December 2003 - cypherpunks-legacy

OpSec Snooping
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Economist, 27 January 1995 Licence to make a killing Spies and fund managers seem to be cut from the same cloth. Both take calculated risks, are fickle when it comes to allegiances and have an annoying tendency to speak in code. More important, however, they both thrive on inside information. This may be why, in the headlong rush to exploit new emerging-market opportunities, a growing number of investment funds are turning to former spooks for some help. The latest fund to tap the know-how of the intelligence community is the Scottish American Investment Company, based in Edinburgh, which invests heavily in international equities. On January 17th it announced that Sir Colin McColl, the former head of M16, Britain's foreign-intelligence service, is joining its board of directors. The fund hopes that Sir Colin's experience in gauging political risks -- he has worked in Eastern Europe and SouthEast Asia -- will improve the quality of its investment decisions. Another ex-spy turned fund manager is Harry Fitzgibbons, a former American agent and now managing director of Top Technology Limited, a fund-management group based in London. Last year, he teamed up with Alexey Vlasov, a former Soviet agent, to launch a new high-technology fund for investment in Russia. It employs three other former Soviet agents in its St Petersburg office. Why are spooks so sought after by international investors? The reason, says Mr Fitzgibbons, is that spying is the ideal training ground for a career in emerging-market investing. Not only are intelligence agents good at spotting when someone is lying, but they are also experts at building relationships and waiting patiently for them to develop: two essential traits for successful long-term investors. Mr Fitzgibbons argues that it is these general skills, rather than any specific local knowledge, that makes former spies such attractive partners. Unfortunately, old adversaries do not always get on as swimmingly as Messrs Fitzgibbons and Vlasov. In 1994, for example, the Vietnam Frontier Fund invited William Colby, a former director of America's Central Intelligence Agency, who headed the agency's Vietnam station during the Vietnam War, to join its board of directors. His appointment prompted the fund's chairman, Nguyen Xuan Oanh, a former deputy prime minister of South Vietnam, to quit. Not only did the fund lose its chairman, but it was unable to take advantage of Mr Colby's experience: he left the board in December 1994 after Hanoi refused him a visa. Despite such drawbacks, the demand for former spooks is rumoured to be growing. One such hint comes from Parvus, a consultancy (with offices in Moscow and Silver Spring, Maryland) that employs a number of ex-spies. The firm claims that it has just been contacted by a headhunter looking for recruits. The mission, should anyone choose to accept it, is to head up a new intelligence unit for a big New York mutual fund. Unfortunately for potential applicants, the headhunters say that the fund's name is still top secret. ------------------- For more on Parvus (not the Utah corp) and its stable of ex-spooks see: URL: http://www2.indigo-net.com/Indigo/INT/INTpublic/1995/ INT275/INT275-a3.html and other AltaVista links to globalization of OPSEC. ------------------- URL: http://www.cais.com/zhi/OPSHomePage.html OPERATIONS SECURITY PROFESSIONALS SOCIETY The OPSEC Professionals Society was established in March 1990 to further the practice of Operations Security as a profession and to foster the highest quality of professionalism and competence among its members. OPSEC is a process used to deny to potential adversaries information about capabilities and/or intentions by identifying, controlling and protecting evidence of the planning and executing of sensitive activities. This process is equally applicable to government, its contractors, and to private enterprise in the protection of their trade secrets and other proprietary information. While military strength and capability still are required during the next years of uncertainty, we must likewise protect our critical economic information and technologies from those who seek to exploit them to their benefit and to our disadvantage. -------------------- URL: http://www.cais.com/zhi/OPSCIND1.html COUNTERINTELLIGENCE NEWS & DEVELOPMENTS Issue No. 1 Letter from the Director, National Counterintelligence Center I am pleased to present the inaugural issue of the National Counterintelligence Center's (NACIC) Counterintelligence News and Developments (CIND). This periodic publication is designed to meet the information needs of US private industry by communicating important, yet unclassified information on the threat posed by foreign countries against US interests. The CIND is part of the NACIC's effort to develop a more effective mechanism to disseminate information on foreign intelligence targeting activities against both the US Government and private industry. This initial issue includes some information you may have already seen in our Annual Report to Congress on Foreign Economic Collection and Industrial Espionage and the Survey of the Counterintelligence Needs of Private Industry. From time to time, we will republish or extract information from such key publications to highlight data we perceive to be of interest to private industry. Furthermore, we will solicit additional information from all sources in order to better understand and support private industry through this unclassified forum. The NACIC will not generally republish information readily available to the general public. Our goal is to make the CIND's contents substantive and relevant to customer needs. Therefore, I cannot overemphasize the importance of receiving feedback from each of you. Future issues will respond to the requirements of industry as a whole and will be driven by your needs and interests. The responses received from you, the customer, will determine the future content, format, and frequency of the CIND. The final page of the current edition provides information on how to forward responses to the CIND Editor. Michael J. Waguespack Director, National Counterintelligence Center _________________________________________________________________ What Is the NACIC? The National Counterintelligence Center (NACIC) was established in 1994 by Presidential Decision Directive/NSC-24. The NACIC's creation was one of the recommendations made by PDD-24 to improve US counterintelligence (CI) effectiveness by enhancing coordination and cooperation among various US CI agencies. An interagency organization staffed with CI and security professionals from the FBI, CIA, NSA, DIA, and the Departments of Defense and State, the NACIC is primarily responsible for coordinating national-level CI activities, and reports to the National Security Council through the National Counterintelligence Policy Board (NACIPB).

