December 2003 - cypherpunks-legacy

CuD forward
by fergp＠sytex.com 17 Dec '03

17 Dec '03

excerpted from: >Date: Sun, 3 Oct 1993 16:49:01 CDT >From: Cu-Digest <uunet!CMUVM.CSV.CMICH.EDU!tk0jut2%mvs.cso.niu.edu> >Subject: Cu Digest, #5.77 - --- Date: Fri, 1 Oct 93 06:55:38 -0700 From: grady(a)NETCOM.COM(Grady Ward) Subject: File 1--Grady Ward DOES NOT Encourage Illegality Jerry Leichter's <leichter(a)LRW.COM> comments about me in CuD, Volume 5, Issue 76 are flatly wrong. I do not and never have encouraged people to copy or use PGP illegally whatever their jurisdiction. In this country they ought not to "make, use, or sell" RSA without a license from PK Partners of Sunnyvale, CA. Similarly, the IDEA cipher ought not to be used commercially without a specific commercial license from Ascom-Tech AG of Switzerland. If they are non North American nationals then they need to obtain a copy of PGP from one of several foreign sites such as: black.ox.ac.uk (129.67.1.165) ghost.dsi.unimi.it (149.132.2.1) nic.funet.fi (128.214.6.100) Depending, of course, on their local laws. I have been assured by two attorneys that source is NOT an infringing "device" and can be copied or studied as long as its distribution is not simply a ploy to evade patent law. The whole constitutional idea of a patent centers on the wide dissemination of the underlying ideas that can be reduced to practice by a "person of ordinary skill" in the field. Disseminating the ideas underlying a patent is explicitly a patriotic act in the United States. In any event individuals become moral creatures by actively making their own personal choices and not having the ideas that could lead to an informed choice restricted by the State. I support the widespread use of strong crypto in the world for two reasons: It assists physically separate individuals to freely exchange ideas in greater safety from State interference. And it preferentially helps less powerful people since the more powerful dominating group can simply use the raw force of its state apparatus to advance its program. It is an equalizer in the quest for coalition and social justice. Strong crypto creates communities, not conspiracies. ------------------------------ Date: Thu, 30 Sep 93 17:49:12 -0600 From: "L. Detweiler" <ld231782(a)LONGS.LANCE.COLOSTATE.EDU> Subject: File 2--Response to Jerry Leichter in re Moby Crypto Editor: I strongly object to comments by Jerry Leichter <leichter(a)LRW.COM> on the PGP subpoenas in CuD, Volume 5 : Issue 76. Mr. Leichter appears to be making contradictory points: even though the ITAR may be casting FUD and chilling people's actions based on `poorly drafted regulations whose coverage no one can determine, by threats and insinuations from government spokesmen that some action is illegal', he on the other hand admonishes G. Ward for his actions to date in challenging the law. "Ward is deliberately flaunting it. Stupid, dangerous idea. Being a revolutionary, putting yourself in direct opposition to the power of the state, isn't fun and games. People get hurt that way." Mr. Leichter does not appear to realize that the most egregious laws created tend only to be overturned by the most dramatic challenges. Our own American Revolution is a dramatic instance of this fact. I have praised G. Ward in email previously as a compelling cyberspatial hero for his actions in publicizing over Usenet the NSA and State Department molestations he has been subject to over the past weeks. Very dramatic constitutional issues are at stake. Another major reality lapse in Mr. Leichter's somewhat desultory argument (that appears to have the fundamental message of minimizing the significance of the Zimmermann-Ward affair) is the following. Citizens in a society do not live by the laws -- they live by the *effect* of those laws on their everyday life. Some laws are widely ignored, such as speed limits. Some are revered with the utmost respect, such as the rulings of the Supreme Court and the directives of the President. Even if no case had ever been brought to court on the ITAR, the fundamental issue is that the law has an extraordinary dampening force on certain aspects of current cyberspatial development and enterprise -- in particular, cryptographic technology intrinsic to a wide variety of transforming technologies such as digital cash and signatures -- all critical to future progress. An analogy might be this: even though our judicial system has evolved an elaborate protocol for granting search warrants, that system is meaningless if people voluntarily allow police to search their homes. We do *not* live in a world described by government laws, we live in one that interacts with them in sometimes unpredictable ways. Now, let me abandon these vague platitudes immediately for some cutting specifics relevant to this case. What is the effect on the ITAR on *domestic* cryptographic development? The ITAR supposedly only deals with import and export and in fact that is all the authority granted by its enabling law, the Arms Export Control Act, to cover. But the use of the ITAR in practice by government bureaucrats is apparently to stifle free speech and free press rights of domestic U.S. citizens. This situation is transparently clear from Grady Ward's wretched predicament and other noxious affairs that have escaped the focused attention of many. In particular, I would like to draw attention to an outstanding effort by D. Bernstein to demonstrate the sheer oppressive force of the ITAR as interpreted by the relevant U.S. agencies. In the anonymous FTP file ripem.msu.edu:/pub/crypt/docs/shuffle-export-hassles. is an extraordinary compilation of letters sent between D. Bernstein and the Bureau of Politico-Military affairs regarding the ITAR rules. Mr. Bernstein sought permission to *post* a simple message to the Usenet group sci.crypt describing a cryptographic technique. The sheer obstruction he encountered is absolutely appalling. It approaches the grotesque torture of a totalitarian society in suppressing information. He required the intervention of his California state representative merely to get simple mail responses from the asphyxiating bureaucracy! Moreover, the exchange demonstrates very clearly that the government *applies* the ITAR not as a law regarding import and export of material (as the *law* constrains it) but *in practice* as an instrument to stifle otherwise lawful 1st Amendment scientific publication. From a letter of 14 July 1993 to A. A. Henderson: >Please note that the State Department is engaging in >unconstitutional censorship of material which I privately >developed and which I wish to publish. What you are >witnessing is a battle over the First Amendment. I believe >that the [Office of Defense Trade Controls, Bureau of >Politico-Military Affairs] is acting in violation of the >Bill of Rights. [They] failed to answer this question: >"Does ITAR exert prior restraint on otherwise lawful >publication"? In these paragraphs I seek to emphasize that the debate goes far deeper than the mere obnoxious classification of widespread, public-domain cryptgraphic algorithms and techniques as `munitions'. The debate surrounding the ITAR cuts to the core of many democratic issues. The ITAR is updated with alarming frequency and changed with disturbing ease. Its revision seems to occur in complete defiance of a regular and open legislative process. Even top *experts* on the law cannot keep up with all the modifications. As a frightening example of this, take the case of U.S. vs. Martinez, where Elizabeth Martinez and her fiance were convicted of violating the Arms Export Control Act by exporting `cryptographic hardware' -- a satellite TV video descrambling device, `Videocipher II'. Apparently, by some magic bureaucratic whim, it is now *legal* to export such equipment under the ITAR! I doubt Mrs. Martinez is consoled by this news, after being consumed and rebuffed even on appeal. I consider the ITAR one of the most totalitarian documents our government has ever produced. G. Ward and P. Zimmerman are modern cyberspatial heroes for their bold, direct challenges of it. In classifying `disclosure of information to foreign nationals' as *export* we find the same institutional paranoia and cyberspatial ignorance seen in the Cold-War era Soviet Union in e.g. restricting Xerox machines. The irony is that in both cases, the paranoia is entirely justified, even necessary, within the context of preserving the illegitimate status quo. This oppression forms the basic foundation of support for the two most totalitarian systems of the 20th century -- one defunct, the other with the initials N.S.A. ------------------------------ Paul Ferguson | privacy \'pri-va-see\ n, pl, -cies; Mindbank Consulting Group | 1: the quality or state of being apart Fairfax, Virginia USA | from others 2: secrecy fergp(a)sytex.com | ferguson(a)icp.net | Privacy -- Use it or lose it.

