December 2003 - cypherpunks-legacy

RE: So how does the crypto crackdown go?
by nobody＠replay.com 17 Dec '03

17 Dec '03

> >One question is whether they would also try to make it illegal to use >(rather than to distribute) crypto software. On the one hand, if they >don't do that, they have a problem with all the installed base of code. >But the legalities of stopping people from encrypting code on their own >computers, or writing crypto programs for personal use, seem a lot more >questionable to me, and I don't know how much precedent there would be >for that kind of restriction. Not at all questionable. A ban on crypto would follow the current trend in regulating technology. Consider the case of Bernie S. who is in jail for possessing electronic parts that could be used for telco fraud. Any government action towards banning crypto will include possession of crypto as a crime. The "cat's out of the bag" argument is ineffective as well as the governments just don't care. They'll just say in effect: "It's illegal. Destroy it if you got it." Now it's doubtful if enforcement would make unprovoked searches and arrest people solely for possession of crypto. And it is also unlikely that DA's (except perhaps the most bored) would follow up on "My neighbor is using crypto" tips. But it is not uncommon for prosecutors to heap additional charges on criminals (alleged) such as the case in robbery: 1 count robbery, 1 count using a gun in robbery. or perhaps 1 count tax evasion, 1 count using crypto to commit tax evasion. While the former charge may end up being unproven the later often sticks. > >So as I see it the main target of the ban would be distributors of >software rather than end users. This would be in line with the often >stated goal of the law enforcement people that their main concern is with >crypto that is built in, transparent, and trivial to use, rather than >hacker's crypto. Hmmm. Hackers built the ubiquitous CryptoFS for Linux, no? And the nascent S/WAN too. I don't see a distinction between popular and subculture crypto. The two invariably mix. A program may have it's origins in the subculture but it will often meet the needs of the popular culture as well and be adopted, accepted, and so on. Consider PGP and such add-ons as Brainless-PGP, WinPGP, and the various auto PGP tools. It seems to me that banning distribution would just be too generous. What is distribution? Are time share accounts distribution? I created it but many can use it but the actual bits (well are there actual bits?) never left my single computer. But the nature of "distribution" is to move something from one person to another. Now nothing really moved but a few electrons. But multiple people did use it. Book 'em. Distribution is an archaic term here and the regulations will involve controlling what software may be run on personal computers. The stated goal is a posture designed to sound reasonable. Only time will tell if the actual goal is the regulation of computer uses as I suspect. The security establishment fears crypto. Fears loss of control. I suspect that with Clinton back in the White House (was there a choice?) we will enter a period where the Clipper chip seemed like a good idea. In comparison. Unless some fundamental changes occur to the Security, Intelligence and Law Enforcement agencies (a new acronym? SILE? Pronounced with a long E of course <g>) we will see more business as usual and some completely draconian steps taken against strong encryption. The only recourse is to take an active role now. We must go on the offensive and : 1) Deploy S/WAN 2) Write more strong ubiquitous crypto 3) Attack the SILE agencies directly by challenging their purpose, gutting their budgets, exposing their falacies (umm is that almost freudian or what), flooding international communications with strong crypto messages (content need not apply), and of course ridiculing their every effort. 4) Finding allies in the legal community and educating fence sitters, critical judges, legislators, and so on. Now is the time to act. diGriz

1 0

Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

What do you do if you are operating a remailer and somebody complains they are getting spammed? That's easy, you keep a list of people that you don't send mail to. What's hard is if that person wants to receive other anonymous mail. The solution is easy: charge e-cash to send mail to certain addresses and send the money to the owner of the account. Never put an address on a kill list, just raise the price of sending mail to it. This generates lots of positive publicity for your remailer. People will beg to be spammed! And, since the remailer operator handles the financial parts of the deal, the technically naive "victim" does not have to have specialized knowledge or even an e-cash account. This also eliminates the spam problem generally. If you are plagued by spam, create a list of names you will accept mail from. When a message comes in that is not on the list, return a message directing them to send you the mail through a paying remailer. This solves a problem for famous people, too. They get lots of mail but they don't have time to read it all. How to sort it? Raise the price of sending a message. (I heard that Arnold Schwarzeneggar was once paid $1 million just to read a script and look at the set of a movie with no obligation to act in it.) Okay, now lets go to mailing lists. We like to read anonymous mail on this list, but we don't like getting spammed. It's hard to filter anonymous mail for obvious reasons. The solution: don't accept anonymous mail. Only people on the "approved" list would be allowed to post. People who wish to post anonymously could then send mail through the paying remailer to people on the "approved" list and request that their message be relayed. Most people on the list would be happy to accept a dollar or two to provide this service. This would eliminate inappropriate mail while allowing anybody to post. For that matter, postings to the list itself could be priced at, say, a dollar to cut down on the noise levels. Payments, and addresses which complicate payment, make it harder to rely on the remailer network. When you send a message through a few remailers and make a faux pax on the last one, you won't know what happened. Did one of the remailers go down? Did you make a mistake? I think I know a solution to this one, too. If somebody wants to get error messages, they include a random 128 bit number with their message. This is a different number for each remailer in the chain. When an error occurs, the remailer distributes an error message with the number attached. Error message distribution is pretty easy. The remailer operator could publish a web page with the errors. Or, the messages could be bundled and made available through anonymous ftp, or mailed to an error message mailing list, or posted to a newsgroup. Peter Hendrickson ph(a)netcom.com

1 0

Federal Reserve Bank is ILLEGAL?
by Doug Renner 17 Dec '03

17 Dec '03

http://feustel.mixi.net/GOV/DEPTS/fedres.html Most list members would be very interested in the above link.

4 6

Re: WebTV a "munition"
by Sean Roach 17 Dec '03

17 Dec '03

At 11:56 AM 11/11/96 -0800, Pablo Calamera wrote: ... >The WebTV Network is currently using a 128 bit encryption system that >gives our U.S. subscribers the most sophisticated security protection of >any online service today. It is our intent to offer our customers the most >secure environment for transactions and transmission with their WebTV >Network service. Our units, sold by Sony and Philips, include a sticker >that states that the product is not to be exported outside of the United >States. > >However, the government restriction does not prevent us from exporting our >product outside of the United States. WebTV Networks has always intended to >announce its expansion plans in early 1997, providing global communication >using either 40 bits, now authorized by the government, or 56 bits which >Bill Clinton recently endorsed. ... This may prove my ignorance, but I thought that the WebTV systems were going to use a propiatory service. I am assuming that this is true in this post. If the WebTV product is using a propietory ISP for its operation, I assume that WebTV sets sold outside of the United States will not be dialing up the same phone number. As the chip could easily communicate with the ISP, and the ISP communicate, perhaps through standard credit validation systems, with the merchants, why does the international version even need U.S. developed encryption. The international version could most likely be fitted with the locally available strong encryption. Since the WebTV ISP will probably have a virtually private wide area network, the "foreign" encryption could be replaced with a more standard type inside of the U.S., at the main offices. Why give the U.S. government the ability to look at the transaction information of non-U.S. citizens, off of U.S. soil. If, however, the WebTV system does not have the ability to maintain contact with its over-seas offices, this could be unfeasable. Granted, this idea would mean that some computer would have access to all of the relevant data,for the purpose of "trading" crypto, but I would rather put my trust in a company, which I could easily quit dealing with, than the U.S. government, which might easily institute an international sales tax system. Can PGP be compiled to an EEPROM? If so, PGP is well distributed and might easily be accepted for online transactions, also, Mr. Zimmerman might be willing to agree to a bulk liscense sale for the implemention of this idea. Just make sure that the chip is loaded outside of U.S. borders.

1 0

Re: two bogus messages to this list
by Sean Roach 17 Dec '03

17 Dec '03

At 11:08 PM 11/11/96 -0500, Ted Garret wrote: ... >Microsloth has, at the heart of it's system, a call which traps ALL >KEYSTROKES and EVENTS. This call exists from Win32s on, and can be >placed inside of a DLL which most users would have no idea was loaded. >Even under NT, this DLL can be made to remain resident and trapping >Keystrokes, events, and window contents. > >Does this just BEG to be exploited? ... I use Windows 3.11. Look at the Recorder in it. Its designed to create Macros. It can be set up, by anyone, to capture passwords in Eudora. I've tried it in a controled environment (my own machine), it works. The only defense is if the person were to have h[is,er] password left in Eudora, which is a serious mistake, or if that person Alt,Tabs through all of the resident programs to make sure it wasn't running. Half of the people I've told this to didn't even know that you could switch between windows programs, (one didn't even know that more than one windows program could be active at the same time). In an open lab environment, where the machines are left on, and the common user can't navigate outside of windows, and then only with the mouse, this would be a serious threat to privacy.

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 08:26 AM 11/11/96 -0800, Hal Finney wrote: ... >I have two kids entering their teens, and I'm sure other list members are >parents as well. What can we do for our children to help them enter their >adult lives with better chances to retain privacy? Unicorn mentions keeping >them absent from school on picture day, although I'm not sure how much this >helps. I suppose it makes it harder for an investigator to find out what >they look(ed) like. Then when they get old enough to drive you have a new >problem avoiding the photo (and thumbprint) on the license. ... As far as the drivers linscense goes, there are religions that do not allow its members to be photographed, and the government honers this,(at least the Tag Offices do). I don't know the name of the religion but I believe it is a Christian one. Convert once every four years to get your drivers liscense, and convert back within the week. No photograph on that little piece of plastic. P.S. In Oklahoma, there is no thumbprint on the current liscense. P.P.S You can always send your child to school with a note saying that you do not want your child in the class picture, I know of someone who did that, (on a side-note, we always wondered why.)