2 1

Re: Belgium has 'key escrow' law
by cman＠communities.com 17 Dec '03

17 Dec '03

I should also point out that Belgium apparently has crypto export laws of sufficient complexity to inspire me to look elsewhere when attempting to purchase a hardware encryption board from a Belgian company (uti-maco). Said company also was under the mistaken belief that I needed a US _import_ license; my failed attempts to persuade them otherwise was the final kicker. ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

2 1

RANT: When hi-tech is a hinderance (freedom w/in limits)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

A short 'rant' on techno-dinosaurism... Saw a blurb on CNN last night about computerized missiles that would defeat jamming devices and analyze the type of target and configure their warheads appropriately. All that I could think of is what an expensive waste of computing machinery... is the cost of a "genius bomb" (assuming it does actually work, unlike the Patriots in Gulf War) worth while? Wouldn't it be better to use a lot of dumb bombs that launch several millions of dollars apiece at a tank or bit of artillery? I'm reminded of the tech they used to detect guerrillas in Vietnam... sensors that went off when uric acid (?) was present so the VC would pis in buckets and walk away, making the sensors go wild... the US put a lot of effort into bombing pis buckets. Or look back to the 13th century when European soldiers were high-tech wearing tons of armor and used cross bows. it was imposing high-tech for the time, but they couldn't move fast or fire arrows quickly... and they were skagmeat for Mongols who were comparatively low-tech. Cypherpunks or crypto relevance? Sometimes high-tech can be a weakness. I've heard that the Soviets, not having the luxury of sexy Crays and whatnot, were adept and using hundreds of PCs to do their cryptanalysis... and so may have a lot of interesting parallel processing algorithms. To paraphrase Miles Davis, creativity is "freedom within limitations".

1 0

This post is rated LTC for `Low Technical Content'
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Time: 01/27/96 02:19 am ## Subject: This post is rated LTC for `Low Technical Content.' ] >Date: Thu, 25 Jan 1996 18:04:21 -0800 >From: tcmay(a)got.net (Timothy C. May) >Subject: Re: "This post is G-Rated" >I see self-ratings of Usenet and mailing list posts as possible, >just nearly worthless. And the reall contoversial stuff, this kind >of goddamned fucking shit, will not get screened out. After all, I >voluntarily rated this thread "G," and look what got through! (And >it's only the tit of the iceberg, so to speak.) The best solution has always seemed to me to be one of these three: a. Tags appended to notes/posts, from various reviewers, digitally signed and otherwise coded to allow intelligent filtering, or b. Electronic distributions of reviewers' evaluations tagged to notes in some simple way. (I.e. give each note or post a unique ID which appears in the message.) Then, a smart newsreader/mail program sorts the notes accordingly, or c. The reviewer reads the group/list, and rates posts according to some useful criteria. He then resends it out to his users, filtered as desired. (CP-LITE seems like a very early version of this.) Any of these can be pretty easily ported to that magical set-top box we hear so much about (no doubt running Windows '05). In many ways, (a) and (b) are easier. >A meaningful "parental filter" cannot be done on-the-fly with >self-ratings. Some minor steps can be taken, but not all worth the >expense and hassle of a mandatory system. Actually, I think in practice this will mean that programs get a given rating, which is renewed every so often. You don't rate Melrose Place episode #89, you rate the entire series. This whole idea offers two wonderful opportunities to control content on TV. First, get the TVs shipped with the V-chip filter turned on. Most people don't bother setting their VCR timers, and they also won't bother setting this unless it denies them access to lots of shows they like. And, if turning the filter on and off is hard enough to actually keep the average 12-year-old out, then it will be hard enough that many families with kids will simply never change its setting. They may even forget or lose the PIN that allows them to do so. This means that you have a sizeable audience who depend on this rating system, the only one readily available. Second, apply pressure to television networks in whatever ways necessary, by threatening a re-evaluation of their top-rated shows. After all, ER really is a little gory for kids to be watching. Oh, you've decided to spend less time on covering the losses in the great Bosnian Peace Initiative? Well, I suppose a little real-life drama won't hurt anyone. If the V-chip is used widely at all, this represents a really useful threat. What happens to the network executive who gets ER to lose half its audience, even just for a few weeks while a review board takes up the network's appeal? >--Tim >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQrIiUHx57Ag8goBAQGhIAQA2F3guHlTnebja5fcGwEwOKx3CwdhAs90 zn6Di+nztSoGt6JF2kIC60zsfVHgQ//RJcMtuiFzBsQoTn/E56JM2mZ4vJpsfipO lVbKlZ1HylDyGLcF/pBllBVfvmXLjpvu0OXkFt3yqEohjaNlF7l49bOz28ngLv/A CATYZGlDP64= =6BO+ -----END PGP SIGNATURE-----

