December 2003 - cypherpunks-legacy

Re: White House crypto proposal -- too little, too late
by jim bell 17 Dec '03

17 Dec '03

At 08:50 PM 10/1/96 -0700, John Anonymous MacDonald wrote: >> Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) >> From: Declan McCullagh <declan(a)well.com> >> >> "What?" I asked. "Unless you're talking about import restrictions." >> >> "Exactly," he said. >> >> -Declan > >I don't doubt that they can do this if they really want to, but I >wonder what legal basis they will use for import restrictions. > >Are there any current import restrictions for products on can legally >manufacture, sell, and use in the United States? "Sugar" Jim Bell jimbell(a)pacifier.com

1 0

unsubsribe
by GOULDING CP 17 Dec '03

17 Dec '03

unsubsribe

1 0

The Right to Keep and Bear Crypto
by azur＠netcom.com 17 Dec '03

17 Dec '03

A well-regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed. --Constitution of the United States of America, Amendment II, 1791 I'm not a consitiutional scholar, but it seems to me that since the government has already classed crypto as arms via ITAR and since the I am guaranteed the right to bear arms I choose to bear the crypto of my choice as part of my arsonal. The founding father's believed that the citizen's right to arms is all that may ultimately stand in the path of a government no longer duly constituted. In such a case a manditory GAK system could render all but the government's crypto impotent, disarming the populace of this valuable weapon. I therefore propose that since only strong crypto may be secure against the government in such a circumstances the government may not deny me the right to keep and bear the strong crypto of my choosing, unless I use it for criminal purpose. Futher in order that citizen militias employing strong crypto be well regulated (e.g., well maintained) the practice of using strong crypto by such citizens must be regular and wide spread. -- Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

3 2

Re: This list is a joke
by Dave Temple 17 Dec '03

17 Dec '03

Actually, I am not adult enough to save the welcome message I received when I joined the list. Thanks to the many people who have since sent me the instructions. I am sorry I had to whine to get them. > > I guess you are not adult enough to take yourself off the list. > > > andrew >

1 0

REM_ail
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-8-96. VV: "The Remailer Is Dead, Long Live the Remailer. Life After Penet." By Dave Mandl (Excellent, Dave, yes!) By the strict standards of the cypherpunks, a loosely knit affinity group of the Net's most radical and technoliterate privacy advocates, Penet's security was actually on the flimsy side. Its Achilles' heel was the file -- just begging to be subpoenaed -- that linked users' real names to their Penet pseudonyms. Cypherpunk-run remailers, on the other hand, generally leave no trace of the sender's true identity. In addition, cypherpunk remailers can be "chained" -- messages can be routed through several far-flung remailers before reaching their final destination, making message tracing all but impossible, even for the remailer operators. ----- http://jya.com/remail.txt ftp://jya.com/pub/incoming/remail.txt REM_ail

1 0

Re: NYT on IBM GAK
by Rich Burroughs 17 Dec '03

17 Dec '03

At 11:14 AM 10/2/96 GMT, jya(a)pipeline.com (John Young) wrote: > The New York Times, October 2, 1996, pp. D1, D8. > > > Compromise Is Offered on Computer Security Codes > > By John Markoff [snip] > Executives of the International Business Machines > Corporation said late yesterday that they were still lining > up the final list of companies in the alliance. Those > involved will include Digital Equipment and smaller > data-security companies including RSA Data Security, Cylink ^^^^^^^^^^^^^^^^^ > and Trusted Information Systems. [snip] > "The Government announcement is disastrous," said Jim > Bidzos, chief executive of RSA Data Security, one of the > country's leading developers of data-scrambling software. > "We warned I.B.M. that the National Security Agency would > try to twist their technology." [snip] Isn't there at least a slight contradiction here? Hello, Mr. Markoff? Is RSA really involved in this "alliance" (read "sell out") or did IBM just throw out their name? Inquiring minds want to know... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Re: LDS 'mountain'
by Dale Thorn 17 Dec '03

17 Dec '03

attila wrote: > Dale: > the 'mountain' contains only original copies of the church > records (actually quite small) and the immense collection of > the genealogy of the world as records are microfilmed whereever > the have been available. these records contain ** only ** birth, > baptismal, marriage, death, and burial records. most European > records come from the churchs. [remaining text deleted] The only reason I would bother to mention this is merely to caution people to think: What could *possibly* happen if the shoe were on the other foot. If the Constitution is about anything at all, it's about balance of power, and when *any* power transfers more to one interest than another, interesting changes can occur. BTW, there have been articles in the L.A. Times about attempts by persons not of the Mormon faith to prevent Mormons from dominating the cultural life in SLC schools, other public venues, etc. This raises the eternal question: Can a group live the way *it* wants to without interference, or is group culture always going to constitute a threat to persons in the vicinity who don't share that culture?

