December 2003 - cypherpunks-legacy

Dallas lawyer needs consultant for privacy of international linguists
by gnu 17 Dec '03

17 Dec '03

From: "Brock N. Meeks" <brock(a)well.sf.ca.us> Subject: This guy needs help John, please forward: Since I'm not an active member of Cypherpunks, I thought maybe you could post this message. It's legit and I think a worthy cause. There's an attorney in Dallas that needs help: Your help. Crypto help. His name is Albert Rochelle (214-520-0881). He contacted me after reading my article on privacy and clipper in the April issue of _Wired_ magazine. Albert's client is an international organization of linguists. They specialize in taking unwritten languages and translating them to written words. They are a clean, non-political group and they want to stay that way. Trouble is, Albert told me, there are governments, both U.S. and foreign, that want to tap this organization's files to access the "raw intelligence" that their field personnel often send in. This intelligence is nothing more than the certain problems they might be having with the in-country governments. But they don't want prying eyes to be poking into their files, using whatever they send in against other groups. Similarly, they don't want their translation notes, files, used by intelligence agencies against the people they are working with for translation. So, they want to encrypt and they need some expert help, Albert is in charge of helping them do all this, BUT HE'S A NEOPHTYE and readily admits this. He's all for privacy encryption schemes and thinks the govt. proposed Clipper standard stinks. He's willing PAY MONEY for your help and he's looking forward to hearing from anyone out there willing to help him get his organization, crypto-safe. Please give him a call, like I said, he's willing to pay for your services. Tell him I sent you. Brock Meeks reporter Communiations Daily ------- End of Forwarded Message

