December 2003 - cypherpunks-legacy

Wiretap and FTC/FCC net-regulation legislation, from HotWired
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 1 Oct 1996 05:57:17 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Congress' wiretap and FTC/FCC net-regulation bills, from HotWired http://www.netizen.com/netizen/96/40/index1a.html HotWired The Netizen "Sure, Walter Scott" by Declan McCullagh (declan(a)well.com) Washington, DC, 30 September When Parade, that ever-so-offline Sunday magazine, announces that Iranian terrorists use the Internet and unbreakable encryption to plan bombings, you know that anti-Net fearmongering has outgrown the Beltway and is gunning for Middle America. On the page facing an advertisement for a gilded 18-inch porcelain cherubim (US$97.96, if you must know), columnist Walter Scott wrote yesterday that Iranian terrorists have "stopped using the phone" in favor of the Internet. Then he quoted an unnamed "expert on international terrorism" who claims that terrorists have outsmarted the spooks: "Just when we thought we had outsmarted them, they caught on and started using codes on the Internet.... There's so much crazy screwball stuff on the Internet that it's practically impossible to track down and isolate the terrorists." Scott did not return phone calls. Small wonder, with fantastic columns like Scott's, that in the waning days of the 104th Congress our elected representatives have failed to do the right thing by the Net. A conspicuous lack of congressional spine made it almost inevitable that Capitol Hill would cave in to the demands of the White House and the Justice Department over the weekend and agree to yank portions of the FBI's national wiretap plan that limited the snooping powers of the Feds. On Saturday, this Digital Telephony slush fund cleared the House as part of an elephantine six-agency spending bill and the Senate approved it today. Earlier this month both the House and Senate declined to act on bills that would lift the encryption export embargo. Supporters of the measures were outflanked by Nebraska senator Jim Exon's intra-committee maneuvering and the anti-terrorism rhetoric of Jamie Gorelick, the deputy attorney general. Gorelick said last week at a hearing before the House Judiciary Committee that the DOJ is "concerned about the proliferation of unbreakable encryption" that might fall into the hands of "terrorists, organized crime, and foreign intelligence agents." (She doesn't like to admit that PGP is already available around the world.) True, some of the more Net-friendly legislators have tried to help. Senator Conrad Burns (R-Montana) emerged as a champion of netizens' privacy rights with his encryption bill, Pro-CODE. Representative Rick White (R-Washington) introduced a bill that would let ISPs give free online time to political candidates - but even though the House passed the bill last Thursday, the Senate will not. In another kind of congressional schizophrenia, one measure would give the Federal Trade Commission authority to regulate the Internet - while another bill blocks the Federal Communications Commission from even thinking about it. White attached an amendment to the FCC Modernization Act - an act that completely denies the commission jurisdiction "with respect to content or other regulation of the Internet or other interactive computer services." The House Republicans passed it over the objections of the Dems on 12 September, but it's still stuck in committee. White had tried to insert this amendment in the 1996 Telecom Act, but it was sliced out. Now he's trying again. "He believes that the federal government gets a little overzealous in regulation," says Connie Correll, White's press secretary. "We're dealing with a new medium that people aren't too familiar with." An FCC policy analyst says the commission "doesn't want to regulate the Net" but that "White's language would be a mistake." The analyst, who wished to remain anonymous, said: "For example, would the FCC be barred from creating regulations to protect privacy online, or from preempting state laws and regulations that criminalize online indecency?" Then late last week, Representative Bob Franks (R-New Jersey) coughed up his own Net-regulation bill. It's designed to respond to the outcry over the Lexis-Nexis P-TRAK database by halting the spread of Social Security numbers. Inexplicably, it does that by letting the FTC "examine and investigate" ISPs and issue "cease and desist" orders against them if they serve as an SSN-distribution conduit. I called up Frank DiStefano from Franks' office. "Why hold ISPs liable?" I asked him. "In June, the FTC itself decided to hold off from Net regulation.. If someone is giving out another person's personal information, why not let the courts decide if he's violating the law?" "OK, you've convinced me," said DiStefano. He said the reason the FTC provisions were in the bill was "to make a point" and his office "would work on this over the recess." No doubt - until Parade calls for the FTC to crack down on narco-terrorists selling Social Security numbers online. --- Some links: Linkname: Brock Meeks on FEC reform, Rep. White's bill URL: http://www.netizen.com/netizen/96/18/index5a.html Linkname: Democrats vote in committee to let FCC regulate Net URL: http://www2.eff.org/pub/Legislation/Bills_by_sponsor/white_fcc_ noregulation_1996.vote ###

