December 2003 - cypherpunks-legacy

COMMUNITY CONNEXION TO OFFER REWARD FOR REVEALING HOLES IN ECASH
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Contact: Sameer Parekh sameer(a)c2.org 510-601-9777 (pager: 510-321-1014) COMMUNITY CONNEXION TO OFFER REWARD FOR REVEALING HOLES IN ECASH October 23, 1995 - Community ConneXion, an internet privacy provider in Berkeley, California, announced the extension of its existing "Hack" contests to the electronic cash system announced today by Digicash bv and Mark Twain Bank. "The ecash deployment an important step towards making internet commerce more than just a curiosity," said Sameer Parekh, President of Community ConneXion. The contest is meant, as with the other "Hack" promotions being run by Community ConneXion, to encourage the examination of the security of the ecash system so as to reveal holes before they are exploited by a criminal element. Community ConneXion hopes that the inquiry being done into the security of these products results in a secure infrastructure for the new paradigms provided by internet commerce. "All internet commerce systems thus far released have been based in old, out-of-date, insecure technology, such as credit cards. DigiCash is the first revolutionary system which can change the way we do business," said Parekh. "If the move to internet commerce does not radically improve the way people do business, then we have not taken full advantage of the potential inherent in the technology." Details regarding the Hack DigiCash promotion are available on Community ConneXion's webserver at http://www.c2.org/hackecash/. Contest submissions should be sent to hackecash(a)c2.org. Community ConneXion is the premier internet privacy ISP. They offer anonymous accounts, remailers, and psuedonym servers, in addition to the standard ISP fare of webspace and dialup IP access. Information is available from http://www.c2.org/ or from sending email to info(a)c2.org. Ecash, DigiCash, Cyberbucks, and Mark Twain Bank are trademarks of their respective owners. This promotion is not affiliated with DigiCash bv nor Mark Twain Bank.

1 0

pkcs7 examples
by Eric Young 17 Dec '03

17 Dec '03

Greetings peoples, I have just about finished writing routines to parse and write pkcs7 objects. I have written all the backend digital envelope routines and so now I have to decide on the the library API and test things. I currently only have a single pkcs7-signedData example, one that is being used to 'transport' x509 certificates and CRL's. Do any of you out there have pkcs-7 'objects' you can send me? I especially want examples of pkcs7 signedAndEnveloped. For those that don't know, pkcs7 is used in S/MIME and is a superset of PEM. The degenerative case of signedData is being used by protocols such as SSLv3 to transport X509 CRL's. thanks in advance. eric (whos SSL library is becoming a kitchen sink of crypto related stuff) -- Eric Young | Signature removed since it was generating AARNet: eay(a)mincom.oz.au | more followups than the message contents :-)