1 0

Mar 12 mtg notes [long, 35K]
by M. Strata Rose 17 Dec '03

17 Dec '03

Here are my notes on the March 12th meeting; I haven't really edited them, so they are kind of rough, but if I waited until I had time to edit them they'd never get posted. All I've done is run thrm through a spelling checker and do minimal clarification where I was typing only pieces of something. They were in Acta format, not plain text, so there are lots of tiny paragraphs that used to be outlines, the indentations still carry some of the form though. I apologize for the formatting, the mac editors are lame about saving text with layout, putting in an extra LF with the CR's and doing other lossage. And we won't even talk about getting rid of "smart quotes" (aargh); at least two major editors force you to do find/replace to get rid of them... I would be happy to save a postscript version of the document and put it up for FTP on soda. Comments, clarifications, and identifications of folks who are annotated as "??" should be sent to strata(a)fenchurch.mit.edu, not to the whole list (where I wouldn't see them anyway, since I am only on cypherpunks-announce). Apologies to the folks who didn't want 35K of notes in their mailbox, the tyranny of the vocal majority requested they be posted... :-) _Strata [Notes on Cypherpunks meeting at Cygnus, Mar 12 1994. Copyright M. Strata Rose, 1994, all rights reserved. This document may be forwarded in its entirety for personal communication but may not be quoted at length without the author's permission. Journalists wishing to use this document as source material must first contact the author.] Show-n-tell: cypherpunks digital phone project Eric Blossom shows board to connect between phone and wall, engineering prototype on Codex chip, etc 28,800 baud capable, 120db down relay; pcmcia for keys, etc 2105 xtrlr, inline devices, $12 q 1; can use as answering machine, etc; final target price under $1K Tim May says some folks in Seattle years ago got a patent on something called Phaser Phone, crypto phone, USGov used the patent to slap a classified on the technology. AT&T phone competitive price... Phil Karns made request for Applied Cryptography, ruled to be in public domain and thus exportable; the day he got that on paper he filed a second request on "is the floppy exportable?" Someone should file a CJ request for PGP download, put on floppy, write letter attesting that you got it that way, Mbone audio link Mark Horowitz & co at MIT Nathan Loofborough at ohio state market.dun-dun-noodles.?? SF cypherpunks EFF offices in DC, Dan Brown sysadm doing direct audio link to Horowitz at MIT, mixed into mbone from there control center up in BayMOO so that there's a token (a floor tile) for message-stick, one delegate per site to talk, control room has a hush feature to shut up non-delegate speakers; later on there will probably be some echos-- people will type live meeting into MOO areas Pavel runs similar setup at PARC Head count MIT 8-10 folks EFF 11 MtView 45-50 Ohio State 1 San Diego 1 Agenda Politics! almost first anniversary of clipper meeting Eric H notes that Clipper was deliberate executive branch sideswipe of separation of powers; Dorothy Denning mentions economic ploy-- using discretionary fund to purchase clippered phones w/o legislative review, creating demand & standard in one swoop We will have to involve the legislature to stop Clipper, you can"t just ask executive branch to restrain itself; we will have to restrain legislature w/judicial restraint; we probably need an amendment to enhance privacy to preclude lossage. Four main points are: comm tech crypto tech anonymity pseudonymity Mark Horowitz mentions needing to get a populist feel for pseudonymity before trying to get stuff for amendment Tim May: brought stack of books to show; how to avoid the privacy invaders: low profile getting started in the underground economy how to create a new identity the outlaws bible by ex boozy the us intelligence community by jeffrey richelson, in tradition of banfrey/banfey pub by ??B in cambridge subsidiary of harper & rowe bruce benson, the enterprise of law, (distributed legal systems workings) (how cryto anarchy might work) how to launder money how to open a swiss bank account the secret money market Juicy books! (sez Tim); the theme was Rants this time, so he wrote a rant on the coming police state; may drift into a police state not by malice but by gradual surveillance for "our own good". Example: stuff built into cars for tolls, bridges, etc; how about using Chawmean(sp?) credentials for anonymity based on payments beforehand. Linkages of other info on drivers licenses, for example health system stuff, could lead to things like diabetics being denied access to bars as incidental info comes up on age-check scan Tim mentions Cpunks is kind of stuck in 1970's secret decoder ring technology, not concentrating enough on fighting routine surveillance by "benign" agencies; Tim is not seeing any mainstream discussion of Chawm technology in American press. Worst can happen very quickly if backlash against immigrants goes into effect, or if national health plan card goes worst case. Double whammy this month: clipper goes through as if we never tried, then digital telephony II resubmitted for massive tapping and lossage. Increasingly groups will have scattered meetings, under DTII the meeting today would have to be tappable. Gilmore says Senators Leyhi and Edwards are having hearings, John, EFF, & randoms (phone, computer, civil libs folks) will be testifying. Wants to take small exception to what Tim is sayng; EFF has taken strong stance that transactional data shouldn"t be available without a real live warrant; DTII says that gov folks could get phone numbers, etc w/o even going through a court. Mentions cell phones keep your cell location even when you"re not on the phone, auto net trackers, etc, this is transactional data, this is why they are tryiing to get this into law now before people are thinking about this much. One thing came out in hearings is how much law enforcement folks are already demanding direct from phone companies (to get your bills if they"re in investigations), they get more than 100K people's phone bills and do web analysis on drug dealers, etc; source for 100K number is House report on the ECPA. One of most important parts is to protect transactional data with bureaucratic process reviewed by juidicial staff. Tim wrapping up, has one more thing to say; EFF and lot of other groups fighting for this, he in person has no faith in the govt being trustworthy, do security via obscurity and just plain don"t let the govt figure it out, have it encrypted. Query from MarkH; agrees with Tim, preaching to converted though; problems due to ignorance and apathy on part of people, people not aware of full ramifications of personal privacy. Europeans seem to be more aware. Phil Karn comes in via San Diego <Hugh announces he's on the link> Fen mentions we need both to educate and to opt in to things, that you shouldn"t be selling your info (such as ATM supermarket purchases) w/o consent and knowledge. Mark H. asks what we can do in specific; Eric Hughes says we need to set agenda and work on positioning. Constitutional Amendments AntiClipper Legislation Strata: do newspaper article on parallels between stuff here and now and stuff in Eastern europe Bill Stewart: NIST survey on privacy and tech, look for it on the net Don Hopkins: frame this as "you need your privacy to protect yourself from your neighbors" ?? : Maria Cantwell's HR 3627 export restrictioin lifting ??: Make people realize privacy tech exists ?? : NII privacy issues request for comments (Bill Stewart) Neil Rest: develop pieces of agitprop, etc get press kits and pamphlets so that when we can give them info when we GET their attention! ??: WWW page, has anyone made one, let's do a single site for lots of anti clipper, lots of tail ends in other stuff ??: takes care of small network, his responsibility is to give privacy, wants to give govt solution and make ourselves the watchmen Strata: encrypted alt group w/news service, put in time to make it juicy and fun, give folks motivation to use the tools. Tim May: agenda item on active sabotage of big brother/clipper, create anticlipper sentiment in new grads, semiotic anticlipper thingy, ?? AT&T guy: let's do executive educatioin seminars for corporate weenies on clipper, those dudes have access to the PACS Arthur Abrahms: publicy of privacy enhancing solutions to stuff like toll booth problem, popularizin them nelson baghla (sp?): come up with solution to the govt's problem that protects our privacy Gilmore: official study of crypto coming up, Herb Lin of Nat"l Research Council, needs good people to be on review board/panel Strata: NPR radio show on clipper ??: will anyone go on mcneil lehrer? Bill Stewart: stockholder resolutions for corporations good way to do propaganda and to generate