December 2003 - cypherpunks-legacy

fcpunx subscribe
by Wendy Fu 17 Dec '03

17 Dec '03

Wendy Fu, Network Manager St. John's University School of Law 8000 Utopia Parkway, Jamaica, NY 11439 E-Mail Address: wfu(a)sjulaw.stjohns.edu Phone: (718)990-1666

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>> INFORMATION IS INSECURE THE MOMENT YOU TOUCH A KEY. > >> This does not mean that Internet commerce is dead. Any scheme that is >> not based on self-identifying one-way financial instruments such as >> credit cards will be essentially unaffected by this problem. Moreover, >> even credit cards may be made safe on the Internet using one of two >> approaches: secure hardware add-ons and the First Virtual approach. etc. My name for this kind of software: Terminate and Stay Clueless ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Although this particular request was sent to the cypherpunks mailing list, others continue to send requests to my mailbox. >>>>> "Wendy" == "Wendy Fu" <WFU(a)sjulaw.stjohns.edu> writes: Wendy> endWendy Fu, Network Manager Wendy> St. John's University School of Law Wendy> 8000 Utopia Parkway, Jamaica, NY 11439 Wendy> E-Mail Address: wfu(a)sjulaw.stjohns.edu Wendy> Phone: (718)990-1666 I don't know how my address got associated with this list, but please, *do not* send requests about FCPUNX to steve(a)miranova.com. Requests about how to set up Gnus scoring for performing your own filtering of the cypherpunks list are welcome. -- steve(a)miranova.com baur Unsolicited commercial e-mail will be proofread for $250/hour.

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: >If the Privacy Act were rewritten to be as strict as the BDSG, businesses >would have a (mandatory) legal requirement to: > >o Ensure that personal data is stored properly (by encrypting it, etc) >o Ensure that personal data is not distributed >o Ensure that databases are *not* being maintained which describe the > characteristics of individuals (buying habits, income, property > ownership, etc) wantonly propagated by marketing (direct mail, > telemarketing, etc) companies. > Unfortunately, it would also: * Require government registration of computers and databases containing information about people (whether these computers are used by business or individuals). This eases regulation of computers and future confiscation. * Reduce market efficiency by making it harder to match buyers and sellers (because neither could easily find out about he other) thus causing higher prices and poorer people. * Do nothing to protect personal information from the government which would get to collect more of it than ever in the course of enforcing data protection laws. If you don't want people to know things about you, don't tell them. DCF

