December 2003 - cypherpunks-legacy

NYC Crypto Forum
by John Young 17 Dec '03

17 Dec '03

Ray Arachelian taped the Cryptography Forum at the Association of the Bar of the City of New York last evening and will share once its transcribed. In the meantime: TITLE OF PROGRAM: Guns, Ammunition and Cryptography: Is the Government's Policy on Digital Encryption Creating a Crisis? MODERATOR: Charles R. Nesson, Professor, Harvard Law School PANELISTS: Matt Blaze, Co-author of Risks of Key Recovery paper. (short-notice invitee) Lynn McNulty (ex-NIST now RSA) filling in for Jim Bidzos Scott Charney, Computer Crime Unit, Department of Justice Kenneth W. Dam, Professor, University of Chicago Law School Dorothy E. Denning David J. Farber, University of Pennsylvania Marc Rotenberg, EPIC ----- Nesson asked the audience (about a hundred), "How many use encryption?" Over half raised hands. "Wow!" he said, "If I asked that of a law class at Harvard, maybe two or three hands would have been raised." Nesson then posed to the principal question: "Is the government's policy on cryptography creating a crisis?" Dam, Denning and Charney said no. Other panelists said yes. The audience by show of hands was about evenly split. There was intense discussion among the panelists but no change in position. Some highlights: David Kahn, in the audience, reaffirmed his support for key escrow, stating that it would not change the current legal provisions for electronically snooping, and why ask for more privacy than is now authorized. Blaze summarized the KR risks paper and pointed out the enormous expense of designing, implementing, operating and securing a global key recovery system -- which, as he ironically smiled, could make cryptographers and crypto-corps rich. That such a system might make security weaker by offering fewer choice targets to attack -- the key repositories. Blaze reminded that encryption will become pervasive in all electronic systems, not just communications. That it must be robust and untamperable or more and more crucial systems will be vulnerable to attack. And, the more complicated the security provisions the more likely they will fail. Farber stated that time was being wasted on KR debate while the nation's infrastructure remained immensely vulnerable to electronic attack. He said that with six students he could shut the system down in "a few days, with, say, spoof E-mail to key administrators." That ITEF is working on a next-generation system to prevent that, but meanwhile there is great risk. McNulty reaffirmed industry's position that other countries will develop robust encryption if the US does not allow export. Charney responded by pointing out that the administration seeks global commitment to key escrow among governments, and asserts they will comply for the same reasons the USG wants it. He said, for example, that countries may allow development of strong crypto but, like the US, will not allow export. He cited Japan's refusal to allow NTT's 128-bit export, and said Russia will surely not allow the export of the Sun/Elvis product. Same for France, Germany, and so forth. There was audience derision when Charney noted that the US must do as the Russians and Chinese and French do to control crypto. Interestingly, Charney did not cite The Wassenaar Arrangement, although Dam pointed out how difficult it was to reach agreement on the COCOM predecessor and enforce compliance with it. Nesson summarized Charney's position by saying, "do you mean that key escrow would do no more than help you catch criminals too stupid to use unescrowed crypto?" Charney nodded, and said that "nearly all all criminals we catch by electronic surveillance talk openly about being surveilled but do nothing about to avoid it." Nesson reiterated: "Do you mean that you want a system to catch stupid criminals while the nation's infrastructure is left vulnerable?" Charney, "That's not the right way to put it." Denning gave examples of her recent survey of law enforcement for examples of crypto use to hinder investigations. Finally, Dam noted that encryption policy was a different task than implementing encryption systems. That the detailed understanding of those who follow the encryption debate is not shared by the public nor by most officials. That agreement upon policy will require greater education for those who could not care less about the complications and subtleties being debated. An auditor queried: There seems to be agreement that encryption will work best when it is totally transparent to users, and the sooner that is devised the better. Why not just get on with it,? Blaze shook his head at this cluelessness, howled at the ceiling, sprouted fur, bared teeth, leaped Dave Farber, went for Charney's jugular, clawed Denning. Kahn and the suited audience ran screaming into the safe streets of Manhattan, while shaggy coders roared, "Kill, kill, kill the infrastructure-fuckers."

