December 2003 - cypherpunks-legacy

Re: Why is cryptoanarchy irreversible?
by Ted Cabeen 17 Dec '03

17 Dec '03

At 02:38 PM 11/7/96 -0800, you wrote: >>Jeremiah A Blatz wrote: >>ph(a)netcom.com (Peter Hendrickson) writes: >> Well, once I've got my strong crypto and electronic commerce, and 20 >> or so virtual identities to do things for me, and the gub'ment can't >> tell what money I'm making and spending, so they can't tax me. So if >> they can't tax me, and they can't tax lots of folks, then they can't >> pay their jack-booted thugs. So the goverment becomes irrelevant. It >> can't support a huge police state infrastructure, and certainly can't >> but mega-crays to break my crypto, so how're they going to retain >> control? >> When we say anarchy, we mean anarchy. > >This only works if there are large numbers of people who think it is >a good idea. Otherwise, the resources of the Federal Government >may be directed quite effectively against a small number of people. > >If you can get a life prison term for your strong crypto you may >hesitate to use it. If not, then you may get to be an example >for everybody else. That's why we have to develop stealth PGP and good stego so that the government doesn't even know that you're using the strong crypto that has been outlawed. If they can't prove that there's actually a message in the picture of the catsgills you just downloaded off of alt.binaries.pictures.nature, you can't get a life sentence in jail. -- ______________________________________________________________________________ Ted Cabeen http://shadowland.rh.uchicago.edu cabeen(a)netcom.com Check Website or finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." -F. Bacon cococabeen(a)aol.com "Human kind cannot bear very much reality."-T.S.Eliot 73126.626(a)compuserve.com

1 0

WebTV a "munition"
by Eric Murray 17 Dec '03

17 Dec '03

Page 3 of the San Jose Mercury News has a small blurb about WebTV's browser/set-top box that "uses computer-security technology so powerful that the government is classifying it as a weapon that will require a special export license before it can be sold overseas". "Few industry experts expect such a licsense to be granted, meaning the companies are unlikely to begin selling current versions of the US-made devices next year in Eurpoe and Japan as they had planned". [fluff about export laws] "We're the guinea pig" says Steve Perlman, chairman and CEO blah blah. So what's the story here? It's a web browser, so they're probably talking about SSL. SSL (both versions) already has mechanisims for allowing "export" level encryption, and although you still need to get a Commodities Jurisdiction, it's been done before so it shouldn't be too difficult. If they didn't use the "export" level SSL CipherTypes, then what're they up to? Are they fighting crypto export laws (for which they should be congratulated and supported) or are they just looking for free publicity? -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

8 9

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:39 AM 11/8/1996, Timothy C. May wrote: >At 9:50 AM -0800 11/8/96, Peter Hendrickson wrote: >>At 11:29 AM 11/8/1996, Jeremiah A Blatz wrote: >>> Furthermore, terrorrim and etc do not depend upon secure >>> communications to work. People tend to be able to talk face-to-face in >>> isolated environs, this is just as effective as a good public-key >>> cryptosystem. Crypto won't suddenly protect the types of people who >>> are professional killers/terrorists from scrutiny. It meerly would >>> allow them to communicate securely over distances of more than 10 >>> feet. This, IMO, is not much of a win for them. >> Face-to-face communications in isolated environs does not a cryptoanarchy >> make. > Yes, but you're the one talking about bombings, mass killings, Sarin gas > attacks, and other such examples of "terrorism." You cite the presence of > these things as why the Constitution will effectively be suspended and why > neighbors will cheerfully conduct vigilante raids on their suspected > terrorists. > Crypto anarchy is not the same thing as terrorism. Calling terrorism > "crypto anarchy" does not make it so. I could not agree with you more. What I am working with is the hypothetical Four Horsemen scenario which you have described above. I am not endorsing that scenario. If that were the outcome of cryptoanarchy, and some people think it will be, would it be a manageable problem or would the technology just sort of get away? I believe it would be easily managed if there were broad public support. Jeremiah correctly pointed out that you don't need strong cryptography to commit terrorist acts. That just puts us where we are today - not in a cryptoanarchy. I don't think that strong cryptography helps terrorists much. Let's face it, biowarfare and sarin gas don't have anything to do with cryptography, no matter how much the GAKers will try to show that they do. But, if I am wrong and for some reason the availability of strong cryptography leads to these scenarios - as the GAKers say - then there would be broad public support for the suppression of strong cryptography. This effort would be successful. It would not dramatically erode the structure of the Constitution or our legal system in the short term. The effect of strong cryptography and the Net is that it makes it possible for people with common interests to find each other more easily and to develop long distance relationships. That's fine when we are talking about scientists, mathematicians, or cypherpunks. But, it also brings together people with less savory interests. It's undesirable for serial killers to find each other and trade notes on how to evade capture. (I think this usually happens now through the prison system.) Strong cryptography makes it harder for governments to manage ideas and relationships between people. There are many implications of this and I think they are almost entirely good. The Constitution may not survive GAK in the long run. If the world were to stay in 1996 and we outlawed strong cryptography this would not necessarily be the case. But the world won't stay still. Computer assisted population management technologies have been getting more effective and cheaper all the time. In the past it was hard to give everybody unforgeable internal passports and ear tags. In a GAKed future that is unlikely to be the case. Segments of the USG probably have the doctrine worked out. We've heard a lot about "the responsible use of cryptography" from the GAKers. In fact, it is highly irresponsible to propose GAK at this time when there is no evidence whatsoever that it is needed. These people may have moved beyond any concern with ideas such as "responsibility." Right now there is a tremendous opportunity to the elites of the world to enslave everybody else. Once you know everywhere somebody goes, everything they read, and everybody they talk about, you can manage their behavior quite effectively. Only a small number of people would be needed to tweak the "justice" computers to punish indiscretions, such as meeting a cypherpunk on the street. Many people would be happy to enslave their fellow citizens if it meant tremendous wealth, power, and prestige for themselves and their children, possibly for a long time. Peter Hendrickson ph(a)netcom.com

1 0

Vulis now on the "Don't Hire" list
by Timothy C. May 17 Dec '03

17 Dec '03

I just wrote: And, indeed, it is not likely to be who suffers in the job market as a result of ^me Dr. Vulis' rants and raves and generally insane postings; my situation is secure, but I understand that Vulis has joined L. Dettweiler on the "List of Unemployables" passed around Silicon Valley. ... I meant to say "it is not likely to be _me_ who suffers in the job market..." Sorry for any confusion. --Tim "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 4:00 PM 11/7/1996, Jim McCoy wrote: >ph(a)netcom.com (Peter Hendrickson) writes: >[...] >>> Once a terrorist has strong crypto, why should they stop using it if it >>> becomes illegal? >> Use of strong crypto would be a tip off that one is a terrorist. >> If strong cryptography were unpopular and highly illegal, very few >> people would be using it. This makes it easy to identify suspects. > But the difference between strong crypto and weak crypto is not > something which is visible to an outside observer unless they make > the effort to attack a particular system or decrypt a message. Such > an attack is beyond the capacity of most municipal or state governements > and is a difficult and expensive task for federal agencies other than > the NSA (who would nto be pleased if their machines were suddenly at > the beck and call of the FBI or any other organization; never underestimate > the power of inter-agency infighting :) If mandatory GAK were imposed, reviewing messages is easy, even with inter-agency fighting. Or, encryption in general could just be forbidden if GAK created too much hassle. > What make such detection even harder is that a good crypto system > generates output which is indistinguishable from noise, this makes it > much easier to hide the fact that an encrypted channel is being used. In practice I suspect that good stego is hard. You don't have to be right every time when you look for it, just some of the time. When you see packets that seem kind of funny to you, the judge issues you a warrant and you search the suspect's house and computer very carefully. If stego is in use, the software that generated it can be found. Then you hand out a life sentence. Yes, this would be somewhat expensive. But if the number of suspects is small, it is completely feasible. You might also identify suspects in other ways. Maybe that Jim McCoy is looking a little too successful or perhaps he made an unwise comment to a "friend" who reported him. That could easily be grounds for a warrant and subsequent change of quarters. > The funny thing about noise in the information theory sense is that it can > actually be _anything_ depending on context, and this sort of uncertainty > is the bane of a legal system which is solidly grounded upon technicalities > (such as the US legal system.) Which technicalities protected the Japanese-Americans during World War II? As you probably know, these people were not protected by our legal system. Their bank accounts were frozen and they were forced to sell their property in less than two weeks. They were effectively stripped of their assets. Then, they were carted off to concentration camps and left there for years. This was allowed to happen because there was strong public support for it. The legal system would have to be stretched considerably less to outlaw strong crypto and make it stick. Peter Hendrickson ph(a)netcom.com

3 2

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:18 PM 11/7/1996, Ted Cabeen wrote: >At 02:38 PM 11/7/96 -0800, you wrote: >>>Jeremiah A Blatz wrote: >>>ph(a)netcom.com (Peter Hendrickson) writes: >>> Well, once I've got my strong crypto and electronic commerce, and 20 >>> or so virtual identities to do things for me, and the gub'ment can't >>> tell what money I'm making and spending, so they can't tax me. So if >>> they can't tax me, and they can't tax lots of folks, then they can't >>> pay their jack-booted thugs. So the goverment becomes irrelevant. It >>> can't support a huge police state infrastructure, and certainly can't >>> but mega-crays to break my crypto, so how're they going to retain >>> control? >>> When we say anarchy, we mean anarchy. >> This only works if there are large numbers of people who think it is >> a good idea. Otherwise, the resources of the Federal Government >> may be directed quite effectively against a small number of people. >> If you can get a life prison term for your strong crypto you may >> hesitate to use it. If not, then you may get to be an example >> for everybody else. > That's why we have to develop stealth PGP and good stego so that the > government doesn't even know that you're using the strong crypto that has > been outlawed. If they can't prove that there's actually a message in the > picture of the catsgills you just downloaded off of > alt.binaries.pictures.nature, you can't get a life sentence in jail. What happens when they find it on your disk? Remember, you don't have an encrypted virtual disk, or if you do, the consequences are the same if you didn't. Peter Hendrickson ph(a)netcom.com

1 0

[rant] Race
by Sean Roach 17 Dec '03

17 Dec '03

Sandy Sandfort wrote: ... >What you mean WE, white man? ... At first I was afraid to comment, as I have been more than vocal in the last 24 hours, but then I decided that I thought this important enough to bring up. This was the first time on this list that I noticed such an obvious reference to race, granted I'm fairly new to the list,(quite new in fact), and when I think about it, there were several references to Russians and Jews in some of the other posts about Dr. Vulis and his practices. In my rose colored view, I had not taken notice, possibly because they were comments about the statements made by an individual, more likely because I'm gratefully ignorant to most of the filth of this imperfect world. I was unaware of some of the hardships some of my friends and their friends still go through just because of their skin color. Not Just with recognized, individual bigots, but also with the police, and I live in a sparsely populated area. The point I was going to make was that this comment caught my eye, because it bridged my real, though I should say corporal as this is quite real, world with my online world. For a week there, I was a individual in a society of minds, our "race" depended on our individual views. I like being online, I am judged by what I think matters. When something threatens my ability to be free of the definitions put on my physical shell, I react. Does this have any relation to crypto? No But it does have relevance to anonymity. Online I can be who I feel like, not what I look like. For those wondering who I am, I may be an AI painted purple with a big intel sticker on my side, it doesn't matter, what do you think about my ideas.

2 1

Re: Group order for "Secret Power" ... (San Francisco Bay Area only)
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>I'm looking for 19 other people interested in "Secret Power" (Craig >Potton Publishers has indicated that there is a discount for 20 or >more copies). If you are in the San Francisco Bay Area, please >contact me by phone or E-Mail. If anyone is going to the Usenix e-commerce conference I can bring over some copies for them. I'm already taking over a whole bunch of copies, I can bring over a few more if I can get them (I've pretty much cleaned out the bookshops around here). I can bring them to the conference but what you do with them from there is up to you (ie I won't have time to find post offices to mail people copies or whatever). Cost is US$25 (the NZ retail price is $35 = US$25), delivery is in just over a week. Peter.

1 0

Re: [PRIVACY][BLACKNET] Potential Analyst?
by Steven L Baur 17 Dec '03

17 Dec '03

>>>>> "Brian" == Brian D Williams <talon57(a)well.com> writes: Brian> The Pro's say that analysts are born not made. If so whoever wrote Brian> this appears to show potential..... Brian> Send resume to BLACKNET..... It would have been more impressive if it had mentioned that Dimitri "Ray is a typical Californian" Vulis and Ray "You'd be surprised if you knew where I lived" Arachelian appear to live within walking distance of each other. -- steve(a)miranova.com baur Unsolicited commercial e-mail will be billed at $250/message. What are the last two letters of "doesn't" and "can't"? Coincidence? I think not.

