December 2003 - cypherpunks-legacy

Help Stop Clipper, Your Testimony Wanted
by Stanton McCandlish 17 Dec '03

17 Dec '03

Path: blogan From: blogan(a)crash.cts.com (Barry Logan) Subject: Help Stop Clipper, Your Testimony Wanted Organization: CTS Network Services (CTSNET/crash), San Diego, CA Date: Tue, 8 Mar 1994 15:15:30 GMT Message-ID: <blogan.763139730(a)crash.cts.com> Sender: news(a)crash.cts.com (news subsystem) Nntp-Posting-Host: crash.cts.com Lines: 99 ****** P A P E R T I G E R T V S O U T H W E S T ******* For Immediate Release 3.07.94 *Distrubute Widely* This is a request for submissions of video testimony regarding Clipper. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Is it a coincidence that at the point where the net seems poised to include the numbers of people required for it to become a truly democratizing institution, that clipper is introduced through a back door? Unless the conquest of cyberspace goes unchallenged by the public-at- large, First and Fourth Amendment rights will be abrogated in a "fait accompli" out-of-sight of democratic processes. The sanctity of coded messages from Starfleet are meaningless if cybercops patrolling the infobahn do not practice non-interference. This is a battle that cannot be won if fought solely in cyberspace. Outside forces can restrain what transpires and control the dilithium crystals that power the net. The implementation of draconian measures calls for innovative counter measures. Opposition to Clipper is largely confined to net users. We propose to take arguments against the Clipper proposal to the public with a video. Fighting with the traditional weapons of mass media will get the attention of the wider net-disinterested audience (most of whom will intersect with the net in the future), than relying on the net alone to conjure the necessary outcry to make Clipper an issue of public scrutiny. We need your collected clips to put together a composite argument. It will be distributed to public access television stations, key legislators, and also be made available to the general public. Submission guidelines: ~~~~~~~~~~~~~~~~~~~~ -Send us a video of you containing your most cogent thoughts and passionate statement regarding Clipper. -Please limit your comments to privacy issues in general and Clipper in particular. -Send original tapes (we'll return them) in any format, 8mm, Hi8, VHS. ~~~~~~~~ Hi8 is the best. -Because of both the nature of video and the nature Clipper, guerrilla theater is encouraged. -Submissions of arguments in favor of Clipper will also be considered for inclusion. -Contributions from outside the U.S. are welcome. -Suggestions about content and/or format welcome. -Please send your video as soon as possible, but no later than May 1st for consideration. Information about Paper Tiger: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Paper Tiger TV is a non-profit volunteer collective based in Manhattan, with working groups in San Diego (PTTV Tiger South West) and San Francisco (PTTV West). Paper Tiger TV produces 30 minute programs shown weekly on public access cable TV and distributed to cable stations, colleges and libraries across the country. The collective has been working for nine years with critical readings on many areas of cultural production including advertisement, TV, films, mainstream publications and cultural events. Although there is no confirmation, it is likely that the finished tape will be uplinked by Deep Dish TV: an association of community and independent producers, public access and cable programmers; a national, alternative satellite network with multi-racial, multi-regional representation producing and distributing television that has a point of view. FEARLESS TV!! We hope that our shows will inspire, educate and empower the political movements that we are a part of. Mail your tapes to: VIEWING HABITS 3270 MT.AACHEN AVE. SAN DIEGO, CA 92111 This is a historic moment, don't blow it. Make history, make video. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 4 1994

