if he kept it up many of the British Protectorates would literally have their economies crippled. Literally overnight the matter was dropped and the offshore centers left to quietly continue their business. So much for democratic countries with universal ideas about banking law, or the rule of "law and order" in banking regulation. This is but one example. So: Rule of Law - means little in the global-political scheme of things Democratic Countries Have Banking Laws - none of which are consistent or consistently applied Money Laundering is a Key Piece of Organized Crime - This begs a definition of Money Laundering. "Concealing the proceeds of a criminal act" sounds legitimate, but consider that it has been held to apply to a store clerk who sold food stamps for cash and deposited the proceeds in his personal (non-anonymous) checking account: Indicted in Federal Court for Money Laundering with a maximum possible term of 35 years. (This is a prosecutorial tactic to get a guilty plea to the basic theft charge). Consider also that third parties often take it on the chin with the wide definition currently applied. Case in point: Ma and Pa travel agency innocently accepts a deposit from notorious attorney of drug dealer. Their entire holding account is seized including the deposits of some 700 other potential travelers. After 7 years of fighting the seizure, the money is finally returned, without interest. (Effectively halfing the value of the funds). The business is ruined, its reputation in tatters. Ma and Pa fight it out in bankruptcy, lose their house, most of their retirement proceeds, etc. In the process this case sets the precedent that any amount of illicit funds ($1) deposited in any size account ($500 million) will render the entire account liable to seizure and permit it to be held in lieu of forfeiture hearings. That can go on for 7 years or so. Money which is "laundered" has its title literally revert to the U.S. Treasury. This means third parties who innocently accept these funds are liable for their return, even if they are passed on in the course of business. Beginning to seem silly? Money laundering is an invented offense. It's definition in the United States has grown so broad so as to be laughable, if not so frightening. Do not think that these are isolated incidents. So, money laundering in its commonly understood sense might be key to organized crime, but what passes for money laundering in the United States has little to do with it. Myth: Money Laundering laws have a serious impact on organized crime. This is increasingly nonsense. The United States spends close to $22,000.00 to seize $1.00 of illicit funds. Money Laundering today is extremely sophisticated and enforcement doesn't catch the drug dealers, it catches professional money launderers. Today if you are a drug lord you drop $30 million in cash with a professional launderer who cuts you a "clean" check for 85% of that figure or so on the spot and takes the risk of laundering the funds on his own. Myth: Money Laundering can be detected accurately and effectively and leads to drug and organized crime convictions. Nonsense. Assume for sake of argument that you could detect 99% of fraudulent transactions with the measures in place (entirely impossible) and that your false positive rate was only 1% (also entirely impossible). SWIFT alone processes $2 trillion per day. That's on the order of $600 trillion per year, just in SWIFT. (Add another $1.3 billion for CHIPS and $989 million for Fedwire daily. Oh, don't forget the foreign exchange markets, oh and NYSE, oh and NASDAQ, oh and international letters of credit, oh and...) The most sinister estimates of the global criminal economy (primarily drug money) run around $400 billion per year. Your false positives will identify $6 trillion in naughty funds that are actually pure just in SWIFT. Your correct hits will identify $396 billion in naughty funds in all systems worldwide. In this example you will have 15 times as many false hits as correct hits ignoring the lionshare of world financial systems. This is under the very best of circumstances. It's a losing game.. It's a game only the mathematically challenged or politically motivated will play. In fact, money laundering is a tack on offense that is brought to bear after an arrest on other charges has been made. The number of cases that originate with a money laundering investigation is vanishingly small. The payment system today eats up over 1.5% of the GNP primarily because of