1 0

More stories from the Bell jar...
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This story is from the Oregonian May 22, 1997 Page D3: Arrest solves mystery of law office stink bomb A federal investigation that led to the arrest of James Dalton Bell of Vancouver appears to have solved a longtime mystery regarding a stink bomb attack in a downtown Portland law office. In late April 1984, someone broke into law offices at 1123 S. W. Yamhill St. and poured a liquid on a hallway run that was so odorous it made at least one of the lawyers who smelled it vomit twice. At the time, Nick Albrecht, who still practices law there, said the skunklike scent, called mercaptan, was so overpowering that he had to go home because he could not stop gagging. The target of the stink bomb attack was lawyer C. Douglas Oliver, who now lives in Southern California and won't discuss the incident. Bell was arrested Friday on a federal complaint charging him with obstructing and impeding the Internal Revenue Service and the use of false Social Security numbers. The complaint said that documents found on Bell's computer boasted of the mercaptan attack on the office of a Portland lawyer who had sued him. The lawyer was Oliver. Albrecht said Oliver had suspected that Bell might have been behind the mercaptan attack, but could never prove it. The federal complaint also charged Bell with the March 16 mercaptan attack on the IRS offices in the federal office building in Vancouver. On the following day, when employees returned to work after the weekend, several of them had to be placed on leave because the smell was so powerful, the complaint said. -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQEVAwUBM4USfeQCP3v30CeZAQGNJgf+O8L65Bc6ce1jhUtUpjQS1kas2WU3TlNm l/wxZt+kNhRV58VnCLYg1JWsUhoifM6JK+v2QU727SVHmAy+ktlovL43oKsgK7EE Vg4WAj9A0rMqKIzNU/0PjNyjPtdsUEbxaZisIbWPONdm/sx1x9hhbDbA5T7sayyW 6HLms5v8n4OQ9URQsnNNpPme6cKTiMFnOk0qw2+0mQUska4q6fLgoEn+vxOYsDAP WPQHaF7EEWHr/8eDRYZP+GgaOtI2pLJvuLGXeebf/0+BEAmTNS6AUuAwt2ogmxCx TPGni0IRhODol5swhZlKAklK7si548Unm90o2o+Lg3JvFqg0SQs/Vg== =7KT2 -----END PGP SIGNATURE----- --- | "Bill Clinton - Bringing back the sixties one Nixon at a time." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

7 8

Re: Jim Bell Complaint
by John Young 17 Dec '03

17 Dec '03

William Geiger wrote: >After reading the complaint I have to say that with friends like that >who needs enemies? True, if that's what the friends actually said, and if they were not induced to do so by being fed lethal information: don't go down with Bell, protect yourself, spill your guts. Recall that John Painter spoke to one or more of them and they hedged the remarks of the complaint, but he, too, saw the makings of a deal in the affadavit's allegations. Turning friends against friends is pretty common in investigations, using threats and promises of relief from possible charges, even saying that your friend is squealing on you. I was struck by how similar some remarks attributed to Bell were to those attributed to McVeigh, not that they were not made, but that the investigators chose to select just those to indicate lethal intent. The possible link between the McVeigh trial and Jim Bell's bust could indicate how the feds are itching to attack every advocate of anti-gov mayhem (no pun Tim). The IRS searching the Internet for incriminating advocacy is a warning of what's to come, as often predicted here. Time to study and ponder the 1st Amend -- which, by the way, Matt Blaze did at the NYC crypto forum last night to challenge Charney and Denning. Matt pulled out a copy and cited it, which may be a good indication of what he knows that we don't about what's coming.