publicity & opinion John Morton: journalism outreach, list of Cypherpunks reps who are willing to be contacted (is part of press kit), *do* a press kit ??: are there clipper clipping services Russ Whittker: set up speakers bureau, people willing to speak at functions about this Gilmore: deploy cryptography, put kerberos in your OS, do the usenet feed, etc Jim Warren talk: Jim Warren: AB1624 passed, round of applause learned how to use the net to pursue political advocacy and action, and to amplify political power in the hands of people woke up after reading piles of email on gov weenieness with a solution on how to do this: we all know to write letter to congresscritter; turns out letters to state (much less feds) count in certain ways individual letter, some attention form letter, less attention phone calls, logged only (counted) form letters & cards almost useless w/one exception [support/anti support for bills, treated later 3/19 _S] communications become much less interesting to legislators once they come from someone who isn"t a voter in their own district; in some district offices the staff has instructions to throw away unread stuff from people outside the district how do we persuade them with the people they DO pay attention to? (registered voters in their district) "communication from a citizen who is not identifiable as a member of a partisan group, political affiliation, or other organization, ie not a drone from somewhere like NRA, church, etc, ie something that seems to be from a private citizen rather than from a push group" (highest value) of course, let's be realistic here: PACS have mucho power Best case is Mr. Organization with a large check, but next after that is private citizen apparently writing from an individual concern. What we really want is a whole bunch of people from their own districts appearing to spontaneously write in and say "hey, don't do this" or "hey, do that". If you want to influence congress, don"t contact all of them, contact committee members, target them; "major perversion, err amendment" (his quote!) goes on in committee. [Request for] bill status documents bill's path through committees, subcommittees. Identify few members of key committees that are real decision makers who can kill the bill before it hits the floor, where they don"t dick with it much. If we can persuade their voters in their district to contact them apparently spontaneously, we have clout that exceeds lobbyists. In all jurisdictions, voter registration lists are public record and available in machine readable form; Contact folks in your own district and ask for real citizens in your own district to send real letters to a citizen in the key members" district, just tell us how many letters you are wiling to write and we"ll give you mailing labels for them and some sample letters to modify electronically to write to the folks! Modify the hell out of it, this is not a topdown authoritarian form letter it is supposed to be grass roots; please use typewriter fonts only, give folks scripts to do mailmerge stuff on their personalized form letters, idealized letters. Example: draft sample letters, inflammatory, less inflammatory, polite, post via FTP and call for effort, say I"ll provide you with names & addrs; typical district congressional is 500,000 - 600,000 with probably 250K reg voters; provide folks with scattering of names so that everyone doesn"t send their own letter to neighbors, businesses in same area (to prevent people from thinking its a scam or form letter) when I provide name & address sets I will provide name & addr of cooperating people in district of test recipients (and will tell you), so that I can find out what you"re sending and when you"re sending it, ie tell them that there are salts in the list but not who the salts are... let's also provide form letters appropriate for sending to newspapers; typical ways you can draft a letter that will almost certainly make it into editorial pages, provide forms and instructions on how to do that When I did AB1621 I wrote it [the info on the bill, and in sample letter] in such a way as any reader could find out issues, topics, who to write to, etc but so that direct cutting and pasting was *hard* but getting info out was easy, so people wrote in and gave same info but no two letters really resembled each other so the effect was very powerful in typical urban, suburban, etc, newspaper, letters to the editor page will exceed comics and sports! Typically 1/2 to 2/3 of those 250K voters vote, so that knocks down the list of those to influence to write; the ringer is that politicians have a different kind of arithmetic they have memorized; it's not the population, not the reg voters, not the voters who actually go out and vote because in a contested election most of those are won by a 5 to 10% margin; so anyone a legislator believes can swing 10% of the vote in their next election is someone to be "cozied up to and feared". Numbers turn out to be (upcoming boardwatch article by Warren) 3500 to 7-8K affected in a typical district, if you can affect those voters you can swing the election. Ways to figure out which ones those are, BTW. Reg list will not only have names and addresses, but will typically track who has voted in the last X elections, ie whether or not you showed up. You can get that info! Every candidate running wants to know who ACTIVE, likely registered voters are. Don Hopkins asks if politicians are smart enough to check letters from folks against names of active frequent voters; it is actually a criminal violation in many districts! System in SoCal called Monarch that tracks voters and can pull names and addresses, they can pull your info when they get a letter to see if you"ve voted recently, what listed party affiliation is, etc. Jim W has been told that part of that info has been blocked off from legislator's staff via their own computers, they have to go to the Partisan office. Other things need to be made available--- master copies of leaflets and door stuffers. Available to residents in or near a congressional legislator's district. Works for any legislation, not just anticrypto and not just congresscritters. Activist near target geographic area must print on laser printer, do good quality leaflet, though there may be marketing justification for making it look somewhat homemade. Door stuffers & leaflet are standard political tools, used by activists, you don"t have to be charming, etc, can do from your own home 7x24, "this is Nerd Power folks! This is Active Participation, this is access to information so provocative and persuasive that they are persuaded to act, this is Patrick Henry writing inflammatory text that Ben Franklin prints on the printing press in the spare room in his home that Paul Revere rides down the electronic highway shouting and handing out literature..." One of the cool things about this technology is that it is absolutely useless to covert interests, doesn"t work on issues that can"t be open action, that the public wouldn"t support! You don"t have to be covert, you don"t have to sneak up. You can say here's exactly what we"re doing, if you know what's going on you will get really annoyed and help the cause. His guess is that this will be fairly mature and ripe technology by 1996 presidential elections and that this will be a massive tool in the 2000"s. Most effective political action is from nonpartisan citizen to his/her elected official; "this is a chance to use these ThinkerToys to ... "<hugh being annoying lost memory of quote> Wex from MIT: thanks, he's a little jaded since he's been using it in environmental movment, is more effective with a central organization, like EFF, someone needs to do this (radio shows, get volunteers, etc) Jim agrees, says it takes folks of wide talents ranging from wordsmith to scutwork secretarial to political insiders/realworld familiarity to put it all together. But it doesn"t take a lot of people to do it and it can be done by a much much larger range of people than the ones who can do traditional style PACtion. Does not require significant loot! Caveat here: the computer, laser printer, etc better be owned by private individual or by registered political org, otherwise you"re asking for trouble unless you register it as an In-Kind Contribution, can lose your 501(c)3, rival politicians will look for this and any other thing to cause trouble and shut you down! Major flak in Sactoh has some senior politicians doing jail time for using such resources for poli stuff. Push from the ["misguided": Eric H] privacy enthusiasts, to severely restrict machine readable and even paper copies Milton Markson in Senate (SF) Jackie Spear in House (south SF); only big money parties and incumbents would have access if that passes. Indicentally it ain"t hard to get this, he has DAT tape that he always carries with him, has all reg voters for SantaClara and SanMateo (750K- 850K, 400K respectively) on