December 2003 - cypherpunks-legacy

Re: GAK, GAP, GAY
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:52 AM 9/18/96 -0700, Timothy C. May wrote: >On a related note, I read an article yesterday about the proposed new >Health Data Base, with all encounters with any medical institution or any >health care provider of any sort being cross-linked and cross-referenced. Which is why some of us lie when we buy private insurance or seek treatment. If you "go bare" of course and use different identifiers whenever you seek treatment there are no problems. Hospitals have to treat people anyway under Hill-Burton Act rules and since they have accepted oligopoly status and have conspired with the Feds to do all sorts of nasty privacy invasions, I don't see many libertarian problems in taking them up on their offer of free care. Private health insurance in Mexico and the UK is also cheap (by US standards). If Canada legalizes private insurance, it will be cheaper too. >And such data bases will be tied to True Names, of course, thus allowing >the "freezing out" of anyone who is not a True Name, who has fallen behind >in child support payments, who is late on his income taxes, and so on. No proposals yet along these lines although smokers might be denied care. >It doesn't matter if cash is still allowed if one cannot interact with any >health care person without a proper citizen-unit data base entry. They've >got you tracked even if you pay in gold dust. Claim to be a foreigner. >(Putting on my Duncan cap--not to be confused with dunce cap--I wonder what >will happen the first time someone dies because a hospital wouldn't treat >someone without a proper citizen-unit health care card?) So far it's just for reporting and not authorization purposes. >P.S. I fully understand that some doctors will treat patients for cash, >without reporting to The Authorities, just as some doctors will treat >gunshot wounds without the mandatory reporting of same to the police. This >does not mean such doctors will be easy to find. The System, if allowed to >win, will win. Particularly libertarian physicians. Also everyone goes to Mexico for (prescription) drugs these days. Maybe they will also seek treatment there or in Canada. >P.P.S. Many of the things we talk about on the list are being made >possible--the good and the bad--by computerization. Obviously. Burnham's >"Age of Privacy" (or maybe it was "The Age of Surveillance"--my copy is not >handy) made this point many years ago. We are taking the mechanization and >systematization procedures the Germans used so efficiently in the 1930s and >modernizing them, with every movement and every transactions tracked and >recorded in data bases. And yet, has anyone noticed any greater sense that we are orderly or in control. I think that we are more disordered than we have been in my lifetime at least. It obviously hasn't worked yet. DCF

1 0

Re: Wealth Tax vs. Capital Gains Tax Reduction
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:27 PM 9/18/96, Jason Vagner wrote: >On Tue, 17 Sep 1996, Timothy C. May wrote: > >> >> I've been thinking a lot about the prospects of a "wealth tax," or "asset >> tax," in the U.S. With the stock market averages at record levels (and, >> hey, Intel has gone up $6 just so far today, to an unheard of $94.5 level), >> and with increasing fractions of people's overall net worth tied up in >> equities, bonds, houses, property, etc., it may be that the looters will >> take a more serious look at taxing people's overall wealth, e.g., the 5% of >> net worth per year that some countries have. > >Forgive me if this is a stupid question, but could this lead to >"engineering" the market at particularly times of the year to decrease the >"official" value of an entity's value and complicating the pricing of >equities? Would this become a viable means for those with less wealth to >capitalize on the momentary "dip" in prices? Certainly people would look for "loopholes" and mechanisms for reducing their officially-calculated wealth, were such a wealth tax to be implemented. For example, they might find ways to transfer their wealth to trusts, corporations, foundations, etc., and then "use" this wealth by hiring themselves as high-priced consultants, providing "company cars" and "company yachts." (Arguably this already happens, with such corporate perquisites considered part of the compensation package for many highly-paid executives.) As to whether there are schemes for reducing the valuation of equities only at certain times of the year, I can't think of any that would have a significant effect. Deals to sell stock at artificially low prices are frowned upon. As are "parking" schemes. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