3 2

A really short one time pad.
by Sean Roach 17 Dec '03

17 Dec '03

Actually, here are ten. 2^.5 3^.5 2^(1/3) 5^.5 5^(1/3) 7^.5 11^.5 13^.5 17^.5 Pi For that patter the nth root of any prime number. A lifetime of "pads" could be distributed in one trip. Of course this still means that you have to make the trip, and write down all of the above with a referring codeword or number. Cheap, I know. Wonder if this type of "one time pad" is as foolproof as truly randomly generated ones.

3 2

Re: Small question about the list
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>I would be realy happy if someone could tell me the adress to remove my name >from the distribution list. >Could anyone send me the procedure on how to remove my name of the list ? The two usual ways to do this on the internet are 1) Use the same address you used to join the list (you _did_ save it?) 2) somethinglist(a)somewhere.com is administered by somethinglist-request(a)somewhere.com (though this is often a frontend for some mailbot like majordomo or listserv @somewhere.com , and may just send you instructions for finding the real mailbot.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

Code of Practice for the Internet
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, Found something I thought you all might find interesting..... www.intiaa.asn.au/codeintro.htm A body in Australia is attempting to introduce a "Code of Practice" in Australia Yours Sincerely, Benjamin Grosman

1 0

Re: Taxation Thought Experiment
by azur＠netcom.com 17 Dec '03

17 Dec '03

>The crypto-relevance is via crypto anarchy: we need to undermine the tax >system enough that _everyone_, not just us, loses faith in it. (There could >be a "straw that broke the camel's back" effect, if people lose confidence >in the system. Even if most people are _not_ using anonymous digital cash >to hide income, if _enough_ are (and this "enough" could be a visible >minority, visible through recounts of their deeds), then confidence could >be lost. As in Italy and other such places, where compliance rates on taxes >are very low.) > >--Tim May > I've posed similar questions to friends and aquaintences. The working-class stiffs (who can't easily hide from the IRS) feel taxes are an unwelcome but necessary burden in order to provide the blanket of government protection they feel exists. They resent and oppose widespread tax fraud. Self-employed tend to be more open to 'alternative' income structuring. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne, Libertarian, for President. http://www.harrybrowne96.org

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 10:14 PM 11/11/96 -0600, Igor Chudov wrote: >This is an interesting topic. I apologize if my questions are too trivial, >but here they are: > > 1) Can a person without an SSN have a credit record? Some > may say that a credit record is a bad thing to have, > but I am still interested in a possibility. > 2) Will private lenders (such as credit card issuers or > mortgage companies) agree to extend credit to a person > without an SSN or to someone who refuses to give out his SSN? > 3) Will the state issue a driver's license to someone who does not > have/does not wish to give out their SSN? > 4) Will states' police (where applicable) approve purchases of > firearms if purchasers do not state their ssn (misstating it > may be a crime) on an application? > 5) Employers are required to pay certain taxes and therefore > they, in my understanding, need to know their employees SSNs. > How can people get around that (unless they do not need to work)? > 6) Can someone without an SSN obtain various kinds of insurance? > >It is my understanding that the law does not regulate use of social >security numbers between private parties. Businesses are free to refuse >to do business with someone who does not present them an SSN. In real >life, how inconvenient is life of a privacy-concerned individual? > >Say, John Anonymous is a young 15 years old who anticipates to become an >engineer and have a middle class life. He wants to get married, have >children, drive a car, obtain insurance, work at some big company, >travel around the world, invest in mutual funds or buy stocks, and so >on. Reliance on government help is not important to him, so he would not >apply for an SSN solely to get Social Security, welfare and such. > >His parents are cypherpunks and did not obtain an SSN for John. How much >effort would it cost him to live a life outlined above? He couldn't, at least not in Oklahoma. In Oklahoma, students in public schools are now required to have SSN's. This may not apply to private schools, but I imagine that it does, at least to some degree. Having a high school education is certainly necessary to gain the Masters necessary to be an engineer. However, getting a drivers liscense should be easy. My sisters drivers liscense number is one that was randomly generated, all because she did not know her SSN off of the top of her head. My drivers liscense number is the same as my SSN, all because I know my state mandated serial number. For all practical purposes, I am Roach, Sean 447-xx-xxxx. Note, 447 refers to the state of my birth. My sisters record is at least a little more convoluted.

2 1

RE: Taxation Thought Experiment
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May The crypto-relevance is via crypto anarchy: we need to undermine the tax system enough that _everyone_, not just us, loses faith in it. ......................................................... Having more of the facts about how taxation works - how it affects an individual in certain examples, providing the kind of calculating which both Tim and Joseph have gone through, should do it (bring about the loss of faith). And Ross Perot would be the right person to communicate it, with his charts and his detailed explanations (so would Harry Browne, but he doesn't yet have the cash for such advertising). Ross doesn't want to do away with taxes completely, but he is at least interested in their making sense. .. Blanc

1 0

Down-Under Bounce Attack halted
by David Lesher / hated by RBOC's in 5 states 17 Dec '03

17 Dec '03

The postmaster of that AU site running the bounce attack assures me he has been able to vanquish the daemon running the box in question; despite the fact he did not even know it was there ;-} [Don't ask..] -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

RE: Taxation Thought Experiment
by Blanc Weber 17 Dec '03

17 Dec '03

From: azur(a)netcom.com I've posed similar questions to friends and aquaintences. The working-class stiffs (who can't easily hide from the IRS) feel taxes are an unwelcome but necessary burden in order to provide the blanket of government protection they feel exists. They resent and oppose widespread tax fraud. Self-employed tend to be more open to 'alternative' income structuring. ..................................................... Just before the elections I heard on NPR and read in an article in a local newspaper, some people's stories of how they converted from Democrat to Republican. Most of them said that athough they were originally idealistic about all the good things which government can do, when they started their own businesses they were suddenly confronted with all the excruciating regulation and rigmarole which any business must deal with on a daily basis while just trying to get some work accomplished. Very quickly they realized the consequences of a lot of the government proposals which they had heretofore supported. So I realized that experience is not only the best teacher, but it is also the best argument against bad cases of faith in government-run economies. Sometimes a person can't understand what the problem is unless they've "been there", and once a person becomes self-employed, starts a business, or becomes an investor in an enterprise, the light dawns and they Understand. I'm happy when I read that more and more of those people who are "down-sized" or layed off are turning to self-employment and starting their own companies, because this means that more people will acquire through direct experience (that is, confrontation with govmt agencies) the details of real-life economics which were left out of high school & college. And this means more economics&tax-savvy voters in existence for govmt candidates to face in the elections. .. Blanc

1 0

December Cypherpunks Meeting at PGP Inc.
by Dave Del Torto 17 Dec '03

17 Dec '03

Cypherpunks December Meeting Notice (1 of 3) I'm pleased to announce that PGP Inc will be hosting December's Cypherpunks physical meeting at our offices in Redwood Shores (mid-peninsula). We really hope to see you here physically, both to present existing/new topics and projects and also to briefly check out what we're doing. If you want to mark your calendars in advance (there'll be two more reminders), here's the basic info: HOST: Pretty Good Privacy, Inc. (Dave Del Torto) TIME: 14 December 96 (Saturday) 12 Noon - 6 PM LOCATION: Pretty Good Privacy, Inc. 555 Twin Dolphin Drive Suite 570 Redwood Shores CA 94065 USA (directions will follow in the next reminder) Please email me your presentation ideas as soon as possible so I can draw up the agenda for everyone (including some idea of how much time you think you'll need). We'll provide a fast TCP/IP hookup, a workstation (Win95/Mac/UNIX) as needed, an RGB projection device, an overhead projector for transparencies/etc, and any other reasonable equipment you might need (assuming you warn us at least a week in advance). Bagels/Chips will be provided by us, but bring your own beverages. We will pause for a "keysigning moment" near the end of the meeting. If anyone has any early questions, please contact me via email, telephone or even PGPfone (by appointment). My key is available via the URL in the header above. dave ________________________________________________________________________ Dave Del Torto +1.415.65432.31 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web

1 0

Re: Child Protective Services and Political Views
by Dale Thorn 17 Dec '03

17 Dec '03

Duncan Frissell wrote: > At 11:26 AM 11/12/96 -0800, Timothy C. May wrote: > >Who knows, it may even be a > >technical crime ("contributing to the delinquency of a minor"?) to even > >discuss basic libertarian ideas with a minor. And as I said, Child > >Protective Services could quite possibly seize a child whose parents were > >sufficiently vocal about their beliefs.) > One shouldn't be vocal to public employees in any case. Avoid them. If > you are going to be vocal use a non government forum. Separate your > personal life from your political life. It's not too hard to break most of > the pointers between your physical presence and your ideological presence. > Even though an investigator could find where I sleep at night, they would > have to actually expend the resources. My neighbors and the local cops are > unlikely to make the connection because they and I move in very different > circles and I minimize my database presence. [snip] Those people who live a very simple life [no TV, or at least no Cable TV, sleep on the floor with a small, thin mattress, use very little power outside of what's necessary for the laptop AC adapters, drive the smallest cheapest car available, wear old clothing, wear a beard to cut down on shaving, eat mostly veggie and mostly fresh, avoid doctors and drugstore products, stay away from large-corporation jobs, move frequently, rent but never buy, .... (you get the picture)] will get by just fine, and will have the flexibility to make large-scale adjustments rather easily. People who consider the opposite of some of the things mentioned above as very important to them will have to deal with the bad news.