hard disk as well as property records (assessors records). Straight off magtape was 400-500Meg per county. Company in SoCal in SanDiego that has pressed CDROM voter reg records for under $100, privacy advocates "going orbital" over this, statutory restrictions that these are supposed to be being used for campaign, etc. but a helluva lot more people are buying them than can be accounted for that way and you know they are being abused by market-o-droids. comments from ?? (perry?): real problem is that in many cases a senator will have many people who agree wholeheartedly with their (to us, lame) cause, example of senator in Arkansas, trying to do gun control campaign-- ha ha, good luck! Jim replies he is doing electronic equiv of precinct walkers and drones; arthur abrahms says "its a brilliant way to subvert localization of political process" "Perot-inoids" are sponsoring balliot initiabive to stop anyone from contribing to state or local campaign who was not able to vote in that campaign. Jim thought it was neat until someone in Common Cause pointed out fallacy (contribs are political speech, so 1st amend). Main fallacy is that congress votes on laws that affect all of us, so members on key committee might not be elected by any of us in a district yet we are going to be affected by their votes, so it's right and correct for us to seek to affect them. ??: suggest cross correlating email addrs w/voter reg letters to send pre-emailings to people likely to have email addrs, etc... BTW, legislators almost never read actual letters, almost never have time to meet people, etc etc; their time is sucked up by all kinds of folks....the flapper system is alive and well, flappers read and summarize all... Neil Rest: is list of congress committees and subcommittees somewhere easily downloadable, also list of districts by zipcode so we can filter our own addressbooks to find folks in good districts; Jim thinks much committee stuff is ftpable from cpsr.org. Zip code exists, every political operative probably has it, can be created from precinct records, but legally shaky, maybe 70% of zip is in one district and 30% in another, so not as great. Finger a zipcode and find out who your legislator and member of assembly is: finger 94087(a)sen.ca.gov, has a nice little finger daemon to do the lookup.... When Jim got started on 1624 they told him it was dead, he said "why, its a great bill?", "well we can"t find any support for it", "well what do you need as evidence of support?" The aide said "10 or 15 letters or faxes would be a strong showing of support", I said "out of *31 million californians?!*" and she said *yes*. That is a good idea of how much a letter from your own district counts. Only exception to "own district" rule is a bill's author wants to see a whole lot of letters from anywhere at all; they HATE to see letters opposing the bill. Mentions 1991 example of "the offending sentence" in a bill , outlawing crypto, "they got torched to hell and gone", took only 2 weeks to get rid of the offending sentence. ALWAYS worthwhile to do concise 1 page letter to bill's author supporting or opposing! Schlackman and Fozzio in NYC, American Campaign data in Palo Alto, acquire all this info from county, will sell it to you in mag tape, labels, printing, walking order maps, etc. On the cheapo, go to voter reg place (county clerk etc) for a given jurisdiction and purchase info on diskette (often, but sometimes in 9track ebcdic). He's planning on pursuing this technique and process for crypto issue, against software patent monopoly, for state push to get political disclosures available electronically for free online jwarren(a)well.sf.ca.us Gilmore's FOIA's ftp. cygnus.com: /pub/foia.clipper.key Phone interview w/Phil Z, Gilmore, in InfoSecurity News [note: firewalls list recently posted address for it, look in ftp.greatcircle.com for list archives of past month 3/19 _S] Ch 7 news came down and did interview here at Cygnus, related to CERT advisory passwd cracking stuff, we put a press release out re: public release of Kerberos, they called up Cygnus noticing from the press wire; Gumby gave a demo gotten from cracker's passwd sniffer which was installed by cracker; other story in that news segment was about 3 guys put up billboard looking for wives and a voicemail number, someone hacked in and put a new outgoing message saying "thanks for calling but we"re really only interested in men". Clipper FOIA, no response yet Exports, commerce, etc he asked "how is crypto being applied, etc etc" in commerce & export first folks to reply were Dept of Justice Office of Legal Counsel analysis folks who were saying that licensing scheme violates 1st amendment; have been writing memos to that effect for years! memos have been forwarded to EFF, scanning them in Jim Warren: suggests forwarding these to 2020, Day 1, etc, this is one arm of the govt stonewalling another arm Gilmore got turned on to the Office of Legal counsel because of 1980 hearings on Govt Classification of Private Ideas (crypto, patents, private research on atomic energy were main topics); turned onto those hearings by Brahms Gang posting on sci.crypt, found copy of hearing in Fed depository, later found transcripts of entire hearings not just minutes/proceedings; very first memo from office of legal counsel is repro"d in minutes, saying "we"re trying to tell you it's unconstitutional". two sentence synopsys: if you file to try to get a patent on something they can order you not to tell anyone about it and they can put your patent application on hold indefinitely and you can go to jail for a decade for talking about it; George Devita (early crypto inventor) got notified on a speakerphone surrounded by students and was thus in violation immediately, publicized his case to NYTimes & congresscritter, part of impetus for hearings, NSA backed down. Generated List of Agenda Items Eric notes that the balance between external education and internal generation [of items] is pretty good.... Legislation available to us: we need to figure out what needs to go into a bill to kill Clipper RIGHT NOW... Arthur suggests making mandatory for intra-gov comm, Eric says no, that will create a market, maybe a secondary strategy is if clipper passes then try that no Fed standards w/classified data MIT says that NSA is breaking the law right now, there's a regulation against it, they asked Mike Godwin and he said <garble> don"t mention it you"d be screwing up! ??: would suing be a good tactic, asking for a writ or somesuch to enforce the statute against the NSA doing this kind of stuff (standards setting, classification) Bill Stewart: if NSA is not allowed to be involved in civilian crypto then the FIP defines the way you vet clipper as being "ask the nsa"; other way to define legislation is that escrowed keys be available to corresponding citizen and citizen notified of attempted and denied access ?? again: access to keys could be time delimited, notify citizen of end of time; Bill says in clipper you don"t know your own key so you should be able to know it; Neil Rest-- broadening FIPS (fed info proc stds) to FS (fed standards) ??: need to attack private citizens not using crypto legislation key "escrow" is illegal (pass a law) FIPS is illegal Eric H's whole attitude was turned around by one sentence from Mark Rotenberg, EFF counsel: "it's much more interesting to change the law than to adjudicate it." Bill Stewart: read Renos rules on access: said can be accessed by method A, B, C but not *disallowed* kinds of access can"t mandate clipper use between private parties and government (chip) Strata: can we mandate use of clipper or similar so that industry will say it's too expensive to implement ; Eric, no, backward strategies are too dangerous. Jim other (not Warren): can we do stuff on state level that will override the gov"t, can we persuade individual states not to use clipper and thus break the back of clipper that way (ie propose legislation that prevents CA from buying clipper phones) Arthur: alter rules of order for cryto legislation, require 2/3 majority Tim May: I think any law that says certain types of crypto should be required or disallowed plays into the hands of people who want to control crypto; how about coattailing on English is not national language movement, no one shall be required to speak in particular language. James Madison's argument against bill of rights recapitulated by Eric H in response to Tim, Tim says we shouldn"t be encouraging legislation, it encourages the feeling that they CAN legislate crypto policies. Lawrence Tribe from Harvard had suggestion for amendment basically "right of free speech and assembly should not be abrogated by technological progress." <bravo!