December 2003 - cypherpunks-legacy

Re: Leahy bill nightmare scenario?
by Dan Weinstein 17 Dec '03

17 Dec '03

On 8 Mar 96 at 9:24, you wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > At 06:14 AM 3/8/96 GMT, Dan Weinstein wrote: > >On Wed, 06 Mar 1996 16:59:36 -0800, you wrote: > > > >>At that point, Bob is GUILTY of violation of the Leahy bill, > >>because his encrypted anonymous remailer: > >> > >>1. Uses encryption to thwart message tracing, and thus the > >>"criminal investigation." > >> > >>2. Bob has already been informed that his system will be used for > >>illegal purposes; the cops have the messages to prove he has been > >>told. He's GUILTY GUILTY GUILTY, he will definitely lose the > >>system and possibly whatever residence it runs in, and will > >>probably have to pay a huge fine to boot. > > > >This is not my understanding. I believe that Bob has to be > >commiting a felony himself before they can get him under the > >current phrasing. > > Well, first, the section's phrasing is screwed up. Whether this is > the fault of VTW, who posted the text, or the original bill I do not > know. I have yet to see the original bill myself, it is not posted on Thomas yet, but I too have ready the VTW version. > Second, if what they're charging is the hindrance of an > felony investigation, it isn't clear to me why they would be > limiting the charging of that "crime" to only those actually who > have committed a felony. (logic isn't the normal mode of thought for > a government employee, you realize.) I agree with your concerns here, but I find it hard to believe that the courts would allow a broader interpretation. > Third, all they have to do is to "suspect" the person of a felony, > and a > "felony investigation" starts. That would presumably make him > guilty of the Leahy bill's provision, regardless of whether he is > actually participating in the crime supposedly being investigated. Here you are dead wrong, the bill specifically states: "in furtherance of a felony." Its like those laws that let them charge someone with murder in the first if someone dies while you are commiting another felony. They must prove the original felony before they can get you on the murder one. The real purpose of this provision, as I read it, is to give longer sentences to criminals that use crypto. > Fourth, I gave what I considered to be a clear example of the > hypothetical misuse of an encrypted remailer by the cops, one that > would arguably make the remailer operator guilty of some > "reasonable" anti-kiddie-porn statute. At that point, _he_is_ the > target of the investigation. Unless you can show that this kind of > action by the government is impossible, I consider it to be not > merely possible but almost certain to occur. Again, the problem I see with your scenario is that I don't believe that the courts will interpret it that way. My interpretation is that if they serve a warrent and I don't decrypt for them and they can prove a felony, then I will be subject to the listed punishment. > Fifth, it isn't clear what amount of knowledge is necessary to > "trigger" this clause, especially in its current flawed state. > Since ISP's and encrypted remailers might know, in general, that > their systems can and probably are being used for SOME criminal > activity, even if they can't identify it or the user, or decrypt it, > etc, a broad interpretation of the resulting law could easily > de-facto prohibit any business practices (i.e., allowing users to > use encryption) that prevents full-scale monitoring and/or tracing. I disagree, it states you must "willfully endeavor" to use the encryption as a means of obstructing the investigation. To me, this means that it is the motivation for using the encryption. If I set up an encrypting remailer for the purpose of allowing free exchange of ideas, I don't believe I would be liable under this law. The only way I could see a remailer charged under this is if he had solid evidence that a specific user was violating the law, and took no action. > This is only the beginning of the problems with this section. If > you can explain why nothing I've described could possibly occur, I > welcome a contrary explanation. I see some real problems too, but I do not see the problems with this provision to be enough to condemn the entire bill. I would like to see this portion of the bill ammended to make it clear that only those actually involved in commiting the felony would be held responsible. > But I would also ask this: Why, exactly, do we need this section? > We've already been told that the opponents of this bill will fight > it tooth-and-nail under its current wording; if that's the case then > the presence of this section is inadequate to appease their > unhappiness. Therefore, we shouldn't include it in the bill at all; > it does no good. > > Any explanations, Dan? You are talking about the fringe, this, I think, was added as an attempt to bring in those that are in the middle. That is, Those that see the need to prevent the use of encryption as a means of obstructing justice, but feel that we should also have a right to privacy. To say that there is no delema here is ridiculous, crime is a serious problem that we are already having a terrible time dealing with. I think Leahy realizes that this provision will be about as useful as the "use a gun, go to jail" laws, but wants to give those in the middle to say that they bill will help prevent crime. > BTW, I'm not the source of those recent anonymous notes on > Cypherpunks criticizing you for the support of this bill. As you by > now have guessed, I'm not at all reticent about standing up and > being counted and identified. > > Jim Bell > jimbell(a)pacifier.com > > Klaatu Burada Nikto Good movie. Dan Weinstein djw(a)vplus.com http://www.vplus.com/~djw PGP public key is available from my Home Page. All opinions expressed above are mine. "I understand by 'freedom of Spirit' something quite definite - the unconditional will to say No, where it is dangerous to say No. Friedrich Nietzsche

