December 2003 - cypherpunks-legacy

Re: Fair Credit Reporting Act and Privacy Act
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:25 AM 2/5/96 -0500, you wrote: >Probably the easiest way of ensuring that personal information isn't >wantonly distributed by credit agencies or (anyone else) is to update >our Privacy Act - which is ridiculously out-of-date and badly in need of >being re-written. It is also hampered by its apparent lack of teeth. The parts of the Privacy Act that I remember are all restrictions on _government_ actions, not private actions. It's an important distinction; even though TRW may know way too much about you, it's all information that you voluntarily released to somebody, unlike data that the government requires you to give them. And, yes, it's out-of-date and toothless. ... >If the Privacy Act were rewritten to be as strict as the BDSG, businesses >would have a (mandatory) legal requirement to: ... >o Ensure that databases are *not* being maintained which describe the > characteristics of individuals (buying habits, income, property > ownership, etc) wantonly propagated by marketing (direct mail, > telemarketing, etc) companies. If you're going to propose laws, you should not only think about whether they'll do what you want, but also about what else they'll do, how they'll be enforced, what are the side effects of that enforcement, etc. How is the government going to ensure _non_existence of databases? If I'm a prosecutor, and claim that you _might_ have personal data about somebody on your machines beyond the Politically Correct Data Elements, can I get a search warrant for _all_ your databases? What about that encrypted file on your PC at work? Such things have been used to hold personal data before (even by police like the LAPD or Stasi.) No thanks. If you want to require that a database exists, then a business can demonstrate that they have it by producing it (though proving whether or not in really includes all transactions is still difficult.) On the other hand, if you don't make the law adequately enforceable, you're encouraging violation and selective enforcement. >o the promotion of the use & implementation of encryption - including > the possibility of ITAR being reduced or eliminated for the export > of encryption products Yes! GAKed encryption, to be sure - once there's a requirement that you be able to produce your data for the government, they'll discover that they need guaranteed access to data that would otherwise be guaranteed inaccessible by strong encryption. >o reduced propagation of personal information A much stronger way to increase privacy is to eliminate one of the most popular unique keys used by these databases - the Social Security Number which the government requires you to give almost anybody who gives you money. Give each taxpayer a pile of taxid numbers (either cryptographically related, or just randomly generated and stored in a big tax-department database) so you can use a different taxid for everyone who needs one, making it impossible for anybody but the government to correlate them. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

What is really happening in Oregon
by Joe Zychik 17 Dec '03

17 Dec '03

Excerpted from today's Zychik Chronicle The Los Angeles Times writes: "rivers raged through Oregon" [should say "Oregon taxpayers sunk by Oregon government"]. "the regions worst flooding in three decades" [should say, "State of Oregon has been wasting tax payer money for 30 years"]. "At least 3 deaths were attributed to the flooding [should say, "State of Oregon kills 3 more innocent citizens"]. "13 counties were declared a disaster area [should say, "State of Oregon has been screwing these 13 counties especially"] "And the worst is yet to come" [the citizens will blame the weather]. "Rats by the hundreds started crawling out of Portland's sewers" [should say, "The parents of Oregon's politicians and bureaucrats came forward."] ------------ The Zychik Chronicle is a daily, liberty oriented e-zine. To subscribe send e-mail with sub-cy in the header. jz

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 10:11 AM 2/9/96 -0500, olbon(a)dynetics.com (Clay Olbon II) wrote: >There is one potential side-benefit to the V-chip -- The inverse-V-chip .. >I am looking forward to a time when I will never, even accidentally, have >my TV tuned to "Full House" ;-) Just as many people program their televisions using VCR-Plus codes to record the shows they want (using TV Guide as a rating service) it would be easy for any rating service to publish a list of the codes for Approved Shows, Banned Shows, Rated-by-interestingness shows, etc. without putting any government-mandated rating chip in the TVs or forcing the TV producers to rate them (which also has a chilling effect on the shows produced.) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>Sorry to post this question here, but I know of no other group with >folks who would know. Have any of the "spiders" such as Alta Vista >been sent to see just how many US sites have been blackened in the >protest? The approximate number and percentage of US sites blackened >might be interesting. In my limited surfing, I have been gratified >to see the _widespread_ response -- but I am not the typical user. I don't think it's updated enough things recently (or else it only indexes the contents of a page and not the header details in the <BODY> statement.) For instance, BGCOLOR="#000000" had 197 hits, but most of them were old, and on topics like "How to set the background colors on your web page", and NO documents matched both BGCOLOR="#000000" and vtw. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 06:28 AM 2/9/96 -0500, Duncan wrote, regarding the appallingly invasive British Privacy Act: >Computer bureaux which process personal data for others or allow data users >to process personal data on their computers must also register. Their >register entries will contain only their name and address. > >Data users and computer bureaux who should register but do not, are >committing a criminal offence, as are those operating outside the >descriptions contained in their register entries. In these cases the >Registrar regularly prosecutes. The penalty for non-registration can be a >fine of up to =A35,000 plus costs in the Magistrates Courts, or an= unlimited >fine in the Higher Courts." Ouch - does this mean that if you offer shell accounts, you either have to contractually limit the processing your users may do, or be fined as a criminal for not registering? #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com= +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 08:39 AM 2/9/96 -0800, jamesd wrote: >If you have one law for men who run businesses and one law [for] other folks, >then we have selective enforcement and application of the laws, >that enables governments to act selectively and capriciously. >For example here in California private citizens who attempt to organize >recall elections are often subject to extraordinary and confiscatory fines. On the other hand, of course, there are laws that are ostensibly for the purposes of regulating businesses whose primary effect is to limit the privacy or actions of individuals. For instance, California's law requiring that mailbox renters provide two forms of ID and make their mailbox companies agents for service of process is ostensibly to "protect" consumers by regulating businesses that operate out of mailboxes (which the law claims there are 7 million of here); it furthermore lets the Post Office specify what kind of ID to use (which some local postmasters are far more extreme about than others), and requires revealing True Addresses. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