> Chip: if skipjack hits PD, we should be able to use it Perry & Martin: how about a bill to put skipjack in PD Perry: require procedure & public reports, comments in fed register, rquire for all standards, procedure before adoption ?? : Xfer crypto policy into hands of dept commerce bureau of export (non military only); that agency has an entire culture of making regs easier & promoting export, etc; commerce always goes in and fights for decontrol, will create counterbalance force in govt pointing the right way! ?? blond guy: coda to having a central authority, put auto-approval on export/distribution, ie after N weeks it goes out if they don"t do anything... also that would be a good amendment to 3627 Eric says we need to replace "escrow", possibly w/key custody or key retention ["detention" says crowd]. Witt Diffy talks about terminology that John LeCarre put in espionage from his writing, if you think up terms that are better they *will* use them. net suggestions: loosely guarded key warehouse, key generation service key license vault, master key, custody, retention, key hostage, key confiscation, forfeiture, skeleton key, key minting Hugh-- Dept of Justic skeleton key closet? key licensing system, key assignment, Tim May says great exercise, but no parallel in our system, possible parallel in surrendering your documents when you travel. Key dissemination service, key surrender, sequester, key chaperone, duplicate key demonstration, keyjackers Trojan chips-- escrowed for your protection! <strata> bumper stickers-- my other key is not in the gov"ts closet! Just say NO to key escrow. Hell no, I won"t escrow. Ridicule terms-- house key escrow good analogy incumbents surveillance system <jim w> key conscription key seizure <tim may> privacy forfeiture system <arthur> key crib communication permit, privacy permit, security permit key sharing [the Barney system! eric] permissible privacy key disclosure system denial of privacy ministry of privacy (minipriv & minisec, one holds each half) Winston Denning Internal Privacy Service <don hopkins> also privateers, J Edgar Hoover Data Vacuum key generation bureau KGB privacy tattoo <hugh> ministry of information privacy reposession agency (repo man!) doublekey (like doublespeak); big brother's key ring dept of data vehicles <strata> Tim May says Joe Sixpack doesn"t know key escrow but has heard of Clipper, so we should hack on clipper. Acronyms Martin Perry: the visible citizen Tim May says Mike Godwin is referring to "information snooper highway" (info sniffer highway, Tim quips) SUCK save us from clipper keys Beavis & Butthead episode, have them build a DES cracking machine or talk the class nerd into it <strata> call it the "buttcracking machine" <eric h> Tim May talks about forging postings of semi-official memos realistically as a form of satire; Strata: no, it's too dangerous, we can"t afford to have people link us to not clearly labelled satirical documents; Gilmore: yes, remember how the cypherpunks community felt about being on the receiving end of the misinformation barrage via Detweiler; Tim: why not misinformation, just make it too bogus, etc; Gilmore: read great satire about Internet collapsing due to flat rate pricing, no investment by service providers, and in fact Nader commission just snuck a flat rate proposal in a couple days ago to "encourage competition"; Bill Stewart: yep april 1st is coming up, April 1st RFCs are traditional.; Tim clarifies he wants to make them look ridiculous, ludicrous, start a campaign of laughter against them; Arthur suggests that people don"t know the issues well enough; John Morton suggests preparing a white paper/FAQ style and gradually leading them into the issues and making it clear how silly it is. Martin Perry agrees, like propose a legislation that bans draperies, the drapery escrow stuff; Martin Minow says people should contact any Hollywood contacts as they have experience getting stuff out. Tim May: SNL did satire commercials of little Newton Message Pads of LCD notes, waiting for it to boot, etc. You could probably get SNL to do a fake commercial on key registration or key escrow, etc. Stuff was good-- after Newton pseudomercial 300 people apparently called Apple wanting to buy one! Bill Stewart: get Rush Limbaugh to do a fake commercial too and get the *other* half of the country.<applause> Hugh-- this is your key; this is your key on escrow Bill Stewart-- Clipper Key Escrow Service: we"re from the government, we"re here to help you Clipper the database from the people who brought you {waco, welfare} Strata: "Expose yourself to surveillance." Maybe we can get that mayor who did the expose yourself to art posters! Anything you say or hear can/will be used against you outside a court of law. Telephone w/Miranda rights on it. Martin Perry: stickers had " do not discuss or try to talk around classified info" at an old job of his, on phones. Katy: tidybowl man w/surveillance in a phone Phone w/"do not remove this tap under penalty of law" Bill Stewart: not only could "big brother inside" be turned into a screen saver but cypherpunks could issue a whole screensaver set and license it to Berkeley Systems; Martin Perry: spy vs spy too; every now and again it will randomly look like a fax is being made and say a copy of this screen is being sent to a govt agency; every time it is invoked it shows you what was on your screen the last time it was invoked; Tim May-- virus that says your hard disk is being duplicated. Void says a mod of the THX slogan: The govt is listening. The clipper chip, bringing you 1984 in 1994. Hopkins: Clipper backup plan-- send any vital data overseas encrypted w/magic cookie, send FOIA request to retrieve it! Use a phone, go to jail (arthur); May-- Clipper questions? call someone and ask them. Warning-- NSA has determined that strong crypto is dangerous to...<varies>.. Tim: aside from satire we should be thinking of different slogans that appeal to other groups ranging from Schafly and rightwing, etc. Only God should know (digital confessional, strata brings up clipper would violate this>) Arthur: Guns & codes, the american way. Clipper, for your most public conversations. <gilmore?> Clipper the last amendment <hugh> Ever had a gov"t agency tap you from thousands of miles away? You will! <??> Narrow your listeners down to two. <witt diffy> Reach out and tap someone. Tip & Tap, the Clipper Brothers Clipper, can we talk? Strata: let's hack popular music too: Whitney houston hack: "I will always hear you" and "from a distance" Tom: all conversations are created private but some are more private than others <much cheering> Clipper: the privacy problem's final solution you deserve a tap today; have it their way. with clipper you"re never alone <hugh> instead of we are everywhere, clipper: we will be everywhere. your direct line to the government third ear stickers for digital phones <strata> you"ll never talk alone Clipper: when you absolutely positively have nothing to hide Phil Karns says he wishes the people w/the good jokes would stand closer to the mike! Eric Hughes: a man's phone is his castle ...that huge sucking sound is your privacy flowing south into clipper....<?? perry?> pay no attention to the govt behind the phone line... Witt Diffy mentions German constitutional amendment debate to expand police capacity for legal wiretap; protest movement is using term <gla:sern burgher> (sp?) "a transparent citizenry" Strata draws parallel between McCarthyism & this, govt can say you have something to hide if you are fighting clipper. Anti-Clipper Semiotics Marketing & Positioning Press Coverage Now vs Eastern Europe Cantwell Bill HR 3627 Sameer(a)soda.berkeley.edu, student at UCB, cypherpunk remailer works to send return mail back with encrypted block; he has some docs on the remailer/blink anon server. A remailer that doesn"t need to know the correspondences between anon-ids and real-ids. Can"t run it for real yet, he has restrictions on his account, but contact him via email if you want to help test it. Also started writing an install script for cypherpunks remailers, if you get this install script you can just type install remailer and you"ll get a standard remailer that can tell "normal" mail from mail that should get remailed, etc. Available for ftp on soda. Strick; working on system called Kudzu, based on Tcl; hopes to port to PC and Mac, keeping modular portable components in key. Is crypto toolkit, has DES, RSA, diffy-helleman, gnu database, Ian Smith did C client wrapper for reading, interpreting mailers, lightweight threads out of SunOS, also setjmp/lngjmp. Wants to have support for threaded Dynin (DCNET) cryptography net, have random IP services in that. Plans to have FTP stuff (for US Citizens only) out before April trip to Budapest & Berlin; quip that he can"t go since he knows this stuff. Tim May mentions that if he said he was going w/the intention of implementing stuff outside the country he could be in trouble. M. Strata Rose Unix & Network Consultant, SysAdmin & Internet Information Virtual City Network (tm) strata(a)virtual.net | strata(a)hybrid.com | strata(a)fenchurch.mit.edu