1 0

RE: Signs of Trouble in D.C.
by Scobbie, Jason 17 Dec '03

17 Dec '03

>>>Signs of unrest in the nation's capital. > >>>These signs began to appear all over yesterday. > >>>WARNING >>>THIS AREA HAS BEEN >>>DECLARED A DRUG FREE ZONE I can attest to the ignorance of the govt. of DC. Having spent 18 months in Arlington (US ARMY), I have seen many acts of total ignorance by the govt. One can only speculate on not only how Marion Berry has regained his power, but to what extent some one has to go before being banded not only a criminal but also no longer welcome in the public sector... Jason Scobbie ________________________ > Drink more Bud >

1 0

NYT on New GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, October 1, 1996, pp. D1, D2. Accord Near On Computer Security Codes 'Key' System Required For Law Enforcement By David E. Sanger Washington, Sept. 30 -- After several years of debate between the computer industry and American intelligence agencies, President Clinton has decided to permit American computer companies to export more powerful data-scrambling software but only if they establish a system that will enable keys to the code to be obtained by law enforcement officials with a court warrant. Administration officials, speaking on the condition of anonymity, said Mr. Clinton reached his decision late last week and that Vice President Al Gore would announce it on Wednesday or Thursday. Several big computer companies, led by the I.B.M., have agreed to the new system, but many others, which have opposed past proposals by the Administration for data- scrambling policies, are likely to object. Many American computer and software executives have long argued that United States export controls on the most sophisticated data-privacy technology put American industry at a disadvantage versus products sold by their foreign competitors. But the Clinton White House, like previous Administrations, citing national security issues and fears of foreign terrorists or criminals, is loath to permit the export of some of the most powerful data-scrambling software. The reason has chiefly been that intelligence agencies feared such equipment would be used by foreign terrorists, drug cartels and other criminals to hide transactions and communications. Now, in a compromise, according to two senior officials in the Administration who have been deeply involved in the new policy, American companies will be permitted on Jan. 1 to export software that encrypts, or scrambles, data using "keys" -- lengthy numeric codes -- that are up to 56 bits long. Until now, companies have been prohibited from selling products abroad that have keys longer than 40 bits. Mr. Clinton has also decided to move the authority for exporting the encryption software from the State Department, which has had export-licensing authority because the technology has been classified as munitions, to the Commerce Department, which controls the export of products that have both commercial and military use. Industry officials have long urged that change, betting the Commerce Department would be more inclined to give a higher priority to American competitive interests. But starting in two years, American companies choosing to export the more sophisticated software would have to set up what the industry is calling a "key recovery" system. That system would enable intelligence officials and law enforcement agents, armed with court warrants, to go through a lengthy multi-step process that would give them the mathematical key to decoding scrambled communications. The approach replaces the Administration's earlier proposed "key escrow" system in which the Government would have been the repository of the numeric keys -- leading to fears of potential Government abuse, or a reluctance by legitimate foreign users to buy the software. Under the new plan, the keys may be held by third-party companies. And large institutions, like banks may be allowed to hold their keys in escrow -- assuming they pass some kind of Government certification. Still, the success of the system will depend on large part on the Administration's efforts to persuade other countries to adopt the same "key recovery" system, allowing their intelligence agencies and justice systems to cooperate in trailing criminals across national borders. But Mr. Clinton's aides acknowledged today that this process has just begun, and so far only England and France have expressed much enthusiasm. "It is going to take a while to persuade people that their data is safe under this system, that it protects privacy, and yet that we can use the system to trace terrorists or drug dealers," one senior Administration official said. Officials at I.B.M., which is expected to announce on Wednesday the creation of an industry consortium to aid in establishing the "key recovery" system, said today that no single entity would hold the entire key. Instead, it will be divided up across several companies that would handle any given message, much the way the launching officials in nuclear missile silos each had only part of the key instructions needed to begin a nuclear attack. If the C.I.A., for example, obtained a court order to decode a message, it would have to go to several groups with its warrant to piece together the key. "We believe that this solves the, biggest weak point in the previous plans, where one entity held the key," said an I.B.M. official familiar with the company's announcement. But these steps are not likely to silence all the critics. "There is still a perception that the U.S. is trying to extend its intelligence capability by setting standards around the world," said Marc Rotenberg, director of the Electronic Privacy Information Center. There are other potential holes in the system. Customers in the United States will be free to buy encryption software of any complexity -- as they can today -- with keys that are much longer than 56 bits and are nearly impossible to break. That means terrorist groups or drug dealers could still buy such software and sneak it out of the country, or even transmit it over computer networks. "There is nothing we can do about bright students or Joe Terrorist who use sophisticated encryption systems to communicate with each other," one senior administration official said. "But when they brush up against legitimate groups, especially banks," the official said, "then they are more likely to be dealing with a system" where law enforcement could use the key recovery system to decode the communications. On Capitol Hill, several bills had been pending that would lift all export controls on encryption software, but the legislation did not move as the current session of Congress wound down. In Congressional testimony last week, Jamie S. Gorelick, Deputy Attorney General, said lifting all export controls would "undermine our leadership role in fighting international crime and damage our own national security interests." [End]

