December 2003 - cypherpunks-legacy

Bill O Rights
by Jiva De Voe 17 Dec '03

17 Dec '03

Lil while back someone posted something about "Our rights are dropping like flies" aboiut various violations of the Bill Of Rights.. could someone re-email that to me? Thanks! :)

1 0

Propriety of crypto on Munitions List
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

In U.S. v Martinez, Elizabeth Martinez and her fiance were convicted of violating the Arms Export Control Act by exporting cryptographic hardware, namely "Videocipher II" video descrambling devices. (I believe these are used to descramble satellite TV broadcasts of HBO and other networks.) Defendants appealed, asking the court to overturn their conviction on the grounds that "the inclusion of 'cryptographic devices and software (encoding and decoding)' on the [Munitions] list is overbroad because this heading includes items already in the public domain whose dissemination would pose no security threat, and which lack any characteristic that is inherently or predominantly military." The 11th circuit appellate court rejected this argument in 904 F2d 601. The court decided that the question of whether an item properly belongs on the Munitions List is inherently political and is excluded from judicial review. "The question whether a particular item should have been placed on the Munitions List possesses nearly every trait that the Supreme Court has enumerated traditionally renders a question 'political'.... No satisfactory or manageable standards exist for judicial determination of the issue, as defendants themselves acknowledge the disagreement among experts as to whether Videocipher II belongs on the List.... Neither the courts nor the parties are privy to reports of the intelligence services on which this decision, or decisions like it, may have been based.... The consequences of uninformed judicial action could be grave." In these days of judicial activism, it is ironic that one time when civil libertarians might wish the court to take a hand and reverse a decision made by the other branches of government, the court chooses not to do so. Shortly before this decision was issued, the AECA was amended by adding the following section, 22 USC 2778(h): "The designation by the President (or by an official to whom the President's functions under subsection (a) have been duly delegated), in regulations issued under this section, of items as defense articles or defense services for purposes of this section shall not be subject to judicial review." So Congress and the court agree that the propriety of an item's placement on the Munitions List is not a matter for the courts to decide. There appears to be little chance that any prosecution for AECA violations will result in the judical removal of cryptographic equipment from the Munitions List. Hal Finney hfinney(a)shell.portal.com