1 0

Re: Mondex vs. Digicash (was: Godzilla vs. Mothra)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text To: rah(a)shipwright.com (Robert Hettinga), www-buyinfo(a)allegra.att.com, ecm(a)ai.mit.edu, bsdc(a)ai.mit.edu Cc: hallam(a)w3.org Subject: Re: (cpx) Mondex vs. Digicash (was: Godzilla vs. Mothra) Date: Mon, 23 Oct 95 12:06:43 -0400 From: hallam(a)w3.org X-Mts: smtp Sender: bounce-bsdc(a)ai.mit.edu Precedence: bulk Reply-To: hallam(a)w3.org Some comments on the comments: > The availability of Digicash in the US, for real, with spender anonymity, will be announced very soon; reporter activity on this subject is consistent with an embargoed press release for Monday or Tuesday. From posts to the list it's clear that a fully working system, ready for customers, will be announced. The avbilability in the US I don't consider as meaning much one way or the other. Mondex is avaliable in Swindon in the UK, a very large and very serious real world trial. More importantly Mondex has Wells Fargo Bank behind it and NatWest and HKSB, these are major league players with very tight coupling, cross ownership of subsidiaries etc. > When doing market research on this subject, it became clear that low-value payments are largely going to be used for impulse purchases. If the Digicash system allows people to set up their accounts without getting out of their chairs (which I suspect will be the case, if they do it right), it will initially get more adopters. DigiCash will be limited to the Internet, Mondex is genuine cash, it allows offline purse to purse transactions. > One or both systems could be found to have serious security problems; who knows what the outcome of their discovery & exploitation would be? I know at least one group of people who believe they have a good line on a serious security problem in Mondex. If they have the specs they are under an NDA. If you know people who know a problem tell them to get in touch with Tim Jones, they are very keen to get the best security possible. I'm not sure that the conventional "publish everything" dogma of cypher types is valid. I don't think they are relying on security through obscurity, they simply want it in addition. Mondex is designed with two security schemes to be exchanged at overlapping four year intervals. > Even if the Mondex hardware were given away for free, think how much fun it is for the average user to add a new piece of hardware to their machines... ever install a sound card and CD-ROM drive on a PC? I remember reading something like 20% of all "multimedia" kits were returned, largely due to user install problems. If there is a competing method that costs the same and _doesn't_ require the hardware, people will tend go with this. They need it to be plug 'n play. I expect this to happen. > In my conversations with state and federal regulators, it is clear that it _is_ possible to issue spender-anonymous e-cash. If you ask them, "Hey, can I create fully anonymous digital cash?", they go apeshit, but if you explain that the money uses existing (auditable) channels going in, and existing (auditable) channels going out, and that only spenders are anonymous, they relax considerably. They may change their minds later, but we're about to get an existence proof. All I know is that at the mention of DigiCash bankers start muttering Regulation E. > It's not clear that _either_ system is going to win completely in the next 10+ years. Although there's been considerable shakeout in the last ten years, there is still a huge variety of non-electronic payment methods -- how can you be so sure that Mondex will win over Digicash, and that they won't co-exist like, say, money orders, currency and cashier's checks (three instruments with both similar and dissimilar attirbutes)? Quite probable, except that Mondex is a very credible scheme with very large and very established names behind it. I haven't heard of Mark Twain bank. I don't say that this predetermines the outcome, just that there are reasons why one might have an advantage. Phill H-B --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: FidoNet Remailer
by jgrubs＠left.webcasters.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- RobL <robl(a)on-ramp.ior.com> writes: > At 04:34 PM 10/20/95 -0400, Jim Cannell wrote: > > > >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > > >-----BEGIN PGP SIGNED MESSAGE----- > > > >I have been a long time lurker on this list, as well as having a long time > >interest in crypto. Most of my activity in this area has been on FidoNet > >rather than the internet. Due to the control phreak nature of much of > >FidoNet, I've spent a lot of time and effort in an attempt to just simply > >route around the bastards. I created the SecureMail system, which is a > >network of FidoNet nodes that agree to route any and all traffic without > >monitoring or censorship. Within SecureMail, encrypted traffic is not > >only permitted, it is encouraged. > > > At the end of the month, I will be putting my BBS back online with new > software which is more Fido friendly than what I had been using.. I would be The Fido remailer appears to be drawing some interest. Fidonet is often criticized (by me among many, many others) for being dull, provincial, and dominated by power phreaks. However, the Fidonet connectivity protocols have much to be admired from the 'punks perspective. Internet has great speed and bandwidth, but network routing is "hardwired." Fidonet is frequently slow and narrowband, but routing is much more flexible. The so-called "nodelist" contains the node number (the equivalent of IP number), various technical parameters, and the dial-up telephone number and availibility schedule at which e-mail/data calls can be accepted. Since the access number of every site in the network is known, you can send e-mail directly to the destination site if you wish not to use standard, fixed routing. This, plus call forwarding and laptops at pre-arranged temporary locations, means Freeh's wiretap problem is now the need to monitor every call at every ESS. Hence, his curious request for huge wiretap capacity. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: LIBERTY!! Use it or lose it!! iQCVAwUBMIvDZt74r4kaz3mVAQG74wP/XhD/g9jE/sNcP5dQWskd95yJSPgJgXac Z42Aj1QfR1fchG4v1A2iuUsaKDma3MU/whn4gqMxJPVjeat6D7wvzU0DzSj7eeSk mAjVZNnZcmGcXiTy4ueTBcdttgi0JV2g0djijOvKCGx48fMIUy8zWK9vPFe7kpkb hDzcqlpD5Xw= =ObiT -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)webcasters.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Don't Kill the Messenger--A New Slant on Remailers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 20 Oct 1995, Rev. Mark Grant wrote: > I suspect that I could easily hack this into Mixmaster in a day or two, Ok, I have an initial version that works on single-packet messages (there seems to be a lot of code duplication for multi-packet messages), and ought to have it finished off and tested by the end of the week. I doubt I'll be able to set up such a remailer, but I'll release a patch for 2.0.2 and hopefully Lance can incorporate it into the next release as a compile-time option. Mark

