December 2003 - cypherpunks-legacy

Cryptographers practicing law?
by jim bell 17 Dec '03

17 Dec '03

At 01:28 PM 3/11/96 -0500, Perry E. Metzger wrote: > >anonymous-remailer(a)shell.portal.com writes: >> This is the second in a regular series of postings to expose >> cryptographers and cypherpunks who are either lying to us or >> making a very serious mistake in there judgement. > >No, this is the umpteenth stupid anonymous denunciation of people who >deserve no such stupidity. > >You aren't fit to eat Bruce Schneier or Matt Blaze's toenail >clippings. >Perry While I don't really appreciate this guy's style and anonymity any more than you do, it's a misleading argument to try to challenge his position based on (presumably) his crypto expertise or lack of it. I don't doubt Schneier's or Blaze's commanding position in that limited area, but when it comes to the analysis of a bill affecting crypto, knowledge of the technical details of crypto is far less important than knowing how a prosecutor or court will interpret any given law. I'm an "expert" in neither field, but I knew enough to worry. Further, after having read Junger's preliminary analysis, it is blatantly obvious that this bill doesn't constitute much of a step forward, and in fact is likely a retrenchment if the government has its way. The "guarantees" the bill provides aren't really guarantees at all, they are "feel-good" conditional promises, and the whole thing is so shot full of holes that it's hard to imagine that it will provide any protection beyond what we have today. As I noted in my original comment to VTW (Mr. Safdar, who hasn't taken the trouble to contradict, let alone respond to my comments) my biggest fear is that the organizations and people who originally came out in mistaken favor of this bill either won't see their mistake, or won't admit seeing it if they do. (People are funny that way; they hesitate to admit it when they are clearly wrong; organizations are even worse on this score; tiny organizations are worse still, because they must "appear" to be externally consistent yet there are few "heads" to depend on to fix mistakes.) If anything, _MY_ mistake was in believing that the rest of the bill was acceptable if a single bad section was removed; I now believe (after seeing Junger's analysis, and a much more careful reading of the bill) that a serious re-write is mandatory. (In my own defense, I had only skimmed the rest of the bill once, I focussed my criticism on the one "killer" section that I could easily tell would be the most questionable item.) This fiasco does, indeed, raise serious questions about the motivations and credibility of those who have effectively endorsed this bill so soon: It is doubtful whether we will get any accurate picture about the bill from anybody who is afraid of changing his original assessment. I'd be just as willing to listen to "experts" quoted by the people who have (so far) expressed support for this bill. Maybe, as he himself suggests, Junger is a bit too pessimistic. On the other hand, Junger has clearly raised many questions whose answers depend almost completely on the INTENT of people within the government, not the wording of the bill itself. Since I believe their intent to be uniformly bad, it is hard to imagine how anyone could resurrect confidence in this bill to anyone who was similarly pessimistic. And the people who originally claimed that the Administration would oppose this bill as "going too far" cannot now turn around and claim that the government's intent was anything other than bad, BTW. We now see how little good this bill might do, and how much trouble it might allow the Feds to cause, so it's hard to imagine why anyone would have believed the bill (if passed) would not have been signed. I predict that the organizations that have, so far, "endorsed" this bill will quietly stop doing so, but without any kind of specific retraction or apology or explanation. I also believe that they will refuse to reveal whatever legal advice they originally received that induced them to endorse it, because they probably had none. At least Leahy's bill is DOA. However, I think it would be interesting and useful to do a re-write of this bill, addressing all of Junger's concerns, mine as well, and Tim May's to boot. I recommend that we totally ignore comments such as those by Padgett Peterson which claimed that certain provision "must" be included for the bill to pass. Jim Bell jimbell(a)pacifier.com