1 0

Digital Signature Standard industry push
by Stanton McCandlish 17 Dec '03

17 Dec '03

|||||||||| |||||||||| Information Express || || a voorhees report || || || ||||||| 718-369-0906 voice || || 636-8931 MCI Mail || || |||||||||| |||||||||| 411 First St., Brooklyn, NY 11215 ==============================================================+ (c) 1994 Mark Voorhees --Feel free to re-post this article freely-- GORE URGED TO PUSH DIGITAL SIGNATURE STANDARD FORWARD Electronic security firms call for resolution of cryptographic patents March 21, 1994--Eight leading data security firms have written Vice President Albert Gore requesting that he prod the adoption of the proposed Digital Signature Standard. A patent dispute between the government and Public Key Partners is holding up the standard, which would provide a way of verifying documents used in electronic commerce. The companies--AT&T, among them--are frustrated that they are missing business opportunity through government inaction. The original standard was proposed in August 1991. PKP owns most of the critical U.S. cryptographic patents. It negotiated an agreement with the National Institute of Standards and Technology that would give PKP the right to earn royalties on products using the government's digital signature standard. That agreement, which was published in the Federal Register last June, raised a ruckus in industry among vendors who did not want to pay PKP. Gore bent to that opposition on February 4, when his office announced that the standard would be royalty free. While that pronouncement greatly pleased industry, it has created a thicket of sticky, interwoven problems that defy quick resolution. The federal government must either assume the royalty payments, which would likely total millions of dollars; try to invalidate PKP's patents in court; or come up with a new standard. The first option is politically explosive and the second and third are time consuming. "Many of us have invested tremendous time, effort and money in developing systems and products" built to the proposed standard, the letter said. A new standard would also encounter royalty demands from PKP and delay commercial development by four to five years. "Further delay would only delay product development, frustrate the user base, fragment the market and delay the benefits to be realized through electronic commerce," the letter said. Gore's office did not respond for comment by press time. The companies signing the letter were: Information Security Corp.; Litronic Industries; AT&T Secure Communications Systems; Digital Signature; Mykotronx, Inc.; Datakey, Inc,; SecureWare, Inc.; and Cordant, Inc. The letter was dated March 14. (For more information, please refer to the March 25 issue of Information Law Alert, which will be in the mail shortly.) | Mark Voorhees | voorhees reports | | 411 first street | 636-8931 MCI Mail | brooklyn, ny 11215-2507 | | 1-718-369-0906 (voice) | markvoor(a)phantom.com | 1-718-369-3250 (fax) -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

House hearings on Internet security TUESDAY 22 March, Wash. DC
by Stanton McCandlish 17 Dec '03