2 1

IMC Resolving Email Security Complexity Workshop
by abarrett＠ee.net 17 Dec '03

17 Dec '03

Found this in the box the other day - thought it might be of interest, esp regarding secure email standards. Warmest regards, AJ <---- Begin Forwarded Message ----> Return-Path: dcrocker(a)brandenburg.com Date: Tue, 23 Jan 1996 10:20:50 -0800 To: (potential attendees) From: Dave Crocker <dcrocker(a)brandenburg.com> Subject: IMC Resolving Email Security Complexity Workshop This is a query of your interest in participating in a working meeting. As an initial activity of the newly-formed Internet Mail Consortium, we are hoping to use the coincident timing of EMail World in San Jose and the ISOC Security Conference in San Diego to call for an all-day meeting on the matter of email security. (If you aren't familiar with the IMC, please check out info(a)imc.org or <http://www.imc.org/>.) This note is intended as a pre-announcement and a solicitation for feedback concerning your interest. We'd like to get a sense of the number and range of folks who might/can/will attend. We do not yet have logistics or finances fully worked out, but the timing pressure is tight enough to warrant this letter before the official announcement. Comments about the activity and, especially, an indication of availability, willingness, and (best of all) intention to attend would be highly welcome. Please pass this note on to others who you think are (or should be) interested in email security. Specifics As its first activity, the Internet Mail Consortium proposes to organize a one-day workshop to consider the problem of multiple MIME-based security mechanisms. This is a complicated topic with a long and painful history, but the previous pain is insignificant when compared to what is emerging for vendors and, worse still, for users. Our proposal is to conduct an open meeting with attendance by principals and others involved in this area of work. We will invite the key contributors and solicit additional attendance by vendors, providers, users, and technologists who are concerned with email security. The attendance goal is to have a critical mass of those with the technical expertise and industry involvement to review and debate the requirements, capabilities, and possibilities. The work goal is to seek common ground for a common solution. While we are not overly hopeful that the end of the day will see peace and resolve among the masses, we do hope for a large amount of improved understanding and some amount of convergence. With luck, there will even be improvement in the clarity of constituency for the different technical choices -- that is, a strengthening of the political base for some of the alternatives. We would like to hold the event: Wednesday, 21 February 8:30 am - 5:30 pm (all day) (Near) EMail World event, San Jose Convention Center, CA. This is the last day of EMail World and the day before a two-day ISOC Security conference in San Diego. We propose to structure the meeting with a tight agenda, having a very focused sequence of work on the problem; this is definitely not for general education. Some amount of review is appropriate, but not much. Attendees will be expected to be knowledgeable in the basic technologies, so that only general systems design and specific algorithm choices need to be cited. To help everyone prepare, the Internet Mail Consortium will organize a set of mail-response and Web pages with references and summaries of the current technologies, and will establish a mailing list for exchanges leading up to the meeting. Proposed Agenda Morning Brief descriptions of the candidate solutions Review of the functional and technical requirements Review the extent to which each alternative satisfies the requirements Seek consensus about the requirements Afternoon Haggle about the strengths and weaknesses of the technical alternatives Explore the choices and/or negotiate a preferred solution Those who have worked on this topic in the IETF are quite tired of the whole situation, but the unfortunate reality is that the current product and user choices are quite problematic. We need to continue seeking a viable service. We expect to charge $50 per person, to cover basic costs. I should have more details about this next week. Please do let us know your comments. Thanks! d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. dcrocker(a)brandenburg.com Sunnyvale, CA 94086 USA http://www.brandenburg.com <---- End Forwarded Message ----> __________________________________________________________________ Out the buffer, | PGP encrypted e-mail preferred. Through the com port, | Finger for Public Key. Over the POTS line, | Also available on a key server near you. Into the NT Box, | Up the fractional T1, | Key ID: 0X457AA6BD Onto the backbone, | Keyprint: 99 C7 17 3B 32 08 3F 17 Nothin' but 'Net. | F4 A9 42 A9 2F BC 39 B1 ------------------------------------------------------------------

1 0

attila sez
by paralax＠alpha.c2.org 17 Dec '03

17 Dec '03

On Date: Mon, 5 Feb 1996 06:49:57 +0000 (GMT) a> attila sez: a> It is not whether paralax does not know shit from beans, but that a> he proves to all that he would prefer to censor TCMay and James A. a> Donald than listen to their opinions, despite the fact he posted his a> own rather trivial and absurd point. a> political correctness and the liberal news intrepretations of "all I seek to censor no one. I prefer to confront racisim whenever and wherever I see (read) it. Mr. May embarassed himself with his denigrating application of the word "Jap" to describe the Japanese people after demonstrating a gross lack of knowledge and sensitivity about Jews. It is NOT a matter of "political correctness" unless YOU and Mr. May believe refraining from addressing an African-American as a nigger the moral equivalent of sucumbing to "politcal correctness". a> with this, I suppose I have been entered upon your "list" of a> enemies of the 'statist' nation along with TCMay and James A. Donald, All three of you would be flattering yourselves if any of you thought you made anybody's list. A. Paralax View

1 0

Re: FV's blatant double standards
by John Pettitt 17 Dec '03

17 Dec '03

At 09:26 AM 2/4/96 -0500, Simson L. Garfinkel wrote: >At 8:18 AM 1/31/96, Rishab Aiyer Ghosh wrote: >>FV demonstrated, through it's "card sharp" or whatever, that >>real-time transactions are vulnerable to sniffers on the recipient's >>own machine. Of course. We all knew that. But the mistake is to >>assume that FV isn't _equally_ vulnerable to that threat. If you >>can write a trojan that will somehow get privileged access to my >>machine, trap my keystrokes, and identify my credit card number, >>you can certainly write one that will, sitting on my machine: >> "intercept the user's electronic mail, read the confirmation >> message from First Virtual's computers, and send out a fraudulent >> reply" >>(to quote from Simson's article). Simson further quotes FV's Lee >>Stein: "A single user can be targeted, Stein said, but ''it is very >>difficult. . . . There are too many packets moving . . . to too many >>different machines.''" - which is of course equally true for real-time >>Netscape transactions. > >Oh, I think that such a program can be written. However, it would be much >harder to get right, considering all of the different ways that people read >e-mail. > > The code looks something like this: 1) hook into the winsock and look for an FV message in the web data stream, save the ID. 2) now look for an approve/deny/fraud, when you see one you know that the user uses an IP connection for mail and web. 3) Forward the ID to an anon box. 4) Look for outbound FV messages with 'fraud' or 'deny' and change to 'approve'. Clearly this will miss AOL, CI$ etc al but thats not important. The issue is not FV noticing the error, they will, it's how long it takes and how much you can steal in the interim. There is a Helen Keller quote I'm rather fond of which starts: "Security is mostly a superstition ..." *If the machine is not secure all bets are off* The most likly failure vector for this attack is that so few people use FV :-) John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2