official statement from Lexis-Nexis about P-Trak
by Jim Byrd 17 Dec '03

17 Dec '03

This statement was issued today: -------- STATEMENT FROM LEXIS-NEXIS 9/18/96 Incorrect information is being distributed on Internet newsgroups regarding the data displayed in LEXIS-NEXIS' P-TRAK file. P-TRAK is like an electronic "white pages." The only information displayed is the name of the individual, current address and up to two previous addresses and telephone number. In some cases, the individual's maiden name may appear and as well as the month and year of birth. That is the ONLY information displayed in the P-TRAK file. Contrary to some messages that have been posted to some Internet discussion and news groups, the P-TRAK file DOES NOT contain any credit histories, bank account information, personal financial data, mother's maiden name or medical histories. This misinformation has been posted over and over again to various news groups. An example of a record appears below: Name: DOE, JOHN E Current Address: 1066 Anywhere Drive, Dayton, OH 95454 Previous Address: 106 Somewhere Drive, Dayton, OH 92454 Birthdate: 9/1965 Telephone Number: 555-1212 On File Since: 6/1/1994 The information displayed in the P-TRAK file is the type of information readily available from public information sources such as telephone directories (in print and CD-ROM format) and public records maintained by government agencies. LEXIS-NEXIS markets the P-TRAK file to the legal community for use by general legal practitioners, litigators and public attorneys, as well as law enforcement agencies and police departments. These professionals use the P-TRAK file to assist in locating litigants, witnesses, shareholders, debtors, heirs and beneficiaries. LEXIS-NEXIS is aware of the sensitivities regarding the potential misuse of information. Business competitors of LEXIS-NEXIS have for some time made Social Security numbers available to users of their services. In addition, Social Security Numbers and other information are available on the Internet from a number of sources. Despite this wide availability of Social Security numbers in the market place, LEXIS-NEXIS discontinued the display of Social Security numbers in the P-TRAK file as of June 11, 1996, eleven days after the product was introduced. Through its actions, LEXIS-NEXIS is balancing the privacy concerns of the public with the legitimate needs of legal, business and government professionals for access to accurate sources of publicly available information. By discontinuing the display of Social Security numbers in P-TRAK and only providing information that is already available to the public from other sources, LEXIS-NEXIS believes it has responsibly met the expressed concerns of the public. Individuals interested in having their names removed from the P-TRAK file can e-mail their full name and complete address to: p-trak(a)prod.lexis-nexis.com or mail this information to ATTN: P-TRAK, P. O. Box 933, Dayton, OH 45401.

1 0

Re: Informal Renegotiation of the Law
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:36 PM 9/17/96 -0800, Adamsc wrote: >It has always seemed somewhat amusing that we will have a) a widespread opinion >that homeschooling is of lesser value and b) numerous studies, surveys, >testimonials, reports, etc, that show what a rotten job public education is >doing*. This raises the question of how anyone even remotely concerned with >their children's welfare could do worse. . . Yet another unexplained mass >insanity. 'Gubmint Skools one of the most common forms of child abuse in America today. Luckily, the same contradictions in the Stalinist methods of production that brought the old SU to its knees are working their wonders on Education as well. Expect it to die from the top as tertiary education is seduced away by the cash derived from selling its wares over the Net. Then with the Web easing Primary and Secondary education at home and the schools worsening, more people will opt out. They will be further encouraged as the schools become the nexus for ever tighter regulation of family and personal life. After all, teachers, nurses, and social workers, work on and with their "charges" to uncover, child abusers, illegal aliens, substance abusers and who knows what all among the parents. The schools also keep loads of records on their "customers." Those who have never turned their kids over to the government for brain massage, find that they have many fewer run ins with the authorities. They also find that their kids are more likely to be able to infer, imply, and know the difference between the two. DCF

