December 2003 - cypherpunks-legacy

Mark Abene (Phiber Optik) sentenced
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9311080705.AA15339(a)toad.com> newsham(a)wiliki.eng.hawaii.edu writes: > I have heard that tapping high speed modems can be a little tricky > because of the adaptive filtering done. The modems both have > adaptive filters that adjust to the line as they see it. If you > are tapping at some other point the filtering will not be optimimal > for your case. I believe these filters take care of smearing and > echos and things of that nature. > > Maybe someone in the know can elaborate and clear up all the > bad data I probably just spewed :) Dunno if this is how they did it, but you get *perfect* data tapping if you record digitally off the exchange trunks... G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

TEMPEST, Van Eyck Radiation, and Eavesdropping
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

TEMPESTpunks, The theme of TEMPEST/RF/eavesdroping/Faraday cages/Van Eyck Radiation/etc. comes up on this list every month or so, nearly as often as the threads about generating random numbers in hardware. (If you don't know about eavesdropping on computer sessions by monitoring and decoding RF emissions by the computers, keep reading this list and the topic will pop up, as it just has!) Anyway, I found this item interesting. I'm not yet sure we need to become "Faraday-Cage-punks quite yet, but the articles and laws mentioned in this report might be useful for someone. From: mitchell(a)ncsa.uiuc.edu (myself) Newsgroups: talk.politics.crypto Subject: Re: illegal taps Date: 8 Nov 1993 22:39:54 GMT Distribution: world Reply-To: mitchell(a)ncsa.uiuc.edu (myself) In article <2bjdvm$6gh(a)vixen.cso.uiuc.edu>, trh42502(a)uxa.cso.uiuc.edu (Dream Weaver) writes: |> I suggest that this be the last post here, as the topic is going well |> out of the groups charter. Please redirect, somewhere else. |> |> This officer was in the same way. He freely admited that he was monitoring |> cellular freqs. My reading of the posting as that he had no idea that this was |> illegal. BAD training, and/or lack of understanding of technology based laws! |> It needs to be emphasized to police that just because something is |> transmitted in the air does not mean they can listen to it! Ordinary |> telephone lines transmit, microwave repeaters for long distance & etc. |> Does anyone know if Tempest or any other non-visual surveillance is |> legal without a warrant? |> There is a file available from NIST discussing TEMPEST tech, and its legal status. It is quite an interesting read. Anonymous ftp to csrc.ncsl.nist.gov file /pub/secpubs/tempest.txt It summarizes the legal status of TEMPEST as follows: The use of TEMPEST is not illegal under the laws of the United States3, or England. Canada has specific laws criminalizing TEMPEST eavesdropping but the laws do more to hinder surveillance countermeasures than to prevent TEMPEST surveillance. In the United States it is illegal for an individual to take effective counter-measures against TEMPEST surveillance. This leads to the conundrum that it is legal for individuals and the government to invade the privacy of others but illegal for individuals to take steps to protect their privacy. <quote.off> The reason for the preventive equipment being illegal is that it is classified. (Shocker!) The eavesdropping is legal due to the fact that the radiation emitted in not considered to be a 'communication', and hence is not covered by ECPA, etc. I am leaving this followup in talk.politics.crypto due to the fact the as crypto gets better, the best way to 'crack' it will be through techniques such as TEMPEST. Even a one-time pad doesn't help if your opponent can read monitor from a half-mile away! Anyway, I highly recommend that everyone interested in this thread get a copy of the file. Curious that it should show up on an NIST server. Looks more like something EFF would be distributing. -David Mitchell |> Tom |> |> ______________________________________________________________________________ |> Tom Hilquist Internet:t-hilquist@uiuc.edu |> Disclamer: I didn't write this! Email for PGP Public Key |> PGP 2.3a Key fingerprint = 20 FF CA 46 1D B8 CD 55 F7 9D 71 B0 BD B7 B3 B5

2 1

Bits-n-Bytes Online
by Stanton McCandlish 17 Dec '03

17 Dec '03

Anyone have the address of Bits-n-Bytes Online newsletter? I think Jay Machado is putting that out, but I don't recall... -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp "A nation that is afraid to let its people judge the truth and falsehood of ideas in an open market is a nation that is afraid of its people." -JFK NitV-DC BBS 202-232-2715 Fido 1:109/1103 IndraNet 369:111/1, 14.4V32b 16.8ZyX Join EFF! For more information about membership, send mail to eff(a)eff.org

1 0

Re: ID of anonymous posters via word analysis?
by doug＠netcom.com 17 Dec '03

17 Dec '03

"Perry E. Metzger" <pmetzger(a)lehman.com> said: >Astonishing how far urban legends go. This keeps getting distorted >further and further. I've heard this go further and further and >further from the version I first heard. I wonder if there ever was a >real story to begin with. Good question. I just checked a terse history of machine translation, and it didn't mention any version of this. I suspect that its origin was as a hypothetical example of the kinds of problems that can arise, and that it didn't actually happen in any real life situation. Examples like that have always been common in linguistics papers on such subjects. Doug

2 1

Re: Taxes
by ljenkins＠mv.us.adobe.com 17 Dec '03

17 Dec '03

> I disagree that income tax is a bad thing. What other way > does the government have of maintaining fairness across I am a relative novice in taxation policies, and among other things, I would like to hear recommendations from people in this list about books and/or articles to read, but the bad thing about income taxes is that it "gives" the government the "right" to snoop into all your affairs because they have to know what your income is. Having grown up in another country and lived in other countries, (that also have income taxes), but don't intrude so much into your private life, I must say that I was shocked the first time that I had to file an income tax declaration in the USA! Of all the countries where I have lived (four or five), this is the only place where *individuals* need to keep ridiculously detailed records of everything! And the only country I know where individuals routinely have to hire an accountant to be able to file a tax return ... Is moving to a consuption-based tax system part of the solution or not? Luis PS: I realize that this is not exactly a cypher issue, so is there a better place to discuss it?

