December 2003 - cypherpunks-legacy

Re: (fwd) Clipper and Tipper on Route 666
by Clark Reynard 17 Dec '03

17 Dec '03

I must say I had never considered the possibility that the Data Superhighway itself might be a scam; but it's an interesting possibility. With all the hideous legislative work they cribbed from the Bush clan, a former CIA chief; how surprised would you be to find that the Data Superhighway AND Clipper Chip proposals were intended to be enacted almost simultaneously; to rein in the Internet. Perhaps the spooks have, as we all know, been buying CD-ROMS and grepping 'em. It could be a conspiracy to establish complete government surveillance of all computer equipment. I may simply be being paranoid, here, but in political situations which smack of unlikely coincidence; one must occasionally ask the rhetorical question _Cui bono_? In this case, a number of people stand to benefit; and, oddly, the people seem to be predominantly in the government. I'm not entirely serious about this theory, and I do present it semi-satirically, as a perspicacious few may have noted; but perhaps the topic shall stir up a bit of debate. "Route 666." I like that. How does one get hold of Pat Robertson's people? And get him to think we're good Christian boys, so they'll do it? I think Pat's _already_ pissed about this Clipper thing, and he'd be happy to talk about evil liberal perfidy in the White House. Anyone have their FAX numbers and addresses? ---- Robert W. F. Clark PGP Key Available Upon Request rclark(a)nyx.cs.du.edu clark(a)metal.psu.edu

4 3

TEMPEST, Van Eyck Radiation, and Eavesdropping
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

TEMPESTpunks, The theme of TEMPEST/RF/eavesdroping/Faraday cages/Van Eyck Radiation/etc. comes up on this list every month or so, nearly as often as the threads about generating random numbers in hardware. (If you don't know about eavesdropping on computer sessions by monitoring and decoding RF emissions by the computers, keep reading this list and the topic will pop up, as it just has!) Anyway, I found this item interesting. I'm not yet sure we need to become "Faraday-Cage-punks quite yet, but the articles and laws mentioned in this report might be useful for someone. From: mitchell(a)ncsa.uiuc.edu (myself) Newsgroups: talk.politics.crypto Subject: Re: illegal taps Date: 8 Nov 1993 22:39:54 GMT Distribution: world Reply-To: mitchell(a)ncsa.uiuc.edu (myself) In article <2bjdvm$6gh(a)vixen.cso.uiuc.edu>, trh42502(a)uxa.cso.uiuc.edu (Dream Weaver) writes: |> I suggest that this be the last post here, as the topic is going well |> out of the groups charter. Please redirect, somewhere else. |> |> This officer was in the same way. He freely admited that he was monitoring |> cellular freqs. My reading of the posting as that he had no idea that this was |> illegal. BAD training, and/or lack of understanding of technology based laws! |> It needs to be emphasized to police that just because something is |> transmitted in the air does not mean they can listen to it! Ordinary |> telephone lines transmit, microwave repeaters for long distance & etc. |> Does anyone know if Tempest or any other non-visual surveillance is |> legal without a warrant? |> There is a file available from NIST discussing TEMPEST tech, and its legal status. It is quite an interesting read. Anonymous ftp to csrc.ncsl.nist.gov file /pub/secpubs/tempest.txt It summarizes the legal status of TEMPEST as follows: The use of TEMPEST is not illegal under the laws of the United States3, or England. Canada has specific laws criminalizing TEMPEST eavesdropping but the laws do more to hinder surveillance countermeasures than to prevent TEMPEST surveillance. In the United States it is illegal for an individual to take effective counter-measures against TEMPEST surveillance. This leads to the conundrum that it is legal for individuals and the government to invade the privacy of others but illegal for individuals to take steps to protect their privacy. <quote.off> The reason for the preventive equipment being illegal is that it is classified. (Shocker!) The eavesdropping is legal due to the fact that the radiation emitted in not considered to be a 'communication', and hence is not covered by ECPA, etc. I am leaving this followup in talk.politics.crypto due to the fact the as crypto gets better, the best way to 'crack' it will be through techniques such as TEMPEST. Even a one-time pad doesn't help if your opponent can read monitor from a half-mile away! Anyway, I highly recommend that everyone interested in this thread get a copy of the file. Curious that it should show up on an NIST server. Looks more like something EFF would be distributing. -David Mitchell |> Tom |> |> ______________________________________________________________________________ |> Tom Hilquist Internet:t-hilquist@uiuc.edu |> Disclamer: I didn't write this! Email for PGP Public Key |> PGP 2.3a Key fingerprint = 20 FF CA 46 1D B8 CD 55 F7 9D 71 B0 BD B7 B3 B5