nonsense regulations like CTR's and other transaction reporting requirements which can cost up to $15 per transaction and (as we see above) have little if any effect on professional money laundering. Given these numbers the degree of "fraud" in the world financial system is far better than in the credit card system, which has pretty much reached equilibrium. (Fraud accounts for about 5% of credit card costs. Customer service accounts for about 15%). > There is a certain logic in the notion of having a legislative > process and laws. Our laws in the U.S. weren't written by > angels up in heaven, but they are better than some other places. In the case of money laundering regulation I should say almost _no_ other places. > If DBS participants advocate that money laundering laws are > not to be followed, I'm sorry but YOU GUYS have the burden > of logically arguing your position. So shut up and quit > raggin' on *me* about it. I would just like to see them applied with rationality. It's fairly clear that that's too much to ask of the United States. Interestingly enough it's typically multi-party systems of government that have a balanced approach to money laundering. Perhaps this is because grandstanding with things like "the war on drugs" isn't as effective outside of a two party system. Sheds new light on your comment about democracies and banking regulations. Some jurisdictions get along quite well without the nonsense perpetrated in the United States. Like Switzerland. Switzerland has one of the nicest things in a cash economy I have seen. A freely circulated 1000CHF note. It's worth about $750. (The United States phased out $500 bills long ago to deal with laundering). In Switzerland you can drop a 1000CHF note at a restaurant and no one bats an eye. In the U.S. you cant take a cab home from the International Terminal unless you have something smaller than a $50. Somehow Switzerland has manage to survive without looting in the streets and rampant crime. Luxembourg is in a similar situation. I tried to purchase a car some years ago outside of D.C. with cash. Completely legitimate transaction. No interest nonsense for me to worry about. No waiting for the car while the check clears. Simple. Right? The dealership called the police, convinced they were striking a blow against drug dealers. It's really gone too far. > 2. Practicality. Without at least a fig leaf of cooperation > with banking authorities and other police, DBS will not be > permitted. Transactions denominated in DBS won't be enforceable > in courts, and fraud won't be a crime. Reporting fraud in DBS > deal would be like reporting a fraud in purchase of heroin. Practicality? Of course any student of political science will understand that where government enforcement of contracts fails or falls short, organized crime tends to move in. Reporting fraud in the purchase of heroin to the right enforcement cartel tends to be much more effective in rendering results than U.S. courts I'd wager. Clearly, the United States would not benefit by forcing DBS underground. Several jurisdictions will permit DBS and enforce it. (I'm involved in the legislative process for one such law in a European jurisdiction now). If you believe that DBS should be outlawed then you must agree that cash should be outlawed. There is effectively no difference but velocity. > The principal reason for failure of electronic money, other > than cards used in physical establishments, is you can't trust > the seller to send you the goods. That's why everybody is > using credit cards, and bearing the 2-3% charge for "insurance". > > You guys seem to think untraceable DBS will be accepted, if > only a good enough encryption algorithm can be found???? 1% of the GNP. Instant 1% growth for changing a system of clearing. Think about that for awhile. > I think your ideas have a fatal, logical weakness. Without > any practical means to verify who got your money, or even > a legal *right* to enforce a contract, what good is dbs? > It's not even money. It's more like a coupon or something. What you are missing is that all your arguments apply equally to cash. Why is cash used if this is so? Prove to me that you just gave me six $100 bills. You are, "without any practical means to verify who got your money or even a legal *right* to enforce a contract" if the transaction is larger than $500. If only we could be rid of this pesky cash would could eliminate organized crime forever. --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