1 0

Saudi Arabia?
by mixmaster＠obscura.com 17 Dec '03

17 Dec '03

Does anyone know what restrictions there might be on the use of crypto (pgp) in Saudi Arabia?

1 0

Quantum Computation article
by cjl 17 Dec '03

17 Dec '03

David P. DiVincenzo from the IBM Research Division has written an article in the 13th October issue of SCIENCE magazine (vol. 270, pg. 255-261) entitled "Quantum Computation". The article is nicely divide into subsections: - Building blocks of quantum logic - Quantum circuits - Peter Shor's prime factorization - The decoherence problem - Outlook >From the outlook section "It is evident from this survey of the current state of the art in quantum experimental physics that the construction of quantum computers is presently in the most rudimentary stage, and that to even think about a procedure like Shor factorization, which might require millions of operations on thousands of qubits, might be absurdly premature." If that is the good news for Cypherpunks, then the great news is the following. ". . even a few bits of quantum computation will be very useful in performing so-called Bell measurements, which could be used to implement quantum teleportation, in which an unknown quantum state can be trasmitted to a remote location. At perhaps the 10-qubit level, a quantum computer becomes capable of performing Schumacher's quantum coding, which would be of interest in the implementation of efficient quantum cryptography. And at perhaps the 100-qubit level, a quantum computer becomes an efficient repeater for a noisy (that is partially decohered) quantum cryptographic link." It looks like the advantages of quantum computing accrue to Alice and Bob, long before it becomes useful to Eve and Mallet. A must read for aficianados of "alternative computing". Here are some URLs from the references http://vesta.physics.ucla.edu/~smolin/ (Quantum Information Page, Center for Advanced Accelerators) http://eve.physics.ox.ac.uk/QChome.html (Quantum Computation and Cryptography page, Clarendon Laboratory, Oxford University) C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