1 0

Secrecy: My life as a nym
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 10:14 PM 11/11/96 -0600, Igor Chudov wrote: > >>This is an interesting topic. I apologize if my questions are too trivial, >>but here they are: >> >> 1) Can a person without an SSN have a credit record? Some >> may say that a credit record is a bad thing to have, >> but I am still interested in a possibility. >> 2) Will private lenders (such as credit card issuers or >> mortgage companies) agree to extend credit to a person >> without an SSN or to someone who refuses to give out his SSN? >> 3) Will the state issue a driver's license to someone who does not >> have/does not wish to give out their SSN? >> 4) Will states' police (where applicable) approve purchases of >> firearms if purchasers do not state their ssn (misstating it >> may be a crime) on an application? >> 5) Employers are required to pay certain taxes and therefore >> they, in my understanding, need to know their employees SSNs. >> How can people get around that (unless they do not need to work)? >> 6) Can someone without an SSN obtain various kinds of insurance? >> Some recent congressional actions or court rulings regarding the mandidate for SSN (Source: National Organization for Non-Enumeration (NONE), http://ime.net/none) * Public Law 104-193 President Clinton Signs Welfare Bill. The bill includes a number of sections attempting to expand the use of the Social Security number and creates new state and federal databases for personal information. * H.R. 3598 Prohibits certain misuses of the Social Security number. Prohibits any person from utilizing any person's Social Security number for purposes of identification of such person without the written consent of such person. * H.R. 3110 Disclosure of Social Security number. Provides for disclosure by the Social Security Administration of Social Security numbers and other records to judgments, or orders issued by courts of competent jurisdiction. * H.R. 4209 Requires applicants registering to vote to provide Social Security number. Amends the National Voter Registration Act of 1993 to require each individual registering to vote in elections for Federal office to provide the individual's Social Security number. * S. 580 Illegal Immigration Control and Enforcement Act of 1995. Provides for a reduction of acceptable employment-verification documents. * S. 999 Illegal Immigration Control Act of 1995. Provides for the issuance of enhanced social security cards for citizens and mandates employer verification of the number. * Olympia, Washington. Court rules no "right to labor" without social security number. * Bar None New Hampshire attorney, was suspended from the Maine Bar because he refused to disclose his Social Security number. Reinstated after agreeing to Consent Decree. * Texas Tech Texan was terminated from his employment for failing to provide a social security number. Filed a religious discrimination claim with EEOC. Rehired under provisions of Consent Decree. * Stop The Press Washington state youth was fired from his newpaper route for not having a Social Security number. Rehired after proving federal law does not require enumeration as a condition of employment. * Vote! Vote! Virginia's law requiring all citizens to provide their Social Security number in order to become registered to vote imposes "an intolerable burden" on their right to vote. * Taco's Are His Life Ohio teenager fired by Taco Bell for refusing to provide a Social Security number. Rehired after proving there is no requirement to provide number to employer. * Social Security Number Not Needed For Licenses Virginians can choose not to have their SSN appear on their driver's license. * Driver License District of Columbia law requiring applicants for driver's license to provide their Social Security number held invalid. -- Steve

1 0

RE: Taxation Thought Experiment
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Blanc wrote: >Just before the elections I heard on NPR and read in an article in a >local newspaper, some people's stories of how they converted from >Democrat to Republican. > >Most of them said that athough they were originally idealistic about all >the good things which government can do, when they started their own >businesses they were suddenly confronted with all the excruciating >regulation and rigmarole which any business must deal with on a daily >basis while just trying to get some work accomplished. Very quickly >they realized the consequences of a lot of the government proposals >which they had heretofore supported. > A case in point: A small company which manufactures premium, hand-rolled, cigars received a bill from the ATF for an unpaid tax and penalties. The notice indicated that the particular tax was over 5 years delinquint. When asked where in the over 500 pages of ATF regulations this tax was documented the investigator said he didn't know and indeed didn't find it after weeks of trying. Finally and expert in D.C. found the obscure reference. The company wanted to know why they were being billed for this tax after almost a decade of operation. They were told that althought the tax has been on the books the ATF had only recently programmed its computers to access the tax. Nevertheless, the tax and penalties were owed, billed or not.

1 0

NRC Crypto Report Supplement
by John Young 17 Dec '03

17 Dec '03

As Herb Lin noted here last week, the final printed version of the NRC Cryptography Report is available. It's a handsome and bountiful volume; and belongs in all the world's libraries. The main difference from the May 30 pre-publication version is about 190 pages of reference documents, now provided in a new Appendix N. The book claims all came from the Internet. We've put 13 of the documents listed below on our site, and will finish the last 2 tomorrow. The Executive Orders, MOUs and MOAs may be of interest. The contents are at: http://jya.com/nrcnidx.htm Here's they are: Appendix N Laws, Documents, and Regulations, Relevant to Cryptography N.1 STATUTES N.1.1 Wire and Electronic Communications Interception and Interception of Oral Communications N.1.2 Foreign Intelligence Surveillance N.1.3 Pen Register and Traffic Analysis N.1.4 Communications Assistance for Law Enforcement Act of 1995 N.1.5 Computer Security Act of 1987 N.1.6 Arms Export Control Act N.2 EXECUTIVE ORDERS N.2.1 Executive Order 12333 (U.S. Intelligence Activities) N.2.2 Executive Order 12958 (Classified National Security Information) N.2.3 Executive Order 12472 (Assignment of National Security and Emergency Preparedness Telecommunications Functions) N.2.4 National Security Directive 42 (National Policy for the Security of National Security Telecommunications and Information Systems) N.3 MEMORANDUMS OF UNDERSTANDING (MOU) AND AGREEMENT (MOA) N.3.1 National Security Agency/National Institute of Standards and Technology MOU N.3.2 National Security Agency/Federal Bureau of Investigation MOU N.3.3 National Security Agency/ Advanced Research Projects Agency/ Defense Information Systems Agency MOA N.4 REGULATIONS N.4.1 International Traffic in Arms Regulations N.4.2 Export Administration Regulations

1 0

Re: More snake oil: ENIGMA
by attila＠primenet.com 17 Dec '03

17 Dec '03

In <v02140b07aeaed1f1f746(a)[10.0.2.15]>, on 11/12/96 at 05:20 PM, azur(a)netcom.com (Steve Schear) said: . Attila said: . .> I wonder if anyone told them the data recovery teams can pull .> multiple layers of data off a disc after it has been stripped? .I've often wondered how effective disk encryption programs, like DiskCrypt, .are at hiding data from a Class III adversary (e.g., NSA). These programs .offer a means of 'cleaning' the data and directory space using randomized .patterns applied one or more times, but this might be insufficient for .removing data written slightly off-track by a previous write cycle. . I don't have any direct experience with 'serious' error recovery either; however, over a few years span listening to some my friends who have not come in from the cold, I received the very definite reading the key is a differential measurement on flux and organization which expands the 'hearing' range exponentially -even if it is multiple destructive formatting. I written software programs for C2 and B1 clearance, including primitives which wiped as they went. I used a pattern which shifted and repeated itself --not too ridiculous on unix if you are using type 2 read/write primitives. messy? yes, in its own simple way. The software was certified by multiple fairly sensitive regula- tory agencies, plus the usual few for whom there is no name. you don't expect, and you do not receive, anything more than a yes/no. but it was in these circumstances I 'heard' the comments on recovery. and their ability to measure that differential gets better every year! No, I do not consider 'erased' disks safe from a determined federal agency. I keep sensitive stuff on zip drives which are removable, and easily crippled forever. that and our principal [a]vocation: stronger cryptography than the hardware can bruteforce or trick. -- Cyberspace and Information are Freedom! FUCK your WIPO, too. -attila

1 0

Re: Censorship on cypherpunks?, from The Netly News
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:33 AM 11/12/96 -0800, Declan McCullagh wrote: >The Netly News >http://www.netlynews.com/ >November 11, 1996 > >Cypher-Censored >By Declan McCullagh (declan(a)well.com) >... > That is, until recently, when Dimitri Vulis was given the boot. > After he refused to stop posting flames, rants and uninspired personal > attacks, Vulis was summarily removed from the mailing list. > >... > > Thus began a debate over what the concept of censorship means in a > forum devoted to opposing it. Did Gilmore have the right to show Vulis > the virtual door? Or should he have let the ad hominem attacks > continue, encouraging people to set their filters accordingly? The > incident raises deeper questions about how a virtual community can > prevent one person from ruining the forum for all and whether only > government controls on expression can be called "censorship." There is a serious error here. Gilmore did nothing to prevent Vulis from posting to the list. He only prevented Vulis from receiving the list under his own name. And, the as hominem attacks continue. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

4 3

Re: Not. [Was Re: Federal Reserve Bank is ILLEGAL?]
by jim bell 17 Dec '03

17 Dec '03

At 02:11 AM 11/13/96 +0000, The Deviant wrote: >On Tue, 12 Nov 1996, jim bell wrote: > >> At 11:57 PM 11/11/96 -0500, Michael Froomkin - U.Miami School of Law wrote: >> Indeed, if Congress chose to license >> >private mints, that would, IMHO be legal. The point here is that the >> >states don't have the power to coin money. >> >> But, apparently, during the 1800's states (?) and individual banks did >> indeed print their own currency. >> >> The way I see it, a positive statement in the Constitution that the Feds >> have the power to coin money does not necessarily exclude other >> people/banks/states/foreign countries from doing likewise. >> > >Hrmm.. One might point out that the only thing required for someone to >"mint" (and I use this term loosely) money is for popular belief that the >money is worth something. What do you think a cashier's check is? Other >notable versions are (and I'm sure somebody is going to say "but its >represintative of the US Dollar", even though its all dealing with money >that really isn't there) is AmEx, MasterCard, Visa, etc. This is yet another reason the Federal government is going to find it so difficult to ban or regulate digital cash. With the collective precedents of paper money, then checks, then credit cards, then traveler's checks, then debit cards, and so forth, the addition of yet another medium of exchange doesn't appear to be a really new concept. Also, as far as I understand it, there is nothing illegal about spending (or accepting) foreign money inside the US, and in many if not most countries it is, likewise, not illegal to spend foreign money there as well. Obviously, the precedents allowing digital cash far outweigh those which could be marshalled to prohibit it.\ Jim Bell jimbell(a)pacifier.com

