December 2003 - cypherpunks-legacy

More on Belgian 'key escrow law'
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

I looked up the law mentioned in the newspaper article and it goes like this (non french speaking cypherpunks, please see comments below <grin>): ---- "Loi du 21 décembre 1994 portant des dispositions sociales et diverses" - published in the 'Moniteur Belge' (= the official journal in which all laws are published), Vol. 164, Nr. 250, Friday 23 December 1994, p. 31878-31963. (p. 31960-31961): " Art. 202 Il est inséré dans la loi du 21 mars 1991 portant réforme de certaines entreprises publiques économiques, un article 70bis, rédigé comme suit: <<Art. 70bis - Le Roi fixe, par arrêté délibéré en Conseil des Ministres, les moyens techniques par lesquels Belgacom et les exploitants des services non réservés qu'Il désigne doivent permettre, le cas échéant éventuellement conjointement, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications privées dans les conditions prévues par la loi du 30 juin 1994 relative à la protection de la vie privée contre les écoutes, la prise de connaissance et l'enregistrement de communications et de télécommunications privées.>>" (p. 31961): " Art. 203 L'article 95, alinéa 1er, de la même loi est complété comme suit: <<5° l'appareil terminal rends inefficaces les moyens permettant, dans les conditions prévues aux articles 88bis et 90ter à 90decies du Code d'instruction criminelle, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications.>>" ---- Simplifying it all seems to boil down to this: The 1994 Law ammends a 1991 Law; that is, it adds a couple of articles/paragraphs. Art. 202 stipulates that Belgacom (= Belgium's leading telephone company) and other telecom companies have to cooperate with law enforcement when it wants to tap telephone lines - no, sorry, make that telecom lines (!). Note that tapping is only allowed under certain circumstances stipulated in the so-called Privacy Law (see also my previous posting to this list). Art. 203 is the most important as far as key escrow is concerned. It completes Art. 95 of the 1991 Law which stipulated 4 conditions in which telecom equipment may be seized. These initial conditions are rather harmless (equipment does no longer conform to the initial specifications, it hinders public broadcasts, presents health risks for the users,...). Art. 203 adds a 5th and stingy one: equipment that makes tapping impossible may be disconnected from the network and seized ... On the face of it - I'm not a lawyer, so don't pin me down on this - this means no crypto (or only with key escrow) ... Ciao, leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

1 0

Re: When they came for the Jews...
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

In regards to all this, I thought that people might be interested in knowing about an interview on Fresh Aire, a radio program I heard via WNYC. The individual being interviewed was the American Jewish Committee's person on Hate Groups, Kenneth Stern. He was being interviewed due to a book he'd written before the Oklahoma City bombing, in which he (mis-)called all militia groups hate groups. In the interview, he was asked about the Simon Weisenthal Center's letter in regards to the Internet. He spoke in opposition to it, and mentioned later that he tends to advise people that the best solution for hate speech is speech against it- a definitely good message. He mentioned the Internet as being a popular place for militia and similar groups to form. The two reasons he gave were that it was an easy means to spread information, and that the information was hard to verify (the urban/computer legend phenomenon, helping give rise to the various conspiracy theories circulating on the Net). He also mentioned that "hate" groups, including militias are using encryption, but didn't say anything further. Unfortunately, he also had some problems, which I'll go into here because of the analogies between guns and cryptography. While having respect for the First Amendment's protections of speech and press, and (to some degree) even the Second Amendment's protections of the right to keep & bear arms, he forgot completely about freedom of association- he called for a federal law making it a felony to have "private armies." There are some such laws on the books on various states, but they are (fortunately) not enforced, and thus have not yet been constitutionally challenged. The second group of his problems were in defining all militia groups as "hate" groups. His basic analysis for this was threefold: A. They have members in common with some definite hate groups, such as the Aryan Nations. B. Some militias have made racist, etcetera statements that qualify them as hate groups. C. They hate somebody, namely the federal government. The first argument falls apart once one points out that this is a classic conspiracy theorist untrue argument- one can use it to argue that the Trilateral Commission runs the US government, for instance. The second argument is obviously false. It's a variety of stereotyping, something that I would have thought he'd be more sensitive to. The third argument would classify the Simon Weisenthal Center as a hate group... he might actually have the guts to do this, since he also named the Nation of Islam as a hate group (due to their antisemitism, though, not due to their anti-white racism). All in all, though, he gave a much better impression for his group than I've gathered for the Simon Weisenthal Center. IIRC, the latter was essentially put together to pursue Nazis, as opposed to Neo-Nazis. My guess is that they're feeling useless and wanting to pursue somebody- sort of like the Secret Service and Steve Jackson Games. -Allen

2 1

Re: PRIVACY: Private traces in public places
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 10:26 PM 1/9/96, Alexander 'Sasha' Chislenko wrote: >- Landfills: They are probably the richest source of detailed historical >information > that is not obtainable from any other source and can be used to reconstruct > the detailed history of society, economy, technology and any single >person with > incredible detail. I ain't holding my breath until someone develops a search engine for Fresh Kills. Ted

