December 2003 - cypherpunks-legacy

Re: ANNOUNCEMENT: DPSWG Crypto-Policy Statement to White House
by jazz＠hal.com 17 Dec '03

17 Dec '03

> NOTICE: This is the letter from the Digital Privacy and > Security Working Group sent to the White House 12/06/93, > urging the Administration to lift export controls on > DES, RSA and other mass market encryption without ^^^^^^^^^^ ?? > requring legislation. > Why only "mass market" encryption? The company I work for is developing a collection of runtime libraries and utilities which software developers can use to create and manage portable object-oriented distributed applications. Think of it as a object-oriented DCE-like tool set with a run-time environment and system administration utilites. That's still mass market. There is already a mechanism for non-mass-market, i.e. one-off, export of crypto; apply for an export permit. The idea of this initiative is to allow products sold in quantities too great to allow individual export licenses to be sold. > For example, generally available software is offered > for sale or licensed to the public without restriction > and available through standard commercial channels of > distribution; sold as is without further > customization; and designed to be installed by the > purchaser without additional assistance from the > publisher. Computer hardware and computing devices are > also defined. You sell your software as-is; the customer does any customization. > . > 15 ``(4) DEFINITIONS.---As used in this > 16 subsection--- > > 1 ``(B) the term `as is' means, in the case of > 2 software (including software with encryption ca- > 3 pabilities), a software program that is not de- > 4 signed, developed, or tailored by the software > 5 company for specific purchasers, except that > 6 such purchasers may supply certain installation > 7 parameters needed by the software program to > 8 function properly with the purchaser's system > 9 and may customize the software program by > 10 choosing among options contained in the soft- > 11 ware program; A developer's kit still qualifies as "as-is", mass market software. You're covered. As I see it, the main distinction between "mass market" software and our software is that our software is used to create other software, whereas "mass market" software implies final product "end-user" software. Not a useful distinction from the standpoint of commerce. "Mass-market" means the seller does nothing special for individual customers; no customization, etc. It means the volume is large enough that requiring action on a per-sale basis (as is required for current crypto export licensing) is essentially impossible. Why only "mass market" software? Because the non-mass-market stuff already has the mechanism of applying for individual export licenses; since it's not mass marketed, it's possible to do special things on a per-customer basis. Does the DPSWG want the government to keep export controls in place for the type of product our company is developing? It doesn't. Jason Zions

1 0

Re: ANNOUNCEMENT: DPSWG Crypto-Policy Statement to White House
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Stanton McCandlish writes: > NOTICE: This is the letter from the Digital Privacy and > Security Working Group sent to the White House 12/06/93, > urging the Administration to lift export controls on > DES, RSA and other mass market encryption without ^^^^^^^^^^ ?? > requring legislation. > Why only "mass market" encryption? The company I work for is developing a collection of runtime libraries and utilities which software developers can use to create and manage portable object-oriented distributed applications. Think of it as a object-oriented DCE-like tool set with a run-time environment and system administration utilites. Our customers are primarily large corporations, although it would be useful to small shops, too. We have communication software that can perform encryption of user data, but the current export laws prevent us from placing this capability in versions for our foreign customers. <sigh> We have to maintain two distinct versions of our product: a domestic version and and foreign version. Since we target other software developers, I don't believe our product qualifies as "mass market" software. At least, this is my interpretation of the definition of "as is" in the Cantwell bill: > For example, generally available software is offered > for sale or licensed to the public without restriction > and available through standard commercial channels of > distribution; sold as is without further > customization; and designed to be installed by the > purchaser without additional assistance from the > publisher. Computer hardware and computing devices are > also defined. > . > . > . > 15 ``(4) DEFINITIONS.---As used in this > 16 subsection--- > > 1 ``(B) the term `as is' means, in the case of > 2 software (including software with encryption ca- > 3 pabilities), a software program that is not de- > 4 signed, developed, or tailored by the software > 5 company for specific purchasers, except that > 6 such purchasers may supply certain installation > 7 parameters needed by the software program to > 8 function properly with the purchaser's system > 9 and may customize the software program by > 10 choosing among options contained in the soft- > 11 ware program; > > Although we don't make custom versions of our software for specific customers, our software, due to its nature, is highly customizable by the purchaser. Neither the Cantwell bill, nor the DPSWG letter mentions this type of software product. As I see it, the main distinction between "mass market" software and our software is that our software is used to create other software, whereas "mass market" software implies final product "end-user" software. My question to the DPSWG (and US Rep. Maria Cantwell, if I could e-mail her) is: Why only "mass market" software? Or put another way: Does the DPSWG want the government to keep export controls in place for the type of product our company is developing? Thanks, Jim_Miller(a)suite.com