1 0

EPIC Alert 2.12 (Wiretap regs, funding, FLIR)
by banisar＠epic.org 17 Dec '03

17 Dec '03

============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================= Volume 2.12 October 23, 1995 ------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, DC info(a)epic.org http://www.epic.org/ * Special Edition: National Wiretap Plan * ======================================================================= Table of Contents ======================================================================= [1] FBI Wiretap Plan Exceeds Legislative Authority (and what you can do) [2] Illegal Bugging by US Agencies Continues [3] Status of Wiretap Funding [4] Court Rules Against Hi-tech Spy Devices [5] NTIA to Release Privacy "Policy" [6] Privacy Success -- Marketry Drops Plan to Sell Net Data [7] ACLU Civil Liberties Update / Privacy Rights Clearinghouse [8] Upcoming Conferences and Events ======================================================================= [1] FBI Wiretap Plan Exceeds Legislative Authority (and what you can do) ======================================================================= The FBI has released a dramatic "reinterpretation" of the Communications Assistance for Law Enforcement Act (the "Digital Telephony" bill or "CALEA"). In a Federal Register notice which outlines "capacity requirements" for surveillance of the nation's communications infrastructure, the FBI is claiming that compliance with CALEA requires that telephone companies and other service providers in some regions of the country build in enough surveillance capacity so that *one percent* of all phone lines could be *simultaneously* wiretapped, calls isolated, and forwarded to the FBI. This would permit wiretapping at a level at least a thousand time greater than currently occurs in the United States. This level of surveillance is also far in excess of what Congress intended when it enacted the CALEA. The rule, if adopted, will lead to a radical change in the surveillance capabilities of the government. The methodology used to determine capacity requirements is also deeply flawed. Wiretapping reports, as required by law, have always been based on actual taps authorized, actual conversations intercepted, and actual lines surveilled. These numbers are reported annually by the Administrative Office of the U.S. Courts. The Bureau's proposed rule attempts to shift from the analytic approach required by current wiretap law to one that is based on percentages of total communications activity. It is similar (in purpose and magnitude) to a government agency that had received an annual appropriation of $12 m to argue by regulation that it was now entitled to 1% of the federal budget (roughly $18 b). EPIC has filed a Freedom of Information Act request seeking all documents relating to the development of this proposed rule. WHAT YOU CAN DO: (a) Submit comments to the FBI. Object to the "percentage approach" to wiretap capacity. Urge the FBI to follow the current measurement of wiretapping, as reported annually by the Administrative Office of the U.S. Courts, which considers the actual number of wiretaps authorized. If you are a telephone customer, ask the FBI to address the privacy risks of unauthorized, illegal, or excessive wire surveillance. Comments should be submitted in triplicate to the Telecommunications Industry Liaison Unit (TILU), Federal Bureau of Investigation, P.O. Box 220450, Chantilly, VA 22022-0450. For further information, contact TILU at (800) 551-0336. Refer to your question as a "capacity notice" inquiry. ** Comments must be received by November 15, 1995.** (b) If you represent or work for a telecommunications company, equipment manufacturer, or service provider, assess carefully the cost and liability that this proposed federal regulation may impose on your company and the risk that it may expose your customers to illegal wiretapping. If you are interested in challenging the final FBI rule, contact EPIC and send us a copy of your comments. We are prepared to assist individuals and companies with a legal challenge. The FBI Federal Register notice (October 16, 1995, Volume 60, Number 199, Pages 53643 - 53646) is available at: http://www.epic.org/wiretap/calea_notice_10_95.txt EPIC will soon post a copy of its FOIA request and its comments on the regulation to implement a national wiretap plan. ======================================================================= [2] Illegal Bugging by U.S. Agencies Continues ======================================================================= Reports of illegal wiretapping by U.S. agencies are on the rise. Last week Japanese officials expressed concern over a report of CIA spying during automotive trade talks earlier this year, and said they would ask the United States to investigate, according to an October 16 Reuters report. "This is certainly not a very pleasant matter," said Trade Minister Ryutaro Hashimoto. Ichiro Fujisaki, political minister at the Japanese embassy "expressed the Japanese government's concern that should the report be true, it could hurt our national sentiment and U.S.