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 4:08 PM 11/7/1996, Timothy C. May wrote: >At 2:38 PM -0800 11/7/96, Peter Hendrickson wrote: > >> If you can get a life prison term for your strong crypto you may >> hesitate to use it. If not, then you may get to be an example >> for everybody else. > Well, this is what in private e-mail to Peter I was referring to when I > said "only a police state" could pull the plug on free speech and strong > crypto once it was ubiquitously deployed. While the term "police state" is not well defined, I do not believe it applies to what I am describing. (There is a risk that it could develop, however.) Laws forbidding the use of cryptography have ominous free speech implications as we would be attempting to outlaw concealed meaning. Concealed meaning can be pretty well concealed and that makes for difficult and dangerous legal questions. On the other hand, the action of running a program which uses forbidden crypto systems is pretty unambiguous and could be effectively isolated from other kinds of speech. Many kinds of speech are already illegal. For instance, I am not allowed to copy somebody else's speech because it would violate copyright laws. I am not allowed to break verbal contracts. In essence, I am punished later for the something I said if I am forced to keep my word. But, this does not constitute a police state. What I am proposing would not require an end to fair trials or warrants or really any other legal customs we have. In case anybody has any doubts, and I doubt Tim does, the existence of a life sentence does not imply the presence of a police state. > Throwing people in prison for life for using crypto is something that is > certainly _possible_, though I rather doubt taxpayers will be keen on > paying for this. Simply executing those who use random numbers makes more > sense. The taxpayers will be happy to pay to keep a small number of criminals in jail if it keeps the rest of us fairly safe within our homes and on the streets. > All implausible, of course. > By the way, I've never claimed that I know crypto anarchy is irreversible, > I just think it is. I've presented some plausibility arguments on why I > think this is so, drawing parallels to other developments in history, but > logical proofs and predictions about the future don't usually go together > very well. Actually, I agree with Tim. I think the deployment of strong cryptography will be irreversible. But, it will be irreversible because the bad aspects of it won't be all that bad and in general it will be a very positive development. The reason it must be stopped now is to stop the voters from discovering this. (Certainly we have seen a strong anti-democratic sentiment among the proponents of GAK, when they propose that we cannot even be allowed to hear the scenarios which should concern us, the ultimate repository of political legitimacy in the United States.) A good comparison can be made to the recreational drug situation. Many people, probably a majority of people, believe that they should be allowed to take whatever drugs they like and many do. Efforts have been made to forbid it, but they are almost universally unsuccessful because of the tremendous popular support for recreational drug use. Peter Hendrickson ph(a)netcom.com

3 3

Re: Why is cryptoanarchy irreversible?
by jim bell 17 Dec '03

17 Dec '03

At 12:22 PM 11/7/96 -0800, Peter Hendrickson wrote: >It appears to be widely believed that cryptoanarchy is irreversible. >Everybody believes that the race to deploy or forbid strong cryptography >will define the outcome for a long time. > >I can't think of a reason why this should be so. >If the wide use of strong cryptography results in widely unpopular >activities such as sarin attacks and political assassinations, it >would not be all that hard to forbid it, even after deployment. Simple analogy: Suppose you put two people into a room with a deck of playing cards and a table, instructing "Person A" to build a house-of-cards, and telling "Person B" to stop him from achieving his goal. Who do you think will win? Obviously, the latter will win: It's vastly easier to knock such a structure down than to build it in the first place, and all "Person B" has to do is occasionally take a whack at the structure. BTW, some of your confusion is probably based is the false assumptions in your last sentence above. "..wide use of strong cryptography results in widely unpopular activities such as sarin attacks and political assassinations." First, I contend that the unpopularity of political assassinations is based far less on their presumed undesirability, and much more so on the fact that the average citizen (currently) has no input on who is being killed. He might well suppose that the killings are trying to deny him the little power and influence he has in the political system. ("They shot [fill in the blank}! I voted for him!") But what if assassination was made far more accessible to the common man? Suppose, say, the approval of one million citizens was the only thing necessary to have an assassination legally accomplished? Or, more likely in practice, the vote of a million citizens was interpreted as a kind of terminal veto over that particular politician or government employee, who would have to resign or face the (lethal) consquences! In that case, assassinations wouldn't be seen as bad, they'd be the natural consequence of a politician who overstays his welcome and ignores numerous warnings. Second, things like "sarin attacks" are, in fact, the classic example of actions which WOULD NOT HAPPEN under a crypto-anarchy. Over the last 30 years or so, "terrorism" has come to be associated with random attacks on innocent citizens. But I propose that such attacks only occur because the better, more appropriate targets are purposely made hard to attack. Most people don't realize this. But consider: Wouldn't the people who bombed the OKC Federal building have preferred to kill, for example, the top 50 government officials responsible for Waco and Ruby Ridge, rather than 150 ordinary government employees? Of course they would! If crypto-anarchy means anything to the future of terrorism, it's about helping to ensure that the people truly guilty of oppression get targeted in preference to anybody else. Naturally, such a point of view will be wildly unpopular...with the guilty few. The rest of us should like it just fine. This is why crypto-anarchy will be so popular with the public once it's in place. No more taxes, governments, militaries, wars, holocausts, etc. _THAT'S_ yet one more reason why it's irreversible: people will have seen the results of both systems, and they'll be damned if they're going to allow crooked politicians back in the game! Jim Bell jimbell(a)pacifier.com

2 1

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:11 PM 11/7/1996, Timothy C. May wrote: >At 5:16 PM -0800 11/7/96, Peter Hendrickson wrote: > >> While the term "police state" is not well defined, I do not believe it >> applies to what I am describing. (There is a risk that it could develop, >> however.) >> Laws forbidding the use of cryptography have ominous free speech >> implications as we would be attempting to outlaw concealed meaning. >> Concealed meaning can be pretty well concealed and that makes >> for difficult and dangerous legal questions. > If the only means of detection is raiding homes to inspect them for > contraband--something not even done during the height of the anti-drug > hysteria, at least not on a regular basis--then I stand by my comment that > stopping private use of cryptography requires a police state such as the > world has not yet seen. Perhaps initially, during the state of emergency declared by our heroic and courageous President, some unfortunate abuses of authority may occur. But, after the first 90% of the terrorists are incarcerated, we will have the luxury of returning to an orderly legal system replete with search warrants. Keep in mind that the drug laws face a large number of dedicated opponents who will go to great trouble to evade the laws. I suspect that these people are in the majority, although I don't know for sure. I find it hard to believe that any sizeable number of people would find the Four Horsemen scenario tolerable. >> On the other hand, the action of running a program which uses forbidden >> crypto systems is pretty unambiguous and could be effectively isolated >> from other kinds of speech. > Oh? How? If the output of such a program looks like quantization or Johnson > noise in a recording, then how could this form of "speech" be effectively > isolated? Sorry, I wasn't very clear. What I mean is that once you've been caught red handed with a stego program, the game is up. That is, I think it is possible to get ideas of who is operating illegally from interceptions. (I may well be wrong.) But, the actual evidence is easily collected off your computer. A program which performs encryption or stego is not very ambiguous about what it is doing. >> Many kinds of speech are already illegal. For instance, I am not allowed >> to copy somebody else's speech because it would violate copyright laws. >> I am not allowed to break verbal contracts. In essence, I am punished >> later for the something I said if I am forced to keep my word. But, >> this does not constitute a police state. > Careful! Some of your examples are not examples of _prohibited_ speech, but > are instead examples of _actionable_ speech. The Constitution is fairly > clear that the government cannot be a filter or censor for speech. > Hence, requirements that people speak in English, or in some other language > that the government can understand, is not required. Not even in a criminal > case, as a matter of fact. (If I speak only Skansko-Bravatlian, and am the > only such speaker in the world, I cannot be compelled to study English or > even Spanish prior to a trial.) > Requiring people to speak or write in a language that is understandable to > some GS-10 at Fort Meade would appear to violate the First Amendment in a > rather serious way. As encrypted speech is really just another language > (tell me I'm wrong on this, anyone), encrypted speech appears to be fully > protected by the First Amendment, which says that Congress shall make no > law about speech, blah blah. Under the right legal environment, and we are not far from it, none of this matters. The Courts can be quite liberal when they think there is a good reason for it. Take seating in restaurants. If you read the Constitution you won't find where the Federal Government is empowered to regulate this. The Courts decided that the Commerce Clause was a reasonable justification. This argument resembles the peace of God. All the Justices have to say is that the Constitution does not specify private speech, just public speech. The same way it doesn't say "assault rifle" it says "arms". The same way it doesn't say "commercial speech" just "speech". The Constitution will likely be a powerful support for cryptoanarchy, but only because I doubt widespread opposition to strong cryptography will arise. >> What I am proposing would not require an end to fair trials or warrants >> or really any other legal customs we have. > I strongly disagree. Prosecution would involve making certain _forms_ of > speech illegal (not the same thing as the _content_ being illegal, as in > ordering the kililng of another, or treason, or shouting "Fire!" > improperly). But we are not objecting to content! We don't care what goes inside the encryption - unless it involves extortion, murder, child pornography, or weapons data - we care that communication has been limited. Cryptography is not a language because nobody can understand it but the recipient. We simply want the recipient to share with the rest of the class - that is an independent legal issue from persecution for one's beliefs which is of course, and thankfully, unconstitutional your Honor. Or how about this argument: It isn't the encrypted message that we care about so much, your Honor. We care that it is evidence that the perpetrator did commit the illegal act of encrypting his communications using military-grade technology which is now highly illegal. When I say it doesn't really put an end to most legal customs, I mean that the courts do not have to behave all that capriciously to make the law stick. For the most part people know how not to break the law and the people who are convicted did break it. Other speech rights do not immediately dissolve away. Yes, there is a risk that they will do so later, but the police state is not required to suppress cryptoanarchy if there is strong public sentiment supporting it. > And detection and collection of evidence would almost certainly involve > illegal searches and seizures. Not in the presence of wide public support. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 6:56 PM 11/7/1996, Andrew Loewenstern wrote: > ...<several excellent points>... > People will outright demand strong crypto. > This is already happening. Despite intense pressure from TLA's for GAK, > savvy businesses are demanding strong crypto (the idea that no crypto at all > will be used is utterly ridiculous, it will either be strong or GAKed but > there will be crypto). Hardly anyone is bowing to the pressure. It will >take > a mandate from congress to get people to actually use GAK, and the more > businesses and congresscritters begin understand the benefits of strong >crypto > to the bottom line, the less likely such a mandate would happen. This implies that there is a dramatic political opportunity for those who have not yet taken a strong stand on the issue, young congresspeople please note. Federal interference has probably delayed the onset of large scale net commerce by at least a year. The Zimmermann case alone, I suspect, has had a dramatic chilling effect on the development of good security technologies. It is interesting to speculate on the career consequences for those who are currently on the wrong side of the fence. People like Jim Exon will, at most, find their way into an embarrassing footnote in the history books. What about Albert Gore? Since the '92 election his political stock has fallen dramatically amongst people I know. Before his "Information Highway" activities, a few people were suspicious of his wife's inclinations towards censorship, but he was not generally hated. A lot can happen in four years. My guess is that the general public and even the reporters ;-) will have caught on to the issues surrounding strong crypto by the next election which will not be good for Gore's naked ambition. It's also interesting to wonder what will happen to certain institutions which have not been very well behaved. Certainly the ATF is not well loved. That is not lucky for long range funding. I suspect the NSA will be able to salvage their reputation by sticking the blame on the Clinton administration and anybody else who is handy. They seem to be playing both sides of the fence right now. There is a tremendous institutional opportunity for the NSA as the demand for secure systems is growing exponentially and they probably know it. Peter Hendrickson ph(a)netcom.com

1 0

Re: RICO - (Was: Group order for Secret Power)
by jim bell 17 Dec '03

17 Dec '03

At 04:43 PM 11/7/96 -0500, Black Unicorn wrote: > >I cover RICO because it's a popular prosecution tool, "popular"? Well, only in a rather stilted point of view! > because it is >the predominate vehicle for seizure and forfeiture in federal cases >(of which remailer and encryption issues are likely to arouse) and >because it represents a codification of the approach most courts take >when dealing with seizure cases. In a very real way, RICO represents >the outer extremes of seizure cases in the United States, and is >probably, given the complexity of many state laws, the simplest way >to "grab" something. It also has civil provisions which make >"private prosecutors" out of you and me. But the odd thing is, the one entity we can't seem to attack using RICO is the Federal government, and probably most other governments levels. Looked at purely objectively, it should be easy to demonstrate that the Federal government (and its representatives) have engaged in plenty of crime as a pattern of activity, and certainly enough to rise to the level of the standards of RICO. (It takes only a few instances of such crime satisfy the standards of RICO.) Change the name "Federal Government" to "Organization X," and describe what it's done, and all the evidence will point to a clear pattern of crime. Now, okay, it may seem presumptuous of me to even dream of the possibility of using RICO against the thugs who wrote it. But this country (USA) is SUPPOSED to be under the rule of law, not men, and there is no reason (other than, sadly, pessimism or a-priori realism) to conclude that the government can't be punished when it breaks its own rules. Such punishment could come by way of mechanisms such as the OKC bombing, or the far more selective system Assassination Politics (AP). Take your choice. Jim Bell jimbell(a)pacifier.com

2 1

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:13 PM 11/7/1996, Jim McCoy wrote: > Getting a program to recognize a subliminal message channel is even > harder than teaching a human to do so, check out the book Disappearing > Cryptography or do a web search for "mimic functions" to see how easy it > is to hide messages in text which a program parses as regular English. > The other problem is that more and more of the data being tossed around > the net are images and sound files in which it is incredibly easy to > hide encrypted messages. I doubt it is as easy as you say. Truly noisy sources are unusual. You don't have to be 100% sure you have a crypto-terrorist on your hands to search their house, interrogate them, and talk for awhile to everyone they know and then watch them carefully from then on. You don't have to have very many convictions with life sentences to discourage most experimenters which means that you can afford to spend a lot of time and effort on those that you can find. The perpetrator need only mess up once to be put in jail where he belongs. Assuming that it is possible to identify most crypto-anarchist-terrorists as suspects (possibly through informants or surveillance or tax audits) it should be fairly simple to find their contraband disks and data when you search their house. The problem with executables is that they have to execute so you can tell if they are encryption software. How will you handle this problem? >> In the absence of strong cryptography, remailers do not offer much >> anonymity. > Except for the fact that US law stops at the US border (modulo kidnapping > Mexican doctors or strongarming the rest of the world to obey US > dictates...) Information, on the other hand, is very easy to transport > across national boundaries and such transmission is impossible to stop. > With remailers outside the US I can send a message to a free nation and > have it delivered to whomever I want. Cross border transmissions of illegally encrypted information is as hard to stop as the use of strong cryptography. If you can stop, for the most part, the use of strong cryptography, then you can stop the use of foreign remailers, errrr, I mean espionage mailers. Were there strong support for it, even cross border activity could be significantly curtailed. This would complicate the practice of carrying stego'd materials across by hand. That may seem improbable, but I know that in the late 1960s the Johnson Administration seriously considered limiting U.S. tourism because of the negative impact it had on the dollar. In the model I am positing, there would be broad popular support for such policies. Peter Hendrickson ph(a)netcom.com

