December 2003 - cypherpunks-legacy

Brookings Inst. on crypto: "There are reasonable compromises"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 18 Jul 1997 09:17:52 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: Brookings Inst. on crypto: "There are reasonable compromises" Morton's Steakhouse is a true Washington institution. Nestled in the heart of lawyer country, between K and L streets, the clientele are well-heeled lobbyists hungry for red meat. Which is all you'll find at Morton's, where the menu lists a fine selection of slabs, all thick, bloody, expensive. I had lunch at Morton's yesterday with a colleague, a fellow from the NSA, and a gentleman from the armed forces. We talked Net-regulation, censorship, and hacking. Most of all we talked encryption, and crypto-compromises. This is a theme you'll see repeated in this recent policy paper from the liberal Brookings Institution: There are reasonable compromises. A useful place to start is a national cryptography policy... rigorous oversight and accountability for government access to the keys needed to intercept and read coded data, negotiation of an agreement with our close allies on a global encryption standard, and formation of a government/private sector oversight body... the basic elements of a reasonable compromise are now in sight and may yet be achieved... Current initiatives that would allow export of any technological solution, of unlimited strength, subject only to the proviso that an acceptable key recovery system be maintained with a suitably defined and trusted party (including self-escrow), are headed in the right direction... -Declan ------------------ no. 21 Deciphering the Cryptography Debate July 1997 By Kenneth Flamm FOR THE PAST FIVE YEARS, the U.S. government and America's information industries-producers and users of computers, communications systems, software, information services-have been locked in a bitter and highly technical battle over cryptography policy: the rules of the game for techniques used to scramble and unscramble data. Such encryption and decryption is vital in maintaining the confidentiality of information (whether business information, financial transactions, personal medical records, or government secrets) passing through the exploding web of computer and communications links joining this nation together. The hard fought and often arcane debate has come to an inconclusive and unsatisfactory draw that does little to deal effectively with any of the conflicting objectives-civil liberties, economic competitiveness, law enforcement, and national security-brought to the bargaining table. This does not have to be. There are reasonable compromises. A useful place to start is a national cryptography policy built around four key elements-strong cryptography put into wide use, a strengthened legal framework and electronic logging system that provides rigorous oversight and accountability for government access to the keys needed to intercept and read coded data, negotiation of an agreement with our close allies on a global encryption standard, and formation of a government/private sector oversight body to review both the overall security of our national information infrastructure and the voluntary testing and certification of encryption and security products. Why Is Cryptography Important? UNTIL THE MIDDLE OF THIS CENTURY, codemaking and codebreaking were primarily the concern of governments protecting diplomatic and military communications. World War II was a turning point for cryptography. The first primitive electronic computers were built by the United States and Britain during that war and used to break German and Japanese codes. Using technology and methods that remained closely guarded military secrets until the late 1970s, the Allies succeeded in building electronic machines to break the supposedly unbreakable codes used to encrypt virtually all Axis radio messages. This allowed the Allies, for example, to read signals sent by German submarines as they reported their locations, send forces to destroy them, and win the vitally important battle for the North Atlantic shipping lanes. After the war, U.S. codebreakers continued to play a central role in the development of the fastest possible computers of the day, so-called supercomputers. In the late 1960s, others in the military funded research into damage-resistant digital communications networks that gave us the first working prototype of today's Internet. As computers and network use also took hold within business in the 1960s and 1970s, cryptography (mainly the domain of government in earlier decades) increasingly began to protect sensitive business information stored in private sector computers. With outside computer links through communications networks growing, the dangers of unauthorized penetration into sensitive computer databases through these external ties also multiplied. The financial sector led these technological changes. As global financial markets, national banking systems, and local automated teller machines all went electronic, cryptographic systems were installed to protect sensitive data coursing through the digital arteries of finance. Today, we are teetering at the precipice of an even wider transformation of the basic infrastructure for commerce. Telecommunications services, retailing, and the electric power grid are already organized around vast computer networks. Multinational companies link global operations over international networks. By 1999, all U.S. government benefits will be paid electronically. Doctors will access data and communicate remotely with patients, businesses will buy services from consultants, contractors will sell to government, researchers will provide policy advice, seminars will be organized-all over computer networks. Vast savings in time and resources and improvements in business productivity seem possible. For this leap forward in our economic infrastructure to be realized, however, the information running through the system will have to be authenticated, verified, protected from unauthorized access, and guarded against witting or unwitting corruption. Equally profound changes are going on within the military establishments whose investments initially spurred the computer revolution. Our post-Desert Storm military forces are as dependent on complex computerized command, control, and communications networks as commercial industry. The Defense Department is today groping toward an information technology-based Revolution in Military Affairs, a future in which sensors, intelligence databases, command and control systems, precision munitions, and smart weapons platforms are seamlessly linked together in real time to deliver measured military force swiftly, surely, and over great distances. In contrast to the situation of forty years ago, enormous private sector investments are today driving the engine of information technology, with the military largely drawing on commercial technology for its particular variant of the information revolution. Commercial and military computer and communications systems-like the core industrial infrastructure underlying modern military power-are hopelessly intermingled within the sinews of the U.S. information economy. A new term, information warfare, explicitly recognizes that an attack designed to disrupt our military capability or will to fight is as likely to target nominally civil infrastructure, like telecommunications networks, the electric power grid, the banking system, or air traffic control, as any purely military system. Widespread use of effective cryptography to secure and protect the rivers of data flowing through computer and communications systems is needed now to enable the further development of the information infrastructure for tomorrow's high-tech economy and to protect military capabilities dependent on that same information infrastructure. What Are the Issues? The heated debate over cryptography policy is fundamentally driven by rapid technological change. The price of computing power has been dropping 20 to 30 percent annually over decades now, an order of magnitude greater than anything measured