1 0

Scenario: Digital Telephony Leads to GAK
by tcmay＠got.net 17 Dec '03

17 Dec '03

Thanks, Leo, for providing this, and the translation into English. At 7:45 PM 1/9/96, Leo Van Hove wrote: >I looked up the law mentioned in the newspaper article and it goes like >this (non french speaking cypherpunks, please see comments below <grin>): ... >Art. 202 stipulates that Belgacom (= Belgium's leading telephone company) >and other telecom companies have to cooperate with law enforcement when it >wants to tap telephone lines - no, sorry, make that telecom lines (!). >Note that tapping is only allowed under certain circumstances stipulated in >the so-called Privacy Law (see also my previous posting to this list). This is almost exactly the same provision that Digital Telephony established in the U.S., namely, that switch providers (phone companies, loosely speaking, but possibly more, including packet switches....). More on this in a moment. >Art. 203 is the most important as far as key escrow is concerned. It >completes Art. 95 of the 1991 Law which stipulated 4 conditions in which >telecom equipment may be seized. These initial conditions are rather >harmless (equipment does no longer conform to the initial specifications, >it hinders public broadcasts, presents health risks for the users,...). >Art. 203 adds a 5th and stingy one: equipment that makes tapping impossible >may be disconnected from the network and seized ... On the face of it - >I'm not a lawyer, so don't pin me down on this - this means no crypto (or ^^^^^^^^^^^^^^^^^^^^^^^^ >only with key escrow) ... ^^^^^^^^^^^^^^^^^^^^^ I think this ties in closely with the European meetings on key escrow (recall that our earliest indications of a move to get "software key escrow" came from the Karlsruhe meeting in the spring of 1994, and various international forums on key escrow began soon thereafter). This fits with several trends I and others here have discussed: * getting corporations to do as much of the enforcment work as possible. * using the civil forfeiture and penalty provisions to terrify the corporations, ISPs, switch providers, etc., to cooperate (I referred to this as "deputizing" the corporations as soldiers in the government's wars). * having Europe launch the crackdowns, then pleading that the U.S. must "conform" to international treaties and law enforcement agreements. (Some have argued that the Bavarian version of Exon was a step in this direction....) So, we need to be alert for the following scenario: 1. Telephone companies, telecom providers, ISPs, etc., must conform to the Digital Telephony wiretapping provisions, or variants thereof (not just the language of Digital Telephony, but also language in pending and future bills). 1a. If Exon passes, ISPs may also have to verify ages of users. This would necessitate a form of "Internet ID card," with all that this implies for the use of cryptography, anonymity, etc. 2. European companies (private, and PTTs) set the precedent. 3. An exception is made for key escrow. That is, one of the companies in #1 can be held harmless if it has taken major steps to ensure that users are not using encryption that is not properly escrowed. That is, they can escape the Title 18 fines and seizure of their equipment if they "cooperate" with "valid investigations." 4. A few prosecutions will likely have to made, just to make sure the message is properly received. (Like the two-by-four over the head I mentioned in my last message.) 5. A panic sets in. Just as CompuServe dumped 200 newsgroups on the whiff that a prosecution and seizure might happen, many ISPs will ignorantly send out warnings to users that all encrypted messages must use GAK. (To be sure, not all will. Some will ignore the warnings, some will contemptuously flout the law, etc.) 6. The government gets a large fraction of messages into a GAK format. Once again, corporations and ISPs become the deputies. (Note: Sure, superencryption still works, and no GAK system will be universally successful. Maybe not even successful in a majority of cases. But probably enough to cripple large-scale usage and, especially, commercial payment usage. This may be enough for the IRS, FinCen, etc.) We really need to be looking to what the nations of Europe are doing (as we have been of course, as the crypto laws of Europe have always been interesting to us, even if the machinations of the U.S. get most of the attention, for obvious reasons). --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A couple of ideas for PGP-based programs
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:32 AM 1/6/96 -0800, Alan Olsen <alano(a)teleport.com> wrote: >1) Something I would like to see on the keyservers for PGP is a way of >retreving all of the key revokations since x date without having to get all of >the keys since that date. The web interface to the MIT keyserver lets you search for keys, and probably some of the other interfaces do too. So do a retrieve on REVOKE, snarf the output, and feed it to perl or grep or something. PGP keyserver >2) I would like to see a program like private Idaho have the ability to send >mail to the key server and grab all of the "unknown signator" keys. This would >have the interesting effect of building a more complete keyring, while using >the "web of trust" to weed out alot of the bogus keys that tend to crop up on >the key servers. I found that a very convenient way to add things to my keyring was to use the keyserver web page and Private Idaho simultaneously. Grab the keys you want on the keyserver, cut+paste into Private Idaho, decrypt (PGP won't find a message, but will find keys), and click on anything you don't recognize. Parsing email isn't too tough, but it takes some work, and it's easier for PC tools to interact through Netscape or finger when they can instead. > After n number of iterations you would have more of the >"important keys" n=4 is an interesting depth, given PGP's default settings..... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "The price of liberty is eternal vigilance" used to mean us watching # the government, not the other way around....

