December 2003 - cypherpunks-legacy

Re: JP vs Homer
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

> We are capable of controlling mail bombs, for instance, in the >following way: > > Take an incoming message, capture From: line. Strip header. MD5 body. >Add to sorted table [From: MD5(message) date]. Check for repetition of >first two fields. If reps = 1, forward message. If reps = 2, send message >to From: "Possible error. Two copies of message <message> received." If >reps = 0 mod 5, send letter to postmaster@From:. "Possible mailbomb or >spam. <reps> copies of <message> received from <From:> at your site in the >past week." Clear table of entries more than a week old every midnight. > > > If all remailers did this, then no matter where the net was entered, >the messages would be rejected. And spammers/bombers would be spamming/ >bombing their own postmaster. Probably a bad idea. If not all did it, >then add special handling to hit remailer-operator@. This would encourage >the operator to auto-magically handle the spam-bomb himself. This works only if one assumes that the exact same message is posted using the exact same path. Granted, it would probably be effective for novice spammers. Consider a premail/chain type script and a cleartext spam message. The script is executed once every five minutes, say. When it runs, it creates a new random path through the remailers, adding encryption wrappers for each hop. Your spam detector would miss this one completely unless your remailer was used as the terminal remailer for a significant number of spams. More significantly, the MD5 hashes of each message would be different even if the same path were used more than once because the PGP session key would be different (again, unless your remailer would be the terminal remailer in the particular path that repeated).