2 1

FW: Returned mail: User Unknown
by Butler, Scott 17 Dec '03

17 Dec '03

Can whoever is responsible for this please stop. This is about the 30th one that I have received. Thanx Scott >>The address you mailed to is no longer valid. >>This is probably because the user in question was an >>old Open Net subscriber. Open Net is NO LONGER an ISP, >>and has not been since May 1996. > >>We have no redirection address for that user. Please >>remove them from any mailing lists you might have. > >>This response was generated automatically. > >

1 0

Re: Not. [Was Re: Federal Reserve Bank is ILLEGAL?]
by Richard L. Field 17 Dec '03

17 Dec '03

At 10:35 AM 11/12/96 -0800, Jim Bell wrote: >...The way I see it, a positive statement in the Constitution that the Feds >have the power to coin money does not necessarily exclude other >people/banks/states/foreign countries from doing likewise. No need to turn this into Constitutional Law 101, but you might wish to look at Article I, Section 10. - Rich

1 0

Q: where is `/etc/passwd' on WindowsNT
by Thomas Vogler 17 Dec '03

17 Dec '03

hi all, i am looking on information where WindowsNT stores its database of hashed passwords (in the registry ? below the key \\hklm\security\sam\domains\account\users ?) and how they are stored / hashed (md4 ?) ? any information welcome... ttfn thomas -- +-----------------------------------------------------------------------------+ | jolifanto bambla o falli bambla / gro_iga m'pfa habla horem / egiga | | goramen / higo bloiko russula huju / hollaka hollala / anlogo bung / blago | | bung blago bung / bosso fataka / | || | / schampa wulla wussa olobo / hej | | tatta gorem / eschige zunbada / wulubu ssubudu uluwu ssubudu / tumba ba-umf | | / kusa gauma / ba - umf // hugo ball, 'karawane' | +-----------------------------------------------------------------------------+ | Thomas Vogler, tvo(a)software-ag.de, http://pcool/~tvo/ | |-----------------------------------------------------------------------------+ | Phone: [49]-(6151)-92-2484 FAX: [49]-(6151)-92-2610 | +-----------------------------------------------------------------------------+ | statements in here are my own and not neccesarily those of my employer | +-----------------------------------------------------------------------------+

1 0

Data leak in Estonia
by Jüri Kaljundi 17 Dec '03

17 Dec '03

The following are some news clips from Baltic News Service about a scandal in Estonia, where some government and private databases were sold on black market on CD-ROM disks. This brings up an interesting question, who should own information like police and IRS databases, and is it illegal to copy such information once it is available. Juri Kaljundi jk(a)stallion.ee --- SECRET INFO IS SOLD ON BLACK MARKET, ESTONIAN POLICE SAY TALLINN, Nov 09, BNS - Classified information of important state institutions is available on the black market, according to Estonian security police and central criminal police officials. A database containing information on hundreds of thousands of people, collected by the Tax Department, Estonian Mobile Telephone and Radiolinja companies, the Social Affairs Ministry and several other state agencies and large companies, has hit the black market, the Eesti Paevaleht daily reported on Saturday. Supposedly, also Customs Department and national car registry databases have been secretly copied. The CD-ROM with the confidential informations costs about 50,000 kroons, according to the daily. Security Police Director General Juri Pihl and acting deputy director of the central criminal police, Andres Anvelt, confirmed that numerous institutional databases are available on the black market. Anvelt said he had happened to see a pirate copy of the buildings registry showing all transactions with buildings and their owners. "I've also heard that information on who owns which telephone number has leaked from mobile telephone companies," he added. Pihl said security police would investigate information leaks only when they concerned security police itself. Looking into database thefts is not directly the province of security police, he said. Such a secret database is a powerful weapon in the hands of organized crime, the daily said. Criminals have managed to take advantage of the insufficient protection of electronic databases and are sometimes better informed than the police, Anvelt confessed. Baltic News Service --- ESTONIAN COMMITEE CLAIMS IT HAS NO INFORMATION ON DATABASES ON BLACK MARKET TALLINN, Nov 11, BNS - Chairman of the Estonian parliament's security police committee, Vahur Glaase, said he had not enough information on allegedly illicit trafficking in classified databases. "I have too little information to draw any conclusions," chairman of the parliamentary committee controlling the activity of the Estonian security police told BNS. The Eesti Paevaleht daily Saturday claimed that a database containing information of the taxation department, the Eesti Mobiiltelefon and Radiolinja mobile telephone companies, the social affairs ministry and some other agencies and companies on hundreds of thousands of people had arrived on the Estonian black market. Presumably, the illegally copied database also contains data of the customs department and the motor vehicles registration center. Glaase said that while a large proportion of the official information is open to the public, the publication of a classified telephone number is a crime. "This seems to smack of misprision, and police must start investigating it when an application is filed," Glaase said. According to the Eesti Paevaleht report a CD-ROM with the illegal database costs about 50,000 kroons. The paper claimed that the pirated information is a powerful weapon in the hands of criminals. Security police general director Juri Pihl and central criminal police acting assistant director Andres Anvelt confirmed there was black-market traffic in many institutions' databases. Pihl said that the security police would launch an inquiry into the information leak if it also concerned the security police. He said investigation of database theft was not an immediate task of the security police. According to the criminal code, the potential punishment for destroying or manipulating with other people's electronically recorded information is punishable with a prison sentence for a term of up to one year. Baltic News Service --- ESTONIAN CABINET EXPRESSES SHOCK AT GOVERNMENT DATA LEAK TALLINN, Nov 12, BNS - The Estonian Cabinet is shocked by the appearance on the black market of government information, foreign minister and acting prime minister Siim Kallas said. "It is a complicated problem and the Cabinet is shocked by it," Kallas told reporters on Tuesday. Kallas said Interior Minister Mart Rask had known about the information leak since two months ago. "Investigation of the leak has started at the Interior Ministry and by today criminal proceedings have been taken in the first case," Kallas said. Kallas said that in the nearest future the Cabinet would adopt a decision obliging state institutions to protect the information at their disposal. "The security systems and leaking connections must be checked," he said. The acting prime minister said that it was important to establish how, by which channels and through whom the information came to the black market. Baltic News Service --- ESTONIAN POLICE QUESTION FIRST PEOPLE IN DATABASES LEAK CASE TALLINN, Nov 13, BNS - Estonian police Tuesday questioned several people in connection with criminal action brought in the databases leak case. An interview with an alleged author of the black market databases, Imre Perli, has been scheduled for Wednesday. Tallinn police deputy prefect Peeter Sults told BNS that investigators had contacted Perli by telephone and he had promised to come for an interview. "Perli is not a suspect," Sults said. "Criminal action was brought concerning the fact of the leak, not any concrete person." Sults said the perons interviewed were connected with institutions from which information had allegedly leaked out. The Tallinn criminal police brought criminal action in the classified information leak case on Tuesday. The action was taken concerning violations of regulations of government register keeping or of the use of the information contained in such registers. The punishment stipulated for this in the criminal code is a fine or a prison sentence for a term of up to two years. The press has claimed that most of the classified databases were compiled by Perli, until September an Eesti Mobiiltelefon mobile telephone company employee. He may also have compiled the motor vehicles register database by which car owners can be established. Databases containing thousands of mobile and ordinary telephone numbers, traffic offences, as well as data of the motor vehicles and companies registers are currently being offered for sale in Estonia. Such databases are of high value for organized crime. Baltic News Service

1 0

Re: pgp3
by Gary Howland 17 Dec '03

17 Dec '03

> Gary Howland wrote: > > > > > Someone suggested to me that Derek posted a draft spec for PGP 3.0. > > > Anyone know of the whereabouts of this document. > > > > Yes. That document has evolved to RFC 1991: > > > > 1991 I D. Atkins, W. Stallings, P. Zimmermann, "PGP Message Exchange > > Formats", 08/16/1996. (Pages=21) (Format=.txt) Hmm - I don't know I managed to make this post - I had started writing a reply, but exited my mailer, and for some reason it decided to send a cut down version of the unfinished mail anyway ... > Nope. This RFC is merely a rehash of the pgformat.doc file in the PGP > 2.6.? distribution. I'm doing an independent implementation of the PGP > 2.6 message formats, and found this document unclear in a few spots. For > example, can anyone else figure out the weird CFB variant mode from this > document? I used a debugger on the PGP code to help me figure it out. Exactly - I spent ages on the same thing. Then there's the problem that packet length headers must be specific lengths for various types (eg. key certificates must have a 2 byte length, even if only one is required). It is also not clear what the exported key certificates should contain, the spec simply mentioning that there should be no trust packets etc. etc. > The PGP 3.0 "spec" that you're referring to is actually a draft for a > PGP library API. A couple of those got circulated on some PGP mailing > lists, but none have been publicly released, another example of the > secrecy surrounding the whole PGP effort. > > Now that PGP Inc. is happening, it's not exactly clear whether the PGP > 3.0 release is going to include an API closely resembling these drafts. I agree with your comments. For example, we are developing PGP compatible libraries in both Perl and Java, and are going to add SHA, Blowfish, T-DES, etc., along with a better key ring format, encrypted key rings, and features such as key generation from a passphrase, and we would very much like to remain compatible with the new PGP, but how can we when there is so little information available? I think we need a forum to discuss PGP development issues - I would be happy to set one up if there was interest. Best regards, Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

4 3

Re: Taxation Thought Experiment
by Gary Howland 17 Dec '03

17 Dec '03

> o TAXES THOUGHT EXPERIMENT > > 1) I generate $100 of productivity for my company > 2) Company is taxed %30, $70 left > 3) Company pay shareholders and costs, $30 is left > 4) Company pays me > 5) I pay 40% in taxes, so $18 left > 6) With $18 I can buy a $16.82 object (%07 sales tax). > > Results: > 1) I see $16.82 realization from $100 productivity increase. > * Govt. gets $49.26 of my productivity, or nearly 3 times the amount I get. The government gets $59.26, not $49.26 (30+16+12+1.26). That leaves you with 16.74 (not 16.82) - they get nearly four times as much. In other countries the situation may be worse, not only due to different rates of tax, but because of social security contributions, employers tax, and the like. Then if you spend your money on beer or fags, you may be paying even more tax, due to taxes on alcohol and tobacco, leaving the government with perhaps 10 times as much money as you. Many imported goods also have a tax on them (eg. motorcycle import tax is around 50% in the UK). It is probably more fun to do these calculations without involving the shareholders, since they are, after all, earning their "cut". [ Crypto relevance? Assasination taxation? ] Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

4 3

FW: Returned mail: User Unknown
by Butler, Scott 17 Dec '03

17 Dec '03

> >>The address you mailed to is no longer valid. >>This is probably because the user in question was an >>old Open Net subscriber. Open Net is NO LONGER an ISP, >>and has not been since May 1996. > >>We have no redirection address for that user. Please >>remove them from any mailing lists you might have. > >>This response was generated automatically. > Can whoever is responsible for this please........STOP IT ! Thanx ScOtT >;-D

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Foulmouthed Timothy May rehashes his lies like a rabid parrot choking on a stale mantra stuck in its poisonous beak.