4 4

DBS, Privacy, Money Laundering nonsense.
by Robert Hettinga 17 Dec '03

17 Dec '03

Long-time DCSBers will remember Unicorn's talk on money laundering to us a few years ago... This more recent rant of his on the Digital Bearer Settlement list is about the best articulation of his position that I've seen him write. Cheers, Bob Hettinga --- begin forwarded text From: "Black Unicorn" <unicorn(a)schloss.li> To: <tboyle(a)rosehill.net>, "dbs" <dbs(a)philodox.com> Subject: DBS, Privacy, Money Laundering nonsense. Date: Fri, 13 Nov 1998 22:57:51 -0600 Keywords: dbs MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: <dbs(a)philodox.com> Precedence: Bulk List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> X-Web-Archive: http://www.philodox.com/dbs-archive/ tboyle(a)rosehill.net comments: [...] > But I simply cannot comprehend the breadth of the agreement > on this dbs conference, and depth of conviction, that DBS money > should be designed with the **deliberate objective** of being > untraceable, for purposes of law enforcement or taxation. In the case of some DBS advocates you are overstating the matter. In the case of others, vastly understating it. > I have a lot of respect for you guys' intellect but I think > you're wrong on two fundamental points: > > 1. Rule of law. Money laundering is a critical piece in > organized crime. The democratic countries have banking laws. > Do you think these laws should be followed, or NOT? (Scurrying > of feet as all the DBS readers avoid answering.) Well let's examine this. The view that all democratic countries have banking laws really begs the question. "What are the differences between said laws." I can tell you with solid authority, they are many. I've often repeated this story here and elsewhere. It's all a matter of public record. Set the way-back-machine to just after Reagan has entered office. Ole Ron began to crack down on tax evasion and in particular offshore havens. Taxes would be cut, it was reasoned, but only if loopholes were filled and evaders rooted out. (Those of us old enough to remember might even recall nodding at the sense of it). This policy was particular hard on certain Caribbean nations. This was the time of operation Tradewinds (search for it in the congressional record) and other IRS black projects where the IRS actually violated local law to spy on foreign banks even going so far as to drug guards, steal the briefcases of banking executives, perform unwarranted searches, bribe foreign officials and all manner of nonsense to root out tax evaders which might also be U.S. citizens. For a long while there was a project which opened and Xeroxed all the incoming mail at JFK which appeared to originate from offshore havens. This wasn't in the 50's mind you, but the 80s. It was acts like these which prompted the Swiss to strengthen their banking secrecy during the Second World War. Just another day in the park in the U.S. Just recently this year Mexico nearly indicted several U.S. law officials for breaking Mexican law during the investigation of several Mexican banks. Clearly the practice hasn't abated much in the last 15 years.. (Note also that today all these methods (except for drugging guards maybe) have their legal equivalents in the United States, which is in itself a powerful statement). This continued for some time back when Ron was at the helm until the United States finally began to threaten to revoke the U.S. charters of certain banks it considered uncooperative. At this point a visitor, unannounced, flew into D.C. and literally dropped by the White House with no press coverage or fanfare at all in the late evening. That visitor was Margaret Thatcher and she proceeded to explain to Ron over the course of a few hours that if he kept it up many of the British Protectorates would literally have their economies crippled. Literally overnight the matter was dropped and the offshore centers left to quietly continue their business. So much for democratic countries with universal ideas about banking law, or the rule of "law and order" in banking regulation. This is but one example. So: Rule of Law - means little in the global-political scheme of things Democratic Countries Have Banking Laws - none of which are consistent or consistently applied Money Laundering is a Key Piece of Organized Crime - This begs a definition of Money Laundering. "Concealing the proceeds of a criminal act" sounds legitimate, but consider that it has been held to apply to a store clerk who sold food stamps for cash and deposited the proceeds in his personal (non-anonymous) checking account: Indicted in Federal Court for Money Laundering with a maximum possible term of 35 years. (This is a prosecutorial tactic to get a guilty plea to the basic theft charge). Consider also that third parties often take it on the chin with the wide definition currently applied. Case in point: Ma and Pa travel agency innocently accepts a deposit from notorious attorney of drug dealer. Their entire holding account is seized including the deposits of some 700 other potential travelers. After 7 years of fighting the seizure, the money is finally returned, without interest. (Effectively halfing the value of the funds). The business is ruined, its reputation in tatters. Ma and Pa fight it out in bankruptcy, lose their house, most of their retirement proceeds, etc. In the process this case sets the precedent that any amount of illicit funds ($1) deposited in any size account ($500 million) will render the entire account liable to seizure and permit it to be held in