1 0

monkey-wrenching GAK
by Adam Back 17 Dec '03

17 Dec '03

This is along the lines of a technical monkey-wrenching of GAK: 1) The state of email encryption If the NSA decides they would like to get a decrypt of an email that you sent, they turn up with a copy of the encrypted email and request that you decrypt it. The reason that this is so bad is that you have effectively secret shared your plaintext between the NSA (who has archived all of your encrypted email), and yourself who still has they key. This is not in your interests. 2) Mandatory GAK In a future with mandatory GAK, the NSA has all your keys already, because they have a nice database of them, and so they can decrypt any thing they feel like. 3) Monkey-wrenching Even with GAK, where you are forced to give the government the keys, you can do much to make the job of administering GAK very expensive. You start by ensuring that the government can not get your encrypted data (the other half of the secret share), so that the key is of no use :-) You can do this by using a forward secret protocol such as Diffie-Hellman to exchange data, then you can't provide the encrypted text to the NSA even if you want to. But won't they make forward secret protocols illegal at the same time as enforcing GAK? Well, maybe they've left it too late already, consider: IP security layers in general - they provides an extra layer of encryption that the NSA has to obtain the keys for to make sense of their tap. They may have to archive impossible amounts of IP traffic if they can't recognize the type of IP traffic through the IP level encryption (www traffic has its uses as cover traffic :-) IP security layers which use Diffie-Hellman: forward secrecy means that the site owners can't decrypt old IP traffic even if they want to. When using an IP security layer, email delivered via SMTP will be transparently sent over an encrypted link with a random symmetric encryption key negotiated with DH. So the NSA can't get your encrypted email so the fact that they have the decryption key doesn't help them. Even if the NSA had access to the signatory keys used to authenticate DH key negotiation, this means that they still have to do an active MITM attack on the link. This is not something they can do after the fact. Bang goes the ability to archive it all and present it to people afterwards for decryption. Also the expense and complexity of fishing expeditions become impractical. To do a successful MITM attack, the NSA must also subvert the authentication key infrastructure, and hope that no one uses a subliminal, or out-of-band channel to verify the authentication. The above arguments, depending on how quickly things like John Gilmore's S/WAN are deployed, will quickly reduce the Governments options to: attempting to revoke de facto international standard internet protocols after the fact requesting the authentication keys used to sign DH negotiations, so that they can do MITM attacks, and get an IP packet modification infrastructure built (something significantly harder, and more expensive than the digital telephony bill which is still floundering at an estimated $4Bn) So, to monkey wrench GAK, be an early adopter of IP link level security, make sure that everybody is using link level security with forward secrecy, long before Clipper IV gets forced into use as a voluntary, or possibly later mandatory scheme. Adam -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

2 1

Re: Assassination Politics, is now Mercenarial Stuff
by Michelle Thompson 17 Dec '03

17 Dec '03

Michelle (me) Wrote: >> I believe that with the breakdown of the traditional sense of sovereignty, >> mercenary activity, whether military or commercial in nature, will increase. >> Engineering seems to be quite mercenary already, and very international. >> Marketing and advertising, to a novice (me), seem to be going the same way. At 04:40 PM 9/17/96 -0500, you wrote: >Depends on what you would qualify as being mercenary work, Would Americans >working on North Sea oil platforms getting paid $70,000+ a year tax free >be considered a mercenary? Yes. Reason: A mercenary is generally held to be someone that serves merely for wages or the adventure. (or taking the narrow definition, a soldier hired into foreign service.) Working on a North Sea oil platform seems to be something done primarily for the wages and/or the adventure. However, the qualification is to what degree does that American depend on the organization operating the rig? Just a little bit? Mercenary. A lot? Employee. The distinction between mercenary and employee, to me anyways, is directly related to the level of dependence the individual has on the group that's paying him/her. >Or going down to the islands and opening a data haven? Yes. Reason: This is much closer to pure mercenary than the former example. This is truly free-lance. There is no oil company paycheck nor is there day-to-day direction in what should or could be done that day at the data haven. However, you are under the influence of the legalities of the island, no? You stand a chance of being assimilated into the legal culture. Your data haven could become an institution, and therefore become used as an extension of that island's political presense. All very intriguing. >Or maybe being the engineer for the Sultan of Brunei? No, not really. In taking the "position" of engineer, you fall into the role of foreign consultant rather than mercenary. You are assimilated to a degree that would preclude the independence enjoyed by the mercenary. Contract for a "project" for the Sultan of Brunei, and yes, mercenary you could then be. >Hired Gun Since 1992! Wow. -Michelle

1 0

nt 3.51 file encryptor
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

i need a good file encryption routine to run under NT 3.51. the eaiser to use the better, since this will be used by people who otherwise can't spell encryption. public domain or 3rd party. cheers, -paul