2 1

LAW: Wireless interception
by System Operator 17 Dec '03

17 Dec '03

Fellow Cypherpunks, Here's a couple excerpts from this month's _Search and Seizure Bulletin_, relating to interception of telephone calls. The first reiterates that ECPA covers interception of cellular telephone calls, whether intentional or not, even by the authorities. The second repeats that there is no expectation of privacy with cordless telephones. Interesting reasoning here: "the reasonableness of a cordless telephone user's expectation of privacy depends on the specific technology involved." By that reasoning, does the use of the new 900 MHz digital telephones (i.e. the VTech Tropez, etc.) infer a greater expectation of privacy, even though they are still cordless telephones? Anyway, here they are: ======================================================================= Interception of Call to Seized Cellular Telephone-- Language Barrier (Hawaii) United States v. Kim, 803 F.Supp. 352 (1992) Drug Enforcement Administration (DEA) agents questioned two men who had bought one-way plane tickets with cash. One of the men was Kim, a man agents had caught with more than eight grams of methamphetamine a month earlier. During the first encounter Kim had cooperated with the police and signed a statement containing a "boiler plate" paragraph. The paragraph stated Kim had read and initialed the statement and agreed all corrections had been made and the statement was true and correct. During the second incident, Kim gave officers permission to a search him. Police found a cellular telephone and a large amount of cash. At this point, Kim was transferred to federal custody. Kim again gave a statement and a written summary, containing the same boiler plate paragraph, and was released. The DEA seized the cellular telephone under a statute which allowed forfeiture of equipment used to carry out drug deals. Two days after the telephone had been seized, an agent activated it to learn the number. Within the space of a few hours, two calls came in. The agent learned from the second caller a "deliveryman'' was arriving that day and needed to know which hotel to go to. The agents knew Kim was staying at the Outrigger Phoenix Hotel. Agents went to the hotel room, knocked on the door, identified themselves, and threatened to "bust it down." Kim was ill and sleeping inside. Menchavez was staying with him. She tried to wake Kim when the police knocked, but was barely able to rouse him. She opened the door and, confronted by four agents with guns drawn, stepped back to allow them in. The agents lifted the naked Kim out of bed, slapped him, slammed him against the wall, and shouted at him. A search of the immediate area revealed $85,000 in cash. After the cash was discovered, Kim was given a consent to search form, which he signed. A further search uncovered 348 grams of methamphetamine. Kim was arrested and signed a third state- ment the following day. Kim asked the court to suppress his written statements, evidence seized during his initial encounter with the DEA and from his car, and all evidence seized as a result of the intercepted cellular telephone call. DECISION: The three statements and all evidence obtained as a result of the telephone call interception were suppressed. Drugs seized during first encounter were admissible. The court said cellular telephone calls are protected under the Electronic Communications Privacy Act of 1986, just as standard telephone calls are, and cannot be intercepted with- out a warrant. Accordingly, the DEA agent's interception of the call to Kim -- although unplanned-- was illegal and all evidence seized as a result of the interception remained inadmissible. Even if the interception had been legal, the evidence would have been suppressed because 1) Menchavez did not give the agents permission to enter the hotel room--she stepped back from the door because agents had threaten to push it down and had weapons drawn; and 2) Kim, being sick, naked, and abused, did not voluntarily consent to a search of the hotel room. Because the entry and search were illegal, Kim's statement made the following day was inadmissible against him. Kim's first two written statements were suppressed. Given Kim's first language was Korean and evidence showed he had a limited understanding of the boiler plate paragraph, it could not be proved the statements were accurate. The methamphetamine taken from Kim during the DEA's first encounter with Kim was admissible. Kim consented to the search of his pockets. United States v. Gallo, 659 F.2d 110 (1981). ============================================================= Expectation of Privacy Cordless Telephone Conversations Monitored Without Warrant (Texas) United States v. Smith, 978 F.2d 171 (1992) Varing believed his next door neighbor, Smith, had burglarized his house. Varing used a scanner to monitor Smith's cordless telephone conversations. When Varing overheard Smith discussing drug deals, Varing contacted police. The police asked Varing to tape the conversations, provided cas- sette tapes, and were present during some of the monitoring. No warrant was obtained. As a result of the monitoring, Smith was arrested and charged with narcotics offenses. Smith argued the warrantless monitoring and recording of his telephone conversations vio- lated his Fourth Amendment rights and the Omnibus Crime and Control and Safe Streets Act of 1968 (Wire Statute). He was convicted and appealed. DECISION: Affirmed. Smith failed to produce evidence he reasonably expected his cordless telephone conversations would remain private. A violation of the Fourth Amendment occurs when government activity significantly intrudes on a person's reasonable expectation of privacy. Depending on the particular technology involved, it may or may not be reasonable for a cordless telephone user to expect his or her conversation will remain private. Early cordless telephones transmitted to commercial radio frequencies and conversations could be overheard inadvertently; some new cordless telephones cannot be monitored without very sophisticated equipment. Accordingly, the reasonableness of a cordless telephone user's expectation of privacy depends on the specific technology involved. Smith failed to offer any evidence that his belief his conversations would remain private was reasonable. The Wire Statute explicitly excludes cordless telephones from its scope. ===================================================================== _Search and Seizure Bulletin_ is published monthly by Quinlan Publishing Company, 23 Drydock Avenue, Boston, MA, 02210-2387. ISSN 0037-0193. I am operating under the assumption that relating these excerpts is covered under the fair use doctrine. Also, I have no connection with Quinlan Publishing Company other than as a satisfied customer. Dan -- system(a)decode.UUCP (System Operator) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