lieu of forfeiture hearings. That can go on for 7 years or so. Money which is "laundered" has its title literally revert to the U.S. Treasury. This means third parties who innocently accept these funds are liable for their return, even if they are passed on in the course of business. Beginning to seem silly? Money laundering is an invented offense. It's definition in the United States has grown so broad so as to be laughable, if not so frightening. Do not think that these are isolated incidents. So, money laundering in its commonly understood sense might be key to organized crime, but what passes for money laundering in the United States has little to do with it. Myth: Money Laundering laws have a serious impact on organized crime. This is increasingly nonsense. The United States spends close to $22,000.00 to seize $1.00 of illicit funds. Money Laundering today is extremely sophisticated and enforcement doesn't catch the drug dealers, it catches professional money launderers. Today if you are a drug lord you drop $30 million in cash with a professional launderer who cuts you a "clean" check for 85% of that figure or so on the spot and takes the risk of laundering the funds on his own. Myth: Money Laundering can be detected accurately and effectively and leads to drug and organized crime convictions. Nonsense. Assume for sake of argument that you could detect 99% of fraudulent transactions with the measures in place (entirely impossible) and that your false positive rate was only 1% (also entirely impossible). SWIFT alone processes $2 trillion per day. That's on the order of $600 trillion per year, just in SWIFT. (Add another $1.3 billion for CHIPS and $989 million for Fedwire daily. Oh, don't forget the foreign exchange markets, oh and NYSE, oh and NASDAQ, oh and international letters of credit, oh and...) The most sinister estimates of the global criminal economy (primarily drug money) run around $400 billion per year. Your false positives will identify $6 trillion in naughty funds that are actually pure just in SWIFT. Your correct hits will identify $396 billion in naughty funds in all systems worldwide. In this example you will have 15 times as many false hits as correct hits ignoring the lionshare of world financial systems. This is under the very best of circumstances. It's a losing game.. It's a game only the mathematically challenged or politically motivated will play. In fact, money laundering is a tack on offense that is brought to bear after an arrest on other charges has been made. The number of cases that originate with a money laundering investigation is vanishingly small. The payment system today eats up over 1.5% of the GNP primarily because of nonsense regulations like CTR's and other transaction reporting requirements which can cost up to $15 per transaction and (as we see above) have little if any effect on professional money laundering. Given these numbers the degree of "fraud" in the world financial system is far better than in the credit card system, which has pretty much reached equilibrium. (Fraud accounts for about 5% of credit card costs. Customer service accounts for about 15%). > There is a certain logic in the notion of having a legislative > process and laws. Our laws in the U.S. weren't written by > angels up in heaven, but they are better than some other places. In the case of money laundering regulation I should say almost _no_ other places. > If DBS participants advocate that money laundering laws are > not to be followed, I'm sorry but YOU GUYS have the burden > of logically arguing your position. So shut up and quit > raggin' on *me* about it. I would just like to see them applied with rationality. It's fairly clear that that's too much to ask of the United States. Interestingly enough it's typically multi-party systems of government that have a balanced approach to money laundering. Perhaps this is because grandstanding with things like "the war on drugs" isn't as effective outside of a two party system. Sheds new light on your comment about democracies and banking regulations. Some jurisdictions get along quite well without the nonsense perpetrated in the United States. Like Switzerland. Switzerland has one of the nicest things in a cash economy I have seen. A freely circulated 1000CHF note. It's worth about $750. (The United States phased out $500 bills long ago to deal with laundering). In Switzerland you can drop a 1000CHF note at a restaurant and no one bats an eye. In the U.S. you cant take a cab home from the International Terminal unless you have something smaller than a $50. Somehow Switzerland has manage to survive without looting in the streets and rampant crime. Luxembourg is in a similar situation. I tried to purchase a car some years ago outside of D.C. with cash. Completely legitimate transaction. No interest nonsense for me to worry about. No waiting for the car while the check clears. Simple. Right? The dealership called the police, convinced they were striking a blow against drug dealers. It's really gone too far. > 2. Practicality. Without at least a fig leaf of cooperation > with banking authorities and other police, DBS will not be > permitted. Transactions denominated in DBS won't be enforceable > in courts, and fraud won't be a crime. Reporting fraud in DBS > deal would be like reporting a fraud in purchase of heroin. Practicality? Of course any student of political science will understand that where government enforcement of contracts fails or falls short, organized crime tends to move in. Reporting fraud in the purchase of