3 2

Litt: 10/28 speech to ABA/ABA
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)tiac.net Date: Tue, 12 Nov 1996 17:46:02 -0500 To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> From: The Old Bear <oldbear(a)arctos.com> Subject: Litt: 10/28 speech to ABA/ABA Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear(a)arctos.com> < gopher://198.80.36.82:70/00s/current/news/topic/econ/96102905.lec > *96102905.LAR 10/29/96 FIGHTING ELECTRONIC MONEY LAUNDERING DEMANDS MULTI-PRONGED STRATEGY (Byliner by DAAG Robert S. Litt) (1930) By Robert S. Litt Most observers believe that widespread electronic commerce is probably inevitable. It offers us the exciting prospect of doing away with many of the costs, burdens, and problems associated with paper money. But the advent of electronic commerce presents certain challenges to law enforcement as well. One of the biggest challenges is the new opportunities for criminals to launder their dirty money. Traditionally, money launderers have deposited troublesome and bulky cash proceeds into banks or other financial institutions to obscure its criminal origins. Or they have created phony companies, or engaged in sham transactions, to hide illicit profits. These methods usually create paper trails that can be traced by law enforcement. Through education, training and the enactment of stringent laws and regulations in this regard, and through close cooperation between the Departments of Treasury and Justice, law enforcement has made great progress preventing and detecting money laundering. As a result, it is increasingly difficult for criminals to launder their money successfully. But certain types of electronic commerce systems permit virtually anonymous transactions and leave no paper trail. These systems could undo years of hard law enforcement work. Electronic commerce could allow a money launderer who wants to transfer tainted funds to do so without the risk of engaging in personal contact with a potentially suspicious bank employee. And the funds could be transferred anywhere in the world by an automated on-line banking system that could be accessed from the safety of the money launderer's home. Similarly, a bank that operates completely on-line could court the business of money launderers with little danger of prosecution. Such a virtual bank could easily be located overseas, beyond the reach of U.S. law enforcement. A recent article in the Washington Post suggests that we are already encountering offshore, on-line banks. According to the Post article, one offshore bank describes itself as the first bank on the Internet, offering the opportunity to open accounts, wire money, order credit cards or write checks by computer from anywhere in the world, around the clock. The bank's Worldwide Web page describes the benefits it offers to customers: "Since there are no government withholding or reporting requirements on accounts, the burdensome and expensive accounting requirements are reduced for you and (the bank). The bank maintains the strictest standards of banking privacy in offshore business and financial transactions. Indeed, (the bank's country) has stiff penalties for officers or staff that violate banking secrecy laws." It is not hard to imagine who will be attracted to this kind of banking. Some smart card systems go further, and would permit money launderers to obscure the origins of funds while avoiding financial institutions entirely. These systems have no central registry of transactions which would allow the transactions to be reconstructed. A sophisticated launderer, using multiple cards, could create an intricate series of transfers that could not be unraveled, and that would circumvent almost all existing money laundering laws. Internet payment systems can similarly permit multiple transactions that could be next to impossible to trace, particularly if unscrupulous merchants cooperate with the criminals. How do we respond? One big step toward eliminating money laundering and other law-breaking through electronic commerce would be to implement electronic cash technologies that track all transfers. We have received information that at least one provider of a smart card system that is already in use in Europe has modified its cards for use in the United States so that financial institutions will be able to track card usage. The system will allow them to audit for fraud, if not recreate every transaction. But a solution such as this raises a fundamental philosophical issue for our society -- striking the proper balance between anonymity and accountability. This question is being debated in many contexts as the Internet grows. Important reasons abound to allow anonymity in communications networks. Whistleblowers may want to remain anonymous to avoid retribution. Consumers may wish to obtain information on a product without ending up on hundreds of mailing lists. Rape victims may want to discuss their experiences without revealing their identities. Unfortunately, criminals also benefit from anonymity. They want to avoid getting caught. Anonymous remote communications can help them avoid detection and apprehension. And so effective law enforcement requires accountability. We must be able to hold individuals who harm others accountable for their conduct. We can find a middle ground between anonymity and accountability in the principle of confidentiality. In a confidential system, a person's identity is not generally known, but in appropriate circumstances -- for example when a court order is obtained -- the identity can be determined. Confidentiality permits us to allow anonymity in appropriate circumstances but does not permit criminals to obtain new advantages from the anonymous capabilities of the Net. This concept of confidentiality embodies the message chosen by the framers of the U.S. Constitution to limit law enforcement through the Fourth Amendment. They rejected a system under which law enforcement could have unfettered access to citizens' papers; but equally they rejected a system where those papers could be immune from scrutiny under any circumstances. Rather, they provided for access to a person's documents under appropriate judicial supervision, forbidding unreasonable searches and seizures and requiring warrants and subpoenas. The same kind of balancing, an approach that protects both anonymity and accountability, should govern our approach to electronic cash. Those are some of the challenges we will face. The Department of Justice has been taking some steps to help us prepare for these challenges, drawing on the expertise we have had in dealing with other computer crimes such as hacking. The first lesson that we have learned is the need for extensive training. To fight computer crime, agents and prosecutors must understand computer and telecommunications technology, and be dedicated full time to this complex area of law. The FBI has now created three computer crime squads, in Washington, San Francisco and New York City. The Secret Service also has agents trained to deal with electronic crimes against financial institutions. The expertise of these agents will be a crucial asset in fighting abuses of electronic commerce. Successful investigation of high-technology crime also requires the participation of technically literate prosecutors. In 1991, the Criminal Division of the Department of Justice created what is now the Computer Crime and Intellectual Property Section, which we have recently doubled in size. And we have set up, with the cooperation and support of our U.S. attorneys nationwide, a network of prosecutors who have been specially trained to serve as Computer and Telecommunications Coordinators. These "CTCs," as they are known, presently serve as resident experts on computer crime issues. But to be successful in combating money laundering or any other form of electronic crime, an international response is absolutely necessary. Many of the crimes of the future will not be hampered by international boundaries, because electronic funds need not be physically transferred; they can be instantaneously and covertly shipped via telephone and data networks. Because computer criminals often are not in the same country as the electronic funds that they are stealing, passports and other existing international controls are of limited use in identifying and apprehending them. Thus, a concerted international effort will be necessary to ensure that electronic commerce criminals cannot take advantage of weak laws in one country to commit crimes with impunity in the United States. We are making great progress in this effort. We have already had several instances of international cooperation leading to the arrest of overseas hackers who have broken into U.S. computers, and we are working in a number of international forums to institutionalize that cooperation and to seek coherent rules and policies that will enable us to prevent abuses of electronic commerce. In addition to working with other governments, we will have to work with industry. The issue of encryption is particularly prominent now. Without strong encryption, successful electronic commerce is probably a fantasy. But encryption that is too strong -- that cannot be broken when appropriate -- risks terrible and irrevocable damage to law enforcement capabilities that are critical to our ability to protect us all. Our goal is to encourage the use of strong encryption to protect privacy and commerce, but in a way that preserves law enforcement's ability to protect public safety. We're not looking to expand what we can do now, just to preserve this ability against the threat of unbreakable encryption. Our goal is confidentiality -- protecting the privacy of individual communications while preserving our present ability under the law to obtain this information when we need it. Similarly, in electronic commerce, we want to work with industry to ensure that the needs of law enforcement are met without either stifling the development of a vibrant new technology or compromising individual rights. We believe that the electronic commerce industry should incorporate certain features into the designs of their smart cards systems, features that we consider necessary to avoid abuses in this area. We don't want to dictate how these features are designed, but there are certain reasonable elements that industry should build into its systems. First, a transaction using a digital purchasing system should generate and safely store records similar to those of credit cards whenever a cardholder makes a purchase or transfer that exceeds a designated size. In this regard, we must again emphasize that we are not seeking to give government any new authority, merely to ensure that we can get information when we are authorized to do so. Second, electronic commerce systems should be designed to maintain sensible limits on the amount of value that may be stored or transferred on a single smart card or personal computer. Few people carry tens of thousands of dollars in cash on their persons; permitting "smart cards" of such value would greatly increase the opportunities for fraud. Finally, and for obvious reasons, we must encourage the major smart card system providers to use responsible financial entities as the primary outlets for their cards. Our last challenge is to update laws that might otherwise become outdated. At present it is not clear whether our existing laws are adequate to deter and punish electronic commerce abuses. Since Congress did not and could not have foreseen the current electronic commerce revolution, law enforcement authorities must be prepared, at least at first, to combat these abuses through existing criminal statutes that are not perfectly adapted to the problem. We do not want to create new laws for their own sake, and certainly not without understanding the effects that they would have on a vibrant new industry. On the other hand, if we find that the law enforcement problems presented by electronic commerce are outstripping our ability to deal with them, changes in our legal structure may be required. The challenges faced by law enforcement in electronic commerce will be enormous. We have already begun to prepare for some of these challenges, but we realize that we have much more to do. With training, technological understanding, international cooperation, diligent law enforcement, and the cooperation of industry, we will meet these challenges. (Mr. Litt, a deputy assistant attorney general, is President Clinton's nominee to head the Justice Department's Criminal Division. The article was adapted from his Oct. 28 speech to the American Bar Association and the American Bankers Association in Washington. It is in the public domain and may be reprinted without permission.) NNNN ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

