December 2003 - cypherpunks-legacy

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 4:08 PM 11/7/1996, Timothy C. May wrote: >At 2:38 PM -0800 11/7/96, Peter Hendrickson wrote: > >> If you can get a life prison term for your strong crypto you may >> hesitate to use it. If not, then you may get to be an example >> for everybody else. > Well, this is what in private e-mail to Peter I was referring to when I > said "only a police state" could pull the plug on free speech and strong > crypto once it was ubiquitously deployed. While the term "police state" is not well defined, I do not believe it applies to what I am describing. (There is a risk that it could develop, however.) Laws forbidding the use of cryptography have ominous free speech implications as we would be attempting to outlaw concealed meaning. Concealed meaning can be pretty well concealed and that makes for difficult and dangerous legal questions. On the other hand, the action of running a program which uses forbidden crypto systems is pretty unambiguous and could be effectively isolated from other kinds of speech. Many kinds of speech are already illegal. For instance, I am not allowed to copy somebody else's speech because it would violate copyright laws. I am not allowed to break verbal contracts. In essence, I am punished later for the something I said if I am forced to keep my word. But, this does not constitute a police state. What I am proposing would not require an end to fair trials or warrants or really any other legal customs we have. In case anybody has any doubts, and I doubt Tim does, the existence of a life sentence does not imply the presence of a police state. > Throwing people in prison for life for using crypto is something that is > certainly _possible_, though I rather doubt taxpayers will be keen on > paying for this. Simply executing those who use random numbers makes more > sense. The taxpayers will be happy to pay to keep a small number of criminals in jail if it keeps the rest of us fairly safe within our homes and on the streets. > All implausible, of course. > By the way, I've never claimed that I know crypto anarchy is irreversible, > I just think it is. I've presented some plausibility arguments on why I > think this is so, drawing parallels to other developments in history, but > logical proofs and predictions about the future don't usually go together > very well. Actually, I agree with Tim. I think the deployment of strong cryptography will be irreversible. But, it will be irreversible because the bad aspects of it won't be all that bad and in general it will be a very positive development. The reason it must be stopped now is to stop the voters from discovering this. (Certainly we have seen a strong anti-democratic sentiment among the proponents of GAK, when they propose that we cannot even be allowed to hear the scenarios which should concern us, the ultimate repository of political legitimacy in the United States.) A good comparison can be made to the recreational drug situation. Many people, probably a majority of people, believe that they should be allowed to take whatever drugs they like and many do. Efforts have been made to forbid it, but they are almost universally unsuccessful because of the tremendous popular support for recreational drug use. Peter Hendrickson ph(a)netcom.com

3 3

Leagal Deffinition of Encryption?
by William H. Geiger III 17 Dec '03

17 Dec '03

Is there any law(s) that actully define encryption? At it's very basics encryption is taking a group of 1's & 0's converting them into a different group of 1's & 0's and providing a mecanisim to change them back to the original group of 1's & 0's. >From a legal standpoitnt how is PGP any different than PKZIP? How does the law make a diference between an "encryption" program and a "compression" program other than the fact that the encryption program is advertized as encryption and the compression program is advertized as compression? -- ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting WebExplorer & Java Enhanced!!! Cooking With Warp 4.0 Author of PGPMR2 - PGP Front End for MR/2 Ice Look for MR/2 Tips & Rexx Scripts Get Work Place Shell for Windows!! PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info ----------------------------------------------------------- *MR/2 ICE: Rumour: NT means Not Tested