heroin to the right enforcement cartel tends to be much more effective in rendering results than U.S. courts I'd wager. Clearly, the United States would not benefit by forcing DBS underground. Several jurisdictions will permit DBS and enforce it. (I'm involved in the legislative process for one such law in a European jurisdiction now). If you believe that DBS should be outlawed then you must agree that cash should be outlawed. There is effectively no difference but velocity. > The principal reason for failure of electronic money, other > than cards used in physical establishments, is you can't trust > the seller to send you the goods. That's why everybody is > using credit cards, and bearing the 2-3% charge for "insurance". > > You guys seem to think untraceable DBS will be accepted, if > only a good enough encryption algorithm can be found???? 1% of the GNP. Instant 1% growth for changing a system of clearing. Think about that for awhile. > I think your ideas have a fatal, logical weakness. Without > any practical means to verify who got your money, or even > a legal *right* to enforce a contract, what good is dbs? > It's not even money. It's more like a coupon or something. What you are missing is that all your arguments apply equally to cash. Why is cash used if this is so? Prove to me that you just gave me six $100 bills. You are, "without any practical means to verify who got your money or even a legal *right* to enforce a contract" if the transaction is larger than $500. If only we could be rid of this pesky cash would could eliminate organized crime forever. --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: DBS, Privacy, Money Laundering nonsense.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Sat, 14 Nov 1998 15:55:00 -0400 To: tboyle(a)rosehill.net Cc: dbs(a)philodox.com Subject: Re: DBS, Privacy, Money Laundering nonsense. Mime-Version: 1.0 From: Ryan Lackey <ryan(a)venona.com> Sender: <dbs(a)philodox.com> Precedence: Bulk List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> X-Web-Archive: http://www.philodox.com/dbs-archive/ Also Sprach Todd Boyle (tboyle(a)rosehill.net) > > * If thieves could hide the money they stole, there would be substantial > increase in frequency and severity of theft; I think this is definitely true. Particularly if it is *easy* to hide the money stolen, as criminals may be expert in a particular field of crime that is *not* financial -- it's already easy for a white-collar criminal to hide money, using the same skills used in white-collar crimes of other sorts, but not so easy for an armed robber. > * Reducing trackability of money increases the severity and frequency > of collusive crimes. Reducing trackability and improving the velocity of money *does* do this, but it's a side effect of the more important (and wider spread) effect of useful forms of money: increasing the severity and frequency of all kinds of collusion and cooperation! This is what money is for -- exchange. That criminal exchange uses DBS is just saying that criminal exchange is a form of exchange. > > In mean time, managing the out-of-control government sector is your civic > duty, to your less intelligent wives, Heh...I'd be afraid of saying this if I were married or ever planning to be :) On an archived list, no less... :) > > You need a coherent argument on this problem. You need measures within > the DBS technology itself, to address the need. Opponents of DBS will > raise all these demagogic arguments. You'll be hooted off the podium. This technology is layered (ooh, bad word to use in relation to money and payment systems :). I think you will agree with me that the correct place for financial restraints (particularly voluntary ones, for auditing purposes, which IMO are the most important -- it allows you to say you are doing something, specify how it can be measured, and then have it measured, rather than just having some vague after-the-fact threat of enforcement if they catch you) on digital token money is not at the following layers: * Sub-atomic layer * Atomic layer * Hardware layer * Network connection layer and you seem to be making the case that it doesn't belong at the human/legal layer. However, there are two layers in the middle: * application (core DBS protocols, etc.) and * presentation (graphical clients, etc.) I believe the correct place for any voluntary restraints on DBS money is not at the DBS protocol layer, but at a higher level. This can be built into the clients people choose to use for managing their money, generate auditing reports, etc. This provides people with the freedom to use clients tailored to their legal requirements -- a corporation's internal financial system should be far more complicated and constrained than my personal wallet -- and makes it relatively easy for everything to interoperate. You can even design things at the levels higher than the DBS level to escrow parts of coins with third parties, this requiring their participation or approval for any transaction -- sort of a "registered DBS system". If you believe taxes are a worthwhile thing, a government could mandage the use of such a system where the IRS was a party to each and every transaction. This would work perfectly well technically, and would not compromise the integrity of the protocols -- it's just a business decision on the part of an issuer of electronic cash. It's easy to see how this could work with insurance schemes, split control of coins, etc. --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Privacy and the internet
by Jason Burton 17 Dec '03

