December 2003 - cypherpunks-legacy

EFF WANTS YOU TO CALL FOR SENATE HEARINGS ON CLIPPER
by Mike Godwin 17 Dec '03

17 Dec '03

EFF WANTS YOU TO CALL FOR SENATE HEARINGS ON CLIPPER *** Distribute Widely *** Feb. 15, 1994 Dear Friends on the Electronic Frontier, Thank you for your efforts in fighting the government's ill-considered Clipper proposal. We have already delivered over 2250 messages supporting H.R. 3627 to Rep. Cantwell, and your messages have continued to flood in. We'd now like to ask you to help us call for Congressional hearings on Clipper by writing to Senator Patrick Leahy c/o leahy(a)eff.org. As we have previously reported, the Clinton Administration has announced that it plans to proceed on every front to make the Clipper Chip encryption scheme a national standard and to discourage the development and sale of alternative powerful encryption technologies. If the government succeeds in this effort, the resulting blow to individual freedom and privacy could be immeasurable. So far, the government has resisted requests that it explain its policy. When the Presidential Decision Directive calling for Clipper deployment first appeared last spring, the Administration promised a report that re-evaluated cryptography and privacy policy in light of technological changes, the coming of the National Information Infrastructure, and the end of the Cold War. The Administration also made a commitment to meaningful public dialog before taking any major action on escrow deployment or new legislation. Yet in spite of the efforts of EFF, CPSR, ACLU, and other groups to provide extensive input to the Administration, the promised policy report never arrived, and the Administration has now said there will be no report after all. This failure of public accountability makes Congressional hearings an absolute necessity. There are individuals in Congress willing to look into the Clipper proposal and related policies--if they hear from you. Senator Patrick Leahy (D-Vermont), who chairs one of the key committees responsible for these issues, has asked for comments and concerns about the viability of the Clipper initiative. Here's where we need your help. *Please write Senator Leahy at leahy(a)eff.org and ask that the Senate hold hearings about Clipper.* Senate hearings may be the only means of ensuring public feedback about Clipper, and, just as important, they may be the only means of forcing the Administration to explain its Clipper policy. Please express your concerns about the United States' Clipper policy and cryptographic policy in general. Your letters in support of hearings will be printed out and delivered to the senator. And if you haven't written Rep. Maria Cantwell to show your support for H.R. 3627, her bill to relax export restrictions on encryption technology, now's the time to do so. Just send e-mail to cantwell(a)eff.org and put "I support H.R. 3627" in your Subject header. Letters in support of the bill will be printed out and delivered to Rep. Cantwell. Our fight to keep national encryption policy out in the open--and to continue allowing individuals to use encryption to ensure their own privacy--has only just begun. In the coming weeks and months, we will be working to give you more ways to make your voice heard on these vital public issues. Sincerely, Jerry Berman Executive Director Electronic Frontier Foundation

1 0

Re: AT&T stopped talking to me
by a2＠ah.com 17 Dec '03

17 Dec '03

I've had extensive experience with hardware vendors, and the behavior you describe is extreremely anomalous. It is just barely possible that your rep has quit, and his replacement hasn't picked up the slack yet. On just the basic problem of getting the data sheets, you might have better luck calling AT&T's literature department directly. This works very well if you have the part number of the data sheet, but just the part's id should get you the info. If the part is more than a few months past announcement, it's data sheet has probably been bound up with a whole lot of other data sheets and printed in some family book, which might be easier to ask for, and give you some alternates to consider. Or, you could ask some smiley friend ;+> to try to get the information for you. Buying the part shouldn't be as hard, they are required to sell to you. However, if you are experiencing politics, beware of such things as deliverly delays and a high percentage of bad parts in your shipment. Going through a distributor is probably enough to avoid most of these problems. So, when can I buy your gadget? -a2

1 0

NSA lobbying for Clipper in Europe
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

