December 2003 - cypherpunks-legacy

Re: (Fnord) Edupage, 10 September 1996
by jim bell 17 Dec '03

17 Dec '03

>------- Forwarded Message Follows ------- >************************************************************ >Edupage, 10 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >************************************************************ > >TOP STORIES > Wired World Will "Diminish National Sovereignty" >[..] >WIRED WORLD WILL "DIMINISH NATIONAL SOVEREIGNTY" >A leading Clinton Administration official on information security and >cryptography matters says that traditional notions of sovereignty, national >security and warfare will be undermined by the year 2020, when the whole >world is "wired" and e-cash is the norm. 24 years from now? He thinks it'll take that long?!? 24 years _ago_ the 4004 microprocessor barely existed. And if anything, change is accelerating very rapidly. >The result will be less powerful >governments in relation to criminal organizations such as the Mafia and >international drug cartels, Organizations which exist only because of the existence of government... >says Michael Nelson, who adds that organized >crime members are already some of the most sophisticated users of computer >systems and strong encryption technology. In addition, computer crackers >will pose a more significant threat. In response, Nelson advocates >resolving the issue of whether unauthorized access of a computer is an "act >of trespass" or an "act of war," and prosecuting the intrusions accordingly. >(BNA Daily Report for Executives 6 Sep 96 A14) I'd sure like to be able to corner this guy and point out that there are people who believe that _regulating_ the Internet should either be considered an "act of trespass" or an "act of war." And does he want to be punished, or merely stopped? Jim Bell jimbell(a)pacifier.com

2 1

Bay Area Cypherpunks Meeting Saturday 9/14, 12-6PDT, Stanford
by Bill Stewart 17 Dec '03

17 Dec '03

The monthly Bay Area Cypherpunks Meeting will be held Saturday, September 14th, at the picnic tables outside Tressider Hall at Stanford University. Lunch and general hanging out begin at 12:00, Program begins at 1:00. The coffee shop at Tressider will be open, though the main cafeteria won't be. Some items on the agenda include John Gilmore's SWAN project, Encrypting 5% of the net by Christmas Highlights of Crypto '96 meeting in Santa Barbara Bagels and bagel paraphrenalia The remailer crisis - anon.penet.fi, creative new spammer attacks Censorship Firewalls for SG, CN, DE, etc. - designing workarounds The Bernstein Lawsuit - court date is Friday Sept. 20 Bring show&tell items. You can find a map of the Stanford campus on the web at http://www.stanford.edu/home/visitors/campus-map.html To confuse Stanford alumni, the map has been realigned with the North end up, so visitors can use it. From Campus Drive East, turn North on Mayfield Ave, turn right on Lagunita Dr, and park in the lot. Walk north to Tressider, and the tables are on the west=left side. Look for the crowd of drug smugglers, money launderers, and Suspicious Persons. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

10 minute delay considered inconsequential
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:15 AM 9/12/96, Adamsc wrote: >I've always wondered if the makers of mailer software couldn't include a delay >option, so that, say, a message might be held for 10 minutes and then sent. >Imagine how many of the "Sorry about x; I meant y" posts we'd never see. I expect there would be little effect. I suspect most of us write articles, send them out, and only notice the mistakes, typos, whatever when they are pointed out. (Very few people reread their posts prior to seeing them on the list an hour or two later, is my strong hunch. A delay of 10 minutes would not inspire many to read and reread their posts...most likely they'd just move on to other articles, other posts, and the 10 minute delay would be utterly inconsequential.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: robert and hipcirme web sight
by !.!..............................# 17 Dec '03

17 Dec '03

>It's obvious that this guy's true passion is fractals and raytracing. >He threw in some bomb-making stuff, but he scanned it out of a book and >probably never tried it. Compared to the rest of the site, it looks like >an afterthought. Someone who was really interested in chemistry would >have taken the time to retype the info and add their own comments. He >had a reason to have some "anarchist" info on there but he's not really >interested in it. So basically this guy is a mathematician/artist trying >to pretend he's an anarchist. If his true passion is fractals and raytracing, then why would he expend energy things other than fractals and raytracing. He may be an anarchict but wish to invest his time in fractals and raytracing rather than in explaining anarchy. >Same goes for the remailers. He claims he likes remailers and anonymity, >but he's lying. Anyone who really liked remailers/anonymity/privacy would >have pages and pages about how to use remailers, and why privacy is a good >thing. He has a reason he needs to be anonymous, but it's not because >he supports privacy. He publishes a PGP key, because he wants to pretend >he's an anarchist, and Louis Freeh told him that all evil terrorist >organizations use PGP. But he doesn't like PGP, he doesn't advocate PGP, >and he doesn't tell you where to get PGP. If his true passion were re-mailers and anonymity then he would spend pages and pages writing about them rather than just admitting to supporting them. .00010000.

1 0

Re: Erasing Disks
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I was asked of an outline of Peter Gutmann's paper, "Secure Deletion of Data from Magnetic and Solid-State Memory" in The Sixth USENIX Security Symposium Proceedings in private mail. Since I think the question is of general interest I am posting the answer and Bccing the original questioner. The paper starts with the comment that most secure data destruction guides are classified. There is the suspicion that the unclassified ones do not cover the newer recording materials and techniques, and will not protect you against government attackers. The analysis techniques for disks examined were Magnetic Force Microscopy (MFM) and its close cousin, Magnetic Force Scanning Tunneling Microscopy (STM). "It is possible to build a reasonably capable SPM for about US$1400, using a PC as a controller." (See http://www.skypoint.com/~members/jrice/STMWebPage.html) This cost is conceivably within the range of a high school student. Peter discusses the way that data can be recovered from under new data (due to the difference in the magnetic domains depending on whether the bits were the same or different), and beside new data due to positioning errors of the head. When trying to develop a secure erasure technique, you need to know the encoding technique used on the disk. (e.g. FM, MFM, RLL, PRML etc.) He recommends a 35 pass erasure scheme as follows: 1-4 Random 5 0x55 6 0xAA 7 0x924924 8 0x492492 9 0x249249 10 0x00 11 0x11 12 0x22 13 0x33 14 0x44 15 0x55 16 0x66 17 0x77 18 0x88 19 0x99 20 0xAA 21 0xBB 22 0xCC 23 0xDD 24 0xEE 25 0xFF 26 0x924924 27 0x492492 28 0x249249 29 0x6DB6DB 30 0xB6DB6D 31 0xDB6DB6 32-35 Random He recommends using cryptographically random numbers and randomly permuting the deterministic passes to further confuse attackers. He warns about disabling any disk caches which may be present, and discusses the problems of erasing data on now-bad sectors. He points out that data which has been left for a long time is harder to erase than recently written data. He mentions that the most powerful commercially available deguassers aren't powerful enough to erase modern disks or DAT tapes. (N.B. Deguassing a disk will also erase the factory-written control tracks, making the disk useless.) He notes that ECC may make destruction of data more difficult. He recommends burning floppy disks. He also discusses recovering data from DRAM and SRAM devices. He mentions that data which has been stored in DRAM for 10 minutes will be detectable after power is removed. He recommends that sensitive data (such as crypto keys) have their bits flipped every second or so. This technique has the beneficial side effect that the page remains recently used and is less likely to be paged out.\ I quote from his conclusion, "Data overwritten once or twice may be recovered by subtracting what is expected to be read from a storage location from what is actually read. Data which is overwritten an arbitrarily large number of times can still be recovered provided that the new data isn't written to the same location as the original data (for magnetic media), or that the recovery attempt is carried out fairly soon after the new data was written (for RAM). For this reason it is effectively impossible to sanitize storage locations by simple overwriting them, no matter how many overwrite passes are made or what data patterns are written. However by using the relatively simple methods presented in this paper the task of an attacker can be made significantly more difficult, if no prohibitively expensive." ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

1 0

An old _Discover_ article explaining RSA
by scrappo.reverb＠juno.com 17 Dec '03

17 Dec '03

I had found this article in an issue of Discover I've had for a few years. It is a comic strip-type article by Larry Gonick article explaining, in Layman's terms, the very basics of RSA. This article was printed in the April 1992 issue of Discover magazine (some liberties taken regarding pictures, etc.). Box1:Prime Time featuring SEYMOUR Cloak-and-Dagger Mathematician! (sh!) Box2:PRIME NUMBERS-numbers that can't be broken into a product of smaller factors- have always been one of the most amusing and USELESS topics in mathematics. Box3:Then why are Banks, Businesses, Mathematicians, and Government SPY AGENCIES fighting over prime numbers? (STOP RIGHT THERE!) Box4:It has to do with CRYPTOGRAPHY-secret codes. (The patriotic thing to do would be NOT to read one more word!) Box5:In the computer age, cryptography is MATHEMATICAL: Inside the computer, every MESSAGE is a string of ONES and ZEROES: a number, in other words. (PLEASE!!!) Box6:ENCRYPTING a message means scrambling this number, using a reversible formula based on a secret number or numbers called the KEY. message-->key-->cyphertext DECRYPTING the cyphertext is done by applying the key in reverse. Box7:It would seem that both the sender and receiver need to know- and conceal-the key, but in the 1970's, WHITFIELD DIFFIE and MARTIN HELLMAN showed a way to MAKE KEYS PUBLIC! (Hippy-Diffie!) Box8:Knowing how to SCRAMBLE, said Diffie, is not the same as knowing how to UNSCRAMBLE. Consider the egg!!! Box9:Suppose a code had TWO KEYS, a scrambler and an UNSCRAMBLER... and suppose it was IMPOSSIBLE to compute one key from the other-in the sense that no computer could do it in less than the lifetime of the UNIVERSE??? (crank crank crank) Box10:You'd have an UNBREAKABLE CODE! (Wait... Almost got it...) Box11:It works like this: Everyone owns a unique pair of keys. One remains private. But the other, public key is listed in a directory. To send me a message, you look up my public key and use it to scramble the message. My private key is the only way to unlock the message. Result:total secrecy and privacy!! Box12:Diffie's idea soon became a reality, as three guys at M.I.T. created a public-key algorithm known as RSA, from their initials. (picture)Rivest (picture)Shamir (picture)Adleman Box13:RSA's unbreakability depends on the "impossibility" of FACTORING large numbers. (15? that's 3 x 5! Easy!) (3,447,981,101,346,271,113,552,476,003,201, 119,181,244,551,900,123,549,822,344,722,436,001? um..) Box14:It's not hard to find two large PRIME NUMBERS P and Q. But if I hand you their PRODUCT, PQ, your supercomputer will never find P and Q again. (SOB!) Box15:Under RSA, each user gets a 160 digit number, N, which is the product of two large primes, P and Q. Box16:The number N is made public, while P and Q remain secret. A simple formula completes the encryption, which can't be cracked without FACTORING! (ngh) Box17:The National Security Agency didn't like this! The spy bureau wants the ability to crack any code! (Your assignment Seymour: FACTOR FASTER!!) Box18:But spies aren't the only ones who need cryptography! Anyone who transmits ELECTRONIC DATA wants to secure the information's integrity. (Why? What? This is an OPEN SOCIETY!) Box19:Unbreakable public-key code would effectively Protect money transfers from tampering Shield sensitive business data from the competition Immunize software against viruses (Allow us to gossip securely by E-Mail!) Box20:So-After years of resisting Public-Key systems, the government in 1991 finally endorsed one as a new NATIONAL STANDARD. (I WAS WRONG! EMBRACE ME!) Box21:Unlike RSA, however, the government's DSA (Digital Signature Algorithm) depends on a single, government-issue PRIME NUMBER. (Take a P! Not any P!) Box22:Within months, mathematicians had shown how this could give the government, and the government alone, the ability to BREAK the code-and so the argument continues... (Trust, Where is the trust??)

