December 2003 - cypherpunks-legacy

Java security (reposted from RISKS)
by stevenw＠best.com 17 Dec '03

17 Dec '03

------------------------------ Date: Fri, 10 Nov 1995 15:45:00 -0800 From: Marianne.Mueller(a)eng.sun.com (Marianne Mueller) Subject: regarding Java security This response was recently posted to comp.lang.java. Marianne Mueller <mrm(a)eng.sun.com>, Java Products Group, Sun Microsystems, Inc. Article 4356 of comp.lang.java: Path: handler.Eng.Sun.COM!puffin.Eng.Sun.COM!mrm >From: mrm(a)puffin.Eng.Sun.COM (Marianne Mueller) Newsgroups: comp.lang.java Subject: Re: PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE Date: 9 Nov 1995 00:50:27 GMT Organization: Sun Microsystems, Inc. Mt. View, Ca. Keywords: alpha3 hotjava security The paper written by the two students at Princeton describes possible attacks on the alpha3 HotJava browser, which have all been fixed in JDK beta. Granted, until this week, the source code for JDK beta wasn't available, so it's understandable that they analyzed the alpha3 source base. We understand people need more information on the security model, and we're taking time right now to document the security story more rigorously. A security FAQ, an updated whitepaper, detailed user documentation and detailed implementor's documentation are all being worked on. The Java security mechanisms include: Java language mechanisms * no pointers * private interfaces, classes and methods * class loader that enforces namespace divisions * runtime byte code verifier that enforces language type rules and name space divisions Browser mechanisms, used by JDK beta appletviewer and by Netscape Navigator 2.0beta * AppletSecurity: extends java.lang.SecurityManager; strict applet checks * AppletClassLoader: extends java.lang.ClassLoader; strict class loading The goal for JDK beta is to enable browsers to run untrusted applets in a trusted environment. The approach is to be conservative at first, and to add functionality when it can be added securely. So, JDK beta applets (and Netscape 2.0beta applets) may not do the following. 1. Files: Access Control Lists are greatly restricted in beta, as compared to the situation in the alpha3 HotJava browser. ACLs are initialized - only once - by the applet security manager, and are not user configurable. For a file not on the access control list, an applet cannot - check for the existence of the file - read the file - write the file - check the file type - check if the file is a directory - check the timestamp when the file was last modified - check the file's size - create a directory - rename the file - list the files in this file (as if it were a directory) Applets cannot - create a FileInputStream - create a RandomAccessFile, either for reading or writing - Open file descriptors 2. Sockets: Applets cannot - Create socket connections other than to its own host - Create a socket factory 3. Loading/linking: Applets cannot - Create class loaders - Access a package in the sun.* hierarchy - Define a new class in the java.* hierarchy - Link dynamic libraries using System.loadLibrary() - Disable or override the AppletSecurityManager 4. Process control: Applets cannot - Define native methods - Fork processes - Manipulate threads or thread groups outside of the applet's thread group - Exit the virtual machine (e.g., the browser or the appletviewer) 5. awt: Applets cannot - Create toplevel windows that don't have a warning banner Applets can use network connections only to connect to the host they originate from, to download files that are part of the applet's implementation. Those files might be java bytecode class files, or they might be input files used by the applet (GIF, JPEG, audio, other data files.) Taking a look at the specific attacks mentioned in the paper - alpha3 HotJava JDK ---------------------- --- 1. socket accept() and applets cannot use listen() aren't protected accept() and listen() adequately, allowing a browser to eavesdrop 2. applets can connect to applets cannot connect the SMTP (mail) port on to the SMTP port on some web server and use the computer the applet that as a covert channel is visiting 3. InetAddress.getByName() applets cannot use is public and does not InetAddress to inquire check the security mode about hosts they are before making DNS request not already allowed to connect to 4. applets can use DNS to applets may not get the create a covert channel internet address of any host 5. Access Control Lists (ACLs) ACLs are greatly restricted for reading and writing in JDK beta. files are not strict enough Reading/writing files is disabled for web browsers, such as Netscape Navigator 2.0. 6. applets can use the System.getenv() is obsolete System.getenv() method and is not part of the JDK to gather information about API the computer that it is running on 7. applets can change the applets cannot read or alter property manager database client properties 8. applets can change the The fields that hold the HTTP and FTP proxy server HTTP and FTP proxy names are private. The values are stored in a property manager database that an applet cannot read or write. It's very difficult, if not impossible, for a web browser to completely prevent denial of service attacks. The JDK applet API doesn't claim to prevent denial of service attacks. A "denial of service" attack is where someone writes an applet whose goal is to consume all available resources on your computer, forcing you to kill the browser you're running. For example, someone could write an applet that creates a million pop-up windows. The windows don't do anything, but creating a million of them might use up all the virtual memory on your computer and you'd have to kill the web browser to reclaim the virtual memory. Before people engage in too much wailing and gnashing of teeth about how applets have been too severely restricted - We want to enable applets to do interesting things, including making socket connections, and reading and writing to the file system. One way to enable that is to used a signed class loader. When a trusted applet is loaded, then the applet could be granted permission to do some of the things they are prevented from doing by default. The goal is to ensure that untrusted applets can't steal or damage information on a computer running a Java-enabled browser. Later, we can allow trusted applets to do things that untrusted applets are not allowed to do. Since an implementation bug in a trusted applet could open a loophole that could be exploited by an untrusted applet, design matters. Marianne Java Products Group http://java.sun.com/people/mrm/ ------------------------------ ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