1 0

Forwarded Article
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

This article was forwarded to you by gtoal(a)an-teallach.com (Graham Toal): --------------------------------- cut here ----------------------------- Newsgroups: mail.cypher Received: from post.demon.co.uk by mailhost.an-teallach.com with SMTP id AA11163 ; Thu, 23 Sep 93 12:41:47 GMT Received: from relay2.uu.net by post.demon.co.uk id aa07673; 23 Sep 93 9:14 BST Received: from toad.com by relay2.UU.NET with SMTP (5.61/UUNET-internet-primary) id AA19504; Thu, 23 Sep 93 04:09:31 -0400 Received: by toad.com id AA29715; Thu, 23 Sep 93 01:03:46 PDT Received: by toad.com id AA29712; Thu, 23 Sep 93 01:03:11 PDT Return-Path: <karn(a)qualcomm.com> Received: from qualcomm.com ([129.46.62.22]) by toad.com id AA29707; Thu, 23 Sep 93 01:03:08 PDT Received: from servo.qualcomm.com by qualcomm.com; id AA27850 sendmail 5.65/QC-main-2.1 via SMTP Thu, 23 Sep 93 01:00:40 -0700 for cypherpunks(a)toad.com Received: by servo; id AA10225 sendmail 5.67/QC-subsidiary-2.1 Thu, 23 Sep 93 01:00:39 -0700 for cypherpunks(a)toad.com Date: Thu, 23 Sep 93 01:00:39 -0700 From: Phil Karn <karn(a)qualcomm.com> Message-Id: <9309230800.AA10225@servo> To: cme(a)ellisun.sw.stratus.com Cc: cypherpunks(a)toad.com In-Reply-To: Carl Ellison's message of Tue, 14 Sep 93 23:53:23 EDT <9309150353.AA06198(a)ellisun.sw.stratus.com> Subject: more than spread spectrum This idea of setting up your own independent network isn't as far fetched as it sounds, at least in a relatively local area with critical mass. The router nodes already exist, in the form of my own TCP/IP code for the PC, or any of several other packages including the various freeware UNIX clones. Radio transmission equipment operating under Part 15 of the FCC rules is already available. Under Part 15, you don't need a license; the radio transmitter does have to be "type accepted" by the FCC but since you buy that as a prepackaged box you don't have to worry about it. The section of Part 15 that is particularly interesting is either 15.247 or 15.249 (can't remember which). It allows you to run up to 1 watt of power, quite a bit for an unlicensed service, on any of several "ISM" (aka "garbage") bands as long as you use spread spectrum with a minimum processing gain of 10dB. The most popular is 902-928 Mhz, with another band in the vicinity of 2450 Ghz coming up fast. Ahthough most Part 15 equipment is designed primarily for use within office environments, it can be and is used over point-to-point paths of 5-10 km with the proper directional antennas. Although Part 15 users are not allowed to cause harmful interference and must accept interference from other users (microwave ovens generally operate on 2450 Mhz), in practice these nets seem to work pretty well if they're properly engineered. Besides, the inherent distributed redundancy available in a packet network should be able to compensate for momentary outages due to interference. Unlike the amateur service, which has some particularly draconian "acceptable use" policies (despite a recent liberalization, encryption is still illegal), there are *no* restrictions on the use of Part 15 equipment. Encryption is not only legal, some boards have hardware encryption support (e.g., the NCR Wavelan has a DES chip). This particular board operates at 2 megabits/sec on the 902-928 Mhz band with 250 mW of power. There is an even more interesting development in the works: "data PCS". In essence, this is "Part 15" style operation on dedicated spectrum, i.e., new spectrum in the 1.8-2.2 Ghz band that will not have to be shared. The specific intent of data PCS is to allow users to build their own ad-hoc networks without having to rely on the facilities of (and pay money to) carriers such as telephone companies. Phil --------------------------------- cut here -----------------------------