4 3

Police & military access
by Jim Choate 17 Dec '03

17 Dec '03

Hi, It occured to me that if the police have no civil liberties extending beyond that of a citizen and citizens are not legaly permitted access to military hardware then neither should the police. If this applied then it would not be legal for police to have access to any sort of communication or encryption technology that was not available to the normal citizen. If a police officer can buy body armor and automatic weapons for self defence then so can a citizen. If a police officer can search a suspect for weapons "to protect their person" and confiscate or otherwise remove them from the immediate vicinity then a normal citizen should require a police officer to do the same. In other words, once it is established that the suspect is not armed the police officer should be required to place their weapon in their vehicle or othewise secure it off their person. etc. etc. So, the question of the hour is: Do police have any civil rights not endowed to a individual citizen? Jim Choate CyberTects ravage(a)ssz.com

4 3

Re: Key Recovery / The True Story
by Ernest Hua 17 Dec '03

17 Dec '03

> And some government spook is going to break into a church's computer > to find out if they are secret terrorists because they oppose this > or that government policy. This is an interesting point on which very little serious debate is taking place: Is it EVER okay for spooks to break into a church's computer to find out if they are secret terrorists? I'm not sure the answer is clearly one way or another, and I am willing to bet that the tone of the answers will mostly be emotional appeals to some idealistic standard or pessimistic nightmares. A meta question is whether the answer to a question like this one above can be answer strictly through a "for all practical purposes it would never affect me so it does not matter" answer. Ern -- Ernest Hua, Software Sanitation Engineer/Chief Cut And Paste Officer Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707 Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua(a)chromatic.com -- Ernest Hua, Software Sanitation Engineer/Chief Cut And Paste Officer Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707 Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua(a)chromatic.com -- Ernest Hua, Software Sanitation Engineer/Chief Cut And Paste Officer Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707 Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua(a)chromatic.com

2 1

SIGH Kent clueless again(was Re: spam is a good thing (was Re: Spam IS Free Speech)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "William H. Geiger III" <whgiii(a)amaranth.com> > Date: Fri, 23 May 97 08:29:59 -0500 > No not at all. Just because I am connected to the network I am under no > obligation to accept a single bit. I don't have to ever download any mail > or I can download all or I can pick and choose what I accept or what I > don't. Exactly, This is the whole point of a firewall after all. Simply connecting your cable to a publicly accessible source implies no more than having your driveway end in a public street. It is NOT an open invitation to stroll through your living room. > Obviously you have not ever entered into contract agreements with an > accesses provider. There is no obligation on my part to receive a single > bit. If I never run a sendmail daemon then I will never receive a single > e-mail message regardless of how many are aimed at my servers. This is the > same with any TCP/IP service. The only obligation I have with my upstream > provider is to pay my bill. If I choose to bounce everything that is > routed from Spamford it is my right to do so as it is *MY* equipment. This is certainly the exact case between myself and my provider for SSZ. Jim Choate CyberTects ravage(a)ssz.com

2 1

NYC Crypto Forum Add
by John Young 17 Dec '03

17 Dec '03

A supplement to the NYC Crypto Forum: Toward the end Nesson asked, "How about the missing participant here, NSA?" Several panelists noted, "NSA's here, in the audience." (Nonesuch spoke, however.) Nesson went on to ask, "What about national security interests outweighing the right to privacy?" It was here that David Kahn offered his defense of key recovery. Farber and others responded that the problem is that the government is not trusted, that guards against abuse of power have not worked, that national security too often has been a cloak for illicit actions. Here, an audience member said that he worked at Salomon Brothers doing traffic analysis of vast E-mail, and that we should be aware that more electronic snooping is going on than most people know. How could we be sure that law enforcement would not similarly abuse systems set up to catch criminals for other purposes, as NSA allegedly does, and, now using the same methodolgies, as private companies do to spy on employees, customers and competitors. All panelists nodded at this, that it's hard to tell god from the devil, and crypto won't help.