TWP on Indecency Protest
by John Young 17 Dec '03

17 Dec '03

The Washington Post, February 5, 1996, p. A8. Language on 'Indecency' Sparks Telecommunications Bill Protest By John Schwartz Provisions in the overhaul of the nation's telecommunications laws that call for regulating adult materials on the Internet have sparked a storm of anger and protest on that medium. "This is the kind of legislation you'd see from a lot of senators and congressmen who have never logged on," said Michael Godwin, staff counsel for the Electronic Frontier Foundation, a civil liberties group. "The Christian Right thinks they've hit a home run here, but the inning isn't over." The provisions, proposed by Sen. J. James Exon (D-Neb.), have gained momentum with support from religious conservative organizations. The legislation would make it illegal to make "indecent" material available to minors via computer, with penalties of two years in prison and up to $250,000 in fines. Exon called passage last week "a victory for children and families," adding, "We've come to a successful closing of the 'peep show' doors to our youth." President Clinton has said he will sign the bill. Those opposed to the regulations, however, said the "indecency" standard, which has been used in broadcast regulation cases, is too vague and would seriously restrict the potential of the emerging on-line medium. "I am concerned this legislation places restrictions on the Internet that will come back to haunt us," said Sen. Patrick J. Leahy (D-Vt.). He warned that quoting from such works as "Catcher in the Rye" and "Ulysses" in on-line discussions could court prosecution and said that making it illegal to "make available" indecent language would outlaw posting of messages or images that a child might see. "Imagine if the Whitney Museum ... were dragged into court for permitting representations of Michelangelo's David to be looked at by kids." But John McMickle, an aide to Sen. Charles E. Grassley (R-Iowa), said drafters rejected the idea that Userious works of redeeming value" would fall within the law, which he said would apply only to "patently offensive" material. McMickle said the bill "is not a Comstock-type effort to wipe out literature or political speech." The American Civil Liberties Union, the Electronic Frontier Foundation and other organizations are preparing a lawsuit challenging the indecency provisions on constitutional grounds. Other legal actions are in the works. An on-line publication, American Reporter, has announced it will soon publish a column by a Texas judge denouncing the legislation intentionally salted with "indecent" language; Randall Boe, a Washington attorney for the American Reporter, said he would immediately sue after publication. "We want to move promptly to have this statute set aside as unconstitutional," Boe said. "The longer it's in place, the greater the harm done to the Internet and to the First Amendment." Boe's firm, Arent, Fox, Kintner, Plotkin & Kahn, was defense council in the landmark "seven dirty words" case, which set the legal standard for indecent language in broadcasting based on a monologue by comedian George Carlin. Cathleen Cleaver, director of legal studies for the Family Research Council, said yesterday she expected such suits and that her conservative organization, which has pushed for on-line regulation, would fight to uphold it. The Justice Department has stated that the legislation would be vulnerable to attack on constitutional grounds. But in response to a letter from Grassley, Assistant Attorney General Andrew Fois noted last week that the department is defending the indecency standard in legislation "and will continue to defend similar statutes against constitutional challenges, so long as we can assert a reasonable defense consistent with the Supreme Court rulings in this area." -----