1 0

jury nullification/selection
by Greg Broiles 17 Dec '03

17 Dec '03

Sorry if I was too terse earlier. I hadn't intended to start a big FIJA dustup. I think that government sleaziness is not only useful in a true nullification argument ("he's guilty but you should acquit anyway") but where it reflects on the credibility of testimony and the prosecution's case in general. It's easy to imagine a prosecution which rests on the testimony of people who lie every day (criminally involved informants, jailhouse informants, and undercover cops) and/or real evidence which was gained through the use of subterfuge and trickery (like wiretap/body wire evidence). The idea is to make the government look sleazier and trickier than the defendant(s) and the defense witnesses. If the government's evidence ends up being tainted directly or indirectly by lying, trickery, etc., then the defense can argue "Hey. You can't trust anyone who got up on that stand and talked to you. And if you don't know who to trust and you think everyone's lying, the government's got no case. And if they've got no case, the judge will tell you that you must acquit." So I think that public distaste and discomfort with weirder and sleazier tactics on the part of cops can be (and is) discussed and used and "voted on". "Not guilty" doesn't necessarily mean "innocent", sometimes it means "The prosecution didn't have enough evidence I thought I could trust." And yes, I agree that even mentioning nullification during voir dire will probably get you kicked off of a jury; and I think that's partly because one party or the other will be scared of nullification, and partly because the term "jury nullification" makes people think of FIJA and associated loons. Nobody wants a loon on the jury. (I don't think everyone who argues for nullification is a loon, but some of them sure are - and there's no good way to figure out whether someone's a loon or not in the middle of jury selection.) And I also agree that the jury selection process tends to select away from a true cross-section of society; but the few easily available examples (big trials like OJ or the Menendez Bros. or Wm. Kennedy Smith or whoever) are poor examples because they're not typical. Trials where lots is at stake (death penalty or celebrity defendant or big $ civil trials) tend to have longer processes (which weed out everyone who isn't incredibly boring) but it's not at all uncommon to pick a jury in a morning or in a day or two. In federal court, the judge usually questions the jury instead of the attorneys (which is faster), and may or may not ask questions that the attorneys have suggested. Also, sometimes one side or the other will *want* especially analytical or technical or well-trained jurors. Attorneys want to pick a jury they can persuade, but they also want to pick a jury that can understand their theory of the case. So I guess my point is that while the jury system isn't perfect, it is in some ways a much more direct way to "vote" on how things work in the judicial and law enforcement systems. I think it's more immediately and directly democratic than the electoral system. All of the legal bullshit aside, it's possible to think about trials as a way for people who have some sort of problem (they've been injured or accused of a crime or whatever) to tell a group of uninvolved people about the problem and ask them what the right thing to do is. Yeah, that's really oversimplified, but I think that what juries do is important and that what they do has a political and a moral dimension even if attorneys aren't supposed to talk about it during argument. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

2 1

Re: Child porn as thoughtcrime
by amnesia＠chardos.connix.com 17 Dec '03

17 Dec '03

Chuck Thompson writes: > > Well Andrew, pornography is meant to lead to arousal, which can lead to > aggression, which may lead to abuse. It's a fairly common path according to > what I've read on deviancy. Going into a bank can lead to casing out the joint, which may lead to a heist. Should this make the posession of pictures of banks illegal? I don't think that anyone here is advocating kiddie porn. The problem that TCM pointed out is that in fighting kiddie porn, legislators have started banning _thoughts_ that _could_ lead to child abuse. This is one great leap forward into the police state. > Following is one association's opinion, but > don't stop there, read for yourself what some of the deviants themselves > have to say: You're seeing the trees and missing the forest. It could be any activity, say the abuse of animals, that winds up being used as a wedge to create the police state. If the government started tatooing red 'P's on the foreheads of convicted pedophiles, would anyone notice the irony? Bobo

1 0

New type2.list/pubring.mix
by John Perry 17 Dec '03

17 Dec '03

I just updated the type2.list/pubring.mix combination on jpunix.com to reflect the disappearance of the ncognito remailer. I've been getting nothing but bounces and the owner doesn't seem to be around to fix it. The updated lists can be obtained by WWW from www.jpunix.com and by anonymous FTP from ftp.jpunix.com. -- John Perry KG5RG perry(a)alpha.jpunix.com PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers.

1 0

Re: na673130@anon.penet.fi gone [Anonymous service rejected your mail.] (fwd)
by Johan Helsingius 17 Dec '03

17 Dec '03

At 21:49 96/09/11 -0400, Andy Dustman wrote: >Looks like Spambo either deleted his id or Julf pulled the plug on him. I pulled his plug. But his real address has been on this list several times. Julf

1 0

Sen. Burns' statement on postponement of Crypto vote today.
by jseiger＠cdt.org 17 Dec '03

17 Dec '03

As you may have heard by now, the Senate commerce committee markup of the Burns/Leahy "Pro-CODE' bill, originally set for today, has been postponed. Indications from the Commerce Committee staff are that this was largely due to scheduling issues, although end-of-the-session politics are also playing a role. Both the Committee staff and Senator Burns himself (see note below) have said they are committed to holding a markup before the end of the session. We expect more information early next week and will post updates as soon as new information becomes available. Senator Burns asked us to forward the following note to the net.community: >X-POP3-Rcpt: jseiger@mailserver >From: Conrad_Burns(a)burns.senate.gov >Date: Thu, 12 Sep 96 09:55:35 EST >To: jseiger(a)cdt.org >Subject: Open Letter to the Internet from Senator Burns > > The Commerce Committee markup on Pro-CODE, S. 1726, that we had > expected to have held on Thursday, September 12 has been postponed. I > am fully committed to taking Pro-CODE to markup, out of committee and > onto the floor of the Senate in this Congress. I believe that this > legislation is vital to ensuring the continued strength of America's > high-tech community and the privacy of its citizens. I would like to > thank the many thousands of Netizens who have expressed their support > for Pro-CODE. > > Sincerely, > > U.S. Senator Conrad Burns > Please keep your phone calls coming to the Senate Commerce Committee members offices, and be sure to sign the petition at http://www.crypto.com/petition/. A coalition alert with more information will be posted soon. Jonah ** THE FIGHT FOR FREE SPEECH ONLINE CONTINUES TO THE SUPREME COURT ** It's not too late to be a part of history -- Join the Lawsuit <http://www.cdt.org/ciec> -- <ciec-info(a)cdt.org> -- Jonah Seiger, Policy Analyst Center for Democracy and Technology <jseiger(a)cdt.org> 1634 Eye Street NW, Suite 1100 Washington, DC 20006 PGP Key via finger (v) +1.202.637.9800 http://www.cdt.org/ (f) +1.202.637.0968 http://www.cdt.org/homes/jseiger/

1 0

[BOOK] Competitive Intelligence
by Brian D Williams 17 Dec '03

17 Dec '03

Competitive Intelligence "From Black Ops to Boardrooms- How Businesses Gather, Analyze, and use Information to Succeed in the Global Marketplace." ISBN 0-684-81074-3 Simon and Schuster ($24.00) Preface: Being a Hero and not a Bum Part One: What is Competitive Intelligence? 1.) The Rise of Competitive Intelligence 2.) What Competitive Intelligence can do for your company: Information vs Intelligence 3.) Why most managers are still stuck in the information age Part Two: Real-World Competitive Intelligence 4.) The Intelligence Cycle 5.) Planning and Direction 6.) Collection 7.) Analysis 8.) Dissemination 9.) Mergers and Acquistions 10.) Benchmarking and Competitive Intelligence 11.) How the Japanese Perform Competitive Intelligence 12.) Competitive Intelligence in other Countries 13.) Building a Competitive Intelligence System Part Three: Issues, Opportunities, and the Future 14.) Justifying the cost of Competitive Intelligence 15.) Using Competitive Intelligence in the European Union 16.) Ethics 17.) The New Gatekeepers 18.) Why the U.S. Government must get involved in Competitive Intelligence 19.) Competitive Intelligence-The Next Generation Glossary of Competitive Intelligence

1 0

Re: ISODE Consortium X.509 Certification system
by Carl Ellison 17 Dec '03

17 Dec '03

Bill, thanks for forwarding this to me. It really bothers me whenever I see someone mouthing plattitudes about certificates, like: >The ITU-T, through X.509, recommend strong authentication based on public >key cryptosystems as the basis for providing secure services. The ISODE >Consortium uses X.509 as the core of its security strategy. >X.509 provides a flexible, scaleable and manageable algorithm-independent >authentication infrastructure, which can be used as the basis for a wide >range of security services such as message encryption and access control. Fact is, identity certification (which is what X.509 gives) is neither necessary nor sufficient for providing secure services -- and there's nothing magic about X.509. There are marketeers, however, who want the world to believe that the generation and use of X.509 certs will somehow give you security -- so they can sell machinery or a service which makes those certs. - Carl P.S. My USENIX paper giving the case against certification authorities is on-line now at <ftp://ftp.clark.net/pub/cme/usenix.ps> = <http://www.clark.net/pub/cme/usenix.ps> +------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP 2.6.2: 61 E2 DE 7F CB 9D 79 84 E9 C8 04 8B A6 32 21 A2 | +-Officer, officer, arrest that man. He's whistling a dirty song.--+

