December 2003 - cypherpunks-legacy

CIA & Espionage
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

In a german weekly news magazine (Focus 34/1995, p. 178-181) I read an article about industrial espionage. It is said that the secret services have lost their main task when the east/west cold war had gone. Their new task is the industrial espionage. The russian, french, and american services were referenced in the article. It was said that Pres. Clinton had given a speech while visiting the CIA HQ in Langley/Virginia. He allegedly said in this speech that obtaining industrial informations has the highest priority and this were the new task for the spies. Can anyone confirm the quotation? Hadmut

3 2

Re: CIA & Espionage
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> because of the source of confirmation, but because it fits right into the > direction most of the intelligence agencies have been taking since the > revelation that the French had won out a multi-billion $ contract for air > traffic control because the French service had, through various espionage > methods, determined the U.S. bidding position and such. We have a similar story in Germany. Some time ago, an asian country (South Korea if I remember well) was looking for a high speed passenger train. They had to choose between the german ICE and the french TGV. Both trains have nearly the same quality from technical point of view. Korea decided to take the cheaper one. The germans gave an offer and just half an hour later the french gave an offer slightly (just a little bit) cheaper than the germans. France got the order (over 10^9 D-Mark). The german headquarter had instructed their asian office to give the offer with a certain price through unprotected fax. It is said that the fax was wiretapped by the french secret service (allegedly)... Hadmut

2 1

Re: "Morphed" child porn case ruling text (FSC v. Reno)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Mike Duvos wrote: > While I suspect the typical citizen is unlikely to have a particularly > strong reaction one way or the other to sexual depictions of children, as > long as it is not a photographic record of an actual child being treated > abusively, there is a obvious subset of frothy pointy-headed individuals > who should be shielded from such material at all costs, or they may be > completely unable to control their behavior. > > They are of course the self-appointed "child protectors", none of whom > could care less about what rights children really need or want, as long as > no one appears naked. Question: "If someone did a study that conclusively proves that free availability of child pornography leads to a substantial decrease in the amount of child abuse taking place, will our legislators and our ministers support the legalization of child pornography? Answer: "Right... And I'm the fucking pope..." When did protecting abused children become such a high priority for the fascists? When people told them to shove their fascism under the banner of "moral values" up their ass. If we wipe drug abuse and child abuse from the face of the earth, the fascists will decide that pictures of naked people cause tooth decay, and launch a "War Against Bad Dental Hygiene." Of course, this will mean that Law Enforcement will need the power to check inside our mouths at their every whim, and imprison people who have dental cavities. PopeMonger "I am not a mushroom..."

1 0

Re: SSL search attack
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Scott Brickner <sjb(a)austin.ibm.com> >>If the segments are shuffled before they are handed out then this attack >>becomes impossible, since the attacker has no way of knowing when >>segment 0x1bad will be handed out. > >An excellent point. One I'd missed. I agree that a random shuffle >of segments is appropriate. Problem is, though, if *each* segment is shuffled, or shuffled in groups of 10 or 25 or 50 or what? brutessl is designed for sequential search through a block of segments. I was pulling down blocks of up to 40 segments each, for each machine I was running. Of course, with brloop running I won't be in such a bind (I have yet to see that it really works though..) but still it also represents a coding problem as to handing out sequential segments within shuffled blocks. Hey, by the way Piete, is there gonna be a ego list (rankings) like there was with the RC4? Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMETbAMLa+QKZS485AQFU7QL/WTljlZyetr0x+L9eBJnrYUNNY1BHfTJn C83wiJgPO5cpR6b/Vn8hYPnMRXnEhaxRJ062TcRitdngsUND1W+6d04Ph1gg/Qj8 US6FtoP+Yk9BhcYlYfogh3YSOxcgIvbu =UiWq -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