1 0

pgptools app wanted
by nates＠netcom.com 17 Dec '03

17 Dec '03

Hello punksters... I am almost done with some remailer software and I need something: an app that takes input from a specified file and sends output to anothe specified file (all on command line) and asks for the key from stdin or from an environment variable. This I need since PGP will not take environment vars or stdin for getting the key for a conventionally encrypted file. I would also like a program that will do nothing but encrypt a file specified on the command line and dump ascii-armoured output to another file, and ask for the password from an environment variable or from stdin. I am asking this since I hope someone else will have already done this or learned pgptools well enough to do it quickly. I thought about modifying PGP, but I also thought that many people would not want to use my remailer if I had to hack PGP to make it work ;-) My remailer implements the following features: :: Latency: ## MINUTES (where ## is an integer or the word "RANDOM") :: Request-Remailing-To: username@machine (of course) :: PleaseDontPad (keeps the mailer from padding the message) :: Encrypted: PGP (message is encrypted with the remailer's pubkey) :: SubjectEnclosed (if message is encrypted, the subject can be hidden inside the encryption envelope, on lines 1-5) :: SuperEncrypted (if the messge is encrypted, it looks for a line in the decrypted message that looks like: (on lines 1-5) SuperEncryptionKey: cjkdsancuiabcdsbakjcdsabkjcdsa and uses that key to decrypt the message again. ) In a configuration file, the owner can specify a few options, also: here's an example: # debuglevel sets the degugging level, 0 = off, 1 = on and 2 = picky. debuglevel 2 # loglevel sets the resolution of logs: # 0 = off. No logs at all. # 1 = Log Synopsis of message (from, to, subject, size, etc... not content) # 2 = Log Full message to the mailbox specified in logmbox # 3 = Log Full text and synopsis loglevel 3 logmbox ./log/mbox logsynopsis ./log/synopsis # This is the directory that all tempfiles, etc are set relative to homedir /staff/nate/dev/perl/remail # set the maximum number of latency minutes for random latency requests maxlatmin 20 # the process number will be appended to this name tempfile ./remailer-temp # defaultsubject specifies the subject to use if none is given, omit to # forward no subject at all. defaultsubject There is no subject. # The mailbox that diagnostic mail and non-remialer mail is sent to. mbox ./mbox # Passphrase for PGP decryption. passphrase nckldanjcsancjkndsakjcdsajk # sourceblock blocks mail coming FROM this address sourceblock detweiler(a)detweiler.org # destblock blocks mail addressed TO the address. destblock nate(a)vis.colostate.edu # netblock will block all mail going to that subnet. netblock whitehouse.gov In addition to this, the owner can change the number of padding sizes and their individual sizes... the remailer strips out the padding when it gets a message and adds it to the end when it's about to leave. -nate -- +--------- | Nate Sammons <nates(a)netcom.com> PGP Key and fingerprint via finger. | Clipper == Big Brother Inside. Question Authority. Encrypt everything. +---------

1 0

Re: 2nd CJ update
by Harry Shapiro Hawk 17 Dec '03

17 Dec '03

------ From: Phil Karn, Mon, Mar 14, 1994 ------ Right. The NSA doesn't have a copy of Applied Cryptography, and has never seen one. Yet, apparently, they signed off on my original CJ request to export the printed book (the State letter mentions comments from the Department of Defense, which is always a code phrase for the NSA in such situations). Perhaps they want to vet the disk to make sure you didn't use stego to hind something "illegal" on|in it. /hawk Harry Shapiro Hawk Manager of Computer Services Warwick Baker & Fiore habs(a)uucp.warwick.com

1 0

A "standardized" remailer syntax
by Sameer 17 Dec '03

17 Dec '03

In writing my client-end software for my anonymous server I came across the difficulty of building remailer paths because I was unsure that the cypherpunks remailers all act in a similar fashion, with a certain set of syntax. I've been out of touch with the list lately so maybe I missed something, but some sort of standard would be a good idea so that even though the underlying guts of the remailers, and even the latency, padding, and special features of remailers are different, there is a standard set of commands and actions which will make it easier to build tools for the user to make remailing easier. Here's my suggestion.. Header pasting: The '::' header pasting syntax should be available-- i.e. when a message comes into a remailer with a body starting with '::' the lines following until a blank line are pasted into the header. The '##' header pasting syntax-- when a remailer is sending out a message, if the body begins with a '##' line then the lines following that are pasted into the header of the outgoing message. Header commands: "Anon-To","Request-Remailing-To": strips headers and sends the message to the specified recipient. "Encrypted: PGP": The message has a pgp block encrypted with the remailer's key. The remailer will decrypt the pgp block before acting furthur upon the message. I *think* that this is the scheme that all the remailers are using, but I can't be sure. All remailers should have at *least* this functionality. Furthur features can be added-- commands for those could be standardized as well, but I can't think of anything. Comments? I can put this standard up on the ftp site, after some discussion. -Sameer