2 1

Re: Bubba Bottoming out on Cocaine Paranoia?
by attila 17 Dec '03

17 Dec '03

In <v03007808ae5dadc0f80f(a)[207.79.65.35]>, on 09/12/96 at 08:16 AM, Chip Mefford <cmefford(a)avwashington.com> said: = > 2. the rewrite of history to reflect not only the = > politically correct views, but to reflect history as = > the elite wish to see it --even to the point of rewriting = > quotations of Thomas Jefferson to suit their purpose. = > = Can you give a clear example of this?? = Just asking the most blatant one was the rewording of Jefferson's words for the equality of all men about two years ago. As we know, Jefferson was all for freedom, and had a "God bless you, you're a slave" attitude, but he was clearly not for the equalization. when that one came out of washington, several papers had a hard time with it, but I have seen it since. I have been collecting Jefferson quotes for years; frankly, I always considered the Dems were off base: Jefferson was the Republican --leaving Hamilton and his Federalists as pawns pawns of the Illuminati as advocates of the independent Federal Bank (the worst of the Rothschilds (Maurice, I think) who made the statements regarding control of the government by control of the money was in his prime around 1800). I am not a dedicated Jeffersonian scholar, but he has been the corner stone of my (now long blown) faith in our government. I would a complete set of Jefferson's works --if, and only, if I could find a good edition published over a 100 years ago. secondly, Jefferson is now interpreted as being the great enfranchiser, which is not even close to his view. Jefferson's writings clearly emphasize that the electorate should be comprised of the landed and merchant class; secondly, it was Jefferson's statement that the electorate, and therefore the juries should be composed "...of a well educated and informed citizenry." Jefferson was interested in an electorate which was of substance and possessing of a stake in America. One of the clear principles of Jeffersonian thought was that jury, beyond the requirement of guilt beyond a reasonable doubt, was to _vote its conscience_. Jefferson was responsible for including the constitutional language which makes this possible, even today, despite instructions from judges who could care less about the intent of the constitution and are treating the accused as nothing more than cattle on the way to the abattoir --if they are not guilty this time they will be next time, so why waste further time --sometimes known as "collateral damage." = > Why has it gone this far? because Joe-Six-Pack will sell = > all his freedom in return for the promised security. who is = > the Judas goat? the captive press. = > = Actually, being a "Joe six pack" my own damn self, I'd have to say = that this is simply not the case. It is Joe six pack who makes up the = body of the NRA and most other freedom watch dog organizations. = Just for yer information, the pendulem has been swinging very much = the other way, with 36 or 37 states recently following Floridas lead = on concealed weapons carries. Not only that, but even NPR has even = admitted that it has been effective. Agreed on the restoration of concealed weapons rights which had been regulated out of existence. Granted, Joe-Six-Pack may not be the perfect analogy, but I refer to America's working class, blue collar and the grunts of the white collars as Joe-Six-Pack --maybe I should say Joe-Couch-Potato. the class" referenced is a collection of many levels --what they have in common is they work and then confrom to the current norm of 7.2 hrs/day in front of the tube which becomes their entire source of information --THEY will sell out from ignorance. If you refer to Joe-Six-Pack as the the classic Southern red neck, any attempt to limit their freedom, particularly the right to a pickup truck with a gun rack, and their handguns --that's a very different situation. and that extends to small town westerners, like myself, and to the plains. I grew up on a farm, went to Harvard, joined the spooks for six years of a bloodpath, bounced around the world in different fields, and I am back in a very small community in the high desert: 100 families. Noone around here questions my bad attitude --the admissions requirements are at least 5 kids and 2000 rounds. However, I think Joe-Six-Pack, in this constrained social set, for the vast majority would sell out on freedom of cryptography. they do not understand it, particularly against the onslaught of the pinko-liberal captive media. Our job is to educate them --and not with defiant rhetoric (such as mine). As for concealed weapons permits, bank robberies should certainly drop --all it would take is one cowboy (and I'll volunteer) and anything other than a large coordinated operation is in serious trouble. One unsuspected, mean and surly patron with a .357 who seriously knows how and when to use same is very effective. On the other hand, I do not recommend carrying an assault rifle on a sling over your shoulder to visit the bank.... The simple (I think) point I was trying to make was: the vast majority of our U.S. citizens would acquiesce to the deployment of federal troops in return for security, rather than being armed, Posse Comitas not withstanding, to wipe crime off the streets. The point could even be made: the troops might as well be doing something useful rather than sitting around their bases; we do have a rather large standing army --unfortunately, they would become poorly trained and poorly disciplined --and could easily be part of the massive corruption in our cities (and every other government over many people). Frankly, we should all vote in a _free_ cyberspace; forget the current system of choosing party loyalists and presidential electors. The application of a military mentality on the streets is not my idea of law and order --they could kill off the majority of the crime by legalizing all drugs and dispensing them in clinics. Britain reduced their second story (burglary) crime rate by over 60%; they did find they had a great many more addicts than the thought, however. A second benefit is that it takes some of the mystery and challenge out of drugs --however, be prepared for the alcohol problem, although that effect would be significantly less than the current social cost of having 10% of the male black population in lockdown. no, my bottome line is the Bubba has sunk to bottom with paranoia, both he and the elite money interests which jerk all of the politicial habituites who depend on their soft money for their campaings and who wish to participate at the trough of influence and greed (ever see someone retired after many years in Washington without a bundle). --attila -- one of the few things we all share: the utter, corrosive contempt for our elected officials.

2 1

Getting the word "GAK" into common usage
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Thu Sep 12 11:20:55 1996 cypherpunks: As most of you know, I have been trying to bring "our" word, "GAK" into common usage, as opposed to the "key-escrow" Newspeak proposed by some (unnamed) big-government bureaucrat, and unfortunately adopted in most discussions of cryptography policy, (especially those outside this forum) in spite of the true English meaning of the word "escrow." There is a resource called "Infomania," which you can learn about by sending a blank message with the subject "help" to <infobot(a)infomania.com>. The service provides, via email, services that are normally only available to people who have real internet acess (ie, "WHOIS,") but there is also a heavy bias toward humor. Sending it the subject "GEEK," for example, returns the current version of the Code of the Geeks. Sending the subject CHEF with some dry, boring text (such as this message) in the message body returns you a truly hilarious transmogrification. :) Anyway, I have been in contact with Jason Fesler, who administers the site for Infomania [a firm which produces film separations for commercial grade printers and which provides this free service] about putting in a new command, "GAK," which will return to senders whatever the current U.S. govt. "key-escrow" Newspeak bigbrother anti-privacy proposal(s) is/are. (ie. clipper1, clipper2, son of clipper etc.). He has agreed that if we can supply a script or url or gopher page or something of that sort to interface it to, and a person to maintain it whenever the policy changes yet again (the hard part) he will do it. I would, of course, expect a bit of cypherpunkly commentary to accompany the text. Perhaps this information already exists (likely it does) on some page, and if you know where and think it is stable and well-updated, please email me privately, and I will try to put the owner of the site in touch with Jason. I am Bccing him with this message. Thanks for your help. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMjgqXW1lp8bpvW01AQF49wP8Ci8D9blF898dNaFsKesX311qT2MO88zr xM11xZ0g1Ui4ahv3yB4jo6qqv4Z9InjNpiOk6wxcsXUPPtn6UNCBOTdos/DCk/SO SSOupiLA48gBHfoCIMN2f/+hGGM4BcuYC5wQ9rgJrTeiY8nQX18hJxKDxujn7z0A pbvTrSRQozY= =rA5a -----END PGP SIGNATURE-----

2 1

PANIX.COM down: denial of service attack
by #6 17 Dec '03

17 Dec '03

WSJ 9/12/96 Paraphrasing: Panix has been under attack for the last week by someone flooding their server with bogus "requests for information" [see below] ... The attack(s): * "Have rendered almost defenseless the small NY company" * "...began late Friday afternoon ... were still continung yesterday" * have targeted "computers that control WWW pages, store e-mail, and still others that link Internet addresses to Panix subscribers." "The hacker [sic] has been sending up to 150 requests a second to Panix's computers, seeking to establish a connection ... the requests, presumably generated by a malicious computer program, contain fake Internet addresses, which the computer must sort out before they can discard them. The computers have choked under the deluge." "As to who might be targeting Panix, the firm's Mr. Rosen speculated it could be someone upset by the fact that the site hosts, free, the Web site for Voters Telecommunication Watch...."

1 0

Re: Child Porn as Thoughtcrime
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Rick Smith wrote: > : ...the "little girls in leotards" case was only a few years ago, etc.) > > Don't know about that one. Is it illegal for little girls to be > photographed in leotards now? "Nutcracker" is X rated? Move over, > Bambi. But this proves precisely Tim's original point, that child pornography is a thoughtcrime. Here's a working definition of child pornography at the end of the millenium: it's a picture of a child, in the hands of a pedophile. Pictures of girls in leotarfds are not child pornography per se, but if you think evil thoughts while watching them, then they become child pornography. What got Stephen Knox in trouble was leaving so much evidence that he was thinking those evil thoughts.

1 0

Re: Nonsense, absolute nonsense... [Fwd: HipCrime and Spam]
by Admin 17 Dec '03

17 Dec '03

At 09:34 PM 9/11/96 -0400, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >On Wed, 11 Sep 1996, Admin wrote: > >> >This is an absurd and inaccurate analogy. The mailBot simply pushes >> >*mailto:* tags that people have willingly placed on their public websites. >> >They invite the mail so a more accurate analogy would be that City Hall puts >> >up a public suggestion box and invites comments. The bot then puts one, and >> >only one, unsigned anonymous suggestion into the box. It then goes on to the > >You're sending out messages, inviting people to visit your web site, but >you're using anonymous remailers because... you don't want people to know >who you are? Perhaps he's sending out through the remailers...because he can. Its open to the public. Or perhaps he's trying to get the word out about remailers also, or perhaps no one but he knows why, and why is unimportant. You can always make your remailers a private, pay per use club. Then you could control all the *whys* *whens* and *hows*. >Then why invite them to your site (or even have a site)? It's >like if I sent out postcards to people with no return address saying, >"Please stop by 1313 Mockingbird Lane for snacks and refreshments. Signed, >A Friend". (Note, this is not my real address.) >Only in this case the >postcards don't have any stamps so the people who receive them have to pay >the postage. Which is precisely what you're doing: Sending someone e-mail >costs them time and it often costs them money. These people have invited the email, and the associated expense, by placing a public email-to: button on their public www page. A more acurate analogy, and to the point, would be if a business sends you a postage pre-paid business reply card, that is blank, and invites your comments on the card. They can hardly complain of the expense when people actually send it in, even if they don't like the comments. >Sending it through an >anonymous remailer accomplishes four things: 1) People can't complain to >you to stop sending them mail. Seems anyone who followed the link can complain to the appropriate source. >2) It costs us, the International Secret >Cabal of Anonymous Remailer Operators, time and money for no good reason, >because you are sending anonymous mail and not making yourself anonymous. Didn't see any disclaimers on the remailers requiring a *good reason* to use them. Who would be this Judge of Sufficiently Good Reason? Perhaps you can write an AI piece that can auto-detect good reason from *no good reason*... >3) You're pissing off a bunch of people, and the only ones they can take >their frustrations out on or complain to is us. What is the ratio of *pissed off people* to not pissed off people. Likely less than 0.5% based on how many messages the Cpunks claim went out in a day. >4) It's giving us a bad >rap, man, and that's the *last* thing the remailer net needs now. The saying goes...There is Heat in the Kitchen... > >I could care less about your little applet, or what you have to say; in >the words of Thomas Jefferson, "it neither breaks my leg nor picks my >pocket." Until, that is, you start sending it through my remailer, and >*then* you start picking my pocket. >The remailers of the world don't exist >to provide non-anonymous anonymous advertising, which you could do just as >well on your own sending forged e-mail headers from netcom. Now now... forgery is a no-no. And someone always has the freedom to give up their anonymity whenever they choose. > >Andy Dustman / Computational Center for Molecular Structure and Design / UGA >===== For PGP public key: finger andy(a)neptune.chem.uga.edu | pgp -fka ===== >Sure, the Telecomm Act will create jobs: 100,000 new thought-cops on the net >http://charon.chem.uga.edu/~andy mailto:andy@CCMSD.chem.uga.edu <}+++< <>________________Lowest_Priced_Long_Distance__________________<> ||Long Distance 9.9¢/min |Helping hardworking people || ||9.9¢ Anytime, Anywhere in US! |like yourself pay the || ||Free sign-up, 6 second billing |lowest possible price for || ||http://www.superhot.com/phone |high quality LD service. || <>-----------------------1_303_692_5190------------------------<>