2 1

RE: Private and Public
by Blanc Weber 17 Dec '03

17 Dec '03

But of COURSE the government has a right to know how much money you make - It OWNS you; why else would it protect you and educate you? (Up Ahead - be prepared . . . you have now crossed into the Twilight Zone). Blanc ---------- From: Arthur Chandler Subject: Private and Public Date: Monday, November 08, 1993 9:31AM I'm sure that few folks want to unsheathe the pro- and con- spoofing arguments again. But Patrick's last post got me thinking: Does the government have the right to know how much money I make, and from what sources? The IRS says yes, absolutely. But Eric Hughes, in a talk given at San Francisco State University, said, in response to a question from an audience, that international digital banking will make it very difficult for a national government to track monetary exchanges, and thereby tax them. Furthermore, I deduced from the gleam in his eye that Eric thought that this was a Good Thing (correct me if I misconstrued you, Eric). Right now, there seems to be a kind of social contract between us and the government: it protects us, provides free schools, etc etc, in exchange for which we have to pony up a fair share of our earnings. It follows, doesn't it, that the government has a right to enforce its laws saying that everyone must pay that fair share of taxes? To enforce that rule, it has a right, under certain conditions, to rummage around in our records to see if we have hidden any income source from them. This may or may not be Big Brother. But it does seem to be the modus operandi of every government that ever was. The point: concerns of privacy often come in conflict with the larger obligations of public good. We can't say categorically that one must always predominate. What do you think?

1 0

Re: Modem taps/Caller ID
by ljenkins＠mv.us.adobe.com 17 Dec '03

17 Dec '03

> Does anyone here know more about this? I would dearly love to set up a > program on the PC in my basement that could capture Caller ID data and There is a number of modems that will do this for you automatically. The Supra comes to mind, and I believe the Zyxel also does it. I do have the specs for CID somewhere, but off the top of my head I don't recall how it is transmitted. There was an intersting thread in comp.dcom.telecom about something called the "Presto Chango!" box, that transmits bogus CID information after the call is answered, so you can easily confuse most CID boxes in the market. Luis

1 0

Re: ID of anonymous posters via word analysis?
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

For the past few years I've looked at this issue (author identification through text content analysis) a bit from a psycholinguistic point of view. According to an occasional electronic digest coordinated by a woman from the UK named Blackwell (I apologize that I don't remember her name or have her email address handy), a technique that sums the probabilities of various word occurrences (CUSUM) has come under fire recently and, if I remember correctly, is not accepted in UK courts. A 1983 paper (which I also do not have the cite handy for) by Dr. Murray Miron of Syracuse University gave his equations for analyzing two texts (of roughly similar lengths) and establishing a probability that the two writings were produced by the same individual. In his paper, Dr. Miron related the story of a trial where he was summoned as an expert witness and was not allowed to testify as to whether an extortion note was authored by the defendant based on analysis of the note vis a vis a known letter from the defendant. However, the jury ended up finding the defendant guilty based on identical misspellings of a word in each message. Dr. Miron noted that the jury's decision agreed with the overall findings of the computer analysis; however, the jury returned a guilty verdict based on a single coincident misspelling that could happen (with relatively high probability) in any two random messages. The same idea applies here - for CUSUM or similar analysis to be valid, an analyst needs large volumes of messages where one of the authors is known (an anonymous id counts) and the documents compared are of similar lengths. One note a while back indicated that matching anonymous id's could be done through tracing misspellings and uncommon word usage. Definitely not true without a large base of known messages from both id's and a high score on an evaluation function as described in the literature. Curtis D. Frye cfrye(a)ciis.mitre.org "If you think I speak for MITRE, I'll tell you how much they pay me and make you feel foolish."

2 1

Re: Mostly offline digicash
by Joe Thomas 17 Dec '03

17 Dec '03

Alan (Gesture Man) Wexelblat <wex(a)media.mit.edu> writes" > Nick asks: > > Why haven't people backed away from credit cards despite $10's of billions > > in fraud? > > A very good question. The reason is largely > because it's a very profitable business *for the > card merchants* (banks, mostly). They get their > percentage no matter what, and losses don't eat > into it all that much. > > I agree with much of what Nick says, but I think > we have to consider ways to help make digicash pay > for its own implementation and enforcement, or it > will not take hold. Hmmm. Couldn't digicash issuers simply charge up front for their digicash notes, adding a percentage on top like travellers checks? Let the people who want the convenience and anonymity of digital cash pay for it; let the merchants redeem it for free. Sound okay? Joe

2 1

Re: Private and Public
by Arthur Chandler 17 Dec '03

17 Dec '03

Hmmm... my post may well ignite some flames; but I can't go along with the notion that this list is for purely tech discussion. Encryption is a social and political issue as well as a technical one, isn't it? I would think that it's more dangerous to ignore the social and political ramifications than to have them out publically. It seems to me that encryption poses LOTS of dilemmas for any government. I chose just one -- taxes -- for my post. And looks like there are quite a few viewpoints on that one, with regards to the government's right to examine your income sources. The fact the encryption schemes are classified as military (or military-type) material and so are subject to comparable controls by the State Department should alert us to this fact. So to insist that we stick to Greatest Primes and Modulo seems... unrealistic. Of course, if the discussion seems pointless or irrelevant to you... there's always the delete key. My :9&53xS+ (= digital $.02) worth. On Mon, 8 Nov 1993, Nick Papadakis wrote: > > > What do you think? > > I think you are inviting a political flame war on what is > supposed to be a technical list. Please take it to alt.privacy. > > - nick >

4 3