1 0

Re: TCP/IP Stego (was CU-SeeMe)
by mccoy＠communities.com 17 Dec '03

17 Dec '03

JonWeinke(a)aol.com writes: > >> -It can be applied by two routers which are in the middle >> of the connection. [...] > >You seem to be oblivious to the fact that this technique is only useful for >ISP's, corporate networks, etc. that the average home computer user will >never have access to. I know that, I was just pointing out advantages you overlooked. I guess that the fact that I probably know more ISP operators and techs then non-geeks who use the net made this part more obvious to me. The original technique of doing stego on packets is still valid, and by adding it in to a WinSock lib or linux tcp/ip implementation the user can send hidden messages just by connecting to a friendly stego-enhanced web server out on the net and doing some casual browsing. The difference between the two methods is, as I said before, exactly the same as the difference between TCP/IP and UUCP. Hiding info in images or sound files works fine for "email" or file storage but has no chance of being an interactive protocol, sometimes you need to get things done in real-time. > If I want to send a WAV file of my 2 year old son >saying "Hi, gramma" (or a 24-bit color TIFF of him practicing nose-picking >techniques) to my relatives, that is not overtly suspicious behavior, even if >it has a slight amount of background noise (or graininess). But your relatives are not the people who you need to communicate secrets with securely. These gross stego hacks to sound and image files are best used to make postings to various binary Usenet newsgroups. Broadcast the message and then put it in a place where many people will download it but only a few will know that it contains the hidden info. Sending this stuff via email is just begging for traffic analysis at the very least... >As long as I >don't stego too many bits in the file, and I strip out any overt "I'm crypto" >headers, it will be impossible to prove that stego techniques were used on a >file. Finding random bits where random bits normally live cannot be used to >prove anything. Provided the bits are random in the way that they should be... The low-order bits in such files were chosen by implementors of stego programs because modification would not be noticed by the person viewing or listening to the file, not necessarily because there was actually randomness at this level which could be replaced. Does anyone know of a survey of images or sound files which tested the statistical randomness of these bits? They may not be as random as people think they are. jim

1 0

Re: new netscape servers
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:14 PM 3/7/96 -0500, Michael Froomkin wrote: >What law applies to a certificate used in a multi-jurisdictional >transaction is less obvious to me than I would like. I think I have >talked a student in my seminar into writing a paper to educate me. Are your concerns international, interstate, or (it seems unlikely) intrastate? Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

WARES - random generator
by Alan Olsen 17 Dec '03

17 Dec '03

This may be of interest to people on the list... >Keywords: madison hawai obsceni prising ridblood ribiliss >Subject: WARES - random generator >Reply-To: email(a)fringeware.com (FringeWare Inc) >Date: Tue, 5 Mar 1996 11:06:20 -0600 >Apparently-To: fwlist-daily(a)fringeware.com >X-UIDL: 4751f2738fffe6a83cf40be20fcd79a5 > >Sent from: email(a)fringeware.com (FringeWare Inc) > >A certain vendor of ours has approached FringeWare with an offer for >exclusive distribution a new product, which may be of general interest >to people reading this list. > >The product line is called Perfect Crypt Products and the new item >being considered is a random number generator which plugs into the >serial port of your PC/Mac/Sparcbook/Cray/etc., and pours out a stream >of random numbers. The process is based on thermal radiation, the >randomness looks quite good, and the product would retail for about us$50. > >If you have an interest in such a product, please let us know here >at: email(a)fringeware.com and we'll add it to our catalog. > >One-time pad enthusiasts and PGP officionados might consider this >offer especially. > > >----------------------------------------------------- >pxn * FringeWare Inc. * http://www.fringeware.com > > > > > --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