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Frank Willoughby 17 Dec '03

17 Dec '03

Verily at 03:05 PM 2/5/96 -0500, Duncan Frissell did write: >At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: > >>If the Privacy Act were rewritten to be as strict as the BDSG, businesses >>would have a (mandatory) legal requirement to: >> >>o Ensure that personal data is stored properly (by encrypting it, etc) >>o Ensure that personal data is not distributed >>o Ensure that databases are *not* being maintained which describe the >> characteristics of individuals (buying habits, income, property >> ownership, etc) wantonly propagated by marketing (direct mail, >> telemarketing, etc) companies. >> > >Unfortunately, it would also: > >* Require government registration of computers and databases containing >information about people (whether these computers are used by business or >individuals). This eases regulation of computers and future confiscation. Works great in theory, not in practice. Having worked in Germany for 9 years, I can *guarantee* that the German gov't hasn't implemented the above. It may have been a good idea (in their eyes, not mine), but it isn't implementable in a democratic society - it bogs down in the implementation phase). Are you planning on registering every computer system that each person and company has with the gov't? Most sysadmins I know are up to their ears in work and are barely able (if at all) to recognize which users they have on their system, and why they have accounts at all (business justification). This might also get pretty wild when the ISPs get polled in terms of usage. (Compuserve notwithstanding). Gathering the registration data will be a bear to implement - keeping it current will be impossible (for the forseeable future). Besides, this would cast further shadows of "big brother" and remind former "ossies" in the former GDR/DDR & eastern block of days gone by - which they would probably rather not remember. Also, just because Germany tries this approach (and fails), doesn't mean we have to repeat their mistake in this area. > >* Reduce market efficiency by making it harder to match buyers and sellers >(because neither could easily find out about he other) thus causing higher >prices and poorer people. Actually, it would probably increase market efficiency as they would be spending their marketing budget on other appropriate methods which have a higher success-ratio. I don't know what the success rates are of mass-mailings, or tele-marketing, but I doubt if they approach 1% (wild guess). Seriously - what is your first impulse when you reach the phone and find out the caller is a tele-marketer? The annoyance factor is rather high for these. More than likely, this was also the reason that unsolicited mass-faxing of marketing info was forbidden by law a while ago? FWIW, personally, I think many marketing organizations have gone off the deep end in their efforts to try to be effective (to wit: putting logos on clothing, in video games, etc; sponsor's logos in Home Pages, 3-5 minutes of TV commercials every 6-10 minutes of TV (for those rare moments one gets to watch TV (thank heavens for cable TV & CNN)). 8^) > >* Do nothing to protect personal information from the government which >would get to collect more of it than ever in the course of enforcing data >protection laws. > You're assuming this isn't happening now? IMO, that would be a rather naive assumption. Personally, I think that the law should also consider exactly this point. The gov't should have no more access to personal information than it needs to carry on its job - and we as taxpayers should decide how much access they need to have. >If you don't want people to know things about you, don't tell them. Agreed....But, this essentially means giving up your phone, your credit cards, your house, your car, your job, and generally withdrawing from society. Not a particularly viable plan, IMO. The main problem is that the companies do little to nothing about protecting an individual's private data. It isn't any of my business how much money, you make, the amount your home is worth, your credit rating, info about your family (wife, kids, etc), religion, etc - yet, all of these are within the easy access of many individuals who don't have a "need-to-know" of this information. If I don't have a "need-to-know" about this info, I shouldn't be able to access it. > >DCF Of course since we are re-writing the Privacy Act from scratch, we can leave out the items you mentioned & design it the way it should be. Best Regards, Frank