2 1

San Jose Merc article on s/w industry crypto deal
by strat＠uunet.uu.net 17 Dec '03

17 Dec '03

------- Start of forwarded message ------- Software Industry to cut deal on Clipper HIGH-TECH FIRMS WON'T OPPOSE DATA-SCRAMBLING CHIP THEY'LL ACCEPT 'CLIPPER' PROPOSAL IF U.S. WILL EASE SOFTWARE EXPORT RULES. By LEE GOMES Mercury News Staff Writer With some privacy advocates crying foul, a group of prominent high-tech companies is dropping its opposition to a controversial White House proposal for a new data-scrambling chip in exchange for a relaxing of the federal rules restricting the export of scrambling software. The Digital Privacy and Security Group, a collection of computer companies and related associations, said Monday that it could accept the administration's ''Clipper'' chip proposal if the chip's adoption was voluntary, and if other encryption software were available for sale, especially overseas. The White House Clipper proposal would establish a special computer chip that would be used to scramble digital transmissions, including computer data and next-generation telephone calls. But the scheme the chip would use to encode the messages would be kept secret, and the government would have the right to get a court order to break the code if it wanted to wiretap a conversation. As originally conceived by the administration, Clipper would be the only advanced encryption technology that could be sold by U.S. firms overseas. Many in the computer industry had opposed the Clipper proposal, both out of privacy and civil rights concerns, but also because more advanced coding software is available from private companies. However, those private coding systems could not, most likely, be broken by law enforcement or intelligence agencies, and both groups are supporters of the Clipper proposal. The switch on Clipper was contained in a letter to President Clinton and marked what a spokeswoman for one of the groups labeled a ''compromise.'' The groups now say they can accept a voluntary form of Clipper as long as the administration drops the regulations that prevent U.S. companies from selling advanced encoding software overseas. Encryption software is one of the few high-tech products whose foreign sale is still tightly controlled. The ban originally was ordered for fear that foreign governments could gain access to advanced U.S. coding software and then use it to shield their communications from American intelligence agents. But the software industry argues that because encryption software identical to the sort sold by American firms is now available from dozens of overseas suppliers, the ban doesn't provide any additional security, but simply prevents U.S. companies from making extra sales. The ban runs counter to the Clinton administration's demonstrated willingness to please its high-tech friends by relaxing export control rules that no longer serve a national security purpose. Most in the software industry say it survives because of strong support from the National Security Agency. However, on Monday, some Clipper critics charged that the industry was sacrificing a privacy issue to gain a sales boost. ''The entire point of Clipper is wrong,'' said David Banisar of the Computer Professionals for Social Responsibility, a mostly liberal policy group. ''The premise (of Clipper) is that they have the right to surveil and nothing should get in the way of that right.'' Banisar said his group, along with such technical associations as the Association for Computing Machinery and the Institute of Electrical and Electronic Engineers, would continue to oppose Clipper because ''they are principled enough not to cut any deals.'' But Bruce Heiman, a Washington attorney working with a group of major U.S. software firms, said the free availability of alternate encryption software would make the privacy concerns about Clipper irrelevant. That's because, he said, individuals and companies could use the software to encode their transmissions in a way that not even the Clipper chip could understand. ------- End of forwarded message -------

1 0

televisions 2 way?
by Sean Lambert 17 Dec '03

17 Dec '03

I heard a theory about how the government can "spy" on us by using cable television. somehow, according to the theory, the cable is a 2-way transmitter, and the television, when turned on, can act like a video camera for the government. I do not know ANY of the specifics of this theory, and really find it hard to believe (perhaps because I do not have any more information)...does anyone have any information on this? is this an appropriate inquiry for the cypherpunks mailing? thanks a lot sean