17 Dec '03

Does anyone know what I should do if someone was posting sensitive information on a website? And what if the webmaster of the domain doesnt respond to the request for removal of information. IS there something that say's what is and isn't able to be published "personal information" on the internet. If someone can reply I'd appreciate it. Seeking council. Jason Burton - Starloop Security security(a)starloop.com

3 2

Will Price (NAI employee) on KRA
by Adam Back 17 Dec '03

17 Dec '03

This comment on NAI's KRA(P) membership by Will Price <wprice(a)pgp.com>, a crypto type who works for PGP was forwarded to the ukcrypto list by Ian Goodyer (uk-crypto list admin). Not sure where it was posted originally, or perhaps Will asked Ian to forwarded it. Adam ------- Start of forwarded message ------- Date: Sat, 14 Nov 1998 11:43:07 +0000 To: ukcrypto(a)maillist.ox.ac.uk From: "Ian D. Goodyer" <goodyer(a)well.ox.ac.uk> Subject: Re: Escrow - news Here is a response from Will Price who was formally from PGP inc and now of course is with NAI. ian -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've commented about this on this list before I believe. This appears to be a case of really old news suddenly being dredged up for no apparent wholesome reason -- which strikes me as quite odd because Wired was apparently so eager to break this ancient story that they didn't wait to ask anyone from NAI about it. NAI being listed on the KRA page is *solely* a result of our TIS acquisition. I really doubt anyone here actually called some KRA person and officially renewed our membership. Frankly, I doubt anyone here actually knows who to talk to there -- if there even is a "there". As I have said before, due to the TIS acquisition, NAI now has a bunch of products which contain key escrow features. Eliminating or modifying these features such that they work in a less big brother-like fashion will take significant time -- indeed entire TIS products were based around managing key escrow infrastructures. Don't get me wrong, TIS had a lot of other great products, but it will take time to redesign and rethink some of them in the context of export and key escrow. I'm not sure there's much point in withdrawing from KRA when those products still exist. These issues have no effect whatsoever on the PGP group. As always, we continue to publish full source code which effectively solves all the export issues for us. Robert Guerra wrote: > I just picked this up from another mailing list that I am on. Perhaps the > folks at NAI can clarify things? > > - ---------- Forwarded message ---------- > Date: Fri, 13 Nov 1998 10:55:06 +0000 > From: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> > Reply-To: ukcrypto(a)maillist.ox.ac.uk > To: ukcrypto(a)maillist.ox.ac.uk > Subject: Escrow - news > > (1) Network Associates has quietly rejoined the Key Recovery Alliance > - - see http://www.kra.org. - -- Will -----BEGIN PGP SIGNATURE----- Version: PGP 6.0.2 iQA/AwUBNkySo6y7FkvPc+xMEQIuygCfYosXGISVrKd4dYWwM8xOrVdd4WAAn3dT XvDG6FMapZpjmvjucF67fwM5 =xa+R -----END PGP SIGNATURE----- Will Price, Architect/Sr. Mgr., PGP Client Products Total Network Security Division Network Associates, Inc. Direct (408)346-5906 Cell/VM (650)533-0399 <pgpfone://cast.cyphers.net> PGPkey: <http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0xCF73EC4C> ------- End of forwarded message -------