2 1

2nd request for links, etc.
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- After too much coffee and not enough sleep, it looks like the (soon-to-be-named) shellback.com site will be going on-line on Monday, 11 March. Until InterNIC comes back and blesses us with permission to use the name, we'll be running as 204.177.232.150 I'd like to again ask anyone on the cypherpunks list that has a site, link, file, or other bit of info that they're willing to have us include please let me know via email. I've got some links from my (soon-to-be-former) home page, but I'd like to include a *lot* more stuff. To repeat an earlier offer, as postmaster, I'm offering the use of our email system for crypto/coder/privacy-related mailing lists, and our drives to store related files/archives. Dave Merriman postmaster(a)shellback.com, webmaster(a)shellback.com, janitor(a)shellback.com, and frazzled(a)shellback.com :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMT/aUsVrTvyYOzAZAQEK8wP9GvQtT3PF91xW38jKL7qWsH75fA0AJXVi fM4pVCDznFUk0DPla8tnBCzyBGQzklZH/217Yct26VvUZN4ZQ+BHkE/ZSkxkk1KQ i1PE1fzhGcVFhfySIMWi3o7+WeZoYOmdtFkMGEcTAsQkhR9FHvHm3oJlS7GY/R/p 2Hm3Wzjgabc= =c6ab -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

1 0

Re: Vexatious Litigants (was: SurfWatch)
by Martin Diehl 17 Dec '03

17 Dec '03

Henry Huang <hwh6k(a)fulton.seas.virginia.edu> at INTERNET-USA wrote: > On Mar 7, 22:29, Timothy C. May wrote: > > At 2:38 AM 3/8/96, Bill Frantz wrote: > > >At 6:59 PM 3/7/96 -0800, Timothy C. May wrote: > > >>If SurfWatch can be sued for a "bad review," then Siskel and Ebert > > >>had better find a new line of work. > > > > > >As long as a reviewer corrects errors, as SurfWatch seems to be > > >willing to do, I think they are relatively suit-proof. If they don't, > > >well - anyone can be sued for anything. I'll let the lawyers comment > > >on the possibility of success. > [snip] > Thanks for the clarification. However, this line of argument applies > only to "third-party" ratings systems. Right now, > Microsoft/RSAC/SurfWatch and SafeSurf/Cybersitter/etc. are setting up > competing standards which would essentially force people to > "self-rate" their own sites, or else be blocked out by browsers > configured to reject unrated sites (a feature Microsoft plans to add > to its Internet Explorer). > The question I have is if these systems were widely implemented, could > an Web page author or provider of content be sued for "mislabeling" > their page? If so, under what circumstances? Could the RSAC attach > legal requirements to the use of their system, and open up such a > loophole (similar to how Sun attaches conditions to the use of its > "Java" logo)? Seems to me that if the Web page author labels his page conservatively, i. e. "materials may be unsuitable for non-adults; may contain controversial material, may contain views different from your own, etc.". How can the author be liable for mislabeling? Martin G. Diehl

1 0

Review Litigation
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:59 PM 3/7/96 -0800, Timothy C. May wrote: >We need to be very careful here. A service like "SurfWatch," voluntarily >used by others, has entered into no contracts with sites to meet defined >standards of what should and shouldn't be blocked. It is essentially a >"review" service, like a reviewer of books, movies, restaurants, etc. Sure, >some books, movies, and restaurants are "hurt" by negative reviews, but >this is life in a free society. It has not yet reached the point in these >Beknighted States that a bad review can be the basis of a tort (though I >could be wrong...nothing would surprise me these days). There was a recent case of a restaurant suing over a bad review that did go to trial. The reviewer won. There has also been litigation against someone who wrote a letter to a scientific journal attacking someone else. The letter writer won. Of course both the letter writer and the reviewer had legal costs because they were unwilling to proceed in forma pauperis. DCF