1 0

exclusion/censorship and the law
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:27 PM 11/6/96 -0600, Jim Choate wrote: >There is one important legal aspect which the operator of the Cypherpunks >mailing list has opened themselves up for with this action. In short they >have now opened themselves up for defamation and liable suites by imposing >an editorial policy on the contents of this list (1). > >This opens up the potential, for example, for Tim May to sue the operator of >the Cypherpunks mailing list now for posts from users (even anonymous ones) >which defame or otherwise liable his character, reputation, or ability to >pursue income in his chosen field. In short the operators of the list >becomes publishers and distributors of the material. It is the legal >difference between a bookstore and a book publisher. I don't pretend to have spent much attention on defamation, but the cases I've seen don't go nearly this far. The two that come to mind are _Cubby v. Compuserve_ 776 F. Supp. 135 (1991), and _Stratton Oakmont v. Prodigy_ (sorry, no cite at hand). _Cubby_ said that service providers were liable *only when they had knowledge of the defamation*. Since the list is set up (as far as I know) to forward messages (regardless of source) to the subscribers without further editorial review, _Cubby_ suggests no liability here. _Stratton Oakmont_ went the other direction (finding potential liability for defendant service provider, on a motion for preliminary injunction? can't remember) but has been widely criticized; that ruling never faced any extended scrutiny because the parties settled. Also, Prodigy, the defendant in Stratton Oakmont, exercised much greater editorial control over postings on that service, and had the ability to remove postings, which is something John Gilmore can't do. So my impression is that you've got the tail end of a useful concept (ability to control is frequently a factor used to determine liability) but are making far too much out of it. One really big difference I see here is that editorial control of the Cpunks list has occurred once (in 4? 5? years of the list's existence), is on a per-person not a per-message basis, and *does not function to restrict who can send messages but only limits Vulis' ability to _receive_ them on his usual system(s)*. You might take a look at Mike Godwin's article on net defamation at <http://www.eff.org/pub/Legal/net_libel_godwin.article>; by now it's a little old, but I don't think anything's happened since which would change its reasoning. >Censorship is censorship, irrespective of the source of the limitation. >Free expression is impossible in an environment of censorship. The problem with absolute statements like this is that they ignore important distinctions about scale - e.g., I think that it's very important that people, generally, be free to discuss whatever they want in private homes. But I also think it's very important that I be able to tell other people that they're not willing to discuss whatever they want in *my* home. Not because I'm especially excited about censorship, but because I enjoy my privacy and my peace & quiet. So on the level of national rights, yes, unrestricted speech is an excellent thing. But on the level of my living room, unrestricted speech is a very bad thing. I don't think anyone who is arguing that it's fine to throw Vulis off the list would make the argument that it would be acceptable for the government to throw Vulis off of the Internet. The closest thing I can see to a First Amendment argument against Gilmore is the "company town" argument, that the list is so much like a city or town that it ought to be subject to the restrictions that the First Amendment puts on municipalities and traditional public forums - but even this (rather far-out) argument got shot down a few days ago when our beloved Wallace of CyberPromo tried it in _Cyber Promotions v. America Online_. The judge said "no way", and I think that argument's a lot more plausible against American Online than against John Gilmore. >I have argued in the past that this list is a defacto public list because of >the way it is advertised and to the extent it is advertised. All the protests >by the operator to the contrary will not convince a court. I don't think this makes any sense. "Public list" has no special meaning. My impression is that you're trying to make an analogy to public places which are privately owned like motels and lunch counters and amusement parks, where the owners (despite being private actors) cannot discriminate on the basis of race, gender, national origin, etc. (See, e.g., Civil Rights Act of 1964, 42 USC 1981 et seq) But I don't think there's any especially credible allegation that Vulis was discriminated against on the basis of protected class membership; nor is it clear that the Civil Rights Act can be extended to the operation of mailing lists. (Can someone shed some light on this? I've spent some time reading civil rights cases and can't remember one which gets even close. But I hate to say "can't be done" on the basis of failing to remember a case where it has been done.) My hunch is that (especially with this Supreme Court) the First Amendment's right to speak and assemble freely would trump Congress' attempt (pursuant to the Fourteenth Amendment, Section V) to regulate the distribution of speech. If there's no prohibited discrimination (either because there's no prohibition, or there was no "discrimination" within the terms of the statute) then I don't see a cause of action. Wanting something you're not getting isn't enough. Owners of "public places" like malls or stores or restaurants are still free to exclude some people for non-prohibited reasons (like not meeting the dress code, or having behaved poorly in the past). And Vulis' behavior is certainly enough to suggest that his exclusion from the list (which has not impaired his ability to speak to the list) was neither arbitrary nor wrongly discriminatory. So I really don't think that a civil rights-flavored argument even gets to first base here. I am pretty disappointed to see that none of the people who profess to be shocked and wounded at Vulis' exclusion have bothered to set up your own lists. In my mind, whatever moral outrage you claim to have looks awfully small compared to the relatively small burden of doing something about what you say is bothering you. Someone said that saying "start your own list" is like saying "well, go start your own country"; but the difference is that you can only live in one place at a time, so starting your own country on some faraway island means severing personal and professional ties in the place that you live now, abandoning the countryside you've come to know and love, etc. But there's no reason that you can't start your own mailing list and stay on cypherpunks. As I pointed out a few days ago, you can even subscribe your list to the cypherpunks list, so that your list is "cypherpunks++". I think there are some copyright issues lurking here, but there are at least two filtered cypherpunks lists running, as well as Bob Hettinga's e-$pam list, which make use of cpunks traffic, and I'm not aware that any of those folks have attracted suits for their reproduction of list traffic. So I don't see any big obstacle to one or more people fixing what they say is a big problem. So I'm left to wonder if this really isn't the big deal people seem to enjoy making it into, or if it's a big deal, but free speech and lack of censorship is worth less than some time and/or some money to these folks. I think that "cypherpunks write code" can/should be understood as a question, e.g., "what are you doing to change the things that bother you?" -- Greg Broiles | "In this court, appellant and respondent are the gbroiles(a)netbox.com | same person. Each party has filed a brief." http://www.io.com/~gbroiles | Lodi v. Lodi, 173 Cal.App.3d 628, 219 Cal. | Rptr. 116 (3rd Dist, 1985)