1 0

Clipper III on the table
by Omegaman 17 Dec '03

17 Dec '03

Here we go again...from today's NYTimes...Clipper III ---------------------------------------------------------------------- -------- > Clinton Ready for Exports of Data Codes > > By DAVID E. SANGER > > WASHINGTON -- After several years of debate between the > computer industry and U.S. intelligence agencies, President > Clinton has decided to permit U.S. computer companies to export more > powerful data-scrambling software, but only if they establish a system > that will enable keys to the code to be obtained by law-enforcement > officials with a court warrant. <snip> > Several big computer companies, led by IBM, have agreed to the new > system, but many others, which have opposed past proposals by the > administration for data-scrambling policies, are likely to object. <snip> > But the Clinton White House, like previous administrations, citing > national security issues and fears of foreign terrorists or > criminals, is loath to permit the export of some of the most > powerful data-scrambling software. > > Their reason has chiefly been that intelligence agencies feared such > equipment would be used by foreign terrorists, drug cartels and > other criminals to hide transactions and communications. <snip> > Now, in a compromise, according to two senior officials in the > administration who have been deeply involved in the new policy, on > Jan. 1, U.S. companies will be permitted to export software that > encrypts, or scrambles, data using "keys" -- lengthy numeric codes > -- that are up to 56 bits long. (ooooo. 16 extra bits!) > Clinton has also decided to move the authority for exporting the > encryption software from the state department, which has had > export-licensing authority because the technology has been > classified as munitions, to the commerce department, which controls > the export of products that have both commercial and military use. <snip> > But starting in two years, U.S. companies choosing to export the > more sophisticated software would have to set up what the industry > is calling a "key recovery" system. > That system would enable intelligence officials and law-enforcement > agents, armed with court warrants, to go through a lengthy multistep > process that would give them the mathematical key to decoding > scrambled communications. > The approach replaces the administration's earlier proposed "key > escrow" system in which the government would have been the > repository of the numeric keys -- leading to fears of potential > government abuse, or a reluctance by legitimate foreign users to buy > the software. <snip> > Still, the success of the system will depend in large part on the > administration's efforts to convince other countries to adopt the > same "key recovery" system, allowing their intelligence agencies and > justice systems to cooperate in trailing criminals across national > borders. > But Clinton's aides acknowledged Monday that this process has just > begun, and so far only England and France have expressed much > enthusiasm. <snip> > Officials at IBM, which is expected to announce on Wednesday the > creation of an industry consortium to aid in establishing the "key > recovery" system, said Monday that no single entity would hold the > entire key. > Instead, it will be divided across several companies that would > handle any given message <snip> > There are other potential holes in the system. Customers in the > United States will be free to buy encryption software of any > complexity -- as they can today -- with keys that are much longer > than 56 bits and are nearly impossible to break. > That means terrorist groups or drug dealers could still buy such > software and sneak it out of the country, or even transmit it over > computer networks. > "There is nothing we can do about bright students or Joe Terrorist > who use sophisticated encryption systems to communicate with each > other," one senior administration official said. > "But when they brush up against legitimate groups, especially > banks," the official said, "then they are more likely to be dealing > with a system" where law enforcement could use the key recovery > system to decode the communications. > Copyright 1996 The New York Times Company ----------------------------------------------------------------- me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