ALERT: On Monday, call Congress to stop Big Brother amendment!
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

=========================================================================== ____ _ ____ _ _ | __ )(_) __ _ | __ ) _ __ ___ | |_| |__ ___ _ __ Stop the Big Brother | _ \| |/ _` | | _ \| '__/ _ \| __| '_ \ / _ \ '__| Amendment, coming next | |_) | | (_| | | |_) | | | (_) | |_| | | | __/ | week in the House |____/|_|\__, | |____/|_| \___/ \__|_| |_|\___|_| Commerce committee! |___/ Posted September 18, 1997 Please forward where appropriate until September 28, 1997 This alert brought to you by The Voters Telecommunications Watch, The Center for Democracy & Technology, the Electronic Frontier Foundation, Wired Magazine, and Americans for Tax Reform _________________________________________________________________ Table of Contents Stop the Government From Building Big Brother Into The Internet What You Can Do -Please contact four leading members of Congress Background About This Alert _________________________________________________________________ STOP THE GOVERNMENT FROM BUILDING BIG BROTHER INTO THE INTERNET In 1948, George Orwell described a future world in which Big Brother peaked over the shoulder of every citizen -- watching every move and listening to every word. Now, in 1997, the FBI is pushing the United States Congress to pass legislation which would make George Orwell's frightening vision a reality. Next week the House Commerce Committee will meet to consider a proposal that would require all Americans to provide the government guaranteed access to their private online communications and business transactions. Taking a page out of Orwell's 1984, the FBI-spawned proposal would require that every part of the Internet -- from the software on your computer to the network provider that carries your messages around the net -- be jury-rigged to divulge your private conversations immediately on request by the FBI (see below). Unfortunately, this is not a work of fiction. The amendment, to be offered by Representatives Mike Oxley (R-OH) and Thomas Manton (D-NY), is a serious threat to your privacy and represents the first and final step in the construction of a National Surveillance Infrastructure. A vote is expected on September 25. The future of privacy and security in the information age is in the hands of the Commerce Committee, and they need to know that folks are watching and care about the outcome. On Monday September 22, please join thousands of Internet users all across the country as we call on Congress to stop big brother. With your help and support, we can ensure that George Orwell's 1984 does not become a reality. All the information you need is attached below. _________________________________________________________________ WHAT YOU CAN DO 1. ON MONDAY SEPTEMBER 22, pick up the phone and call as many of the four leading members of the Commerce committee as you can: Chairman Thomas Bliley (R-VA) (202) 225-2815 Ranking member John Dingell (D-MI) (202) 225-4071 Rep. Tauzin (R-LA) (202) 225-4031 Rep. Markey (D-MA) (202) 225-2836 2. Ask for the staffer that handles the encryption issue. 3. Say that you're calling to urge the Congressman to pass SAFE (HR695) without amendments. Specifically, say that you "OPPOSE THE OXLEY/MANTON BIG BROTHER AMENDMENT. Americans should not be required to give the government keys to the front door of their house, and they shouldn't be required to give the government the keys to unlock their private online communications." Other amendments may be proposed. Please urge the Congressman to pass SAFE "as is" and oppose any amendments. Feel free to use your own words though here are some points you might want to stress: - Oxley/Manton is a dramatic expansion of law enforcement power. It would give law enforcement "immediate" access to private online communications and business transactions without any notice or knowledge to the user. - Oxley/Manton is NOT A BALANCE BETWEEN PRIVACY INTERESTS AND LAW ENFORCEMENT CONCERNS, as some supporters have argued. It gives the FBI broad new power while stripping Americans of their Fourth Amendment right to be secure from unreasonable searches and seizures. - Oxley/Manton would give the Attorney General authority to dictate the design of Internet services and software to suit the needs of law enforcement. - Oxley/Manton would not stop crime. Strong encryption without "immediate access" features is available today at home and abroad. - Oxley/Manton would increase opportunities for cybercrime as criminal hackers attack vulnerabilities in the key recovery access system. 