December 2003 - cypherpunks-legacy

LACC: DEA Agents Accuse CIA of Tapping Phones
by Greg Broiles 17 Dec '03

17 Dec '03

This would probably be a pretty interesting complaint to read, if there are any DC-area cypherpunks who feel like making a trip down to the courthouse .. >Resent-Date: Wed, 17 Sep 1997 19:55:42 +1000 (EST) >Date: 17 Sep 1997 09:49:50 -0000 >From: proff(a)suburbia.net >X-Loop: lacc(a)suburbia.net >Resent-Sender: lacc-request(a)suburbia.net >To: lacc(a)suburbia.net >Resent-From: lacc(a)suburbia.net >X-OS: FreeBSD3.0-current >X-Mailing-List: <lacc(a)suburbia.net> ftp://ftp.suburbia.net/pub/mailinglists/lacc/archive/latest/1018 >X-Subscription: To unsubscribe from this fine mailing list mail lacc-request(a)suburbia.net with Subject: unsubscribe >Subject: LACC: DEA Agents Accuse CIA of Tapping Phones > >Real-To: proff(a)suburbia.net > > > >SAN FRANCISCO (AP) - The CIA and other spy >agencies have systematically tapped the phones of >overseas Drug Enforcement Administration offices, >according to a class action lawsuit agents filed >Thursday in Washington. > >The lawsuit, which also names the National Security >Agency and the State Department, seeks a court >order barring those agencies from any further >wiretapping. > >"These agencies have a pattern and practice of >eavesdropping on DEA agents' and employees' >conversations while they are serving the government >overseas," said attorney Brian Leighton of Clovis, Calif. > >But legal experts say it could be a difficult lawsuit to >win, especially since an employer - in this case the >government - generally has a right to listen to employee >conversation on office phones. > >It also doesn't help that national security was involved >and that courts have held that U.S. citizens don't have >constitutional rights overseas. > >``It's an uphill battle. It's going to be a tough suit,'' said >constitutional law expert Paul Rothstein of Georgetown >University. > >The lawsuit was filed on behalf of all DEA agents, >but the agency itself was not part of the action. > >The only DEA agent named as a plaintiff in the suit >is Richard A. Horn, currently with the agency's New >Orleans bureau. Five other incidents involving other >unidentified agents are alleged. > >Two years ago Horn filed a lawsuit accusing U.S. >officials of undermining his anti-drug efforts in Burma. > >That suit is still pending. > >Leighton said subsequent contacts with other DEA >personnel revealed a pattern of similar abuses around >the world. > >CIA spokesman Mark Mansfield said he could not >comment directly on the class action lawsuit, but >defended his agency. > >"It is not the CIA's mission, nor is it part of the >operations of the agency, to surveil in any manner >U.S. officials, or other U.S. citizens at home or >abroad,'' Mansfield said. > >The only exception would be in counterintelligence >cases, he added, and then only in consultation with >senior Justice Department officials. > >DEA spokesman James McGivney said he could not >comment on pending litigation, but noted that as a >U.S. citizen, Horn had the right file his own lawsuit. > >John Russell, spokesman for the Justice Department, >which defends the other agencies in lawsuits, >said only, ``we will respond in court.'' > >In Horn's previous case, Leighton said, the Justice >Department angered DEA agents by claiming they >have no Fourth Amendment constitutional right >against wiretapping when working outside the >country. > >Leighton, a former federal prosecutor, said the >lawsuit doesn't address the reasons for the alleged >electronic eavesdropping. > >"My assumption is because they want to know >what DEA is doing, they want to rip off DEA >informants, they want to know DEA contacts >within foreign governments,'' Leighton said. >``And with the Cold War over, these agencies >are looking for a new mission.'' > >An April 1996 letter to agents by Horn and >Leighton, details the allegation of wiretapping >against the agent in Burma. > >Horn's residence ``was the target of a U.S. >Government Agency-sponsored electronic audio >intercept,'' it said. > >"Horn had occasion to see a cable containing >his words in quotation marks, that he had spoken >to another DEA agent, set forth exactly as stated...'' > >The suit also reports alleged wiretaps against >DEA agents in the Dominican Republic from >1987 to 1990, in May 1993 and September 1994 >at the Bangkok, Thailand office; at the Guatemala >City office in 1984, 1985 and from 1987 to 1989; >and in an unidentified location in April 1987. > >The suit, assigned to U.S. District Judge Harold H. >Greene, names as defendants Secretary of State >Warren Christopher, CIA Director John Deutch >and NSA Director Adm. J.M. McConnell. > > -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