1 0

Thoughtcrime a Reality: U.S. Toughens Child Pornography Law
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> WASHINGTON (Reuter) - Congress cracked down on child >pornographers in a new law that took effect Tuesday, making it >illegal to appear to depict children in sexual situations, >whether in films, computer images or photographs. > But the American Civil Liberties Union decried the law as >unconstitutional and a waste of prosecutors' resources, since it >expanded a law designed to protect any actual children used to >produce pornography. The ACLU said it also was so broad that >adults portraying children in films could risk prosecution. > Previously, depictions of minors produced by computers >without using children had been outside the scope of federal >law. The new law expands the definition of child pornography to >include any image -- photograph, video or computer-generated >image -- that depicts or appears to depict a minor engaged in >sexually explicit conduct. > Senate Judiciary Committee Chairman Orrin Hatch, a Utah >Republican, said it was designed to protect children from sexual >exploitation and pedophiles. ``This is a tough bill aimed a >child pornographers,'' he said. > ``While federal law has failed to keep pace with technology, >the purveyors of child pornography have been right on line with >it. Passage of this bill will help to correct that problem,'' >Hatch said. > But ACLU legislative counsel Daniel Katz said it had major >ramifications for artists, the film industry and journalism. He >said it included a waiver-of-privacy rule to permit newsroom >searches for information related to investigations of child >pornography. > ``It is much broader, and the ramifications are >extraordinary, both for artists and for people in the cinema,'' >Katz said. Under this expanded definition of child pornography, >it would be illegal to produce or show a film that included an >adult actor or actress portraying a minor in a sexually explicit >scene, he said. > Computers can be used to alter photographs, films and videos >to produce sexually explicit materials virtually >indistinguishable from unretouched photographs. The new >technology has hampered prosecutors in their ability to obtain >convictions because it can be impossible to identify individuals >or to prove that the materials were produced using real >children. > The new law would allow prosecution of pornographers whether >or not the identity of the child could be determined, so long as >the person, even if an adult, appeared to be a minor. Currently, >pornography is protected under free speech laws except when a >minor child is involved. > Hatch said the Judiciary Committee determined that >computer-generated pornography posed many of the same dangers to >children as did pornography made from unretouched photographs in >that it could be used to seduce children into sexual activity or >to encourage a pedophile to prey on them. > The new law sets mandatory prison sentences of 15 years for >production of child pornography, five years for possession of >the materials and life in prison for repeat offenders convicted >of sexual abuse of a minor. > The child pornography law was included in part of a broad >spending bill President Clinton signed into law Monday. It had >passed the Senate Monday just hours before the midnight deadline >for the start of the new financial year. > It does not address new or expanded regulation of the >Internet. The Justice Department has asked the Supreme Court to >overturn a landmark ruling by a Philadelphia appeals court that >blocked as unconstitutional a new federal law barring indecency >on the Internet. > > > _______________________ Regards, You cannot depend on your eyes when your imagination is out of focus. -Mark Twain Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

How might new GAK be enforced?
by Timothy C. May 17 Dec '03

17 Dec '03

Now that the shoe is dropping on "Clipper III" (or "Clipper IV"), the "voluntary, for export, key escrow system," how might it be enforced? Some possibilities: 1. Make GAK the "easiest and safest" use even within the United States. Do this by aggressively pursuing, harassing, and prosecuting anyone who lets non-U.S. persons, even within the United States, have access to export-controlled software. (I had not fully appreciated the ramifications of the ITARs for software distributed _within_ the U.S. until the Bernstein matter unfolded. Export-controlled software is not supposed to be sold to various classes of foreign persons, including visitors, students on certain types of visas, and others. Mostly such rules have been ignored, with large software stores like CompUSA, Fry's, Egghead, etc., simply selling export-controlled software to anyone with the money. Their are _stickers_ on some software items warning against export, but these are ignored in sales. A few high-profile prosecutions of large resellers could spread FUD wide and far, triggering a "GAK-only" policy on sales of crypto products. The outcome of the Bernstein hearing could thus be critical.) 2. Attempt to make illegal the _interoperability_ with non-GAK software. Or, attempt to make illegal interoperability with a product which would have been illegal to export. Thus, if Alice, in the U.S., uses a crypto product to communicate with Bob, in a foreign country, and it "would have been illegal" for Bob to legally receive the product, then Alice is presumed to be breaking some law (maybe "conspircacy"...I'm not a lawyer) by sending messages Bob can read. This is just vague speculation. But I think the government must be thinking how they can finesse this point, how they can stop the current "crypto anarchy" (in a different sense than I use it), where "rogue users" in foreign countries are unreachable by U.S. law. The easiest way, of course, is to go after U.S. persons or companies who intercommunicate with these rogue users. (Else what's to stop Giant Corporation from using Non-GAKked software within the U.S., which is perfectly legal (under the "voluntary" system), but then "happening" to have their foreign branches and customers obtain "bootleg" versions at their end? All it takes is a single copy to get out, and be duplicated a zillion times. Voila, interoperability, with the only "crime" being the first export...which is essentially impossible to stop, for so many reasons we mention so often. Conclusion: Government must make this very mode illegal, perhaps by making it a conspiracy to thwart the export laws....) Any other ideas on how the government plans to enforce GAK, to make GAK the overwhelmingly-preferred solution? --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 6