4. Let us know how it went! Go to one of the following web pages, depending on who you called, and tell us about the conversation. Rep. Bliley http://www.crypto.com/member/meet.cgi?membid=va07 Rep. Dingell http://www.crypto.com/member/meet.cgi?membid=mi16 Rep. Tauzin http://www.crypto.com/member/meet.cgi?membid=la03 Rep. Markey http://www.crypto.com/member/meet.cgi?membid=ma07 5. Forward this ALERT to your friends and colleagues. 6. Feel good about yourself! Know that you've stood up for privacy, and contacting Congress is more than most people take the time to do! _________________________________________________________________ BACKGROUND The House Commerce Committee is considering a bill known as the "Security and Freedom through Encryption Act" (HR 695, a.k.a. SAFE). SAFE would encourage the widespread availability of strong, easy-to-use encryption technologies in order to protect privacy and promote electronic commerce on the Internet. SAFE enjoys broad support from Internet users, civil liberties advocates, and over 250 members of Congress. Last week, the Commerce Committee delayed its vote on the SAFE bill in order to give the Committee more time to study the implications of the Oxley/Manton amendment, which would change SAFE to ban encryption which does not contain features that provide law enforcement with "immediate access" to the plain text of encrypted information, including private communications and business transactions (visit http://www.crypto.com/safe_bill/) The Oxley/Manton amendment would for the first time impose sweeping restrictions on the ability of American citizens to protect their privacy on US soil. Specifically, the amendment would: * PROHIBIT THE DOMESTIC MANUFACTURE AND SALE OF ENCRYPTION PRODUCTS OR SERVICES WHICH DO NOT PROVIDE INSTANT ACCESS FOR LAW ENFORCEMENT: The proposal would prohibit the manufacture, sale, import, or distribution within the United States of any encryption product unless it allows "immediate access" to the plain text of any user's messages or files without the user's knowledge. * GRANT BROAD NEW AUTHORITY FOR THE ATTORNEY GENERAL TO SET TECHNICAL STANDARDS FOR ENCRYPTION PRODUCTS: The proposal allows the Attorney General to set standards for what are and are not acceptable encryption products. The proposal's requirement of immediate access to plain text would seem to seriously limit the options available to encryption manufacturers seeking approval of their products. The amendment does not specify whether the immediate access "features" could be activated (or not) at the option of the purchaser or end user. Nonetheless, requiring that such a capability be installed in all domestic communications networks and encryption products is the equivalent of enabling a national surveillance infrastructure and asserts unprecedented control over the design of Internet software, hardware, and services. The amendment is analogous to the government requiring surveillance cameras in every new house built in the United States, which could be turned on remotely by the police if you were ever suspected of committing a crime. Worse yet, such "key escrow" or "key recovery" technologies pose significant risk to the security of the Internet -- providing new points of vulnerability for hackers, terrorists, and industrial spies to exploit. A recent study by 11 of the worlds leading cryptographers concluded that the large scale deployment of such technologies would be too complex and too insecure to meet the needs of an Information Age society (see http://www.crypto.com/key_study/) Despite widespread opposition from Internet users, civil liberties groups, privacy advocates, and the computer and communications industries, Oxley and Manton plan to push for this FBI spawned amendment at the Commerce Committee vote. If it is adopted, it would represent the first and final step in the development of a national surveillance infrastructure. _________________________________________________________________ ABOUT THIS ALERT This message was brought to you by the Center for Democracy and Technology (http://www.cdt.org) the Voters Telecommunications Watch (http://www.vtw.org/) the Electronic Frontier Foundation (http://www.eff.org/) Wired Magazine (http://www.wired.com/) and Americans for Tax Reform (http://www.atr.org/) who have joined together on this alert. _________________________________________________________________ end alert 09.18.1997 net ===========================================================================