1 0

Fertilizer & fuel oil as cause for suspicion - similar to cryptography?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

In the below article, the cops seem to be claiming that fuel oil, fertilizer, and bomb-making knowledge = illegal explosives possession. This idea doesn't make sense. Crypto relevance? An example of how governmental idiots are likely to take cryptography. -Allen ----------------- Copyright &copy 1996 Nando.net Copyright &copy 1996 The Associated Press CORVALLIS, Ore. (Mar 8, 1996 11:09 a.m. EST) -- Ingredients for a fertilizer bomb like the one that killed 169 people in Oklahoma City were found on a farm along with bomb-making instructions, guns and drugs, police said. Four people were arrested on weapons and drug charges. Charges involving illegal explosives were expected to be filed later, police Sgt. Dennis Carson said Thursday. Officers seized a large quantity of fuel oil and the fertilizer ammonium nitrate, two key ingredients in the April 19 Oklahoma City bombing. "My understanding is it could have made a large bomb and a rather large explosion had it been detonated," Carson said. "All they had to do was mix the parts. It would take just a few minutes." He wouldn't say how much fertilizer was found in the raid Wednesday night near this city about 80 miles south of Portland. The fertilizer, found in an 8,000-square-foot barn, was removed in a state police bomb-squad truck. Carson said investigators were trying to determine whether those arrested had plans to bomb a building or had ties to any anti-government groups. The federal Bureau of Alcohol Tobacco and Firearms is investigating. Along with the material for the fertilizer bomb, officers found 29 guns, including eight assault rifles, and material to make pipe bombs. Three ounces of marijuana and some methamphetamine were also found. [...] All were charged with drug possession and Luehring and the younger Bradley were also charged with being ex-convicts in possession of weapons. Carson didn't have details on their criminal past. [...]

1 0

Re: U.S. State Dept criticizes Chinese net-censorship
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From State dept about China: > Government control > of news media generally continues to depend on self-censorship to > regulate political and social content, but the authorities also > consistently penalize those who exceed the permissable. It is this kind of double talk, "self-censorship", that makes possible the US govt. to do the exact same as China's one does. There is no such thing as "self-censorship". Either you stick to your values, and then it is *not* censorship, or then you do not, and then, it is neither. The *only* ultimate tool of censorship is a gun. JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQEVAwUBMUBUDMiycyXFit0NAQExqQf+JxkWi4BhPwQSXtzscf+AGGA++5dZjTmP 3mkhsPzT1JKT1Pl4LXVLbCEJctv+yeLOq1sRYV3rcdIZOIwh1cvfPoWI8LFqfCH4 63nkX6eTG+6VR1uCOMCuTfJFx/f86v5Y34ehfQDzGzcN2SrxCSXpDFwHuTMpB6/g 6Zjhspfqz8PT7U9vHbyHkytXBI9BdR9b6+WUkJMHMpflrDDbSTrsR+C3XObIO4gu 85l4/HjUqSf+EyAw9/Bv3J5uUFF45o+ff6BvWt5eVUMTgWEBcJkjHbm/JYgj7lrK Bjm3oXboh940zHIRIkjb56SRFEb2ITNSfoKilXLgq3CV9r/+Wx5q4g== =UnIn -----END PGP SIGNATURE-----

3 2

Review Litigation
by sasha1＠netcom.com 17 Dec '03

17 Dec '03

What if somebody gets a positive review they do not deserve, or has incorrect data? Can somebody file a "public against reviewer" lawsuit? Who would collect damages (public, competitors)? ----------------------------------------------------------- | Alexander Chislenko | sasha1(a)netcom.com | Cambridge, MA | | Home page: http://www.lucifer.com/~sasha/home.html | -----------------------------------------------------------

1 0