1 0

WSJ on CIA Dump
by John Young 17 Dec '03

17 Dec '03

The Wall Street Journal January 18, 1995, p. A14. Get Smart -- Eliminate the CIA By Angelo Codevilla Over the past several years, U.S. intelligence agencies in general and the CIA in particular have proved themselves incompetent in peacetime and of little use in conflict. Stripped of their mystique and lacking the capacity to reform themselves, these organizations are virtually in receivership. The maladies ailing the intelligence community are numerous. Independent quality control was never more than a pretense, and competition among intelligence agencies was nonexistent. Producers of intelligence -- rather than the soldiers and diplomats who have to use it -- have also become its judges. All this has spawned a complex of habits, procedures, mentalities and people too entrenched to be repaired and too noxious for any part to form the nucleus of a new, healthy system. Hence, we should take Sen. Daniel Patrick Moynihan's advice, and rethink our intelligence from the ground up. A good place to start is with the fact that about half of the $28 billion U.S. intelligence budget pays for units directly controlled by military commanders, which routinely provide precise information for the armed forces' operations close to the front lines. The Treasury and State Departments also have their own intelligence units, which fit their needs quite well. So why do we need a national system headed by the CIA? The original justification for the creation of the CIA in 1947 was that intelligence would be best if its gathering and evaluation were divorced as much as possible from the operating departments of government -- State, Defense, etc. -- and placed under the president. This judgment has turned out to be wrong. Because presidents have relied on the CIA to run the system, the result has been a system dominated by the priorities of the producers -- not the users -- of intelligence. A basic failing is that the CIA has primary responsibility for intelligence and none at all for real world events. The CIA prefers to place its career employees in U.S. embassies, where they pretend to be employees of other parts of the government. Such "case officers" must acknowledge that they are gathering information for the U.S. Another disadvantage is that they don't speak foreign languages well. And unlike successful reporters, they virtually never know the substantive fields about which they are seeking information. Thus it is unsurprising that they are usually outdone in economic reporting by economic reporters, in military reporting by military reporters, and so forth. The Aldrich Ames case shows how much more highly the CIA values the smooth functioning of its system than what the system produces. Mr. Ames handed the KGB the capacity to shape the intelligence flowing to top U.S. officials during the endgame of the Cold War. Thus disinformation made presidents and secretaries of state more vulnerable to Gorbomania than the average citizen informed by newspaper accounts. How could the CIA fail to notice the fishiness of reports generated by a network controlled by the other side? The same way that, in the 1970s and 1980s, the agency had failed to notice that it was passing along reports from a network of agents in Cuba totally controlled by Castro's DGI, and from a network in East Germany all but a few of whose agents were working for the Stasi. In other words, while the Ames case was unusually destructive, it was a typical example of bureaucratic sclerosis. In the Gulf War, intelligence worsened the farther one got away from the front lines. The national system headed by the CIA misperceived the nature of Saddam Hussein's regime, failed to grasp the obvious signs of attack, and has yet to learn Saddam's military and political reasoning. Our imaging satellites failed to find mobile Scud launchers, and our communications intelligence antennas failed to shed light on the diplomatic intercourse between Saddam and the Soviets. National analysts misjudged Iraq's nuclear program, and were fooled by elementary camouflage. Gen. H. Norman Schwarzkopf's public belittling of CIA-run intelligence was matched by unprintable epithets from field commanders. What happened in the Gulf would have happened in any conflict because the intelligence community's cameras and antennas were conceived, and its people trained, on the CIA's assumption that cooperative competition with the Soviet Union would last forever and that the basic designs of weapons would not change. Thus cameras, for example, were optimized to take pictures of fixed installations rather than to keep track of attacking military forces or mobile missile launchers. Long before the Soviet collapse, however, it had become clear that the CIA made bad bets. The age of mobile missiles arrived long ago, and modern weapons are defined by the software they contain rather than by observable features. So what's the point of, for example, analyzing a radar signal that a computer can change in an instant? Divorce from operational responsibility also tends to make the reports that flow to top officials less valuable than the information used to compile them. (In any given subject, the CIA delivers a consensus of the system's several agencies. It takes far more time for a paper to go through the interagency process than for someone to write the paper. Considering the elementary errors and ignorance that often come out, it is clear that the conferees do not spend much time fact-checking. Intelligence analysts become spin doctors, concerned not with facts but with pushing policy makers in the direction of their parent agencies' prejudices. Hence the ultimate irony: A system whose ostensible reason for being was to eliminate from intelligence the parochial interests of tank drivers, diplomats, bomber pilots, etc. ended up aggregating the prejudices of the analysts -- prejudices unrelieved by the sobering prospect of having to carry out the policies they are pushing for. The CIA has maintained a monopoly on judging the quality of the system's operations and products. It does not heed presidents, much less their appointees. A decade ago, the agency ignored President Reagan's executive order to reorganize counterintelligence. Two decades ago, President Ford, shocked by how far intelligence estimates were diverging from reality, asked a group of distinguished outsiders (the B team) to see whether the intelligence community's data on Soviet nuclear forces could support conclusions different from those of the insider analysts. The B Team, despite resistance from the agency, came up with results far superior to the insider A Team's. A better intelligence system should be built on a model radically different from the 1947 original. Each of the major departments of the U.S. government (State, Defense, etc.) should be responsible for gathering and evaluating the information it needs to operate in the new world disorder. Intelligence, in short, should be franchised out to its consumers. There is reason to believe that the departments would do better without the ClA's tutelage than with it. In the past, the armed forces have asked to deploy officers who speak foreign languages, who could blend in with the local population, and who would be experts in the military fields on which they were reporting. U.S. military leaders have also clamored for satellites whose products they could use. Each time, the CIA made sure such requests were denied. If those requests had been granted, the country would be better informed. In all this there is a need for some central coordination. The several agencies have to mesh their quest for agents abroad, lest they stumble over each other. The information that any part of the government collects must be available to properly cleared people in all other parts, so that any and all analysis can be based on all the facts. Fortunately, maintaining a central registry nowadays requires computers, rather than the bureaucratic monster that arose a half century ago. Finally the president of the United States' own intelligence needs should be provided by his own staff. Among its duties should be to make sure that all the agencies get each others' estimates. The availability to the president and other top decision makers of contrasting estimates from through out the government would stimulate better performance all around. So, while there is a role for a central intelligence agency in a system based on consumer sovereignty, there is none for the CIA. Mr. Codevilla, a fellow at the Hoover Institution, is the author of "Informing Statecraft" (Free Press, 1992). End

1 0

BYTE on PGP WoT
by John Young 17 Dec '03

17 Dec '03

William Stallings writes in the BYTE February issue on "The PGP Web of Trust."