2 1

Re: The final version of the NRC crypto report is now...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: Re: The final version of the NRC crypto report is now available! The Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) is pleased to announce the availability of its cryptography policy study "Cryptography's Role in Securing the Information Society". This report was originally released in pre-publication form on May 30, 1996. The final printed version of this report can be obtained from the National Academy Press, 1-800-624-6242 or Web site http://www.nap.edu/bookstore. The pre-publication version and the final printed copy differ in that the printed copy contains an index and many source documents relevant to the crypto policy debate; of course, editorial corrections have been made as well. An unoffical ASCII version of the prepublication report can be found at http://pwp.usa.pipeline.com/~jya/nrcindex.htm; the official NRC version should become available online in ASCII form in December. In addition, CSTB has been conducting briefings on this report at various sites around the country; if you would like to arrange a briefing in your area, please let us know (cstb(a)nas.edu, 202-334-2605).

1 0

Re: Blocking addresses by default
by Sean Roach 17 Dec '03

17 Dec '03

At 03:25 PM 11/7/96 -0500, you wrote: >Mark M. wrote: >> >> >> With remailer abuse becoming more popular and remailers going down >> because of complaints, there seems to be some interest in remailer >> software that will block all email by default and will only pass >> along email that is explicitly unblocked. >I think this threatens serious security problems for the remailer >network in two ways: > >1. You'd create a list of people interested in anonymous information, > which could potentially be obtained by police or other armed thugs. > However, those armed thugs would come up with a bunch of public keys with no names attached. These keys could be used to check that "person X's" e-mail was h[er,is] own but never know who was attached to that signature. Also, complaints could use that signature to close down the account, so that "person X" could no longer send. Of course, this would not prevent that individual from resubscribing, (what would, if you figure that out, apply it to Dr. Vulis), it would allow for the remailer to be used without the fear of the government confiscating the names of the individuals. The only thing I can think of that I don't have a solution for, note this is just what I've thought of, is the sting, where the government would take over the remailer and let it continue to operate, but logging the return posts. This could work simply for mailing lists, such as this one, where the sender could verify that the message got there in person, and receive h[er,is] responses straight from the same list. For private mail, the person would have to submit to being a part of a group of approximately 100 others, with all of the posts put in a newsgroup which would be downloaded in mass. Anyone watching for downloads would only see that the person was one of one-hundred who might have made that post. All of the posts could be encrypted with the key in plaintext for easy filtering. No need to attempt to decipher everyone's mail just to see what was for you. This would be akin to stopping by a bullitan board in a hospital to find out what the test results were. Anyone could see that you were there, but they wouldn't even know what type of test you were in for, be it a blood-sugar test, a chemical analysis, an X-ray or veneral-desease test. All they would be able to tell was that you're patient number was on that wall somewhere. Persons wanting more security could download the entire contents of several newsgroups straight to the screen while they were going to the fridge for a soda. Akin to visiting several bulletin boards to cover which post you were at. Granted, the second idea is less secure than the mailing list one, but could be made to work. In the hospital, you could send a friend in for the check, on the net, you could have a daemon remail the newsgroups for you and then self destruct. You could always keep a copy of the daemon on your hard drive, and use multiple telnet sites to do the job.