-Japanese friendship and mutual trust." The New York Times reported earlier that the Central Intelligence Agency conducted electronic surveillance in the course of preparing reports for American negotiators prior to an accord reached in June. The Times also reported that U.S. Trade Representative Mickey Kantor "was regularly supplied with information gathered about the Japanese negotiation position by the CIA's Tokyo station and the National Security Agency, which operates electronic eavesdropping equipment." (NYT, Oct. 14, 1995). The Washington Post confirmed the incident and noted that the "eavesdropping reflected the U.S. intelligence community's increasing involvement in economic and commercial information gathering since the end of the Cold War." The illegal wiretapping report follows an incident earlier this year when French officials charged that the United States intelligence agencies engaged in clandestine monitoring of trade negotiations. Meanwhile, the President of Estonia was forced to resign following news that he had engaged in secret wiretapping of political opponents. According to the New York Times, residents of Estonia wondered whether the days of Soviet police agents spying on citizens had returned. Newly chosen President Lennart Mei called the scandal "a crisis of democracy." He said, "We must ask ourselves: Does power belong to the people if surveillance equipment is in the hands of others?" (NYT, Oct. 18) Estonia is the most recent country to see its government fall after public disclosure of illegal wiretapping. In the last few years, Greece and France have replaced political leaders because of wiretapping scandals. ======================================================================= [3] Status of Wiretap Funding ======================================================================= In 1995 the Communications Assistance for Law Enforcement Act authorized the expenditure of $500,000,000 over four years to reimburse companies to design wiretap-ready communications technologies. But opposition to the "Digital Telephony" proposal forced the FBI and the White House to find a creative way to fund the unpopular program. Now the Administration is proposing that the $500 M be gathered from a special fund which authorizes the surcharge of 40 percent on all civil fines levied by the United States after October 1, 1995, excluding fines levied by the Internal Revenue Service. [The specific legislative provision may be found in Title IV of the Counterterrorism Bill, HR 1710 (Civil Monetary Penalty Surcharges and Telecommunications Carrier Compliance Payments). The terrorism bill is now under consideration by Congress and will be the subject of an upcoming EPIC Alert]. But even the "slush" fund may not generate enough money to reimburse companies to design wiretap capabilities, which some industry experts estimate may run in excess of $2 billion. The House appropriations bill for the Department of Justice sets aside only $50 M for the Telephone Carrier Compliance program. The U.S. Telephone Association earlier recommended that the government follow traditional funding methods for the program rather than the slush fund approach taken in the Counter-terrorism bill. The benefits of such a budget, said the USTA, include the fact that "it brings the process into the sunshine, making government surveillance expenditures an issue for public scrutiny." (USTA Wiretap Workshop, May 1995). The Office of Technology Assessment, before its demise, also prepared a useful overview of the bill and discussed the funding issues -- "Electronic Surveillance in a Digital Age" (OTA 1995). Further information about wiretapping is available at the EPIC web page: http://www.epic.org/privacy/wiretap/ ======================================================================= [4] Court Rules Against Hi-tech Spy Toys ======================================================================= In a case that illustrates that the protections provided by the Fourth Amendment against the intrusiveness of modern technologies are still very much alive, the U.S. Court of Appeals for the 10th Circuit ruled on October 4 that police must obtain a warrant before using Forward Looking Infrared Radar (FLIR) devices to examine private residences. FLIR measures heat differentials on surfaces of as little as 0.5 degrees Celsius to determine activities inside homes. Police use FLIR devices to scan neighborhoods an detect houses that emanate heat which may be caused by "grow" lamps. In U.S. v. Cusumano, No 94-8056, No 94-8057, Oct. 4, 1995, the court ruled that new technologies do not eliminate the normal expectation of privacy that individuals have in their homes. Echoing the words of Justice Brandeis' opinion in a 1928 wiretap case, the court said: the Defendants need not have anticipated and guarded against every investigative tool in the government's arsenal. To hold otherwise would leave the privacy of the home at the mercy of the government's ability to exploit technological advances: the government could always argue that an individual's failure (or inability) to ward off the incursions of the latest scientific innovation forfeits the protection of the Fourth Amendment ... [T]he government would allow the privacy of the home to hinge upon the outcome of a technological race of measure/counter-measure between the average citizen and the government -- a race, we expect, that the people will surely lose. Other courts have split on this question. Recently, the Washington State Supreme Court ruled that a warrant is required before FLIR can be used (State v. Young, 867 P.2d 593 (Wash. 1994), while several other federal