1 0

Re: NPR?
by DON_HENSON＠delphi.com 17 Dec '03

17 Dec '03

cvoid wirtes: --> Has anyone considered forwarding and/or send NPR an information packet to help bring the encryption/clipper issues to the general public, or is that looked upon as a bad idea? <-- I'm in favor of getting the word out on the Clipper/Skipjack problem but I don't think sending a note to NPR is going to do it. They have a long history of extremely biased (toward the government view) reporting. Don Henson PGP key on server or on request

1 0

Revisionist Reinterpretation
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Jim choate, quoting another: >> We might also add Shay's Rebellion, Bacon's >Rebellion, the Hudson >> River Renters' Uprising, the Pullman Strike, the >Homestead Strike, the >> Ludlow Massacre, the Lawrence Textile Strikes, etc., >etc. Many of >> these were full-scale insurrections. This country's >"progress" is >> really just a series of grudging concessions made by >authoritarian >> power structures to various nearly catastrophic >crises. I have a hard time comparing any of these histricaly important but comparatively minor events to the half a million dead of the Civil War or the 50,000+ dead of Vietnam. Perhaps you have extended the analogy a little too far?... .......................................................... I think he was talking about the Principle of the deal, Jim - about what this means regarding the relationship of the citizenry to the big G. Put all of those insurrections together and what do they spell? F _ _ _ _ _ F Blanc