1 0

Books, Loompanics, and other weird stuff
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Branch Cypherians, At the Saturday Cypherpunks meeting (60 people there for all or part of the 6-hour meeting, not counting the remote sites), I displayed a dozen or so books. I've had a number of requests that I post the names, authors, ISBN numbers, and Department of Justice Permission Numbers. These are by no means the most important books to have. We have mentioned the crypto books _many_ times, and also such seminal books as Bamford's "The Puzzle Palace," Kahn's "The Codebreakers," Brunner's "Shockwave Rider," Card's "Ender's Game," and of course Vinge's "True Names." I shall not dwell on these further. (Except to say I did look for used copies of Bamford, for possible mailing to some in foreign countries, but couldn't find any. And I couldn't find any copies at all of "When Harlie Was One," so can't check out the issue of who first talked about worms.) Several points: * I'll list some basic info about these books. * However, these were just a bunch of books I picked to show the range of information about there, the stuff your local library is unlikely to carry. (Things like "How to Create a New Identity," "The Secret Money Market," "Getting Started in the Underground Economy." etc.). Understand that I make no claims that these are the best books available, or that their contents are up to date, useful, etc. * This is why I strongly recommend you get yourself a copy of the wonderfully wacky 280-page catalog from Loompanics Unlimited, Port Townsend, Washington. Details are below. Most of these odd and controversial books I ordered several years ago (1988) from Loompanics...no doubt more current odd books are now available. * Alternative books stores often carry some of these books. For example, the "Anubis Warpus" bookstore in Santa Cruz (across from the Taco Bell on Pacific Avenue) has many of these books, in addition to offering tattoo and peircings (ugh!, but to each their own)...I haven't had my public key tattooed on my arm yet, but I'm considering having "Poor Impulse Control" put on my forehead. * These books are not "crypto" books....I showed them at the "politics" meeting as a change of pace from the usual number theory and crypto-oriented books we pass around. So, here are brief descriptions of the books. Best that you get the Loompanics catalog, which has nice summaries of each of the books and, of course, convenient ordering information. - "How to Launder Money," John Gregg, 1982, ISBN 0-317-03306-9. A small pamphlet, undoubtedly dated material. Useful to provoke ideas, but don't rely on this. - "How to Open a Swiss Bank Account," James Kelder, 1976, ISBN 0-690-01033-8. Also dated....Swiss accounts are passe these days. (I have several of these sorts of books, picked up in various places....your library may have some). - "Getting Started in the Underground Economy," Adam Cash (right), 1987, ISBN 0-915179-46-4. More ideas, but don't rely on it for legal or current advice. Loompanics has a dozen or more titles with themes about black markets, tax avoidance, etc. - "Low Profile: How to Avoid the Privacy Invaders," William Petrocelli, 1981, ISBN 0-07-049658-7. Similarly, Loompanics sells numerous books with this theme. - "How to Create a New Identity," Anonymous, 1983, ISBN 0-8065-1034-X. (Warning: This book comes with the "Law Enforcement Access Field," so that anyone reading the book can be electronically reported to the Witness Security Program, which holds the monopoly on creating fake identities, credit histories, and other legends.) Need I say more? Things are changing especially quickly here, so the material is just a starter. Fake passports and driver's license are now buyable on the streets of major cities (especially in the colored sections) for as little as $25. - "The Enterprise of Law: Justice Without the State," Bruce Benson, 1990, ISBN 0-936488-30-1. This book I threw in to show folks that the anarcho-capitalist system many of us favor does have some strong underpinnings in legal theory. There are several dozen good books on libertarian theory. Most are available by mail order from Laissez-Faire Book in San Francisco. (Dial 800 Info, or SF Info.) - I also showed a book on American Intelligence agencies (NSA, NRO, DIA, State Dept., etc.) by Jeffrey Richelson, but Whit Diffie has already borrowed it, so I can't provide the relevant info right now. Richelson has written several books on foreign intelligence agencies (BND, Mossad, MI5 and 6, etc.) and U.S. intelligence agencies, and is a good "post-Bamford" source. Enjoy finding and reading these. But your first priority should be to get the Loompanics catalog...other books may spark your interest more. I think the catalog is still $5 (well worth it), unless you order another book first, as described below. Good luck! --Tim May From: solmaker(a)pt.olympus.net (Stephen Schumacher) Newsgroups: misc.books.technical,rec.arts.books,alt.books.reviews,soc.libraries.talk,comp.security.misc,alt.politics.libertarian,alt.zines,alt.wired Subject: review: Secrets of a Super Hacker Date: 7 Mar 1994 11:17:44 -0800 Message-ID: <2lfuko$6rd(a)olympus.net> SECRETS OF A SUPER HACKER by The Knightmare, introduction by Gareth Branwyn, 205 pp., 8 1/2" x 11", ISBN 1-55950-106-5, March, 1994, Loompanics Unlimited, Box 1197, Port Townsend WA, 98368. Price: $19.95 plus $4.00 for shipping (includes a copy of their must-have 280 page catalog of unusual books). Credit card orders to 206-385-2230 (phone) or 206-385-7785 (fax). This is a very good practical book on breaking into computer systems. It's readable, interesting, informative, balanced, and accurate, with a nice spirit of fun and swashbuckling! Here's the contents: Introduction: Hackers: Heroes or Villains? I: The Basics II: The History of Hacking III: Researching the Hack IV: Passwords and Access Control V: Social Engineering VI: Reverse Social Engineering VII: Public Access Computers and Terminals VIII: On-Site Hacking: The Tresspasser-Hacker IX: Hacking at Hope: Dialing Up Computers With Your Modem X: Electronic Bulletin Board Systems XI: Borderline Hacking XII: What To Do When Inside XIII: This Lawful Land XIV: Hacker Security: How To Keep From Getting Caught XV: Conclusion Further Reading Glossary 8 Appendices The Knightmare covers lots of clever technical tricks for gaining access, but he shows most glee with scores of hilarious "Social Engineering" scams for seducing legitimate users into revealing their passwords. The striking thing about these spoofs is, just reading them, you realize through the laughter how often these simple Social Engineering techniques will produce results and how the credulity of non-security- minded naive users is the weak point of any security system. Sometimes while reading, I wished the book provided more specific info about phone numbers, brand names, specific techniques that work on specific bulletin board systems, etc. But I recognize that such information would go quickly out-of-date, or would be fixed in response to the book's publication, or could implicate the author. The Knightmare is presenting concepts that won't go out-of-date soon, giving the interested non-hacker a comprehensive and comprehensible survey of the field, and tipping off the potential hacker with just enough details to get him/her started and steered in the right direction and minimize the chance of getting caught. On this final point... a few times during the early chapters I thought The Knightmare was being cavalier about personal safety, favorably reporting (for example) Social Engineering advertizing scams that would likely bring the cops to one's doorstep. But The Knightmare was saving his warnings for 2 chapters towards the end, 22 sobering pages that make very clear the risks involved and what definitely NOT to do. A very balanced presentation. As usual with Loompanics books, this one can be read backwards, and pages 167-168 are directed specifically to System Administrators interested in beefing up security. I also appreciated all the hacker philosophy and pragmatic do-no-damage hacker ethics. The Knightmare disdains and derides "crackers" who break into a system in order to wreak havok; for him, "hackers" are peaceable, non- destructive puzzle-solvers and liberators of information. In a world where the govco is ever working to extend and centralize its control over financial data, encryption techniques, cyberspace, and every aspect of people's lives, the hacker may emerge as a modern-day Robin Hood. -- Steve (solmaker(a)pt.olympus.net)