2 1

Spam complaints 14 times worse than Spam.
by Ross Wright 17 Dec '03

17 Dec '03

This was from: Tasty Bits From The Technology Front Your Host: Keith Dawson This issue: <URL:http://www.tbtf.com/archive/05-22-97.html> ..Mailing-list spammers.. Email spam is the favorite gripe of most Netizens, excepting the spammers. Congress is considering legislation [25] to limit the practice of sending unwanted commercial email in bulk. Not everyone thinks this is a good idea. See [26] for a thread from an ongoing debate on Declan McCullagh's fight-censorship mailing list. George Matyjewicz <mosaic1(a)ix.netcom.com> did a modest experiment on a week's worth of his email -- he is on 56 mailing lists and gets around 200 messages a day -- to gauge how widespread the problem actually is. Matyjewicz posted these results: week avg/day Total messages 1,354 193.4 Spam messages 10 1.4 < 1 % Spam complaints 189 27.0 14 % Mailing-list owners share information on the addresses from which commercial spam messages originate. Recently Alexander Verbraeck <A.Verbraeck(a)duticai.twi.tudelft.nl> posted a particularly compre- hensive list of purported spammers. I have taken the liberty of preserving a snapshot on the TBTF archive [27], sorted both by email address and by "virulence" -- the total number of messages sent by each spammer over a given time period to two of Verbraeck's lists. Thanks to Tom Parmenter <tompar(a)world.std.com> for the tip. [25] <URL:http://www.news.com/News/Item/0%2C4%2C10875%2C00.html> [26] <URL:http://www.tbtf.com/resource/to-ban-spam.html> [27] <URL:http://www.tbtf.com/resource/spammers.html> =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

2 1

Re: Police & military access (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 22 May 1997 23:23:31 -0700 > From: Kent Crispin <kent(a)songbird.com> > Subject: Re: Police & military access > > Do police have any civil rights not endowed to a individual citizen? > > No. But on the job, doing their state assigned duties, they have > access to instrumentalities not available to private citizens or > off-duty police. "On" and "off" duty may sometimes be a little fuzzy > in practice, but the principle is clear. It isn't a big deal, and > it's not a matter of civil rights. Which principle is clear? That police like to confuse the issue as much as possible to their advantage? Of course it is a matter of civil rights. The police are a representative of the CIVIL authorities, you have truly missed the entire point of the constitution. > A license to practice medicine > gives you the ability to prescribe morphine. A certain class of > drivers license lets you drive a school bus full of children. True, but there is NO law that can dictate which doctor I choose let alone if I choose one at all. At least there I have a choice, because of this the comparison you are trying to draw is broke. Jim Choate CyberTects ravage(a)ssz.com

1 0

Re: Police & military access (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 23 May 1997 15:12:54 -0700 > From: Greg Broiles <gbroiles(a)netbox.com> > Subject: Re: Police & military access > >This would seem to support Jim Choate's general position. (Though I have my > >own skepticism that many jurisdictions think it is true.) > > Jim Choate's messages about cops and "civil rights" suggest that he's not > familiar with and/or interested in the basics of legal research. > Restrictions (and lack of restrictions) related to use of force, power to > arest, possession/use of weapons, etc., are mostly statutory. You can't > find them (or understand them) by starting with only the Constitution, and > then reasoning and deducing things from it. Absolutely, but those statutes MUST be referencable back to the Constitution. Something I freely admit is not the current case. If it were the current case this would be a very quite mailing list indeed. What a citizen can and can't do with a weapon is covered in the 2nd. It includes police. If I as a citizen can't have object x then a police officer can't have it, constitutionaly. > >From a moral or political perspective, (e.g., what *should* the > relationship between cops and citizens look like) what he writes is > perfectly reasonable. From a legal perspective (what is the law today?) > it's incomplete and thereby misleading. Absolutely, and if you are infering that I at any time in my life have EVER asserted that my speculation was the case then you need to take a reading comprehension course (as well as reflect on what the entire discussion on cypherpunks truly is at the core). What *should* be the case is the whole damn point. Jim Choate CyberTects ravage(a)ssz.com

1 0