during the first great Industrial Revolution of two centuries ago. Computing power is used to both make and break codes, and as the cost of computing power plummets, cryptographic systems that once offered adequate protection for data become insecure. By the same token, however, cheaper computers also make it cost effective to encrypt data where once it would have been uneconomic. Paradoxically, then, plummeting computing costs have both enabled the widespread use of encryption to defend information security and increased the ability of moderate to large organizations (in the private sector and governments) to afford the computing resources needed to successfully attack once-capable encryption systems. To balance these shifting forces, the United States must grapple with multiple and often conflicting objectives. First, there are constitutional issues. On the one hand, the United States has a well-established tradition of respect for privacy and civil liberties that is a bedrock of our society. On the other hand, there are few absolute rights-under court order, communications can be legally intercepted, and private homes may be entered and searched. Encryption-like "speaking in tongues"-might even be interpreted as a form of speech and offered the greater protection that freedom of speech enjoys. Historically, the government has not attempted to control the use of encryption within domestic U.S. borders but instead limited its export overseas. Similarly, court orders are required to lawfully intercept domestic telephone conversations, but not for foreign traffic. The legal framework protecting data communications-including encryption of data-has not changed to address the many new channels for expression (and surveillance of expression) opened up by the computer revolution. It is now appropriate to establish an organized and systematic legal framework for our information society. Second, we need to use strong cryptography to enable electronic commerce on the burgeoning information infrastructure that is going up all around us. The potential economic benefits from moving forward rapidly to locate our businesses on the information superhighway seem large. Without ironclad security, however, no business is going to drive its sensitive data up the on-ramp. Strong cryptography is a small but vital piece in the systems that will provide information security. Third, U.S. companies are world leaders in computers and communications, where success in global markets is an essential ingredient in maintaining competitive advantage. But the market for information technology is one in which capable foreign competitors stand ready to pick up the baton of technological leadership should American firms stumble. The economic preeminence of U.S. information technology companies-and the resulting benefits to the U.S. economy-are arguably at risk should U.S. producers be blocked from selling important technology that is available from foreign competitors. Law enforcement objectives, in contrast, argue for controls on use of strong cryptography (while recognizing that cryptography also protects against electronic crimes). Since the dawn of the age of telephony, lawful wiretapping has been viewed as an essential tool for police, the legal extension of the right to enter and search under warrant. In the information age, with the proliferation of digital technology, cryptography has the potential to deny police the lawful access that they now enjoy to voice and data communications. National security has been another powerful argument for limits on encryption. Though not often discussed openly, interception of foreign communications traffic is in all likelihood one of the most valuable and reliable sources of intelligence for defense and foreign policy purposes. Routine use of strong and difficult-to-break cryptography in, say, the global public telephone network would be a nightmare scenario for both law enforcement and the intelligence community. But we should also recognize that while global availability of strong encryption may limit our offensive gathering of foreign intelligence and perhaps in the future, offensive "information warfare," the global economic success of U.S. information technology producers also has a positive value for offensive intelligence gathering. Even the strongest encryption technology may be rendered vulnerable by the way it is administered and used. A global marketplace dominated by the products of the United States and its allies-which will be well understood by a substantial community of American technologists-will be much more transparent to allied intelligence gathering than a world market dominated by the unfamiliar and poorly understood products of others. And strong encryption, even if pervasive and unbreakable, will nonetheless have a positive national security value in protecting U.S. information from the snooping of adversaries, political and economic. It will also have significant value as a defensive rampart against the information warfare offensives of adversaries. Arguably the United States, now reliant on the most advanced and pervasive information infrastructure in the world, is also the nation with the most to lose to disruption by a successful offensive attack. Finally, we must acknowledge that as more and more aspects of our personal and economic lives are connected to, and accessible over, the information superhighway-things like medical records, corporate accounts, personal travel plans, even daily calendars and diaries-the "wiretapping" metaphor for permitting government access to electronic information begins to break down. It is no strain to forecast a not-too-distant digital future in which almost everything-all sorts of personal information, records, even art and music-is stored or communicated electronically, connected to or accessible through some computer network. As the Worldwide Web reaches out to encompass all aspects of our lives, a surreptitious government access hatch begins to resemble a special door built into the basement of our homes through which government can enter without our knowledge or consent. Our Constitution's protections against "unreasonable searches and seizures" should be our guide as we chart these deep and unknown waters. Government access to private information should be governed by clear rules that "we, the people" make after open debate. Even in simpler times, there have been occasional but deeply disturbing instances in which individuals in government have abused powers granted for legitimate law enforcement and national security purposes. As pervasive electronic tendrils from the information superhighway reach into the nooks and crannies of our lives, the potential damage from poor judgment (or worse yet, corruption) by some individual in government will be enormous. It is vital that a system with clear guidelines and strict accountability be put into place to oversee our national encryption policy as we strike a balance among the multiple, legitimate objectives. Where Are We Now? In the late 1970s, industry, in collaboration with the U.S. government, developed a Data Encryption Standard (DES) based on coding keys (sequences of binary digits, or bits) that were 56 bits long. Though widely used today, steady advances in computer performance now make this system vulnerable (commercial supercomputers almost double in power every year, sufficient to "break" a key that is one bit longer in some given time). Much stronger encryption systems are used within the military and other parts of the U.S. government. Until 1996, the State Department did not readily permit the export of encryption systems using keys longer than 40 bits, which can be easily broken today. The Clinton administration, recognizing the need to promote commercial use of stronger encryption, unveiled such a system in April 1993 (actually developed under previous administrations but not publicly promoted). The system used special computer circuitry dubbed the "Clipper" chip, with decoding keys issued in two parts and held by two separate government agencies-within the Treasury Department and the Commerce Department. This Clipper chip initiative