3 2

Electronic Surveillance Indices
by John Young 17 Dec '03

17 Dec '03

>From the Privacy Act Online via GPO Access [wais.access.gpo.gov] [DOCID:jus_fbi-7] DEPARTMENT OF JUSTICE JUSTICE/FBI 006 System name: Electronic Surveillance (Elsur) Indices. System location: Federal Bureau of Investigation, J. Edgar Hoover Bldg., 10th and Pennvylvania Ave., NW, Washington, DC 20535. Those field offices which have sought conducted electronic surveillances also maintain an index. See appendix to System 022. Categories of individuals covered by the system: Individuals who have been the targets of direct electronic surveillance coverage by FBI in a court order; those whose communications have been monitored/intercepted by an FBI electronic surveillance installation; those who won, lease, or license premises subjected to electronic surveillance coverage sought by the FBI in a court order. Categories of records in the system: The ELSUR Index is comprised of three types of 3 x 5 cards: 1. Principal cards identify, by true name or best known name, all interceptees (targets) identified in an application filed by the FBI in support of an affidavit seeking a court order to conduct an electronic surveillance; 2. Proprietary Interest cards identify entities and/or individuals who own, lease, license or otherwise hold a possessory interest in locations subjected to an electronic surveillance sought by the FBI in a court order; and, 3. Overhear cards identify, by true name or best known name, individuals and/or entities who have been reasonably identified by a first name or initial and a last name a being a party to a communication monitored/ intercepted by the FBI. Authority for maintenance of the system: The ELSUR Index was initiated in October, 1966, at the recommendation of the Department of Justice and relates to electronic surveillances conducted/ sought by the FBI since 1/1/60. The authority for the maintenance of these records is Title 5, Section 301, USC, which grants the Attorney General the authority to issue rules and regulations prescribing how Department of Justice information can be employed. Title 18, U.S.C., Section 3504, also sets forth recordkeeeping requirements. Routine uses of records maintained in the system, including categories of users and the purposes of such uses: The Elsur Indices are utilized: (1) To respond to judicial inquiries about possible electronic surveillance coverage of witnesses, defendants, or attorneys involved in Federal court proceedings, and (2) To enable the Government to certify whether a person regarding whom court-order authority is being sought for electronic coverage has ever been so covered in the past. The actual users of the indices are always employees of the FBI. In addition, information may be released to the news media and the public pursuant to 28 CFR 50.2 unless it is determined that release of the specific information in the context of a particular case would constitute an unwarranted invasion of personal privacy; Member of Congress or staff acting upon the member's behalf when the member or staff requests the information on behalf of and at the request of the individual who is the subject of the record; and, to the National Archives and Records Administration and the General Services Administration in records management inspections conducted under the authority of 44 U.S.C. 2904 and 2908 to the extent that legislation governing the records permits. Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system: Storage: The records are maintained manually on 3 x 5 cards. Retrievability: Names/facilities are indexed and filed alphabetically. Telephone numbers and other such serial or identification numbers targeted are indexed and filed numerically. Locations targeted are indexed by address and filed by street name. Safeguards: The index is maintained in a restricted access room at all times. The entrance is equipped with a special locking device and alarm system for off-duty hours when the index is not in use. Retention and disposal: Until advised to the contrary by the Department, the courts or Congress, these indices will be maintained indefinitely. The indices have been declared permanent by NARA. (Job No. NC1-65-82--4, Part E. 2. t.) System manager(s) and address: Director, Federal Bureau of Investigation, Washington, DC 20535. Notification procedure: Same as the above. Record access procedures: Inquiry addressed to Director, FBI, Washington, DC 20535. Contesting record procedures: Same as the above. Record source categories: Category of Individual. Systems exempted from certain provisions of the act: The Attorney General has exempted this system from subsections (c) (3) and (4), (d), (e) (1), (2) and (3), (e)(4) (G) and (H), (e) (5) and (8), (f), (g) and (m) of the Privacy Act pursuant to 5 U.S.C. 552a(j). Rules have been promulgated in accordance with the requirements of 5 U.S.C. 553 (b), (c) and (e) and have been published in the Federal Register.