1 0

Re: Leahy and Mrs. Bemmis (now that's a subject line)
by jim bell 17 Dec '03

17 Dec '03

At 11:24 AM 3/11/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >The Leahy bill is flawed in two areas. Sent a message with proposed wording >to Sen. Leahy via his web page but have not gotten a response. Have a bad >habit of reading laws without thought since this is how LEA and prosecutors >are told to enforce them - as written, not as believed. If an area is >vague, a court is required to decide how to interpret it, not LEA. If badly >written *everyone* loses. Unfortunately, this is not the way CREATIVE prosecutors enforce laws. _THEY_ try to be imaginative, "pushing the envelope" as it were, and expect the courts to stop them. Sadly, those same courts often have ex-prosecutors as judges, people who aren't particularly inclined to dissuade the abuse of laws. (exceptions exist, obviously.) >At the same time am pragmatic enough to accept the idea that it will have >no effect unless it passes and to be passed today it must have something >like the criminalization statement. I've occasionally seen statements like this, but the people who make these claims never seem to back them up with reasoned commentary, let alone facts, which would help to establish that this particular section is a "must" to any particular supporter, certainly not a substantial number of supporters of this bill. Even a quote or two from some political-type saying, "We need that section to pass this bill" would be better than nothing. I'm not suggesting this is totally implausible; merely that it would be lunacy to _assume_ that the bill "needs" this clause to pass, without more evidence or even opinion expressed by key people. It's almost as if you people have surrendered before the "fight" even has begun. _NOW_ do you understand why I'm so astonished at your reaction to this bill? Tim May would object to my use of the word, "Sheeple" here, but I think it fits absolutely. Anybody who would allow himself to be spoon-fed this _entire_, unrepaired bill _IS_ a "sheeple." Anyone who invents some requirement that this bad section be in place is WORSE. Furthermore, if any people (for example, Senators and Representatives) actually are willing to publicly stand up and insist on that section, then I'd say that's a cue for us to ask them some very hard questions. You seem to be unwilling to put them to their proof. I recommend that you stop living DOWN to your reputation, Padgett. > The goal here should not be to throw >it out since that would simply cause the whole bill to fail, Again, you do NOTHING to support this claim. How do you KNOW this to be true? And even with that knowledge, presuming you have it, why are you apparently not planning to use it to our best advantage? Why not try to "smoke out" some of the people who have conspired to include this section into the law? I'll bet they're hoping nobody questions them on their motivations! Moreover, does this comment indicate that you've had conversations or seen information that indicates that the presence of this part of the bill is necessary to its passage? And you're not TELLING US the details of that conversation or information? Suggesting that you're happy to sell the rest of us out? Hmmmmmm? Or are you just jumping to a conclusion? Padgett, the more you say the more you destroy your credibility. > but to word >it carefully enough that it satisfies those who reguire laws Huh?!? Who "require[s] laws"????????? _I_ certainly don't "require" this section to be there, and so far I haven't seen anyone on CP who _personally_ would insist on the presence of this section to condition his support the entire bill. Quite the opposite; most people express varying degrees of reservations about it. > while being narrow enough to avoid exploitation. IMNSHO the best way to do that is to >require that: >1) A felony occured (curiously misdemeanors were ommitted) > and >2) That the individual to be charged was an active participant (before, > during, or after the fact) The problem is, what is your definition of the words, "active participant"? And will YOUR definition actually be the one included in the law? I, on the other hand, see no reason to add crimes, since the implication above is that the person involved is ALREADY prosecutable in court. Why all this "piling on"? On the contrary, I believe it is absolutely certain that this clause will be used to prosecute people who are not otherwise prosecutable or convictable of any other crime. It's curious that you don't see that. > and >3) That encryption was used in furtherance. > >Note: that in the US (1) and (2) seem sufficient for a criminal charge to be >brought, so does (3) really add anything except words or possibly severity ? I sure wish you were better at answering your own questions... >Seizure seems to be a great concern of the group with the point of the >Bemmis Pontiac being brought up. For someone providing a free remailer, >that is a valid concern since the first question a court might ask is >"what was the motivation". I suspect that someone providing a remailer >and charging a reasonable fee to all who might want to use the service >might be in a much better position (not a lawyer so not allowed to know). Playing into their hands yet again, I see! Raising the price is merely a diluted form of banning, BTW. So far, people implement remailers because running them is a comparatively minor cost, and they feel that there is a need for those services. If there was some sort of de-facto rule that the operator had to charge for those services, this would complicate the use of anonymous remailers even more, deter their use even further, and achieve the government's ends just about as surely as a downright ban would do. In fact, accepting a fee might actually INCREASE the liability of the operator, not reduce it, because the remailer operator would have a financial stake in the use of his remailer. He could no longer argue that he did not "benefit" from the abuse (use) of that remailer. >One indicator might be easy to check: Has there ever been a seizure >involving a rental car (Hertz, Avis, etc.) and if so, what was the >disposition ? Well, given the fact that these auto-rental companies do billions of dollars of business each year and are known and "loved" by one and all, you could not use the (supposed) fact that no such incident occurred as some sort of positive sign. Any prosecutor is well aware that he may need a rental car some day, and angering a multi-billion dollar company is not something you do lightly. OTOH, if you discover that EVEN THESE organizations are liable for the transgressions of their renters, either civilly or criminally, that should give you fair warning that anyone smaller (especially an individual running a remailer) and less able to defend himself is certainly going to be a target eventually. Even a failed attempt to get a car rental company to be liable for something done by a renter is a sign that prosecutor was inclined to go after a big target, suggesting he wouldn't think twice before he tried to haul an individual into court. Do you think a person would operate a remailer if he thought it was likely he'd get prosecuted and have to pay thousands of dollars in legal bills, even if he were eventually acquitted? Remember, his legal bills won't be reimbursed by the government, though I believe they should be. Too bad you can't see this, huh? Jim Bell jimbell(a)pacifier.com