2 1

LEAF field encryption
by smb＠research.att.com 17 Dec '03

17 Dec '03

As promised, I asked Steve Kent -- a member of the review panel -- about how the LEAF is encrypted. Here's his answer, reposted with permission. ------- Forwarded Message To: smb(a)research.att.com Subject: Re: Key escrow review In-reply-to: Your message of Mon, 14 Mar 94 15:54:22 -0500. Date: Mon, 14 Mar 94 17:03:18 -0500 From: Steve Kent <kent(a)BBN.COM> Steve, You are right.... SKIPJACK is used to encipher the LEAF, but employing a complex mode. The FBI can decode the "outer layer" of the LEAF to get the chip ID, by using the "family key" but it cannot get at the traffic key which is encrpted using the device unique key, the splits for which are held by the escrow agents. Steve ------- End of Forwarded Message

1 0

Re: Nature of RSA's patent
by jmueller＠gac.edu 17 Dec '03

17 Dec '03

> I've got a guy who's telling me that PGP-encrypted communications sent > into the U.S.A. from abroad can be stopped at the border as infringing > "products," pursuant to this statute. I know you are looking for legal advice, but the idea of some stiff trying to stop a communication at the "border" just seemed rather ludicrous to me. Somehow I don't think he'll have much luck imposing national boundaries on cyberspace, which has no borders, save those of private, individual systems. Once something is on the net, they'd do better of thinking of it as instantly being everywhere, rather than beating their heads against the wall with old, hidebound ideas of restricting the flow of information. -- Joel Mueller - <Insert your favorite witty quote here; I'm tired.> GAT/O -d+(---) -p+ c++@ l+ u++ e m+ s+/- n- h-- f+@ g+(-) w+ t(--) ry? PGP 2.3a Public Key : finger jmueller(a)gac.edu or on keyservers. 0C6D75 01 0E 16 A7 29 C4 48 75 54 CD 99 09 88 88 3C 39

1 0

Re: Canon Copiers
by Harry Shapiro Hawk 17 Dec '03

17 Dec '03

Jay @ The new models, the 350 and 550 do indeed have a currency recognition @ feature based on color. I was talking to a serviceman--interestingly, as @ I used to be skeptical of this feature--someone here conjected that it @ would be based on color. they were right. Smart. I was the one who said it might be color based. It maybe but once it finds the color it might do something else; I was able to copy one size but not the other. I thought it might be color as the copier has lots or routines for finding and shifting color; very helpful in the graphics are business. /hawk Harry Shapiro Hawk Manager of Computer Services Warwick Baker & Fiore habs(a)uucp.warwick.com

1 0

Hey...
by jmueller＠gac.edu 17 Dec '03

17 Dec '03

It's just occurred to me - say that all the petitions against clipper are ignored, clipper becomes mandatory, and other methods of encryption are outlawed, and clipper gets a user base of several million. One well-placed explosive device that destroys even one of the two escrow databases, and suddenly the government has supplied us with secure encryption that even they can't break. Of course, that is assuming that the government didn't lie and make extra backup copies (just for safety's sake, you understand, against just such a threat) that are kept somewhere out of public scrutiny, so that wiretaps can be made on a large scale without alarming people monitoring the access of the "official" database. Say all this happens. Maybe the government will even be the one to rig the explosion. Suddenly people lose all their reservations about using Clipper products. The government decides to give up escrowing keys (officially). But they can still listen in everywhere, and people won't be guarded. That first paragraph is also assuming that they didn't build in a back door to the encryption system. But then essentially the same scenario would apply. -- Joel Mueller - <Insert your favorite witty quote here; I'm tired.> GAT/O -d+(---) -p+ c++@ l+ u++ e m+ s+/- n- h-- f+@ g+(-) w+ t(--) ry? PGP 2.3a Public Key : finger jmueller(a)gac.edu or on keyservers. 0C6D75 01 0E 16 A7 29 C4 48 75 54 CD 99 09 88 88 3C 39

1 0

Transcript: Barlow v. Denning on America On Line, 02/10/94
by Stanton McCandlish 17 Dec '03