1 0

The Press
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:25 AM 1/28/96, Mark Allyn (206) 860-9454 wrote: > >I would like to make a suggestion that D. Denning; others >who are pro-escrow/clipper; and some of you folks here on >this forum get together for a debate. There have already been several debates about Clipper. I recall one at George Washington University, in D.C., with Prof. Lance Hoffmann as the moderator, and the usual suspects on each side (Denning representing Clipper, one or more of the EPIC/EFF/CPSR/ACLU folks on the other side). Didn't change a lot of views, I suspect. And I'll bet a hundred bucks that not a single Congresscritter saw the debate, either live (of course not) or on C-SPAN (assuming it was carried). And there was an IRC "town meeting" with DRD herself, though I don't recall the details. My point was that few cryptographers and computer scientists actively support the pro-control, pro-GAK position, not that we need more meaningless debates with Dorothy Denning, Donn Parker, and Stuart Baker. >Ideally, this would be real nice on a TV show such as the >McNiel Lehrer show on PBS. Barring that, I would think >that an IRC chat channel could be set up so that they >could get on line and engage in an on line discussion. Absolutely not enough time. The News Hour with Jim Lehrer could only devote at most 20 minutes to such a story. Hardly enough time to even explain the issues to a public which has no idea whatsoever what PGP stands for, or what key escrow means, etc. (Consider how many hours a week of reading this list and other sources it took before you, the reader, knew which end was up.) And if the News Hour _did_ do such a report, they'd look to the canned experts they have in their backyard: the EPIC/CPSR/ACLU Washington staffers. When major media outlets send a film crew out to California it's usually to get crowd shots of those whacky "Cyberpunks" arguing about privacy. "Is the head dead yet?" But, of course, I would never discourage anyone from talking to the local media. Maybe it will help. Sure. Fine. Whatever. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: "Gentlemen do not read each other's mail"
by James M. Cobb 17 Dec '03

17 Dec '03

Rich, On 01 26 96 you say: ...the US might have received credible reports that Pearl Harbor was going to be bombed. But they also received cred- ible reports to the contrary, and decisions were made. Bamford's 1983 The Puzzle Palace, page 57: In December 1941 American COMINT [communications intelli- gence] more closely resembled a medieval feudal state than the empire it is today. P 58: The system was a hodgepodge. No one was responsible for a continuous study of all material. *** Though the technical side of COMINT, particularly in the breaking of Purple, had been performed with genius, the analytical side had become lost in disorganization. That's the background. Then Bamford step by step follows the events of the first Sunday in December 1941 FROM (p 58) interception of the Japanese government reply to the US government "diplomatic note" [=declaration of war] sent 11 days before calling "on Japan to withdraw all its forces from China and Indochina in return for a U.S. promise to release Japanese funds and resume trade" TO (p 61): At 7:55 A.M. [Hawaii time], the first bomb smashed into a sea- plane ramp on Ford Island in Pearl Harbor. Before the last bomb whistled down through the black and orange sky two hours later, Americans would give their lives at the rate of almost thirty a minute. A note accompanying the Japanese government reply included these prophetic words (p 59): Will the Ambassador please submit to the United States Govern- ment (if possible to the Secretary of State) our reply to the United States [breaking off negotiations] at 1:00 P.M. on the 7th, your time. 1 PM Washington time = 7:30 AM Hawaii time. Bamford, p 60 (my emphasis): It was now about 11:00 A.M. [in Washington], almost six hours after the giant ear on Bainbridge Island had first snared the prophetic message, and ALL OF WASHINGTON'S SENIOR ELITE HAD READ IT. P 61: At 2:40 P.M. [Hawaii time] the [Ft Shafter] signal officer passed [Army Chief of Staff Marshall's warning] message to the decoding officer, and twenty minutes later,...Marshall's warning at last reached a devastated General Short. The credible report was received at 7:55 AM Hawaii time. The incredible report was received at 3 PM Hawaii time. One decision was made 11 days earlier. Another was finalized 10 days later. Bamford dryly concludes (p 62): Disorganization and divided responsibility had cost America dearly. Cordially, Jim