2 1

Panorama of the Spy Industry
by John Young 17 Dec '03

17 Dec '03

http://www.fas.org/pub/gen/fas/irp/overhead/index.html _________________________________________________________ FAS Project on Intelligence Reform _________________________________________________________ OVERHEAD THE INTELLIGENCE COMMUNITY As part of our Intelligence Agency model homepage profiles of the components of the intelligence community, we are constructing a picture gallery of agency and contractor sites and buildings. These are derived from US Geological Survey and other aerial photographs. We obtained some of these initial test images from Los Alamos National Lab.

1 0

Re: How would Leahy bill affect crypto over HAM radio?
by Deranged Mutant 17 Dec '03

17 Dec '03

jim bell wrote: > Even so, it isn't clear that this new law WON'T change the rules under which > hams operate. An affirmative statement of the right to use encryption would > seem to pre-empt prior bans, except if there was some sort of explicit > exception for over-the-air transmissions. After all, the law was written I re-read the bill... it notes "wire" communications, as opposed to all forms. It also allows for previous restrictions to keep in effect, I think. Still, the distinction between wire and wireless is not clear anymore with new technologies. Certainly if enough HAMs pester Sen. Leahy about this 'oversight' positive changes could be made. [..] > Not that such an interpretation will necessarily be welcomed by some hams: > Part of the reason for maintaining the ban on encryption would be the fear by > hams that ham bandwidth will be surreptiously used by commercial services > masquerading as ham users. Encryption would make such usage difficult to > detect. Interesting point... Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: TWP on Crypto Keys
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

I think the upshot of it is that they just read the bill (and the surrounding issues) incorrectly. I read the editorial and said to myself, "they aren't reading the same bill the rest of us are reading". -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace Thaddeus J. Beier writes: >Somebody posted this editorial this morning, that includes the >following passage: > >> The Washington Post, March 11, 1996, p. A18. >> >> Security and Software [Editorial] >... >> >> Legislation introduced this month in both the House and the >> Senate would ease the export restrictions while attempting >> to meet some of the government's security concerns. Code >> makers would deposit a "spare key" to any exported >> encryption software with a trusted third-party agency... > >Now, I thought that the bills did no such thing. How could The >Washington Post get this so wrong? > >As I understand it, the bills do not in any way tie export to >key escrow. They mention key escrow only to the extent that >they specify that it is illegal to disclose the keys. > >Why would the paper get this cockeyed? Is it just a screwup, >or are they pushing for a change? > >thad >-- Thaddeus Beier thad(a)hammerhead.com > Technology Development 408) 286-3376 > Hammerhead Productions http://www.got.net/~thad