17 Dec '03

March 10, 1994 online debate between John Perry Barlow of the Electronic Frontier Foundation, and Dr. Dorothy Denning, over the Clipper Chip scheme, from the Time Online forum of America On Line. 3/10/94 8:49:41 PM Opening "Chat Log 3/10/94 CLIPPER" for recording. OnlineHost : Good evening and welcome to the Time Online Odeon! Tonight we look from both sides at the Clipper Chip, a semiconductor device that the National Security Agency developed and wants installed in every telephone, computer modem and fax machine. OnlineHost : In his article in the current issue of TIME, Philip Elmer-DeWitt writes: "The chip combines a powerful encryption algorithm with a ''back door'' -- the cryptographic equivalent of the master key that opens schoolchildren's padlocks when they forget their combinations. A ''secure'' phone equipped with the chip could, with proper authorization, be cracked by the government. OnlineHost: "Law-enforcement agencies say they need this capability to keep tabs on drug runners, terrorists and spies. Critics denounce the Clipper -- and a bill before Congress that would require phone companies to make it easy to tap the new digital phones -- as Big Brotherly tools that will strip citizens of whatever privacy they still have in the computer age. OnlineHost: "Lined up on one side are the three-letter cloak-and-dagger agencies -- the NSA, the CIA and the FBI -- and key policymakers in the Clinton Administration (who are taking a surprisingly hard line on the encryption issue). Opposing them is an equally unlikely coalition of computer firms, civil libertarians, conservative columnists and a strange breed of cryptoanarchists who call themselves the cypherpunks." RPTime: Lined up on our stage tonight are John Perry Barlow, Dr. Dorothy Denning and Philip Elmer-DeWitt. Barlow is co-founder of the Electronic Frontier Foundation, which promotes freedom in digital media. A recognized commentator on computer security, he is arguing against the Clipper Chip Dr. Denning is the chairperson of the Computer Science Department at Georgetown University. A leading expert on cryptography and data security, she favors the adoption of the Clipper Chip. Philip Elmer-DeWitt, TIME's technology editor will lead the questioning of our guests. Audience questions may be sent up using the Interact with Host function....Phil? PhilipED: Dr. Denning, could you *briefly* make the case for why we need the key escrow encryption system. DDenning: The government needs a new encryption standard to replace DES. They came up with a very strong algorithm called SKIPJACK. In making that available, they didn't want to do it in a way that could ultimately prove harmful to society. So they came up with the idea of key escrow so that if SKIPJACK were used to conceal criminal activity, they would be able to get access to the communications. PhilipED: THanks. Mr. Barlow, could you briefly make the case *against* Clipper. We'll see if I can be brief. We oppose Clipper in large part because of the traffic analysis which it makes possible. We believe that it is in the functional nature of the chip as designed to greatly enhance the ability of government to observe who we are calling, when, and from where, all fairly automatically and centrally. We also oppose Clipper because of the many way in which we believe the escrow system could be compromised, by people and institutions both inside and outside of government. PhilipED: Dr. Denning, what about John's contention that Clipper makes it easier to detect calling patterns. DDenning: I don't buy this. First off, for law enforcement to access any communications, they need a court order. Even if the communications are encrypted. Second, with a court order, they can get access to call setup information and find out what other lines the subject of the investigation is talking to. This is of much more use than anything in the encrypted stream. PhilipED: John, is Dorothy right that you need a court order for call set up info? Barlow1: Dorothy, the government asked for and received over 100,000 calling records last year without a court order. I see nothing in the Clipper documents which indicates that they would require a court order to get this kind of information, which each chip would make readily available to the entire network. DDenning: You need a court order to do implement pen registers and dialed number recorders in order to find out who is talking to whom. Barlow1: Furthermore, my faith in court orders has been eroded by 30 years of government wiretap abuse. PhilipED: Aren't we talking about three different hurdles here, one for a wiretap... Barlow1: But that's only with the present system where putting a pen register on a line requires physical entrance to a phone company site. PhilipED: One for a pen register (to track calling patterns in real time) and one for phone records. RPTime: Let's take a question from the audience... How would you guarantee that this facility will never be misused? If you can't make that guarantee, why should a democratic society, with a prohibition against prior restraint, consent to this? John Barlow? Barlow1: There are three different sources of information, as you say. But there are not three "hurdles." That sounds like a question for Dorothy. I don't think we should, obviously. RPTime: Dr. Denning? DDenning: First of all, there has been no evidence of widespread abuse of wiretaps since passage of the 1968 and 1978 wiretap statutes. Second, there are a lot of security mechanisms going into it to protect against abuse. Third, it will provide much greater protection against illegal wiretaps than we have now, since almost all phone conversations are in the clear. It will make virtually all illegal