2 1

Fwd: God and None (fwd)
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

--------------------- Forwarded message: From: scotta(a)astea.com (Scott Auge) To: scottauge(a)aol.com Date: 96-11-07 10:18:29 EST ---------- Forwarded message ---------- Date: Tue, 5 Nov 1996 21:26:43 GMT From: Donald Sellari <dsellari(a)btg.com> To: scotta(a)hpg60.astea.com Subject: None History Of The Net > ================== > > First there was God. He was quite lonely so he created Dennis. > > Dennis was unimpressed with God. > > So,... God created Brian. > > But, Brian got bored with God. > > So Brian and Dennis started playing, and they created C. God saw C, > and saw that it was good. So he decided to let Brian and Dennis play > some more. > > Then Brian and Dennis created Unix. God saw Unix, and he was jealous. > So he created Bill to torment Brian and Dennis and obscure their > creation (for God could not destroy Unix, for he secretly admired > its perfection). > > So Bill created Microsoft. And Microsoft created Windows. And God saw > that it was bad, but it had market share, so he was happy. Then Bill > got cocky, and his ego got bigger than God's. So to knock Bill down a > couple of pegs, God put into effect, a wondrous plan. > > First God created Tim. And Tim created the World Wide Web (using > Unix, of course). This was good, but not THAT good. So God created > Marc. Marc created Mosaic (using Unix, of course). Mosaic created a > huge feeding frenzy that has got a lot of people who are reading this > their jobs. > > But that's a different story. Mosaic was good, and God saw it was > good, so he allowed Marc to start Netscape. Back to this later. > > But all this time Brian and Dennis started to make something better > than Unix called Plan 9 (because God was successful in foiling Brian > and Dennis' previous seven plans [there was no Plan 8 because Brian > and Dennis pulled the wool over God's eyes and just jumped to Plan 9, > which was too bright a move for even God to figure out.] ) > > Eventually, God figured out how to create Larry. > > No one knows how or why he created Larry, except perhaps to reduce > productivity at the Jet Propulsion Labs at NASA. [Rumors are that God > created Larry because he secretly liked what Dennis and Brian had done > with C, but didn't think C and Unix was enough -- this probably isn't > true because God believed he had destroyed Brian and Dennis' plans by > destroying Plans 1-7, and by creating Microsoft to slay their beloved > Unix. > > Anyhow, Larry created Perl (using Unix and C, of course), and God saw > it was good, so he made Randal. Larry and Randal wrote books about > Perl. And everyone saw that this was good, except snobs who were too > much into C, Windows, and Intel. (It so happens that Randal was so > cool he figured out a way to break into Unix at Intel, and Intel sued > him for it but that's another story also -- chances are Randal would > not have been able to break into *Plan 9* at Intel, but Intel isn't > cool enough to be running Plan 9) > > Anyhow, back to Randal. So Randal and Larry wrote books, but they had > to be nice because of the people they worked for. So then came Tom. > But back to Tom later. > > Anyhow, God saw Netscape (made using Unix and C, of course), and he > saw it was good, and that annoyed Bill quite a bit. And that made Him > very happy, and made Marc very rich. But Bill was very very rich. But > that's a *completely* different story. > > But as good as Larry's creation, Perl, was, it couldn't do everything, > so God created Scott. Scott announced Java, and this was big news. Now > Java really pissed Bill off, because Bill also created Blackbird, and > Java killed Blackbird. This was bad because killing Blackbird also > meant killing the Microsoft Network. And many rejoiced over that, but > that, too is another story. > > Now Java, obviously had done much to annoy Bill. For Java was so good > that Bill had to license Java. All this time, Scott poked lots of fun > at Bill because Sun, which was where Scott worked, made a better OS, > derived -- of course -- from Unix, which was better than Bill's and > Microsoft's Windows. > > Anyhow, even God's creations Steve and Steve who created Apple > couldn't make Bill license the much superior MacOS. But finally, Bill > had to license Java. So justice was served, and Bill's ego was served > him on a platter for him to eat his words. Or something. That part is > unclear. > > So by this time Windows and Microsoft and Bill in general really > sucked. Especially considering the advantages that Brian and Dennis' > C and Unix, running Marc's Netscape and Mosaic over Tim's World Wide > Web, doing cool CGI stuff with Larry's Perl, which you learned from > Randal and Tom, and got to program with Scott's Java. > > And God realized he had put Bill down too far. So then God made it so > that Marc's Netscape and Mosaic could run on Windows. We already know > that Bill had to license Java from Scott. We know that Bill missed > the boat for not beating Tim to the punch on the World Wide Web. The > last straw was for God to make it possible for Larry's Perl to run on > Bill's Windows. > > So back to Tom. Tom was a Perl God. And God didn't like this, but > Tom's a God so there isn't much God could do, so He couldn't stop Tom > from saying things like "install an operating system on your poor > lonely computer the way God and Dennis intended", and "Espousing the > eponymous /cgi-bin/perl.exe?FMH.pl execution model is like reading a > suicide note -- three days too late." > > The moral to the story? God is fickle. That's why Microsoft and Bill > and Windows exists. Do what God intended, install C, Unix, > Mosaic/Netscape, Java, and Perl on your system, and make Brian, > Dennis, Larry, Tim, Tom, Randal, Scott, and even Steve and Steve, > I'm sure, happy by doing so. > > Oh yeah, Linus was cool too. He's the guy you thank for being able to > run all the cool stuff on your crappy little Pee Cee. (anything with > x86 on it, by default, is crappy, no PERSONAL flames intended) > > >

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:12 PM 11/7/1996, jim bell wrote: >At 12:22 PM 11/7/96 -0800, Peter Hendrickson wrote: >>It appears to be widely believed that cryptoanarchy is irreversible. >>Everybody believes that the race to deploy or forbid strong cryptography >>will define the outcome for a long time. >> I can't think of a reason why this should be so. >> If the wide use of strong cryptography results in widely unpopular >> activities such as sarin attacks and political assassinations, it >> would not be all that hard to forbid it, even after deployment. > Simple analogy: Suppose you put two people into a room with a deck of > playing cards and a table, instructing "Person A" to build a house-of-cards, > and telling "Person B" to stop him from achieving his goal. Who do you > think will win? Obviously, the latter will win: It's vastly easier to > knock such a structure down than to build it in the first place, and all > "Person B" has to do is occasionally take a whack at the structure. > BTW, some of your confusion is probably based is the false assumptions in > your last sentence above. "..wide use of strong cryptography results in > widely unpopular activities such as sarin attacks and political > assassinations." No, you're confused, but it's probably my fault. We don't really know what cryptoanarchy will be like. We all have ideas about it. Some we share and some we don't. But we won't really know until we see it happen. My whole point is based on the proposition that the doomsayers are right. I believe D. Denning has suggested that cryptoanarchy will result in the breakdown of our society. The implication is that we must stop this from happening. What I am saying is that we can wait and see before going into a panic. If it turns out to be bad - and I mean Assassination Politics, by the way - it is reasonable to assume that broad popular support for the suppression of strong cryptography will result. Even most cypherpunks would support and participate in such policies if it appeared to be necessary. Broad popular support means that it will be possible to roll back cryptoanarchy. That means we don't need to do anything hasty now. The people who want to do some hasty should be called upon to justify their beliefs. To date I don't believe they have done so. It might be a good idea to reread the first sentence of the last paragraph. I am not repeat not endorsing the Four Horsemen scenario. > First, I contend that the unpopularity of political assassinations is based > far less on their presumed undesirability, and much more so on the fact that > the average citizen (currently) has no input on who is being killed. He > might well suppose that the killings are trying to deny him the little power > and influence he has in the political system. ("They shot [fill in the > blank}! I voted for him!") But what if assassination was made far more > accessible to the common man? Suppose, say, the approval of one million > citizens was the only thing necessary to have an assassination legally > accomplished? Or, more likely in practice, the vote of a million citizens > was interpreted as a kind of terminal veto over that particular politician > or government employee, who would have to resign or face the (lethal) > consquences! In that case, assassinations wouldn't be seen as bad, they'd > be the natural consequence of a politician who overstays his welcome and > ignores numerous warnings. It is my opinion that your bloodthirsty dreams have done a great deal to discredit cryptoanarchy. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:48 PM 11/7/1996, Jim McCoy wrote: > Peter Hendrickson writes: >> If mandatory GAK were imposed, reviewing messages is easy, even with >> inter-agency fighting. Or, encryption in general could just be >> forbidden if GAK created too much hassle. > Encryption itself will never be forbidden because there is far too much > money riding on electronic commerce. I think this is true. Good computer security, including encryption, is clearly important to the financial well being of the country. If we consider that to be a national security issue, then we have to ask why the national security apparatus is attempting to undermine our security. > An administration which tried to outlaw all encryption would soon find > itself on the next train out of D.C. after the next election cycle. But if the doomsayers are right, this would not be the case. Most people will be willing to give up some Internet commerce if they believe it is necessary to protect their children and maybe their society. That is not even an unreasonable point of view. >> In practice I suspect that good stego is hard. > You are mistaken. Read Disappearing Cryptography to see just how easy > it is, then check out Romana Machado's EzStego program (done in Java so > it can be added to any web download with a bit of tweaking.) If the > penalty for using bad stego is high enough you can be certain that natural > selection will make certain that eventually the programs being used are > top notch code :) I may be mistaken. I have added "Disappearing Cryptography" to my list. Still, my intuition says that it is quite hard to do stegonography for many years and never tip your hand even once. >> You don't have to be right every time when you look for it, just some >> of the time.... > The problem is that you need to be able to prove that stego is in use, and > this is a much more difficult task than you suggest. But you really don't need to prove it. You just have to convince a judge to issue a warrant for you to get the real evidence. If you have to, you'll train a dog to sniff stego. (That was a joke by the way. ;-) >> You might also identify suspects in other ways. Maybe that Jim McCoy >> is looking a little too successful or perhaps he made an unwise comment >> to a "friend" who reported him. That could easily be grounds for a >> warrant and subsequent change of quarters. > Get a warrant, search my system, find nothing but a bunch of applications > and a collection of risque (but definitely legal) pictures which I exchange > with a few friends. You may suspect that when the images are concatenated > in a particular way the low-order bits form a stego filesystem but no one > will be able to prove it in court. Are you concatenating these images by hand? If so, the level of entropy is probably low enough to recover the information through brute force methods or you are hiding a very small amount of information. If you are not doing it by hand, you own terrorist software and will pay the price. And, by the way, who are these friends? Can any of them finger you in exchange for a reduced sentence? Incidentally, I hope nobody on this list believes they will be able to practice cryptoanarchy in my scenario. You are already suspects. >> Which technicalities protected the Japanese-Americans during World War II? > Few. OTOH the interment of Japanese-Americans occurred during a period of > war, at a time when civil liberties were much more limited, and when > Asian-Americans were second-class citizens with very little political power > (that and the Korematsu decision was a complete piece of crap...) In the Four Horsemen scenario, where people are being murdered all the time and the society is in a turmoil, popular support for the suppression of strong cryptography would be easy to arrange. > Today most US citizens distrust the US governement, civil liberties and > protections are fairly well established in law and legal precedence, and > we techno-nerds are actually the ones running the country :) In the Four Horsemen scenario, it is likely that most engineers would be delighted to help put things to rights. >> The legal system would have to be stretched considerably less to outlaw >> strong crypto and make it stick. > It would have to be shattered to make such a ban stick. Times have changed > quite significantly since the 40s, and free speech rights and the first > amendment have become rather important to our information society. This is correct. But these views would be change if we were facing a terrible situation. It isn't even clear that you would have to tamper with free speech rights all that much to suppress strong cryptography. There would be a dramatic political risk that all rights would disappear later, but after somebody you know gets killed anonymously, you might be willing to chance it. Peter Hendrickson ph(a)netcom.com

2 1

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:24 PM 11/7/1996, Timothy C. May wrote: > At 6:56 PM -0600 11/7/96, Andrew Loewenstern wrote: >> middle men). Weak Crypto (i.e. GAK) does not offer these features because >> the >> weak point in the chain becomes a mostly disinterested low-wage employee at >> the KRC, which is likely to be operated by a foreign government! Any >> businessman can immediately understand why this is unacceptable, especially >> with all of the economic espionage stories going around corporate america. > And the GAK advocates have never clarified how an international system will > work. Even if one accepts the dubious hypothesis that the U.S. has a > noncorrupt, benign government, what of other countries? Is Ghaddaffi the > keeper of keys in Libya? How about the military government of Burma? > I can imagine no scheme which could possibly solve this problem. None. The > problem of "rogue governments" (and maybe all governments are rogue to at > least some other governments) means no simple solution. And the > Administration has done nothing to clarify how this will all work. I cannot speak for the GAK advocates. However, you could establish a system where messages between two countries are encoded with keys which are made available to only the two countries in question. A really simple scheme to do this would be for each country to publish a public key. You would be required to encrypt the key to the message with the national public key. That scheme would be fast to deploy. In a more complicated and secure scheme, you would be given a public key from each country that was unique for your communications at the same time you were granted your international communications license. The unique public key would be managed by a small group of people. This means that if it was ever compromised, most message traffic would be secure and those who were responsible would be easy to find. The only way you are at the mercy of the Libyans is if you do business in Libya. Peter Hendrickson ph(a)netcom.com