1 0

Re: Revocation, Trust, Policy Models, etc.
by Bill Stewart 17 Dec '03

17 Dec '03

>>The question is: is there a "majority vote" mode on the keyservers that >>causes them to remove a key if enough people claim it is no longer valid? No - it's too easy to attack. (It's also outside the scope of what the keyservers do - they're convenient ways to collect the data for the Web of Trust, but they're not trusted themselves.) Even if you wanted "A majority vote of people who've signed a given key" to revoke the key, that's easy to attack - you and your tentacles can all sign the victim's key, send the signatures to the keyservers, and now that you're the majority, you can all send in notes saying "please revoke victim(a)antinuke.org's key - he's an FBI plant". I'm not really satisfied with Matt's description of revocation that requires it to be done by a key's signers, not owner, though there are workarounds for most of the problems, though I agree that PGP's framework is deficient (not inadequate - it's still Pretty Good - but way underpowered.) One problem is that usually _you_ are the one who knows your key needs revoking (either you forgot the passphrase, or you know the computer it was on has been compromised, or whatever.) Under PolicyMaker, I guess the best way to implement this is to always sign your own key (since signers are the ones who revoke keys), and establish policies requiring unrevoked self-signatures. It may be difficult to implement Certificate Revocation Lists in a way that works well for your own keys, though, depending on why you want to revoke them. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "The price of liberty is eternal vigilance" used to mean us watching # the government, not the other way around....

1 0

Re: <fwd> Spiegel on CIS Censorship
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:11 PM 1/8/96 -0500, Vin McLellan wrote: >CIS's utter >ignorance of free-speech principles set the stage for the symbolic >Bravarian Censorship of the Net. You'll hear of a dozen other nations >jumping in, with different standards, within the month. Don't overdo the CIS newsgroup "ban". The first sysop to "ban" newsgroups did so many years ago. There are well-developed techniques to read "banned" newsgroups. A FAQ and everything. http://www.ECNet.Net/users/mumbv/pages/banned-groups-faq.shtml Compuserve is just a large proprietary service and sometime ISP (and one of the most expensive ones). They are not a big player on the Net. > I find the tragic association of a "free" Internet and porn to be >painfully common among cyberless adults even in my own community. Odds >are, my state, Massachusetts -- arguably the most liberal of the US states >-- would vote for Censorship Filter tomorrow if it were on a ballot. Luckily it's not and can't be. > It's amazing how incompetent the liberal/libertarian side has been >in this public debate. (So incompetent, in fact, that there has been _no_ >public debate!) Everyone who wants to place control over any filter (any >part of The Filter?) in the hands of the citizen is just another >snuff/torture/kiddy porn addict. Almost all of the articles on the CIS "ban" have mentioned that "therapeutic" groups were also included. Certainly the Net has let CIS know what we think of them. They expressed surprise at our reaction. Their "ban" isn't even a ban as my piece on using CIS to read banned groups shows. (http://www.cs.umass.edu/~lmccarth/cypherpunks/banned.html) It is making it into Wired and the Baltimore Sun (maybe) and was good enough that Michael Miller, author of "Using Compuserve" linked to it from his book page: http://www.mcp.com/people/miller/cistop.htm. DCF

1 0

Re: PRIVACY: Private traces in public places
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tbyfield(a)panix.com (t byfield) on Wed, 10 Jan 10:42 AM > I ain't holding my breath until someone >develops a search engine for Fresh Kills. (See code relevance at end.) For the curious, Fresh Kills is NYC's main waste archive, the largest built structure in the US (a favorite of Japanese techno-tourists exceeding 256 Great Pyramids of Egypt) and still heaping. Archeologists are indeed excavating selected spots, under grants made after probes revealed that decomposition was not occurring as expected. Newspapers and such were perfectly preserved after years of burial. Due to sophisticated engineering of the mountain to prevent dispersal, air and moisture could not enter to lubricate return to mother earth. However, very profitable methane gas retrieval has been taking place for many years -- which may be a suitable metaphor for mining electronic archives. Now, then, code for this glop? Construction debris can be illegally dumped at Fresh Kills with the proper building-code-compliant green handily hooked to the side of the dumpster for the guard.

1 0

No Subject
by Douglas F. Elznic 17 Dec '03

17 Dec '03

Has anyone bought the disks mentioned in applied cryptography? Are they anvailable anywhere online to citizens of the US? -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

2 1

Re: When they came for the Jews...
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:33 AM 1/10/96 -0800, sameer wrote: > Is there some way I can get a copy of this letter? Is it >directed at specific ISPs or ISPs in general? An open response, >publicized, to this sounds like something I could do. Publicity is >fun. It's not on http://www.wiesenthal.com/ yet. Maybe I'll query. They are sending it to "hundreds" of ISPs. Hitting the big services first (even though they aren't really ISPs.) DCF

1 0