appeals courts have ruled that the heat is "waste" not protected by the Fourth Amendment. The 10th Circuit opinion rejected the waste argument "because the interpretation of that data allows the government to monitor those domestic activities that generate a significant amount of heat. It . . . strips the sanctuary of the home of one vital dimension of its security: the 'right to be let alone' from the arbitrary and discretionary monitoring of our actions by government officials." ======================================================================= [5] NTIA to Release Privacy "Policy" ======================================================================= The National Telecommunications and Information Administration is expected to release today (October 23) a white paper entitled "Privacy and the NII: Safeguarding Telecommunications-Related Personal Information." In an agency press release, NTIA administrator Larry Irving said, "We hope to contribute to the effort of addressing the public's concerns regarding the protection of their personal information." NTIA says the paper will focus on "privacy concerns associated with an individual's subscription to or use of a telecommunications or information service." But if the final NTIA report is at all similar to a privacy policy discussed by an NTIA official at a conference earlier this month in Brehmen, Germany there is little that will reassure the public about this policy. Ignoring mounting evidence that voluntary codes have failed and that new technologies of privacy should be promoted, the NTIA recommends a "be careful out there" strategy, in effect saying that it is better to post warning signs along the information highway than to make the road safer to travel. The NTIA proposal specifically recommends the "contract" approach to privacy that was rejected by European officials earlier this year as an inadequate safeguard for consumers using advanced communications services. NTIA officials, and other members of this Administration, have claimed that with changing technology it is too difficult to legislative effectively. But a different group of public officials, facing a similar challenge 20 years ago did not make such excuses. *Records, Computers, and the Rights of Citizens* (1973) was a ground-breaking report that spoke clearly of the need to protect citizens rights, led to passage of the Privacy Act of 1974, and established firmly the importance of Fair Information Practices. NTIA's report, like the other privacy "policies" of this administration, will occupy no similar place in history. The spirit of Clipper has infused this government. Copies of the report are available from NTIA at 202/482-3999 and will soon be posted at the EPIC web site with a complete critique. EPIC has also prepared a detailed review of an earlier administration privacy code: http://www.epic.org/privacy/internet/epic_nii_privacy.txt ======================================================================= [6] Privacy Success -- Marketry Drops Plan to Sell Net Data ======================================================================= In a notable victory for consumer privacy and on-line activism, a Bellevue, Washington company has backed off plans to sell personal information gathered from the Internet following reports in the Washington Post and a call to action in the EPIC Alert. Marketry President Norm Swent announced last week "Marketry's resignation as manager of the email Internet Interest Selector list." However, Marketry was not the compiler of the data. Another agent could still be found. Washington Post reporter John Schwartz broke the Marketry story in the paper's Business section following news of the proposal in the industry trade publication The Friday Report. The Marketry data was to be gathered from newsgroup posts, website visits, and chat room comments. ======================================================================= [7] ACLU Civil Liberties Alert / Privacy Rights Clearinghouse ======================================================================= An excellent civil liberties on-line newsletter is the ACLU Cyber-Liberties Update/ To subscribe to the ACLU Cyber-Liberties Update, send an e-mail message to infoaclu(a)aclu.org with "subscribe ACLU" in the subject line of your message. For more information about the newsletter, contact editor Ann Beeson, beeson(a)aclu.org. One of the leading consumer privacy organizations in the country is the Privacy Rights Clearinghouse in San Diego. Formed in 1992, the Clearinghouse has produced many consumers fact sheets on common privacy concerns, and maintains a toll free hotline to provide advice to consumers about their rights. More information about the Privacy Rights Clearinghouse is available at http://www.manymedia.com/prc/. 5998 Alcala Park, San Diego, CA 92110. (619) 260-4806 (tel). 