1 0

Re: The Remailer Crisis
by jalicqui＠prairienet.org 17 Dec '03

17 Dec '03

>For example, the Linux mavens could tell us if Linux-based remailer >boxes could be hung on dedicated connections to The Little Garden >network, as a specific example. A "black box remailer" such as several >folks have suggested (Chaum (in 1981), me, Eric Hughes, others) might be >buildable for under a grand. We could ask here for contributions, and >might even raise this amount of money. Then each of us who contributed >could have "accounts," maybe several of them. Imagine 100 or more >"remailers" all on this one machine--I'm deliberately ignoring the >security issue for now. Little Garden has stated categorically that >they will not tell users what they can or can't do with their machines >(though I can think of some cases where they might have to, as with >spamming, etc.). Anyway, you can see where I'm headed. The "Linux mavens" followed by the "black box" stuff sparked an idea... First, before delving into dreamland: I'm sure Linux could be hung off just about any store-and-forward (a la UUCP) or TCP/IP-based network there is with a minimum of trouble. Linux junkies are familiar with the concept of "distributions". For the uninitiated, Linux itself is just a kernel; Linus Torvalds doesn't hold anyone's hand when it comes to actually turning that kernel into a working system. As a result, people have done this job themselves: they build their own working systems painstakingly from scratch and then archive it off to disk or CD-ROM, which they sell or give away. Most of the time, when you get Linux, you're actually getting one of these "distributions" of Linux, complete with all the frills that don't come with the kernel (like the shell, basic utils, and so on). Now how 'bout this: Consider a new distribution of Linux, the "Cypherpunk" distribution (if ya don't like the name, make up yer own!). This would be a bare minimum of a distribution, with nothing fancy: bash, misc. utils like ls, etc. This can fit (tightly) in 20 MB. The supplied kernel would have every networking option under the sun turned on, but would be otherwise bare of frills as well. Now let's add minimal network utils (telnet and telnetd for connecting and sendmail for obvious reasons), perl, PGP, and a remailer package. To make it as easy as possible, I'd use the UMSDOS filesystem, so that Linux could be installed on a DOS machine without any reformatting, repartitioning, or similar headaches. We could make this available via FTP or press some CD-ROMs if we were ambitious. Better yet, the cool Linux thing to do now is to install via NFS; this makes installing Linux as easy as sticking in a boot disk and pointing the install program at the NFS server (well, not quite, but pretty close). After adding in the cute little install program (like the Slackware distribution already has) and some boot options, you'd have an "instant remailer" software package, able to transform any 386SX/4MB RAM DOS machine or better into a Linux-based remailer site, complete with aliases, logging policies, etc. already configured for you. I bet even Tim May could install this if it were done right. :-) So, am I dreaming, or does this sound viable to y'all?