2 1

exclusion/censorship and the law
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:27 PM 11/6/96 -0600, Jim Choate wrote: >There is one important legal aspect which the operator of the Cypherpunks >mailing list has opened themselves up for with this action. In short they >have now opened themselves up for defamation and liable suites by imposing >an editorial policy on the contents of this list (1). > >This opens up the potential, for example, for Tim May to sue the operator of >the Cypherpunks mailing list now for posts from users (even anonymous ones) >which defame or otherwise liable his character, reputation, or ability to >pursue income in his chosen field. In short the operators of the list >becomes publishers and distributors of the material. It is the legal >difference between a bookstore and a book publisher. I don't pretend to have spent much attention on defamation, but the cases I've seen don't go nearly this far. The two that come to mind are _Cubby v. Compuserve_ 776 F. Supp. 135 (1991), and _Stratton Oakmont v. Prodigy_ (sorry, no cite at hand). _Cubby_ said that service providers were liable *only when they had knowledge of the defamation*. Since the list is set up (as far as I know) to forward messages (regardless of source) to the subscribers without further editorial review, _Cubby_ suggests no liability here. _Stratton Oakmont_ went the other direction (finding potential liability for defendant service provider, on a motion for preliminary injunction? can't remember) but has been widely criticized; that ruling never faced any extended scrutiny because the parties settled. Also, Prodigy, the defendant in Stratton Oakmont, exercised much greater editorial control over postings on that service, and had the ability to remove postings, which is something John Gilmore can't do. So my impression is that you've got the tail end of a useful concept (ability to control is frequently a factor used to determine liability) but are making far too much out of it. One really big difference I see here is that editorial control of the Cpunks list has occurred once (in 4? 5? years of the list's existence), is on a per-person not a per-message basis, and *does not function to restrict who can send messages but only limits Vulis' ability to _receive_ them on his usual system(s)*. You might take a look at Mike Godwin's article on net defamation at <http://www.eff.org/pub/Legal/net_libel_godwin.article>; by now it's a little old, but I don't think anything's happened since which would change its reasoning. >Censorship is censorship, irrespective of the source of the limitation. >Free expression is impossible in an environment of censorship. The problem with absolute statements like this is that they ignore important distinctions about scale - e.g., I think that it's very important that people, generally, be free to discuss whatever they want in private homes. But I also think it's very important that I be able to tell other people that they're not willing to discuss whatever they want in *my* home. Not because I'm especially excited about censorship, but because I enjoy my privacy and my peace & quiet. So on the level of national rights, yes, unrestricted speech is an excellent thing. But on the level of my living room, unrestricted speech is a very bad thing. I don't think anyone who is arguing that it's fine to throw Vulis off the list would make the argument that it would be acceptable for the government to throw Vulis off of the Internet. The closest thing I can see to a First Amendment argument against Gilmore is the "company town" argument, that the list is so much like a city or town that it ought to be subject to the restrictions that the First Amendment puts on municipalities and traditional public forums - but even this (rather far-out) argument got shot down a few days ago when our beloved Wallace of CyberPromo tried it in _Cyber Promotions v. America Online_. The judge said "no way", and I think that argument's a lot more plausible against American Online than against John Gilmore. >I have argued in the past that this list is a defacto public list because of >the way it is advertised and to the extent it is advertised. All the protests >by the operator to the contrary will not convince a court. I don't think this makes any sense. "Public list" has no special meaning. My impression is that you're trying to make an analogy to public places which are privately owned like motels and lunch counters and amusement parks, where the owners (despite being private actors) cannot discriminate on the basis of race, gender, national origin, etc. (See, e.g., Civil Rights Act of 1964, 42 USC 1981 et seq) But I don't think there's any especially credible allegation that Vulis was discriminated against on the basis of protected class membership; nor is it clear that the Civil Rights Act can be extended to the operation of mailing lists. (Can someone shed some light on this? I've spent some time reading civil rights cases and can't remember one which gets even close. But I hate to say "can't be done" on the basis of failing to remember a case where it has been done.) My hunch is that (especially with this Supreme Court) the First Amendment's right to speak and assemble freely would trump Congress' attempt (pursuant to the Fourteenth Amendment, Section V) to regulate the distribution of speech. If there's no prohibited discrimination (either because there's no prohibition, or there was no "discrimination" within the terms of the statute) then I don't see a cause of action. Wanting something you're not getting isn't enough. Owners of "public places" like malls or stores or restaurants are still free to exclude some people for non-prohibited reasons (like not meeting the dress code, or having behaved poorly in the past). And Vulis' behavior is certainly enough to suggest that his exclusion from the list (which has not impaired his ability to speak to the list) was neither arbitrary nor wrongly discriminatory. So I really don't think that a civil rights-flavored argument even gets to first base here. I am pretty disappointed to see that none of the people who profess to be shocked and wounded at Vulis' exclusion have bothered to set up your own lists. In my mind, whatever moral outrage you claim to have looks awfully small compared to the relatively small burden of doing something about what you say is bothering you. Someone said that saying "start your own list" is like saying "well, go start your own country"; but the difference is that you can only live in one place at a time, so starting your own country on some faraway island means severing personal and professional ties in the place that you live now, abandoning the countryside you've come to know and love, etc. But there's no reason that you can't start your own mailing list and stay on cypherpunks. As I pointed out a few days ago, you can even subscribe your list to the cypherpunks list, so that your list is "cypherpunks++". I think there are some copyright issues lurking here, but there are at least two filtered cypherpunks lists running, as well as Bob Hettinga's e-$pam list, which make use of cpunks traffic, and I'm not aware that any of those folks have attracted suits for their reproduction of list traffic. So I don't see any big obstacle to one or more people fixing what they say is a big problem. So I'm left to wonder if this really isn't the big deal people seem to enjoy making it into, or if it's a big deal, but free speech and lack of censorship is worth less than some time and/or some money to these folks. I think that "cypherpunks write code" can/should be understood as a question, e.g., "what are you doing to change the things that bother you?" -- Greg Broiles | "In this court, appellant and respondent are the gbroiles(a)netbox.com | same person. Each party has filed a brief." http://www.io.com/~gbroiles | Lodi v. Lodi, 173 Cal.App.3d 628, 219 Cal. | Rptr. 116 (3rd Dist, 1985)

2 1

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

On Wed, 6 Nov 1996, Bill Frantz wrote: > At 4:39 AM 11/6/96 -0500, Jim Ray wrote: > >Judge Kozinski wrote: > >> ... Perhaps the answer > >> is that the post office should not accept mail unless there > >> is a clear indication of who the sender is on the upper left > >> hand corner of the envelope. ... > > In the case of postal mail, return address forgery is so easy that anyone > who can address an envelope can figure it out. Requiring something > scribbled there certainly wouldn't help protect against anonymous mail. > You would have to couple it with "is a person" checks to ensure the person > posting it is the person referenced by the return address. Bye bye corner > post box. Yes the failure to forsee this did stand out a little in the discourse :).

1 0

Judge Patel Background
by ph＠netcom.com 17 Dec '03

17 Dec '03

Jim McCoy pointed me to an interesting book called "The Courage of Their Convictions" by Peter Irons. It just happens to reference Judge Patel. Fred Korematsu was a Japanese-American shipyard worker in the early 1940s. His fiancee was Caucasian. To stay with her, he evaded the concentration camps for two months, but was caught and convicted anyway. His conviction was not reversed until 1983 in the court of one Judge Patel. Page 48, "After hearing lawyers on both sides, Judge Marilyn Patel asked Fred Korematsu to address the court. `As long as my record stands in federal court,' he quietly stated, `any American citizen can be held in prison or concentration camps without a trial or hearing.' Ruling from the bench, Judge Patel labeled the government's position as `tantamount to a confession of error' and erased Fred's conviction from the court's records." (Judge Patel is presiding over Dan Bernstein's challenge to the ITAR.) (Full reference: Irons, Peter "The Courage of Their Convictions: Sixteen Americans Who Fought Their Way to the Supreme Court" New York: Penguin Books, 1990 ISBN 0 14 01.2810 7) Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:55 PM 11/7/1996, Timothy C. May wrote: > "Truly noisy sources" are not at all unusual. Actually, the hard part is > ever proving a source is _not_ noisy. (There are deep issues involving > randomness here, and I usually go into the work of Kolmogorov, Chaitin, and > others at this point. Consult the archives, or see a book on information > theory.) Truly, I am out of my depth. But, I will plunge ahead nonetheless. I think it is hard to show that a source is noise. Using only the signal itself, I believe it is impossible. That means there may be patterns which you cannot prove do not exist. That is surely less than ideal, especially if you are betting your life on it. And there are all sorts of ways you can blow your cover. Maybe your traffic patterns are sort of odd. Maybe you are up at odd hours. The weakness is stego does not have to be great before you are put on the suspect list. If cryptoanarchy is unpopular, you are in big trouble because the government can afford to watch you intensively. > The legal issue is this: can we pass laws and have them upheld by the > courts which impose severe penalties on people for the supposed crime of > having in their possession sequences of numbers which cannot be converted > to meaningful English sentences? I maintain that the Constitution says we > cannot. Of course, if the Constitution is thrown out, then the old > Cypherpunk joke may come into play: "Use a random number, go to jail." (An > Eric Hughes quote, from 1992-3.) What Tim May maintains may be more reasonable that what the Supreme Court maintains. But it's the Supreme Court that will rule. We have laws which state, in essence, that certain large numbers cannot be copied legally if they are related to copyrighted executables. >> In the model I am positing, there would be broad popular support for >> such policies. > I think you are assuming a lot. I think I am, too. I don't subscribe to the Four Horsemen scenario. Peter Hendrickson ph(a)netcom.com

1 0

Re: Excusing Judges for Knowing Too Much
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:54 AM 11/8/1996, Timothy C. May wrote: >At 8:20 AM -0500 11/8/96, Jim Ray wrote: >> been decided and appealed, because of this very possibility. I am already >> concerned that an ambitious U.S. Attorney, using Alta Vista, could attempt >> to argue that "cypherpunk terrorists have been secretly trying to subtly >> influence Kozinski's thinking, and that therefore he should be removed from >> the case in favor of some judge who has no clue whatsoever about the 'Net, >> encryption, anonymous remailers, etc." [I am sure the argument wouldn't be >> put quite that way <g> but that's what the U.S. Attorney would mean.] There >> is now a judge with some idea of these issues who will IMNSHO probably be >> fair to "our" side. It is a rare opportunity, and I don't want to "blow it." > A valid fear, given the times we live in. > If jurors can be dismissed for knowing "too much" about the O,J. > case--knowing how to _read_ ensures this--then we are probably > fast-approaching the point where judges are recused (or whatever the word > is) from hearing cases where they've had any education whatsover on. > (An exaggeration, of course.) This issue has been discussed recently by a prominent author. "The men who murdered Virginia's [The city in Nevada. -- ph] original twenty-six cemetary occupants were never punished. Why? Because Alfred the Great, when he invented trial by jury, and knew that he had admirably framed it to secure justice in his age of the world, was not aware that in the nineteenth century the condition of things would be so entirely changed that unless he rose from the grave and altered the jury plan to meet the emergency, it would prove the most ingenious and infallible agency for {\it defeating} justice that human wisdom could contrive. For how could he imagine that we simpletons would go on using his jury plan after circumstances had stripped it of its usefulness, any more than he could imagine that we would go no using his candle clock after we had invented chronometers? In his day news could not travel fast, and hence he could easily find a jury of honest, intelligent men who had not heard of the case they were called to try - but in our day of telegraph and newspapers his plan compels us to swear in juries composed of fools and rascals, because the system rigidly excludes honest men and men of brains. "I remember one of those sorrowful farces, in Virginia, which we call a jury trial. A noted desperado killed Mr. B, a good citizen, in the most wanton an cold-blooded way. Of course the papers were full of it, and all men capable of reading read about it. And of course all men not deaf and dumb an idiotic talked about it. A jury list was made out, and Mrs. B. L., a prominent banker and a valued citizen, was questioned precisely as he would have been questioned in any court in America: "`Have you heard of this homicide?' "`Yes.' "`Have you held conversations on the subject?' "`Yes.' "`Have you formed or expressed opinions about it?' "`Yes.' "`Have you read newspaper accounts of it?' "`Yes.' "`We do not want you.' "A minister, intelligent, esteemed, and greatly respected; a merchant of high character and known probity; a mining superintendent of intelligence and unblemished reputation; a quartz-mill owner of excellent standing, were all questioned in the same way, and all set aside. Each said the public talk and the newspaper reports had not so biased his mind but that sworn testimony would overthrow his previously formed opinions and enable him to render a verdict withou;t prejudice and in accordance with the facts. But of course such men could not be trusted with the case. Ignoramuses alone could mete out unsullied justice. "When the peremptory challenges were all exhausted, a jury of twelve men was empaneled - a jury who swore they had neither heard, read, talked about, nor expressed an opinion concerning a murder which the very cattle in the corrals, the Indians in the sagebrush, and the stones in the streets were cognizant of! It was a jury composed of two desperadoes, two low beerhouse politicians, three barkeepers, two ranchers who could not read, and three dull, stupid, human donkeys! It actually came out afterward that one of these latter thought that incest and arson were the same thing. "The verdict rendered by this jury was, Not Guilty. What else could one expect? "The jury system puts a ban upon intelligence and honest, and a premium upon ignorance, stupidity, and perjury. It is a shame that we must continue to use a worthless system because it was good a {/it thousand} years ago. In this age, when a gentleman of high social standing, intelligence, and probity swears that the testimony given under solmen oath will outweigh, with him, street talk and newspaper reports based on mere hearsay, he is worth a hundred jurymen who will swear to their own ignorance and stupidity, and justice would be far safer in his hands than theirs. Why could not the jury law be so altered as to give men of brains and honesty an equal chance with fools and miscreants? Is it right to show the present favoritism to one class of men and inflict a disability on another, in a land whose boast is that all its citizens are free and equal? I am a candidate for the legislature. I desire to tamper with the jury law. I wish to so alter it as to put a premium on intelligence and character, and close the jury box against idiots, blacklegs, and people who do not read newspapers. But no doubt I shall be defeated - every effort I make to save the country `misses fire.'" >From "Roughing It" by Mark Twain, Chapter XLVIII. Peter Hendrickson ph(a)netcom.com