1 0

WinSock Remailer Version ALPHA 1.3 Now Available
by Joey Grasty 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Y'all: Version ALPHA 1.3 of the WinSock Remailer is now available at Lance Cottrell's Export Controlled Crypto Site at: http://www.obscura.com/crypto.html After you get past the crypto control and into ftp site, look in the DOS directory for the file WSA13.ZIP. You can find more information on my webpage at: http://www.c2.net/~winsock/ which I will be updating tonight. What's new in this release: - -------------------------- 1) Support for e-mail accounts that are "Shared" or "Exclusive". This function allows a remailer operator to share a personal e-mail account with the remailer. The way this function works is that messages without valid remailer headers are NOT deleted from the mail spool file (the file where your messages are stored at your Internet Service Provider). Instead, the remailer only deletes messages with valid remailer headers from the mail spool, allowing another e-mail client (such as Eudora or Pegasus Mail) to retrieve the non-remailer messages. If the e-mail account is "Exclusive", the remailer will download all messages from the mail spool file and delete them automatically. Note that if you use the "Shared" function, you should always operate the remailer FIRST, and then your e-mail client. This way, the remailer removes the remailer messages, leaving the personal messages (and improperly formatted remailer messages) for your e-mail client to process. You will have to halt the remailer while using your e-mail client. If, for some reason, you manage to download a message meant for the remailer, simply save it to a file (in ASCII format) with a filename of the form INxxxxxx.yyy, where: xxxxxxx is a six-digit number (doesn't matter what number) yyy is a three-digit number (doesn't matter what number) and save it to the INMAIL directory. Make sure there is no other message with that filename so that you won't overwrite an existing message. The remailer will process the message normally on the next batch. You will probably want to kill all rejected messages, as each batch of messages that are processed will download each non-remailer message every time. Set the remailer to KEEP rejected messages until you feel comfortable with the remailer's operation, so you can recover any personal messages in the REJECT directory, if there is a problem with the remailer. 2) Support for message pool size on the Outgoing Mail dialog box. I recommend that the pool size be set to 3 for lightly used remailers (less than 100 messages per day) and 5 to 10 for heavily used remailers. 3) PGP only operation now works properly. 4) Separate secret key ring file for the remailer's key now works properly. The key file must be located in the PGP directory and only the filename should be used in the edit box on the PGP Options dialog box (the path is automatically appended to the filename). 5) The rare problem of the remailer locking up while retrieving messages from the POP server has been fixed. 6) Messages with subject help are now accepted along with remailer-help, to send the remailer help file. Features not yet implemented and known problems: - ----------------------------------------------- 1) Latent-Time is not operational; the header is ignored. 2) Message size limit is not implemented. 3) Help file is not implemented. Use my webpage at: http://www.c2.net/~winsock/setup.html instead. 4) Hard coded IP addresses are not supported. 5) Message reordering for NNTP is not supported yet. 6) The remailer does not work under WinNT or Win95 yet. 7) The remailer does not operate with the Netcom winsock. 8) If the remailer does not have enough memory to run the PGP task in a DOS window, the PGP decryption will fail and the message will be lost. Test a few messages before allowing the remailer to run unattended. 9) Occasionally, the remailer timing out on SMTP or POP3 will cause Free Agent (the newsreader) to disconnect from the news server when using the Internet-In-A-Box WINSOCK. Netscape and Private Idaho also cause this problem, so I am unsure if this is a problem with the remailer or with the WINSOCK. 10) Getting the addresses in the From: and Request-Remailing-To: header lines is weak (requires only that an "@" be present for the address to be assumed valid. Addresses without an "@" sign will be rejected. 11) Loading the WINSOCK.DLL and dialing does not work with Internet-In-A-Box dialer. Trumpet may work, but has not been tested recently. I will retest with Trumpet in a few days. The remailer has not been tested with any other WinSocks. If you find any that work or don't work, please let me know. 12) Debugging messages in DEBUG.ASC file in the LOG subdirectory are cryptic. Generally, timeouts are caused by the server not responding within 60 seconds. 13) Daylight savings time in the Date: header is not yet supported (it will always use standard time). 