from sci.crypt... The following article was printed on page 10 of the UK's `Independent on Sunday' (13th Feb 1994). It would seem that the tentacles are spreading. For those who haven't read it, James Bamford's book `The Puzzle Palace' contains a fascinating history of the incestuous relationship between the NSA and Britain's GCHQ. No official UK opposition can be expected. Follow-ups to talk.politics.crypto please. ---------------------------------------------------------------- How America Plans to bug the electronic age BIG BROTHER JOINS SCRAMBLE FOR DATA By Leonard Doyle A high-ranking official of the National Security Agency, America's largest and most secretive intelligence arm, is in London with the task of selling the 16 governments of the European Union and European Free Trade Association on the virtues of a controversial electronic scrambling technology. The Clinton administration hopes that the encryption devices will become the global standard for anyone wanting privacy while using cellular phones, computer networks and fax transmissions. They have a serious drawback for anyone looking for total privacy, however. The devices have a built-in `back-door' that will allow spy agencies to listen in on all communications, or read faxes and electronic mail. Spy agencies in the US and Europe, with nearly 50 years' experience of advanced technology in surveillance of citizens, suspected criminals and foreign governments, have been concerned for some time about developments that have put sophisticated encryption devices within reach of many. The agencies want to ensure that they are not left behind by the rapid advances in high technology which have made telephone scramblers and the mathematical codes used to encrypt computer and fax data relatively cheap and easy to use. The governments fear that electronic eavesdropping will be set back decades if and when terrorists, money-launderers, drug traffickers and unfriendly governments gain widespread access to the technology. The NSA is concerned that, despite the $30bn (UK Pounds 21bn) a year it spends monitoring global communications, it cannot keep pace with technological change and the massive spread of encryption codes. The NSA official, James Hearn, who until recently was the deputy director for information security at NSA's sprawling headquarters near Washington DC, is heading up a `liaison office' in London with a colleague, Clint Brooks, according to reliable sources in the computer security community on both sides of the Atlantic. The US Embassy in London issued a pro forma denial about Hearn's presence yesterday, saying: "There's nobody by that name here." Mr Hearn is well known, however, to UK and European officials at the cutting edge of efforts to control the spread of highly sophisticated scrambling devices. These encryption codes, developed by private software companies, are putting communication beyond easy reach of the NSA, Britain's GCHQ at Cheltenham and France's DGSE, to name but a few `Big Ear' agencies. As a response, the US has developed an encoding device for telephones and computers known as the `Clipper Chip', with a `back door' that will allow spy agencies armed with special electronic keys to eavesdrop. When the Clinton administration decided to press ahead with the controversial coding devices last week, the computer industry and privacy campaigners reacted with outrage. "It's like trying to order people to use only resealable envelopes for correspondence, so that no communication can ever be private again," said David Bannisar of Computer Professionals for Social Responsibility. Big computer companies, including IBM and Apple, are bitterly opposed to the new monitoring devices. But AT&T, the US telephone company, which is fast establishing itself in Europe, will put the eavesdropping technology into the telephone scrambling devices it sells in high street shops for about UK Pounds 800 each. The US is keen to ensure that similar electronic monitoring technology becomes standard in the rest of the industrialised world. The NSA's Mr Hearn has the task of persuading governments that the controversial Clipper Chip for telephones and a technology called Tessera, for computer modems, is quickly adopted, despite mounting opposition. The US, European Commission and four European Union countries - Britain, Germany, France and the Netherlands - are already deciding how to administer the dawning electronic age of `information highways' which will bring an explosion in the use of hi-tech in everyday lives. A consultant to the European Commission who has worked on the new encryption standards claims that those who object to US efforts to regulate the market for encryption are `politically naive'. "Whether we like it or not, the authorities will want to listen in on our communications," he said. "The Americans are to be admired for being up front about it, when other countries are doing the same thing anyway." Experts in the field of information security often speak of physical boundaries that now define the world being replaced by electronic boundaries. In this Orwellian world, which is at most five years away, people will be issued with so-called `smartcards' with microchips that can store their entire personal history. The identity cards will be a passport for ordinary citizens, used to store health records, for personal banking, paying for travel and for identity checks at borders. In the same way, companies and even countries will be expected to use technology like the encryption Clipper Chip for date transmissions. "We are defining our new electronic world - which will become increasingly important in a borderless Europe," the EU security consultant said. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Ameritech announcement
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ameritech first in nation to detail plans to open local network Ameritech has become the first communications company in the nation to volunteer to open its local network to competitors. Ameritech today submitted tariffs to the Illinois Commerce Commission (ICC) that specify how it will open its local network to competitors in Illinois communities where it is the primary telephone company. If approved, the tariffs will go into effect when Ameritech is authorized to enter the long distance business. "We believe that our customers want and deserve the choices that only all-out communications competition can deliver," said Dick Brown, Ameritech vice chairman. "No court ordered us to do this. No regulators mandated that it must be done. Ameritech initiated the idea as a way to better serve our customers and we now have delivered a detailed blueprint for getting the job done." When the changes that Ameritech has proposed are implemented, a competitor, subject to regulatory approval, can use portions of the Ameritech network to provide local telephone service. Thus, the competing company on its own can provide all of the capabilities necessary to offer local communications services, or it can obtain from Ameritech the capabilities that are needed but which it chooses not to provide itself. "The positive regulatory environment in Illinois favorably positions this state and its citizens to lead the way on the information superhighway and to be among the first to reap the economic benefits of communications competition," said Doug Whitley, president of Ameritech Illinois. Specifically, Ameritech's Illinois Commerce Commission (ICC) filing proposes procedures, technical specifications and prices. It describes how competitors can: - - Obtain access to Ameritech's local distribution network in Illinois (the local loop) so that they can use the Ameritech links to reach customers' homes or offices. - - Purchase from Ameritech the local switching capability. - - Integrate their local switches and networks with the Ameritech network. The Ameritech filing also provides details of a process under which an Ameritech customer in Illinois can choose to have a single company handle local and long distance calls. Ameritech's quid pro quo for fully opening its local network to competitors is straightforward: Ameritech wants new regulations geared to a competitive marketplace and the freedom to provide long-distance services. When Ameritech's plan to fully open the local network to competitors is implemented, all-out competition, market-driven prices and accelerated innovation will shape communications marketplaces in the portions of Illinois the company serves. "Ameritech should be a full participant in the new communications world that is emerging. We want the flexibility to serve its customers as they want to be served," said Brown. "As customers' needs become more sophisticated and voice, data and video industries converge, opening access to all networks is necessary for a fully competitive communications marketplace." "The same rules should apply to all players -- providers of voice, video and data; long distance or local service," he said. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWJ0FtCcBnAsu2t1AQF3EAQAhqNcBIwBF1p8IxqwBWm/ZFui7KR8VWV9 bm1d6531kXoXt6wA7qaKqnZ8KvAfjCKxmEgBQ3OFCB9jYkyBB6/DRByNyb/agldS trTdUn48LZgsm4IP2Kr1O0Ds2J17droUS7bljNhrohjtCIoVY1UU8sOoefxMqlKG DRxjEEmCT58= =IMpJ -----END PGP SIGNATURE-----