2 1

Anonymous remailer client in Java
by Geoffrey KEATING 17 Dec '03

17 Dec '03

I have set up a Java client for type 1 anonymous remailers at <http://www.ozemail.com.au/~geoffk/anon/anon.html>. The client features a simple type-and-click interface, PGP encryption, automatic remailer chaining, and a 100% java implementation---no native code required. It has been tested under Netscape and Sun's AppletViewer on MacOS and Solaris. It will let you create simple reply blocks (those which don't encrypt the message). This is intended as a better way to post mail anonymously via the web (especially since Community ConneXion's https service seems to have shut down). Flaws: - Persons in the US will not be able to use it unless they have a license from RSA (which is unlikely). - It doesn't do Mixmaster remailers yet (but it will soon). - It can't actually send the mail if you're behind a firewall, but it will PGP encrypt a message for you to send. - It has to send all its mail via the HTTP server's machine because of applet security restrictions---you can fix this by making a local copy, or (if you're brave) giving it more permissions. The mail is encrypted from your machine, so this isn't insecure, just slow and a waste of bandwidth. Ideally, it would run from a web site on the same machine as an anonymous remailer, and use that as the first hop in the chain. If anyone (outside the US, of course) would be interested in setting this up, please e-mail me at the address below. Please CC any followups, as I am not presently subscribed to cypherpunks. -- Geoff Keating <geoffk(a)ozemail.com.au>

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:46 PM 11/7/1996, Mark M. wrote: >On Thu, 7 Nov 1996, Peter Hendrickson wrote: >> If mandatory GAK were imposed, reviewing messages is easy, even with >> inter-agency fighting. Or, encryption in general could just be >> forbidden if GAK created too much hassle. > > How would this be possible? The latest GAK proposal is for companies to store > keys instead of the government. There is the potential for colaboration > between a TLA and an "escrow" company. It is also possible for a TLA to > illegally obtain the keys from the company's database. However, it would > still be impossible to review every message. Even if the government had full > access to all encryption keys, it would still be technically infeasible to > review every message. The latest GAK proposal is not under discussion. What is under discussion is the policy options that are possible when there is strong public support to suppress strong cryptography. The Four Horsemen scenario would likely generate such mass support, even among cypherpunks. >> In practice I suspect that good stego is hard. You don't have to be >> right every time when you look for it, just some of the time. When >> you see packets that seem kind of funny to you, the judge issues you >> a warrant and you search the suspect's house and computer very carefully. >> If stego is in use, the software that generated it can be found. Then >> you hand out a life sentence. > Good stego is possible. Stegoing data in jpegs is very secure and probably > infeasible to detect. I am not convinced, but I am not expert in this area. > However, I find the life sentence idea pretty unrealistic. You are assuming > that there will be wide support for tough restrictions on crypto. This is > not currently the case and I doubt it would ever get to this point. Yes, I am assuming that the Four Horsemen scenario would stimulate strong public support for extraordinarily tough restrictions on crypto. Yes, I doubt it would ever get to this point because cryptoanarchy will be far less dramatic than many people believe. It may cause dramatic changes, but they will be subtle and gradual, like the Net's influence. For instance, I don't think Ruby Ridge would ever have been an issue raised in Congress if it hadn't been for the Internet. This is a subtle and positive change, but most people hardly noticed the effect of the Net. The way in which the agenda is set has moved out of New York and Washington. Strong cryptography promotes this because it enables people to discuss issues which are important to them without fear of retribution. > Not very many people are currently supporting any life sentence for anyone > who is in possession of explosives, despite the increase in terrorist > activity. Gun-control advocates aren't supporting laws that will give a life > sentence to anyone who owns a gun. Given that many people who believe in > gun-control and tagants in explosives are against GAK, why do you think there > will be such a revolt against strong crypto? I don't think that there will be a strong revolt against crypto. From the point of view of the GAKers that's a problem. That is why they have to act before the public discovers it's an asset, not a liability. But, if the GAKers are right about the Four Horsemen scenario (which I doubt they believe themselves) there would be great public support for drastic measures and these measures could be quite effective. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 8:48 PM 11/7/1996, Timothy C. May wrote: >At 7:20 PM -0800 11/7/96, Peter Hendrickson wrote: >... >> I cannot speak for the GAK advocates. However, you could establish a >> system where messages between two countries are encoded with keys >> which are made available to only the two countries in question. >> >> A really simple scheme to do this would be for each country to publish >> a public key. You would be required to encrypt the key to the message >> with the national public key. That scheme would be fast to deploy. > Well, this is not what the proposals for GAK involve. If it were _only_ a > matter of each country requiring GAK for communicatons entering its > country, then this would be as you describe (not that many of us would > approve of it). > What complicates matters is that the U.S. proposes that _it_ keep > records/escrows of communications with, say, recipients in Libya. Or > Russia, or Burma, or Tazbekinoya. This means automatically that simplistic > models ("encrypt to the public key of Tazbekinoya" will not be sufficient). The U.S. would have to concede this point, and it would be a likely one for it to concede. The reasonable Schelling point for inter-governmental relationships on this matter is for the each government to have access to whatever communications it likes within its borders but that the contents of communications between governments is shared. This could be set up exactly the same way tax treaties are set up now. Technically, this is not hard to do. For instance, I think PGP encrypts messages for multiple recipients by encrypting the same session key with each recipient's public key, and then attaching the same IDEA encrypted ciphertext: <Session Key with Alice's Public Key><Session Key with Bob's Public Key> <IDEA encrypted message> All GAK requires is that you also encrypt the session key with the government's key: <Session Key with Alice's Public Key><Session Key with Bob's Public Key> <Session Key with Eve's Public Key><IDEA encrypted message> For multiple government access to keys, you encrypt the session key with the foreign government's key, too: <Session Key with Alice's Public Key><Session Key with Bob's Public Key> <Session Key with Eve's Public Key><Session Key with Yvette's Public Key> <IDEA encrypted message> >> In a more complicated and secure scheme, you would be given a public key >> from each country that was unique for your communications at the same >> time you were granted your international communications license. The >> unique public key would be managed by a small group of people. This >> means that if it was ever compromised, most message traffic would be >> secure and those who were responsible would be easy to find. >> >> The only way you are at the mercy of the Libyans is if you do business >> in Libya. > No, I think you are missing the point. The issue about Libya is that the > GAK system must make decisions about when and under what conditions it > accedes to government wishes--for governments we may be hostile toward. > Or governments may be hostile toward us. Yes, there is a problem with uncooperative foreign governments who won't prosecute people who send in non-GAKed messages. So, we simply terminate communications with those countries. It's something the government wants to do anyway, so it's not a painful pill to swallow. > As I said in another message, I don't think there can be a unified GAK > policy. I believe the U.S. Administration hopes to browbeat enough nations > into compliance such that it--the U.S. government--controls which keys are > released and which are not. My point about "rogue" governments is that the > problems of Burma, Libya, etc. will not vanish. Clearly the U.S. government > will not settle for waiting for Libya or Burma to co-release keys.... The scheme I described above does not require co-release of keys. It may be the case that the USG is trying to pull a cypherpunk maneuver on other less sophisticated governments. That is, they are probably telling the other governments, "You've got a real problem here. You will be overthrown if you don't get our help fast with our sophisticated encryption technology! And if you don't let us help, you'll lose most favored nation status." By the time other policy makers figure out the implications of this, it will be too late. Sad for them, but good news for the U.S. consumer. > And nothing in GAK says one gets to communicate with Libyan parties by > encrypting with the public key of Libya, thus bypassing the U.S. decryption > capabilities! Nothing stops you from sending fully encrypted messages to Libya except your fear of social disgrace and a long prison term. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 4:43 PM 11/7/1996, Timothy C. May wrote: >At 2:24 PM -0800 11/7/96, Peter Hendrickson wrote: >>> If I understand the reasoning, people beleive it is easier to prevent the >>> release of strong crypto. techiniques than to remove them once they are >>> released. >> >> The reasons underlying this are what I don't completely understand. >> >>> Once a terrorist has strong crypto, why should they stop using it if it >>> becomes illegal? >> >> Use of strong crypto would be a tip off that one is a terrorist. >> >> If strong cryptography were unpopular and highly illegal, very few >> people would be using it. This makes it easy to identify suspects. > > * Identification of high-entropy traffic (putatively: encrypted traffic) > would require extensive surveillance, tapping, and whatnot. The > infrastructure for this does not exist, and would cost an enormous amount > to deploy. This could be financed by taxing routers, computers, modems, leased lines, and the like. The fraction of the total cost of communications equipment would be minimal. > * (This is why so many of us want a crackdown on crypto delayed for as long > as possible: every year that passes means more networks, more intranets, > more channels, more modes, etc. Satellites, fibers, etc.) But, in the face of near unanimous belief that strong cryptography must be stopped, this would not matter. Most of the operators of this equipment would be eager to help. > * High-entropy traffic does not mean encryption, either. And encrypted > traffic can be twiddled to look like lower-entropy traffic (and I don't > even mean steganography, I mean adjusting message statistics). I'm not sure I entirely understand this, but I am as skeptical of this as I am of reasonably high bandwidth stegonography operated over several years. I think this is a real hard problem, especially if 100% accuracy is not required. > * Once crypto has become widespread, and is built into mailers, browsers, > etc., there will be many people already using those old mailers and > browsers. Throwing Mom and Pop in jail because they forgot to turn off the > PGP mode in Eudora 4.0 or Netscape 5.0 is not going to go over well, even > in an era of supposed "zero-tolerance." (And California and Arizona just > voted to effectively decriminalize pot..."medical use of encryption" on the > 2005 ballot?) You are proposing a likely scenario: large numbers of people think there's nothing wrong with a little encryption now and then. But, that is not the scenario I am discussing. I am discussing the Four Horsemen scenario where terrible things are enabled by the wide deployment of strong cryptography. Most of us would accept greater surveillance and some restrictions of our liberties if we believed that our lives and fortunes were endangered. In this environment, you might have a three month grace period for people to change to legitimate tools. Then the police would probably practice a certain amount of discretion. If they catch Mom or Pop with a pre-ban crypto program, they'll bring them in and give them a good talking to, and then let them go. After a year or two you prosecute. Mom and Pop will get with the program. Violators will be seen as being quite irresponsible, regardless of age. > * Steganography. Entire volumes can be written about this. I believe I was > the first to propose, in a 1988-89 series of articles on sci.crypt, the use > of LSBs in image and sound files to transmit huge amounts of information, > with detection very difficult. As I told Kevin Kelley--reported in his > "Whole Earth Review" article and in his excellent "Out of Control" book--a > single DAT tape of a musical recording can easily carry 150-200 MB of > "message" just in the LSBs! I strongly suspect that there are patterns in how sensors function and in real tapes. They may be subtle. The government need not reveal any particular knowledge of these patterns. All they have to do is set up a series of labs, each of which is expert in one kind of known pattern. When studying a suspect's communications - or tape - the information gets passed through these labs. If any of the labs flags the data as suspicious, a search warrant is issued. The prosecution is then based on evidence that the search warrant turned up so the stego need never be introduced into court. > Unless all tapes are checked at the border--and what are live tapes, with > lots of noise in the bottom few bits of each word--to be compared against? > The mind boggles at the task. There's no reason why we have to allow live tapes to cross borders without some questioning and explanations. Iran did this for many years when they were trying to keep the Ayatollah's speeches out. It didn't work, of course, but it did not have popular support, either. > * "Legitimate needs." The whole notion Peter raises of banning cryptography > is fraught with problems. Are businesses to be told that all communications > are to be in the clear? Or is Peter's point that some form of GAK will be > used? My point is that the government can do whatever it needs to do if there is strong public support. If it is too expensive to decrypt even GAK'ed communications, then it may be made illegal to encrypt anything. I am inclined to think that even in the Four Horsemen scenario, the government would prefer GAK'ed communications because it gives them greater leverage. People speak more freely when they think not everybody can hear what they are saying. Somebody brought up the Catholic church's custom of confessionals a few weeks ago and suggested that it was a powerful political tool. (Sorry I can't remember who said this.) I am sure this is the case. The priests don't even have to break their vows of secrecy for this to be the case - they simply summarize the results. Had the early Christian custom of public confessional been followed, the Church would have had far less political power. Of course, once somebody has confessed deep secrets to you for years, they will be reluctant to push their luck to far when opposing you. > (If the latter, then of course we are back to an even better form of > "stego" than stego itself: superencrypt before using GAK. Unless the > government samples packets randomly and does what they say they will do to > open a GAKked packet--e.g., get a court order, go to the escrow key > holders, etc.--then how will they know if a message is superencrypted? And > what if a GAKked message contains conventional _codes_? Are shorthand codes > such as business have long used--"The rain in Rome is warm this month"--to > be illegal?) There is no reason at all to assume that the government will get warrants. For instance, maybe a warrant only applies to people and not to machines. So, the court could decide - if it were so inclined - that it was not a violation of the Bill of Rights to automatically scan messages for suspicious looking material so long as the material itself was not revealed without a warrant. Then the results obtained could be used to justify a warrant, reading of the material by human agents, and the further issue of more warrants. To make this convenient they could even keep a judge in the basement. > * The point being that "rogue crypto" (terrorists, crypto anarchists, > freedom fighters) gets lost on the blizzard of other uses. And shutting > down all crypto means shutting down business use of crypto to protect > secrets, and probably means an end to digital commerce. No, GAK does not mean an end to digital commerce or an end to secure business communications. It just means that you have to register with the government for a cryptography license which gives you a unique public key to use to encrypt your keys for the government's use. If the license costs $1000 for ten years that should cover the costs. Companies which are terribly worried about compromise of the government secret key could purchase many of them frequently to reduce the damage. (Earlier I said something about GAK harming Net commerce. It does, but not irreparably. It delays its onset and increases its cost.) > (This is another reason we want to delay action on crypto for as long as > possible: make encrypted communications so widespread in commerce that to > pull the plug would mean a financial calamity.) GAK does not require anybody to pull the plug. It could be implemented as an add-on to PGP with extraordinary ease. PGP (Tim knows this, this is for others) currently encrypts the session key with the recipients public key. You would just have to extend this to also encrypt the session key with the government key, maybe one you purchase for your own communications. > * Intent. It's hard to imagine someone being imprisoned for using > cryptography, except perhaps in wartime conditions. I may be wrong. Also, > there are deep Constitutional issues we haven't been much discussing. If the Four Horsemen scenario were correct, then it is easy to envision strong public support for the crime of practicing unlicensed cryptography. If I believed that I might get shot if we didn't have such restrictions, I would be might inclined to support such laws myself. The Constitution can be amended, and Judges tend to be compliant when there is a national consensus and when they want to make very sure that nobody is using Assassination Politics to put them in the crosshairs. > * Offshore sites. Even if U.S. citizen-units are proscribed from using > crypto--a hard thing to do--many crypto-anarchic markets will flourish > overseas. (If communication with offshore persons or sites is allowed, all > sorts of things can be done. If such communication is banned, this means a > profound change in the American system.) [I have not fleshed out the > arguments here, adequately, so don't focus on this point to rebut the rest > of my arguments, please.] Yes, I agree with this. In many other countries they are going to be simply too disorganized to outlaw strong crypto. If the Four Horsemen scenario is correct, these societies will dissolve into Hell. Sad, for them! The USG may see this as positive in terms of its hegemonic desires. But, this does affect the American situation. Strong border controls would have to be in place to hamper efforts to bring troublesome technologies here and to prevent the importation of assassins. > In another post, Peter posits a condition where people are appalled at the > implications of crypto and there is no popular support for it. But is he > implyiung that neighbors will burst into the homes of others to ferret out > crypto. I doubt this vigilantism will ever happen. I also doubt that it will happen because it will turn out that cryptoanarchy is basically a positive development. Even in the Four Horsemen scenario, I think it unlikely that vigilantism will be necessary. Neighbors will simply inform on their "nerdy" neighbors and collect that $50,000 reward and feel they did good by doing it. Search warrants will take care of the rest. However, I could imagine vigilantism developing if unlicensed cryptography became sufficiently unpopular. Certain crimes are seen as so offensive that many people would be delighted to take the law into their own hands. There was a border incident during the Second World War between Switzerland and Germany. Switzerland ("The Little Porcupine", as the Germans would have it) was attempting to stay out of the war. Refugees from Germany were returned if they were found. This resulted in some ugly handoff scenes at the border. In one of them, an SS man (I believe) who was taking custody of a family had the poor taste to throw a baby on the ground as hard as he could. The Swiss border guard expressed his disapproval of the man's poor manners by shooting him dead on the spot. This caused a major diplomatic crisis for Switzerland. It is interesting to speculate on whether the Swiss border guard did the right thing, but few people will fail to have a strong visceral reaction in his favor. People just don't like seeing children come to harm. If unlicensed cryptography were seen as an equivalently heinous crime, you might well see vigilantism come into the picture. > (My gun example is apropos. I believe we are fast approaching a point where > most people want guns outlawed. But it won't happen, as there are not > enough cops and military people willing to raid private homes in > contravention of the Bill of Rights and at personal risk to > themselves....and so it won't happen. I should point out that when I say "strong public support" I mean something on the scale of how people feel about murder, not 51% of the voters. The same thing is true of guns. Sure, a majority of the people might vote for gun control, but the gunnies feel so strongly about it and are so stubborn and so well organized that it isn't really worth the trouble. > Once crypto is deeply intertwined into the fabric of life and commerce, > it'll be too late to pull the plug. I think this is true, but only because it will be clear that the benefits of GAK (if there are any) would clearly not be worth the effort. Peter Hendrickson ph(a)netcom.com