Re: e$: NSA Fluffy FUD?
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Sep 30, 1996 17:56:39, 'Robert Hettinga <rah(a)shipwright.com>' wrote: >Anyway, has anyone *else* seen this apocryphal NSA paper yet? Is it on the web? >I'm sure (he said, volunteering someone else's services unasked yet again) that >someone like John Young would be interested in seeing that fax... You bet, and begging for it. Fax: 212-799-4003 (USfA)

1 0

Re: Clipper III on the table
by Jon Lebkowsky 17 Dec '03

17 Dec '03

At 08:51 AM 10/1/96 +0000, Omegaman wrote: >Here we go again...from today's NYTimes...Clipper III >---------------------------------------------------------------------- >-------- > Clinton Ready for Exports of Data Codes > > By DAVID E. >SANGER > > WASHINGTON -- After several years of debate between the > >computer industry and U.S. intelligence agencies, President > Clinton >has decided to permit U.S. computer companies to export more > >powerful data-scrambling software, but only if they establish a system >> that will enable keys to the code to be obtained by law-enforcement >> officials with a court warrant. ... That URL is http://www.nytimes.com/library/cyber/week/1001code.html -- Jon Lebkowsky http://www.well.com/~jonl jonl(a)hotwired.com

1 0

RE: Utah as a Religious Police State [RANT]
by Moroni 17 Dec '03

17 Dec '03

The mountain is not for the public . Not even mormon public. The records are.The mountain merely contains dup0licates of everything so in the event of a nuclear devastation the church could paste things together again. People can submit whatever they wnat to the records including wills and trusts and stuff ,but that has nothing to do with the gentile community at large . i can only think of the microfilms containing a gentile will if that gentile wanted one.

1 0

mormons questions
by Moroni 17 Dec '03

17 Dec '03

I have no desire to make this a mormon list so any additional questions can be answered by me at 1-717-343-2365. Intelligent questions only. moroni

1 0

Re: RESPONSE FROM CYBERPROMO
by Dale Thorn 17 Dec '03

17 Dec '03

Mail AutoResponder wrote: > Version 9-30-96: > Cyber Promotions has started to implement stricter Terms of Service > policies WITH TEETH. We have just recently terminated several accounts for > abuse of our policies. (Updated TOS at end of message). [buncha text deleted] > If you would like to send a complaint about any account @cyberpromo.com or > @answerme.com or @omni.cyberpromo.com that has not been terminated, please > send email to: wallace(a)cyberpromo.com Ya' know, it's hard enough working 10 hours a day in a sweatshop, coming home to three kids and a cranky wife, the washer doesn't work, etc., and now I have to answer you? Please, just leave me alone. Don't send me anything. No free money. Nothing.