championed the concept of "key escrow," with government holding copies of the keys used to encrypt data, and argued for its voluntary adoption by the private sector as a solution to increasingly evident data security problems. Since only stronger encryption systems using the Clipper chip, or similar technology, were likely to be approved for export, critics argued that the system was not really voluntary. No U.S. multinational corporation would want to build and maintain two separate computer and communications networks-one for domestic use and one for international use. There were other practical objections. It was unclear how foreign governments would react to companies operating in their nations giving the U.S. government the keys to read encrypted communications, or even if this would be required. There was suspicion that the Clipper chip, with its proprietary government-developed technology, was not as secure as advertised and might even allow surreptitious government interception without appropriate legal safeguards. Even more important, there was concern that a government-mandated technical solution was being imposed on an industry that was far more capable and responsive to continuing technological change than any cobwebbed and inflexible government bureaucracy, and that industry itself through market forces was much better able to work out the best solutions to its information security problems. Furthermore, argued much of U.S. industry, increasingly capable foreign producers were beginning to market and sell encryption systems that were stronger than what U.S. industry would be permitted to sell in export markets. The net effect of administration policy, in this case, would be to tie the hands of U.S. industry and leave an important and growing segment of the information industry to foreign producers, free to sell any and all strong encryption products to customers anywhere. Stung by these criticisms, the Clinton administration withdrew and regrouped. In mid-1994, it offered up a new proposal in which "trusted third parties" within the private sector, rather than the government itself, would act as key escrow agents. This did little to silence industry critics. Finally, in 1996 the administration revealed a new plan and made some important changes in the direction of its policies. There would henceforth be no restrictions on exports of cryptographic systems-based on key length or technology-if those systems contained so-called key recovery features. That is, if U.S. exporters could demonstrate a viable plan in which trusted third parties (possibly including "self-escrow" within user organizations) would hold (and supply to government when presented "appropriate legal authority") information that would permit recovery of code keys and decryption of data, unrestricted export of such encryption systems would be allowed. Over an interim period of two years, exports of non-key recovery 56-bit cryptography systems would be permitted by producers demonstrating a commitment to develop viable key recovery systems. Cryptographic systems would be reclassified as a dual-use commercial product, rather than a munition, and export controls transferred from the State Department to the Commerce Department (though the Department of Justice would now play a new advisory role in the export licensing process). Finally, an explicitly international framework would be sought, with mutual access to national key recovery agents negotiated with foreign governments through carefully defined legal procedures. Though some in the U..S. business community continued to object, initial reaction was much more favorable than with previous cryptography initiatives. The government had worked with U.S. business in developing the new initiative, and a number of major U.S. computer and software companies voiced support for the general principles outlined in the initiative. (A system that enabled recovery of their own encrypted business data, in fact, was actually useful to companies in dealing with the risks of employee turnover.) Others took a wait-and-see approach. The wait was not a long one. Within months, a number of the proposal's initial supporters had publicly or privately defected as the details of its implementation were revealed. One major sticking point was the government's apparent desire to involve itself in frequent and detailed reviews of proprietary company business plans and progress in developing key recovery systems, as a condition for continued approval of interim exports of 56-bit systems. By mid-1997, some additional problems had become visible. A U.S. attempt at internationalizing the key recovery principle met only limited success: a draft policy from the Organization for Economic Cooperation and Development (OECD) recommended only that the issues be left to national discretion. While the United States, Britain, and France publicly supported the idea (and Japanese officials made it clear privately that they too would cooperate), opinion in Germany was divided, and other countries hesitated. Dueling bills-establishing a legal framework for key recovery, decontrolling cryptography export-were debated on Capitol Hill. On the face of it, another impasse was shaping up. In fact, however, with a little more flexibility and some degree of innovation, the basic elements of a reasonable compromise are now in sight and may yet be achieved. For the first time, the varied interests at stake are close enough to a workable solution to make establishment of a functioning and effective national cryptography policy a real possibility. Seeking Common Ground Four basic elements make up the core of what a national cryptography policy should do. First and foremost, strong cryptography-strong enough to resist the attacks that rapidly improving computer technology will continue to breed-must be available for routine business use. In an integrated global economy, this also means that it must be usable and exportable around the world. Current initiatives that would allow export of any technological solution, of unlimited strength, subject only to the proviso that an acceptable key recovery system be maintained with a suitably defined and trusted party (including self-escrow), are headed in the right direction. This will permit market forces to determine the most cost effective and flexible technologies, build in the ability to respond dynamically to continuing innovations in computer and communications technology, and yet maintain the ability of law enforcement and national security authorities to gain lawful access to encrypted communications when a critical national interest makes such access imperative. But the government should be more forthright in presenting its case. Though it is true that no constraints on domestic use of encryption are being proposed, the only product likely to gain wide acceptance in today's global economy is cryptography that is exportable to one's foreign subsidiaries and business partners. The government should be crystal clear in acknowledging that this debate is in fact about the encryption systems that will be used widely within the domestic U.S. economy. Also, key recovery remains an untried and untested system. It is entirely possible that a better solution to the cryptography problem may be discovered as computing technology advances, and policy should be flexible enough to adapt if this happens. The critical thing is the principle: strong encryption, widely available, with the potential for lawful decryption by accountable authorities. The government still must establish clear principles and a transparent cryptography policy. The new export regulations do not explicitly address a large number of significant issues (for example, backwards compatibility of key escrow with interim 56-bit systems, length of time escrowed keys must be kept for different types of data) that are now being defined in a piecemeal and private fashion as individual companies' key recovery product development plans are submitted with license requests. Various "exceptions" to the infant policy- permitting the export of stronger encryption without key recovery, for example, in