December 2003 - cypherpunks-legacy

Secret Clearance (was: re: NIST GAK export meeting, sv)
by Pete Loshin 17 Dec '03

17 Dec '03

I'm definitely opposed to GAK, but the conspiracy theory approach to considering what it means to employ people with SECRET clearance may be getting a bit paranoid. >From working at an organization that did a lot of government work, my understanding of the process of clearing employees is this: -certain tasks require knowledge or access that must be restricted -you have to have a high degree of trust in the people doing those tasks -people with money troubles, out-of-control addictions, skeletons in the closet, and histories of "troubles" are prime targets for subversion -doing a clearance check (in theory) eliminates the possibility that these people will be blackmailed/bribed into revealing their secrets Not that this stuff always works in practice, considering that Aldrich Ames was an alcoholic with money troubles who then turned up with a lavish lifestyle, and no one he worked with noticed until it was pretty much too late. The point is, if you want to keep your organization's systems secure, you need some mechanism to do so. Security clearance is one way; banks and other financial institutions do other things (like finger prints, background checks, etc.) My big question is, do any of the companies providing Internet services, or Internet software, or digital commerce services/software, employ any of these security mechanisms on their employees? Comments or (preferably) references to actual practices? -Pete Loshin pete(a)loshin.com

1 0

Re: The "Future" Fallacy
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: Duncan Frissell Bill Gates (like Mister Newt before him) committed what I call the Future Fallacy in "The Road Ahead." Page 106. "Soon any child old enough to use a computer will be able to transmit coded messages that no government on earth will find easy to decipher." ................................................... Billg is an optimist. What's wrong with this picture, Duncan? .. Blanc

1 0

re: Secret Clearance
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 9:00 PM 12/5/95, Pete Loshin wrote: >I'm definitely opposed to GAK, but the conspiracy theory approach to >considering what it means to employ people with SECRET clearance >may be getting a bit paranoid. In a discussion of governmental efforts to deny presumedly innocent citizens the assurance that they can conduct their affairs in privacy -- and to require that "trusted," "impartial" escrow agents employ someone who has been vetted according to undisclosed criteria, the best you can come up with is this "conspiracy theory" saw? Did *I* invent this stipulation? >>From working at an organization that did a lot of government work, >my understanding of the process of clearing employees is this: > >-certain tasks require knowledge or access that must be restricted >-you have to have a high degree of trust in the people doing those tasks >-people with money troubles, out-of-control addictions, skeletons in the > closet, and histories of "troubles" are prime targets for subversion >-doing a clearance check (in theory) eliminates the possibility that > these people will be blackmailed/bribed into revealing their secrets Therefore, *every* GAK escrow agent *must* employ someone with an arbitrary clearance level? >Not that this stuff always works in practice, considering that Aldrich >Ames <etc.> And what protected him? Incompetence, cronyism, corruption, and ass-covering. Of course, any failures in GAK administration would be handled differently... >The point is, if you want to keep your organization's systems secure, >you need some mechanism to do so. Security clearance is one way; >banks and other financial institutions do other things (like finger prints, >background checks, etc.) I get the point. I *disagree* with it. >My big question is, do any of the companies providing Internet services, >or Internet software, or digital commerce services/software, employ >any of these security mechanisms on their employees? Comments or >(preferably) references to actual practices? On the *hardware* front, definitely -- if not by law then simply by practical need. Does the hardware in question *necessarily* apply to every citizen in America? Hieronymous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMUfVr3g0mNE55u1AQE2AwH+Ps6ux/T/jME+yz6NEr2hC02m2j1TalGr /hfzvIGytpAE3Ld6f0ltjz70RbSFb4mFX1oPbNnDVwDsPo5iSstEiw== =4PcI -----END PGP SIGNATURE-----

3 2

Re: NIST GAK export meeting, short version
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

David Lesher <netcomsv.netcom.com!nrk.com!wb8foz> said: > Attendence was roughly 20% (yes, one fifth) of September. > ISTM industry is tired of hearing the same words in a different order. I thought that this would happen, immediately on reading that there was going to be this meeting. From Pat and John Young's reports on the previous meeting, it was almost a revolt; almost everyone in attendence thought that the proposals were completely wrongheaded. Yet, it was announced that this meeting would be happening. Very quickly an new set of criteria were announced that made it clear that the input from the last meeting was completely, systematically, and with no apology whatsoever, ignored. All the intelligent complaints from intelligent people that cared and thought a lot about the issue could just have well not have been said. So, why go to the next meeting? Many people have apparently decided not to. Nothing can demoralize somebody more than making good points, telling arguments, that are then ignored. I would have thought at this meeting there would have been a majority of pro-GAK people, to affirm the mandate that was being presented. Apparently this did not happen, although I'm desparately waiting for more reports from this meeting as to exactly what did happen. It's not completely true that the efforts of the previous meeting had no effect, there was one: that the breakout meetings where the major shouting took place were eliminated from this meeting. I think that this was an error on the Govt's part, it worked so well the last time. I'm sure that by the next meeting, or the one after that, or if necessary the one after that, they will have finally come to the point where they can say that there was unanimous enthusiastic acceptance of the GAK criteria, so why not extend it to domestic use as well? thad who is deeply grateful to the East-Coast group for showing up and making noise -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-2244