800-773-7748 (in Cal. only) prc(a)teetot.acusd.edu (email) Director: Beth Givens. For a comprehensive guide to online privacy resources, check out: http://www.epic.org/privacy/privacy_resources_faq.html ======================================================================= [8] Upcoming Privacy Related Conferences and Events ======================================================================= SPECIAL: Ram Avrahami will discuss efforts to strengthen consumer privacy this week on NPR's Morning Edition and then on CNN Today. For more information, check out http://www.epic.org/privacy/junk_mail/) Smithsonian Institution, "Frontiers in Cyberspace: Encryption, Privacy, and Cybercodes. October 25, 1995. Marc Rotenberg, Director, Electronic Privacy Information Center (EPIC), Philip Zimmermann, Creator, Pretty Good Privacy (PGP); Stewart Baker, Attorney, Steptoe & Johnson, former General Counsel, National Security Agency. Contact: Melody Curtis (CurtisM(a)aol.com) Managing the Privacy Revolution. October 31 - November 1, 1995. Washington, DC. Sponsored by Privacy & American Business. Speakers include Mike Nelson (White House) C.B. Rogers (Equifax). Contact Alan Westin 201/996-1154. Innovation and the Information Environment. November 3-4. University of Oregon School of Law in Eugene, Oregon. Contact: Keith Aoki KAOKI(a)law.uoregon.edu. National Privacy and Public Policy Symposium. November 2-4., Hartford, Cosponsored by the Connecticut Foundation for Open Government. Contact Richard Akeroyd, rakeroyd(a)csunet.ctsateu.edu 203/566-4301 (tel), 203/566-8940 (fax) 22nd Annual Computer Security Conference and Exhibition. November 6-8, Washington, DC. Sponsored by the Computer Security Institute. Contact: 415-905-2626. Global Security and Global Competitiveness: Open Source Solutions. November 7-9. Washington, D.C. Sponsored by OSS. Contact: Robert Steele oss(a)oss.net. "The Right to Privacy," November 9. Authors Caroline Kennedy and Ellen Alderman discuss their new book on privacy. Lizner Auditorium, George Washington University, Washington, DC. Contact 202/357-3030. 11th Annual Computer Security Applications Conference: Technical papers, panels, vendor presentations, and tutorials that address the application of computer security and safety technologies in the civil, defense, and commercial environments. December 11-15, 1995, New Orleans, Louisiana. Contact Vince Reed at (205)890-3323 or vreed(a)mitre.org. RSA 6th Annual Data Security Conference: Cryptography Summit. Focus on the commercial applications of modern cryptographic technology, with an emphasis on Public Key Cryptosystems. January 17-19, 1996. Fairmont Hotel, San Francisco. Contact Layne Kaplan Events, at (415) 340-9300, e-mail at info(a)lke.com, or register at http://www.rsa.com/. Computers Freedom and Privacy '96. March 27-30. Cambridge, Mass. Sponsored by MIT, ACM and WWW Consortium. Contact cfp96(a)mit.edu or http://www-swiss.ai.mit.edu/~switz/cfp96 Conference on Technological Assaults on Privacy, April 18-20, 1996. Rochester Institute of Technology, Rochester, New York. Papers should be submitted by February 1, 1996. Contact Wade Robison privacy(a)rit.edu, by FAX at (716) 475-7120, or by phone at (716) 475-6643. Australasian Conference on Information Security and Privacy June 24-26, 1996. New South Wales, Australia. Sponsored by Australasian Society for Electronic Security and University of Wollongong. Contact: Jennifer Seberry (jennie(a)cs.uow.edu.au) Visions of Privacy for the 21st Century: A Search for Solutions. May 9-11, 1996. Victoria, British Columbia. Sponsored by The Office of Information and Privacy Commissioner for the Province of British Columbia and the University of Victoria. Program at http://www.cafe.net/gvc/foi 18th International Conference of Data Protection and Privacy Commissioners. Sponsored by the Privacy Commissioner of Canada. September 18-20, 1996. Ottawa, Canada. Advanced Surveillance Technologies II. Sponsored by EPIC and Privacy International. September 17, 1995. Ottawa, Canada. Contact pi(a)privacy.org International Colloquium on the Protection of Privacy and Personal Information. Commission d'acces a l'information du Quebec. May 1997. Quebec City, Canada. (Send calendar submissions to Alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send the message: SUBSCRIBE CPSR-ANNOUNCE Firstname Lastname to listserv(a)cpsr.org. You may also receive the Alert by reading the USENET newsgroup comp.org.cpsr.announce. Back issues are available via http://www.epic.org/alert/ or FTP/WAIS/Gopher/HTTP from cpsr.org /cpsr/alert/ and on Compuserve (Go NCSA), Library 2 (EPIC/Ethics). ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues relating to the National Information Infrastructure, such as the Clipper Chip, the Digital Telephony proposal, medical record privacy, and the sale of consumer data. EPIC is sponsored by the Fund for Constitutional Government and Computer Professionals for Social Responsibility. EPIC publishes the EPIC Alert and EPIC Reports, pursues Freedom of Information Act litigation, and conducts policy research on emerging privacy issues. For more information, email info(a)epic.org, WWW at HTTP://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. (202) 544-9240 (tel), (202) 547-5482 (fax). The Fund for Constitutional Government is a non-profit organization established in 1974 to protect civil liberties and constitutional rights. Computer Professionals for Social Responsibility is a national membership organization of people concerned about the impact of technology on society. For information contact: cpsr-info(a)cpsr.org If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Your contributions will help support Freedom of Information Act litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and funding of the National Wiretap Plan. Thank you for your support. ------------------------ END EPIC Alert 2.12 ------------------------