1 0

New Crypto product & other ramblings
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

I think the only way to prevent Clipper is pre-emptively. The advantages of Clipper are twofold: Gov't volumes may drive the price down The Algorithm is fast, and the silicon required to implement it is small. Modular arithmetic is (belief here, not fact) bigger, slower, and more expensive. There is enough knowledge, experience, and money on this mailing list to design an encryption chip to compete against Clipper. It would be better if we could just buy them- maybe that will happen. SGS-Thompson has just announced a smart-card chip with Modular Arithmetic Processor (ST16CF54) developed by an Israeli company, Fortress U&T Ltd. It's optimized for 256 and 512bit exponentiations, but can handle 1024 bit. It sounds like this is just for public key signature verification- it can't encrypt or decrypt at high speeds. Anyone know more about this product? (ref. EEtimes 2/14/94 pg 20) ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Re: Clipper and Traffic Analysis
by smb＠research.att.com 17 Dec '03

17 Dec '03

Speaking of phone records and such, btw, AT&T keeps phone records for quite a long time. About half a year or so my girlfriend visited her relatives in Hong Kong and I called her there to save them some major money. A few months ago, I get a letter/offer from AT&T saying that I could save over xxx% on calls to HK, Taiwan, etc... Now, I'm a white boy and my name would give them absolutely no hint of having relatives or friends in Hong Kong. Obviously they keep records for waaaay far back, and keep them in use!!! If they use'em for advertising, you can bet they use them for other shady "law-enforcement" type info for cops, etc.... That's a fairly strange conclusion to draw. In fact, I was originally going to use a much stronger word than ``strange'', but I forbore to change my standing policy against flames. Why, pray tell, do you think that because AT&T uses its own information, that it gives it to the government? For one thing, that would be illegal, as I read the law. 18 USC 2703(c)(1)(A) specifically prohibits giving out records of subscriber information to government agencies, except in reponse to a subpoena, warrant, or court order. (Oddly enough, it is permissible to give out the information to non-government agencies; if I recall correctly what I've read of the legislative history of the act, that was specifically intended to permit compilation and sale of mailing lists and marketing data.) For another, it isn't at all clear to me that it's in any way unethical for a company to understand which of its products its customers buy. *Selling* such data is another matter -- I don't like that at all -- but that isn't what you're claiming. You also say that AT&T is not using racial data or certain names to pick out markets. All you're saying is that you once called Hong Kong, and that AT&T is now offering you a cheaper way to do so. What's wrong with that? (Btw -- half a year is not at all a long time. That's only very slightly longer than they'd need to keep the data just to resolve billing questions.) --Steve Bellovin Disclaimer: Obviously, I work for AT&T. That doesn't mean I like everything the company does -- but in this case, I fail to see the offense.