wiretaps impossible. Fourth, if for some reason it doesn't provide adequate protection, we can destroy the key databases and everyone will have absolute privacy against government wiretaps. I don't think our society will tolerate that kind of abuse. PhilipED: John, isn't Dorothy right that you're better off with compromised encryption than none? Barlow1: Gee, where to begin... First of all, there was plenty of abuse after 1968. Remember Watergate, Dorothy? Second, I believe that Clipper in the Net will dramatically *enhance* certain powers of... DDenning: I was talking specifically about wiretap abuses. And there hasn't been any evidence since the 1978 law. Barlow1: surveillance over current technical abilities. One of the reasons that wiretap hasn't been more abused is the bureaucratic overhead of current practices. Make it so that it doesn't require 50 agents to conduct a wire tap and you'll see a lot more of it. And Watergate included quite a number of wiretap violations. Indeed, the burglers were caught trying to install one. As to the assertion that we can always back up and destroy the databases if we don't like it, I can't imagine that someone as bright as yourself would believe that this is possible. Technology and power ratchet into positions which almost never retract without a complete change in the system of authority RPTime: Care to respond Dr. Denning? DDenning: Clipper would prevent the watergate burglars from getting anywhere since they wouldn't have a court order. Clipper will not make wiretaps cheaper or easier. Wiretaps are becoming more diffiults. And there will always be more agents involved becasue they have to follow exacting procedures, including minimization (throw out all conversations that are not specific to the crime at hand). Barlow1: Dorothy, they were from the *Government* remember? I can't imagine that Nixon wouldn't have been able to find a sympathetic ear from somebody at NIST and somebody else at Treasury. Further, you're not talking about the truly insidious element of this, which is dramatically improved traffic analysis. Content is less important than context, and most agents will support this. RPTime: Another question from the audience. JCMaille asks... Does the government have a constitutional right of access to my personal communications? Dr. Denning, why don't you go first? DDenning: The Supreme Court ruled that wiretaps with a court order are Constitutional. At one time, communications were not even protected under the 4th Amendment. The government could wiretap without a court order! Now a court order is required. PhilipED: To put the question another way, do citizens have a right to use powerful encryption? DDenning: Right now there are no laws preventing the use of any encryption. Clipper is voluntary. You can still use something else. RPTime: We have to apologize. John Barlow has temporarily lost his connection... PhilipED: Dr. Denning, in your opinion... would a law outlawing powerful encryption be unconstitutional? DDenning: I don't think so. But that doesn't mean it will happen. RPTime: John Barlow is back with us. Sorry for the interruption! Barlow, Denning just said she didn't think a law banning powerful encryption would be unconstitutional What do you say? Hi folks. Don't know what happened. Gald to be back Gald indeed! Barlow1: Actually, I believe that our current export embargoes are a violation of the 1st Amendment which specify speech without regard to the manner of speech. If we could restrict manner of speech, it would be constitutional to require that everyone speak English. Which of course it isn't PhilipED: John, can you make the case why ordinary law-abiding citizens need powerful encryption? Barlow1: Because it is in the nature of digitally networked communications to be quite visible. Everytime we make any sort of transaction in a digital environment, we smear our fingerprints all over Cyberspace. If we are to have any privacy in the future, we will need virtual "walls" made of cryptography. RPTime: Another audience question... Isn't this like the gun argument? If guns are outlawed only criminals will have guns? Well, if clipper is standardized, won't criminals be the ones NOT using it? RPTime: Dr. Denning? If Clipper becomes the de facto standard, then it will be the chief method of encryption. That would be what you'd get at Radio Shack. What criminals use will depend on what is readily available and what their cohorts are using. Both parties of a conversation have to use the same thing. Criminals also talk to a lot of people outside their immediate circle - e.g., to buy goods and services. Also, they can be quite stupid at times. But the main thing is that criminals will not be able to take advantage of the SKIPJACK algorithm as a way of concealing their conversations. This is the whole point. It is not to catch criminals. It is to allow people access to a really high quality algorithm in a way that someone cannot use it to conceal criminal activity. Barlow1: The gun analogy is excellent up to a point. I can't for the life of me imagine why we would think that even a stupid criminal would use Clipper if something else were available. And when I talk to people in the administration their big hobgoblin is the "nuclear-armed" terrorist. Any fanatic smart enough to assemble and detonate a nuclear device is going to be smart enough to download PGP from a bulletin board somewhere. Also, I'd like to point out that the gun analogy doesn't go the whole distance. Crypto is by its nature a purely *defensive* technology. You can't shoot people with it. PhilipED: Speaking of PGP, Dr. Denning, is that encryption system secure, in your opinion? DDenning: I don't know of anyone who's been able to