specialized financial applications, or to banks and foreign subsidiaries of U.S. companies- are announced weekly. A "black box" process ("just submit it, and we'll tell you if it's OK") that sets limits on cryptography without open discussion and debate and forces Americans to struggle to infer the policy from the sparse and sometimes inaccurate details published in the press is totally unacceptable in an area this important to the nation. A second core element of a new national policy-and one that has yet to be carefully addressed by any broad initiative-is the construction of a clear, up-to-date legal framework for, and safeguards on, government access to encrypted data and communications. Government access is only tolerable in pursuing the legitimate social objectives outlined earlier. The legal framework defining privacy and freedom of speech in electronic data and communications is currently a crazy, patchwork quilt with many holes in it. The administration's new rules specify that key recovery agents must hand over keys to the government within two hours after receiving "appropriate legal authority" but nowhere define precisely what this authority must be. Is a court order required, or merely a signature from a political appointee, and under what circumstances? Our laws should be debated and updated to define the answers better and more comprehensively, given current and foreseeable technological realities. Careful attention must also be paid to the potential for abuse or corruption. Even after appropriate legal authority is granted on paper for some narrow purpose, there is typically substantial room for interpretation as to what is "reasonable" in deciding how wide to cast an electronic net in trapping suspicious communications and how to deal with unexpected discoveries that turn up. Most government officials can be expected to behave in a responsible and lawful way, but an excessively curious or aggressive, or even corrupt, official using a legal interception to "surf" through data or communications beyond its intended scope creates a potential for damage that will grow just as quickly as the information superhighway itself. The same computer technology that makes electronic communication so cheap and pervasive also makes it possible to electronically record and log, with a permanent and verifiable audit trail, any government interception of electronic communications. Just as financial services companies safeguard against abuse by logging and taping telephone contacts with customers, comprehensive logs and a verifiable audit trail should be automatically recorded and stored electronically in each and every instance that a government official intercepts private data or communications. In addition, tougher standards for private abuse of personal data and illegal access to private communications should be included in whatever new legal framework is adopted, and significant penalties should be defined. Third, a national cryptography policy must recognize that the problems-and solutions-outlined above are inherently international in scope. Law enforcement, national security, regulation and oversight of global finance and trade are all areas that span national boundaries today and require cooperation among governments. Just as our private sector works with its foreign partners to define standards that allow it to operate easily and effectively in global markets, the U.S. government must work with foreign governments to define an international encryption policy that makes the U.S. approach compatible with foreign systems. U.S. requirements imposed on U.S.-based businesses must be compatible with the foreign environments in which they operate. U.S. requirements should also be no more onerous than those imposed by foreign governments on their business communities. A level playing field, with common global rules of the game, is needed to avoid giving economic rivals competitive advantages over one another. The administration made an important and correct decision in seeking an international consensus on the key recovery approach to strong encryption and must be sure to continue to work hard in seeking this common global approach. While it has yet to achieve such a consensus within the OECD, many of the key players with the technical capability to ship advanced cryptography products and affect global markets-Britain, France, and (quietly) Japan-are supporting the U.S. approach, and if a few more (like Germany and Israel) can be brought on board, the critical mass around which the core of an international agreement can be assembled will exist. Finally, with cryptography set to play such a key role in tomorrow's information infrastructure, some new institution that provides a framework for business and government to jointly examine both the overall security of our information infrastructure and the integrity of its individual parts is needed. At the micro level, we must recognize that acquiring a cryptographic product is not like buying a computer or auto- simply testing or using it within an organization gives insufficient insight into its quality or utility. The essence of an effective cryptography system is what the most capable and potentially hostile forces outside a business or other organization can do with the system. There are also obvious economic benefits from some sort of government-industry testing and certification process that spares individual customers a costly and duplicative investment in determining the effectiveness of a cryptography product (and makes use of sensitive information that may be available only to the government). At the macro level, the integrity of our power grid, banking system, and phone network are clearly as vital to our national security as the number of transport aircraft the U.S. Air Force buys, and both government and industry have an obvious interest in scrutinizing the entire information infrastructure and taking steps to reduce weaknesses and vulnerabilities. Government and the private sector should form an oversight body tasked with both reviewing the overall integrity and security of the national information infrastructure and creating a voluntary testing and certification process for the information security products developed by the private sector. A national cryptography policy built around these four elements- strong cryptography put into wide use, a strengthened legal framework and electronic logging system that provides rigorous oversight and accountability for government access to the keys needed to intercept and read coded data, negotiation of an agreement with our close allies on a global encryption standard, and formation of a government/private sector oversight body to review both the overall security of our national information infrastructure and the voluntary testing and certification of encryption and security products-will leave many (maybe even most) participants in the current debate unsatisfied. An absolute right to privacy would not be created in the electronic realm. The government would probably face greater constraints in seeking lawful access to electronic communications, and maintenance of auditable records probably will create some additional costs. Business is being asked to bear some burden in keeping the keys needed to decrypt confidential communications for a time. Intelligence and national security officials will be more dependent than ever before on cooperation with their allied counterparts. Cooperation on common rules of the game for encryption at the international level will have to be carefully negotiated. None of this will be painless. But it must be done if we are to balance an important and complex set of interests as we enter the next century, the age of the information society. Kenneth Flamm is a senior fellow in the Brookings Foreign Policy studies program and the author of Mismanaged Trade? Strategic Policy and the Semiconductor Industry (Brookings, 1996). The views expressed in this Policy Brief are those of the author and not necessarily those of the trustees, officers, or other staff members of the Brookings Institution. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