1 0

IEEE Security Symposium Program
by Rich Salz 17 Dec '03

17 Dec '03

Date: Mon, 5 Feb 1996 14:14:22 -0800 To: pem-dev(a)tis.com, ietf-pkix(a)tandem.com, ipsec-owner(a)ans.net >From: Stephen Kent <kent(a)bbn.com> Subject: IEEE Symposium Program Announcement I'm distributing a copy of this year's program to members of these security-oriented WG mailing lists as a means of "getting the word out" to individuals who may be interested in attending this sort of conference. As the chair of the former PEM WG, and current co-chair of the PKI WG, I feel that this announcement is appropriate for these lists, and I hope my fellow IPSEC WG members agree that it is appropriate for that list as well. I apologize in advance for those of you who, like me, will receive multiple copies of this announcement. Steve =========================================================================== 1996 IEEE SYMPOSIUM ON SECURITY AND PRIVACY _/_/ _/ _/ _/ _/ May 6-8, 1996 _/_/ _/_/_/ The Claremont Resort, _/ _/ Oakland, California _/ _/ _/_/ Sponsored by the _/_/_/ IEEE Technical Committee on Security and Privacy _/ _/ In cooperation with the _/ _/ International Association of Cryptologic Research _/_/_/ _/ Symposium Committee _/ Dale M. Johnson, General Chair _/_/_/ _/_/ Stephen Kent, Vice Chair _/ _/ _/ John McHugh, Program Co-Chair _/ _/ _/ George W. Dinolt, Program Co-Chair _/_/_/ _/_/_/ _/ _/ _/ PRELIMINARY PROGRAM _/ _/ _/ Subject to Change _/ _/_/ MONDAY, MAY 6 08:30-09:00 WELCOMING REMARKS: Dale Johnson and John McHugh 09:00-10:30 PANEL: Object Management Group CORBA Security Standard Moderator: Terry Benzel Participants: TBA 10:30-11:00 BREAK 11:00-12:00 COVERT CHANNELS An Analysis of the Timed Z-Channel Ira S. Moskowitz, Steven J. Greenwald, Myong H. Kang Defining Noninterference in the Temporal Logic of Actions Todd Fine 12:00-13:30 LUNCH 13:30-15:00 PANEL: Goals for Computer Security Education Cynthia Irvine, Chair Leslie Chalmers Karl Levitt Steven F. Barnett Jim Schindler Roger R. Schell 15:00-15:30 BREAK 15:30-17:00 FIVE-MINUTE RESEARCH TALKS SESSION Submissions in the form of one-page ASCII abstracts due by email to mchugh(a)cs.pdx.edu no later than 2 April 1996. See http://www.cs.pdx.edu/SP96/ for more information. Abstracts to be distributed at the conference. 18:00-19:30 RECEPTION TUESDAY, MAY 7 09:00-10:30 DOMAIN SPECIFIC SECURITY Security for Medical Information Systems Ross Anderson Discussion Discussants TBA 10:30-11:00 BREAK 11:00-12:00 PROTOCOLS Entity Authentication Dieter Gollmann A Fair Non-repudiation Protocol Jianying Zhou, Dieter Gollmann Limitations on Design Principles for Public Key Protocols Paul Syverson 12:00-13:30 LUNCH 13:30-15:00 DATABASES Ensuring Atomicity of Multilevel Transactions Paul Ammann, Sushil Jajodia, Indrakshi Ray View-Based Access Control with High Assurance Xiaolei Qian Supporting Multiple Access Control Policies in Database Systems Elisa Bertino, Sushil Jajodia, Pierangela Samarati 15:00-15:30 BREAK 15:30-17:00 BIOLOGICALLY INSPIRED TOPICS IN COMPUTER SECURITY An Immunological Approach to Change Detection: Algorithms, Analysis, and Implications Patrik D'Haeseleer, Stephanie Forrest, Paul Helman A Sense of Self for UNIX Processes Stephanie Forrest, Steven A. Hofmeyr, Anil Somayaji, Thomas A. Longstaff Cryptovirology: Extortion Based Security Threats and Countermeasures Adam Young, Moti Yung 17:30-19:30 TECHNICAL COMMITTEE MEETING WEDNESDAY, MAY 8 09:00-10:30 MODELING A Security Model of Dynamic Labeling Providing a Tiered Approach to Verification Simon Foley, Li Gong, Xiaolei Qian A Communication Agreement Framework of Access Control Martin Roscheisen, Terry Winograd Decentralized Trust Management Matt Blaze, Joan Feigenbaum, Jack Lacy Security Properties and CSP Steve Schneider 10:30 11:00 BREAK 11:00 12:30 NETWORKS Security Flaws in the HotJava Web Browser Drew Dean, Dan S. Wallach On Two Proposals for On-line Credit-card Payments using Open Networks: Problems and Solutions Wenbo Man Secure Network Objects Leendert van Doorn, Martin Abadi, Mike Burrows, Edward Wobber Run-Time Security Evaluation (RTSE) for Distributed Applications Cristina Serban, B. McMillin 12:30 12:45 CONCLUDING REMARKS 12:45 SYMPOSIUM ADJOURNS 1996 IEEE SYMPOSIUM ON RESEARCH IN SECURITY AND PRIVACY _/_/ _/ _/ REGISTRATION FORM _/ _/ _/_/ _/_/_/ Name:_______________________________________________ _/ _/ _/ _/ Affiliation:_______________________________________________ _/_/ _/_/_/ Postal Address:_______________________________________________ _/ _/ _/ _/ _______________________________________________ _/_/_/ _/ _______________________________________________ _/ _/_/_/ _/_/ Phone:_______________________________________________ _/ _/ _/ _/ _/ _/ Fax:_______________________________________________ _/_/_/ _/_/_/ _/ _/ _/ Email:_______________________________________________ _/ _/ _/ _/ _/_/ Note: Address information will be distributed to attendees. Please enter the appropriate registration category. Payment must be included and must be by credit card or by check in U.S. dollars, drawn on a U.S. bank, made payable to "IEEE Symposium on Security and Privacy." Dates are strictly enforced by postmark. Advance registration (up to 29 March 1996) ___ Member of the IEEE (Member # ____________, required)........