4 4

Re: Cone of silence update
by Rich Salz 17 Dec '03

17 Dec '03

---------- Begin Forwarded Message ---------- Date: Wed, 18 Jan 95 21:03:02 -0500 From: burton(a)het.brown.edu (Joshua W. Burton) To: silent-tristero(a)world.std.com Subject: Cone of silence update I haven't been able to turn up the original New York Times article I saw, but our own Providence (RI) Journal today reprinted an article from the Washington Post, no date given, that tells substantially the same story, though without any mention of the cost of Intelink. Since a few people have asked me for details, I thought I'd better post this verbatim. Be sure to save a copy, in case this article disappears the way the first one I saw did.... GOVERNMENT'S SECRETS FLOW THROUGH AN INTERNET CLONE WASHINGTON - When the US intelligence community recently decided to modernize the way it communicates, it did what countless other government agencies, businesses and individuals have done over the last few years: it turned to the Internet. But the regular Internet wouldn't do. For spies and other government officials concerned about secrecy, that very public, very uncontrollable global mesh of computer networks was too risky a place to do business. So the intelligence community created its own Internet. Dubbed Intelink and based on the same technology used to run and navigate the original Internet, this new network for sharing supersecret information---including satellite imagery and video footage---officially began operating just a few weeks ago. When the bugs are worked out and a final system is in place, it will allow analysts, policy-makers, military officials and soldiers in the field to tap quickly and directly into classified information at the Central Intelligence Agency, the National Security Agency, the Pentagon and diverse other parts of the national security bureaucracy. Those familiar with Intelink say it could promote cooperation in a business characterized by internecine rivalry, and that at the very least it will centralize and speed up information retrieval. ``This is a major breakthrough,'' said Barry Horton, principal deputy assistant secretary of defense for command, control, communications and intelligence. ``Intelink for the first time, in a user-friendly environment, allows every element of the intelligence community and every element of the Department of Defense to reach into every other element,'' he said. As one might imagine, it's not for everybody. Horton said the system is now available only to people with ``Top Secret'' or higher security clearances. Moreover, those who run the system eventually will have to confront a major issue of how to make Intelink flexible enough to accommodate users with a variety of clearances. There are many levels of classification higher than Top Secret, and for Intelink to be useful to those working on the most secret programs, the officials responsible would have to be comfortable placing such information on the system. And, while Pentagon and CIA officials spoke of how Intelink promises to improve communication and cooperation among the agencies and reduce duplication of effort, others said there is good reason to be skeptical. The intelligence community has made innumerable attempts to eliminate redundancy and streamline information channels, but there has been little progress. ``It's gone like gangbusters since its inception, but any Internet-like thing grows overnight. The question is, is it going to mature well? And how will it operate in a time of crisis?'' said Ross Stapleton-Gray, who recently left the CIA to start a business providing Internet services to embassies in Washington. In a way it is fitting that what some call an Internet ``clone'' should come out of the national security bureaucracy. Internet itself was started under Department of Defense sponsorship in the 1960s, as an attack-proof communications link among military, corporate and university research centers. ``Remember, Internet is a DoD creation,'' said Neil Munro, a reporter for Washington_Technology, a local business newspaper, who recently broke the story about Intelink's start-up. ``This is the prodigal son....They created it and now it comes back in much stronger fashion.'' All those familiar with the system said it is totally walled off from the Internet, and designed never to be penetrated. But several experts familiar with Intelink noted that no system is ever totally secure. ``This would obviously be a Mount Everest for hackers,'' said John E. Pike of the Federation of American Scientists. But Pike, who said he thinks Intelink has the potential to ``revolutionize'' the intelligence community, added that it would be so difficult to crack he doubts many will try. The network now operates among several dozen intelligence agencies and centers. But it is the talk of the intelligence community, and its reach is expected to grow rapidly. Those who now have regular access to it number in the hundreds, estimated Martin C. Faga, general manager of the Center for Integrated Intelligence Systems at the Mitre Corp., the company that helped the intelligence agencies set up the system. ----------- End Forwarded Message -----------

1 0

"Time" Magazine and "Future Shock" Author
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