2 1

Anarchy Gone Awry (fwd) Cu Digest, #5.91
by Anonymous 17 Dec '03

17 Dec '03

Computer underground Digest Sun Dec 5 1993 Volume 5 : Issue 91 ISSN 1004-042X ---------------------------------------------------------------------- Date: Thu, 02 Dec 93 04:36:10 -0700 From: "L. Detweiler" <ld231782(a)LONGS.LANCE.COLOSTATE.EDU> Subject: File 1--Anarchy Gone Awry Mr. Leichter raises some extremely pivotal issues in CUD #5.90 related to the `anarchy' of the Internet. B.Sterling is the author of one of the most brilliantly colorful characterizations and metaphors of the Internet as `anarchic', comparing its evolution and development to that of the English language: > The Internet's `anarchy' may seem strange or even unnatural, but > it makes a certain deep and basic sense. It's rather like the > `anarchy' of the English language. Nobody rents English, and > nobody owns English. As an English-speaking person, it's up > to you to learn how to speak English properly and make whatever > use you please of it (though the government provides certain > subsidies to help you learn to read and write a bit). > Otherwise, everybody just sort of pitches in, and somehow the > thing evolves on its own, and somehow turns out workable. And > interesting. Fascinating, even. Though a lot of people earn > their living from using and exploiting and teaching English, > `English' as an institution is public property, a public good. > Much the same goes for the Internet. Would English be improved > if the `The English Language, Inc.' had a board of directors > and a chief executive officer, or a President and a Congress? > There'd probably be a lot fewer new words in English, and a lot > fewer new ideas. Unfortunately, though, having attended a lecture by Mr. Sterling and having read `The Hacker Crackdown', I think he has a tendency to overdramatize and glorify quasi-criminal behavior and rebellious, subversive, revolutionary aspects of social structures, including those of the Internet. In my view, to the contrary the Internet is largely held together with the glue of social cohesion and human civility, and ingredients that are destructive to that order are likewise toxic to Cyberspace, and that, conversely, virtually all of the excruciating poison in the bloodstream today can be traced to violations and perversions of that trust. (Unfortunately, the English language is itself subject to unpleasant, corrupt, or toxic uses such as for profanity, disinformation, and lies, which are prevented or at least minimized through rejections by honest people.) I agree with Mr. Leichter in the belief (to paraphrase Twain) that `reports of the anarchy on the Internet are greatly exaggerated'. Leichter: >The Internet has been >described as an anarchy, but in fact only relatively small parts of >the Internet are actually anarchic. I would like to go further than this and suggest that the Internet has been over-promoted as `anarchic' by certain subversive, quasi-criminal segments that have found a tenacious hold there, namely extremist libertarians and `Cryptoanarchists'. The Cryptoanarchist cause is closely associated with the Cypherpunk founders E.Hughes and T.C.May (characterized particularly by the latter's infamous signature), who in my view appear to promote not merely `privacy for the masses' and `the cryptographic revolution', but at least condone or tolerate the use of collections of imaginary identities to manipulate and deceive others, and even to evade legitimate government actions such as criminal prosecutions. My most strident requests for their position, personal knowledge, and potential involvement in this practice have gone unanswered, evaded, and repressed over many weeks, but I have many statements from followers that might be regarded as `cult fanatics' about the Liberating Effects of `pseudoanonymity', which they exalt as True Anonymity. In my opinion, in this regard of the ease of creating fake identities, the `anarchic' vulnerability of the Internet reaches its peak in undesirable and socially poisonous consequences, which people are bloodily battling daily on many diverse mailing lists and Usenet groups. In my experience, the Internet inhabitants I have found who most fanatically worship the Internet `anarchy' seem to be closely associated with criminally subversive aims of pornography distribution, tax evasion, black marketeering, and overthrow of governments, goals which are all masked in much of the eloquent Cryptoanarchist dogma and rhetoric. While some of us have glimpsed various hideous corners of Cyberspatial Hell, those who subscribe to the Liberating Religion of Anarchy are in their Paradise on the Internet As We Know It. I call their Utopia a Ticking Time Bomb and a Recipe for an Apocalypse. I have come to these (admittedly melodramatic) conclusions after ~10 months and ~3500 messages of generally unpleasant and at times excruciatingly troubling and painful reading and participation on the Cypherpunks list and many personal communications with the Cypherpunk leaders including E.Hughes, T.C.May, and J.Gilmore. In fact, in my opinion the `Psychopunk Manifesto' parody in CUD #5.89, which longtime cypherpunk list subscriber P.Ferguson describes in 5.90 as having `made its rounds in the cyberspatial world', actually in many ways comes closer to delineating the actual cypherpunk agenda than the one authored by founder E.Hughes on soda.berkeley.edu: /pub/cypherpunks/rants/A_Cypherpunk's_Manifesto. The satire is actually a reformulated version of the original Manifesto, and the former's amazing meme-virus penetration of the into the cyberspatial psyche that P.Ferguson alludes to is indicative of its resonance over the latter. I gave the Cypherpunks the most extraordinary benefit of the doubt for months, far beyond that of a reasonable cyberspatial inhabitant. But now I must warn everyone who can hear me that if they assign the `cypherpunks' as an organization the same credibility as a group like EFF or CPSR they are dangerously, perhaps disastrously, misguided. They appear to me to the contrary to be the cultivators of a flourishing conspiracy and essentially the first Cyberspatial guerilla and terrorist group! The Psychopunk satirization of the Cryptoanarchists is representative of this Internet Anarchy Gone Awry. More information on the CryptoAnarchist & Cypherpunk agenda can be found in RISKS 15.25, 15.27, and 15.28x (FTP crvax.sri.com, directory RISKS:). I also have an essay `Joy of Pseudospoofing', regarding the dangerous consequences and poisonous effects of the manipulations of fake cyberspatial identities such