1 0

PGP on UK TV
by Sherry Mayo 17 Dec '03

17 Dec '03

Sorry if someone has already posted this but I didn't think I had seem it on the list: Found this on Uk.misc: ========================== alecm(a)coyote.uk.sun.com (Alec Muffett) wrote: >> >> Sunday 3rd September. 7:00pm on Channel 4. Equinox. >> >> "Cybersecurity" - an investigation into cryptography, the >> Internet, civil rights, Phil Zimmerman, PGP (and should we be >> permitted to use it?) and so forth. >> >>I, for one, am going to be videoing it. >>Let's just hope they get it right. > >Having seen a preview trailer of the program I am glad to say that it >comes down on the _right_ side (ie right to privacy, etc). > >It also refers to cipherpunks as "rebel programmers" - I dunno but >I quite like this description of them :-) Has a sort of cult-hero status >about it. ========================== Sherry ps Can't watch it cos I'm in Oz let us know if it was any good.

1 0

Is the book Network Security any good?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Has anyone read the book "Network Security Private Communication in a PUBLIC World" yet? It's by Charlie Kaufman, Radia Perlman, and Mike Speciner, and has a copyright date of this year. Is it good? What's the level? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

3 3

Export Transactions Espionage
by John Young 17 Dec '03

17 Dec '03

>From the Privacy Act Online via GPO Access [wais.access.gpo.gov] [DOCID:commer-31] DEPARTMENT OF COMMERCE COMMERCE/ITA-1 System name: Individuals Identified in Export Transactions-- COMMERCE/ITA-1. System location: Office of Export Administration, ITA, U.S. Department of Commerce, 14th St. and Constitution Ave., NW, Washington, DC 20230. Categories of individuals covered by the system: a. Individuals involved in export transactions. Information is maintained on domestic and foreign companies and business officials, and includes U.S. citizens involved with or working for firms abroad. b. Individuals identified in an export administration compliance proceeding or investigation. Individuals alleged to have violated the Export Administration regulations; established violators of the regulations; certain other individuals identified by the FBI or other investigating agency or individual in the investigative process such as those involved in organized crime; and individuals who have received warning letters. Categories of records in the system: Reports and cables from U.S. foreign service posts. Reports from F.B.I., other law enforcement or investigative agencies, investigators, or informants; investigative and intelligence data; documented violations; warning letters. Includes any information on alleged or proven violators of the Export Administration Act. Authority for maintenance of the system: Export Administration Act of 1979 (Pub. L. 96-72, 50 U.S.C. App. et seq.). 5 U.S.C. 301, 28 U.S.C. 533-535, 44 U.S.C. 3101. Routine uses of records maintained in the system, including categories of users and the purposes of such uses: See routine use paragraphs 1-5 and 8-13 of the Prefatory Statement. Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system: Storage: Paper records in file folders. Retrievability: Information filed by case or subject file. All names are cross-referenced by name card file. Safeguards: Records are located in lockable metal file cabinets or in metal file cabinets in secured rooms or secured premises with access limited to those whose official duties require access. Retention and disposal: Retained for a reasonable period of time. Disposition is recorded. System manager(s) and address: Director, Compliance Division, Office of Export Administration, ITA, U.S. Department of Commerce, Washington, DC 20230. Notification procedure: Information may be obtained from: Privacy Officer, Office of Management and Systems, ITA, Room 3102, U.S. Department of Commerce, Washington, DC 20230. Requester should provide name, address, and case or subject, if known, pursuant to the inquiry provisions of the Department's rules which appear in 15 CFR part 4b. Record access procedures: Requests from individuals should be addressed to: Same address as stated in the notification section above. Contesting record procedures: The Department's rules for access, for contesting contents, and appealing intial determinations by the individual concerned appear in 15 CFR part 4b. Use above address. Record source categories: Individual exporters, those authorized by the individual exporters to furnish information, trade sources, investigative agencies, intelligence, investigative and other personnel of the Office of Export Administration, informants, CIA, FBI, Justice Department, Defense Department, Energy Department, and State Department. Systems exempted from certain provisions of the act: Pursuant to 5 U.S.C. 552a(j)(2), all information about an individual in the record which meets the criteria stated in 5 U.S.C. 552a(j)(2) are exempted from the notice, access and contest requirements of the agency regulations and from all parts of 5 U.S.C. 552a except subsections (b), (c)(1) and (2), (e)(4)(A) through (F), (e)(6), (7), (9), (10), and (11), and (i), and pursuant to 5 U.S.C. 552a(k)(1) and (k)(2) on condition that the 5 U.S.C. 552a(j)(2) exemption is held to be invalid, all investigatory material in the record which meets the criteria stated in 5 U.S.C. 552a(k)(1) and (k)(2) are exempted from the notice, access, and contest requirements (under 5 U.S.C. 552a(c)(3), (d), (e)(1), (e)(4)(G), (H), and (I), and (f)) of the agency regulations because of the necessity to exempt this information and material in order to accomplish this law enforcement function of the agency, to prevent subjects of investigation from frustrating the investigatory process, to prevent the disclosure of investigative techniques, to fulfill commitments made to protect the confidentiality of sources, to maintain access to sources of information, and to avoid endangering these sources and law enforcement personnel. Section 12(c) of the Export Administration Act of 1979 also protects certain of this information and material related to export licenses from disclosure.