2 1

Re: PANIX.COM down: denial of service attack
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:09 AM 9/12/96 -0700, #6 wrote: >WSJ 9/12/96 > >Paraphrasing: > >Panix has been under attack for the last week by someone flooding >their server with bogus "requests for information" [see below] ... Even though service has suffered, Panix is still useable. Until I read the MOTDs on Tuesday, I thought it was just normal flakiness. DCF

1 0

Fear of Flying -- from HotWired
by declan＠well.com 17 Dec '03

17 Dec '03

http://www.hotwired.com/netizen/96/37/special3a.html 12 September 96 HotWired, The Netizen Fear of Flying by Declan McCullagh (declan(a)well.com) Washington, DC, 11 September John Gilmore, co-founder of the Electronic Frontier Foundation, knows firsthand how drastically airports in the United States are altering their policies in response to the nation's perceived vulnerability to terrorists. When Gilmore opened his laptop for inspection by airport personnel at San Francisco International last month - as requested - but refused to turn the machine on, the cops were called. When he then refused to show identification to airport police, "they put the handcuffs on me and hauled me off," he told The Netizen. The cops took Gilmore to a back-room office. "They tried to ask me questions. I said I wanted to speak to my lawyer. They kept asking me questions anyway," he says. Airport police arrested Gilmore even though, according to the FAA, "there is currently no prohibition against allowing someone on an aircraft" without identification. Gilmore's arrest came after President Clinton tightened airport security in response to the TWA Flight 800 disaster and the Atlanta Olympic Games bombing. Now the anti-terrorism drumbeat in the nation's capital is starting again, and it's louder and more ominous than ever. It reached a fevered pitch Monday, when Clinton called for an increase of more than one billion dollars to be spent on anti-terrorism measures, especially airport security. Clinton based his request on the unsurprising recommendations of a commission created by executive order in August, staffed by spooks and headed by Vice President Gore. The group's proposal includes a plan allowing the CIA and FBI to "develop a system" to screen passengers who fit certain profiles as potential terrorists. David Sobel, a lawyer with the Electronic Privacy Information Center, called the White House proposal "a realization of Big Brother concerns people have about computer technology." The proposal would allow the FBI and CIA to couple their databases with those of the airlines. "There are going to be massive databases that will track our actions and activities. If you think of increased capabilities to collect information, it's even scarier," Sobel said. A former US senator agrees. At a Cato Institute terrorism conference yesterday, Malcolm Wallop said: "In the year and a half since the terrorism debate began, all the legislation considered would do little or nothing to stop or deter terrorism. These measures do more to crack down on Americans than terrorists. "A bloody nose does not warrant an exponential expansion of federal government authority," argued Wallop, now the chairman of the Frontiers of Freedom Institute. Over lunch at the conference yesterday afternoon, former CIA director James Woolsey responded with some seemingly gratuitous anti-Net rhetoric. Terrorists may use biological weapons like anthrax, he said. "Anthrax is colorless, odorless, and has a 90 percent lethality. One gram has 100 million lethal doses." Then Woolsey delivered the zinger: "The knowledge of how to make anthrax is widely available, including on the Internet." Not content to let bad enough alone, Woolsey added that the government can't allow netizens to use data-scrambling software like Pretty Good Privacy that the spooks can't break. He said the threat of terrorism will "require us to have a key escrow system" where keys "for complex algorithms [will] be placed in such a way that the government" will have access to them. "You can accommodate industry a lot, but the principle is: you got to get to the key," Woolsey said. (FBI director Louis Freeh made similar, though less straightforward, comments during Senate hearings in July.) Before Congress adjourns for the fall recess, the House must decide whether to approve a "digital telephony" domestic wiretapping slush fund into which the NSA and CIA can pour cash. Senators will then likely add provisions for warrantless wiretaps to the anti-terrorism bill that the House sent to them in August. The fundamental problem here is, of course, the politics of terrorism. Legislators routinely grandstand atop national tragedies, using victims and their families as backdrops. Justice Department lobbyists then swarm onto Capitol Hill and demand reduced civil liberties in the name of fighting terrorism. Societies can, and should, safeguard against systematic threats. Random acts of violence, on the other hand, are trickier to forestall - and terrorist acts are anything but predictable. Luckily for the EFF's Gilmore, he was cited only for the crime of "delaying/obstructing a peace officer" and was released after being handcuffed to a bench and then dumped in a holding cell for a few hours. He got off easy. But if Congress decides to sacrifice freedom for security, the country will ultimately enjoy neither. ###

1 0

(Correction) Child Porn as Thoughtcrime
by Rick Smith 17 Dec '03

17 Dec '03

I wrote: : I've read in several places that the Jock Sturges case was thrown out : Nobody has dragged me away in shackles for : owning "Radiant Images." Correction -- That's "Radiant Identities." Rick.

1 0

Re: PANIX.COM down: denial of service attack
by Duncan Frissell 17 Dec '03

17 Dec '03

Here are the gory details from the first MOTD last Saturday: The attacker is forging random source addresses on his packets, so there is no way to find his/her location. There is also no way to screen out those packets with a simple router filter. This is probably the most deadly type of denial-of-service attack possible. There is no easy or quick way of dealing with it. If it continues into Saturday we will start working on kernel modifications to try to absorb the damage (since there's absolutely no way to avoid it). This however will not be an easy job and it could take days to get done (and get done right). For those who are IP hackers, the problem is that we're being flooded with SYNs from random IP addresses on our smtp ports. We are getting on average 150 packets per second (50 per host). We are not the only site being attacked in this way. I know of one other site that is being attacked in an identical manner right now, and I know of three others that have been attacked in the last two weeks. I hope that this means that the attacker is merely playing malicious games, and will soon tire of molesting our site. If that is the case, mail will come back up as soon as the attack ends. But if the attacker is really interested in damaging Panix specifically, the attack may *never* stop and service won't be restored until we can write kernel modifications. Since then the packet streams have hit almost all the ports for news, www, telnet, etc. DCF

3 4

[BOOK] "Competitive Intelligence" corrected
by Brian D Williams 17 Dec '03

17 Dec '03

Sorry, forgot the Author... Brian "Car Bombs- The poor mans cruise missle." Competitive Intelligence Larry Kahaner "From Black Ops to Boardrooms- How Businesses Gather, Analyze, and use Information to Succeed in the Global Marketplace." ISBN 0-684-81074-3 Simon and Schuster ($24.00) Preface: Being a Hero and not a Bum Part One: What is Competitive Intelligence? 1.) The Rise of Competitive Intelligence 2.) What Competitive Intelligence can do for your company: Information vs Intelligence 3.) Why most managers are still stuck in the information age Part Two: Real-World Competitive Intelligence 4.) The Intelligence Cycle 5.) Planning and Direction 6.) Collection 7.) Analysis 8.) Dissemination 9.) Mergers and Acquistions 10.) Benchmarking and Competitive Intelligence 11.) How the Japanese Perform Competitive Intelligence 12.) Competitive Intelligence in other Countries 13.) Building a Competitive Intelligence System Part Three: Issues, Opportunities, and the Future 14.) Justifying the cost of Competitive Intelligence 15.) Using Competitive Intelligence in the European Union 16.) Ethics 17.) The New Gatekeepers 18.) Why the U.S. Government must get involved in Competitive Intelligence 19.) Competitive Intelligence-The Next Generation Glossary of Competitive Intelligence

1 0

Re: ... subversive leftists
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> tcmay(a)got.net (Timothy C. May) writes: > > As to "tasteless and insulting," a matter of personal perspective. I find > > it helpful to call a spade a spade, and others apparently do as well. > > > > Of course, Tim gets very uncomfortable when others call a spade a spade. This constant character assasination of Tim is getting rather boring, as far as I can see, and I read all of the posts on the list, he has done nothing more than ignore posts from these idiots, that is his choice and nothing to do with anyone else. This whole thread is taking up too much space and is just totally pointless. lets call it a day and just agree to differ eh? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az4= =riHc -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Fear of Flying -- from HotWired
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:16 PM 9/12/96 -0500, Declan McCullagh quoted: >... former CIA director James Woolsey: responded with some seemingly > gratuitous anti-Net > rhetoric. Terrorists may use biological weapons like anthrax, he said. > "Anthrax is colorless, odorless, and has a 90 percent lethality. One > gram has 100 million lethal doses." Then Woolsey delivered the zinger: > "The knowledge of how to make anthrax is widely available, including > on the Internet." Gee, biotech has come a long way. Now I can download the Anthrax DNA sequence from the net and insert it in some carrier bacteria and start making Anthrax bacteria. Neat! Or did he mean I can chemically synthesize Anthrax toxin? Or did he mean I can get information on culturing bacteria on the net, but must obtain a sample of the bacteria from other sources? BTW - My dictionary says that Anthrax is primarily an animal disease which only occasionally infects humans. It sounds like a poor choice for bio-war terror. ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

1 0

Re: Excite Live!
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"live(a)excite.com" 11-SEP-1996 22:14:03.06 >A request was made for the location of your Excite Live! page >Found your Excite Live at URL >http://live.excite.com/?uid=CEC8C99632372D6E Hi. As you can see from the above, I've set up an Excite Live! page up with the email address of cypherpunks(a)toad.com. It has top priority on things related to cypherpunks, including technology news, political news, international news, etcetera, plus some build-in links and searches to appropriate places. I'd advise using the anonymizer to access the above link (http://www.anonymizer.com:8080/http://live.excite.com/?uid=) -Allen

2 1

ALERT: S.1726 vote postponed; keep calling! Offices are swamped! (9/11/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