3 2

Black Market in Russia
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

The MacNeil-Lehrer Newshour, a PBS television show (for you non-U.S. residents), has a good report tonight on the black market in Russia. Mostly an emphasis on the "shuttle traders" who take chartered flights down to Dubai and stock up on massive amounts of stuff to sell back in Moscow. (An inefficient system, compared to the systems of shippping and mega-malls we have, but encouraging to see.) The traders then pay off customs inspectors, etc. Apparently Russians are doing better than official stats would indicate, similar to the way Italians are much wealthier than tax stats would suggest. I was heartened to see this report. All Cypherpunks, of course, are encouraged to see thriving black markets (or markets of color, to be politically correct about it). --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

pseudospoofing, copyrights, and ECPA
by L. Detweiler 17 Dec '03

17 Dec '03

Some losers are still assaulting me with claims that I failed to respect His Royal Eminence's privacy by revealing his mailbomb to the list, saying I was not polite or courteous. Please, hypocrites, go away. Where does this bizarre philosophy originate? Where do you guys get your `ethics', anyway? At least have the decency to codify them, sign your names to them, and stick them on an FTP site if you are going to spout this bizarre depravity. Next: Mr. Zions, while one of the `protect the mailbombers privacy' advocates, brought up some interesting points. Does the ECPA (the law regulating communications privacy) or the copyright laws apply to material that was written under a *pseudonymous* identity? I would consider this a grey area. A court test would be extremely fascinating. What if work was redistributed if printed under imaginary identities? the whole aspect of both of the laws involves *ownership* and *identity*. If ECPA or copyright laws are interpreted to protect pseudonymous identities, I propose they be amended and revised to afford no protection. (Legitimate variations like pseudonymity and anonymity should be protected in any case.) One man's opinion. Feel free to stone me some more. Have you figured out who my personal friends are yet? Have you found any nifty blackmail on me? I can't wait for the next sordid perversion.