"Perceptions and Misperceptions of Privacy on the Net"
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)tiac.net Date: Tue, 12 Nov 1996 19:59:39 -0500 To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> From: The Old Bear <oldbear(a)arctos.com> Subject: "Perceptions and Misperceptions of Privacy on the Net" Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear(a)arctos.com> The George Washington University School of Engineering and Applied Science Cyberspace Policy Institute FREE AND OPEN TO THE PUBLIC Tuesday, November 19, 1996 4-6 p.m. Room 410 Marvin Center, 21st & H St. NW, Washington, DC "PERCEPTIONS AND MISPERCEPTIONS OF PRIVACY ON THE NET" Speaker: Steven Emmert, Corporate Counsel for Lexis-Nexis Commentators: William W. Burrington, Assistant General Counsel, America Online Deidre Mulligan, Staff Counsel, Center for Democracy and Technology Privacy norms, regulations, and laws have been developed over the years, in balance with norms, regulations and laws governing access to government information and open meetings. The advent of widespread Internet use has called into question some previously unchallenged uses of information, reopened discussion on some problems once thought resolved, and raised new questions which have never been addressed. In addition to the commercial players involved, individuals, in greater numbers than at any time in the past, have joined these discussions about the proper uses of information. LEXIS-NEXIS recently experienced this increased individual participation first hand following the release of a commercial product, P-TRAK. This product, which makes limited information about individuals available to LEXIS-NEXIS' subscribers (typically law firms, Fortune 1000 corporations, and government agencies including federal law enforcement agencies) became the centerpiece of an Internet controversy about privacy. Information and misinformation about P-TRAK was widely disseminated on the Internet (and still is) and in the mainstream media. In response to this controversy, the Congress directed the Board of Governors of the Federal Reserve System, in consultation with the Federal Trade Commission, to conduct a study of whether organizations which are not subject to the Fair Credit Reporting Act are engaged in the business of making sensitive consumer identification information available to the general public. Senators Bryan, Pressler, and Hollings have requested "that the FTC conduct a study of possible violations of consumer privacy rights by companies that operate computer data bases." As these studies proceed it will be important for all concerned -- corporations, individuals, the government, law enforcement and others-- to ensure they fully understand the issues and policies involved in order to strike the proper balance between the legitimate information needs of businesses, professionals, individuals, the press, the public, government and law enforcement, and an individual's right to privacy. Lessons learned from this experience will be shared. The policy and legal issues raised will be identified. Implications for the future of the Internet and for electronic commerce in information will be discussed. Additional information on this and other seminars is available at www.cpi.seas.gwu.edu/Activities/Seminars/96-97.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

RE: Taxation Thought Experiment
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

>azur(a)netcom.com (Steve Schear) wrote: >>The crypto-relevance is via crypto anarchy: we need to undermine the tax >>system enough that _everyone_, not just us, loses faith in it. >> >>--Tim May >> > >I've posed similar questions to friends and aquaintences. The >working-class stiffs (who can't easily hide from the IRS) feel taxes are an >unwelcome but necessary burden in order to provide the blanket of >government protection they feel exists. They resent and oppose widespread >tax fraud. Self-employed tend to be more open to 'alternative' income >structuring. And in the meantime, it would seem prudent to use the existing system to maximum advantage. In Canada, you can set up a personal trust called a Registered Retirement Savings Plan (similar to an IRA?) wherein you can trade securities without tax liability until you withdraw the money into your hands. As long as you aren't trying to spend it, no taxes are owing. There is a withholding tax of 25% if you eventually leave the country, but the tax free compounding effect over a decade or two will make this virtually irrelevant. There are also tax credits for venture capital (especially if it relates to R&D) or scientific research investments. Since we are in fields that likely are related to this type of work, it seems that we would be able to take advantage of these types of credit. In Canada, they can pay 80-90% of the related payroll. Add NRC (National Research Council) grants available for R&D projects and you can run a company with a dozen people for NO money. This is not fantasy since I know at least two companies that do this. The only caveat is that you need a good idea to start with. It is also not hard to have a nominal 50+% marginal tax rate yet pay 15% net income taxes. Since I can use the Canadian tax system to advantage, I'm not sure that I want to get rid of it just yet. So, while you are waiting for that anarchy, you may want to retain a good tax accountant. Ciao, James The grass is always greener over the septic tank.

1 0

RE: Remailer Abuse Solutions
by Mullen Patrick 17 Dec '03

17 Dec '03

Sounds like another attempt to raise the cost of using the Net, nothing more. Sure, paying postage (Is $1 really necessary? Why email when snailmail's cheaper??) may reduce general spamming done by local punks, but it does nothing against corporations which already spend millions on snailmail spamming. Also, what happens when your long-lost friend comes across your addy and tries to email you? Surely you don't want to charge postage for an otherwise free service to him/er. Maintaining a list of "accepted sources" would be a hassle not many people would accept. Slight variation is to generate a list of "toll these entities." A smaller list (hopefully :-), and generally easier because then it defaults to no-bill. Or, to accomodate superstars/actors/etc, generate files like rhosts.accept rhosts.deny in UNIX. That way, the user may use either/both types of filtering. Again, the average user wouldn't want to deal with this hassle, everyone's mail software would have to be rewritten, and I basically oppose any ideas that cost me money for something I already get for free... :-) PM _______________________________________________________________________________ From: Peter Hendrickson on Wed, Nov 13, 1996 4:10 Subject: Remailer Abuse Solutions To: cypherpunks(a)toad.com What do you do if you are operating a remailer and somebody complains they are getting spammed? That's easy, you keep a list of people that you don't send mail to. What's hard is if that person wants to receive other anonymous mail. The solution is easy: charge e-cash to send mail to certain addresses and send the money to the owner of the account. Never put an address on a kill list, just raise the price of sending mail to it. This generates lots of positive publicity for your remailer. People will beg to be spammed! And, since the remailer operator handles the financial parts of the deal, the technically naive "victim" does not have to have specialized knowledge or even an e-cash account. This also eliminates the spam problem generally. If you are plagued by spam, create a list of names you will accept mail from. When a message comes in that is not on the list, return a message directing them to send you the mail through a paying remailer. This solves a problem for famous people, too. They get lots of mail but they don't have time to read it all. How to sort it? Raise the price of sending a message. (I heard that Arnold Schwarzeneggar was once paid $1 million just to read a script and look at the set of a movie with no obligation to act in it.) Okay, now lets go to mailing lists. We like to read anonymous mail on this list, but we don't like getting spammed. It's hard to filter anonymous mail for obvious reasons. The solution: don't accept anonymous mail. Only people on the "approved" list would be allowed to post. People who wish to post anonymously could then send mail through the paying remailer to people on the "approved" list and request that their message be relayed. Most people on the list would be happy to accept a dollar or two to provide this service. This would eliminate inappropriate mail while allowing anybody to post. For that matter, postings to the list itself could be priced at, say, a dollar to cut down on the noise levels. Payments, and addresses which complicate payment, make it harder to rely on the remailer network. When you send a message through a few remailers and make a faux pax on the last one, you won't know what happened. Did one of the remailers go down? Did you make a mistake? I think I know a solution to this one, too. If somebody wants to get error messages, they include a random 128 bit number with their message. This is a different number for each remailer in the chain. When an error occurs, the remailer distributes an error message with the number attached. Error message distribution is pretty easy. The remailer operator could publish a web page with the errors. Or, the messages could be bundled and made available through anonymous ftp, or mailed to an error message mailing list, or posted to a newsgroup. Peter Hendrickson ph(a)netcom.com ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;13 Nov 1996 04:10:17 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Wed, 13 Nov 1996 9:06:01 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id RAA13602 for cypherpunks-outgoing; Tue, 12 Nov 1996 17:07:45 -0800 (PST) Received: from netcom19.netcom.com (root(a)netcom19.netcom.com [192.100.81.132]) by toad.com (8.7.5/8.7.3) with SMTP id RAA13594 for <cypherpunks(a)toad.com>; Tue, 12 Nov 1996 17:07:36 -0800 (PST) Received: from [192.0.2.1] (ph(a)netcom21.netcom.com [192.100.81.135]) by netcom19.netcom.com (8.6.13/Netcom) id RAA03014; Tue, 12 Nov 1996 17:07:31 -0800 X-Sender: ph(a)netcom15.netcom.com Message-Id: <v02140b04aeaec9f1fa9b(a)[192.0.2.1]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Tue, 12 Nov 1996 17:07:41 -0800 To: cypherpunks(a)toad.com From: ph(a)netcom.com (Peter Hendrickson) Subject: Remailer Abuse Solutions Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0

PGP3.0 & ElGamal
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

On Fri, 25 Oct 1996 00:32:52 +0100, Adam Back wrote: [snip] > Also I understand, though there appears to be no available > documentation saying as much, that pgp3.0 will not use RSA, nor IDEA, > nor MD5, using instead El Gamal for public key encryption and > signatures, 3DES (unsure?), and SHA1. Can someone confirm that PGP3.0 will use ElGamal? Bert-Jaap