2 1

GAK Rat Pack
by jya＠pipeline.com 17 Dec '03

17 Dec '03

C|NET, October 2, 1996, 1:45 p.m. PT Computer alliance supports encryption policy By Alex Lash An alliance of 11 software and hardware companies has just announced its formation to develop key-recovery solutions for electronic encryption, a crucial component of the Clinton administration's latest plan to loosen the export of encryption technology. Announced yesterday, the administration's plan gives exporters of encryption or encrypted software a two-year window starting January 1, 1997, to build what the administration calls "key recovery" into their products. IBM, Apple Computer, Atalla, Digital Equipment, Groupe Bull, Hewlett-Packard, NCR, RSA Data Security, Sun Microsystems, Trusted Information Systems, and United Parcel Service have banded together to develop systems that will give the government what it wants, which is access to suspicious encrypted messages, so that compliant software companies will be able to get export licenses for hard-to-crack encryption codes. "Export controls are a fact of life," RSA President Jim Bidzos said today. "In an imperfect world this technique will at least allow you to take advantage of what governments around the world will allow." RSA's presence in the alliance is not only a coup for the government but a big surprise, as Bidzos has been one of the most vocal opponents of the Clinton administration's key escrow efforts. He has even accused the government of offering software companies special "sweetheart" deals to gain support for its encryption regulation plans. A key-recovery plan not only satisfies the government's desire for court-ordered access to encrypted messages, but also sets off alarm bells for privacy advocates and civil libertarians. Some within the U.S. software industry also claim they won't be able to sell encrypted products overseas if customers know the U.S. government has access to a skeleton key. "While some companies might choose to cast their lot with the government's key-escrow policy, the marketplace is likely to reject the approved products," said David Sobel, legal counsel for the Electronic Privacy Information Center. "Users want strong security, not guaranteed government access to their communications." However, the concept of key recovery is not anathema to companies that acknowledge that firms and folks using encryption to secure electronic transactions and communications will need backup copies of their keys, just as homeowners keep an extra house key under a flower pot. Under the new government plan, a company that promises to participate in key recovery will receive a six-month license to export up to 56-bit DES encryption. When the promise is fulfilled and the government can get access to the decryption keys, the 56-bit limit is lifted. If by the end of the two-year grace period the company has not fulfilled its promise to implement a key-recovery scheme, the 56-bit limit is dropped back down to the current 40-bit limit. "The fact that 56-bit DES [a type of encryption] will be available from significant sources is going to jump-start electronic commerce," said Ken Kay, executive director of the Computer Systems Policy Project, a public policy group comprised of 12 computer industry CEOs. Now that the details are out and endorsements are coming in, executive action is expected in the next two to three weeks, according to one senior administration official. President Clinton will soon sign an executive order that transfers jurisdiction over encryption export licenses from the State Department to the Commerce Department, a move that the computer industry has asked for in the past because they see Commerce as a more sympathetic agency. At the same time, Commerce will announce a new set of streamlined rules to grant companies a "fast track" to an export license if they comply with key recovery, the official said. Commerce plans to begin licensing on January 1. But the new plan will also give the Justice Department a voice in the licensing process, a detail that angers privacy advocates and software companies alike. "The transfer from State to Commerce has been called for for a long time, but a small tweak is that the FBI now has veto power," said Peter Harter, legal counsel to Netscape Communications. "Domestic law enforcement shouldn't have a seat at the table." Harter acknowledged that Netscape has not ruled out key recovery but said that the market must show demand for it. The administration has said it hopes to introduce a bill next spring that would encourage the build-up of key recovery by establishing laws on the conduct of third-party key holders. But it will not try to mandate key recovery through legislation. "I think we have a critical mass of companies willing to work with us," said Heidi Kukis, spokesperson for the Vice President's office. "That would make legislation to mandate key recovery very unlikely." Another fear is that the administration is using export limits to control domestic use of encryption. While Gore directly stated yesterday that domestic use of encryption will remain unregulated, the double standard for domestic and international products might discourage U.S. companies from developing two different versions, leaving U.S. and Canadian customers with the same products that the federal government has deemed safe to ship overseas. "We obtained and intend to hold the administration to its assurances that export controls would not be used to control domestic use," said Kay of the CSPP. "The CEOs have told the administration that if they want to do domestic controls, they should do it frontally through the democratic process and introduce legislation." [End]

1 0