======================================================================== SENATE COMMERCE COMMITTEE VOTE POSTPONED SENATOR BURNS ENCLOSES LETTER OF COMMITTMENT TO CRYPTO WE CONTINUE TO RECEIVE REPORTS OF "HEAVY CALLS" TO OFFICES. KEEP THE PRESSURE UP! WE'RE HOLDING OUR OWN! September 12, 1996 Please widely redistribute this document with this banner intact until September 30, 1996 ________________________________________________________________________ CONTENTS The Latest News What You Can Do Now Background / What To Expect This Week Description of S.1726, Pro-CODE Bill Chronology of Pro-Crypto Legislation For More Information / Supporting Organizations ________________________________________________________________________ THE LATEST NEWS The Senate Commerce Committee vote on S.1726 (Pro-CODE) originally set for today (Thursday 9/12) has been postponed. We have been told that the change was largely due to committee scheduling issues, and the Committee staff and have indicated that they are still committeed to marking up S. 1726 within the next. More information should be available shortly. Senator Conrad Burns (R-MT), co-author of S. 1726, asked us to forward the following note to the net.community: X-POP3-Rcpt: jseiger@mailserver From: Conrad_Burns(a)burns.senate.gov Date: Thu, 12 Sep 96 09:55:35 EST To: jseiger(a)cdt.org Subject: Open Letter to the Internet from Senator Burns The Commerce Committee markup on Pro-CODE, S. 1726, that we had expected to have held on Thursday, September 12 has been postponed. I am fully committed to taking Pro-CODE to markup, out of committee and onto the floor of the Senate in this Congress. I believe that this legislation is vital to ensuring the continued strength of America's high-tech community and the privacy of its citizens. I would like to thank the many thousands of Netizens who have expressed their support for Pro-CODE. Sincerely, U.S. Senator Conrad Burns It is critical to keep your phone calls and faxes coming into the offices of the Committee members listed below. Based on the feedback we are receiving from callers and conversations with Capitol Hill staff, the response from the Net has been strong and continuous. Thank you to all who have taken the time to call Congress to voice your support for encryption policy reform. If you have not yet done so, please take a moment to call the committee members below. If you have a little extra time on your hands, between now and the middle of next week please make an effort to call all the Senators on the list below. Your help and support is critical to the future of privacy and security on the Internet. Finally, please don't forget to sign the petition in support of Encryption Policy Reform -- http://www.crypto.com/petition/. More than 4000 Netizens have already signed, including encryption experts Phil Zimmermann, Matt Blaze, Phil Karn, and others. ________________________________________________________________________ WHAT YOU CAN DO NOW It's crucial that you call the Commerce committee members below and urge them to pass S.1726 out of committee without amendments. (This is also known as a "clean" bill.) Any opportunity for amendments (even if they are good) opens us up to the possibility of hostile amendments that could restrict the use of encryption even further than today's abysmal state. It could even prohibit the use of encryption without Clipper Chip-like key 'escrow' technology, which includes built-in surveillance and monitoring functionality. 1. Call/Fax the members of the Senate Commerce committee and urge them to pass S.1726 out of committee "cleanly". Do not use email, as it is not likely to be looked at in time to make a difference. Use the sample communique and directory listing below to make it a simple TWO MINUTE task. 2. Sign the petition to support strong encryption at http://www.crypto.com/petition/ ! Join other cyber-heroes as Phil Zimmermann, Matt Blaze, Bruce Schneier, Vince Cate, Phil Karn, and others who have also signed. 3. Over the next 7 days, it is crucial that you call all these members of the Senate Commerce Committee. P ST Name and Address Phone Fax = == ======================== ============== ============== D SC Hollings, Ernest F. 1-202-224-6121 1-202-224-4293 D MA Kerry, John F. 1-202-224-2742 1-202-224-8525 D HI Inouye, Daniel K. 1-202-224-3934 1-202-224-6747 D KY Ford, Wendell H. 1-202-224-4343 1-202-224-0046 D WV Rockefeller, John D. 1-202-224-6472 1-202-224-7665 D LA Breaux, John B. 1-202-224-4623 1-202-228-2577 D NV Bryan, Richard H. 1-202-224-6244 1-202-224-1867 D ND Dorgan, Byron L. 1-202-224-2551 1-202-224-1193 D NE Exon, J. J. 1-202-224-4224 1-202-224-5213 D OR Wyden, Ron* 1-202-224-5244 1-202-228-2717 R SD Pressler, Larry* 1-202-224-5842 1-202-224-1259 R MT Burns, Conrad R.(*sponsor) 1-202-224-2644 1-202-224-8594 R AK Stevens, Ted 1-202-224-3004 1-202-224-2354 R AZ McCain, John* 1-202-224-2235 1-202-228-2862 R WA Gorton, Slade 1-202-224-3441 1-202-224-9393 R MS Lott, Trent* 1-202-224-6253 1-202-224-2262 R TX Hutchison, Kay Bailey 1-202-224-5922 1-202-224-0776 R ME Snowe, Olympia 1-202-224-5344 1-202-224-1946 R MO Ashcroft, John* 1-202-224-6154 1-202-228-0998 R TN Frist, Bill 1-202-224-3344 1-202-228-1264 R MI Abraham, Spencer 1-202-224-4822 1-202-224-8834 * supporter or cosponsor. The bill also enjoys broad bi-partisan support from members not on the committee including Senators Leahy (D-VT) and Murray (D-WA). 4. Here is a sample conversation: SAMPLE PHONE CALL You:<ring ring> Sen:Hello, Senator Mojo's office! You: SAY I'm calling to urge the Senator to pass S.1726, the Burns, Leahy, THIS-> Pressler bill at the upcoming Commerce Committee Markup. The bill is critical to the future of privacy, security, and electronic commerce on the internet. Sen:Ok, thanks!<click> IF THEY SAY "The Senator has concerns about the bill", please answer, "Please try to work these issues out as it moves to the Senate floor, but passage out of committee will send an important signal to the Administration." 5. To help us measure the effectiveness of the campaign, WE NEED TO HEAR FROM YOU. Please tell us who you called, and how they sounded. We'll be passing this information to folks in D.C. who can help apply pressure where needed. $ Mail vtw(a)vtw.org Subject: I called so-and-so Hey, I called Sen. Mojo. He sounded iffy, call in the reinforcements. ^D 6. Forward this to your friends and colleagues in appropriate forums until the date of expiration at the top. Forward a copy of this to your Internet Service Provider as well, and ask them to put the following text in their message of the day (motd), or on their WWW page: ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT The U.S. Senate will be voting on a proposal to encourage better security on the Internet soon. Your help is needed to call Congress. See http://www.crypto.com/ for more details. ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ALERT ________________________________________________________________________ BACKGROUND / WHAT TO EXPECT THIS WEEK For the past 3 years, Cyber-Rights Activists, citizens, and industry leaders have been working hard to reform US encryption policy. Support has been building behind several legislative proposals this year because they send a clear signal to the Administration about the need for security and privacy in the Information Age. The digital revolution is currently being held hostage by the White House's Cold War restrictions on privacy-enhancing encryption technology. Now, with Congress less than a month away from adjournment, everyone who supports encryption and privacy is working to see this bill leave committee in order to send a clear message to the White House that they are on the wrong side of the encryption issue. Although this bill may not become law this year, its passage out of committee will be a landmark event that will clearly tell the White House that the Congress, the public, and the computer industry care about security and privacy, and need strong, reliable encryption technology in order to make the Internet a viable platform for commerce, education, and democracy. Success for our side is not certain, and the next week is not without risks. On September 12th (or sometime soon after), the Senate Commerce committee is expected to hold a "markup", where the bill is examined, voted on, and if there are enough votes, passed out of committee. Two things could happen: -the committee could pass the bill as written, -the committee could pass the bill with amendments. Any amendments are not likely to be friendly, and in particular, quiet sources have told privacy activists that the Clinton Administration has been readying a legislative assault on your right to use encryption for several weeks now. A Clipper-like amendment could be attached to the bill if our side does not have enough votes to block all amendments. It is crucial that all netizens who consider privacy and security important take a moment to call members of the Commerce Committee right now and urge them to vote S.1726 out of committee without amendments. ________________________________________________________________________ DESCRIPTION OF S.1726, PRO-CODE BILL Privacy-enhancing encryption technology is currently under heavy restrictions kept in place by the White House. Encryption that is currently allowed to be exported is not sufficient to protect confidential information. This policy acquires an "Alice-in-Wonderland" quality when one realizes that strong encryption products are available abroad both for sale and for free download off the Internet. The Pro-CODE Act resolves to: 1. Allow for the *unrestricted* export of "mass-market" or "public-domain" encryption programs, including such products as Pretty Good Privacy and popular World Wide Web browsers. 2. Requires the Secretary of Commerce to allow the less restricted export of other encryption technologies if products of similar strength are generally available outside the United States, roughly up to DES strength. 3. Prohibits the federal government from imposing mandatory key-escrow encryption policies on the domestic market and limiting the authority of the Secretary of Commerce to set standards for encryption products. ________________________________________________________________________ CHRONOLOGY OF PRO-CRYPTO LEGISLATION 9/12/96 (scheduled) Senate Commerce committee will hold markup of S.1726 and hopefully pass it out of committee with no amendments. 7/25/96: Full Senate Commerce committee holds positive hearings on S.1726. FBI Director Louis Freeh testifies along with many cyber-luminaries. Hearings are cybercast Internet Cyber-Rights activists with HotWired and WWW.Crypto.Com. You can see the photos, read the testimony, and listen to the audio transcript at http://www.crypto.com/events/072596/ 6/26/96: Senate subcommittee holds positive hearings on S.1726. Hearings are cybercast Internet Cyber-Rights activists with HotWired and WWW.Crypto.Com. You can see the photos, read the testimony, and listen to the audio transcript at http://www.crypto.com/events/062696/ 5/2/96: Bi-partisan group of Senators introduce Pro-CODE Act, which would free public-domain encryption software (such as PGP) for export, free much commercial encryption for export, and reduce the government's ability to push Clipper proposals down the throats of an unwilling public. Original sponsors include: Senators Burns (R-MT), Dole (R-KS), Faircloth (R-NC), Leahy (D-VT), Murray (D-WA), Pressler (R-SD), and Wyden (D-OR). 3/5/96: Sen. Leahy (D-VT) and Rep. Goodlatte (R-VA) announce encryption bills (S.1587/H.R.3011) that significantly relax export restrictions on products with encryption functionality in them, as well as free public domain software such as PGP (Pretty Good Privacy). ________________________________________________________________________ FOR MORE INFORMATION / SUPPORTING ORGANIZATIONS There are many excellent resources online to get up to speed on crypto including the following WWW sites: http://www.crypto.com http://www.privacy.org http://www.eff.org http://www.cdt.org http://www.epic.org http://www.vtw.org Please visit them often. The following organizations have signed onto this alert: American Civil Liberties Union Center for Democracy and Technology Electronic Frontier Foundation Electronic Privacy Information Center Voters Telecommunications Watch ________________________________________________________________________ End alert ========================================================================

1 0

Re: mailing lists
by HipCrime 17 Dec '03

17 Dec '03

>i don't see you sticking your neck out to deal with assholes who think >freedom of speech is secondary to their right not to ever see mail >they don't want. Like hell we're not. What are you guys mad at us for? Thinking that FREEDOM of SPEECH is much, much more important that whining computer nerds who can't push a DELETE button. >i did competitive public speaking from 7th grade until my junior year >of high school where i was also on the debate team for two years. In that case, maybe you should learn to use the SHIFT key. Or didn't debaters in your school take typing and/or learn about punctuation, capitalization, and the other niceties of English communication? >now i make a living as a biochemistry grad student (only a year left >until you get to call me Dr.) where logic is paramount and feelings >are irrelevant. Well, "doctor" why can't you see (with your logic) that junk Email (or "spam") would save many, many forests if it REPLACED junk SnailMail. Isn't it just that your "irrelevant feelings" have been hurt, because someone used your remailer-baby in a way you hadn't planned for ?!? Why not put your money where your mouth is, and bet me (any amount), that spam WILL be socially acceptable by the year 2000. Particularly, when the green-folks discover how many trees will be saved. It'll be a social-mandate, NOT just a suggestion. Want to bet? -- HTTP://www.HIPCRIME.com

5 4

J'accuse!: Whitehouse and NSA vs. Panix and VTW
by Robert Hettinga 17 Dec '03

17 Dec '03

I think someone should just stand right up and accuse the NSA, at the behest of the Whitehouse, of running a denial of service attack on Panix at *exactly* the time when VTW is lobbying its hardest on the PRO-CODE bill. Ooops. I just did.... ;-) None *dare* call it conspiracy, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Kook Of The Month
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