1 0

Red Ryder decoder rings declared illegal (fwd)
by Anonymous 17 Dec '03

17 Dec '03

I apologize if this has already been posted to the list, as I have been extremely busy the past couple of days and have not had the luxury of reading every message that has been posted. If this is old news -- sorry. ,-) Begin excerpted message --------------------------- > Subject: Cu Digest, #5.74 - More on Moby Crypto ------------------------------ Date: Tue, 21 Sep 1993 21:13:17 GMT From: Grady Ward <grady(a)netcom.com> Subject: File 2--NEW State Dept FLASH on Moby Clipper (Grady Ward) (please edit follow-ups) In a fresh (to me, stunning) development, the Austin Code Works received a letter today (Tuesday 9/21/93) from the State Department, Bureau of Politico Military Affairs, Office of Defense Trade Controls advising them, in part, of their need to register as an International Arms Trafficker *even if* their crypto material is intended solely for *domestic* publication, regardless of whether they are selling executables, source, descriptions, algorithms of any crypto (and presumably viral detection) software or documentation, as defined by ITAR. This requirement literally implies that a Cereal manufacturer is required to register as an arms trafficker if it wants to include a secret de/coder ring in the box, has a cardboard outline of a de/coder printed on the box, or even a description how to construct or use a de/coder ring. Complete text of the letter follows: (State Department Seal) United States Department of State Bureau of Politico-Military Affairs Office of Defense Trade Controls Washington, D.C. 20522-0602 AUG 31 1993 Austin Code Works 11100 Leafwood Lane Austin, TX 78750-3587 Dear Sir: It has come to the attention of this office that your company is making cryptographic source code and technical data available for commercial export claiming a technical data exemption from the International Traffic in Arms Regulations. Cryptographic software, including source code, is a munitions article as defined in 22 CFR # 120.1, category XIII(b). Further, the exemptions listed in 22 CFR # 125.4 for technical data do not apply to cryptographic software and source code. A valid Department of State license is required to export cryptographic source code. As such, it would be a violation of the International Traffic in Arms Regulations to export cryptographic source code without a valid Department of State export license. We take this opportunity of advise you that any company or individual who engages in the United State in the business of either manufacturing or exporting defense articles or furnishing defense services is required to register for a fee with the Office of Defense Trade Controls (DTC) pursuant to 22 U.S.C. # 2778(b)(1)(A) and 22 C.F.R. Part 122. Furthermore, the export of such defense articles and related technical data must be licensed by the Department of State in accordance with 22 U.S.C # 2778(b)(1)(B)(2) and 22 D.F.R. Parts 120-130 (International Traffic in Arms Regulations). A booklet entitled "REGISTRATION: The First Step in Defense Trade" is enclosed. If you are unsure whether an article is on the U.S. Munitions List, you may send five (5) copies of descriptive literature about the product and request a commodity jurisdiction determination from this office according to 22 C.F.R # 120.5 of the ITAR. If you have any questions regarding the matters discussed in this letter, please do not hesitate to contact this office at (703) 875-6650. Sincerely, (signed) Clyde G. Bryant, Jr., Chief Compliance and Enforcement Branch ++++++++++++++++ I guess this means that all FTP sites who implement the GET command and have anything to do with crypto or viral detection, including RFCs, overviews or discussions of specific techniques or algorithms, etc. must be registered as International Arms Traffickers *even if* they disallow all but domestic FTP connections. What to do now. My advice to this new twist of the NSA and State Department regulating activities *within* the United States is twofold: (1) GET and FAMILIARIZE yourself with PGP sources or other crypto options NOW and upload it to your local BBS (if you deem it still legal for you to do these things) and (2) Consider supporting the Electronic Freedom Foundation. PGP sites: black.ox.ac.uk (129.67.1.165) src.doc.ic.ac.uk (146.169.2.1) ftp.demon.co.uk (158.152.1.65) ghost.dsi.unimi.it (149.132.2.1) nic.funet.fi (128.214.6.100) soda.berkeley.edu (128.32.149.19) Electronic Freedom Foundation 1001 G Street, NW Suite 950 East Washington, D.C. 20001 202/347-5400 voice 202/393-5509 FAX FTP ftp.eff.org End excerpted message ------------------------------

1 0

QPK, SOURSE, FTP
by David Colston 17 Dec '03

17 Dec '03

Hi, I do agree with your concepts for a public key voice system. I don't think Joel will be up to speed for a long time<G>. Re: SOURCE CODE I will snail mail you the Call Security source and exe's today. You should have them by tomorrow or Saturday. Please post them on an FTP, so that any of the cypherpunks can get a copy. TO ALL EAVES DROPPERS<G> If you need the source snail mailed to you, then send a floppy any size to: Colston & Associates 5111 Rogers Ave. Suite 507 Fort Smith, AR 72903 I'll stand good the return postage, but the disks will help out.