2 2

Re: PGP in Fidonet
by doug＠netcom.com 17 Dec '03

17 Dec '03

> I know of no case in which a >sysop has been "arrested" merely because of allowing so-called "illegal >traffic" that he or she didn't know about. Some time back (maybe quite a long time ago, I forget) I heard rumors that a BBS that someone had uploaded child porn or some such to, without the sysop's knowledge, resulted in the sysop's arrest. Was that merely a rumor? Or is that a different category than the mail traffic you're commenting on? Doug

2 1

Re: NPR?
by doug＠netcom.com 17 Dec '03

17 Dec '03

DON_HENSON(a)delphi.com said: >I'm in favor of getting the word out on the Clipper/Skipjack problem but >I don't think sending a note to NPR is going to do it. They have a long >history of extremely biased (toward the government view) reporting. So phrase it in a slick way that gets past their bias. For instance, lie and say that "other government agencies are concerned that..." Anyone biased towards the govt will be willing to believe that some part of it is a benevolent avuncular sort. It's part of that mind set. Doug

1 0

Re: Single Value Pseudonyms
by Karl Lui Barrus 17 Dec '03

17 Dec '03

> Karl Barrus posted this, and I've been meaning to respond to it. > Basically Karl's scheme doesn't work. With any cut-and-choose > protocol, there must be some assurance that the two things offered What? It doesn't work? Care to elaborate? I mean, a person can satisfy to any degree desired that the last unblinded document is of a particular value. I agree that it becomes real expensive to do so, and for digital banking purposes, there are several alternatives: 1) all cash is of same denomination, 2) different exponents for different denominations, 3) different keys for different denominations. I think I mentioned the application towards digital cash is a bit forced because of the above. The real point is in avoiding signing a blinded document that is later unblinded to reveal something undesirable, in which case the signature and the document signed have value. The application of cut-and-choose I described applies best when for some reason (poor choices of the bank?) the document itself contains value, like the denomination it represents. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

ECPA and Remailers?
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Not being a lawyer (despite my recent spate of "legal" posts, which were based on several hours browsing through the library), I wonder whether any provisions of the ECPA would apply to anonymous remailers. Several operators keep logs of messages and read them, occasionally rebuking or perhaps even blocking users who send inappropriate messages. (As far as I know, no cypherpunks have done blocking, but other remailer operators have. Several cypherpunks have said they read messages.) My feeling is that it is better for me as a remailer operator to have as little to do with the content of the messages as possible. I just don't want to know. If someone complains I will have, to the best of my ability, NO POSSIBILITY of breaking the anonymity of the message they were upset about. Paradoxically, this very blindness to the content of messages will, I hope, protect me if and when abusive or illegal messages are sent. Frankly, I find it paradoxical for remailer operators to try to keep secret information which will allow them to break the very service they are providing, anonymity. I think it represents confusion about just what they are trying to accomplish. And I think it could even get them into trouble if illegal messages go through their systems. Like the Fido sysops, in trying to protect themselves they may be exposing themselves to even more liability. Hal Finney hfinney(a)shell.portal.com