1 0

No Subject
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Fri, 10 Nov 1995 11:52:41 -0800 >From: Bill Stewart <stewarts(a)ix.netcom.com> >Subject: Re: coding and nnet's >Schneier's 2nd edition says "Neural nets aren't terribly useful for >cryptography, primarily because of the shape of the solution space. >Neural nets work best for problems that have a continuity of >solutions, some better than others. This allows a neural net to >learn, proposing better and better solutions as it does. Breaking an >algorithm provides for very little in the way of learning >opportunities: You either recover the key or you don't. (At least >this is true if the algorithm is any good.) Has anyone tried using neural nets or similar techniques for searching for useful nonrandom properties of the round functions of block ciphers or hash functions? This might be useful in trying to prepare some new kind of attack, find a balanced binary function that is useful in using the generalization of linear cryptanalysis discussed by Harpes, Kramer, and Massey at Eurocrypt '95, find a better "difference" function for use in a differential attack, etc. >Neural nets work well >in structured environments when there is something to learn, but not >in the high-entropy, seemingly random world of cryptography." And he >doesn't give any references. Merkle's paper on Khufu and Khafre addresses this idea, I think. Merkle comments that it's not going to be useful against a full cipher, but that it might be useful against (say) Khufu with one or two octets. ># Thanks; Bill ># Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com ># Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKhv1UHx57Ag8goBAQE5IAQAtV3GTqZO08WwHDJSI3Dj2NgIu7rQPrUH V5vBCWTCvRsVNt07K8FbKMxPhF+QmXINPlOEMn4qZbhph0oyf/zAj3uV+6yzO3Eg FMXrZzc1zOOdcfp9IcMvoXvd/av9zq/jH6Sn6yZB3jTO42ENeSSLNbxtaBrzgABl zPklYWOnDrw= =x3kP -----END PGP SIGNATURE-----

1 0

Re: y2k as ideological opportunity
by Blanc 17 Dec '03

17 Dec '03

In behalf of the Union of Unorganized Programmers, VZ Nuri-logical wrote: >when the government finds itself in a crisis. it is >true at the current rate it looks dismal for the govt to >fix the problems in time, but govt has huge amounts of >monetary resources to throw at problems when it wants to. >does anyone have any idea how much cash sloshes around in >defense industries? ..................................................... On the PBS daily economics news report the other day, and an economist was warning that this y2k problem could lead to a recession (don't remember if he said it would be mild or what). This is a possibility that the rest of us ought prepare for (guess I'll have to see what Harry Brown has to say about it). .. Blanc

1 0

Re: coding and nnet's
by daw＠delhi.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199511111800.NAA23831(a)jekyll.piermont.com>, Perry E. Metzger <perry(a)piermont.com> wrote: > > > Perhaps neural nets could be used in an unknown plain text, brute force > > attack to automatically select possible decryptions for human examination. > > I don't know of any papers on the subject. > > I remember seeing a good paper by our own David Wagner on how to do > this without anything more than some ordinary statistics -- no > complicated junk required. David, if you are reading this, could you > comment? > Check out http://www.cs.berkeley.edu/~daw/recog.ps for a paper by Steve Bellovin & me on doing plaintext recognition with ordinary statistics. It has nothing to do with neural networks, though.... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMKZvoCoZzwIn1bdtAQHItQGA1jD4SjC1Vg1fwCO3VLJ7v+gUlUvncwhj v2SwPURAjry2QAeWBNeL5hMJARQuQHNx =Cepa -----END PGP SIGNATURE-----