4 3

Re: NYT article on Mosaic today.
by walter kehowski 17 Dec '03

17 Dec '03

Where can you get 'Mosaic'? Walter A. Kehowski <wak(a)next0.math.pitt.edu>

1 0

Re: San Jose Merc article on s/w industry crypto deal
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> HIGH-TECH FIRMS WON'T OPPOSE DATA-SCRAMBLING CHIP > > THEY'LL ACCEPT 'CLIPPER' PROPOSAL IF U.S. WILL EASE SOFTWARE EXPORT RULES. > > By LEE GOMES > Mercury News Staff Writer > > With some privacy advocates crying foul, a group of prominent high-tech > companies is dropping its opposition to a controversial White House proposal > for a new data-scrambling chip in exchange for a relaxing of the federal > rules restricting the export of scrambling software. > > The Digital Privacy and Security Group, a collection of computer companies > and related associations, said Monday that it could accept the > administration's ''Clipper'' chip proposal if the chip's adoption was > voluntary, and if other encryption software were available for sale, > especially overseas. What a sell-out (literally). Will these guys also support the government's right to conduct random house-to-house searches if they're promised a piece of the booty? And Clipper has ALWAYS been "voluntary" (at least so far), so that part of the deal is no victory at all. With friends like these... --Dave.

3 2

Re: San Jose Merc article on s/w industry crypto deal
by Black Unicorn 17 Dec '03

17 Dec '03

-> What a sell-out (literally). Will these guys also support the government's right to conduct random house-to-house searches if they're promised a piece of the booty? And Clipper has ALWAYS been "voluntary" (at least so far), so that part of the deal is no victory at all. With friends like these... --Dave. <- ()() As originally conceived by the administration, Clipper would be the only advanced encryption technology that could be sold by U.S. firms overseas. ()() Yeah, real "voluntary." More government controled, distributed, surveiled monopolies. Reminds me of ma bell. Western electric manufactures the phones that everyone HAS to buy. Sounds like AT&T has found out that turn about is fair play. They are stabbing the very system that gave them their boost in the back in many ways. (Sigh) I do have to admit however, I have one of those heavy western electric phones on my desk. It must be 12 years old or something and it has out lived all the other phones I have ever bought. I'm sort of fond of the heavy clunky feel it has too. Not like these cheap AT&T Spielzeug that aren't heavy enough to hold on to the desk when you stretch the cord. :) -uni- (Dark)

1 0

NOTICE: EFF & UUNet downtime, Nov. 11
by Stanton McCandlish 17 Dec '03

17 Dec '03

UUNet is moving all of their Falls Church VA routers and network connections to another location. Their 800 numbers will also be unavailable. All sites, such as eff.org, feeding from the Falls Church UUNet site will be unavailable during the move. This starts Saturday, Dec. 11 at 9am EST. UUNet 800 numbers should be back up by 11am, as should backbone links & 56K/T1 service. All the downstream nodes, including EFF's site, should be available by then, except for those using SLIP/PPP, which may not be restored until 3pm. ALL UUNet feeds should be available by 3pm or so. According to UUNet: >If you experience problems with your connection after Saturday night >please contact the Network Operations Center at 1-800-827-4864 or >send email to noc(a)uunet.uu.net. Sorry for the upset. -- Stanton McCandlish mech(a)eff.org 1:109/1103 EFF Online Activist & SysOp O P E N P L A T F O R M C R Y P T O P O L I C Y O N L I N E R I G H T S N E T W O R K I N G V I R T U A L C U L T U R E I N F O : M E M B E R S H I P @ E F F . O R G

1 0

ANNOUNCEMENT: EFF Statement on Cryptography & Policy
by Stanton McCandlish 17 Dec '03