3 2

BBS seizures
by L. Detweiler 17 Dec '03

17 Dec '03

some annoying anonymous FIDONet apologist writes: >In any case, I am informed hobby sysops have been arrested and their >systems seized for allegedly illegal traffic on their systems of which >they claim to have had no knowledge. I believe this is the case in the >CT case pending. First of all, the Connecticut case you seem to be referring to is that of Michael Elansky (Hartford). See Computer Underground Digest for full details. This was *not* email. He had file downloads and kept around (uh) "fireworks recipes". We've got to track down these supposed cases where boards were seized for content. I consider them minor *anomalies*, and I think a rational analysis of statistics will bear that out. Turning a board into a systematic exercise in privacy violation is *not* the proper response to paranoia about law enforcement seizures. This punishes users for the misdeeds of overzealous officers. Sort of like ``because Steve Jackson was raided we have to monitor all traffic'' or ``because there are 50K missing children a year, you can't go outside to play''. Read the *scalding* decision handed down by the judge in the S.J. case on T. Foley and decide what the law *really* says about BBS seizures and operator responsibility. Don't these Fidonet operators *understand* that by perpetuating the myth that they are responsible for all traffic on their machines, that they are actually *playing into* the hands of authorities? they are *strengthening* the paranoid atmosphere. And in fact I am quite repulsed by their policies, posted here, that seem to cutely rationalize systematic invasion of privacy. IMHO FIDOnet operators are perpetuating that sort of media-hysteria-frenzy associated with illegal activities on boards by their warped policies. The outcome of Steve Jackson case should foster glasnost, ease, and freedom among the operators, but instead it appears to have had the opposite effect on FidoNet operators, who have done a fine job of erecting a vast, oppressive network of systematic surveillance more appropriate to the NSA. >Even if these cases are eventually dismissed, the >legal expense and personal disruption to a private party (usually a >young person of very limited means) is catastrophic and without >practical recourse. But this is absurd. There may be legal expenses associated with any illegal seizure. One may be subject to seizure and involved in a judicial process no matter *what* the policies. Would you rather approach that process saying that `I have no knowledge of illegal activity, I don't monitor any email traffic' or `uh, as far as I've seen nothing illegal is going on, and I know *everything* that's going on' or worse, `gee, somehow that one slipped by'? At the *very minimum* there should be no restrictions on cryptography use. And if they want to join cyberspatial society, they are going to have to drop their silly paranoias and bizarre policies and routine privacy invasion. Fidonet operators wallowing in delusion and hysteria appear to have missed an article by Joe Abernathy in the Houston Chronicle ~Feb 1, 1993: > AUSTIN -- An electronic civil rights case against the Secret > Service closed Thursday with a clear statement by federal > District Judge Sam Sparks that the Service failed to conduct a > proper investigation in a notorious computer crime crackdown, > and went too far in retaining custody of seized equipment. > > Secret Service Special Agent Timothy Foley of Chicago, who was in > charge of three Austin computer search-and-seizures on March 1, > 1990, that led to the lawsuit, stoically endured Spark's rebuke > over the Service's poor investigation and abusive computer > seizure policies. While the Service has seized dozens of > computers since the crackdown began in 1990, this is the first > case to challenge the practice. > > Sparks grew visibly angry when it was established that the Austin > science fiction magazine and game book publisher was never > suspected of a crime, and that agents did not do even marginal > research to establish a criminal connection between the firm and > the suspected illegal activities of an employee, or to determine > that the company was a publisher. Indeed, agents testified that > they were not even trained in the Privacy Protection Act at the > special Secret Service school on computer crime. > > "How long would it have taken you, Mr. Foley, to find out what > Steve Jackson Games did, what it was?" asked Sparks. "An hour? > > "Was there any reason why, on March 2, you could not return to > Steve Jackson Games a copy, in floppy disk form, of everything > taken? > > "Did you read the article in Business Week magazine where it had > a picture of Steve Jackson -- a law-abiding, tax-paying citizen > -- saying he was a computer crime suspect? > > "Did it ever occur to you, Mr. Foley, that seizing this material > could harm Steve Jackson economically?" > > Foley replied, "No, sir," but the judge offered his own answer. > > "You actually did, you just had no idea anybody would actually go > out and hire a lawyer and sue you." > > More than $200,000 has been spent by the Electronic Frontier > Foundation in bringing the case to trial. The EFF was founded by > Mitchell Kapor amid a civil liberties movement sparked in large > part by the Secret Service computer crime crackdown.