1 0

wiretaping ability and future plans
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Thu, 02 Nov 1995 01:55:06 -0800 >From: Jay Campbell <edge(a)got.net> >Subject: FBI seeks huge wiretapping system >FBI seeks huge wiretapping system >BY JOHN MARKOFF >New York Times >``These are staggering numbers,'' said Mark Rasch, director of >information security law and policy for Science Applications >International Corp. in McLean, Va. ``Either they do a lot more >wiretaps than they now admit, or they plan on doing a significant >larger number of wiretaps in the future because of the fear of >domestic terrorism.'' I can see at least two possible alternative explanations: 1. The FBI envisions a time when voice-recognition systems will be cheap enough to do "keyword searches" on digital voice in something close to real time, with high accuracy. This might be useful when fishing for crime, dissent, etc. It would certainly require some rather broader powers, but they may expect this, especially if they expect more acts of domestic and foreign terrorism. 2. After implementing some kind of widespread escrowed crypto, the FBI envisions recording lots of encrypted phone conversations, perhaps targeted on suspiscious people, perhaps random. Since the whole conversation is encrypted, this might not violate any laws, since they still have to get the warrant to recover the conversation. This would get them past the obvious practical problem with most wiretap-based investigations--if you start your wiretap three days after the target becomes a suspect, you've probably missed all the juicy stuff. Only a bit of carelessness or stupidity on the part of your target will get the desired information. > Jay Campbell edge(a)got.net - Operations Manager > -=-=-=-=-=-=- Sense Networking, Santa Cruz Node > Jay(a)Campbell.net got.net? PGP MIT KeyID 0xACAE1A89 Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMJm0AUHx57Ag8goBAQGHTAP/XCsTUjb26sLB+UORMQCNjtBz2dhCjcF2 QkKfRjuUcBOG3z/nCeLDgfb1hWiiSYJwRhJOTG0dCcqS9k9gO//hpC4CsDz3y0Yw mt5sG4X6POB+ljBfFOHqM7joekLmnmbodZQYdmiFTHbZ/Zn4w4obrTRjcPKhlQH9 Fctxd8JCYyg= =ITxA -----END PGP SIGNATURE-----

1 0

video as a source of public randomness
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Thu, 02 Nov 1995 00:39:29 -0800 >From: tcmay(a)got.net (Timothy C. May) >Subject: Re: Video as a source of randomness >Digitized video input, especially from something like a noisy channel (t.v. >channel, for example), is quite likely to produce a lot more entropy bits >per second than nearly any of us ever need. (One's PGP key could be seeded >in a fraction of a millisecond, for example.) This seems like a potential source of a stream of public random bits. If these can be authenticated and matched, this kind of thing can be useful in a lot of protocols. For example, if there is some packet structure in the digital video transmission which has at least 160 bits of entropy, then we can take the SHA1(packet[i]) to be public random bit block i. (If we're worried about entropy, we can collect arbitrarily large numbers of packets to hash per 160-bit public random block.) For large-scale, above ground protocols, these packets would need some kind of signature or other authentication. However, for protocols that could handle having the public random string checked offline later, this idea provides a reasonably good public random string that can be used without any knowledge or consent of the broadcaster/cable system/satellite system/whatever. If the transmission is sent under encryption, so much the better. This does still leave the possibility that an attacker could control the broadcaster's transmissions for a few seconds, but this seems unlikely in practice. An alternative might be the encrypted transmissions from any communications satellite. How many telephone calls are your opponents able to reroute? >--Tim May, who has both audio and video digitizers built into his Power >Macintosh 7100av, but notes that none of the crypto programs he uses has >any provision for using them, and so he doesn't use them for crypto >purposes. Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMJmz3kHx57Ag8goBAQGYiwQAkx3dxUUcGjsEKqRAlc0CTq6EaTzBrLRz ifrKgZPxfyD9F+sBTJGGPpHWc3mtfwJwV8HeIa/MY1Z1hpssN1ZY6ELlEn+4FFIA 3A+BNjB1PKrHebVZ0WHBJ3DI3h4/olF37bYNP261Uqd8CNig+fQ3VMtE0L0frBdr I+izpEMOwiw= =y7To -----END PGP SIGNATURE-----

1 0

Re: National Security Committee amendments to SAFE
by Steven Bellovin 17 Dec '03

17 Dec '03

Carl Ellison says: >>Decisions made by the Secretary of Commerce with the concurrence of the >>Secretary of Defense with respect to exports of encryption products under >>this section shall not be subject to judicial review. > >I take it this last sentence is intended to kill Bernstein, Karn and Junger >and any other cases we might try to bring. Correct? How could that possibly be binding? Anything the court system thinks is subject to judicial review is subject to judicial review. I'm sure one of the real lawyers will add a lot more detail. However... The way something can be beyond judicial review is if it's purely an executive branch function. You can sue, of course, but in order to overcome that argument you'd have to show that either the function wasn't executive branch-specific, *or* some other constitutional right is being violated. To see how a judge can rule on such an issue, have a look at the trial court's opinion in the Karn case. You can find that opinion at http://venable.com/oracle/oracle7.htm, according to Karn's page (I was unable to confirm that link just now).