[I'm into my daily "blackout" of toad mail to Netcom, so am posting blind, as usual. If this article has already been posted, my condolences.] The January 23rd issue of "Time," this week's issue, features a cover story on talk shows, Limbaugh, Gingrich, and "HyperDemocracy." I haven't seen the physical issue yet, but have skimmed the Web version at: http://www.timeinc.com/time/magazine/magazine.html Point your browser at it and have fun. Lots of folks are flaming the article, in the usual newsgroups (e.g., alt.data-highway). Me, I'm as scared as "Time" is about "direct, electronic democracy," though perhaps for different reasons. On a related note, the article and sidebars touch heavily on the "cybergurus" who are advising Newt Gingrich on his journey into cyberscpace, notably Alvin Toffler ("Future Shock," "The Third Wave," "Powershift," etc.) and George Gilder ("Beyond Wealth and Poverty," "Macrocosm," lots of essays on the Net). As it happens, I spent some time talking to Alvin and Heidi Toffler at an interview last Friday in L.A.--they were being interviewed before and after me. Not enough time to really get into issues, and of course they did most of the talking (Heidi is especially opinionated, and had just been in a highly publicized battle with newage guru Arianne Huffington, spacey wife of losing candiate in California, Michael H.). Anyway, we talked about John Brunner (as you all know, Brunner's seminal "The Shockwave Rider," was inspired by "Future Shock") and his ideas. (And we all agreed that "Stand on Zanzibar" was his crowning achievement...even Shalmaneser admitted "Christ, what an imagination he's got.") Tidbits: * on digital cash: Heidi: "Oh, we're for it! Did you hear what I just told the interviewer?" (I didn't, as I was in the adjacent room. Later comments lead me to believe that neither of the Tofflers has a clear idea of what's going to happen with digital cash and crypto anarchy.) * on the NSA and the t-shirt I showed them ("Cypherpunks: putting the NSA out of business"): "Oh, no, we need a strong NSA now more than ever!" (What else would I expect? They view the NSA as the main bastion against terrorists plotting to blow up the World Trade Center. Alvin was generally more reserved and thoughtful. When I pointed out that the very hotel room we were in could be used to plot crimes, even nuclear terrorism, and that the solution to stop this would have to be an Orwellian regime of continuous monitoring, Alvin nodded thoughtfully, but Heidi just sniffed. I mention this to give a flavor, just a whiff, of what senior advisors to the most influential man in America are thinking.) * I gave Alvin a copy of my "Crypto Anarchy and Virtual Communities" paper. * My interview was pretty disappointing, by the way. Lots of sitting around, delays in getting my laptop hooked up to Netcom (outside calls had to be unblocked). The interviewer wanted memorable, quotable stuff from me, but I felt constricted sitting around and being expected to spout on cue. Maybe they'll get a few minutes of usable stuff.... (Print media is so much better. An interviewer can let the tape recorder run for hours, can edit the containing material of a quote, and can thus produce clear, coherent quotes. A video interview is more constrained in lots of ways, and offending gestures or rambling interjections cannot be easily edited out. As one example, at one point I naturally (to me at least) said something about "As we just saw...." Well, this made this quote unusable. And so it goes.) I was generally unhappy with the whole thing. Four hours to get there, two hours spend waiting around, an hour to resolve problems, an hour under the camera lights (being told not to move, to "use the mouse," to "tell us why cryptography is important," etc.), and five hours to get home. All for a few minutes at most on a t.v. show. Oh, the show is the BBC's "Horizons" science series, which may also get sold to U.S. outlets, etc. I think the title will be "The Information Bomb," and features segments on information warfare, a la Winn Schwartau's views, the Tofflers, some military planners, and--maybe--me. I don't have high hopes for my segment. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

"Disclosing" private email
by Arthur Chandler 17 Dec '03

17 Dec '03

Greetings! I'd like to solicit your/our best thoughts on the following message. San Francisco State University is considering a policy of "disclosing" private email to outside agencies. I'm aware that such a policy is yet another argument for using crypto; and the last cypherpunks meeting gave some encouraging instances of "transparent" encryption schemes that are not a hassle or a fear-barrier for newbies. But if you could post or private email me your thoughts about the legal/ethical aspects of "disclosure," I'd be much obliged. I've put a few of my own concerns at the end of the enclosed quote. ---------- Forwarded message ---------- >From: "Deirdre C. Donovan" <deirdre(a)mercury.sfsu.edu> > >I am rewriting the information handouts which we here in San Francisco >give out to our students when they apply for Internet access accounts. >The issue with which I am struggling is one of privacy. I have heard of >universities (anecdotally only) where the administration reserves the >right to read E-mail. Here, we are leaning more toward something like the >paragraph below, which is taken verbatim from an Indiana University draft >document. > > IU computing centers will maintain the confidentiality of all > information stored on their computing resources. Requests for > disclosure of confidential information will be reviewed by the > administrator of the computer system involved. Such requests > will be honored only when approved by University officials > authorized by the [President] of the campus involved, or when > required by state or federal law. Except when inappropriate, > computer users will receive prior notice of such disclosures. > I'm uneasy about the chain of "prior notice": 1) Does this policy give university administrators the power to read private email before the decision is made to "disclose" it to outside persons or agencies? 2) Does this "prior notice" mean "We're going to do it" or "We plan to do it, and if you disagree, let's discuss it before we release it"? 3) What constitutes "inappropriate"?