1 0

FV -- What we have learned
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Please excuse the cross-posting, I'll keep it short. With my colleagues at First Virtual, I have recently completed what we intend to be the definitive statement about what FV has learned from a full year of processing payments over the Internet. This is not intended as a puff piece, but a serious academic-style overview. We're hoping it will prove to be a valuable resource for anyone trying to process payments on the net, even those who disagree with some aspects of FV's approach. The paper will be presented next week at the "Frontiers in Electronic Commerce" conference in Austin. In Postscript, it's a 14 page paper with a nearly 30 page appendix, so it doesn't *have* to be a long paper to read unless you want it to be. :-) Plain text and postscript versions are available on the net by anonymous ftp: ftp://ftp.fv.com/pub/nsb/fv-austin.{txt,ps} -------- Nathaniel S. Borenstein <nsb(a)fv.com> | When privacy is outlawed, Chief Scientist, First Virtual Holdings | only outlaws will have privacy! FAQ & PGP key: nsb+faq(a)nsb.fv.com | SUPPORT THE ZIMMERMANN DEFENSE FUND! ---VIRTUAL YELLOW RIBBON-->> zldf(a)clark.net <http://www.netresponse.com/zldf>

1 0

CSP
by Frosty 17 Dec '03

17 Dec '03

Frosty ::: AT&T ACCUSED OF DEFRAUDING !!! New York - AT&T Corp. is accused in a lawsuit of cheating millions of residential long-distance customers out of billions of dollars by rounding off calls to the next full minute. The Lawsuit, filed Thursday in state Supreme Court, claims AT&T residential calls are billed in full minutes, meaning a call lasting one minute and one second would be billed as a two-minute call. Business customers, on the other hand, are billed in six-second intervals, meaning a one-minute, one-second call would be billed as one minute, six seconds, the lawsuit claims. -The Associated Press -The Sun Herlad - 21 Oct 1995 * sotmesc(a)datasync.com aka ---* Frosty, ilKhan of the SotMESC * To send a submission, use this address with 'CSP' in the Subject line * Thanks to: Voyager, 2600, LOD, Knight Lightning for supporting us * Finger SotMESC or http://www.datasync.com/~sotmesc/sotmesc.html

3 2