December 2003 - cypherpunks-legacy

Profiling (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

At Lee's request, I'm forwarding this note to several relevant forums. - mech(a)eff.org Forwarded message: Date: Thu, 15 Sep 1994 06:15:37 -0600 From: ap524(a)Freenet.HSC.Colorado.EDU (Lee Knoper) Subject: Profiling Reply-To: 6564559(a)MCIMail.COM [...] Here's a situation in which "profiling" by a government agency is already causing a problem. Recall that recently on <eff-activists) there was brief discussion regarding the use of "profiles" in advertising efforts, in the context of interactive TV. Some participants favored what was perceived as a probable improvement in the efficiency of such advertising. Others saw distinct dangers, especially if profiles were marketed or traded among private sector entities, or if government became more involved. This particular situation is quite disturbing because it involves a state tax agency, and as everyone can appreciate, here is an example of where one is effectively presumed guilty until proven innocent, and is subject to asset seizure pending resolution as well as possible forfeiture. A correspondent is trying to defend himself against some aggressive actions by the AZ Department of Revenue. He has discovered that AZ Revised Statutes section 42-117 permits the DoR, at its discretion, to assess a personal income tax which is based on a "statistically valid sampling method." Although this option is seldom used, it is being applied in his case due to partial loss of records during a move. In other words, your AZ tax can be based on your profile, irrespective of your income or expenses. Worse, AZ DoR cites ARS 42-113 through -115 as requiring one to keep records for four years after filing. Yet it asserts that there is no statute of limitations for audits - it can audit a filing at any time, and can presumably apply the statistical sampling method retroactively if it so desires. Obviously, this situation goes well beyond profiling to determine who to audit. These and other, equally onerous provisions comprise a pit of despair. Ironically, DoR asserts that "all laws are presumed to be constitutional." The U.S. military is also involved in profiling, which is probably not much of a surprise because the military is often used as a test bed for social engineering experiments anyway. New ID is being issued to retired and current members of the military and their dependents, and to commissioned officers in the U.S. Public Health Service. The new ID is replete with a digitized photo, two bar codes and what amounts to a kind of PIN linked to the SSAN. It is intended to be machine-readable and linked to local and central databases. It's also a bit of an eye-opener to note that it is expected to replace ID used for -other- than official business as well, like club cards and health care access cards. If it's not in your profile or if the money is not in your account, you can't do_it/have_it. Moreover, you'll probably get automatically reported for followup investigation to determine willfulness and intent. Does unrestrained profiling start to look a little ugly by now? It ought to. If there's money to be made, or power to be wielded, neither Constitutional law nor existing statutory law holds much sway. Lee_K

1 0

DC-Nets and sheep
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

doug(a)OpenMind.com (Doug Cutrell) > One possible way around this societal control of anonymous remailers might > be the existence of very large DC-nets (or related technologies). The idea I've been arguing that DC-Nets are among the crypto protocols that we've not exploited much so far. I was working on an implementation, till I got stuck with the 'net' part of it. The basic protocol is very simple, with hooks to the bit-flipping crypto routines. The problem is integrating the DC into an existing net protocol in a manner that makes it transparent and practical to use. Ideally a layer over IP or Ethernet, as DC-Nets share many of the basic problems of net protocols - conflict resolution, random wait-before-resend etc. Ideas? (Read section 13.4.8 of Tim's Cyphernomicon for an explanation of DC-Nets) Note that the major problems lie in the _practical_ implementation, which is not necessarily the speed - despite conflict resolution and anti-collusion techniques, the basic operation in a DC-Net, assuming the presence of a stream of random numbers, is the fast XOR. DC-Net implementation problems are more severe than those in secure-IP (swIPe etc) as they have to handle lots of things at a lower level in the network protocol. Doug goes on to suggest that to be immune from the "sheep^H^H^H^H^Hpeople" DC-Nets will have to have millions of members. But if anon remailers were used by millions, than they'd be immune too. All crypto is vulnerable to mob action until it's widespread. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