3 3

EFF GIF file recall notice: is EFF the new CERT?
by L. Detweiler 17 Dec '03

17 Dec '03

Enclosed, a `GIF file recall' warning from EFF & S. Steele. Ug. Blech. What the heck is EFF doing something like this? This strikes me as promoting hysteria and paranoia over image content and BBS operator liability. I hope Mr. T.C. May will have something eloquent to say about how silly, useless, and damaging this is. Didn't anyone talk to M. Godwin about this?! Is EFF the new CERT? Are we going to have new periodic EFF Pornographic GIF warnings? S. Steele, I think we deserve better. This gets a definite Cypherpunk Razzberry award. (And that will probably be the *least* of the criticism.) Whose idea was this? This reminds me. There is a whole new class of urban legends that are starting. Technology does not mean the eradication of urban legends, it only seems to mean they are propagated faster. Did anyone hear the rumor (now totally debunked) that California police were warning motorists not to blink their lights, because it was a signal to gangs to shoot in an `initation ceremony'? This flashed across the nation in a few days due to well-meaning, but totally indiscriminating, public who transmitted it via email and fax machines. Didn't anyone stop to just say `uh, waitaminit!' They think *we* (cypherpunks) are paranoid, and easily subscribe to conspiracy theories. Hah! The public at large is frighteningly gullible, even *without* the media. In fact, as bad as the media is, it actually has a dampening force to this kind of sheer hysteria. `extraordinary public delusions and the madnesses of crowds'. The trick is to try to get networks to allow urban myths to meet the dampening force faster. Imagine if early in the spread someone authoritative comes on and says `there is no substance to this, and we should know'. ------- Forwarded Message Date: Sun, 3 Oct 1993 12:02:02 -0400 From: farber(a)central.cis.upenn.edu (David Farber) Subject: Warning re some gif files (from EFF News) ************************************************************ ***VERY IMPORTANT*** Critical Files to Remove from Your BBS ************************************************************ EFF has learned that the following graphic image files have been the subject of a recent federal indictment alleging receipt and possession of child pornography and transportation of obscene materials through interstate commerce. ***EFF STRONGLY ADVISES ALL SYSOPS TO REMOVE THESE FILES FROM THEIR ELECTRONIC BULLETIN BOARD SYSTEMS IMMEDIATELY IN ORDER TO AVOID LEGAL REPERCUSSIONS.*** Please distribute this message widely and quickly. Alleged child pornography files: PPO4@.GIF FAMO3.GIF CHERRYA.GIF CHERRYB.GIF CHERRYC.GIF WC221501.GIF LITSIS.GIF MBON006.JPG MBON007.JPG DS-X-219.GIF INOCNT.JPG KID013.GIF Alleged adult obscenity files: ORGY6.ZIP (A DL FILE) WC1C2332.GIF BAMS-039.JPG ________________________________________ Shari Steele Director of Legal Services Electronic Frontier Foundation 1001 G Street, NW Suite 950 East Washington, DC 20001 202/347-5400 (voice), 202/393-5509 (fax) ssteele(a)eff.org ------- End of Forwarded Message

2 1

FBI on BBS operator liability (fwd)
by L. Detweiler 17 Dec '03

17 Dec '03

also from Computer underground Digest Sun Oct 3 1993 Volume 5 : Issue 77 ISSN 1004-042X ===cut=here=== Date: Thu, 30 Sep 1993 11:38:00 -0400 (EDT) From: "Daniel P. Lieber - (617) 642-7697." <LIEBER_DANI(a)BENTLEY.EDU> Subject: File 4--Summary of BBLISA meeting (CuD 5.75) Account of BBLISA Meeting (posted in CuD #5.75) On Wed., Sept. 29, the BBLISA (Back Bay [Boston] Large Installation Systems Administration Group) group had their monthly meeting where they hosted both an FBI agent and a federal prosecutor from the U.S. Attorney General's office. Both speakers were knowledgeable about the subject and tried to answer all of the questions that they could. (I am omitting names as I am not sure of the correct spelling or titles -- both were substitutes for the original speakers.) After a brief welcoming by the leader of the group, the prosecutor spoke extensively on the different types of intruders into systems. Her particular area of expertise in the field of "computer crime" is with kiddie porn. However, she was knowledgeable on the major topic at hand -- intrusions. The most common and least threatening type of break-in artists are the solo hackers and crackers (usually young males) who break into systems for the thrill and to brag about their accomplishment. Usually, they cause little or no damage and no crime is prosecutable (just utilizing resources is not prosecutable). By far, the most serious threat is internal. Disgruntled workers and recently dismissed employees cause the most damage and are usually motivated by revenge and want to inflict injury. The third type of intrusion, for-profit, is growing rapidly. This includes bank and ATM fraud, among other types of information theft. The FBI agent relayed stories about cases he has worked on and the scope of the FBI office in Boston. To be investigatable by the FBI, a monetary or equivalent loss must be $100,000 or the loss must be shared amongst many different parties. He also informed us that there are no agents that just cruise around BBSs looking for crime. The FBI is too busy to do that. From the information discussed at the meeting, there were some conclusions and suggestions that were brought out: * System banners informing all users that unauthorized access is prohibited and that privacy is limited are helpful. * E-mail is usually considered private unless specifically stated otherwise. * System administrators are not obligated to report illegal activities that they detect on their systems. * Law enforcement does not like to confiscate systems and will usually get the information out of the machine without taking it. * To be prosecuted for a crime utilizing a computer, the defendant must have prior knowledge of the criminal materials or intent. For more information on BBLISA, send a message to majordomo(a)cs.umb.edu with the subject line: subscribe bblisa. Next month's meeting will discuss large-site Internet services. --Daniel Lieber, Systems Manager- _The Vanguard_ at Bentley College

1 0