>From remailer(a)mailhub.bart.nl Thu Sep 12 11:48:50 1996 Received: by bwalk.dm.com (1.65/waf) via UUCP; Thu, 12 Sep 96 13:14:35 EDT for dlv Received: from [194.158.160.11] by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; id AA27439 for dlv(a)bwalk.dm.com; Thu, 12 Sep 96 11:48:50 -0400 Received: (from remailer@localhost) by spoof.bart.nl (8.7.5/8.6.8) id RAA06613 for dlv(a)bwalk.dm.com; Thu, 12 Sep 1996 17:49:57 +0200 (MET DST) Date: Thu, 12 Sep 1996 17:49:57 +0200 (MET DST) Message-Id: <199609121549.RAA06613(a)spoof.bart.nl> To: dlv(a)bwalk.dm.com From: remailer(a)2005.bart.nl (Anonymous) Comments: Please report misuse of this automated remailing service to <remailer-admin(a)remailer.nl.com> The contents of this message are neither approved or condoned by nl.com or our host bART Internet. *** Replying to it will not send your reply to the sender *** There is no way to determine the originator of this message. If you wish to be blocked from receiving all anonymous mail, send your request to the <remailer-operators(a)c2.org> mailing list. The operator of this particular remailer can be reached at <remailer-admin(a)remailer.nl.com> Subject: Kook Of The Month Eat this Dr. Scum Bag Return-Path: <cypherpunks-errors(a)toad.com> To: stewarts(a)ix.netcom.com Cc: postmaster(a)netcom.com, abuse(a)netcom.com, security(a)netcom.com Subject: Unsolicited harrassing e-mail from <stewarts(a)ix.netcom.com> From: dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) Date: Wed, 11 Sep 96 21:37:09 EDT Sender: owner-cypherpunks(a)toad.com Please stop e-mailing me, cc:ing me, or otherwise harrassing me. I have no connection with the thread you're quoting and don't want to receive any more e-mail from you. stewarts(a)ix.netcom.com writes: > >> There > >> are a number of anonymous remailers out in cyberspace, but it has been > >> stated by a knowledgeable source that a number of them are being operated > >> by law enforcement agencies (presumably to troll for criminal activity). A > > > >Can someone verify/discredit/comment on this statement? Who is the > >knowledgeable source? > > Definitely true. Zero is a number, and there are also larger numbers. > KOTM = Kook Of The Month. > > # Thanks; Bill > # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com > # <A HREF="http://idiom.com/~wcs"> > # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto >

1 0

Re: Sen. Burns' statement on postponement of Crypto vote today.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 12 Sep 1996 15:30:19 -0400 To: 1e$pam From: Robert Hettinga <rah(a)shipwright.com> Subject: Re: Sen. Burns' statement on postponement of Crypto vote today. Cc: Bcc: X-Attachments: --- begin forwarded text From: somebody Date: Thu, 12 Sep 1996 15:03:21 -0400 To: rah(a)shipwright.com Subject: Re: Sen. Burns' statement on postponement of Crypto vote today. Robert-- My sources indicate that no markup will be held on the Burns bill before Congress adjourns for year. Not clear the votes were there, plus the Administration had Dems lined up to offer weakening amendments. Also, the hearing scheduled yesterday in House Judiciary for its counterpart bill was postponed until Sept. 25; that is 3 days prior to adjournment target, and I wouldn't be surprised if it never takes place. In other words, most likely prospect is for no action -- not even favorable reporting by a Cmte. -- before Congress goes home. Administration in next two weeks will unveil its "new and improved" encryption policy, which will likely offer a shift in licensing to Commerce Dept., and gradual easing of exportable strength, in exchange for industry-funded key escrow management demo projects. And that's the way it is (Political reality is not optional). You can pass this info. along, as long as you do not attribute it to me. --- end forwarded text --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

3 3

Informal Renegotiation of the Law
by Duncan Frissell 17 Dec '03

17 Dec '03

Many people on this list and in the larger world focus on laws and regulations and sometimes act as if that is the only way that the relative rights and duties of governments and civilians are established. In fact, there is a lot of informal negotiation going on all the time. This is significant because an unenforced law isn't a law at all. For example, you will not read anywhere that compulsory education laws have been repealed -- but they have. When the home schooling movement started in the late 1970s, there were occasional harassment and prosecution of parents. The home schoolers won some and lost some. As time went on, the authorities came to accept home schoolers so that at this point, legal problems are rare. Compulsory education has been effectively repealed by the actions of refusenicks in both the subject population and the enforcement population. This same process will occur more frequently in the future as libertarian memes spread, government enforcement resources shrink, and people's vastly different attitudes as to what should be legal and illegal make a monopoly legal regime impossible to keep in place. Note that unlicensed immigration is against the law. Note that some websites post material that others would like banned. Maybe you can deport a few or ban a few. But how many? If you have three million illegal aliens or 3 million individual ISPs (people with high speed connections running their own sites) you can't deport them or shut them down because it simply takes too much time and too many enforcement resources. The authorities give up. You get de facto open immigration and a de facto unregulated Net. Coercion is expensive and slow. Free exchange is cheap and fast. That's why free exchange wins in the long run. It's not a victory without losses. Some people are busted. Some sites are shut down. You don't go into battle expecting zero casualties. But what counts in the end is who wins. And we've got them outnumbered by far. DCF "So you think you can handle 3 million sites? Wait a few years and you can try to handle 300 million."

2 1

CryptLib CAPI for VB
by Joel McNamara 17 Dec '03

17 Dec '03

Before I do it myself, thought I'd check if anyone has updated Peter Gutmann's CRYPT.BAS file for CryptLib (if not, I'll forward it to Peter when I get finished). The current version is fairly out of date, and I'm looking for a library to use with Visual Basic to implement some secure hashing and 3DES. Thanks in advance... Joel

1 0

ISP-TV Interview with Solveig Bernstein
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: Interview with Solveig Bernstein *** Monday, September 16 9:00 PM ET Solveig Bernstein Assistant Director of Telecommunications & Technology Studies Cato Institute ISP-TV will present an interview with Solveig Bernstein from the Cato Institute. Ms. Bernstein will be discussing legal issues concerning the CDA, the upcoming Supreme Court case, and other telecom legal issues. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network

1 0

Re: What is best policy paper on crypto?
by Hallam-Baker 17 Dec '03

17 Dec '03

Adam Shostack wrote: > > Declan McCullagh wrote: > | I happen to know that an influential Congresspern will be meeting with > | some Cato folks tomorrow morning, so I'm assuming this isn't an idle > | request. > The NAS report, despite a few silly points, does push for > liberalization of the export regime, standardization, a switch to > an 'assume export' stance, states that the debate can be carried out > in public, and that classified information is not needed, and suggests > that crypto can help reduce many threats to Americans. > > It does not suggest abolishing the ITARs, and suggests > consideration of a law criminalizing the criminal use of crypto. I agree that the NAS report is the one to use. Its from an authoratative source and the conclusions are pretty reasonable. Its perhaps not as far as some would like to go but if we got there it would be livable. Given where we are it would make a good first step. Some good lines from the talk included: Re Dennings "If you know what I know argument", basically Lin said that he did know and it made no difference at all to his point of view. Also 13 of the 16 members of the committee got "the briefing" - which is all Dorothy bless her socks got, and the report was unanimous. Re who is behind the anti crypto policy, its Freeh at the FBI and not the NSA. The NSA know crypto and don't really care all that much. Gore credited as guy who is holding Freeh back. Seemed a reasonable enough guy, but a number in the audience were upset that they didn't have someone like Dorothy who we can throw tomatoes at. Phill

1 0

Gaining trust in OCO crypto code
by frantz＠netcom.com 17 Dec '03

17 Dec '03

These thoughts came up at the Mac Crypto conference, but are somewhat more general than the Macintosh, so I am ccing them to cypherpunks. OCO, or Object Code Only, a bad idea whose time has not yet past (although it was part of the reason for the decline of IBM's mainframe operating systems), is the business practice of keeping the source code for a system secret. Some companies are applying the idea to cryptographic software, so the we should think about how we can establish trust in such software. There are three techniques which may work for all OCO software. (1) Trust the designer/implementor. Ron Rivest's RC2 and RC4 algorithms were originally released as OCO algorithms. Rivest's reputation as a cryptographer established trust in them. (2) Trust a third party auditing agency. The US military trusts vendor implementations of cryptographic software because they have been audited by the NSA. (3) Reverse engineer the implementation. While laborious, this process is straight forward. When Netscape started using RC4 in their SSL implementation, a review of its security became important enough that a certain anonymous person(s) reverse engineered the implementation and posted it to the Internet. As a result, the algorithm has undergone peer review. If we can't use the above techniques, we have to think very carefully about what parts of a cryptographic system we can trust by only examining their inputs and outputs. Here is a list of things we can NOT trust in this manner: (1) Random number generation. An error (as occurred in a Netscape implementation), or a deliberate weakness can not be easily detected by examining only the output of a cryptographic random number generator. (2) Key generation. There are published ways to encode an RSA secret key in the corresponding RSA public key. A key generation algorithm which only uses 32 bits of the random number would be hard to detect, but easy to break by one who knew its secret. You have to be able to examine in detail how keys are generated. Now there are some things we might be able to trust based only on an examination of the inputs and outputs. (1) Implementation of a cryptographic algorithm. If we can feed it enough test cases, and compare the output with a public, well vetted implementation, we can come to believe that it is correct. (2) Certain cryptographic protocols. If we can trust one side of a Diffie-Hellman (DH) key exchange, then we can trust the keys generated because both sides contribute to the randomness of those keys. However we can't trust two instances of an OCO DH exchange implementation working with each other, so this trust doesn't seem to cover many practical instances. If the OCO protocol implementation can interoperate with a trusted implementation, then we can start to have some trust in it. However, we will still have to carefully examine the protocol for covert channels. This form of trust may be of real-world use. ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

1 0

common sense
by HipCrime 17 Dec '03

17 Dec '03

> And rather than "dispensing drugs in clinics," why not simply > scrap the drug laws entirely? People have a *right* to do as > they please with their bodies. Let's hear it for common sense. It's the first decent posting I've seen to this list. -- HTTP://www.HIPCRIME.com

3 2

Re: [Long] A history of Netscape/MSIE problems
by Hallam-Baker 17 Dec '03

17 Dec '03

Some comments:- 1) Netscape were using BSafe but Kipp unhooked the ergodicity testing code which is meant to detect inadequate random number generation methods. Netscape got full access to Bsafe in return for 1% of Netscape stock. 2) Most serious concern was not the 40bit part. That was simply the US govt making the security a joke and there was nothing that Kipp or anyone else could do about it. More serious were the structural problems, SSL cannot be used across a firewall (unless the admin is a twit) because it is entirely opaque. SSL is not very good as an authentication only option. There is no facility for escrow of keys - another essential feature if you are to use it inside a corporation. If I am the CIO of IBM I'm not having the company secrets go out the door via some encrypted stream I can't read. Similarly banks and nuclear power stations have a legit need to snoop on their own lans. 3) Microsoft proposed PCT because they wanted to force Netscape to make SSL an open standard rather than one Netscape could tweak as they liked and freeze Microsoft out of the picture. Quite how they would imagine that anyone would want to ever do such a thing... 4) The initial weakness exposed in SSL was that integrity attacks had not been considered at all. It took a while to explain that this was in fact a more pressing concern than confidentiality in many applications. The SSL.v2 integrity was not actually bound to a particular site. Simon Spero produced a rather nice proxy server which allowed one to reroute URLs but keep the key intact. (ie connect to foobar.com and get the netscape home page). There was a long list of security holes in SSL, PCT plugged a good number of them and SSL v3 plugged a few. The overall design never gave me confidence however. Like much Netscape stuff they start with an over-simple view of the problem spec and then try to solve problems by adding extra ornaments. Phill