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- markm(a)voicenet.com wrote: On Mon, 11 Mar 1996 savron(a)world-net.sct.fr wrote: > > I began testing PGP a few days ago ( I'm a PGP newbie ) and I found > > that it gives out the key ID of an encrypted message . From this you > > can get the identification of the recipient of the message , if it's > > someone who has publicaly distributed his key (keyserver , homepage > > ...) . So even if you are unable to decode the message you can find > > who is the recipient of a given message . I think this is a big > > privacy problem . > > The recipient of the message is right in the "To:" header of the message. > If you anonymously remail a message, however, only the last remailer in the > chain will know to whom the message is encrypted, but the last remailer can > also just read the "To:" header. I don't find this to be a problem at all. Not everything goes via email, eg. mail exchanges via alt.anonymous. Gary - -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUVP2CoZzwIn1bdtAQGlBwF8DxnCbaU1P0pz0TQ7OkuE9kkuSgnf6Ump 3p6Ut328gqJGj7oEza5S78rjBMpHgUej =2Ymx -----END PGP SIGNATURE-----

1 0

Re: Remailer passphrases
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 5:43 AM 3/12/96 -0500, Gary Howland wrote: >On Mon, 11 Mar 1996, Gary Howland wrote: >> root access to the system, something like "strings /dev/kmem" could narrow >> the search for the passphrase down significantly. Of course one could >> obfuscate the passphrase by XOR'ing it with 0x80, but that's only security >> through obscrurity. > >Sure, _if_ they were able to gain root access without rebooting the machine, >but the usual scenario is that the filth turn up with black bin liners, not >men from the NSA. The bottom line of all cryptography is that there is something that must be kept secret. Since it must be kept secret, there is always a significant level of paranoia about the means to keep the secret. For example, one could imagine an attacker attaching a logic analyzer to the CPU chip, unloading the on-chip caches and then rummaging thru the system memory for the secret. One of the reasons classical (government) crypto users change keys frequently is to minimize the amount of data compromised by a broken key. We keep hearing about NSA decrypting 20 year old cyphertext and showing more of the workings of the atomic spy rings operating in the 40s and 50s. If an opponent can rubber hose the key, her job is easy. If she has to perform cryptoanalysis, it is much harder. Remailers should regularly change their keys to avoid compromising previously recorded traffic. (They can have a long lived key for signing their traffic keys.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

4 3

Re: What about PGP? (was Re: Leahy Bill a Move to Slow Crypto Exports as Much as Possible)
by jim bell 17 Dec '03