1 0

Ajax
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

A source for links to the Intelligence Community: URL: http://www.interport.net/~sagal/ajax.html ---------- AJAX UNITED STATES AND INTERNATIONAL GOVERNMENT MILITARY AND INTELLIGENCE AGENCY ACCESS Last update: 16 AUG 95. All accesses verified at time of inclusion. Certain locations or sections thereof may be closed to unauthorized use. Please read access warnings, if any, and abide by them. _______________________________________________________ United States Government Intelligence and Law Enforcement Agency Servers ATF (Bureau of Alcohol, Tobacco and Firearms) BOP (Federal Bureau of Prisons) CIA (Central Intelligence Agency) COPNET FBI (Federal Bureau of Investigation) FINCEN (Federal Crimes Enforcement Network) FLETC (Federal Law Enforcement Training Center) HEROES (U.S. Department of State Diplomatic Security Service Counter-Terrorism Rewards Program) MARSHALS (U.S. Marshals Service) NLETC (National Law Enforcement Technology Center) SS (Secret Service) United States Military Branch Servers NATGUARD (Army and Air National Guards) USA (United States Army) USAF (United States Air Force) USCG (United States Coast Guard) USMC (United States Marine Corps) USN (United States Navy) United States Military & Defense Agency Servers ACC (Air Combat Command) AFIN (U.S. Air Force InterNet) AFOS1 (1st Security Police Squadron, Langley Air Force Base) CHIEFS (Joint Chiefs of Staff) DEFENSE (Defense Department) DISA (Defense Information Systems Agency) DRMS (Defense Reutilization and Marketing Service) NEW (8/16/95) DTIC (Defense Technical Information Center) NAVWAN (Naval Aviation Systems Team Wide Area Network) NAWCWPNS (Naval Air Warfare Center Weapons Division) NCS (National Communications System) NSWC (Naval Surface Warfare Center) United States Military & Defense Laboratory Servers AHPCRC (Army High Performance Computing Research Center) ARPA (Advanced Research Projects Agency) BMDO (Ballistic Missile Defense Organization Test Data Centers) LABLINK (U.S. Department of Defense Laboratory System) NRL (The Naval Research Laboratory) RL (USAF Rome Laboratory for C41 Technology) International Intelligence and Law Enforcement Agency Servers FORENSICS (The Forensic Web, Canada) UKPFW (UK Police and Forensic Web) RSB (Home Office Research and Statistics Department, UK) UNCPCJ (United Nations Crime Prevention & Criminal Justice) NATO and International Military Agency Servers DRA (Defence Research Agency, United Kingdom) DREO (Defense Research Establishment, Ottawa, Canada) NATO (North Atlantic Treaty Organization) SACLANT (Supreme Allied Commander, Atlantic) United States Regulatory Agency Servers EPA (U.S. Environmental Protection Agency) FAA (Federal Aviation Administration Technical Center) FCC (Federal Communications Commission) FTC (Federal Trade Commission) NRC (Nuclear Regulatory Commission) SEC (Securities and Exchange Commission) United States Government Agency Servers CDC (Centers for Disease Control and Prevention) CENSUS (U.S. Department of Commerce Bureau of the Census) CONGRESS (U.S. House of Representatives) CUSTOMS (U.S. Customs Service) DHHS (U.S. Department of Health and Human Services) DOE (U.S. Department of Energy National Laboratories & Programs) DOSFAN (Department of State Foreign Affairs Network) EXECUTIVE (The White House) FDIC (Federal Deposit Insurance Corporation) FEMA (Federal Emergency Management Agency) GPO (U.S. Government Printing Office) GSA (U.S. General Services Administration) HPCC (NOAA High Performance Computing and Communications) IRS (Internal Revenue Service) JUSTICE (Justice Department) NARA (National Archives and Records Administration) NASA (National Aeronautics and Space Administration) NIMH (National Institute of Mental Health) NOAA (National Oceanic & Atmospheric Administration) NSF (National Science Foundation) NTIS (National Technical Information Service) SBA (Small Business Administration) NEW (8/16/95) SEL (Space Environment Laboratory) TREASURY (Treasury Department) USCODE (U.S. House of Representatives Internet Law Library U.S. Code) _______________________________________________________ AJAX maintained and monitored by Sagal Computer Systems. E-Mail suggestions, additions, comments or corrections to sagal(a)interport.net