1 0

pseudopools
by L. Detweiler 17 Dec '03

17 Dec '03

One application of pseudospoofing, a particularly insideous and treacherous form, would be to create a `pool' of different accounts. Everyone in the group can negotiate with each other `behind the scenes' when to post from different accounts. This would be even more difficult to detect than regular pseudospoofing (and, IMHO, even that much more of a perversion) because all traces of consistency of identity are subverted and lost.

1 0

Re: Key Servers
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

L. Detweiler writes: > I wonder if anyone would want to start a PGP key server > dedicated only to *real* identities. Obviously, there > is no such demand with the current ones. > > And please don't start with the `that would be > impossible' arguments. A key server that had the > official policy `if you register here, on your honor your > legal name is what you give, under penalty of public > exposure if you are caught' would be enough for me. > It's not PGP, but RSA, Inc. and others (Internet Policy Registration Authority) are already setting up a system for registering pubilc-keys that are "proven" to belong to actual humans. You can read about it in RSA's newletter available at their ftp site (rsa.com) The newsletter is called "Ciphertext - The RSA newsletter". Of course, their system for "proving" the identity of a human is not perfect. If you can obtain some fake IDs, you can defeat their public-key registration system. This is probably true for any non-biometric identification system. Jim_Miller(a)suite.com

1 0

cypherpunk archives?
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

I'm looking for an official cypherpunk document on `pseudospoofing' -- I looked all over soda.berkeley.edu:/pub/cypherpunks, but couldn't find one anywhere. Does anyone have one, preferrably written or endorsed by E.Hughes or T.C.May? Also, any messages they have posted on the subject sought. I have some stuff, but they seem extremely reluctant to talk about it publicly. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

True Name Keyservers
by Mike Ingle 17 Dec '03

17 Dec '03

>"ld231782(a)longs.lance.colostate.edu" "L. Detweiler" wrote: >Subject: Key Servers >I wonder if anyone would want to start a PGP key server dedicated only >to *real* identities. Obviously, there is no such demand with the current >ones. >And please don't start with the `that would be impossible' arguments. A >key server that had the official policy `if you register here, on your >honor your legal name is what you give, under penalty of public >exposure if you are caught' would be enough for me. That might be somewhat effective if there was a way to expose the person's True Name if they were caught using a nym. If the only thing to be exposed was the falsity of the nym, the person could just create a new nym, with no penalty for lying except a bit of inconvenience. Another approach would be to have some people who certify keys as being True Name keys, using special signer keys which are labeled "True Name certifier key" or something similar. These certifiers would be risking their own credibility if they were tricked, so they would have a motive to be careful. If this was a for-profit undertaking (i.e. "send me ten bucks and a copy of your birth certificate, driver's license, and a third form of ID") then it could be fairly effective. Any of you capitalists out there...? Somewhere I read about "is-a-person" certificates, which, if I remember correctly, allow you to prove your identity is unique without giving out your True Name. How do these work? Is this a blind signature of your key? Whatever is done involving True Names, nyms should have a right to exist as well. --- MikeIngle(a)delphi.com

2 1

EDM--Encyclopedic Dictionary of Mathematics
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I've gotten a few requests already for info on the book I mentioned. I usually avoid giving ISBN numbers for folks to order a book sight unseen--if they're going to spend $50-70 for a book, they at least ought to flip through it in person and see if they really want it. (Sidenote: Must be the electronic age...often when I mention a paper on something, I get notes asking me where it's available online! I admire these Net-dwellers (no relation to Detweiler!), but the fact is that most of the good stuff is only in print. The reasons are many.) Anyway, here's the EDM info: > > > ObCrytp Note: Just got the English translation in paperback of the > > > Japanese-published "Encyclopedic Dictionary of Mathematics," a large > > > 2-volume set with detailed articles on many branches of math. If the > > > math talked about in crypto is sometimes obscure to you, check this > > > out. The cost is $59, a real bargain these days. > MIT Press, ISBN 0-262-59020-4 (paperback), "Encyclopedic Dictionary of > Mathematics," Second Edition, edited by Kiyosi Ito, 1993. For $59, a real bargain. But if you don't have a fairly good crypto library (Schneier, especially, and perhaps Denning, Salomaa, Brassard, Simmons, etc.), then you'd probably do better to get some of them first. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0