1 0

No Subject
by solovay＠math.berkeley.edu 17 Dec '03

17 Dec '03

Eric writes: Yeah, the internet technology is changing. ATM is coming. Query: What's ATM? --Bob Solovay

4 3

Re: Misc replies
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greg Broiles wrote, >I second Hal's suggestion to route Detweiler's traffic through Xenon's >remailer. >(Xenon - the point isn't to keep Detweiler off the net. We all know >that's impossible. The point is to keep Detweiler from getting remailers >shut down by abusing them. That's why this is particularly unlike >censorship; Detweiler's goal is to keep all people from using remailers.) Sure, send me YOUR garbage. Why isn't Larry abusing MY remailer? This peer pressure is childish. I no longer really need qwerty as a remailer, and will happily shut it down as soon as YOU people start abusing it. I admit I created a lot of negative feelings out there with my statement that I didn't want to block Larry's addresses. However, say I retract that statement, and say I do not want to block him, but that I AM willing to give into such peer pressure and try TO block him? I now ask you to, with compassion, educate me about how the arguments I express against the MEANS you tell me to use, are not valid. I don't mind blocking the address of some undergrad who is sending silly stuff to Usenet, but must I always have to demonstrate to you things that I cannot seem to convey in words? OK. I shall write a script to telnet to port 25 of a given remailer, and forge mail from various non-existent addresses at Netcom. They will include names like "S.Boxx(a)netcom.com", "Executioner(a)netcom.com", and "Fuckyou(a)netcom.com". What will you do then, block incoming from netcom.com? Yeah right ;-) ! I sent myself mail this way via Hal's remailer. It WORKED. Larry knew how to do this when I was still trying to work my newsreader. Again, as I have said before, it is my feeling that all of our trying to block Larry's current known addresses will only fuel the fire, and next time he will REALLY cause problems. He isn't a stupid guy. And he IS the type of person who if you fight him, he will fight back with more energy than before. So far I am not impressed with the level of sophistication in the words I hear coming from the remailer operators and other interested parties out here. We need an ABUSE filter, not a Detweiler filter, for with current sendmail, we CANNOT block a determined person from abusing the remailers. And it is my belief that trying to do so will renew their fanaticism and dedication to upsetting the remailers. He already seems to have a new anon.penet.fi address. He can have as many more as he wants, brand spanking new, by telnetting to anon.penet.fi 25 and faking his address. I have tried this and it too WORKS. Give me a real solution, one that will not make the problem WORSE. Many of you out here remind me of government bureaucrats, in how you want to try quick very short term fixes, which in the end only backfire and make the problems worse. You think Larry isn't willing to fork over $20 to get a Netcom account and then spend another $50 to buy e-postage, then send out much MORE damning abuses (since you made it harder for him to do damage by quantity alone), this time