1 0

Mixmaster Security Issues
by hroller Mixmaster 17 Dec '03

17 Dec '03

Apart from thwarting traffic analysis attacks, how does the security of a Mixmaster Type II remailer packet compare to that of a PGP-chained Type I message? For example, is each remailer in the path limited to knowing only the next remailer in the path? Is there any way for a remailer (except for the first and last in the chain) to know how many hops have already occurred or how many remain? Is there a session key chosen via an RNG? If so, how random is the RNG? Is it seeded from a pseudo-random source that's at least as secure as measuring keystroke latencies, as PGP does? Lance Cottrell's original "remailer essay" which proposed the Type II concept envisioned, if I'm not mistaken, the use of PGP technology to do the actual encryptions. Now it seems that another, seemingly proprietary, implementation of RSAREF was used, instead. What was the reason for this change? Would any security be lost if Type I and II technology were combined and a PGP-chained Type I packet were initially sent via Mixmaster? This would would seem to provide the necessary protection against traffic analysis while bypassing any *POSSIBLE* hidden weaknesses in Mixmaster. IOW, if the outer Mixmaster "envelope" were "steamed open", perhasps based on some hidden weakness in Mixmaster, the inner, nested PGP envelope(s) would remain intact. BTW, what volume of message traffic is the Mixmaster network of remailers currently handling? Is much cover traffic necessary to minimize delays while providing enough reordering to thwart traffic analysis? (IOW, so a remailer with a reordering pool size of five messages, and averaging one REAL message a day, wouldn't have to keep a message for an average of five days before sending it on its next hop, as a worst-case scenario). Is my math correct in surmising that chaining a message through five remailers, each with a reordering pool of five messages, could mean that the message eventually leaves the chain as one of 5^5 (3125) possible messages? (My math is a bit weak, so please feel free to correct my methodology, if necessary.) If so, does that work in reverse? Could a given output message that finally surfaced in the clear be narrowed down to one of 3125 Mixmaster input messages through traffic analysis? Or would the fact that the attacker didn't know the exact number of hops utilized significantly increase the odds against identifying the sender? What effect, if any, would increasing the number of available remailers have on traffic analysis?

2 1