14) On rare occasions, long messages are sometimes munged. I've been working on this one for weeks, and still don't know why. Installing the WinSock Remailer: - ------------------------------- 1) Create a directory where you want the remailer code to reside, for example, C:\REMAILER. You should have at least 10-20 MB of free disk space on the drive where the remailer will operate. 2) Unzip the file WSA13.ZIP into the directory you just created. You will find three files, WSRMA12.ZIP, this file README.TXT and WSRAM13.SIG. WSRMA13.SIG is the detached signature file for WSRMA13.ZIP. Verify the signature using PGP and my key found on my homepage at http://www.c2.net/~winsock. 3) You will find the following files in WSRMA13.ZIP: Length Method Size Ratio Date Time CRC-32 Attr Name ------ ------ ----- ----- ---- ---- -------- ---- ---- 219648 Implode 107495 52% 11-17-94 04:50 d2386b5d --w- BC450RTL.DLL 164928 Implode 50249 70% 02-28-95 11:14 060f476f --w- BWCC.DLL 283 Shrunk 220 23% 08-04-96 17:41 eff2eab1 --w- COMMENT.ASC 34 Stored 34 0% 08-04-96 17:44 5400f517 --w- DEST.BLK 1310 Implode 731 45% 09-16-96 23:49 7049ba29 --w- HELP.ASC 232 Shrunk 194 17% 08-04-96 17:43 84f570bc --w- KEY.ASC 4846 Implode 2609 47% 08-13-96 21:37 f8aacb35 --w- LICENSE.TXT 266538 Implode 98828 63% 09-16-96 23:42 80b5a398 --w- REMAILER.EXE 17 Stored 17 0% 08-04-96 17:44 28dedbf6 --w- SOURCE.BLK 545 Implode 179 68% 08-27-95 10:59 d85b6f8e --w- WRPGP.PIF ------ ------ --- ------- 658381 260556 61% 10 4) Move the files BWCC.DLL and BC450RTL.DLL into your Windows system directory (usually C:\WINDOWS\SYSTEM) only if: a) you don't already have these two files, OR b) the dates on the two files in your system directory have dates earlier than those shown above. If you already have the same or later dated files, delete these two files. 5) Move the file WRPGP.PIF into your PGP directory (you should have installed PGP before installing the remailer), usually C:\PGP. Make sure the environment variable PGPPATH points to your PGP directory. 6) Edit the file COMMENT.ASC to customize the headers of messages sent by your remailer. You will want to include information on where to send complaints and blocking requests, and a pointer to your remailer's home page, if any. 7) Edit HELP.ASC for specific help information on how to use your remailer. This file will be sent to users of your remailer if you enable remailer-help on the Options Dialog Box. You should include information on which options you are using with your remailer. 8) Edit KEY.ASC to insert your remailer's PGP public key. 9) Edit SOURCE.BLK (source address blocking file) and DEST.BLK (destination address blocking file) for any addresses you want to block. I recommend you block "whitehouse.gov" to make sure no one uses your remailer to threaten the President, which is a federal crime. Each address must go on a separate line. 10) Create a "Program Item" that you will use to startup the remailer from the Windows Program Manager. Do this by selecting the Group that you want to put the WinSock Remailer into and then selecting File | New from the Program Manager. Make sure that the Working Directory points to the directory where REMAILER.EXE resides. 11) Once you have done all of the above instructions, you can now run the remailer for the first time. Open all of the dialog boxes under the Setup Menu and fill out all of the items. See the WinSock Remailer Setup Page at http://www.c2.net/~winsock/setup.html for more details. 12) Once everything is setup properly, you can now run the remailer. Use Private Idaho to send the remailer some test messages and verify that the operation of the remailer is successful. You will probably want to turn on logging so that you can debug any problems with your remailer setup. If you have any problems or questions, send me a note at jgrasty(a)gate.net and I will get back to you as soon as I can. You can find additional information on my webpage at http://www.c2.net/~winsock/. See also the release notes at http://www.c2.net/~winsock/relnote.html. Since this is alpha software, you may encounter some problems. Specifically, I need to know if you have success with any of the following untested configurations: a) Windows 95 (now known not to work) b) Windows NT (now known not to work) c) Any WinSock other than Internet-In-A-Box or Trumpet WinSock. d) Any version of PGP other than 2.6.2. If you do find a problem, give me detailed information on your computer's configuration, such as version of Windows, Winsock, amount of memory, which version of PGP, etc. Good luck, Joey Grasty jgrasty(a)gate.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMkCJNsODO2V89BZZAQGpSgL/bfB+K6kZsguHIWlmOdzkQiU/sJHYYFZN XMwyvt+CXyuQX3nCIwHEkWglFIly+9+FUHfD49McTuBAx0E/EyfuiQbS4XkiSsym 6r/B4kBv3w9Tv54p19LnsApSH4YjGHMX =4XOe -----END PGP SIGNATURE----- -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