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

>Jeremiah A Blatz wrote: >ph(a)netcom.com (Peter Hendrickson) writes: >> It appears to be widely believed that cryptoanarchy is irreversible. >> Everybody believes that the race to deploy or forbid strong cryptography >> will define the outcome for a long time. >> >> I can't think of a reason why this should be so. ><snip> > Well, once I've got my strong crypto and electronic commerce, and 20 > or so virtual identities to do things for me, and the gub'ment can't > tell what money I'm making and spending, so they can't tax me. So if > they can't tax me, and they can't tax lots of folks, then they can't > pay their jack-booted thugs. So the goverment becomes irrelevant. It > can't support a huge police state infrastructure, and certainly can't > but mega-crays to break my crypto, so how're they going to retain > control? > When we say anarchy, we mean anarchy. This only works if there are large numbers of people who think it is a good idea. Otherwise, the resources of the Federal Government may be directed quite effectively against a small number of people. If you can get a life prison term for your strong crypto you may hesitate to use it. If not, then you may get to be an example for everybody else. Peter Hendrickson ph(a)netcom.com

3 2

Re: Blocking addresses by default
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mark M. wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > With remailer abuse becoming more popular and remailers going down > because of complaints, there seems to be some interest in remailer > software that will block all email by default and will only pass > along email that is explicitly unblocked. I think this threatens serious security problems for the remailer network in two ways: 1. You'd create a list of people interested in anonymous information, which could potentially be obtained by police or other armed thugs. 2. The traffic would go down so substantially that traffic analysis would be trivial. As a counterproposal, I'd like to see better disclaimers on remailed messages. The reason the people complaining are so pissed off is that the blocklists are neither advertised nor automated enough. I'd like to see disclaimers and block list instructions at the top of the body of every single message. This would be encapsulated in some mark characters so that it could easily be removed by remailer chains. E.g., To: remailer(a)erehwon.com Request-Remailing-To: remailer(a)nowhere.com [message] remailer(a)erehwon.com prepends the following to the message before it is sent along: $$ This message was sent through the anonymous remailer network. Neither the operator of this remailer, remailer-op(a)erewhon.com, nor the postmaster at this site has any way of determining the source or filtering the content of remailer messages. No logs are kept. If you do not wish to receive such anonymous messages from any link in the remailer network, send an email message to remailer-operators(a)c2.net with subject line "block." For more information on the remailer network, see [Raph's list] or send email to help@[?]. $$ remailer(a)nowhere.com looks for "$$" as the first line of the message, and strips everything up to the next occurrence of "$$". It then appends its own disclaimer block before sending the message to the hop (remailer or final destination). A bit annoying, yes, but I think this would go a long way towards improving public relations. I don't see how it compromises security. What's wrong with this scheme? Other than the fact that all remailers would have to change their software at the exact same moment. :-) [By the way, someone told me that the Chardos remailer doesn't include Complain-To or block-list instructions anywhere, not even in X-Headers. Is this true? I think that would be bad. [tm]] - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMoJFnCoZzwIn1bdtAQEZSwF/eurxI6jVBcv4srS8FEE3Rtc5rVCTfyw8 gNrC5p5ZzBGgFCaM3MOair4gH91zH/HK =oqSh -----END PGP SIGNATURE-----