2 1

Any additional information on Kata, TX. decision??
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Sombody posted some information about Child Protective Services interrogating children without parental permission, etc and the decision that followed being upheld in favor of the state. would you be so kind as to provide the entire available clip or a URL.

1 0

criminalizing crypto use
by Greg Broiles 17 Dec '03

17 Dec '03

At 04:43 PM 11/7/96 -0800, Tim May wrote: >* Intent. It's hard to imagine someone being imprisoned for using >cryptography, except perhaps in wartime conditions. I may be wrong. Also, >there are deep Constitutional issues we haven't been much discussing. One change I suspect we'll see sooner or later on the Federal side is an amendment of the Sentencing Guidelines to include an upward adjustment for the use of encryption to frustrate law enforcement efforts. This wouldn't be a conviction for using crypto, but would result in harsher penalties for people convicted of other crimes where they happened to use crypto in a way connected with the crime. (Keeping child porn or records of a forbidden business on an encrypted disk volume, using PGPfone to conspire across long distances, etc.) As an example, less than a year ago, Congress directed the Sentencing Commission (a sub-branch of the federal Judiciary) to amend the guidelines to enhance the penalties by at least two levels for using a computer to advertise or "ship" a visual depiction of child porn. Pub. L. 104-71, Sec. 2 (12/23/95). Sentences for felony and some misdemeanor convictions in Federal court are usually based upon a payoff matrix, where a crime is assigned a "base offense level" (higher levels indicate more serious crimes), which is then adjusted upwards for aggravating factors (like the use of a gun, or an elderly victim, or prior convictions) and mitigating factors (like admission of responsibility or cooperating with law enforcement) to arrive at a final score, which indicates a relatively narrow range of potential sentences. Adding an enhancement for crypto use seems like an easy way for legislators to "get tough on crypto" while avoiding Constitutional issues. (It also strikes me as pointless; I have yet to run across anyone who doesn't work in criminal law (or isn't in a federal pen) who seems to have any idea that the sentencing guidelines exist, much less take them into account when planning crimes. They're pretty complex.) I feel a little wary about saying this because I haven't heard anyone mention it before. I have no secret insider knowledge. But I think a step like this is probably transparent to the folks in the Justice Dept who work on computer crime and crypto stuff, so I'm probably not giving anyone any ideas. I hope not. Federal court is tough enough for defendants already. Folks who want to know more about the Sentencing Guidelines might take a look at <http://www.ussc.gov>. They've done a nice job of putting everything on the web, so you can scratch your head in puzzlement at home, instead of at the law library. Many states also use a similar system for sentencing in criminal cases, but they may not be crypto-savvy enough to think of adding extra penalties for crypto use. -- Greg Broiles | "In this court, appellant and respondent are the gbroiles(a)netbox.com | same person. Each party has filed a brief." http://www.io.com/~gbroiles | Lodi v. Lodi, 173 Cal.App.3d 628, 219 Cal. | Rptr. 116 (3rd Dist, 1985)

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:52 PM 11/7/1996, Huge Cajones Remailer wrote: > Look around at all the laws in a community that are unenforceable and > largely ignored by significant sections of the community. Taxes are a > classic with many people receiving cash and not declaring it..I suppose > you could say they just opt not to pay taxes while law abiders (to varying > degrees) opt in to pay tax. I agree. It would be necessary to marshal widespread public support to eliminate strong crypto. If the Four Horsemen scenario is available, this support would be available. > It is estimated here where all dogs, for example, are required to be > registered, that only 40 percent are in fact registered (ie pay the dog > tax). The authorities simply do not, with their current technology, have > the ability or political will to break down everyone's front door and > complete house to house dog searches then deal with court cases and bring > eveidence as to the actual owner of the animal where this is a relevant > matter to be proved. Sure, it's not really worth the effort. How much effort will you go to prevent your children from being kidnapped? > Consider the difficulty of actually outlawing say PGP and making it > stick. To ban its use on a network compliance measures such as routine > traffic scanning would be implimented. So users may say resort to direct > modem to modem systems thus forcing authorities to routinely tap > telephone calls, identify modem calls, and analyse these calls. The > authorities start to use scarce resources provided by those members of > the public that choose to pay taxes to them. In the case of a largely compliant public, this isn't all that expensive. > The authorities have to spend even more resources on publicity and scams > to align privacy advocates with terrorists. Some privacy advocates may > even become terrorists who before didn't really care for such tactics. This is a highly likely scenario. But in the scenarios proposed by the GAKers, even the privacy advocates would be reluctant to defend crypto. > Assume the snail mail route is effectively sqaushed what then? Well you > could voice call your friend and read the encyphered text to them over > the phone and they could then run it through pgp and decrypt it. If the > authorities effectively made this too costly (in terms of risk etc) then > you could always just jump on a plane and tell them the message > personally or send someone else to do that for you. Gee, I hope you don't have to send many messages if you have to travel across the country to deliver them. How will you operate an anonymous business this way? It doesn't sound like cryptoanarchy to mean. > The costs of compliance increase as the authorities take measures to put > the genie back in the bottle. Stealth versions of popular programs get > released, and further technological advances are made so that the problem > becomes greater with respect to compliance as do the costs to the > taxpayer of ensuring compliance. Encrypted data that cannot be easily > distinguished form noise would require routine analysis and attempted > cracking of every bit of data transmitted..a task that would soon bring > even the great US economy to its knees assuming the people didn't put a > stop to the madness before it reached that point. I think people probably would put a stop to the madness. But, under the Four Horsemen scenario, most people, even Mr. Huge Cajones Remailer, would not consider it to be madness. > Just as an aside, I am sure the various spook angencies in the 'free > world' are well aware of these issues and no doubt other issues I have > not imagined and such considerations have played a part in so far stalling > an outright ban on the use of effective encryption programs and devices. This is interesting. I would be quite interested to see real evidence that various spook agencies have been foot dragging on the GAKers plans. > There are always costs to a government in the reduction in freedoms, and > the ultimate cost to any particular government is that it may stir the > beast so much that it awakens and takes away that governments authority > whether by democratic means or otherwise. Yes, this is correct. Peter Hendrickson ph(a)netcom.com

1 0

Re: Blocking addresses by default
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>> With remailer abuse becoming more popular and remailers going down >> because of complaints, there seems to be some interest in remailer >> software that will block all email by default and will only pass >> along email that is explicitly unblocked. Rich wrote: >I think this threatens serious security problems for the remailer >network in two ways: >1. You'd create a list of people interested in anonymous information, > which could potentially be obtained by police or other armed thugs. >2. The traffic would go down so substantially that traffic analysis > would be trivial. Yeah. If you keep a centralized list, it's too risky. I've been thinking about how to implement a related approach - when the mailer receives anonymous mail for you, it sends a message saying Subject: Anonymous message #<cookie> Hi! You've got an anonymous message! Here's how to retrieve it / block future messages / accept all future.... <disclaimers, explanations, etc.> and you can send back the cookie to retrieve the message. Blocking or accepting also using the cookie, to reduce denial-of-service and spam attacks. This approach is primarily useful for terminal remailers, but if you set up the syntax carefully, you can get the things to relay to each other. It's not particularly useful for posting news, though. Since it is good for terminal remailers, that may make it less hassle to run them. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

Re: Why is cryptoanarchy irreversible?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

To a large extent, it's a volume question - if there's too much widespread use, it's too hard to control, prevent, or ban later. If the volumes of traffic and users are low, you can track users. So the government's working hard to keep volume down, both by export controls, FUD attacks on Phil, and constant offers to deal, such as Clipper I, II, III, and IV, all of which both delay widespread use of real crypto and try to introduce pre-wiretapped crypto instead. Strong vs. weak crypto isn't the real issue - for most business use, weak crypto is obviously unacceptable, but strong crypto with GAK is ok as long as it doesn't interfere with use (and as long as the government bureaucrats don't sell too many keys.) After all, any corporation, and most businesses, can be forced to keep and produce records when the government wants them to; a government-held master key doesn't change their "legitimate" access, only the convenience of legal and illegal access. Key Recovery, on the other hand, implies that you're required to either use GAK or use Weak Crypto, which is obviously Bad. Most businesses are far more opposed to things that make them wait for bureaucratic action in their day-to-day business than to the privacy issues, and they're more concerned about control and convenience than the economic rights issues (otherwise they'd be refusing to pay taxes....) The government might be able to stop new Netscape versions from using strong crypto - threatening to confiscate the company's ill-gotten gains from aiding and abetting money launderers might help, and threatening to confiscate PCs that use unapproved crypto. But it's tough to use a widespread threat like that on popular software once it's out there. A friend of mine lives in a kleptocracy; the local thugs haven't stolen his email provider's computer yet, mainly because the hardware doesn't work very well without software and administrators. But he's not willing to risk using PGP very often, because the volume is small enough they can watch everything (they give him enough trouble occasionally for using his native language on the phone instead of the local languages.) And sending stego isn't likely to be a good solution for a while, since mail volume is low enough to his remote area that sending lots of scanned photographs would be a big impact on email costs. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

WinKrypt
by John Young 17 Dec '03

17 Dec '03

"WinKrypt's marriage of highly sophisticated technology -- such as the advanced, not-for- export 256-bit GOST encryption algorithm contained in the KeyMail program -- with a user-friendly interface virtually redefines the PC security category," said Syncronys. http://www.syncronys.com.