1 0

Re: NIST GAK export meeting, short version
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:54 AM 12/6/95, Thaddeus J. Beier wrote: >I thought that this would happen, immediately on reading that there was >going to be this meeting. From Pat and John Young's reports on the previous >meeting, it was almost a revolt; almost everyone in attendence thought that ... Man, whatever government type thought up this idea of getting "industry input" is gonna have his head handed to him! Democracy really sucks at times. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

re: NIST GAK export meeting, sv
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:35 AM 12/6/95, Anonymous wrote: >Tim May 12/5/95 6:25 PM: >>One "defensible" (and maybe even good) reason is because someone with >>government clearance can then be prosecuted for leaking what they know, >>whereas ordinary citizens are harder to prosecute for this. I doubt this is >>the main reason, but it makes a certain kind of sense. > > Nice point, though I too doubt that's the reason: if *every* agent >needed to be cleared, then this clearance stipulation would serve nicely, >but if only *one* at every escrow agency needs to be cleared... No, I didn't make that basic a logical blunder. What I was thinking, even if I didn't go into it, is that the "cleared" agent would be the one within the office who would actually handle the surveillance. But I do think the more basic reason is really that the intelligence agencies want a direct channel to "their" guy. I'm really pleased to hear about the 20% attendance. Nothing trivializes a program more than being ignored. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Solution for US/Foreign Software?
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

Manufacturers of handheld ham radios have to make them for at least three markets: Japan, US, and Europe. Since these devices are usually based on the same LSI chip for control, customization is usually done by installing/not installing certain tiny surface-mount devices (diodes?) on the PC board, which tells the "boss MOS" which frequency band edges to work with, etc. Getting these radios to receive or transmit "out of band" is usually a simple matter of modiying these radios by adding/removing/moving these diodes to a different position. The instructions on how to do this custom operation are not included with the radio itself, but the information always seems to get out there, and you can buy books which show the mods for practically every such radio in existence. Okay, the problem as I see it is that USG doesn't want to approve encryption software for export that can use "excessively long" keys, yet Netscape (and others) want to be able to sell outside the country with full-feature encryption. I think I have a solution. 1. Write a program with limited encryption (40 bit?), with the encryption module in a file external to the main program. 2. Get export approval for this program. 3. Write a module which replaces the encryption file, increasing key size to whatever you REALLY wanted in the first place. (128-bit IDEA, 2000-bit PGP, etc.) 4. Ship that new module with the old software to US customers. Naturally, that new module will "leak," so anybody who buys the old program out of the country can convert to a fully-functional version by downloading it from a foreign bbs that just happens to have it. The module can be encrypted/signed by the manufacturer so everyone can be sure of its identity and genuineness. Better than nothing, I suppose.

1 0

Re: Solution for US/Foreign Software?
by tcmay＠got.net 17 Dec '03

17 Dec '03

jim bell proposes "crypto hooks": >1. Write a program with limited encryption (40 bit?), with the encryption >module in a file external to the main program. >2. Get export approval for this program. >3. Write a module which replaces the encryption file, increasing key size >to whatever you REALLY wanted in the first place. (128-bit IDEA, 2000-bit >PGP, etc.) >4. Ship that new module with the old software to US customers. >Naturally, that new module will "leak," so anybody who buys the old >program out of the country can convert to a fully-functional version by >downloading it from a foreign bbs that just happens to have it. The >module can be encrypted/signed by the manufacturer so everyone can be sure >of its identity and genuineness. > > >Better than nothing, I suppose. "Crypto hooks," basically the scheme you are proposing, were thought of by the authorities and are not a bypass of the crypto export laws. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Netscape gives in to key escrow
by James A. Donald 17 Dec '03

17 Dec '03

At 04:59 PM 12/4/95 -0600, Scott Brickner wrote: >Netscape has pretty clearly said that they don't like the idea of GAK, Actually netscape has not said that: Jeff has said that netscape *will* say that real soon now. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: The "Future" Fallacy
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:24 AM 12/6/95, blancw(a)accessone.com wrote: >From: Duncan Frissell > >Bill Gates (like Mister Newt before him) committed what I call the Future >Fallacy in "The Road Ahead." Page 106. > >"Soon any child old enough to use a computer will be able to transmit coded >messages that no government on earth will find easy to decipher." >................................................... > > >Billg is an optimist. > >What's wrong with this picture, Duncan? I found nothing wrong or incorrect with the quote Duncan attributed to Bill Gates (I haven't read Gates' book). I couldn't understand Duncan's koan, shrugged, and moved on. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

6 6