3 2

Re: [NOISE] If the shoe fits, wear it [VULIS]
by Thomas C. Allard 17 Dec '03

17 Dec '03

Rich Graves <rcgraves(a)ix.netcom.com> said: > networks(a)vir.com wrote: > > The nature of the Internet means it is extremely difficult for John > > to prevent Dr. Vulis from either posting using a pseudonym or having > > messages forwarded to him. IF it were possible to prevent Vulis > > from either reading messages or posting do you think John would have > > done that too? Just curious. > > I think that gets into "how many angels can dance on the head of a > pin" territory, because it just isn't, and I certainly don't speak > for him. But... What if John didn't prevent him "suvscribing", but instead directed his software to simply send messages from Vulis back to him as though they were sent to the list, but in fact did not forward his messages to the rest of the list. Vulis would continue to (spit) and (fart) on the list, would assume everyone else saw it, but would not see any replies to his spew. His remailer (spits) would still get through, but think how much less noise there would be. Alternatively, he could just moderate the list and not forward his rantings at all. LOTS more work, but still feasible. All I'm saying is that it *is* possible for John to censor Vulis from this list if he was so inclined. rgds-- TA (tallard(a)frb.gov) I don't speak for the Federal Reserve Board, it doesn't speak for me. pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D

2 1

Re: Why is cryptoanarchy irreversible?
by jim bell 17 Dec '03

17 Dec '03

At 06:25 PM 11/7/96 -0800, Peter Hendrickson wrote: >At 5:12 PM 11/7/1996, jim bell wrote: >> BTW, some of your confusion is probably based is the false assumptions in >> your last sentence above. "..wide use of strong cryptography results in >> widely unpopular activities such as sarin attacks and political >> assassinations." > >No, you're confused, but it's probably my fault. We don't really know >what cryptoanarchy will be like. We all have ideas about it. Some >we share and some we don't. But we won't really know until we see it >happen. Well, uh, with all due respect, but while it's obviously true that we won't know EXACTLY how it'll be, that doesn't mean that no portion of we imagine will come true. This is particularly true on the big issues. For example, you hypothesized that "wide use of strong cryptography resuts in widely unpopular activities such as sarin attacks and political activities. I pointed out, almost certainly correctly, that these are wrong: 1. To believe that use in cryptography will result in greater numbers of random attacks on innocent civilians. As I pointed out, the exact opposite should be true: A greater ability to target the guilty means less reason to kill the innocent. 2. To believe that political assassination will be unpopular even if the ordinary citizen has an effective say in who's going to die. In other words, based on my understanding these beliefs are diametrically opposed to the truth. Not simply a difference in extent, we're talking a 180-degree change. Your response is a sheepish, "but we won't really know until we see it happen." Harrumph! >My whole point is based on the proposition that the doomsayers are right. Which doomsayers? What version of "doom"? >I believe D. Denning has suggested that cryptoanarchy will result in >the breakdown of our society. I suppose that depends a lot on what a person means by the phrase, "our society." Used as you (and maybe she, as well) this sounds like a code-word. To a statist, "society" is basically the stratification system that has developed to let one group of people control another. By that standard, cryptoanarchy WILL "result in the breakdown of our society." But that's all for the good. Jim Bell jimbell(a)pacifier.com

2 1

Re: [rant] Re: Censorship on cypherpunks
by Sean Roach 17 Dec '03

17 Dec '03

At 09:11 PM 11/6/96 -0800, Dale Thorn wrote: >What both of these arguments (moreso the first) fail to mention is an individual's >investment in time and possibly a lot of money in various memberships, with expec- >tations that they will have the opportunity to develop and express themselves to >their utmost capability. When I have a problem with some of the dirty things my >representatives in Washington DC do on my behalf, people say "like the U.S. or >leave it", etc., as though my father, his father, his father, etc. clear back to >the 1600's in the colonies here, wasted their blood on the battlefields defending >these assholes who like to say "you can just leave if you don't like it". > >The squashing of people's dreams begins at birth with selfish and shortsighted >parents, and since that and other oppressions permeates our brains at every level, >it's a wonder that some people are as accomplished and expressive as they are. This >topic as it's been handled so far by most of the subscribers is prima facie evidence >that most of the people in the industrialized countries are just good little suck-up >fascists. Actually, I was comparing some people on the list, who were saying someone could always start thier own list, with those who advocate telling someone to start a new country as opposed to making their vote count. This is a free country where we, fortunately, don't have to hang around, and, this is a free list, where we don't have to post or remain subscribers. I was saying that telling someone to start their own list was equivalent to telling them to dig in on an uninhabited island. I was never advocating either action. If you read the previous posts, you can see the one I responded to and see what I mean. I know that this may not be possible as you probably tossed them, but ask me if you would like, I have that post somewhere in backup.

3 2