1 0

Bernstein hearing: The Press Release
by John Gilmore 17 Dec '03

17 Dec '03

CRYPTO FACE-OFF AT HIGH-NOON Judge Patel to Decide if Government Restrictions on Cryptography Violate the First Amendment September 18, 1996 Electronic Frontier Foundation Contacts: Shari Steele, Staff Counsel 301/375-8856, ssteele(a)eff.org John Gilmore, Founding Board Member 415/221-6524, gnu(a)toad.com Cindy Cohn, McGlashan & Sarrail 415/341-2585, cindy(a)mcglashan.com San Francisco, CA -- On Friday, September 20, 1996, Judge Marilyn Hall Patel will hold hearings in a case with far-reaching implications for personal privacy, U.S. competitiveness, and national security. Mathematician Daniel J. Bernstein, a Research Assistant Professor in the Department of Mathematics, Statistics and Computer Science at the University of Illinois at Chicago, has sued several Federal agencies on the grounds that the agencies' requirement that he obtain a license prior to publishing his ideas about cryptography violates his First Amendment right to freedom of speech. Cryptography is the science of secret writing. It is the technology to use for providing privacy or proving authenticity over distances. All kinds of communications, from cellular phones to corporate or government databases, depend on cryptography for protection. The security of computers against intruders, the privacy and integrity of the Internet, ATM machines, satellite and cable TV, and the world financial networks all depend on cryptographic protection. In fact, the very future of the global Internet, especially as a tool for commerce, political organizing and scientific development of new ideas, depends upon the availability of strong encryption. The U.S. government has restricted cryptography since it was useful in winning World War II. However, cellular telephones, satellites, ATM machines, and the Internet did not exist in 1945; advances in communication and cheap computation have made cryptography useful in many new applications. In addition, strong encryption is already available abroad, making laws restricting their export obsolete and damaging the ability of U.S. businesses to compete in overseas markets. In fact, Congress is currently considering three pieces of legislation that would all update the export control laws and remove encryption from its current place on the U.S. Munitions List. While Washington toils with Pro-CODE and the other introduced bills, this hearing will examine the various legal tests that will determine whether the export laws and regulations (the "ITAR") are constitutional. Professor Bernstein argues that they violate the First Amendment in several different ways: LEGAL ARGUMENTS * Any legal framework that allows a government bureaucrat to censor speech before it happens is an unconstitutional prior restraint. The government is not allowed to set up such a drastic scheme unless they can prove that publication of such information will "surely result in direct, immediate, and irreparable damage to our Nation or its people" and that the regulation at issue is necessary to prevent this damage. The government must also tightly restrain the discretion given to the bureaucrats to ensure that they don't misuse this power. The government has not met this burden regarding the ITAR legal framework. * Because restrictions on speech about cryptography are based on the content of what is being said, the court must apply a strict scrutiny test to determine whether individuals can be punished for engaging in this speech. This requires that the regulation be necessary to serve a compelling state interest and that it is narrowly drawn to achieve that end. The ITAR regulatory scheme has adopted a too- restrictive approach, by prohibiting many forms of speech in the area of cryptography. * The ITAR regulatory framework lacks the necessary procedural safeguards. Grants of administrative discretion must be limited by clear standards, and judicial review must be available. "Quite simply, the ITAR Scheme allows its administrative agencies to make inconsistent, incorrect and sometimes incomprehensible decisions censoring speech, all without the protections of judicial review or oversight." * The ITAR framework is unconstitutionally vague. The government doesn't even seem to know what its regulations include and exclude! Here, they told Professor Bernstein that he could not publish his academic paper for over three years, only changing their collective mind and withdrawing that decision after being sued. The lack of standards has allowed the government to misuse a statute aimed at commercial, military arms sales to limit academic and scientific publication. * The ITAR regulatory scheme is overbroad. In an internal memo written almost 20 years ago, the government's own Office of Legal Counsel concluded that the ITAR's licensing standards "are not sufficiently precise to guard against arbitrary and inconsistent administrative action." The OLC specifically warned that the coverage was so broad it could apply to "communication of unclassified information by a technical lecturer at a university or to the conversation of a United States engineer who meets with foreign friends at home to discuss matters of theoretical interest." This is exactly what is happening here, and it is unconstitutional. Judge Patel will hear arguments from attorneys for Bernstein and the government concerning their respective motions for summary judgment. The hearing on Friday is scheduled for 12:00 noon at the United States District Court for the Northern District of California, San Francisco Headquarters, at 450 Golden Gate Avenue. The hearing is open to the press and to the public. CASE BACKGROUND Bernstein completed the development of an "encryption algorithm" (a recipe or set of instructions) he calls "Snuffle." In order to contribute Snuffle to the marketplace of scientific ideas, and to allow other scientists to evaluate and test his ideas, Bernstein wishes to publish (a) a paper in English describing and explaining the algorithm, (b) the "source code" for a computer program that uses the algorithm (this source code more precisely describes and implements the idea), and (c) instructions for how a person could use the source code and a computer to encrypt communications. He wishes to publish them in print journals as well as on the Internet. Bernstein also wishes to discuss these items at mathematical conferences, in college classrooms, on the Internet, and in other open, public meetings. In fact, he would like to use Snuffle as part of his course material for a cryptography class he will be teaching next spring. The Arms Export Control Act and the International Traffic in Arms Regulations (the ITAR regulatory scheme) required Bernstein to submit his ideas about cryptography to the government for review, to register as an arms dealer, and to apply for and obtain from the government a license to publish his ideas. Failure to do so would result in severe civil and criminal penalties. Bernstein believes this is a violation of his First Amendment rights and has sued the government. In the first phase of this litigation, the government argued that since Bernstein's ideas were expressed, in part, in computer language (source code), they were not protected by the First Amendment. On April 15, 1996, Judge Patel rejected that argument and held for the first time that computer source code is protected speech for purposes of the First Amendment. Because of its far-reaching implications, the Bernstein case is being watched closely by privacy advocates, the computer industry, the export and cryptography communities, and First Amendment activists. In fact, several members of these communities provided declarations that were submitted in support of Bernstein's motion. ABOUT THE ATTORNEYS Lead counsel on the case is Cindy Cohn of the San Mateo law firm of McGlashan & Sarrail, who is offering her services pro bono. Major additional pro bono legal assistance is being provided by Lee Tien of Berkeley; M. Edward Ross of the San Francisco law firm of Steefel, Levitt & Weiss; James Wheaton and Elizabeth Pritzker of the First Amendment Project in Oakland; and Robert Corn-Revere of the Washington, DC, law firm of Hogan & Hartson. ABOUT THE ELECTRONIC FRONTIER FOUNDATION The Electronic Frontier Foundation (EFF) is a non-profit civil liberties organization working in the public interest to protect privacy, free expression, and access to online resources and information. EFF is a primary sponsor of the Bernstein case. EFF helped to find Bernstein pro bono counsel, is a member of the Bernstein legal team, and helped collect members of the academic community and computer industry to support this case. Full text of the lawsuit and other paperwork filed in the case is available from EFF's online archives at http://www.eff.org/pub/EFF/Policy/Crypto/ITAR_export/Bernstein_case/