break the IDEA algorithm that it uses. RPTime: Back to the audience for a question from Steve HW.. This is for Dr. Denning. What is the evidence of harm if the Clipper proposal is not adopted? DDenning: The harm would be to the government. They would not be able to use it and would have to resort to something less secure. Also, Clipper is part of a larger project to make hardware available for encryption and digital signatures. This will be used, for example, in the Defense Message System. The goverment needs a new standard. I personally believe that making really powerful encryption like SKIPJACK available without key escrow could be harmful to society. Wiretaps have been essential for preventing and solving many serious crimes and terrorist activities. Barlow1: Why on earth would the government have to use something else if they failed to get the rest of rest of us to buy into this folly? Hey, they are already using SKIPJACK. It's a government algorithm and has been in use for a... DDenning: CPSR and others are asking the government to drop Clipper. Barlow1: long time. There are plenty other algorithms which we can use which are truly protected... unless of course, this is only the first step in a process which will outlaw other forms of crypto. And I believe that it must be. Makes absolutely no sense otherwise. EFF is not asking the Government to drop Clipper, though we would vastly prefer they did. We're merely asking that no steps be taken to require it either by law or practice...as, for example, would be the case if you had to use a Clipper chip to file your tax return. PhilipED: Dr. Denning, do you think this is the "first step in a process to outlaw crypto"? DDenning: No I do not. The government has not been using SKIPJACK to my knowledge. The Clipper initiative represents the first time that the government has put one of their really good algorithms out there in the unclassified arena. They are trying to do this in a way that won't backfire against the public. Other NSA developed algorithms are not available for purchase by the public. Barlow1: I appreciate their willingness to make some of that crypto research available to a public which has paid so much for it, but I'm afraid that I would never trust an algorithm which was given to me by any government. And I certainly don't trust a classified algorithm like Skipjack, even without a back door which everyone can see. I think I'll stick to systems which have been properly vetted to be clear of such compromises, like RSA. I hope others will do likewise and that RSA will become the standard which Clipper shouldn't be. RPTime: Time for one more question from our audience... To John Barlow. Isn't society becoming increasingly vulnerable to concerted criminal/terrorist disruption, requiring *stronger* law enforcement tools? Barlow1: Gee. I don't know. It's a scary world. However, I'm willing to take my chances with the few terrorists and drug lords there are out there rather than trusting government with the kind of almost unlimited surveillance power which Clipper and Digital Telephony would give them. It's a touch choice. But when you look at the evil perpetrated by government over this century in the name of stopping crime, it far exceeds that done by other organized criminals. RPTime: Dr. Denning, hasn't remote listening technology enhanced police abilities to eavesdrop to the point... where the loss of a few wire taps won't mean much? DDenning: No. They need to get the cooperation of the service providers to implement a wiretap. The loss of some wiretaps could be costly indeed. As an example, wiretaps were used to help solve a case that involved plans by a Chicago gang from shooting down a commercial airliner. There have been 2 cases where they helped save the lives of kids who were going to be kidnaped for the making of a snuff murder film. They helped solve a case where a man's house was going to be bombed. I could go on. If we take John's arguments about law enforcement to their logical conclusion, we'd just get rid of law enforcement. I think it's better to have it. The people in law enforcement hate it as much as the rest of us when some member of the community does something wrong. And they correct it, design new procedures and laws where necessary, and go on. Barlow1: Oh, please. I'm not proposing eliminating police. I'm opposing giving them unlimited powers. Also,these are the same cases cited over and over by everyone from you to Judge Freeh. Surely, we aren't going to fundamentally change the balance of power in this country because of these two (undocumented, to my knowledge) stories. DDenning: Clipper is not going to change the balance of power. It does not give law enforcement any additional authority to do wiretaps. Barlow1: Well, this is where we basically disagree, Dorothy. If we could continue the same level of LE capacity we presently have, I'd have no objection. But I believe, for reasons I'm not sure we have the bandwidth to discuss here, that we are talking about dramatically enhancing their abilities. For one thing, we would greatly reduce the bureaucratic overhead involved in wiretap, which is what keeps it under 900 cases nationwide at the present. RPTime: And that will have to be the last word on the matter for tonight... DDenning: The overhead of a wiretap is more likely to increase, not decrease. PhilipED: Not quite! Maybe not! ;-) RPTime: THAT will be the final word! Barlow1: Well, let's get together and talk, Dorothy. RPTime: TIME thanks Dr. Dorothy Denning and John Perry Barlow for being with us tonight... along with Philip Elmer-DeWitt. Thank you all, and goodnight! Thank you both. This was very interesting. DDenning: Thank you for the opportunity to be here!

1 0