8 10

RE: Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 10:34 AM 11/13/1996, Mullen Patrick wrote: > Sounds like another attempt to raise the cost of using the Net, nothing more. I am curious which conspiracy you believe I am participating in, other than the Great Cypherpunk Conspiracy, that is. Keep in mind that nobody is forced to participate. > Sure, paying postage (Is $1 really necessary? Why email when snailmail's > cheaper??) may reduce general spamming done by local punks, but it does > nothing > against corporations which already spend millions on snailmail spamming. Many people would be happy to read spam mail at $1 a piece. Assuming you can scan at a very conservative 3 messages/minute, that's $180/hr. you can make in the privacy of their own home. Not enough for you? Raise the rate. One dollar is a nice schelling point. That's why I chose it for my example. In practice the people involved are welcome to choose any amount in any currency they like. > Also, > what happens when your long-lost friend comes across your addy and tries to > email you? Surely you don't want to charge postage for an otherwise free > service to him/er. Maintaining a list of "accepted sources" would be a hassle > not many people would accept. Absent highly intrusive global net monitoring techniques, that's what they are going to have to do anyway. E-mail is inexpensive. The advertiser can justify the expense even if generates a small number of leads. Expect more spam. The alternative to filtering the mail in some way is to create Internet licenses for every participant which may be revoked for infractions. These licenses would have to be global. Big Brother is Watching. Advertisers do not have a monopoly on spam. Many people - especially women - complain about harrassing mail they receive. > Slight variation is to generate a list of "toll these entities." A smaller > list > (hopefully :-), and generally easier because then it defaults to no-bill. Or, > to accomodate superstars/actors/etc, generate files like rhosts.accept > rhosts.deny in UNIX. That way, the user may use either/both types of > filtering. How will you construct your "toll these entities" list yet accept mail from any remailer? Why will spammers not figure out remailers? > Again, the average user wouldn't want to deal with this hassle, everyone's > mail > software would have to be rewritten, and I basically oppose any ideas that > cost me money for something I already get for free... :-) No, everybody's mail software would not have to be rewritten. That was the idea. For instance, it would be easy for users of Unix systems to use procmail to pre-filter their mail for whatever program they like. Nota bene: the remailer operator is not offering to filter the users mail. "Free" is not always the best choice. I would gladly pay $10/month to receive the cypherpunks list if it meant that messages were delivered immediately when sent. (I believe these delays hamper the discussion.) As it is, I can't complain because I am a recipient of John Gilmore's charity. I would be interested to hear more about your solution to this problem: People spam other people who don't like spam but like to receive anonymous messages. I would prefer to see solutions in keeping with the Cypherpunks spirit; that is, no use of force, no use of law, and no loss of anonymity will be acceptable. Peter Hendrickson ph(a)netcom.com

2 1

RE: Question on non-repudiation
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 13 Nov 1996 04:11:08 -0500 (EST) X-Sender: field(a)pop.pipeline.com Mime-Version: 1.0 To: John Lowry <jlowry(a)BBN.COM> From: "Richard L. Field" <field(a)pipeline.com> Subject: RE: Question on non-repudiation Cc: set-discuss(a)commerce.net Sender: owner-set-talk(a)commerce.NET Precedence: bulk +----------------------------------------------------+ Addressed to: set-discuss(a)commerce.net +----------------------------------------------------+ As chair of the ABA's Electronic Commerce Payment Committee and a member of the drafting team for its Digital Signature Guidelines, I suppose I am one of the people expected to "solve" the non-repudiation problem through legal means. Notwithstanding any technical or procedural proofs, there is no absolute non-repudiation, as a legal matter, unless a statute is enacted to that effect. For consumers in the U.S., there is no indication that this will happen. The applicable laws governing credit cards and the consumer use of debit cards specify that the customer can repudiate any unauthorized transaction, and that it is left to his bank/issuer to prove that the transaction was actually performed by that customer or under his authority. Even if technical means are used to ensure that the customer will always retain solitary access control to the account (by biometric means, for example), he can still claim coercion, error with respect to legal capacity, etc. Where software-based keys are used to confirm identity and/or authority to enter into a transaction, there are additional risks of error or fraud associated with initially obtaining a key and tying it to an identity, as well as the ongoing association between the key and the identity and/or authority. In these cases some third party ("trusted" CA, etc.) could step in and contractually agree to bear all risk of customer repudiation, but given the relatively low value of the average transaction that would be unlikely. Additionally, in some countries laws may shift the risk of loss absolutely to the customer or otherwise prevent him from repudiating a transaction. To some degree, this is the direction taken in the U.S. laws governing commercial wire transfers. If there are any countries contemplating the enactment of laws that would absolutely bind a person whenever his private key has been used, I would be most interested in hearing about them. - Richard Field At 11:35 AM 11/12/96 -0500, you wrote: >+----------------------------------------------------+ >Addressed to: set-discuss(a)commerce.net >+----------------------------------------------------+ > >Not to be argumentative but non-repudiation can be established >technically. The formal definition requires that through technical >and procedural proofs a party cannot repudiate a transaction. The >law may not recognize those techniques and procedures for contractual >purposes today but the ABA is working on it.... ------------------------------------------------------------------------ This message was sent by set-discuss(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: So how does the crypto crackdown go?
by Hal Finney 17 Dec '03

17 Dec '03

From: "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> > As Hal knows, but some newer members of the list may not, I discuss the > possibility of a ban on strong (unescrowed) crypto at some, ahem, length > in > > http://www.law.miami.edu/~froomkin/articles/clipper.htm > > Although the article is more than 18 months old, the law hasn't changed > in any material way as far as I know. > > Bottom line: they probably can't do it under the constitution, but it's a > closer call than it should be. This is a very helpful and thorough analysis. However it does not address the possibility of a ban on the sale/distribution of strong crypto, rather than a ban on its use. There are several reasons why I think the former is more likely: - PRECEDENT FROM ITARS The current bans on export of encryption software limit the distribution of the software itself, not of encrypted messages. Extending this ban to domestic distribution would imply banning distribution but not use of crypto software. - NOT A PRIVACY ISSUE The privacy issues would be much less relevant because it is no longer a matter of just what you do in the privacy of your own home. - OUT OF THEIR OWN MOUTHS The Clinton administration's original veiled warning, quoted in Michael's paper, denied that "every American, as a matter of right, is entitled to an unbreakable commercial encryption product." Noting the use of "commercial" this suggests a ban on sales rather than use. - COMMERCIAL REGULATION Not being a lawyer, I can only speculate that the interstate commerce clause would give more justification for a ban on distribution than on use. - FOOT IN THE DOOR Conceivably such a ban, if successful, would provide new arguments for advancing to the second stage of a ban on usage after some time. The impact of the usage ban would be less due to the lack of access most people would have to such software, and the (arguably) demonstrated effectiveness of the government approved software almost everyone would be using by that time. - BIG BROTHER IS WATCHING We have long speculated that the government's real interest is in making mass surveillance more practical, with the stated concerns about criminals being merely a convenient cover. Commercial restrictions would be consistent with such motives since they would have more impact on the innocent many than the motivated few. A ban on sales and distribution could still be opposed on First Amendment grounds, especially if it becomes established that software is speech. Still there are many restrictions possible on commercial speech so even a favorable precedent in this area would not preclude some regulation of software distribution. We could also argue that such a ban is de facto equivalent to restrictions on use, since most people would not then have access to privacy preserving software. In that case the many excellent arguments which Michael brings forward to oppose such restrictions would be relevant. And what would be the implications for freeware crypto? Could distribution of such software be subject to regulation in the same way as commercial programs? Then there are the issues relating to speech about crypto which are currently being litigated. Presumably domestic restrictions on such speech would have to reach a much higher standard of demonstrated need than restrictions on export. For these reasons I think that domestic regulations on the sales and distribution of strong crypto would not be a sure thing for the government, but would be a lot easier for them than restricting use. This suggests that it is a likely direction for them to take after the next terrorist attack. Hal

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

Re: pgp3 Re: pgp3
by nobody＠replay.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com cc: ktk, prz(a)acm.org, colin, pgp(a)lsd.com Subject: preliminary pgp 3.0 api document Date: Sat, 11 Feb 95 17:30:55 -0800 From: Katy Kislitzin <ktk>

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

take me off your mailing list
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

unsubcribe cypherpunks

1 0

Dossier on Tim May is Easily Obtainable
by smith＠sctc.com 17 Dec '03

17 Dec '03

The thorough investigator respects the value of physical records and interviews with those actually present. Bit rot is a tricky thing, and so are simple string matches. At 7:15 PM 11/12/96, Timothy C. May wrote: >To illustrate, let me call up my BlackNet Dossier Service entry on you. >www.black.net... I'll just pick _part_ of your entry, from exactly 30 years >ago: >[,,,,much stuff about Mr. Smith elided....] >So, Mr. Smith...is the dossier entry basically correct? Perhaps that was the Rick Smith in the class behind or before me who is or is not shown in yearbook photos with that blonde cheerleader. Or perhaps it was another Rick Smith who does or does not appear in yearbook photographs in the company of various brunette females. Could it have been the Rick Smith whose house got struck by lightning in our town a few weeks back? Or the Rick Smith who just got a building permit? Are these all the same person? Nope. On the other hand, a review of physical records from that important era of the mid 1960s *does* indicate the existence of one and only one young Timothy Christopher May in the vicinity of Langley, Va. Interviews with [SOURCE DELETED] indicate that this young Timothy Christopher May was known for a clever and abrasive style of discourse. Investigators note that the exact same style of discourse appears in the postings of one "Tim May" who is associated with that subversive cabal known as "cypherpunks." The interviews also indicate that young Timothy Christopher May was observed on numerous occasions to be reading Scientific American in the school library and didn't always "share." E-mail messages authored by "Tim May" and intercepted by [SOURCE DELETED] state that he has read Scientific American on numerous occasions. At this time there is no evidence as to whether or not "Tim May" willingly shares his magazines with others, though some investigators argue that it is unlikely. Records retrieved from [SOURCE DELETED] also show that the young Timothy Christopher May exploited his interest in physics for destructive purposes, like elaborate pranks involving fictious weaponry and national security information. [INFORMATION DELETED FOR NATIONAL SECURITY REASONS -- ORCON U31 -- OADR FOR RECLASSIFICATION] However, more careful investigators have uncovered evidence to suggest that this was not entirely a prank. Records from [SOURCE DELETED] indicate that the young Timothy Christopher May purchased a huge gap magnet from Edmund Scientific Company and also produced science fair project titled "Ball Lightning: A Stable Plasma?" Investigators suspect the timing of these events is not a coincidence. Unfortunately, the photographs of young Timothy Christopher May being escorted out of Earth Science class by agents of the Office of Naval Intelligence have somehow been tampered with and are difficult to reconstruct. Perhaps with modern technology... Hmmm, similarities in name, interests, style of discourse, and a history of technological subversion. Is this the same individual, thirty years later? Gentle readers, you decide. Rick. smith(a)sctc.com