1 0

Re: Court challenge to AOL junk-mail blocks
by Hallam-Baker 17 Dec '03

17 Dec '03

watson(a)tds.com wrote: > > NetSurfer said: If you know a valid email address on the spammers system you can always > bounce each message back to them. If enough people turned the messages > back on them it might give them the opportunity to experience first hand > what its like to receive tons of mail you don't want or need... > > Doesn't seem to work that well. The "green card lawyers" were reported > to have received hate-mail in the hundreds of thousands. The happily waded > through it all and pulled out a few valid replies who apparently made it > all a net profit for them, apparently. What we really need is to improve > our defensive filtering mechanisms. Someday soon we'll all have our own > personal software agents that will handle all this stuff for us. Balls, the green card lawyers minions ratted on them. The number of responses from interested people was small and the amount of business they obtained even smaller. The cost of going through all the mail, getting new net hosts and such left them with a net loss which is why they are no longer in business. Phill

1 0

EPIC Alert 3.16
by Dave Banisar 17 Dec '03

17 Dec '03

============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================== Volume 3.16 September 12, 1996 -------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, D.C. http://www.epic.org/ ======================================================================= Table of Contents ======================================================================= [1] White House Proposes Screening of all Airline Passengers [2] EPIC Testifies on Children's Privacy Bill [3] House Panel Probes White House Database [4] Crypto Update [5] Anonymous Remailer Shuts Down [6] EPIC Now Accepts First Virtual Contributions [7] EPIC/PI to Sponsor Conference on Surveillance Technologies [8] Upcoming Conferences and Events ======================================================================= [1] White House Panel Endorses Airport "Profiling" System ======================================================================= In the wake of perceived terrorist threats and the mysterious crash of TWA Flight 800 in July, a Presidential advisory panel has proposed an automated system for increased screening and "profiling" of airline passengers for all domestic and international flights. In its interim report sent to President Clinton on September 9, the White House Commission on Aviation Safety and Security provided few specifics, but noted that "[b]ased on information that is already in computer databases, passengers could be separated into a very large majority who present little or no risk, and a small minority who merit additional attention." Details of the profiling system will presumably be withheld from the public on national security grounds -- a substantial portion of the Commission's "public" meeting on September 5 was closed to permit the discussion of "classified" matters. Nonetheless, the proposed system appears to raise substantial privacy issues. The Washington Post recently reported that under the proposal, "the federal government would require creation of a computer profiling system that would examine passengers' bill-paying records, flying habits and much other data to determine which checked baggage should undergo examination by sophisticated explosives detection equipment." The Commission's initial report also calls for FBI and CIA involvement in the development of the profiling database. The theory underlying the profiling proposal appears to be that even seemingly innocuous bits of personal data can raise the suspicions of a law enforcement agency. This point is illustrated by the comments of an unidentified FBI agent recently quoted in a New York Times article. Discussing the Bureau's investigation of the bombing of Pan Am Flight 103 over Scotland, the agent noted that, "Almost everyone on the plane, almost everyone you ever met, has something that can get your imagination going. A recent fight, a divorce, a business deal, an overseas connection -- when you don't know what you're looking for, it's easy to see all kinds of possibilities." EPIC plans to monitor the development of the automated passenger profiling system under the public oversight provisions of the Federal Advisory Committee Act, which governs the proceedings of the White House Commission. More information, including relevant government documents, is available at: http://www.epic.org/privacy/faa/ ======================================================================= [2] EPIC Testifies on Children's' Privacy Bill ======================================================================= EPIC Director Marc Rotenberg testified today before the House Judiciary Committee Subcommittee on Crime in support of the Childrens Privacy Protection and Parental Empowerment Act of 1996. The bill would establish basic privacy standards for organizations that collect personal information on children and curb recent abuses in the marketing industry. The bill is sponsored by Rep. Bob Franks (R-NJ) and has 46 cosponsors in the House of Representatives. A similar measure has been introduced in the Senate by Senator Diane Feinstein (D-CA). Rotenberg said that "current practices pose a substantial threat to the privacy and safety of young people." He described a recent incident where a reporter posing as the murderer of Polly Klaas was able to obtain the ages and address of young children living in the Pasadena area. Rotenberg also cited editorials from USA Today and the Economist favoring privacy legislation as well as public opinion polls which show that 9 out of 10 Americans object to the sale of personal data where explicit consent is not obtained. Recalling the passage of the Family Educational Right to Privacy Act of 1974, which protects the privacy of student records, Rotenberg said there was already Congressional recognition of the need to protect personal information about young children. "No universities have been shut down because of the Act, but the privacy of children's educational records is more secure because Congress did not fail to act when it had the opportunity to establish privacy protection for young people." #011#Also testifying in support of the bill were Rep. Bob Franks, children rights advocate Marc Klaas, and Miriam Bell of Enough is Enough. Marc Klaas also heads the Klaas Foundation for Children which launched the Kids Off Lists campaign. Testifying against the bill were representatives from the Direct Marketing Association, a list broker, a book publisher, and a police officer from San Bernadino. More information on the Childrens Privacy bill and kids privacy may be found at: http://www.epic.org/privacy/kids/ The Klaas Foundation for Children is on the web at: http://www.klaaskids.inter.net/ ======================================================================= [3] House Panel Probes White House Database ======================================================================= The General Accounting Office revealed at a hearing of a subcommittee of the House Committee on Government Reform and Oversight on September 11 that the secret White House database of 200,000 people has inadequate controls on access. The GAO reported that the database, this existence of which, was revealed during the Filegate controversy, does not keep track of what files have been viewed by the 150 White House staffers who are authorized to access the files. The database contains 125 different fields of information for each file. Several thousand files included ethnic and political information. The GAO did not reveal in its testimony what was contained in the other fields. According to news reports, the database was designed to link into other related databases, including the Secret Service and the Democratic National Committee. The White House claims that the database is used for a number of reasons, including, for invite lists for White House events, tracking correspondence, sending out Christmas cards and other matters. Congressional Republicans claim that it is more akin to the Nixon "enemies list." The database was created by PRC Inc., a company that also creates databases for the CIA and other intelligence agencies, among other government agencies. ======================================================================= [4] Crypto Update ======================================================================= As the election approaches and Congress scrambles to complete its agenda before recessing for the year, members are continuing to deal with cryptography-related issues. The Senate Commerce Committee delayed its scheduled vote on S. 1735, the Promotion of Commerce Online in the Digital Era, originally planned for September 12. The Committee is expected to take up the measure next week. Members of the Committee have reported receiving a large number of calls supporting the bill. Individuals interested in supporting the bill should continue calling members of the Committee. The House is planning to hold hearings at the end of September to examine the companion House bill. The hearings were originally scheduled for September 11 but were delayed due to other legislative matters. The White House is also expected to introduce its own legislation next week. According to reporter Brock Meeks, the legislation will offer "sweetheart deals" to limited segments of the industry including financial, health care and insurance sectors who would then agree to support government key escrow systems. The systems would then become de facto mandatory. Internationally, an expert committee of the Organization for Economic Cooperation and Development is meeting on September 26-27 to review draft guidelines on cryptography policy. The US has been pressuring the OECD to adopt its key escrow proposals as an international standard but has been opposed by other countries and business representatives. EPIC will be hosting an international symposium in Paris on September 25, in cooperation with the OECD, to provide an opportunity for cryptographers, human rights advocates, privacy experts and user associations to present public concerns about the development of international privacy guidelines. The event will feature speakers from more than a dozen countries and includes US cryptographers Matt Blaze, Whit Diffie, and Phil Zimmermann. On September 20, oral arguments will be heard in the Daniel Bernstein's challenge to the constitutionality of export controls in federal court in San Francisco. Bernstein is arguing that the controls violate the First Amendment. Judge Marilyn Patel ruled preliminarily in May that software code is speech protected by the First Amendment More information on cryptography is available from: http://www.epic.org/crypto/ ======================================================================= [5] Anonymous Remailer Shuts Down ======================================================================= Johann Helsingius, the operator of the anon.penet.fi anonymous e-mail service has decided to shut down his remailer service because of the unknown legal protections of privacy on the Internet. He had come received requests by the Church of Scientology and the Singapore government demanding to know the identity of some of his users. In a press release, he said that he hoped to bring the server back up once the Finnish government enacted new laws protecting privacy of electronic messages, "I will close down the remailer for the time being because the legal issues governing the Internet in Finland are yet undefined. The legal protection of the users needs to be clarified. At the moment the privacy of Internet messages is judicially unclear." A list of remailers and other tools to protect privacy are available from: http://www.epic.org/privacy/tools.html ======================================================================= [6] EPIC Now Accepts First Virtual Contributions ======================================================================= Individuals interested in donating or purchasing books from EPIC can now use the First Virtual system to transfer money to EPIC. Until the end of 1996, donations of up to $50 will be matched by the Stern Foundation. Your support is appreciated and will help make possible our continued FOIA litigation, privacy advocacy, and web site development. More information about supporting EPIC is available at: http://www.epic.org/epic/donate.html ======================================================================= [7] EPIC/PI to Hold Conference on Surveillance ======================================================================= The new generation of covert surveillance activities of government agencies and private companies will be examined at a conference to be held in Ottawa next week, sponsored by EPIC and Privacy International. The conference will explore the process of planning and implementation of the technologies, their operating conditions, and the people and organizations responsible for instituting them. The conference will also examine possible technical, regulatory and legal responses. A number of former government agents, intelligence experts and surveillance analysts will gather at the Advanced Surveillance Technologies II conference on September 16th to discuss the use of powerful new technologies being used to gather information. Speakers will include Mike Frost, a former intelligence officer for the Canadian Communications Security Establishment and author of the bestseller "Spyworld." He will discuss the surveillance technologies used by the CSE and its American counterpart, the National Security Agency. The Conference will take place at the Citadel Hotel in Ottawa, Canada. More information is available on the conference from the Privacy International Web Page at: http://www.privacy.org/pi/conference/ottawa/ ======================================================================= [8] Upcoming Conferences and Events ======================================================================= "Advanced Surveillance Technologies II." September 16, 1996. Ottawa, Canada. Sponsored by EPIC and Privacy International. Contact: http://www.privacy.org/pi/conference/ottawa/ or email pi(a)privacy.org. "Privacy Beyond Borders", 18th International Privacy and Data Protection Conference. September 18-20, 1996. Ottawa, Canada. Sponsored by the Privacy Commissioner of Canada. Contact: jroy(a)fox.nstn.ca or http://infoweb.magi.com/~privcan/ "Regulation or Private Ordering? The Future of the Internet." September 20, 1996. Washington, DC. Sponsored by the CATO Institute. Contact: R. Scott Wallis, (202) 789-5296. "The Public Voice and the Development of International Cryptography Policy." September 25, 1996. Paris, France. Sponsored by EPIC. Contact: rotenberg(a)epic.org. "The 2nd International Conference & Exhibit on Doing Business Securely on the Information Highway." September 30 - October 1, 1996. Montreal, Quebec, Canada. Contact: http://www.ecworld.org/Conferences/2nd_Security/ menu.html. "Managing Privacy in Cyberspace and Across National Borders." October 8-10, 1996. Washington, DC. Sponsored by Privacy and American Business. Contact: Lorrie Sherwood, (201) 996-1154. "The Information Society: New Risks & Opportunities in Privacy," October 17-18, 1996. Bruxelles, Belgium. Sponsored by the European Parliament. Contact: http://www.droit.fundp.ac.be/privacy96.html "Communications Unleashed - What's at Stake? Who Benefits? How to Get Involved!" October 19-20, 1996. Washington DC. Sponsored by CPSR and Georgetown University. Contact: phyland(a)aol.com. "19th National Information Systems Security Conference." October 22-25, 1996. Baltimore, MD. Sponsored by NSA & NIST. Contact: Tammy Grice (301) 948-2067. "Eurosec'97, the Seventh Annual Forum on Information Systems Quality and Security." March 17-19. 1997. Paris, France. Sponsored by XP Conseil. Contact: http://ourworld.compuserve.com/homepages/eurosec/ (Send calendar submissions to alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send email to epic-news(a)epic.org with the subject: "subscribe" (no quotes). Back issues are available via http://www.epic.org/alert/ ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national id cards, medical record privacy, and the collection and sale of personal information. EPIC is sponsored by the Fund for Constitutional Government, a non-profit organization established in 1974 to protect civil liberties and constitutional rights. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, email info(a)epic.org, HTTP://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax). If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and funding of the National Wiretap Plan. Thank you for your support. ---------------------- END EPIC Alert 3.16 -----------------------