1 0

SSZ is back...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, SSZ has been down the last few hours because of a non-functioning ISDN line. Seems to be back up now. On with the show... ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Crypto++ 1.1
by Wei Dai 17 Dec '03

17 Dec '03

I am still talking to RSADSI's lawyers, but it's taking a lot longer than I expected. So in the mean time I've decided to rerelease the Crypto++ library with RC4, RC5, RSA removed, and some calls to RSAREF disabled. RSADSI said it will not object to this rerelease. Version 1.1 also has some minor bug fixes. You can find it at ftp://ftp.csn.net/mpj/I_will_not_export/crypto_?????/libraries/crypto11.zip where ????? is in ftp://ftp.csn.net/mpj/README For the next version I hope to work out a deal with RSADSI to put some of those files back in. I'm also planning to add SAFER and perhaps some elliptic curve stuff. Other suggestions are welcome. I encourage people to use this library in commercial as well as shareware/freeware products. You don't have to pay me a cent, but don't forget about the patents. Wei Dai P.S. Does anyone know if elliptic curve key agreement protocols are patented?

1 0

Re: 767 MHz Alpha, opinion_mode_enabled (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

I 'spose it's gettin' to be time that we ditched them 512 bit keys and them 40 bit keys. :) The very existance of a 2.6GHz CPU - yes freon cooled is more than enough... =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ========================== ---------- Forwarded message ---------- Date: Wed, 17 Sep 1997 11:08:40 -0500 From: "Kirk R. Erichsen" <KirkE(a)LOSNINOS.ORG> Reply-To: AlphaNT(a)beauty.mke.ra.rockwell.com To: AlphaNT(a)beauty.mke.ra.rockwell.com Subject: Re: 767 MHz Alpha, opinion_mode_enabled According to trade reports, the 21264 will be available at 800MHz by mid 98 but the die size (a .25 micron die) will need a signficant shrink to make the speed practical (heat and power consumption will be monsterous). It will need a die shrink to a .15 or .18 process in order for 800MHz + Alpha CPUs to be inexpensive enough to produce in volume. A smaller die size increases the number of chips that are "good" per waffer and decreases the finished chips power consumption and heat dissipation. Other methods for dealing with CPU speed (which don't address power or heat directly) include using CMOS alternatives like BiCMOS and Gallium Arsenide. Gallium Arsenide is very expensive, and the element Gallium is a rare earth element, so high production using it is not possible. As for the existing Digital freon "lab" chips, the 1.2GHz frequency has actually been surpassed twice already, with some reports saying that the last test with a non-production (beta 21364?) chip reached 2.6GHz. I don't know if at that frequency the processor was at sub-zero (in Celsius) temperatures, but it was at least a liquid nitrogen machine. One question no one seems to ask is "how fast were the external buses to memory and cache running on these testbeds?" Xray lithography has already produced (in very limited quantity) operable memory and processors with die sizes of below .000001 microns, a size that could accomodate about 1000 21264 processors in a package that would appear to be little more than a single "chip." The problem with implementing Xray lithography is that almost none of the existing process tools for producing chips can be used. The precise photo lithography masks (most of which are used with ultra-violet light) don't work anymore (Xray just goes right through) forcing you to use alloys of lead, bismuth and zirconium in the masks, a considerably more expensive and complex method. Ionizer units and other tools would have to be built for dealing with incredibly low tolerance. When Xray lithography is finally implmented, there will be a quantum lead in the frequency (multi GHz) while simulataneously reducing power consumption and heat dissipation. SMP and massively parallel machines will be portable boxes that will weigh only slightly more than the case and screen (if the TFT panel itself does not fall prey to light weight projection glasses) force it to be. The other option for new memory and processor devices is to "grow" them. Nanotechnologies that may be available in the next 10 years could allow microscopic machines in combination with biologic engineering could produce processors and memory of sizes at or below those of Xray lithography, with significant implications in other industries as well. One issue very rarely addressed in trade mags is the system bus speeds for the system bus (or any seperate cache, memory and I/O buses). Without a fast external bus speed, the system cannot necessarily provide more usable performance, particularly when memory becomes bottlenecked and saturated even at todays low frequencies. High internal CPU frequency does can not provide a linear increase in performance in and of itself. At about 400MHz, you have reached the maximum frequency an electrical bus can run. The next option for connecting the system bus to the processors is through optical buses. Optical buses don't suffer from the interference and noise that electrical buses do, and can operate at up to many thousands of GB without the error rates. Optical buses will connect all cache, memory and storage devices (directly without I/O adaption) in multiple segments with parallel access to all devices. The problems with doing this are the speed of the embedded switches which convert electrical signals into optical pulses are currently much too high in latency. A die shrink, the use of a high speed silicon or GA switch (or some new Selenium technology) could make the speed between electrical and optical buses practical. The other implication of more advanced methods for producing memory and processors is that the sluggish mechanical disk drive becomes totally obsolete. Massive non-volatile memory storage could be added to a system directly off the memory bus without the need for additional I/O buses. Hologramic optical storage devices (which store data as an image in 3D space) will replace most of the mechanical drive based multi-terrabyte installations with multi exabyte storage that will be 1000 smaller than existing storage devices. The entire world could place all its currently existing data and archives into a hologramic memory device the size of a lunch box. If it all sounds far fetched, its been proven possible already. Lets give it 10 years. At 10:41 AM 9/17/97 -0400, you wrote: >I talked with a tech from DEC here in Massachusetts and yes, I can >confirm that they did get 1.2 Gig but it was cooled with a liquid >nitrogen containing fan system, which cooled the chip considerably, but >not below freezing point. The FPU was very bad at this temp though Kirk R. Erichsen LAN Manager/Communications