as on the Internet by Cryptoanarchists, available to anyone who requests it from me by email at <ld231782(a)longs.lance.colostate.edu>. * * * I think that many people have mistaken the word `anarchic,' implying no overseeing authority or order (which the Internet is less) with the word `decentralized' (which the Internet is more). Again, the Internet has many regulatory and self-governing systems and orders. For example, connecting sites are required to implement a certain minimum set of software standards and prevent or even root out corruptions in their local sites and software. We have centralized databases that require the registration of domains for fees. A complex network of agreements and policies governs interconnectivity and communication, and a complicated interplay of elements affects basic content such as `commercial vs. academic.' Lack of some of these regulations and protocols would be disastrous. Leichter: >Most of the Internet, in fact, is >better described as self-governing. There are a variety of social >norms concerning network use and interactions. One doesn't post >messages to unrelated groups. One doesn't evade moderation >restrictions. One maintains a certain (rather limited, it must be >admitted) degree of restraint in how one describes other network >participants. There are few effective mechanisms for enforcing these >norms, and they are certainly broken on an all-too-regular basis; but >the network continues to function because social pressure *can* be >applied to those who become too annoying; and in the most outrageous >cases, it's possible to remove the offenders' access to the net. I advocate that we build new formal mechanisms to enforce this order! We have for too long pretended that a central element of the Internet is not integral to it, namely that of the `degree of restraint over network participants' exerted through `social pressure'. Let us codify and formalize these `norms concerning network use and interactions' and develop systems that enforce them! I believe such systems can be developed that do not stray from the sacred Internet tradition of decentralization of control and freedom from censorship. Why should we continue to subject ourselves to the torture of `few effective mechanisms for enforcing these norms broken on an all-too-regular basis'? One of my most enduring Cyberspatial hallucinations is that of a Ratings server. A Ratings server would be a massive distributed network for the propagation of information similar to Usenet, and could conceivably be built upon it. But the Ratings server is not Information, as Usenet is, it is Information about Information. Anyone can post an arbitrary message to the Ratings server that refers to Information somewhere else in Cyberspace. It is in a sense a Rating of that Information. The Information could be *anything* -- a mailing list, a person, a particular Usenet posting, an FTP site. But postings on the Ratings server can be perused by anyone, and anyone can contribute Ratings to the server or indicate their own opinion on the existing Ratings. Different mechanisms exist such that some Ratings are `local' and some are updated globally. The fantastic possibilities of this system are evident upon some reflection and consideration. We could establish arbitrary new groups that have *formal* requirements that are matched by Ratings servers. For example, we could require that new sites that enter the Internet be `trusted' by an existing site. We could require that membership in certain groups requires a certain amount of collateral peer approval, with automatic suspension or expulsion as the consequences for violating it! We could have *meaningful* polls on arbitrary issues. We could have news servers that automatically sort and archive articles according to their passing certain Ratings thresholds. We could restrict the influence of troublemakers! These are all examples of strengthening and formalizing the informal social orders that are, in my opinion, today just barely holding the Internet together. With a Ratings system, I think the civility of the Internet would increase to a fantastic degree. In short, we could have our *own* cyberspatial government! Note that there is no centralized authority or unfair influence in this system, unless people corrupt their servers. When everyone who has joined a group *individually* decides to screen their postings of messages that fail to meet a certain `quality' or posters who have a certain `reputation', that is not Orwellian Censorship but the beautiful Internet freedom and right of Bozo Filtering. When everyone who joins a group *agrees* to a charter that may bar troublemakers based on Ratings, no one can claim they are being unfairly oppressed. Other extremely interesting implementation issues in the use of the Ratings servers can be addressed in detail. For example, the use of cryptographic protocols to ensure the integrity of voting or privacy of certain entries will certainly prove invaluable and even critical to their development. The optimal protocols for the localization or distribution of votes will surely be subject to extremely fascinating and fruitful research. In my view the concept of a Ratings server is wide open territory and holds some immensely promising potential in finally, valiantly slaying the dreaded, ugly, vicious Signal to Noise Monsters harassing, terrorizing, and torturing us everywhere on the Internet, to be replaced with Shining Castles. I urge anyone interested in developing `civilized systems for cyberspace' to subscribe to a new group I have helped start with J.Helgingius (owner of the popular and revolutionary anon.penet.fi anonymous server) called the Cypherwonks, dedicated to openness, honesty, and cooperation on the Internet, and building sophisticated new systems to promote social harmony in Future Cyberspace. We are particularly fascinated with the possibilities of `Electronic Democracy'. (Send a message to `MajorDomo(a)lists.eunet.fi' with the body the commands `info' or `subscribe cypherwonks'.) I fervently hope that the glorifications and manipulations of Internet Anarchy by mouth-frothing libertarian extremists, Cryptoanarchists, and sympathizers can be adequately controlled and minimized in the future, and some harmonious systems and effective countermeasures along the lines of the Rating server can be established by visionaries and tinkerers, but in any case, for the sake of humanity's integrity, sanity, and well-being, I pray that Future Cyberspace is far less Anarchic than the Current Internet. ------------------------------