1 0

First amendment and ITARs
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

In U.S. v Posey, 864 F2d 1487, the defendant was convicted of violating the Comprehensive Anti-Apartheid Act ("CAAA") and the Arms Export Control Act ("AECA") by sending design documents relating to the C-130 aircraft to South Africa. Posey obtained these documents from the U.S. government via the Freedom of Information Act. The U.S. government agreed that these documents were technically public domain within the meaning of the ITAR's. However, the CAAA, which applies only to exports to South Africa, does not contain the "public domain" exemption that the AECA (which applies to exports in general) does. The recent grand jury action regarding PGP appears to involve possible violations of the AECA. Posey appealed on several grounds, one of which was that these Acts violated his first amendment rights, since the information was, after all, freely available. The court rejected this argument, with a lengthy (and, to my mind, somewhat confused) discussion, which is worth repeating: VII. FIRST AMENDMENT Appellant's final argument is that the First Amendment bars the government from restricting the export of information that is already available to the public. He insists that the data he sent abroad was available under the Freedom of Information Act, and therefore could be legally obtained by virtually everyone in the world. He contends that the First Amendment prohibits the application of the AECA and CAAA to the export of such publicly available information. Our Court has already considered and rejected this argument. In United States v. Edler Industries, 579 F2d 516 (9th Cir. 1978), we rejected an essentially identical challenge to the predecessor of the AECA. The defendant was convicted of exporting certain manufacturing designs that were on the Munitions List but were not classified. He challenged his conviction on First Amendment grounds, arguing that the government could not constitutionally prohibit the export of techno- logical data that was widely distributed within the United States. In rejecting that claim, we explained that even assuming that the First Amendment offers some protection to the dissemination of technical data, the government has a strong interest in regulating the export of military information: The federal government undeniably possesses the power to regulate the international arms traffic.... As a necessary incident to the power to control arms export, the President is empowered to control the flow of information concerning the production and use of arms. The authority to regulate arms traffic would be of negligible practical value if it encompassed only the exportation of particular military equipment but not the exportation of blueprints specifying the construction of the very same equipment. 579 F2d at 520. We accordingly concluded that the government could permissibly restrict the flow abroad of data included in the Munitions List. 579 F2d at 521. Finally, we held that the government's power to issue such restrictions was not affected by the domestic availability of the regulated data: Given the unquestionable legitimacy of the national interest in restricting the dissemination of military information, the claim of public availability in the United States is not a defense recognized by the Constitution. 579 F2d at 522. Appellant attempts to distinguish Edler from the present case by pointing out that the exported data in Edler was "cutting edge" technology and was not widely used in this country. [Citation]. Whether or not this was factually true of the technology at issue in Edler, however, the Edler decision clearly assumed for purposes of its decision that the material was extensively available in the United States. See 579 F2d at 518, 522. Moreover, we believe Edler should not be read as permitting the govern- ment to restrict the export of only that information which is not widely available domestically. Under appellant's reading of Edler, if the government wished to prevent technical data from being sent to foreign powers, it would be required to suppress the information alto- gether, at home as well as abroad. This outcome would blur the fact that national security concerns may be more sharply implicated by the export abroad of military data than by the domestic disclosure of such data. Technical data that is relatively harmless and even socially val- uable when available domestically may, when sent abroad, pose unique threats to national security. It would hardly serve First Amendment values to compel the government to purge the public libraries of every scrap of data whose export abroad it deemed for security reasons necessary to prohibit. We conclude that appellant's conviction does not violate the First Amendment. (Hal speaking again here.) The thing I find somewhat ironic about this decision is this last paragraph. The court is saying that if the First Amendment implied that domestically available information could be exported, then the government might have to restrict domestically available information. But, this ignores the fact that the AECA already contains an explicit exemption for public domain information. So, the court is going to some length in this last paragraph to consider an argument which is mooted by the public domain exemption in the AECA. And in fact, as we have seen, at least one government official is daring to argue that this provision of the AECA does in fact give the U.S. government the power to keep Munitions List information out of public libraries! In any case, this decision and the earlier one it quotes both represent rejections by the 9th circuit appellate court (which includes California, where the grand jury investigations are taking place) of the argument that the ITARs infringe on First Amendment rights. This will make it more difficult to use the First Amendment defense in any new charges of arms export violations. Hal Finney hfinney(a)shell.portal.com