HAPPY BIRTHDAY (H.E.A.T.) TO YOUUUUUUUUUUUUUUUUUU
by Blanc Weber 17 Dec '03

17 Dec '03

~ ~ ~ ~ ! ~ ~ .!. ~ ~ . ! . ~ ~ / / \ \ ~ ~ | | | | ~ ~ \ \ / / ~ ~ :: ~ ~ | ~ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | %~~~~~~~~% [------------------] [------------------] [-----------------------------------------] [-----------------------------------------] [-----------------------------------------] May your light burn bright, and long. May you have many chocolate cakes & gourmet cookies. May you have many double tall mocha nutmeg lattes. May you find love & happiness. May your spirit & your finances both soar into the stratosphere. May you make many friends who write in parced sentences. May the Bluebird of Paradise visit your apartment. May you achieve total anarchy and maximum privacy. May this email totally embarrass you. X X X ~ Blanc

1 0

Unfinished FAQ?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Tim, I was going through the FAQ and was puzzled by what appear to be cryptic notes to yourself, such as "quote from Wired, Whole Earth Review" in the definition of cpunk in the MFAQ, along with a number of questions without answers - "Who are Alice and Bob" in the MFAQ for example. Do I have an unfinished version (0.666!) or what? ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

RC4 article in Saturday (Sept 17) New York Times
by Matt Blaze 17 Dec '03

17 Dec '03

John Markoff has a piece on the RC4 betrayal in the Business section of the Saturday NY Times (page 37), "A secret computer code is out -- Key to data security appears on internet". Not much that hasn't already been said here or on sci.crypt, but there was an interesting quote from Jim Bidzos that suggested that one of the conditions RSADSI agreed to in order to get approval of 40 bit RC4 for export in shrink-wrap software included keeping the algorithm confidential. Bidzos speculated that the NSA could revoke RC4's export status as a result of the disclosure. Also, the piece reports that "The RC4 formula was first circulated on Tuesday to a specialized computer network mailing list of computer researchers who oppose the Government's stringent controls on data encryption technology. The mailing list, which has thousands of computer users around the world, is known as Cypherpunks, and the mailings usually consist of highly technical discussions of data encryption technology." I guess Markoff gets Eric Blossom's moderated version of the list :-) -matt

3 2

Re:Profiling
by frissell＠panix.com 17 Dec '03

17 Dec '03

> In other words, your AZ tax can be based on your profile, irrespective > of your income or expenses. But the AZ D of R can't use a profile to actually *find* your money or, indeed, to determine that you are a resident of Arizona. > It's also a bit of an eye-opener to note that it is expected to > replace ID used for -other- than official business as well, like club > cards and health care access cards. If it's not in your profile or if > the money is not in your account, you can't do_it/have_it. Moreover, > you'll probably get automatically reported for followup investigation > to determine willfulness and intent. I *love* it when the government decides to use automation to cut people off from permissions/benefits if they don't "toe the line." Since I would like them to cut *everyone* off from permissions/benefits, every step closer to that situation is an improvement. Apparently, "Seaquest, DSV" had a little automated punishment example on yesterday's show. A guy on a motorbike was speeding and his plates were scanned on the fly and he was notified, while still driving, that his "Social Security Account" had been docked for some $700 in fines. Note that all they accomplish by such things is to convert people into "outlaws." If government benefits and permissions are withdrawn from you then the incentive for you to play their game is reduced. Automated punishment also weakens the hold of the government even on those who obey the law because they knwo that they can lose their government "benefits" at any time and so they value them less. In a strictly practical sense, such punishments encourage those punished to learn how to live outside the government's reward/punishment system. Note the non-compliance rates in New York City for driver's license, insurance, and registration rules. The DMV computers automatically suspend someone's license (even if he's never had one) and he keeps driving anyway. People accumulate hundreds of suspensions. DCF ************************************************************************* ATMs, Contracting Out, Digital Switching, Downsizing, EDI, Fax, Fedex, Home Workers, Internet, Just In Time, Leasing, Mail Receiving, Phone Cards, Quants, Securitization, Temping, Voice Mail.