17 Dec '03

EFF ANNOUNCES ITS OFFICIAL POLICY ON CRYPTOGRAPHY AND PRIVACY Strongly opposes original Clipper/Skipjack plan, reiterates the need to lift restrictions on encryption December 8, 1993 The Electronic Frontier Foundation is pleased to announce its formal policy on encryption. This is particularly timely, because yesterday the New York Times announced that the Digital Privacy and Security Working Group had proposed to trade support for the administration's proposed Clipper Chip for a lifting of the long-standing export embargo on robust domestic encryption. This was a misunderstanding of what the DPSWG offered the administration in this proposal, leading to the belief that both the DPSWG (a coalition of over 50 computer, communications, and privacy organizations and associations) and it's principal coordinating organization, the Electronic Frontier Foundation, have offered to ease their opposition to Clipper. We see it as a pragmatic effort to get the government to wiggle on these issues: one step in the right direction, with many more to follow. This step is that we insist that use of Clipper and key escrow must be completely voluntary. It's not voluntary if users of the Skipjack algorithm are forced to use key escrow. It's not voluntary if users who do choose escrow are forced to use the government's choice of escrow agents. It's not voluntary if manufacturers such as AT&T are pressured into withdrawing competing products. It's not voluntary when competing products can't be sold in a worldwide market. It's not voluntary if the public can't see the algorithm they are "volunteering" to use. It's not voluntary if the government will require anyone to use Skipjack or escrow, even when communicating with the government. The Working Group chose to state this in a diplomatic fashion by applauding "repeated statements by Administration officials that there is no intent to make the clipper chip mandatory". They were diplomatic for two reasons. First, they believe the Administration has gotten this message. Clipper was announced in April and was supposed to be available in the Summer. It is December, the escrow system is still uncertain, and the Administration is still drafting a report which was due in July. If they still don't get it, the coalition has a 100 page white paper documenting the case against clipper and the case for lifting export controls, which they will release in response to any Administration position favoring Clipper. The second reason is that the coalition was trying to use the introduction of the Rep. Cantwell's bill eliminating many export controls on crypto to try, one more time, to urge the Administration to make voluntariness meaningful by unilaterally lifting export controls. Even if the Working Group and the Administration can't agree on Clipper, EFF and the Working Group needed to continue pressing the export issue. But NSA is digging in, and a legislative fight looks more likely. If diplomacy fails, EFF must fight for our rights. Thus, we are going to need all the allies we can find, from IBM, Apple, Lotus, and Sun, to cryptographers, cypherpunks, and folks on the net. EFF wants the public and the Administration to know (as we have frequently stated to them face to face) that the Electronic Frontier Foundation would fight to the end any attempt by the Administration to do any more than let companies use Clipper if they want and to let people buy it if they want -- and only in a market which has other strong encryption schemes available because export controls have been lifted. Under truly voluntary conditions, the EFF would be proud to say, "We have expressed ... tentative acceptance of the Clipper Chip's encryption scheme ... only if it is available as a voluntary alternative to widely-available, commercially-accepted encryption programs and products." We would applaud the Government for employing NSA's substantial expertise to devise improved encryption schemes -- like DES and Skipjack -- and deploying them to improve our society's privacy and security. We hope that the Clinton Administration can agree to take this single step. Here is the whole journey we'd like to begin. If you share our path, we need your help and support -- please join EFF. Send the end of this document for details. Electronic Frontier Foundation Policy on Cryptography & Privacy (Approved November 11, 1993) Digital technology is rapidly rendering our commercial activities and communications -- indeed, much of our personal lives -- open to scrutiny by strangers. Our medical records, political opinions, personal financial transactions, and intimate affairs now pass over digital networks where governments, employers, insurance companies, business competitors, and others who might turn our private lives against us can examine them with increasing ease and detail. The Electronic Frontier Foundation believes that Americans must be allowed access to the cryptographic tools necessary to protect their own privacy. We will work toward making the following principles the official policies of the U. S. Government: 1. Private access to cryptography must be unhindered: * There must be no laws restricting domestic use of cryptography. * There must be no restrictions on the export of products, services, or information because they contain cryptographic algorithms. 2. Cryptography policy and technical standards must be set in open, public forums: * All participants in the policy debate on these issues, particularly law enforcement and national security agencies, must submit their arguments to public scrutiny. * Any civilian encryption standard must be published and exposed to rigorous public challenge. 3. Encryption must become a part of the information infrastructure to provide security, to protect privacy, and to provide each individual control over his or her own identity. * Each user must be free to choose whether or not to use key escrow, and who should have copies of their keys, if anyone. * Government at all levels should explore cryptography's potential to replace identity-based or dossier-based systems, such as driver's licenses, credit cards, checks, and passports with less invasive technology. 4. New technologies must not erode constitutional protections, particularly the right to speak, publish, and assemble, and to be free from unreasonable searches and seizures . * There must be no broadening of governmental access to private communications and records, through wiretap law or otherwise, unless there is a public consensus that the risks to safety outweigh the risks to liberty and that our safety will actually be increased by the broadened access. *** The Electronic Frontier Foundation recognizes that the combination of digital communications and encryption technology does indeed threaten some of law enforcement's current investigative techniques. We also recognize that encryption will prevent many of the online crimes that will likely occur without it. We further believe that these technologies will create new investigative tools for law enforcement, even as they obsolete old ones. Entering this new environment, private industry, law enforcement, and private citizens must work together to balance the requirements of both liberty and security. But technology halts for no one, not even the law. *** For Electronic Frontier Foundation membership info, send email to membership(a)eff.org. For basic EFF details, send email to info(a)eff.org. Other queries should be sent to ask(a)eff.org.

2 1

Test
by ARL106＠PSUVM.PSU.EDU 17 Dec '03

17 Dec '03

This is a test. Sorry to waste the bandwidth.

1 0