17 Dec '03

[cribbed from a pair of press releases] House Subcommittee on Science Hearing on Internet Security Chaired by Rep. Rick Boucher (D-VA) March 22, 1994 9:30 a.m. - 2318 Rayburn House Office Building The Subcommittee's interest in the issue arises in part because the Internet is a prime method of communication between researchers in academia and industry. It is also a major means of communication for federal researchers at agencies under the Subcommittee's jurisdiction. Recent break-ins on the Internet prompted the federal Computer Emergency Response Team to issue a special alert to Internet users on February 3, and suggest that the system may be more vulnerable than generally acknowledged to deliberate destruction or alteration of computer files. The hearing will evaluate the status of security on the Internet today and will examine measures currently available to enhance security, assess the effectiveness and degree of implementation of such measures, and identify obstacles to enhancing Internet security. Mail sstpress(a)hr.house.gov or fax 202-225-8280 for more info. For press access, call Rick Borchelt at 202-225-3359 Tentative Witness List Mr. L. Dain Gary, Manager Computer Emergency Response Team Operations (CERT) Carnegie Mellon University Pittsburgh, Pennsylvania (CERT is one of the coalition of response teams that form the Forum of Incident Response and Security Teams, or FIRST) Mr. Thomas T. Kubic Chief, Financial Crimes Section Federal Bureau of Investigation Washington, DC Dr. Vinton G. Cerf, President Internet Society Reston, Virginia (Senior VP of Data Architecture, MCI) Mr. Lynn McNulty Associate Director for Computer Security Computer Systems Laboratory National Institute of Standards and Technology Gaithersburg, Maryland (NIST is the secretariat for FIRST) Dr. Stephen D. Crocker, Vice President Trusted Information Systems Glenwood, Maryland (Chair, Privacy and Security Research Group, Internet Research Task Force) -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Administrivia: Questions about the List
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherdenizens, Sorry to bother the List, but two things have come up that I need some feedback on. Two items: 1. Is the list sending out messages in a defective (slow) way, or is my service (Netcom) bouncing a lot of mail, thus causing these delays as toad attempts resends? 2. I'm getting a lot of error messages from Julf's site, saying my messages cannot be delivered to "an2757938" and the like. This used to be a problem, but was fixed by Eric Hughes a year or so ago. It appears to be back again. Are others seeing this, too? First, I seem to be having delays in Cypherpunks mail of about 1-2 days on about 5-10% of all messages. This shows up as me not seeing messages others are already responding to (because 90-95% of all messages are getting to me in the usual prompt way). I especially notice this, of course, with my own messages. (I can't test whether other mail is being delayed, because I'm no longer on Extropians and so Cypherpunks accounts for 95% of all my mail.) For example, the item on video surveillance cameras, forwarded from alt.conspiracy, did not not reach me until a day after others had already posted public responses. And just today I got a 5-day old message (Steve Bellovin's "Re: Clipper Cracks Appear"). The message I posted today about "Shout it to the world: Clipper is Compromised!" has still not appeared at my site, although some others have already responded to me about it (ironically, Steve Bellovin did). My question is this: Is this just _me_ (and possibly Netcom), or are others seeing these delays? My suspicion has been that Netcom is bouncing mail, because of recent overloading and NFS problems, reports from other about their mail being delayed (usually this implies a bounce and resend), and from the lack of other messages here complaining about delayed messages. Could Hugh Daniel, if he is reading this, or Eric Hughes, or anyone else who has access to the list at toad.com give me some hint as to whether I should beat on Netcom some more? Could other Netcommers here, of which there may be as many as 50, tell me what experiences they've had? The second item is also an administrivia issue: I'm getting dozens of error messages from daemon(a)penet.finland.etc. or somesuch (I can't look right now at the precise address) telling me my mail cannot be delivered, will not be delivered, is being returned, etc. It looks like the old blocks Eric had installed to prevent Julf's system from doing this are no longer working. (There may be more accurate explanations....) Anyone else seeing this? Anything we can do? Does the new automated subscription software (majordomo?) have anything to do with this? If people send me comments, I'll summarize--unless someone really knows the Big Picture and wants to just summarize it all here. Thanks, --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

5 4

Exciting News!
by Adam Lake 17 Dec '03

17 Dec '03

Fellow cypherpunks: Your Clipper worries are over. Cracker Jacks will soon offer a Clipper decoder ring in a few select boxes of Craker Jacks;-) lake(a)uenics.evansville.edu ---------------------------------------------------------------------------- Space for rent ----------------------------------------------------------------------------

1 0

Re: How to control the Internet.
by henryl2416＠aol.com 17 Dec '03

17 Dec '03

Well, you don't have to worry about MicroSoft being buddy buddy with the US Govt'.. They are currently under investigation (read: Witch Hunt) by the Feds for having a monopoly... Seems to many people like to use MS-DOS...

1 0

Re: FWD: RIPEM/SIG - Worldwide Digital Signature Software
by Christopher Allen 17 Dec '03

17 Dec '03

At 12:21 AM 3/19/94 -0700, mdbomber(a)w6yx.stanford.edu wrote: >I tried turning RIPEM Mac loose on this message and it complains about a >garbled Originator Certificate, then complains that it does not appear >to be a PEM/RIPEM message. > >Did anyone else get this to work? I've tested this further - like you I can't seem to verify the press release using RIPEM Mac. However, I did find someone with the RIPEM 1.2 software installed and it does verify with that software. I've sent a copy to Ray Lau, the author of RIPEM Mac, as I know that he is working on incorporating the features of RIPEM 1.2 in the next version of RIPEM Mac. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<consensus(a)netcom.com> 4104-24th Street #419.. .. San Francisco, CA 94114-3615.. .. o415/647-6383 f415/647-6384.. ..Mosaic/World-Wide-Web Front Door: .. ..ftp://netcom7.netcom.com/pub/consensus/www/ConsensusFrontDoor.html ..