1 0

Re: Snake-Oil FAQ
by Sean Sutherland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: wendigo(a)pobox.com, cypherpunks(a)toad.com Date: Wed Sep 18 18:54:08 1996 > I think a blacklist of that sort is inherently bad. I would much rather > have the public be able to RECOGNIZE SYMPTOMS of snake oil, rather than > just be spoon fed a list of good products vs. bad products. Pardon the > cliche, but if you give a man a fish ... etc, etc. Not only that, but you're also looking at a potential lawsuit, unless such a list were compiled and managed through the use of a nymserver. Since there's no way, within reasonable limits, that a cryptogrpahic program can be proven bad, then a lawsuit is inevitable. I could potentially see a list of products which have "methods which have been proven ineffective in securing data against determined attacks" such as DES, etc., but otherwise, it's just begging for trouble. - --- Sean Sutherland | GCS/C d- s+:+ a--- C+++ V--- P L E- W++ N++ K- w PGP Key ID: E43E6489 | o O-(++) M-- V PS+ PE++ Y++ PGP++(+) t--- 5+++ http://pobox.com/~seans | X++ Rb++ DI+ D+ G e- h! !r y -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMkCLo1ZoKRrkPmSJAQE9swf/VWCd3++mf2NUPPPd37bW0oHTcz/T2Ft/ PAN/3bf0/NgE/0XxOHZn3DY2a8J5BYUNtnmoqwc/fVo+UQ1sLL8OgYZb/5PMLKtC A4u9IzhNcdg03M5r2n8DltDIsYewiA7NS3IP3/7s9PU/qpsXxS5aa9rSryoB5sLe qPRW97uutrhQD6BREcvVxpmYllYLLXGX9uYxevK99dxpUrNfjKWm/XL3iE2RsF5n 6mERNQXu3yUEEfPpAvIUPXmw9raAhlseBVBY+S4CbhqKRmH8pn6X2ZKeWouo4cPn ZWyyW6CrQJXbX8ARCp8ojI66UgkHCQpNWKIWKwAvTvtoPAT0lSvd+A== =zuPa -----END PGP SIGNATURE-----

1 0