1 0

Re: Misc replies
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

I'll try this again; Netcom has this nasty habit of just dying for 10 minutes at a time right in the middle of my pasting e-mail. -----BEGIN PGP SIGNED MESSAGE----- Greg Broiles wrote, >I second Hal's suggestion to route Detweiler's traffic through Xenon's >remailer. >(Xenon - the point isn't to keep Detweiler off the net. We all know >that's impossible. The point is to keep Detweiler from getting remailers >shut down by abusing them. That's why this is particularly unlike >censorship; Detweiler's goal is to keep all people from using remailers.) Sure, send me YOUR garbage. Why isn't Larry abusing MY remailer? This peer pressure is childish. I no longer really need qwerty as a remailer, and will happily shut it down as soon as YOU people start abusing it. I admit I created a lot of negative feelings out there with my statement that I didn't want to block Larry's addresses. However, say I retract that statement, and say I do not want to block him, but that I AM willing to give into such peer pressure and try TO block him? I now ask you to, with compassion, educate me about how the arguments I express against the MEANS you tell me to use, are not valid. I don't mind blocking the address of some undergrad who is sending silly stuff to Usenet, but must I always have to demonstrate to you things that I cannot seem to convey in words? OK. I shall write a script to telnet to port 25 of a given remailer, and forge mail from various non-existent addresses at Netcom. They will include names like "S.Boxx(a)netcom.com", "Executioner(a)netcom.com", and "Fuckyou(a)netcom.com". What will you do then, block incoming from netcom.com? Yeah right ;-) ! I sent myself mail this way via Hal's remailer. It WORKED. Larry knew how to do this when I was still trying to work my newsreader. Again, as I have said before, it is my feeling that all of our trying to block Larry's current known addresses will only fuel the fire, and next time he will REALLY cause problems. He isn't a stupid guy. And he IS the type of person who if you fight him, he will fight back with more energy than before. So far I am not impressed with the level of sophistication in the words I hear coming from the remailer operators and other interested parties out here. We need an ABUSE filter, not a Detweiler filter, for with current sendmail, we CANNOT block a determined person from abusing the remailers. And it is my belief that trying to do so will renew their fanaticism and dedication to upsetting the remailers. He already seems to have a new anon.penet.fi address. He can have as many more as he wants, brand spanking new, by telnetting to anon.penet.fi 25 and faking his address. I have tried this and it too WORKS. Give me a real solution, one that will not make the problem WORSE. Many of you out here remind me of government bureaucrats, in how you want to try quick very short term fixes, which in the end only backfire and make the problems worse. You think Larry isn't willing to fork over $20 to get a Netcom account and then spend another $50 to buy e-postage, then send out much MORE damning abuses (since you made it harder for him to do damage by quantity alone), this time with real religious zeal, since now he has gotten you guys to finally fight back, and as you must realize, he takes this all VERY seriously. And after all, isn't our installing ABUSE filters what Larry is trying to tell us to do in the first place? I do not find this an unreasonable request. It is a wonderful solution that avoids accountability problems, after the fact, upon someone posting an abusive message to Usenet, since they are unable to post such an abuse in the first place. Why don't we appease Larry? How? The answer is painful and obvious: Moderated remailers. You already have to trust the remailer operator with your privacy. E-postage is a fun idea especially for ME ;-), but the logistics and loss of traffic are real problems. Besides, I can't charge as much for a Netcom remailer, as it is not as secure as some others. Is it not unfortunate that an AI program cannot ever hope to accomplish what the human eye and brain can do in a millisecond? Hit a 'd' key in responses to abusive mail. Send me such a script! Until Usenet is fully moderated, and realize that MOST people on Usenet do NOT feel like pandering to "those cowards and irresponsible people afraid to use their real names". THAT is the attitude out there. There must be moderation, if only for remailing to Usenet. Since such moderation is unlikely in the next year, for all of Usenet, the moderation must lie within the remailers. Yes, anon.penet.fi has survived without this, but Julf keeps people's REAL addresses on his hard disk, and keeps FULL logs (not content though). Still, it is possible for Larry to send out a hundred Usenet posts, by forging e-mail to anon.penet.fi. Fortunately for Julf, he is busy enough upsetting us. If full moderation not be practical, then fairly smart scripts for detecting abuse could do SOME good. Certainly a barrage of posts to Usenet could be detected and blocked. But that only causes someone to post more damaging posts in fewer numbers. "I am afraid of knowing the truth, for when you offer it to people, they call you mad." -=Xenon=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLWI1bASzG6zrQn1RAQHPEwP/Wf/jCuEV6sE9vs89NvC25T1ejBrr6nxq +65zorNvaSpaTYJraH5kD7NHSerXX5XlNKllG10RoqwnpjwQ56FCsVQzqDrkYH+9 DXk5VP2ay0B0DFIRxgTGXhl4fXi6K6bjiS4dRi4AxvnOeZaGlzTQMu1CGJJZ1pNk Cv+P0X/rYcw= =tO7R -----END PGP SIGNATURE-----

1 0

Big Brother PostScripts
by Robert A. Hayden 17 Dec '03

17 Dec '03

Thanks to some help, I have the Big Brother PostScript but have reduced its size so that it is about 1" x 1" or so (no ruler, just a guest). This is a perfect size for printing on stickers, letterheads, etc. If anyone wants a copy, please drop me a line and I'll be happy to mail it to you. If someone at cpsr.org wants to put it up for FTP, please also contact me and let me know where to upload it to (or if you want me to email it to you.) [As a side note, I'm thinking of breaking into the lab some night and putting these stickers on all of the workstations. Just thinking about it, not actually going to do it :-)] ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0