1 0

Catholic University talk; ISP-TV
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 13 Nov 1996 10:35:20 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Unabashed self-promotion I'm speaking at the Catholic University Law School about online speech/crypto/copyright issues at 6:30 pm today. Anyone in DC is welcome to stop by; the talk will be in the Columbus School of Law. Also tonight at 8 pm I'll be Brock Meeks' guest on the debut of his ISP-TV show, "Meeks Unfiltered." We'll be talking about what the U.S. elections mean to the Net. We plan to argue about universal service as well. http://www.digex.net/isptv/ -Declan

1 0

[REBUTTAL] Censorship on cypherpunks?, from The Netly News
by Dave Hayes 17 Dec '03

17 Dec '03

[This is a rebuttal to a misguided news article.] > Cypher-Censored > By Declan McCullagh (declan(a)well.com) Thank you for leaving your email address. It makes this easier. You people (read: the unaware and hypnotized masses, which includes reporters who's desire for attention and political safety holds them in line with the consensual illusion) keep missing the real issue, and substituting issues which only hold themselves in place. [Those of you who know, please excuse the mediaistic terms used in this rebuttal. One must use the symbols one is given to communicate at the level of understanding of those who use them.] > Thus began a debate over what the concept of censorship means in a > forum devoted to opposing it. Did Gilmore have the right to show Vulis > the virtual door? Or should he have let the ad hominem attacks > continue, encouraging people to set their filters accordingly? The > incident raises deeper questions about how a virtual community can > prevent one person from ruining the forum for all and whether only > government controls on expression can be called "censorship." "Cyberspace" is interacted with using tools under the control of the interactor. In person-to-person interaction, one's only real defense against what one decides to call "unwanted" is to remove oneself from the arena of interaction. It may not be possible to ignore or run away from certain sources of input. In cyberspace, however, it is not only possible but necessary and even desirable. Cyberspace allows one to interact with many more people then can fit in any given physical space. One simply -cannot- receive input from 2000 people and not employ some sort of filtering mechanism. Indeed, cyberspace has many buttons and switches (and even programmatic filters) which allow one to -completely- control whom one interacts with. Logically, we must conclude that those who frequently and repeatedly cry for the censorship or removal of any source of input from cyberspace are either: -quite clueless about the tools at their disposal -ideologically or personally opposed to the source of input or -in need of large amounts of attention from others Cluelessness can be overcome by appropriate teaching and interest in learning (the latter issue we can safely assume users of popular but ineffectual windowing OSes are not able to overcome). Such cluelessness, however, is not and should never be a reason for censorship. A need for attention can be overcome by refraining from the denial that the need exists, followed by careful observation of that need. More can be said on this, but this is not the forum. Such a need is not and should never be a reason for censorship. Idelological opposition is another matter entirely. To understand this better, we'll need to observe this in action. Here is an example: > Vulis portrays himself as a victim, but as I posted to the list > last week, I disagree. Anyone who's spent any time on the > 100-plus-messages-a-day list can read for themselves the kind of nasty > daily messages that came from Vulis's keyboard. "Nasty" is, of course, by this reporter's standard of "nasty". Granted this standard may in fact be shared by Mr. Gilmore, however a shared standard is not necessarily an appropriate or correct standard. > The list is on Gilmore's machine and he can do what he wants with > it; he can moderate the postings, he can censor material, he can > shut the whole thing down. By kicking off an offending user, a > list owner merely exercises his property right. There's no > government involvement, so the First Amendment doesn't apply. And > the deleted, disgruntled user is free to start his own mailing > list with different rules. Notice how, once the opposition is admitted to, the rationalization begins. Suddenly this is not a matter of censorship, but of ownership. Just as suddenly, the classic anti-free-speech arguments of "if you don't like it, start yer own" begin to surface. (Anyone ever notice how this resembles the "love it or leave it" mentality of certain American patriotic organizations?) What would ideological opposition be without the attempt at analogy? Here we witness another example: > But then the question is whether Gilmore should have exercised > that right, especially in such an open forum. Again, I think Gilmore's > actions were justified. Consider inviting someone into your home or > private club. If your guest is a boor, you might ask him to leave. If > your guest is an slobbish drunk of a boor, you have a responsibility > to require him to leave before he ruins the evening of others. Notice that the net is compared to a home or private club. Actually the net is neither, however that would not serve the purposes of this analogy, so this fact is convienently forgotton. The net is a wonderful place. Any ideology, no matter who disagrees or agrees with it, can be expressed and discussed here...assuming those who oppose this ideology do not have their way with the source of expression. There is a more refined and deeper truth to be found in the very existence of the set of all human ideologies, which is just beginning to show itself to some netizens. Unfortunately, this truth can be ruined when people equate some notion of value to sources which ignore all but a tiny subset of the set of all ideologies: > Eugene Volokh, a law professor at UCLA, runs a number of mailing > lists and has kicked people off to maintain better editorial control. > Volokh says that the most valuable publications are those that > exercise the highest degree of editorial control. Value to whom and for what? If the editorial control produces one small element of the set of all ideologies, then this is only of value to the people who support this ideology. Given that the set of people who support an issue is smaller than the set of people who support and oppose an issue, would the value not increase by allowing both sides of an issue equal speaking time? > For his part, Gilmore calls removing the Russian mathematician "an > act of leadership." He says: "It said we've all been putting up with > this guy and it's time to stop. You're not welcome here... It seemed > to me that a lot of the posts on cypherpunks were missing the mark. > They seemed to have an idea that their ability to speak through my > machine was guaranteed by the Constitution." It is sad to note that this is the leader of one of America's forerunning organizations of freedom who says these words. For all *his* ideology of free speech, this statement reveals the hypocrasy he lives with for all to see. The true litmus test of free speech is to encounter speech that you *want* to censor. Mr. Gilmore, and other like minded parties, might want to consider what would happen if one parent company owned *all* communications media. Would they they be so supportive of the ideology of ownership and communciation they espouse? ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Truth (n.) - the most deadly weapon ever discovered by humanity. Capable of destroying entire perceptual sets, cultures, and realities. Outlawed by all governments everywhere. Possession is normally punishable by death.

10 18

Re: Exon Countdown Clock and farewell messages
by Sean Roach 17 Dec '03

17 Dec '03

At 09:59 AM 11/8/96 -0800, Michael Page wrote and Rich Graves forwarded: >> ... >> >We would attempt to send it via a Email, but the respected Senator does not >> >have Email. (The Irony). >> ... To Which, on Mon, 11 Nov 1996, I wrote: >> There is no irony here, Mr. Exon tried to control the internet for the very >> reason that he didn't understand it and one of his granddaughters did. >> Perhaps if he did understand the internet then he wouldn't be a threat. >> Remember, people fear that which they don't understand. To which, at 07:57 PM 11/12/96 -0800, Declan McCullagh wrote: >I disagree. I think people understand the printing press and still want >to control it. Morality police are morality police, no matter what the >medium or how well they understand it. A valid point, and Exon may have had designs of media control the whole time. The methods he used and the arguments he stated, however, suggested to me, that he was someone who did not comprehend the technology. Those who he was able to sway with the dossier of .GIF's certainly were ignorant, many of them were turned by that one display of images.

1 0

CDT's Jonah Seiger on ISP-TV's "Real Time"
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: Live interview with Jonah Seiger, Policy Analyst for the Center for Democracy and Technology *** *** Monday, Nov. 18 *** *** 9:00 PM ET *** Jonah Seiger, Policy Analyst and online organizer with the Center for Democracy and Technology (CDT), will be on ISP-TV's "Real Time" interview series this monday night. Seiger has been very active on both the crypto rights front and opposing the Communications Decency Act. He worked with Senator Burns to put the first Congressional Hearing on the Internet, played a key role in organizing an online petition which generated over 115,000 signatures in opposition to the CDA, and helped to organize the "Black Thursday Protest." We will ask Jonah questions about what the future of crypto regulation will be in the next Congress, and the efforts of the Citizens Internet Empowerment Coalition (CIEC) in fighting against the CDA in the Supreme Court. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 07:31 PM 11/12/96 -0800, Vladimir Z. Nuri wrote: ... >actually, there are some amusing things going on here with cpunk >"rules." are cpunks in favor of pseudonyms or not? one famous >cpunk madman wrote under a pseudonym to the list, and many >cypherpunk went to great lengths to try to derive his identity. >is this a case of respecting pseudonyms? or is it more a case of >the double standard at best, hypocrisy at worst, >"respect my pseudonyms, but yours are fair game"? ... Cypherpunks try to break each others crypto as well, in an attempt to evolve crypto to the point that it is not crackable. Perhaps you would like to make pseudonyms easier to protect. If you developed a pseudonym and gave it its own public/private key pair, and if people bothered to check your signatures with the appropiate sources, then you should be able to protect it. Of course, I just assume that those on the list are who they say they are, I have e-mail access on the schools LAN, and PGP on the machine in my room. There is an air gap between the two, so getting a key requires a two way trip. I may start validating in the future, but I don't now. The point I was trying to make is, is "cracking" of pseudonyms any different than cracking of algorythims?

2 1