1 0

ecash in pcweek
by an407769＠anon.penet.fi 17 Dec '03

17 Dec '03

Opinion: Digital Cash Takes Step Toward Reality >From PC Week for November 13, 1995 by Bill Machrone Some people are always looking for new ways to make money. Other people are always looking for new ways to spend money. They're running headlong into one another on the Internet. Most of the digital cash and electronic commerce schemes out there are still in their infancy, but many of them are predicated on making a transaction fee off the people who want to buy things in this new, electronic medium. Making money from people spending money is hardly a shocking proposition. But all the approaches that call themselves any kind of "cash" are stretching the definition. To the best of my knowledge, cash is the thing you can spend without having it costing you a cent, so to speak. The only way you'll see digital cash without transaction costs is if a powerful but paternalistic ruling body gets into the business. That doesn't mean if Microsoft builds it into the operating system, but rather if the government gets involved and makes some form of electronic money transfer legal tender, and therefore immune to fiscal encumbrances. This isn't remotely close to happening, so don't get your hopes up. Meanwhile, things are getting pretty interesting in the real world of digital-cash transactions. Digicash (www.digicash.com) has partnered with the Mark Twain Bank to offer online shoppers a debit card-like "E- cash" account that they can fill with real money and then use either in normal purchases or microtransactions from vendors who accept E-cash. You pay a combination of setup fees, monthly fees, and money-movement fees, but the overall goal is to make the transactions painless, transparent, and anonymous. The anonymity factor is a key component of real cash and a design requirement of Digicash. It's extremely unlikely that anyone could spoof the system and spend your money; yet you can re- create your E-cash on your own machine if you have a disk crash. Portland Software (www.portsoft.com) has also attacked the issue, putting itself in the position of vendors who want to sell things electronically. Its approach, called ZipLock, is suited to selling software products on the spot but is also suitable for published content, artistic images, and fonts. It approves your credit and goes through an unlocking/decrypting routine on the spot. The ZipLock transaction is much more like a normal credit-card transaction and in fact uses the communications infrastructure built by a major credit-card clearinghouse. In effect, it transforms your PC into a point-of-sale terminal, where all you have to do is enter your credit-card number. If you're ordering software or other electronically deliverable goods, they're transmitted and decrypted on the spot. Other merchandise is delivered via the usual direct-marketing vehicles. Fees are paid by the merchant, which means that the transaction cost is built into the price. Although E-cash and ZipLock are hardly the only two electronic-payment schemes out there, their differences are instructive. Each appears to have a significant, valid role in building consumer confidence in online commerce. Bill Machrone is vice president of technology for Ziff-Davis Publishing Co. He can be reached at wmachrone (MCI Mail) or 72241,15 (CompuServe). --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Getting the ITAR
by Rich Salz 17 Dec '03

17 Dec '03

The front of the ITAR has this convenient phone number you can call to get a copy: 1 703 875 6644. I don't think anyone on this list can claim ignorance. :) BTW, as for Pegasus, please note that I didn't say the author was going to get in trouble, merely that his software is export controlled -- there's a difference. /r$