2 1

NRO spoof & Wiretapping Bill
by John Young 17 Dec '03

17 Dec '03

Responding to msg by paul(a)hawksbill.sprintmrn.com (Paul Ferguson) on Tue, 9 Aug 6:56 AM The NY Times today also reports on the controversial NRO headquarters. Another long article reports on the wiretapping bill. One quote: "I'm not a great fan of wiretapping," said Rep. Don Edwards, who is a former FBI agent and is viewed by many as a sort of civil-rights sentry over the bureau. "But it's legal and we have to take care of it. . . . I don't think there will be objections except perhaps from purists who don't like the idea of Government listening in on conversations." End quote.

1 0

Re: <null>
by usura＠hacktic.nl 17 Dec '03

17 Dec '03

In article <199408062304.AA24750(a)xs4all.hacktic.nl> you wrote: : The jurisdiction where this remailer could be located, preferably : shouldn't care about pornografy. [Holland, Scandinavia ?] Pornografy isn't illegal in the Netherlands, but -contrary to popular believe- child pornografy *IS* illegal in the Netherlands. -- ____ Alex de Joode <usura(a)vox.hacktic.nl> \ /__ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- \/ / "It's dangerous to be right when the government is wrong." \/ --Voltaire --finger usura(a)hacktic.nl for PGPpublicKEY--

1 0

NRO spoof and deception
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

Front page story in the Washington Post, as expected, entitled, "Spy Unit's Spending Stuns Hill," and subtitled, "$310 Million Facility Secretly Sprouts Up Near Dulles Airport." Gee, I wondered what that building was. ,-) A couple of select quotes from the article: "The Senate Select Committee on Intelligence yesterday charged that the clandestine agency that manages the nation's spy satellites has concealed from Congress the mushrooming cost of a $310 million compund it has been secretly building near Dulles International Airport. "President Clinton declassified the existence of the proposed headquarters for the National Reconnaissance Office (NRO) yesterday after several senators protested to him privately that they had been kept in the dark about the cost and scope of the project. At 1 million square feet, it is nearly one-fourth the size of the Pentagon. "The NRO, whose very existence was until two years ago an officially classified secret, is jointly overseen by the CIA and the Department of Defense. Until yesterday, the headquarters project had been publicly described as an office complex for Rockwell International Corp., the Los Angeles-based defense contractor." "DeConcini critized the Pentagon and the CIA for not providing Congress adequate information. The intelligence community is a culture that 'believes we don't have to account like everybody else in government,' he said." --------- - paul