$310.00 ___ Non-Member..................................................$385.00 ___ Full-time Student...........................................$100.00 Late registration (from 30 March 1996) ___ Member of the IEEE (Member # ____________, required)........$370.00 ___ Non-Member..................................................$460.00 ___ Full-time Student...........................................$100.00 Do you wish to present at a poster session or lead an evening discussion? [ ] Yes [ ] No Do you have any special requirements?_________________________________________ Please indicate your method of payment by checking the appropriate box: [ ] Check in U.S. funds drawn on a U.S. bank (PLEASE ENCLOSE WITH THIS FORM) Credit card authorization: (Charges will appear on your statement as made by IEEE COMPUTER SOCIETY) Visa MasterCard American Express Diners Club [ ] [ ] [ ] [ ] Credit Card Number:_________________________________________________________ Card Holder Name:______________________________Expiration Date:_____________ Signature:__________________________________________________________________ Mail registration to: Or FAX this form (CREDIT CARD Stephen Kent REGISTRATIONS ONLY) to: BBN Corporation FAX: +1 617 873-4086 MS 13/2A VOICE: +1 617 873-6328 70 Fawcett Street Cambridge, MA 02140 >>>>SORRY, NO REGISTRATIONS BY EMAIL. NO REFUNDS.<<<< Five-Minute Research Talks Session ================================== At the 1995 Symposium a session of five-minute research talks was held for the first time. These proved very popular, so there will be another session this year. It is being held on Monday to give attendees more opportunities to contact the presenters during the rest of the conference. If you are interested in presenting a five-minute talk, please submit a one-page abstract in ASCII format by email to mchugh(a)cs.pdx.edu no later than 2 April 1996. See http://www.cs.pdx.edu/SP96/ for more information. Abstracts to be distributed at the conference. Please note that the five-minute time limit will be strictly enforced. Evening Sessions ================ The 1996 IEEE Symposium on Research in Security and Privacy will accommodate poster sessions and evening discussions. There will be rooms with blackboards and bulletin boards for interested parties to post presentations on work in progress, recent research results, and innovative proposals, or to lead discussions on topics of current interest. These rooms will be available Monday and Tuesday, May 6 and 7, from 8 p.m. to midnight. If you are interested in posting a presentation or organizing a discussion on a particular topic, please indicate so on the registration form. Hotel Reservations - The Claremont Resort ========================================= The Claremont Resort in Oakland, California is 20 minutes from San Francisco and just over an hour from Napa Valley. It is situated in the Oakland-Berkeley hills overlooking the San Francisco Bay on 22 acres of beautifully landscaped lawns and gardens. Facilities include the Claremont Pool and Tennis Club and The Spa at the Claremont. Oakland Airport is 14 miles from the hotel, or attendees may choose to fly into San Francisco and rent a car. SuperShuttle (+1 510 268-8700) provides service from the San Francisco Airport or the Oakland Airport to the Claremont Resort. The charge is $15 from Oakland Airport and $18 from San Francisco Airport, per person one way. Parking is available at the hotel at a cost of $8 per day for guests and a maximum of $9 per day for non-guests. Hotel reservations must be made under the group name IEEE Symposium on Security and Privacy. The group rate is $102 single, $114 double occupancy, plus 11% tax. The cut-off date for reservations is Saturday, April 6, 1996. Reservations made after this date will be accepted on a space available basis. Reservations must be accompanied by an advance deposit or credit card guarantee. You may cancel your individual reservations up to 72 hours prior to arrival, after which your deposit becomes non-refundable. Please be advised the check-in time is after 3:00 p.m.; check-out is 12 noon. For reservations and information, contact: The Claremont Resort, Ashby and Domingo Avenues, Oakland, CA 94623-0363; Phone: +1 800 551-7266 (7 a.m. to 8:30 p.m., PST) or +1 510 843-3000; Fax: +1 510 549-8582.

1 0