1 0

Re: Password File Utility Wanted [Win95, ha ha]
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: comp.os.ms-windows.win95.misc, alt.security,comp.security.misc) -----BEGIN PGP SIGNED MESSAGE----- In article <48888p$970(a)news.infi.net>, lestat(a)richmond.infi.net (Terry Harrison) wrote: >I would like to obtain a program to address the following..... > >I use the 'remember password' option on my network logins, and then >when they expire, I don't remember what they were. This is bad as I >need them to change the old password (particularly a problem with >Netware). What I would like is a utility that would prompt me for my >current windows ID for security, then decode the .pwl files so that I >could read my old passwords. Ideally, it would allow an edit of the >existing passwords as well. Anybody seen onea these?? Such a thing could exist, because Win95 allows you to save passwords that use different encryption methods. Microsoft would say "no, doesn't exist," however, because this is a major security flaw. I haven't seen such a tool, though. Anybody? What you should do is get a real encryption package like PGP (poke around on http://web.mit.edu/ or http://www.netresponse.com/zldf/, it's free), use something that is long and complicated but that you will never ever forget as your PGP passphrase, and encrypt a text file containing all of your passwords with PGP. You can put other stuff like all your credit card numbers in a PGP-encrypted file with reasonable safety too. You (only) will be able to decrypt and read this file whenever you want. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKgam43DXUbM57SdAQE9eQP/YY/Sv9izIoSg9gnOZUM+WQSZfkv/YDi4 oCzFerVMDFZT+7kD+w206qGjrtWUDQ3Rwie5XqlaLG3Ezhh9tpldMMPdy50K8dwI WL43SQeplXDxAESUC3Td7j2MRK5ONacfojSaSoauHW6Ffr+M2sU5opJlB+y88eTv 45VCTDn8J1I= =Qbqx -----END PGP SIGNATURE----- -- rich graves, llurch(a)networking.stanford.edu moderator of the win95netbugs list http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html

1 0

Re: coding and nnet's
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: tcmay(a)got.net 13-NOV-1995 02:25:05.47: At 11:40 PM 11/11/95, Michael Pierson wrote: >I wouldn't be surprised to learn of somebody like FinCEN using >neural-net systems to do pattern analysis on funds transfers and >the like, or the NRO or NSA investing research money into >investigating the usefulness of NNs for image processing or for >scanning raw ELIN SIGINT or COMINT data. In fact, I'd be quite >surprised if they weren't. [...] I recall reading of some contracts let out, and other RFCs, for AI programs for FinCEN use. Not surprising. (If I ran FinCEN, this is what I'd surely have a bunch of folks working on. Scary thought.) ------------------------ I find it interesting that FinCEN has a net link (at http://www.ustreas.gov/treasury/bureaus/fincen/fincen.html) I have heard about an IRS cash-tracking center in Detroit, where all those $100+ cash deposits/withdrawals get sent. They probably use similar setups for analysis, although with more of an individual focus. I have recently been contemplating how a private digital cash system (either national-currency based or private-currency based) would show up on such an analysis process. My suspicion is that it would do so via fewer known non-cash transfers. Cash transactions might actually increase, due to conversions between digital cash and normal cash. On the other hand, many of those using a private digital cash scheme may (like myself) tend to use mostly cash anyway. I am interested in hearing the thoughts of others on this subject. Particularly useful would be methods to stealth or spoof such a system; i.e., to either hide a private digital cash system from it, or to give it so many false positives that they couldn't distinguish what is real and what is not. I suggest that the latter would be easier (and would have other valuable applications). -Allen P.S. Does anyone know what is up with the extropians list? Down again, I suspect.

1 0

U.S. Exit Tax - SI
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

U.S. EXIT TAXES from Strategic Investment's Intelligence bulletins - November 15, 1995 Strategic Investment 824 E. Baltimore St. Baltimre, MD 21202-4799 Published monthly for U.S. residents at US$109 per year. Republicans add barbed wire to Clinton's "Berlin Wall." SI accurately forecasted the coming of the "exit" tax proposed by the Clinton Admin- istration earlier this year. Now Senate Republicans have passed an exit tax that is even more punitive than that proposed by Clinton. Section 12441(b) of the Balanced Budget Reconciliation Act of 1995 (H.R. 2491) adds a new layer of confiscatory taxes, succession taxes, to be imposed upon U.S. citizens and residents. Unlike gift or estate taxes, which are imposed upon the giver or his estate, succession taxes are imposed upon the recipient of bequests. Under the Senate proposal, succession taxes would be levied upon property acquired by gift or inheritance from a former U.S. citizen or former long-term resident of the U.S. who leaves U.S. tax jurisdiction after February, 1995. This tax would make it finan- cially more punitive for an American to renounce his citizenship unless his entire family came along. It would also make unattractive for foreign- ers with close U.S. relatives to take up residence in the United States. The would be subject ot confiscatory exit taxes upon leaving. (Questions arise - is there any legislation that Congress can't pass or attempt to pass? Aren't Republicans supposted to be an alternative to Democrates?) - GLJ

2 1