1 0

Re: ANNOUNCE: the TAZONO is here
by Andrew Infante 17 Dec '03

17 Dec '03

Eric - If you wouldn't mind - I'd like to be removed from these mailings (for the umpteenth time! :) andy

1 0

Re: Keepers of the keys
by Lizard 17 Dec '03

17 Dec '03

At 10:10 PM 7/18/97 -0700, Tim May wrote: >All of this brainstorming about who might be the best choice to hold >"escrowed" keys, a la the reporter stooge Shea, or about requiring the Feds >to use the same escrow system, misses this basic point. And plays into >their hands. > >Kill the key grabbers and all those who support them. Isn't it exactly what >Patrick Henry, Thomas Jefferson, and the others would have argued? > Sure. And that is, of course, the bottom line. But even if I was a rabid national security freak, I'd *still* oppose key escrow, because it makes the nation *less* secure. It's a loser on both liberty *and* security grounds, and, since the liberty issue has already been conceded, the (political) battleground is security. The "key escrow exposes us to spies" meme has the capability to graft into the same mental reception points that the "key escrow will save us from terrorists" meme is currently attached to, much as 'blocker' viruses can prevent other viruses from infecting cells. If I were heading the NSA/CIA/FBI/etc, I'd be putting my budget into getting ringers onto every BBS, every IRC channel, every 'warez' group, every mailing list, everywhere, not wasting time on 'key escrow' when the people I'd be most interested in tracking would never ever in a million years turn their key over to the government. I'd be infiltrating, subjerting, and getting keys the old fashined way -- by tricking people into giving them to me. A key can be a gigabit in length and still be cracked just by watching what someone types in to decode a message, and the technology to do *that* is decades old, as are, sadly, the wiretap laws to permit it. The "legitimate needs of law enforcement" are already far too well served by existing holes shot in the Constitution -- there is no need to make more, and doing so will defeat the putative aims of the hawks, as well.

1 0

Re: Postal Inspection (was Common Carriers...)
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408082050.AA26145(a)smds.com> FutureNerd Steve Witham writes: > That reminds me. I once got a conference announcement from Europe > in the mail. Printed on the envelope was a little icon showing a > profile of the head of a guy wearing a hat (like a policeman or > mailman's hat), and an arrow pointing from about his eye level to a > picture of an open envelope. This looked like the original envelope, > untouched, and the icon seemed to have been there from the start. What was the conference about? (If the icon was printed on the envelope, I suspect that it represented the topic of the conference or the group sponsoring it.) -- Jim Dixon

1 0

Re: <null>
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>In article <199408062304.AA24750(a)xs4all.hacktic.nl> you wrote: > >: The jurisdiction where this remailer could be located, preferably >: shouldn't care about pornografy. [Holland, Scandinavia ?] > >Pornografy isn't illegal in the Netherlands, but -contrary to popular >believe- child pornografy *IS* illegal in the Netherlands. > But what is the age of consent for such in the Netherlands? I believe I saw on an educational TV program here in the U.S. that the age of consent in the Netherlands was 14. If so, what affect does that have on what is considered "child pornography"? [before the flames start, I would like to point out that my question is 'scholarly' :-] Dave Merriman

2 1

Re: e$
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408072158.memo.40958(a)BIX.com> peace(a)bix.com writes: > I can recall that many years back the casinos in Las Vegas all > accepted the chips from the other ones and then had a great > exchange each day where the accounts were settled up. Even the > gift shops took chips in place of cash. The US Treasury put a stop > to this as it was considered to be a replacement for cash. > > Also I hear a lot about bearer bonds, but never in the US. OTOH > the NYC subways have started a cash card that they expect merchants > to accept in lieu of coins. It would be nice to know what the Feds > will or won't accept. BTW, does it matter if the e$ are US denominated? > Could e$ be presented as travelers checks? The possibilities here are > extremely interesting. There is a small point to be made here which I think is really a big point. The US government does not object to the use of financial instruments so long as they are backed by the US $ (or another accepted currency). Most of us use such financial instruments daily -- checks and credit cards, for examples. Most financial transactions involve no cash at all. If an e$ is backed by US $1.00, the government will not object. The government objects if you create an alternative currency. Barter systems based on scrip are an alternative currency, and therefore illegal. If you had $1,000,000 in the bank and wrote out and signed 1,000,000 checks for $1.00 each, I think that these could be traded without violating any laws. But if you issue $e carelessly, you will probably find that you are acting as a bank, and therefore violating several Federal laws. You also need to be concerned about Federal regulations covering the import and export of money. I think that at $5,000 or $10,000 you have to report the transaction. I believe that the forms issued on airplanes make it clear that checks and other financial instruments are included. The action taken to stop the exchange of tokens between casinos would seem to contradict this. It would be useful if someone were able to find more information on this. The legal point might be that the tokens simply had an amount written on them ("$100) with no currency specified and without the name of a bank directed to pay this amount -- having said this, I am reasonably sure that they would not allow banks to pay out against their tokens, and so therefore they would definitely represent an alternative currency, and not an IOU. -- Jim Dixon

3 2