2 3

Privacy and the internet (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 14 Nov 1998 04:46:03 -0500 > From: Jason Burton <talon(a)who.net> > Subject: Privacy and the internet > > Seeking council. > That's exactly what you should do, get a lawyer. ____________________________________________________________________ Lawyers ask the wrong questions when they don't want the right answers. Scully (X-Files) The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

100S OF FREE PICS'N'LINKS EVERY DAY!
by STUFFED SUN NOV 15 17 Dec '03

17 Dec '03

+ 30 SUPERB, HI-RES, HOT PHOTOS + 5 SUPER SEXY STORIES + HARDCORE SEX WITH ZOOM + MY BUTT COLLECTION + ABSOLUTE XXX + CATIJANA'S PUSSY PICS + EXCESSIVE + SEX CARNIVAL + WAANAADOOUS + DILDO MANIA + A1 HARDCORE + TITS 4 FREE + BONUS PIC 1 -> http://www.stuffed.net/home/20453.htm + BONUS PIC 2 -> http://www.stuffed.net/home/4919.htm + BONUS PIC 3 -> http://www.stuffed.net/home/1906.htm + BONUS PIC 4 -> http://www.stuffed.net/home/5819.htm + BONUS PIC 5 -> http://www.stuffed.net/home/1663.htm + MUCH, MUCH MORE! ----> http://stuffed.net/home/ <---- This email is never sent unsolicited. Stuffed is the supplement for the Eureka newsletter you subscribed to. Full instructions on unsubscribing are in every issue of Eureka! ----> http://stuffed.net/home/ <----

1 0

Welcome to the Risk Professionals Discussion Area!
by garp＠chadmarc.com 17 Dec '03

17 Dec '03

Thank you for participating in our conferencing system, John. Please save this message. It contains important information, such as your login name and password (see below). Our web conferencing offers online Help for all major features. If you have questions about a feature, look for the help button on the menubar. Here is your login information. Be sure to keep it somewhere safe! Your Login Name: cypherpunks Your Password: cypherpunks You can change your password, email address, and other items by selecting "Profiles" from the "More" button on the menubar. Please be sure to come back and visit us at: http://chat.bccg.com:8080/~GARP We hope you enjoy participating in our conferences! Sincerely, garp(a)chadmarc.com

1 0

Re: DBS, Privacy, Money Laundering nonsense.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Michael Alexander" <mfa(a)alpha.univie.ac.at> To: <dcsb(a)ai.mit.edu> Subject: Re: DBS, Privacy, Money Laundering nonsense. Date: Sat, 14 Nov 1998 20:52:53 +0100 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.0810.800 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: "Michael Alexander" <mfa(a)alpha.univie.ac.at> >From: "Black Unicorn" <unicorn(a)schloss.li> > That's on the order of $600 >trillion per year, just in SWIFT. (Add another $1.3 billion for CHIPS and >$989 million for Fedwire daily. Oh, don't forget the foreign exchange as a minor correction, SWIFT 's main service is to exchange payment messages to feed into e.g. Fedwire or CHIPS so that would be double counting >The payment system today eats up over 1.5% of the GNP primarily because of >nonsense regulations like CTR's and other transaction reporting ... >1% of the GNP. Instant 1% growth for changing a system of clearing. Think >about that for awhile. slowly on that: payment systems costs represent what economists call 'specific taxes' that is they inflict deadweight losses on the economy. More efficient payment instruments such as some being based on bearer certificates would per se lower GDP but lead to higher demand in theory. Its effect would be as instant as a cut in other broad ones such as income or capital gains that is it involves lag. On the actual percentage of payment systems costs as % of GDP my estimates are way higher. By simply taking clearing float days of the major retail, business and interbank instruments, the figure is more like >2% with current (low) interest for the U.S. and even higher for Europe. This does not take into account that a more efficient payment system with a higher money velocity would lower the demand for transaction money among other effects. Michael For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0