Re: A temporal remailing (was: CDA = death of crypto)
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

>At 3:26 AM 2/7/96, anonymous-remailer(a)shell.portal.com wrote: >>CDA means that virtually all underground or 'illegal' traffic will be >>distributed via encryption. >> >>As soon as the loony right and fundo Christians realise this, they *will* >>call for legislation against encryption, and if the CDA is any benchmark, >>they will easily win. > > >4-1-99. NYT: > > "Congress Passes "Children's Protection and Safe Information Highways" Bill" > > "In a vote of 479-12 in the House of Representatives and 93-5 in the >Senate, the "Children's Protection and Safe Information Highways Bill" was >sent to the President, who is expected to sign it on Thursday. > > "The Bill criminalizes the possession of unauthorized cryptographic >programs and extends the Telecom Act of 1996 and the Digital Telephony Act >of 1994 to regulate the new cyberspace frontier. > > "Attorney-General Louis Freeh pushed for the legislation, citing the >growing use of cryptography by dissidents and criminals. "We are hoping >Congress will next pass the "Secure and Decent Cyberspace Bill." This bill, >nick-named the "Crypto-Kingpins Bill," will subject traffickers in illegal >crypto to the same harsh penalties meted out to drug kingpins. "While it >may seem harsh to execute a person for possession of a key greater than 60 >bits, we must consider the terrible consequences for our children of people >writing down things the government cannot read," Freeh said. > > > BAD_nws So the're going to arrest us all? It's unconstitutional (of course!) and unenforcable. It will have the same effect as Prohibition. lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAzD3EHEAAAEDAMVwZzXozPjX18mCenA5fJsdWZXcrhJCxPR+SoVCmR7d4ZVU mwITzPTHo/GyLvJrWyk5YdhheczyY2VSawaMrCN/nWA7K9lwAylbKyPxqBhRYJ3C 2wi2uD5LY2wypNOQyQARAQABtB5KZWZmIENvbm4gPGx1bmFzbGlkZUBsb29wLmNv bT6JAHUDBRAw+1bqS2NsMqTTkMkBAQkTAwCersFbCyk8O0MbGlNcZDAe24CLEWQ0 0C5EHni33W76UsG1bybcLsuMH6HVwLF7IqZivnzc7wkujYPQvCqn8HEYYTld8V9V Cou4dOvA8kV7rHvAn/LuLx7DRruLFrRoPSk= =OIT9 -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: Why am I wrong?
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