2 1

Apologies for brain-damaged mailer failure! :-(
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Sorry folks - I forwarded an article from this group to my wife that's relevant to her work, and it appears to have been sent to the people in the To: line contained in the article body rather than in the address I asked to send it to. This is almost certainly because I'm beta-testing a new local version of snews (a DOS newsreader) and I think I've just found its first major bug :-( Sincere apologies and I'll be *much* more careful in future what I do with this version of the newsreader. Meanwhile, excuse me while I step next door and beat up a certain programmer :-) Graham

1 0

Re: Propriety of crypto on Munitions List
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>From: hfinney(a)shell.portal.com >In U.S. v Martinez, Elizabeth Martinez and her fiance were convicted >of violating the Arms Export Control Act by exporting cryptographic >hardware, namely "Videocipher II" video descrambling devices. I would guess that they have good grounds for an appeal now that the ITAR has been changed to except the VideocypherII (unless they were exporting studio or professional quality equipment): FEDERAL REGISTER VOL. 58, No. 139 Rules and Regulations DEPARTMENT OF STATE Bureau of Politico-Military Affairs 22 CFR Parts 120, 121, 122, 123, 124, 125, 126, 127, 128, and 130 [Public Notice 1832] Amendments to the International Traffic in Arms Regulations Part II 58 FR 39280 DATE: Thursday, July 22, 1993 ... Enumeration of Articles 121.1 -- General. The United States munitions list. (a) The following articles, services and related technical data are designated as defense articles and defense services pursuant to sections 38 and 47(7) of the Arms Export Control Act (22 U.S.C. 2778 and 2794(7)). Changes in designations will be published in the Federal Register. Information and clarifications on whether specific items are defense articles and services unde this subchapter may appear periodically in the Defense Trade News published by the Center for Defense Trade. ... Category XIII-Auxiliary Military Equipment (a) Cameras... (b) Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefor, including: (1) Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software with the capability of maintaining secrecy or confidentiality of information or information systems, except cryptographic equipment and software as follows: ... (viii) Limited to receiving for radio broadcast, pay television or similar restricted audience television of the consumer type, without digital encryption and where digital decryption is limited to the video, audio or management functions. (The VideocypherII falls here) What were the dates of the conviction and appellate court decisions?