1 0

EMBARRASSED, I?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks (did I ever tell you, it's pronounced "spunks"?), Blanc Webber made me feel like JFK being sung to by Norma Jean. The part I didn't understand, though, was when she wrote: May this email totally embarrass you. Hell, Blanc, why should it embarrass me? You're the one with the dirty picture. It's a candle? Sorry, my mistake. (But it looks just like my... oh, never mind.) Thanks Blanc, S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rom owner-cypherpunks Mon Sep 19 13:30:56 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA02563; Mon, 19 Sep 94 13:30:56 PDT Received: from mail.crl.com by toad.com id AA02557; Mon, 19 Sep 94 13:30:50 PDT Received: from crl2.crl.com by mail.crl.com with SMTP id AA23474 (5.65c/IDA-1.5 for <cypherpunks(a)toad.com>); Mon, 19 Sep 1994 13:29:20 -0700 Received: by crl2.crl.com id AA12797 (5.65c/IDA-1.5 for Cypherpunks <cypherpunks(a)toad.com>); Mon, 19 Sep 1994 13:29:19 -0700 Date: Mon, 19 Sep 1994 13:29:01 -0700 (PDT) From: Sandy Sandfort <sandfort(a)crl.com> Subject: THE BEST MINDS IN CYBERSPACE To: Cypherpunks <cypherpunks(a)toad.com> Message-Id: <Pine.3.87.9409191301.A12756-0100000(a)crl2.crl.com> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-cypherpunks(a)toad.com Precedence: bulk ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I'm always telling people how smart the Cypherpunks are. Now I have proof. Paul Robichaux wrote: I suggest we all kick in $10 or so and hire Alison Armitage to jump out of a cake or something. Seems like the least we could do. It's like he read my mind--especially the "or something" part. Thanks Paul. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: On the crime bill and remailers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:22 PM 9/18/94 -0700, Anonymous wrote: >Current drafts of the crime bill include a scienter requirement. >You are liable only if you know or intend for your remailer to be >used by a terrorist. > >This is SOLONg's first post to this list. Hey. I get it. Solon. Lawyer. Nym. Cool. Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

RE: That Steamy Aura
by Blanc Weber 17 Dec '03

17 Dec '03

That's not funny, Sandy. (but I'll keep it in mind, whenever I think about you) ~ Blanc

1 0

A Scenario
by Anonymous User 17 Dec '03

17 Dec '03

Anonymous User scripsit >> >> Let's say I have a digital cellular phone. I also have Anonymous Remailers, >> PGP, and over 100 BBS numbers (structured for which day and which hour each >> would be used) so that I can contact and talk to my "Friend." >> Please tell me how the LEA's can find me and understand the transactions >> between us? >You don't give us enough information. >Are your attackers looking for known parties? >How secure is your cellular? Do you operate from a known or a guessable >location? Is your "Friend" known? Suspected? His location, guessable? >Known? >If your location were known it would be a simple matter to monitor >the area, say put a van just outside your site and wait for cellular >activity of a strength that suggests your presence. How likely would it >be that someone else is using a cellular phone in your presence? Given >this, it is probably not difficult to obtain the billing/ESN number for >your phone, and then obtain detailed traffic information about your >transmissions. Given that it is a simple matter to conduct a lower tech >attack, say tempest, and pick up the conversation as you compose it, end >running the encryption so to speak. You think in too shallow a fashion. >Security is about more than communications security. >Even if yours is perfect, how about your friends. A tempest attack on >his site while he is using Word for Windows is just as effective as one >on you. >Modify this tactic to use a phone which uses several different ESN's at >random or move your location often and at random. >> >> If I have several encryption programs, can I 'layer' each document [I PGP the >> file, the I DES the PGP file, then IDEA for the final layer. >Worthless given the above attack. >> Does the NSA have to crack it one layer at a time, or can they bombard it, >> crack the layers in whatever order the supercomputer finds? >Again, unimportant given the cheaper low tech solution. >> If I am missing something, please let me know what I have missed. >Been there, did that. >-uni- (Dark) In the above scenario, I would never use my voice over the digital cellular [and I would be always moving {nothing done at home}]...strictly PGP/E-Mail. Even IF the parties are known, can they make their case? [How can they prove X sent Y if using PGP and anonymous remailers?] Of course, if one of them cooperates, that's different. Can Tempest be used as I'm driving/on a city bus? How expensive is it to maintain a Tempest surveillance in this fashion? This is a positive of portable computers and portable communications..no one can pinpoint [even remotely] where I'll compose/collect my pgp/e-mail. I am assuming that I'm covering my tracks smartly, and the only thing they have is what they can grab over the air, which is PGP, and that gets sent to some BBS [which they don't know] for my friend to pick up. The ESNs and the Keep Moving are really helpful, thanks.

2 2