17 Dec '03

At 08:04 AM 3/11/96 -0500, Shabbir J. Safdar wrote: >I think this is somewhat skewed. Let's look at our situation now: > > We don't get to export much crypto software. > >The Leahy bill takes us to: > > We get to export lots of software that is "generally available", > "in the public domain or publicly available", or if similar > products exist already in other countries. (That's a lot of > stuff, but it's not the whole enchilada.) This is very debateable. Generally, I've found that the government will always disappoint you, in the implementation of any legislation, "good" or "bad." The "good" gets less good, the "bad" gets more bad. >We want to be at: > > We get to export all crypto software. (I mean legally; I think > we all know that export controls don't work against someone with > enough brains to post news, send mail, or use ftp) > >This is a pretty good improvement in the situation, and will hopefully >pave the way for the "whole enchilada". It's not good strategy though >to criticize this because it's not the ultimate crypto bill. I don't know about others, but _I_ haven't done that. I've made some distinct criticisms that say NOTHING about the extent to which export controls are loosened. (I leave that part of the issue alone because it is being addressed properly, unlike the matters I'm focussing on.) BTW, it has been two days since my first comment to you, however, and you have presumably seen a few more criticisms that I've heaped on a portion of the bill. Your response (or lack of it) is particularly unexpected, because you ought to be interested in defending a positive review of the bill. Sticking your head in the sand isn't a good tactic at this point. > Let's be >honest with ourselves here, this is Congress we're talking about and >this is a pretty bold step. We need to educate them to see the facts >we understand so thoroughly: "What's wrong with this picture"? If this is "a pretty bold step," then my question is, who "on our side" did they consult before they wrote this law? If, as you state, "we need to educate them..." then the implication is that this bill simply popped out without any apparent "ordinary-crypto-user/small-crypto writer-seller" input, right? In that case, we should ask "how [arguably] did they get what we wanted as well as they did?" On the other hand, if they DID get consultation from a number of "our" organizations, why didn't they fix the remaining problems? Here's a totally unsupported hypothesis for your consideration: I speculate that they DID get some input from "our" side, via some confidential arrangement, by some of those same organizations that were falling all over themselves to praise most of the bill. In other words, those organizations were subtly co-opted, although not nearly completely of course. However, those organizations then felt like they had a "hand into" the structuring of this bill, and you know how blind to faults a proud parent can be! Am I getting close to the truth here, Mr. Safdar? Tell me, Mr. Safdar, did you consult a lawyer before you endorsed this bill? Please share with us whatever legal opinions you received which induced you to speak positively about this bill. > that crypto export controls do not work, >endanger our own requirements for confidentiality, and aren't helping >contain this technology in the rest of the world. Then let's take the position that this law CAN be changed! In fact, let's insist on it. >Forcing Congress to have this debate will lay bare these facts and >hopefully embarass the Administration for their absurd policy >approach on encryption. With that limited statement I totally agree. >They say that liberty is seldom lost all at once, but a little at a time. >Regaining it is probably done this way as well. In this case, the >Leahy bill gives us back a mouthful. And the "mouthful" contains enough poison to kill our freedoms. Fortunately, the poison is easily identifiable, and is all in one spot, and should be removeable if we see it in time. So why are these people trying to shove it down our throats? Jim Bell jimbell(a)pacifier.com

1 0

Re: Leahy bill nightmare scenario?
by jim bell 17 Dec '03

17 Dec '03

At 09:09 PM 3/11/96 -0800, Timothy C. May wrote: >At 11:29 PM 3/11/96, jim bell wrote: > >>Welcome to prison, Tim. Your optimism will serve you well, there. >> >>BTW, it is clear that you haven't yet read Mr. Junger's analysis of the >>bill. Nobody except a government stooge could read that and not wonder why >>anybody would support that bill. A complete re-write is called for. > >A question, Jim: do you _ever_ just respond calmly to a post you disagree >with, or is everyone you disaagree a stooge, a cretin, an agent for the >Feds, or someone who should be disposed of with your "assassination >politics"? What's your definition of "calmly." I'm as "calm" as you can imagine. I simply have not a shred of mercy in me for people who can't accept reality. >Yes, I read Junger's analysis. A nice analysis. What does this have to do >with the points I was making? I'm a government stooge, to use your terms, >because of my points about hotel rooms? Fortunately for me, Tim, and unfortunately for you, a friend of mine visited me last night, an ex-cop who is now a cabbie (he left the force due to an accident, slipping on glare ice chasing a "perp", which caused an inoperable back injury). Being a cabbie (in the same town he was a cop), and very familiar with the "drug" and "prostitute" sections of town, I asked him whether or not he was aware of a hotel or motel ever being siezed by the govt. for "tolerating" drugs and/or prostitution. His reply was that as we speak, he knows exactly where a motel has been closed, locked up, and BARRICADED with _city_ signs and POLICE TAPE (you know the kind, "Police line: Do not cross."). We're not talking of a bankrupty, or a voluntary shutdown, either. His understanding was that this was on the news a while back. Would you like the name and address? I didn't ask him for it, but I'm sure he'll be driving by it again within the next week or so. I accept your anticipated apology, Tim. Jim Bell jimbell(a)pacifier.com

2 1

Re: Your "switchboard" listing
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:07 PM 3/11/96 -0500, you wrote: >Ha! Very funny that you have yourself listed as Mssr Thomas Pynchon in >Switchboard's listings. I especially like the mailing address. The punctuation was also interesting.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0