>(Was referring to the govs ability to control communications *with them*) >>Perhaps I do not understand your point. They can perhaps >>control the communication between them and me, but not between me and >>everyone else. > >Ok please view my three points fromn the standpoint that so much of the >total traffic would be affected by at least one, that "uncontrolled" >communications would be minimal. Do you mean readable by "controlled"? I thought I knew what you meant by that :-) If you do mean readable, I don't see how that would make a difference since so many people would still be encrypting their mail. If you mean controled as in being able to encrypt messages would be controlled, that the govt. would have final say over whether one could encrypt or not, then unless they pass legislation specifically outlawing encryption, or encryption not readable by them, they could have no such control. Even if they did legislate, they could not enforce reliably because to many would be breaking that law anyway. Plus, the law would (should, he says kneeling and praying) be struck down as unconstitutional by the fourth. > >>>2) communications using someone else's equipment/network (university, >>> employer, etc) > >>Employers nor universities have any jurisdiction over whether you use >>encryption in your transmissions while using their networks unless it >>specifically does not allow it when you first agree to have an account with >>them. > >I think you had better review the concept of "property rights". Unless you >have a contract that says you can, or can establish "expectation", the >property owner who allows you to use their equipment may control how it is >used. Perhaps I had better. I do know that if employers do have jurisdiction, then my point about employers encouraging encryption should still hold (barring legislative prohibition). If it does not, then I conceed that you are correct in saying that it would *affect* traffic, but it would not totally control it. As for universities, the traffic here would be affected as well, as you say. There would still have to be some justification for imposing such a restriction and it would be demanded by the students and the parents of the students, but it still could be sucessful (how frightening this is!) >>>3) communications with anyone (Internet merchant, etc) who says "this >>> is not what <MasterCard|Visa|AmEx> approves..." > >>I don't quite understand your meaning. I am a merchant and I encourage my >>customers to use PGP when they send information over the internet, whether >>to me or to anyone else. > >That is fine but what if MasterCard refuses to accept this method ? (Not >saying they will, just "what if" ? You are free to use digicash if you >want but is not "legal tender for all debts public and private". I think that the comming standards announced by credit companies will take care of secure transactions, and I still don't see where the govt. would have to do with controlling traffic here. Just as we have many credit cards, we will have many online accounts, each with their methods of secure, verifiable trasactions. Methods for payment and security will become increasingly easy to use and software will be written to accomidate these features. >>Comments? Bring 'em on! :-) > >I dood it. The debates roll on... lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAzD3EHEAAAEDAMVwZzXozPjX18mCenA5fJsdWZXcrhJCxPR+SoVCmR7d4ZVU mwITzPTHo/GyLvJrWyk5YdhheczyY2VSawaMrCN/nWA7K9lwAylbKyPxqBhRYJ3C 2wi2uD5LY2wypNOQyQARAQABtB5KZWZmIENvbm4gPGx1bmFzbGlkZUBsb29wLmNv bT6JAHUDBRAw+1bqS2NsMqTTkMkBAQkTAwCersFbCyk8O0MbGlNcZDAe24CLEWQ0 0C5EHni33W76UsG1bybcLsuMH6HVwLF7IqZivnzc7wkujYPQvCqn8HEYYTld8V9V Cou4dOvA8kV7rHvAn/LuLx7DRruLFrRoPSk= =OIT9 -----END PGP PUBLIC KEY BLOCK-----

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 09:21 AM 2/9/96 -0500, Tim Philp wrote: > Private individuals are not what I was refering to. I am more >concerned about corporations who hold information about me and release it >to the highest bidder. When it comes to individual versus corporate >rights, I am clearly on the side of the individual. Remember that there's a major difference between "corporations" and "business"; you seem to be mixing them up. A corporation is a legal fiction that treats a cooperative effort by one or more people as if it were a person in itself, and normally involves limiting the liability of the corporation's investors by putting it all on the fictional person. A business is what one or more people do to make money. Most corporations are businesses, though not all. Governments can legitimately tell corporations what to do because that's part of the price of the legal fiction; a government can't abuse a corporation because you can't beat up a legal fiction, though it can say "Poof! You're not a legal fiction any more", and conversely, if the people who own the legal fiction don't like what the government's telling it to do, they can dissolve it. (Governments also enjoy regulating non-corporate businesses, but they're no longer on solid moral ground.) > I have also not suggested some form of prior restraint that would >require government access to computers. I simply suggest that should a >violation occur, that I have the right of civil and criminal law as a >recourse to both compensate me for my loss of privacy as well as deter >future damage. A company knowing that civil and criminal penalties could >result from a violation would take extra care to ensure the security of >my data. How are you going to _know_ that a "violation" occurred, if company A tells company B your address or favorite liquor? Only by having access to the records of both companies. Getting that through the courts, for only the parts of their information relevant to you, is better than blanket permission for the government to rummage through their files, but after the first lawsuit lets investigators in, everything they've got is clam bait anyway. It's still major privacy violation - for the company whose machines are being violated, and for the non-suing individuals whose data is also on those machines. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

Re: What is really happening in Oregon
by Alan Olsen 17 Dec '03

17 Dec '03

At 04:29 PM 2/9/96 -0800, Joe Zychik wrote: >Excerpted from today's Zychik Chronicle > >The Los Angeles Times writes: "rivers raged through Oregon" [should say >"Oregon taxpayers sunk by Oregon government"]. "the regions worst flooding >in three decades" [should say, "State of Oregon has been wasting tax payer >money for 30 years"]. "At least 3 deaths were attributed to the flooding >[should say, "State of Oregon kills 3 more innocent citizens"]. "13 counties >were declared a disaster area [should say, "State of Oregon has been >screwing these 13 counties especially"] "And the worst is yet to come" [the >citizens will blame the weather]. "Rats by the hundreds started crawling out >of Portland's sewers" [should say, "The parents of Oregon's politicians and >bureaucrats came forward."] You need to cut back on your medication (or increase it). The water damage in oregon has little to do with the action or inaction of government. It has much more to do with a strange set of weather patterns in Oregon. (Mainly a whole lot of snow and ice followed by heavy rains.) Right now the weather here is just creating lots of land slides and flooding. The worst seems over for now. Time to wait for the water to recede and then clean up the mess. How this can be blamed on the Oregon State government is beyond me... What it has do do with Cypherpunks, I have no idea... (Not even much of a conspiracy there.) Sounds like someone just wnats to rant. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0