1 0

Re: more than spread spectrum
by doug＠netcom.com 17 Dec '03

17 Dec '03

Phil Karn said: >This idea of setting up your own independent network isn't as far fetched >as it sounds, at least in a relatively local area with critical mass. A little while ago I mentioned an SF Bay Area grass roots internet connection project. When I talked to Qarin about it almost 1.5 years ago, I'd thought that she was proposing an actual independent network beginning in Santa Cruz, which is why I brought it up. However apparently it is simply a connection to existing sub-Inets. After chasing down some leads, Tom Jennings' .vacation notice says to contact John Gilmore regarding SF area Little Garden business while Tom is away. This naturally leads me to suspect that everyone here except me is already well acquainted with all this...I've no idea what's going on with Little Garden myself. I like Phil's ideas, just for the record. :-) Anyway, here's what I found on the Santa Cruz project, as long as I've got it lying around. P.S. The following does not include some rumors I heard some months ago, that this project ran into opposition from commercial Internet providers around here. It also says nothing about Qarin's radio wave internet link ideas, so maybe that fell through. ---------------------- Item 1 of 2 --------------------------- >From netcomsv!darkstar.UCSC.EDU!injectnews 20 Sep 93 23: 11 PDT Wed Sep 22 18:55:52 PDT 1993 From: matthew kaufman <matthew(a)klinzhai.echo.com> Newsgroups: scruz.sysops Subject: Santa Cruz Community Internet (scruz-net) STATUS UPDATE Date: 20 Sep 1993 23:18:03 -0700 Organization: University of California, Santa Cruz Santa Cruz Community Internet (scruz-net) 903 Pacific Ave. #203-A Santa Cruz, CA 95060 (408) 426-6771 [for now...until new line is installed] matthew(a)echo.com, queue(a)echo.com, garlick(a)echo.com SEPTEMBER 20, 1993 STATUS UPDATE Summary: Full speed ahead. Full Service Begins November 1st. - We now have an office leased for the hub. Address is above. This is also our new mailing address. - We have ordered the 56kbps digital line to Mtn. View. - RGNet (formerly TLG, The Little Garden) has signed their agreement with Sprint for a new Internet feed. They will switch to Sprint on or about November 1st, coincident with our beginning of full service. - scruz-net has a registered domain name for our hub equipment and FTP/name servers (scruz.net) - scruz-net has a Class B IP address space to be used to provide IP addresses to sites that haven't already obtained an IP address (165.227.x.x) (initial sites... your IP address will be assigned this week) - Santa Cruz Community Internet (scruz-net) is now a registered fictitous business name. We also have a City of Santa Cruz business license. We are a partnership. - We have a checking account, so all the founding connection checks have been deposited. - We have some of the equipment required (donated and/or loaned), and we will be purchasing the rest over the next few weeks. - We will be obtaining a pager so that we can be contacted 24hrs in case of network problems. Latest timeline: October 1 - we move equipment into office space and begin wiring everything up. October 13 - 56kbps line installation should be complete. October 15 - Testing begins. We bring up 56kbps connection to Mountain View, begin software configuration of routers and terminal servers. Sites which want to participate in initial testing can start dropping off their modems and we'll assign phone lines. Full IP routing will NOT be in effect, but you (and we) will be able to test SLIP/PPP software, failure recovery, local routing. Initial sites: before connecting, you'll need to sign an actual agreement, which we're writing up. November 1 - Sprint begins routing our addresses to RGnet, who then routes them to us. Full operation begins. Any sites which have paid initial fees can begin full operation. (Note that this item depends upon the Sprint-RGnet arrangement) December 1 - First monthly payment due for connected sites. Thanks to the 9 people who've already gotten us checks for their initial connection, and the 3 whose checks we'll have soon. Without your commitment we wouldn't have been able to get started. Anyone else who wants to be included in the initial startup, you're welcome to join... a check for $406 to "scruz-net" will sign you up for a 14.4kbps connection. (That's $250 startup, $70 for the first month, $70 for the phone line at our end, and $16 for the first month of phone service at our end... you provide both modems, phone line at your end, and all equipment at your end needed for a SLIP/PPP connection). After this, fees are $86/month ($70 for IP, $16 for phone at our end. Faster connections (56kbps leased line, 128kbps over ISDN) are available... just ask. -Matthew Kaufman Qarin Van Brink Tim Garlick matthew(a)echo.com queue(a)echo.com garlick(a)echo.com ---------------------- Item 2 of 2 --------------------------- >From matthew(a)klinzhai.echo.com Wed Sep 22 23:11:09 1993 Date: Wed, 22 Sep 93 23:14:34 PDT From: matthew(a)klinzhai.echo.com (matthew kaufman) To: doug(a)netcom.com Subject: Re: Santa Cruz Community Internet (scruz-net) STATUS UPDATE well, the best source of information is to just ask us questions. The most interesting piece of information that someone who wants to start something similar should know is that there's a group like us in the Bay Area (San Francisco, Palo Alto and Mountain View) called The Little Garden, and they're in fact who we're working with to get IP connectivity to Santa Cruz. The contact person for that is Tom Jennings (tomj(a)wps.com) If they want to do something substantially south of Mountain View, it might be cheaper to connect to us, or perhaps we could work out an arrangement to reduce the digital line charges somehow, so definitely they should keep in touch with us as well. -matthew

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

OK, now for something completely different: A few years back, a sculpture was created and presented to the CIA by an artist who inscribed the base of the work with a cyphertext. He refused to tell anyone what it said, but I think he later acquiesced and told the DCI. Has anyone heard anything more about this? Was the cypher cracked?

1 0