1 0

Where to find RIPEM/SIG (an exportable version of RIPEM)
by Christopher Allen 17 Dec '03

17 Dec '03

Though I've not seen much traffic here in cypherpunks on the new exportable version of RIPEM/SIG, I do think that its latest release is significant. RIPEM/SIG plus the new version of RSAREF is going to allow my firm to do some development on products that were not realizable with PGP (because of export controls, as well as licensing and patent issues.) For those of you who are also interested in the exportable RIPEM/SIG version 1.2a, the files are now available via anonymous ftp or by using Mosaic/World-Wide-Web. Unlike the binaries for RIPEM 1.2a, these files are available via anonymous ftp -- you don't need an account on the server to download the files (in order to get an account you have send an email message saying that you are an US or Canadian user.) The press release on RIPEM/SIG from Mark Riordan <mrr(a)scss3.cl.msu.edu> is at: ftp://ripem.msu.edu/pub/crypt/ripem/ripemsig/posting Binary files are at: ftp://ripem.msu.edu/pub/crypt/ripem/ripemsig/binaries/ ripemsig-68030-macintosh-commandline-1.2a.sit.hqx ftp://ripem.msu.edu/pub/crypt/ripem/ripemsig/binaries/ ripemsig-80x86-dos-vanilla-1.2a.exe ftp://ripem.msu.edu/pub/crypt/ripem/ripemsig/binaries/ ripemsig-hppa-hpux9.01-1.2a ftp://ripem.msu.edu/pub/crypt/ripem/ripemsig/binaries/ ripemsig-ibm-rs6000-aix3.2-1.2a ftp://ripem.msu.edu/pub/crypt/ripem/ripemsig/binaries/ ripemsig-sparc-sunos4.1.1-1.2a There does not seem to be separate documentation for RIPEM/SIG yet, so I guess you have to use the documentation for RIPEM 1.2a: ftp://ripem.msu.edu/pub/crypt/ripem/ripem.man ftp://ripem.msu.edu/pub/crypt/ripem/ripemusr.doc ftp://ripem.msu.edu/pub/crypt/ripem/ripemusr.txt A current list of RIPEM public keys is at: ftp://ripem.msu.edu/pub/crypt/ripem/pubkeys.txt The new RSAREF source code that RIPEM/SIG is based on was made available today the rsa.com server. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<consensus(a)netcom.com> 4104-24th Street #419.. .. San Francisco, CA 94114-3615.. .. o415/647-6383 f415/647-6384.. ..Mosaic/World-Wide-Web Front Door: .. ..ftp://netcom7.netcom.com/pub/consensus/www/ConsensusFrontDoor.html ..

1 0

Where to find RSAREF (source library used by RIPEM)
by Christopher Allen 17 Dec '03

17 Dec '03

Some people asked after my last message how to get the latest version of RSAREF 1.2 -- it can be found on RSA's anonymous ftp server. What is significant about the new RSAREF is that it is used as the basis for RIPEM and RIPEM/SIG, and that you can incorporate its toolbox in your own applications very inexpensively. According to their license agreement, freeware (i.e. non-moneymaking) software can use the RSAREF toolkit provided that you make the source code to your utility available. Though this is not official yet, I've been told by RSA that they will also grant a royalty-free license to shareware authors up to $10,000 worth of gross annual sales if the shareware source code is available and the author(s) do not charge more than $50 a copy. If you are a commercial developer, I know from personal experience that they can be quite reasonable about licensing -- they want this base level of technology adopted as widely as possible -- just make RSA a reasonable offer and I think they'll take it. Remember, even though you can use RSAREF to create exportable non-encryption based digital signature software, the source code to RSAREF is not exportable itself as it can do encryption thus it is only available to US and Canadian citizens. Information on what RSAREF is all about and what are the license terms are located at: ftp://rsa.com/rsaref/info.reply ftp://rsa.com/rsaref/license.txt To get access to a time dependent directory (it changes every few minutes) you will need to read the document: ftp://rsa.com/rsaref/README If you agree to it's terms, take the directory mentioned there and substitute it for the the checksum in the directory "U.S.-only 7c04e6". The uuencoded tar archive of RSAREF is at (remember to change the time dependent directory!): ftp://rsa.com/rsaref/dist/U.S.-only-7c04e6/rsaref.tar.Z The ZIP archive of RSAREF is at (remember to change the time dependent directory!): ftp://rsa.com/rsaref/dist/U.S.-only-7c04e6/rsaref.zip You can also get the RSAREF via email by reading the RSAREF license agreement and sending the following message to <rsaref-administrator(a)rsa.com>. If your electronic mail address is located in Canada, please send RSA your full name and mailing address; they'll need it to complete a Department of State export declaration. I acknowledge that I have read the RSAREF Program License Agreement and understand and agree to be bound by its terms and conditions, including without limitation its restrictions on foreign reshipment of the Program and information related to the Program. The electronic mail address to which I am requesting that the program be transmitted is located in the United States of America or Canada and I am a United States citizen, a Canadian citizen, or a permanent resident of the United States. The RSAREF Program License Agreement is the complete and exclusive agreement between RSA Laboratories and me relating to the Program, and supersedes any proposal or prior agreement, oral or written, and any other communications between RSA Laboratories and me relating to the Program. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<consensus(a)netcom.com> 4104-24th Street #419.. .. San Francisco, CA 94114-3615.. .. o415/647-6383 f415/647-6384.. ..Mosaic/World-Wide-Web Front Door: .. ..ftp://netcom7.netcom.com/pub/consensus/www/ConsensusFrontDoor.html ..

1 0