1 0

Need a new word for non-violent-censorship
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I often have the same difficulty when speaking with Objectivists. They define "censorship" as "silencing the speaker by force", which is a fine and useful definition, but suppose we want to talk about a similar phenomenon which does not involve force? For example, the magnate who owns all the newspapers, television stations, bookstores and movie theatres in a small town decides that never again will homosexuality be publically mentioned in any of these venues. Force? No. "Censorship"? Not by _that_ definition, but what _is_ it? We need a new word, or else we have to continue using "censorship" to mean both of those things. I sometimes use "violent-censorship" and "non-violent-censorship" in conversation. As long as we continue to try to overload "censorship" we will waste much of our dialogue energy on semantic quibbling or pure misunderstanding. Regards, Zooko -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMoMarEjbHy8sKZitAQGzZQL+OuobcXVKg8bU1FIgdIZl/0i2QZ/5McmC W//HUMtT+5D4sejWstVqkk2taB+jD9ctyKtgFIjIXOJdddsAAbd/Tbjr0TjuCMC4 FmagUDtrDD3tQOwiIXnb2rDit+GrfGPB =X6N3 -----END PGP SIGNATURE-----

3 2

Re: Why is cryptoanarchy irreversible?
by jim bell 17 Dec '03

17 Dec '03

At 06:25 PM 11/7/96 -0800, Peter Hendrickson wrote: >At 5:12 PM 11/7/1996, jim bell wrote: >> BTW, some of your confusion is probably based is the false assumptions in >> your last sentence above. "..wide use of strong cryptography results in >> widely unpopular activities such as sarin attacks and political >> assassinations." > >No, you're confused, but it's probably my fault. We don't really know >what cryptoanarchy will be like. We all have ideas about it. Some >we share and some we don't. But we won't really know until we see it >happen. Well, uh, with all due respect, but while it's obviously true that we won't know EXACTLY how it'll be, that doesn't mean that no portion of we imagine will come true. This is particularly true on the big issues. For example, you hypothesized that "wide use of strong cryptography resuts in widely unpopular activities such as sarin attacks and political activities. I pointed out, almost certainly correctly, that these are wrong: 1. To believe that use in cryptography will result in greater numbers of random attacks on innocent civilians. As I pointed out, the exact opposite should be true: A greater ability to target the guilty means less reason to kill the innocent. 2. To believe that political assassination will be unpopular even if the ordinary citizen has an effective say in who's going to die. In other words, based on my understanding these beliefs are diametrically opposed to the truth. Not simply a difference in extent, we're talking a 180-degree change. Your response is a sheepish, "but we won't really know until we see it happen." Harrumph! >My whole point is based on the proposition that the doomsayers are right. Which doomsayers? What version of "doom"? >I believe D. Denning has suggested that cryptoanarchy will result in >the breakdown of our society. I suppose that depends a lot on what a person means by the phrase, "our society." Used as you (and maybe she, as well) this sounds like a code-word. To a statist, "society" is basically the stratification system that has developed to let one group of people control another. By that standard, cryptoanarchy WILL "result in the breakdown of our society." But that's all for the good. Jim Bell jimbell(a)pacifier.com

2 1

Return address forgery [was Judge Kozinski...]
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Fri Nov 08 20:20:02 1996 The Bovine remailer wrote: > On Wed, 6 Nov 1996, Bill Frantz wrote: > > > At 4:39 AM 11/6/96 -0500, Jim Ray wrote: > > >Judge Kozinski wrote: > > >> ... Perhaps the answer > > >> is that the post office should not accept mail unless there > > >> is a clear indication of who the sender is [...] > > In the case of postal mail, return address forgery is so easy [...] > Yes the failure to forsee this did stand out a little in the discourse > :). Well, in the judge's defense, note that he used the word "perhaps" above. I like this judge, which (obviously) isn't something I can say about too many judges...I think he was just trying to sharpen our thoughts and arguments, and that he DOES agree with us on many, many things. His fears about the misuse of anonymity in a police state, for example, come from his personal experience in a former socialist paradise. I think (hope) that being exposed to "cypherpunk issues" by as many good thinkers as he was, in a relaxed, non-courtroom setting, has broadened his understanding of the many issues involved and will help "our" side immensely if these same issues ever do come before him. I have decided, however, to cease my very enjoyable conversation with him about these issues, from now until after Judge Patel's Bernstein case has been decided and appealed, because of this very possibility. I am already concerned that an ambitious U.S. Attorney, using Alta Vista, could attempt to argue that "cypherpunk terrorists have been secretly trying to subtly influence Kozinski's thinking, and that therefore he should be removed from the case in favor of some judge who has no clue whatsoever about the 'Net, encryption, anonymous remailers, etc." [I am sure the argument wouldn't be put quite that way <g> but that's what the U.S. Attorney would mean.] There is now a judge with some idea of these issues who will IMNSHO probably be fair to "our" side. It is a rare opportunity, and I don't want to "blow it." JMR Please note new 2000bit PGPkey & new address <jmr(a)shopmiami.com> This key will be valid through election day 2000. PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 Please avoid using old 1024bit PGPkey E9BD6D35 anymore. Thanks. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMoPcRjUhsGSn1j2pAQHtVAfPd+F3jXHov9TgaZJSsKNcfi0dn30K9Dgs 2PQwFFLp8UuHFQGybBdorw4V9DQuGTehLVuiBttKdbBZYWVMhWv/TptZ+sagbexO EX0TrcD8gU3dtSK9xLH94TO8YMY5U/sk/8LIC1Q4cehXiZ3MOK/yxxR7V8uooJuI 6g4+HSxUOU2CBPIfYyHjzALxYkjn2/YYjo8VdFbxE7fRnjycnvr+qn2l70az4nnx E2l9qvXJYgNiEhSQVk4o3b+hlybCuFA1jtNLnkHa1qYQz2xP7xoF6QiDcscl4Jev HVQfUg52JyxS6DxsZ8K9/64aUlJWAXZYZbg4bn80OV4ETg== =gQWe -----END PGP SIGNATURE-----

3 2

So there's a cypherpunks newsgroup? mail.cypherpunks
by nobody＠replay.com 17 Dec '03

17 Dec '03

1 0

Re: Why is cryptoanarchy irreversible?
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 17:12 1996-11-07 -0800, jim bell wrote: >Simple analogy: Suppose you put two people into a room with a deck of >playing cards and a table, instructing "Person A" to build a house-of-cards, >and telling "Person B" to stop him from achieving his goal. Who do you >think will win? Obviously, the latter will win: It's vastly easier to >knock such a structure down than to build it in the first place, and all >"Person B" has to do is occasionally take a whack at the structure. What if Person A is better armed? Could that change the outcome?

2 1

Re: [rant] Race
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Thu, 7 Nov 1996 18:15:17 -0800 (PST) > To: cypherpunks(a)toad.com > From: Sean Roach <roach_s(a)alph.swosu.edu> > Subject: [rant] Race Sean Roach wrote: > Sandy Sandfort wrote: >> ... >> >What you mean WE, white man? ... > At first I was afraid to comment, as I have been more than vocal in the last > 24 hours, but then I decided that I thought this important enough to bring up. > This was the first time on this list that I noticed such an obvious > reference to race, granted I'm fairly new to the list,(quite new in fact), > and when I think about it, there were several references to Russians and > Jews in some of the other posts about Dr. Vulis and his practices. [...] I think Sandy is actually refering to an old joke: ------------------------- The Lone Ranger and Tonto found themselves cornered in a box canyon by 1,000 Apache braves, all screaming for the LR's blood after he had [grossly offended them in some arbitrary way]. As the Redskins approached from all directions, arrows and tomahawks struck the bodies of Silver and Scout, behind which the two brave vigilantes had taken cover. Suddenly, the Lone Ranger ran out of ammunition (silver bullets are expensive). Turning to his faithful Native AmerIndian companion, the LR saw that Tonto, too, was down to his last bullet. With tears staining his mask, he said: "Well, old friend, it looks like this is it - I don't see any way we can get out of here alive." Tonto looked back at his mentor and master of so many years, deep in thought, and came to a decision. Reaching into his shirt he produced an eagle feather. Sticking this in his hair, he leveled his gun at the Lone Ranger, and said: "What's this 'we' bit, White Man?" --------------------------- ObCrypto: Is it true that "Kemo Sabe" is Abanake for "Horse's Ass"? Peter Trei trei(a)process.com Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

Universal Service for the Net: Why it's a bad idea
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 8 Nov 1996 07:53:05 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Universal Service for the Net: Why it's a bad idea Yesterday I spent one of the most interminably boring afternoons of my life in a cramped and sweaty eighth-floor conference room at the FCC. The occasion? A special panel was announcing its recommendations to the FCC on a new universal service plan, as required by the 1996 Telecommunications Act. The problem was that the Federal-State Joint Board hadn't reached a decision by the time the hearing was due to begin at 1 pm. Nor had they at 2 pm. Or an hour later. In a conference room down the hall, the eight-person board were sweating even more than we were. They wanted consensus. Eventually the meeting began, closer to 4 pm. The board's unanimous recommendation: The creation of a $2.25 billion universal service fund to subsidize schools' Net-connections. The subsidy will range from 20 percent to 90 percent and will be tied to how many kids get tax-subsidized school lunches at each school. The cost will be paid for by "telecommunications carriers," meaning higher phone bills for consumers. (Of course, the FCC's Reed Hundt tried to duck this question, but other panel mambers clarified.) The FCC will vote on this proposal early next year -- and since Chairman Hundt was on the panel, approval seems almost certain. I happen to think this is a bad idea, but saying so publicly almost inevitably results in charges of elitism, "information have-nots," or being indifferent to the needs of our children. Opposing the CDA also left one open to similar charges: soft on porn, high on anarchy, or indifferent to the needs of our children. (I'm starting to believe that more evil can be done in the name of "protecting our children" than with any other excuse.) But just as there are real arguments against the CDA that don't rely on overheated "protecting children" rhetoric, so there are real arguments against this universal service scheme: * With more government intervention almost inevitably comes more control. I can hear it now from family values activists: "My tax dollars are going to pay for porn on the Net!" * Why should a Beverly Hills high school get a discount of 20 percent? Can't they afford to pay for ISDN? * Ironically, the same White House that is pushing this plan to wire schools to the Net is also pushing Bruce Lehman's "NII copyright bill" that will shut the door on schools' ability to _use_ information on the Net. Schizophrenic kowtowing to too many special interests? You decide. * The American Library Association has fought the good fight on free expression issues (as in the second CDA suit, ALA v. DoJ) and on the copyright bill. Yet in this matter, they're the ones pushing for this universal service scheme. Clearly, alliances shift. * With increased taxation of telecom industries -- taxes that could increase constantly at the whim of the FCC -- investors will be wary and money will shift elsewhere. If this happens, it will damage the ability of firms to improve our nation's telecom infrastructure. * Does every student have a _right_ to be online -- that should be paid for by tax dollars -- or is it a _privilege_ that should be paid for by other means? * This implementation of universal service is based on a knee-jerk fear of Internet "haves and have-nots." That's unrealistic. New technologies takes time to filter through a society. The joint board's position ignores history; flush toilets and cars took decades to spread. * Why should universal service be a priority, before books and roofs for our schools? Dozens of schools in the nation's capital were blocked from opening because of, I recall, fire code violations and even non-working bathrooms. If the Clinton administration _truly and honestly_ wants to help children, the president has to look no further than the District's own school system. Don't get me wrong. I agree with the end goal, which is to get kids online. But I can't stomach the Clinton administration's means to that end. -Declan

1 0

Re: [NOISE] If the shoe fits, wear it [VULIS]
by Thomas C. Allard 17 Dec '03

17 Dec '03

Rich Graves <rcgraves(a)ix.netcom.com> said: > networks(a)vir.com wrote: > > The nature of the Internet means it is extremely difficult for John > > to prevent Dr. Vulis from either posting using a pseudonym or having > > messages forwarded to him. IF it were possible to prevent Vulis > > from either reading messages or posting do you think John would have > > done that too? Just curious. > > I think that gets into "how many angels can dance on the head of a > pin" territory, because it just isn't, and I certainly don't speak > for him. But... What if John didn't prevent him "suvscribing", but instead directed his software to simply send messages from Vulis back to him as though they were sent to the list, but in fact did not forward his messages to the rest of the list. Vulis would continue to (spit) and (fart) on the list, would assume everyone else saw it, but would not see any replies to his spew. His remailer (spits) would still get through, but think how much less noise there would be. Alternatively, he could just moderate the list and not forward his rantings at all. LOTS more work, but still feasible. All I'm saying is that it *is* possible for John to censor Vulis from this list if he was so inclined. rgds-- TA (tallard(a)frb.gov) I don't speak for the Federal Reserve Board, it doesn't speak for me. pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D

2 1

Re: Return address forgery [was Judge Kozinski...]
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