NYT on IBM GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, October 2, 1996, pp. D1, D8. Compromise Is Offered on Computer Security Codes By John Markoff The Clinton Administration offered a compromise to the computer industry yesterday by holding out the possibility of removing all export restrictions on data-scrambling technology for companies that accept a new approach to allow law enforcement officials to unscramble coded messages. The new system is being recommended by an alliance led by I.B.M.. The approach is to be announced today and has passed muster with the Central Intelligence Agency. It would enable law enforcement officials to unscramble computer communications -- provided they have a warrant -- without having to obtain a mathematical key to the code. Instead, the agents could use the warrant to obtain the cooperation of outside parties to help unscramble portions of code accompanying a message. This information would then allow law enforcement officials to draw mathematical inferences enabling them to decipher the scrambled messages. By making it at least a two-step process to decipher a scrambled, or encrypted, message, and by requiring the cooperation of at least two outside parties designated by the code users themselves, the approach is supposed to address the main criticisms against data-scrambling systems previously endorsed by the Government. But some industry executives and privacy-rights advocates said yesterday that the new approach would not satisfy their objections to a Government-backed eavesdropping system. Critics contend that any such system could compromise the privacy of United States citizens and hinder the ability of American high-technology companies to sell their most sophisticated data-security products overseas. Executives of the International Business Machines Corporation said late yesterday that they were still lining up the final list of companies in the alliance. Those involved will include Digital Equipment and smaller data-security companies including RSA Data Security, Cylink and Trusted Information Systems. The computer industry and the Clinton Administration, as well as factions within the Administration, have been at an impasse for years over export policy for data-scrambling technology. Intelligence and law enforcement agencies, fearing that such technology can be used by terrorists and criminals to conspire with impunity, have insisted on a system for cracking the coded messages under certain circumstances. Seeking to end the deadlock, I.B.M. set in motion the new compromise earlier this year when it demonstrated its experimental approach to the C.I.A. Director, John Deutsch. Mr. Deutsch then took an active role in the internal Administration debate, in which Justice Department and F.B.I. officials had previously taken a hard line against loosening export controls, according to several people familiar with the talks. In a public statement issued yesterday Vice President Al Gore said that if the I.B.M. data-deciphering technology proved workable, there would no longer be export restrictions on the strength of the data-scrambling technology or on the type of software algorithms -- or mathematical formulas -- employed. The Administration is calling the I.B.M. approach a "key recovery" system. The designation is meant to distinguish it from previously proposed "key escrow" systems, like one called Clipper that the Government put forth a few years ago. In an escrow system, one or more Government or private-industry escrow agents would hold keys for unlocking coded messages, which could be used by law-enforcement agents with a warrant. The drawbacks, according to I.B.M., are that the storage of the keys can become a record-keeping nightmare and can also make the system vulnerable to unauthorized use of the keys. The I.B.M. approach is intended to eliminate this vulnerability by giving no third party an actual key to the code. Instead, at least two "trusted agents" would be required to help unscramble encrypted information in the header of each message. Only after this portion of the message is deciphered, I.B.M. said, would law-enforcement agents be able to unscramble the contents of the message itself by recreating the original key to the code. "Our theory is this should work the same way as your filing cabinet," said Kathy Kincaid, an I.B.M. computer security executive. "You wouldn't give law enforcement the keys to your filing cabinet unless they had a search warrant." And yet, even one of the companies that I.B.M. is counting on as an alliance member said yesterday that new approach did not go far enough beyond the old Clipper plan, in terms of privacy protection. "The Government announcement is disastrous," said Jim Bidzos, chief executive of RSA Data Security, one of the country's leading developers of data-scrambling software. "We warned I.B.M. that the National Security Agency would try to twist their technology." The Clinton Administration also angered executives at the software company Netscape Communications, who warned that even the new Government plan would continue to hinder the American industry's ability to compete internationally. Peter Harter, Netscape's public-policy lawyer, contended that the Administration was playing favorites among computer companies, rewarding those willing to go along with its approach by removing export restrictions that might be retained for companies not willing to incorporate the "key recovery" system in their products. "This is tantamount to making public policy by extorting high-tech companies," Mr. Harter said. But some computer hardware makers were more conciliatory. "From my perspective the process has been much better this time," said Eric Schmitt, Sun Microsystem's chief technology officer. "The question is still, 'How will industry implement key recovery?' It's still too early to say." [End]

2 1