2 2

Summary of FBI talk @ MIT, Sept 10
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Date: 17 Sep 97 17:35:20 -0400 From: Request Admin <request-admin(a)phx.com> Subject: Summary of FBI talk September 10, 1997 To: BBLISA Announce <bblisa-announce(a)bblisa.org> ############################################################### Summary of FBI talk held September 10, 1997 7-9p.m. Room 395 MIT E-51 ---- HES [Heidi Schmidt] hschmidt(a)phx.com ############################################################### Note: I did not write down Steves' address but you can get it from the site. :) Concepts discussed regarding cybercrime.... T.O.E (Tool, Object, Evidence) Tool-- You are used to get to the target Object-- You are the target Evidence -- Evidence of the crime C.I.A ( all pertaining to data and your rights to have the following...) Confidentiality of data Integrity of data Availability of data The url for Subsection 1030. Fraud and related activity in connection with computers http://www.usdoj.gov/criminal/cybercrime/1030_new.html This subsection protects three types of computers within institutions: 1) Financial based institutions using computers 2) Governmental based institutions using computers 3) Foreign commerce or Interstate commerce transaction based institutions using computers The url for Computer Crime and Intellectual Property Section CCIPS http://www.usdoj.gov/criminal/cybercrime/index.html Contact information for CSI http://www.gosci.com telephone: 415 905 2370 Since spam and other security issues cropped up as sub topics I am mentioning other urls that may prove helpful in the long run. Additional sites of interest regarding security and spam: Spam http://spam.abuse.net http://www.cauce.org Web security http://www.nmrc.org/faqs/www/ Sage resources (including security) http://www.usenix.org/sage/sysadmins/sysadmin_resource.html These are only but a drop on the planet, but they are a start. ############################################################### The next announcement will be regarding the development of the BBLISA web site currently beign hosted at http://jthome.jthome.com/~bblisa ############################################################### Heidi Schmidt hschmidt(a)phx.com UNIX Systems Administrator-Webmistress The Boston Phoenix Media Communications Group -- Send mail for the `bblisa' mailing list to `bblisa(a)bblisa.org'. Mail administrative requests to `majordomo(a)bblisa.org'.

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:03 AM 11/3/95, clark.matthews(a)paranet.org wrote: >Thanks for this item! Two little excerpts jump out at me. They follow: >> Last year, federal and state courts authorized 1,154 wiretaps, of which 48 >> percent .... >> "People are starting to say that seems awfully high," Dempsey said, noting that >> the overall level of such surveillance activity is now a total of 20,000 >> to 25,000 intercepts nationwide over an entire year. >So what is it? 1,154 wiretaps? Or 20,000? Perhaps that's 1154 wiretap victims, with an average of 20 intercepts each? In a separate article, Clark posted estimates that ranged from 500K - 1.5M people could be wiretapped, depending on how many people are in the 1%/.5%/.25% zones. It's worse than that - if they're tapping the average victim for (say) 3 months, that's 4 times as many victims.... And just how many cops do they plan to hire to watch all these phones? Computers can help some, especially for data, but who's going to read it all, even after the fancy pattern recognition systems pick out the possible good stuff. >FBI Director Louis Freeh testified under oath to 1,157. The FBI was asked >for the data to support those numbers. The FBI refused to release them >until the year 2002. [....] >One last thing. >What's so special about the year 2002? Statute of limitations? :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

SSZ Test [No Reply]
by Jim Choate 17 Dec '03

17 Dec '03

Check Check Test No Reply

1 0