1 0

Re: Nonsense, absolute nonsense... [Fwd: HipCrime and Spam]
by Ross Wright 17 Dec '03

17 Dec '03

On Or About: 12 Sep 96 at 17:48, Rabid Wombat wrote: > > > > These people have invited the email, and the associated expense, by placing > > a public email-to: button on their public www page. Correct! > > However, since others may think like you, I guess I'll have to add a line > above my link stating that email not related to the purpose of my site > will be happily proof-read at the rate of $200 per hour, Just great. That sure takes away any anonymity you had about being "on the cutting edge" of the information age. That 1952 "proof-read" crap went out in the 70's. How can you hope to enforce it? It's a joke, right? :) Maybe not, since it's on your sig-line. > > A more acurate analogy, > > and to the point, would be if a business sends you a postage pre-paid > > business reply card, that is blank, and invites your comments on the card. > > They can hardly complain of the expense when people actually send it in, > > even if they don't like the comments. > > No, this b.s. is more like having someone put a dead skunk in my mailbox, > with no return address, trying to prevent me from sending them 100 dead > skunks as a return favor. And about as welcome. > Sorry, Wombat. As much as I hate to agree with this multi level long distance phone company spammer. He is right. A website is an open invitation to comment and e-mail. Better password your site if you want to solve this problem. Then no-one can visit it, and no-one can send out a spider to get your e-mail address. That's what I do, send out a robot to bring back e-mail addresses. Of course I only send to makers of software, and my product applys to their world. If you don't want spam in your mail box: 1. Don't have a website or don't put your e-mail address on your website 2. Don't post to newsgroups 3. Don't post to mailing lists 4. If you post do so anonymously Ross =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

5 5

Observer's defense of "Internet Pornography" article
by Martin Minow 17 Dec '03

17 Dec '03

If you haven't overdosed on the Observer articles yet, you can read their defense on http://www.observer.co.uk -- it is rather self-serving, but it could have been worse. The only revelation is that Demon (the major Internet provider) plans to block access to some newsgroups/sites. Also, assuming I read between the lines correctly, Demon receives three billion (with a "b") e-mail messages per day. I can never remember whether British usage is "thousand million," or "million million", but the numbers seem a bit large in any case. Perhaps they mean "3 billion bytes of e-mail." (Assume ten million Demon subscribers and three thousand million e-mail messages. This implies that the average subscriber receives 300 e-mail messages per day. Are they all subscribing to Cypherpunks?) Some other numbers: -- 180,000 newsgroup articles received per-day (per server). -- "tens of terabytes of data, (each equivalent to 750,000 floppy disks) move across a network of about 10 million machines." This seesm to refer to all of the Internet. Martin Minow minow(a)apple.com

2 1

Re: mailing lists
by Ross Wright 17 Dec '03

17 Dec '03

On Or About: 12 Sep 96 at 18:11, Rabid Wombat wrote: > > > more restricted. I'm personally against needing to pay the social costs of > > more and more laws because someone is trying to make a buck any way he > > can, regardless of the costs and annoyances to others. > > > > Junk faxing was a blessedly short term fad, one that had to be legislated > > > > I'm completely in favor of allowing junk email, as long as "JUNK MAIL" is > > required to be the first thing on the subject line. PLONK! ... but that > > will take yet another law ... > Wombat: If you are "against needing to pay the social costs of more and more laws" Then how come you want another one? > IE," as long as "JUNK MAIL" is required to be the first thing on > the subject line. PLONK! >... but that will take yet another law > > ... "! One more law to pay for, one foot in the door for the government. Don't call for new legislation in order to not get spam! Please. Ross =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Fed appellate judge remarks re anonymity, free speech on the net
by Greg Broiles 17 Dec '03

17 Dec '03

The Daily Journal, a LA/SF legal newspaper had an article today (9/12) about a lunchtime address given by Ninth Circuit Judge Alex Kozinski last Monday at an Internet Law Symposium in Seattle. The article quotes Kozinski as saying "I have a severe problem with anonymous E-mailers . . . You don't have a right to walk up to somebody's door and knock with a bag over your head." The article says Kozinski likened anonymous E-mail to menacing someone. Kozinski also suggested that computer-generated or morphed images of children involved in sexual acts may not be protected under the Constitution because of ongoing trauma to the child, while computer-generated or morphed images of adults would be protected. The article says that Kozinski was skeptical that he or other federal judges necessarily agreed with the 3rd Circuit's ruling in _ACLU v. Reno_ (finding the CDA unconstitutional). Kozinski is considered relatively conservative and relatively libertarian, as 9th Circuit judges go. Copies of the Daily Journal should be available at larger newsstands in CA; interested parties might try DeLauer's on Broadway near 14th St in Oakland if you're in my neck of the woods. (They usually have extras for the preceding week or so.) Also try Barnes & Noble in Santa Monica or the newsstand whose name escapes me in Westwood, if you're down there. (Also in today's news, the 9th Circuit upheld a CA statute forbidding sales of material considered "harmful to minors" from vending machines.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

2 1

who can count?
by HipCrime 17 Dec '03

17 Dec '03

> No, this b.s. is more like having someone put a dead skunk in my > mailbox, with no return address, trying to prevent me from sending > them 100 dead skunks as a return favor. And about as welcome. 100 dead skunks in exchange for ONE is exactly what this discussion is all about. You CypherWIMPS just love over-kill. EmailRobot sent ONE message to EACH address. Are you guys so unskilled in arithmetic to understand the difference between 1 and 100? One message is NOT spam, 100 messages to a single box IS spamming. -- HTTP://www.HIPCRIME.com

4 3

Re: SPL -- Suspicious Persons List
by Hallam-Baker 17 Dec '03

17 Dec '03

Timothy C. May wrote: > > Digitaltronics Corporation V.P of Human Relations: "Joe, thanks for coming > in this morning. I'm sure you're busy, so I'll make this as short as > possible. OK with you?" > > Joseph Shlubsky, Programmer: "Uh, sure." <nervously> Yeah, thats why we Europeans have labour laws that prevent Digitaltronics from doing any such thing without getting sued from here to eternity. Pity you guys missed out on the idea of trades unions and think that employment is some kind of serfdom in which you loose all your rights the day you sign up. If you hadn't sold your government to the cooprorations a while back you might have got out of the middle ages. I suspect that even under the weak as dishwater employment laws that you have in the US would provide ample opportunity to file a countersuit. When that type of thing happens, they don't give the reason, they do it behind closed doors. How do you fight that? Phill

5 4

"Unwanted Mail"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:48 PM 9/12/96, Rabid Wombat wrote: >> >> These people have invited the email, and the associated expense, by placing >> a public email-to: button on their public www page. > > >Most people put up an "email to:" button on a public page for >communications related to what's on the page. It's quite a stretch to >assume that this invites any and all email from anyone who cares to send >whatever they want. I can't say I've ever seen one that said "Please send >SPAM(tm) to:" ... But to attempt to define "SPAM" (unless you're Armour) is dangerous. This whole notion of "unwanted mail" is ill-defined and not something "the law" should get involved in, in my view. (And CP technologies certainly are consistent with this, e.g., placing the role of screening on those who set up gates, not on tracking down True Names for prosecution.) >However, since others may think like you, I guess I'll have to add a line >above my link stating that email not related to the purpose of my site >will be happily proof-read at the rate of $200 per hour, 1 hour per 60 >lines, minimum. Perhaps I'll get lucky. If I get a big enough chunk of >SPAM(tm), it might be worth the costs of breaking down the anonymity. As the legal eagles will tell you, the essence of a contract is a two-way agreed upon set of terms, not a one-way "if you send me mail I decide I don't want, you will have incurred a charge of $1000." Try enforcing your $200 an hour "proofreading charge" in any court in the land. (I've been saying this thing for several years. Who knows, maybe Rabit Wombat was the first to use it. Whatever, it's as unenforceable and meaningless now as it was several years ago.) >No, this b.s. is more like having someone put a dead skunk in my mailbox, >with no return address, trying to prevent me from sending them 100 dead >skunks as a return favor. And about as welcome. In the case of actual USPS mailboxes, there are laws which prevent others from using them (e.g., no UPS or FedEx deliveries). For sure, dead skunks can be placed in mailboxes, or under porches, or whatever. The law can't fix everything. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Unrequested mail from Mr. Babayco
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:28 AM 9/13/96, Z.B. wrote: >It doesn't matter if you get one or one hundred messages - both are still >annoying as hell. If I wanted whatever you're advertising or selling, >I'd come look for it. I'd prefer that you not mail me. Mr. Babayco, I did not request your mail to me, and I am annoyed at having received it. I am not interested in the views you are advertising or selling, and I'd prefer that you not mail me. To make me whole, I demand that you send me $125 for this occurrence, and $125 for each future occurrence. Have a nice day. --Timothy C. May cc: Law firm of Canker, Sleazewell, and M. Dooza (sauce for the gander?)

2 1

Security technical list
by MacGyver 17 Dec '03

17 Dec '03

[pgp sign clear] Anybody could help me to find a mail list of security,crypto,etc?? Regards

2 1

Morph Escrow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:40 AM 9/13/96, Greg Broiles wrote: >Kozinski also suggested that computer-generated or morphed images of >children involved in sexual acts may not be protected under the Constitution >because of ongoing trauma to the child, while computer-generated or morphed >images of adults would be protected. Hence the proposal for "morph escrow": "Upon presentation of a valid court order or Presidential Decision Directive, a complete morph history of any image deemed possibly of prurient interest must be presented to law enforcement." As the law cannot tell if an image of prurient interest started out as a legal image of Raquel Welch or Jennifer Aniston, or started out as an illegal image of a minor child, morph escrow will force all image possessors and distributors to produce proof that the image started out legal. Failure to escrow morph histories, or possession of an image with an authorized morph history escrow certificate, is punishable by not less than six months in jail. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0