1 0

CDT, RSACi, and "public service" groups (1/3)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 24 Jul 1997 15:12:36 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Cc: chris_barr(a)cnet.com Subject: CDT, RSACi, and "public service" groups On Thu, 24 Jul 1997, Jonah Seiger wrote: > We do not believe ratings are appropriate for news sites or sites that are > geared toward public discussion of political/social issues (CDT has refused > to rate our sites with RSAC). Of course that hasn't stopped CDT from, as I understand it, proposing a "public service site" exemption to RSAC, similar to the "news site" exemption. Under such an RSAC-PS scheme, organizations defined as legitimate "public service" groups -- and only those groups! -- would be exempt from labeling each of their pages for violence, nudity, and so on. After all, if CDT wanted to label and the RSAC-PS scheme didn't exist, they'd have to cordon off the portion of their site with the Pacifica decision as inappropriate for children. The RSAC working group discussed "public service sites," according to RSAC head Stephen Balkam, during a conference call on July 10. RSAC-PS raises the same troubling questions as RSACnews: what is a "public service" group? Who decides? Is CDT? Focus on the Family? The fight-censorship archives? The Cato Institute? The Washington Post? The U.S. Congress? The Democratic Party? NAMBLA? Jim Bell's Multnomah County Common Law Court? The above is what I understand to be the case. I emailed CDT a week ago about this but haven't heard back. I'd appreciate clarification. -Declan

5 5

UUNET Customer Liaison: USENET "netiquette" Reminder
by Perry E. Metzger 17 Dec '03

17 Dec '03

It would appear that UUNET does not consider themselves to be a common carrier any more -- they now claim the right to cut sites off for violating netiquette. .pm ------- Forwarded Message From: help(a)uunet.uu.net (UUNET Customer Liaison) Message-Id: <QQxzjt24313.199501191826(a)odin.UU.NET> Subject: USENET "netiquette" Reminder To: news-subscribers(a)uunet.uu.net Date: Thu, 19 Jan 1995 13:26:40 -0500 (EST) Because of recent improper use by users on AlterNet sites we are sending out this reminder to all sites currently subscribing to news. If you have not reviewed the accepted USENET netiquette with your users recently we strongly suggest you take this opportunity to do so. Before you or your users post to USENET, please take the time to learn the rules of the environment which you are entering. Doing so can make the difference between creating a good name for you and your company on the Internet or a bad one. Please read the postings contained in news.announce.newusers to familiarize yourself with the etiquette of USENET. This information may also be obtained via anonymous FTP at UUNET's archive (ftp.uu.net) in the directory /usenet/news.answers/news-newusers-intro.Z UUCP customers may obtain the file via UUCP. It is your responsibility to ensure that the users on your system are also aware of the proper guidelines for posting to USENET. Improper use of "netiquette", the guidelines of the USENET community, will be viewed as a violation of the rules of a network. This is in violation of your contract with UUNET/AlterNet and will likely result in your a loss of news posting privileges for your site. Tamara Bowman help(a)uunet.uu.net Manager Technical Support uunet!help UUNET Technologies, Inc. ------- End of Forwarded Message

1 0

Re: UUNET Customer Liaison: USENET "netiquette" Reminder
by Rich Salz 17 Dec '03

17 Dec '03

> It would appear that UUNET does not consider themselves to be a common > carrier any more -- they now claim the right to cut sites off for > violating netiquette. Strange. First, they were never a common carrier: they went to some legal pains to get registered as an enhanced service provider. I don't know what the differences are, but when the first "Internet Porn" article by Joe Abernathy appeared years ago, Rick wasn't worried. He told me ESP was better then CC, but I don't remember why (perhaps it was no FCC regulation?) It's unclear how this new policy affects their ESP status. /r$

1 0