3 2

Re: RANT: When hi-tech is a hinderance (freedom w/in limits)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:48 AM 1/28/96, Anonymous wrote: >A short 'rant' on techno-dinosaurism... ... >Cypherpunks or crypto relevance? Sometimes high-tech can be >a weakness. The canonical story being Arthur C. Clarke's "Superiority," said at one time to have been required reading at MIT. >I've heard that the Soviets, not having the luxury of sexy >Crays and whatnot, were adept and using hundreds of PCs to >do their cryptanalysis... and so may have a lot of interesting >parallel processing algorithms. I'm skeptical. Sun Microsystems did indeed buy up a bunch of Russian programmers, a couple of years ago. Haven't heard anything come out of this. And loosely-coupling PCs, for a task such as Anonymous describes, does not sound like terribly good preparation for other tasks. No point in speculating further, as the speculations and counter-speculations are underdetermined. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: This post is rated LTC for `Low Technical Content'
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:55 PM 1/27/96 -0500, JMKELSEY(a)delphi.com wrote: >The best solution has always seemed to me to be one of these three: > >a. Tags appended to notes/posts, from various reviewers, digitally >signed and otherwise coded to allow intelligent filtering, or > >b. Electronic distributions of reviewers' evaluations tagged to >notes in some simple way. (I.e. give each note or post a unique ID >which appears in the message.) Then, a smart newsreader/mail >program sorts the notes accordingly, or > >c. The reviewer reads the group/list, and rates posts according to >some useful criteria. He then resends it out to his users, filtered >as desired. (CP-LITE seems like a very early version of this.) d. The "V-Chip" device makes a network query to the selected rating service to ask for a rating. What happen when the rating service is unreachable is just one of the many parameters that the parent needs to set. (If designed right, no parent could use it, but its availability would still stop the adult censorship croud in congress.) This approach as the advantage that the communications costs accrue to those using the feature and not to everyone else. A disadvantage is that each content item needs some ID. Bill

2 1

Re: RANT: When hi-tech is a hinderance (freedom w/in limits)
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:48 AM 1/28/96 +0100, Anonymous wrote: >Cypherpunks or crypto relevance? Sometimes high-tech can be >a weakness. You don't know how right you are. Jim Bell Klaatu Burada Nikto "Something is going to happen. Something.....Wonderful!" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQrhZvqHVDBboB2dAQFKZAP/U6tKRFYbMmag6wB/HEO/K8XxsSUFr5dt 9sMaeptBa2EEvn2f4rrlZ9AadKTEX8qhd9VI3gF+XfsZ8tVnfK7FSvdeteoN7iBB tVPfXgozxLWqKFUe1YoYIKJof9c5q4IPNkOaWCUAiMbOiA8BrhYLPUOISkC0W5f8 0yse7fmFA1w= =0Fe9 -----END PGP SIGNATURE-----

1 0

Re: This post is rated LTC for `Low Technical Content'
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:36 PM 1/27/96 -0800, Rich Graves wrote: >On Sat, 27 Jan 1996, Bill Frantz wrote: > >> At 7:55 PM 1/27/96 -0500, JMKELSEY(a)delphi.com wrote: >> >The best solution has always seemed to me to be one of these three: >> > >> >a. Tags appended to notes/posts, from various reviewers, digitally >> >signed and otherwise coded to allow intelligent filtering, or >> > >> >b. Electronic distributions of reviewers' evaluations tagged to >> >notes in some simple way. (I.e. give each note or post a unique ID >> >which appears in the message.) Then, a smart newsreader/mail >> >program sorts the notes accordingly, or >> > >> >c. The reviewer reads the group/list, and rates posts according to >> >some useful criteria. He then resends it out to his users, filtered >> >as desired. (CP-LITE seems like a very early version of this.) >> >> d. The "V-Chip" device makes a network query to the selected rating service >> to ask for a rating. What happen when the rating service is unreachable is >> just one of the many parameters that the parent needs to set. (If designed >> right, no parent could use it, but its availability would still stop the >> adult censorship croud in congress.) > >This just gets ridiculous. It adds a lot of overhead without necessarily >giving you good information. ... <lots of good rant deleted> Rich - Remember that this is NOT being designed for usability, only to stop a bad movement in congress. The reason I proposed solution (d) is that it adds no overhead to people who don't use it. (I propose using the Message-ID: header as a lookup ID for items received by email. I suspect it has spoofing problems, but perhaps congress won't notice.) Perhaps we should re-visit the need for usability if anyone really wants to use such a system themselves. As a parent, I always wanted my children to explore freely and discuss anything they found that bothered them. Bill

1 0