> Well, in the judge's defense, note that he used the word "perhaps" above. I > like this judge, which (obviously) isn't something I can say about too many > judges...I think he was just trying to sharpen our thoughts and arguments, > and that he DOES agree with us on many, many things. His fears about the > misuse of anonymity in a police state, for example, come from his personal > experience in a former socialist paradise. I think (hope) that being exposed > to "cypherpunk issues" by as many good thinkers as he was, in a relaxed, > non-courtroom setting, has broadened his understanding of the many issues > involved and will help "our" side immensely if these same issues ever do > come before him. Jim, Thank you for doing this. I went to Law School to bring a viewpoint to the bench that was never there. I do so whenever I can. What you are doing is a very important part of moving this country forward. I understand the people who [RANT] about the problems we face, but when people like you hold a civil discourse with officials we overcome the label of extremists. > > I have decided, however, to cease my very enjoyable conversation with him > about these issues, from now until after Judge Patel's Bernstein case has > been decided and appealed, because of this very possibility. I am already > concerned that an ambitious U.S. Attorney, using Alta Vista, could attempt > to argue that "cypherpunk terrorists have been secretly trying to subtly > influence Kozinski's thinking, and that therefore he should be removed from > the case in favor of some judge who has no clue whatsoever about the 'Net, > encryption, anonymous remailers, etc." [I am sure the argument wouldn't be > put quite that way <g> but that's what the U.S. Attorney would mean.] There > is now a judge with some idea of these issues who will IMNSHO probably be > fair to "our" side. It is a rare opportunity, and I don't want to "blow it." Once again, thank you for all you are doing. > JMR > > > Please note new 2000bit PGPkey & new address <jmr(a)shopmiami.com> > This key will be valid through election day 2000. > PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 > Please avoid using old 1024bit PGPkey E9BD6D35 anymore. Thanks. Matt -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzDq+FoAAAEEANM9+JcJmUp4aCSGpdOG4Y1b6m4630XA8H41Utbvr7Tr6wEH CD6tlxZ+k+Pycj4w/f8WQa8fC50skoLjUNeP4lYsR7NYaMGRp6WkqCLMI/3Nohvk pfLDqnzZZdwVL2liB7mfTURoF6doQaVehHmMBjSaVTfD12tzNGm6VvyEc77JAAUR tClNYXR0aGV3IEouIE1pc3pld3NraSA8bWptaXNraUBleGVjcGMuY29tPg== =lkx1 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 12:29 AM 11/8/1996, Jim McCoy wrote: >Peter Hendrickson writes: >[...] >>> Get a warrant, search my system, find nothing but a bunch of applications >>> and a collection of risque (but definitely legal) pictures which I exchange >>> with a few friends. You may suspect that when the images are concatenated >>> in a particular way the low-order bits form a stego filesystem but no one >>> will be able to prove it in court. >> Are you concatenating these images by hand? If so, the level of entropy >> is probably low enough to recover the information through brute force >> methods or you are hiding a very small amount of information. > I hide the relatively small amount of data within a very large amount of > data which makes it impossible to find. Data from analog sources, like > the "real world" (images, sounds, etc) is noisy. This is a fact of life. > Because this data is noisy I can hide information in the noise. As long > as the information I am hiding maintains the same statistical properties > of noise it is impossible to pull the information out of the data file unless > you have the key. If I am paranoid enough I can make this key impossible > to discover without a breakthrough in factoring. Where will you keep your secret key? Remember, when they go through your house they bring 20 young graduates from MIT who are just dying to show how clever they are and save the world at the same time. > This is the essence of steganography and the nature of signal and noise are > fundemental principles of information theory. The concept of noise is not all that well defined, however. There is no way to look at a signal and say "this is all noise." Sometimes physical theories may lead you to believe that it is all noise. That is fine for many applications, but when becomes less convinced of things if the consequences are severe. >> If you are not doing it by hand, you own terrorist software and will pay >> the price. > Ah yes, terrorist programs like cat and perl and operating systems like > Linux which contain a loopback filesystem that I can hook a perl > interpreter into at compile-time (which is enough for me to rewrite the > program from scratch each time if necessary, unless things like math > libraries are also outlawed on computers :) I think that the crypto > concentration camps are going to be very crowded places. Can you elaborate on this? I am curious to know exactly what you are going to keep in your head and what goes on the disk. Please post the Perl code that you would type in from scratch every time. Peter Hendrickson ph(a)netcom.com

6 7

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 12:01 AM 11/8/1996, Timothy C. May wrote: > I don't believe it is as easy to differentiate between unencrypted and > encrypted traffic as Peter believes, and I definitely don't believe the > United States could stand--in the form it is in now, Consitutionally--if > forms of language and speech were to be banned and violators of the ban > were to receive harsh treatments. Maybe we don't differentiate between traffic. Maybe we work on tempest attacks. Think about this right now - do you know for sure that nobody is lurking in a van down the road with eavesdropping equipment? Do you know for sure that nobody is renting a room from one of your neighbors for all the equipment? If cryptoanarchy is unpopular, once you are a suspect - and are "guilty" - it is all over for your career as a cryptoanarchist. What are the benefits of being a cryptoanarchist? Maybe you get to double your income. Most people won't see this as worth the trouble. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 3:51 AM 11/8/1996, jim bell wrote: >At 06:25 PM 11/7/96 -0800, Peter Hendrickson wrote: >>At 5:12 PM 11/7/1996, jim bell wrote: >>> BTW, some of your confusion is probably based is the false assumptions in >>> your last sentence above. "..wide use of strong cryptography results in >>> widely unpopular activities such as sarin attacks and political >>> assassinations." >> No, you're confused, but it's probably my fault. We don't really know >> what cryptoanarchy will be like. We all have ideas about it. Some >> we share and some we don't. But we won't really know until we see it >> happen. > Well, uh, with all due respect, but while it's obviously true that we won't > know EXACTLY how it'll be, that doesn't mean that no portion of we imagine > will come true. At last some respect! (I agree with your point.) > This is particularly true on the big issues. For example, you hypothesized > that "wide use of strong cryptography resuts in widely unpopular activities > such as sarin attacks and political activities. I pointed out, almost > certainly correctly, that these are wrong: Yes, I think they are probably wrong. But, not everybody shares our view. Some people claim that we should not be allowed to communicate privately because of the terrible things that would happen if cryptoanarchy were to develop. But, these people want to make it illegal now (a big hassle) long before it is clear that we are going to have these problems. Imagine for a moment that LSD was just invented. Somebody then pointed out that it was possible to randomly dose people without their knowledge. The amounts required are virtually indetectible until it is too late. This is certainly possible, but in practice it almost never happens. I can only think of one incident I have heard about where somebody took a recreational drug involuntarily, and that was an accident. A lot of the things we talk about are that way. If they are not, it is entirely possible to put a stop to them, should there be broad popular support to do so. > 1. To believe that use in cryptography will result in greater numbers of > random attacks on innocent civilians. As I pointed out, the exact opposite > should be true: A greater ability to target the guilty means less reason to > kill the innocent. I imagine the guilty will never figure out that a pre-emptive attack on the innocent would be advisable. > 2. To believe that political assassination will be unpopular even if the > ordinary citizen has an effective say in who's going to die. Why don't you take an off-list poll of core cypherpunks and see how many of them share your view? I suspect not many. If not even cypherpunks are open to the idea, how many voters will be? > In other words, based on my understanding these beliefs are diametrically > opposed to the truth. Not simply a difference in extent, we're talking a > 180-degree change. > Your response is a sheepish, "but we won't really know until we see it > happen." Harrumph! What happened to my "all due respect"? ;-) >> My whole point is based on the proposition that the doomsayers are right. > Which doomsayers? What version of "doom"? Take a look at this essay by D. Denning: http://www.cosc.georgetown.edu/~denning/crypto/Future.html Denning writes: > A few years ago, the phrase crypto anarchy was coined to suggest the > impending arrival of a Brave New World in which governments, as we > know them, have crumbled, disappeared, and been replaced by virtual > communities of individuals doing as they wish without interference. > Proponents argue that crypto anarchy is the inevitable -- and highly > desirable -- outcome of the release of public key cryptography into > the world. With this technology, they say, it will be impossible for > governments to control information, compile dossiers, conduct > wiretaps, regulate economic arrangements, and even collect taxes. > Individuals will be liberated from coercion by their physical > neighbors and by governments. This view has been argued recently by > Tim May [1]. > Behind the anarchists' vision is a belief that a guarantee of > absolute privacy and anonymous transactions would make for a civil > society based on a libertarian free market. They ally themselves > with Jefferson and Hayek who would be horrified at the suggestion > that a society with no government control would be either civil or > free. Adam Ferguson once said "Liberty or Freedom is not, as the > origin of the name may seem to imply, an exemption from all > restraints, but rather the most effectual applications of every just > restraint to all members of a free society whether they be > magistrates or subjects." Hayek opens The Fatal Conceit, The Errors > of Socialism (The University of Chicago Press, 1988, ed. W.W. > Bartley III) with Ferguson's quote. > Although May limply asserts that anarchy does not mean lawlessness > and social disorder, the absence of government would lead to exactly > these states of chaos. Leaving aside Denning's snide (and evasive) remark about Tim, if her assessment of cryptoanarchy is correct, that will become clear in due time. There is no reason at all to think that it cannot be rolled back in the unlikely event that a disaster results. I would comment parenthetically that Denning's understanding of Jefferson is limited. Jefferson once said he preferred a free press to government. Jefferson once said that he thought a revolution every twenty years was healthy for a society. Jefferson was an accomplished mathematician. Jefferson invented a pretty good cipher. Jefferson was a cypherpunk to the marrow! >> I believe D. Denning has suggested that cryptoanarchy will result in >> the breakdown of our society. > I suppose that depends a lot on what a person means by the phrase, "our > society." Used as you (and maybe she, as well) this sounds like a > code-word. To a statist, "society" is basically the stratification system > that has developed to let one group of people control another. By that > standard, cryptoanarchy WILL "result in the breakdown of our society." But > that's all for the good. While I may not have paraphrased Denning and her (few) cohorts as accurately as I would have liked, I think your question is better directed towards them. Presumably when Denning says "social disorder" she is not thinking of disorderly relationships such as choosing your own job, or friends, or spouse, or whatever. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 12:58 AM 11/8/1996, stewarts(a)ix.netcom.com wrote: > Strong vs. weak crypto isn't the real issue - for most business use, > weak crypto is obviously unacceptable, but strong crypto with GAK > is ok as long as it doesn't interfere with use (and as long as the > government bureaucrats don't sell too many keys.) We often say that the government is a security weak point and that this makes GAK impractical. However, this is not true. If the holders of the government keys were individually responsible for their release, they would not be released very often. That is, in order to use cryptography you must purchase an expensive encryption license. That pays the salary of a certified "key escrow agent" who is the only person who can decrypt your messages. What stops him from revealing your keys to unauthorized parties? It's his business. If that's not enough, you back it up with criminal penalties for disclosure. And, hiring this person is no different from hiring an employee for your company. There are already similar activities. Lawyers are nominally employees of the state. Employees of Swiss banks can go to jail for violating their secrecy laws. > The government might be able to stop new Netscape versions from > using strong crypto - threatening to confiscate the company's > ill-gotten gains from aiding and abetting money launderers might help, > and threatening to confiscate PCs that use unapproved crypto. > But it's tough to use a widespread threat like that on popular > software once it's out there. I agree, if the software is popular. But, if the fears of the GAKers and the dreams of certain cypherpunks are real, such software will not be popular. Peter Hendrickson ph(a)netcom.com

1 0

His and Her Anarchies
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Copyright c 1996, The Globe and Mail Company r U.S. election reveals his and her politics Educated women have different agenda By Graham Fraser Washington Bureau WASHINGTON - Bill Clinton's re-election has shone a spotlight on a widening difference in views between men and women in the United States, particularly among those with a university education. "Men and women, if college educated, agree about very little," Celinda Lake, a Democratic pollster, told a conference organized by the Brookings Institution yesterday. "Men and women would have elected a different president, a different Senate, and a different House of Representatives," Ms. Lake said. She pointed out that "men and women are coming to some pretty different conclusions" about the role of government and the importance of social programs. Polling has shown that women believe the government can play a positive role in solving social problems, while men feel that government is a problem, and that it is a good day when they have not been hurt by it, Ms. Lake said. "On our side of the aisle, we're beginning to wonder what a college education does for a man," she said. ... http://web.theglobeandmail.com/web/cgi-bin/ DisplayPage?SITE=web&KEY=961108.GlobeFront.UGUYSM

1 0

[NOISE] A modest :-) proposal
by Derek Bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To make things more crypto-relevant, I suggest a new source of noise should be analysed for crypto-security: this list. Of course, this should be done with an *un*filtered version of the list as filtering decreases noise. Derek http://www.maths.tcd.ie/~dbell/key.asc <- my public key available here -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAgUBMoNp+FXdSMogwMcZAQFt3gP/WzfxzkOvc7gcTS2RL6Eiv3/hztGzdg6n PCC8xroKl+UZ6U9w/5EioB2GrEexc7QpcfWozqYqIeEfy8ZJlvKLU25/1cpWZrCe NrWWi+lsUanMUWn1JdkdjKFyEuHZl/E4FLjp9Fyy6C15scWJzeoISPKlSjru1qv7 A8pp3lyG/84= =u5Gn -----END PGP SIGNATURE-----

1 0

RE: WinKrypt
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

By way of JYA: > >"WinKrypt's marriage of highly sophisticated technology -- such > >as the advanced, not-for- export 256-bit GOST encryption > >algorithm contained in the KeyMail program -- with a > >user-friendly interface virtually redefines the PC security > >category," said Syncronys. >> >> http://www.syncronys.com. ROTFL! Marvelous. This from the folks who brought us SoftRam95, arguably the most blatant fraud ever perpetuated on the software buying public. For that, they recently got off with a remarkably soft slap on the wrist from the FTC. (See http://ftp.uni-mannheim.de/info/OReilly/windows/win95.update/softram.htm l for the story.) I wouldn't buy a _screen saver_ from these folks, let alone a mission critical piece like email encryption! Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ====================================================================== >

1 0