December 2003 - cypherpunks-legacy

Do you know what to do with this?
by Ecafe Mixmaster Remailer 17 Dec '03

17 Dec '03

well, someone stuffed this in my mailbox, with a note asking that I "delete my email address and send it to the world." im not sure what to make of it but maybe someone here will better know what do do with it. ---------- Forwarded message ---------- [headers snipped] delete my email addresses and send it to the world. these are the people who i suspect of terrorism related activities. the country they are residing in is pakistan. the address are 1-)12 ,a,b,c chinar roadu.town not marked no no no name. 2-) 6chinar road,utown peshawar,next to former prov minister ghani dad khan's house not marked, nothing written on the gate no no,no name. 3-)32b actually 12e or 14 chinar road university town peshawar. marked as 32b 4-)11 chinar road university town peshawar 5-)18 or 20chinar road university town peshawar not marked.no no. the cars are 1_)prk 9325 or 9327,a sudanese doctor ali working for the islamic relief agency mental hospital chinar road university town peshawar. 2-) a silver pajero prn or prh 6973 or 6874 4-)a white toyota landcruiser prl 8470 5-) a white pajero ningrahar(afghan) 63or ngr 133, a white girl .sometimes it has the no ngr134 on it. 6-a white pajero prp 2364 5-)a cream coloured suzuki jeep prm 6872 the cars that used to come to their house during the xmas break or on sundays when the american diplomats went to isb and they took them out the year was 1993-94 1-a red american jeep cc64-138 2-a blue old senator cc64-47 another blue senator ad 64-47 3- a white toyota land cruiser pro or prp 3305. 4- agrey american jeep prp 1228 5- a toyota pickup pro1269 or pro1260 6- ablue pajero prl 2667 7- a rust coloured corona prn 2147 8-) a white pajero ad44-104. 9-)the other cars that come are cc29-??? and cc-19 they people who come to these houses are sudanese, one phillipino woman some afghans or arabs it is difficult to tell. and a lot of white people, who mostly ride on pakistani made sohrab cycles or toyota pickups,probably muslim converteees. the cc64-138 jeep used to be driven by a pakistani looking guy ,dark with spectacles. the other pakistani nos they kept on changing ,so iam not sure if these are the correct nos 10- awhite nissan patrol x68-2199. 11-PRP 1228 grey american jeep just look for the addresses,most of the car nos are from the year 1993 so they might have changed them since.most of these people belong to the islamic relief agency.

1 0

NRC crypto report
by tien＠well.com 17 Dec '03

17 Dec '03

I'm told the study officially emerges from the National Academy Press as a book early August. Until then, apparently, the only available copies will be a limited number of pre-publication drafts issued at events like the one scheduled at SRI International, 333 Ravenswood Avenue, Menlo Park on June 5. A long way of saying that to get a copy of the whole thing, not a summary, attend on Wednesday. Lee

1 0

Re: An alternative to remailer shutdowns
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 29-MAY-1996 19:17:02.67 >On the other hand, if the Church of Spam tries to frame remailers >by posting their own Secret Documents, they can only target the >terminal remailers and as far back as they can subpoena, >because they'd otherwise have to admit that they posted it. Unfortunately, you may very well be incorrect on this. I had a chat with Uni over email a couple of days ago, and he reminded me of the possibility of them doing this through an account that wasn't obviously theirs, then claiming the initial remailer operator was negligent in not filtering the mail. The way to counter this is to only accept mail that's already encrypted to another remailer (i.e., Mixmaster with outgoing mail from non-remailers only to other remailers). If the judge is going to find a remailer operator responsible for the content of material he/she can't even read, then the remailer network is dead in its present form anyway. There's also the analogous consideration for outgoing remailers; they may need to send only encrypted mail to the transient end point(s), and the end points may need to be anonymous both in input and output. If the last remailer can read the material, then the Co$ or whoever can argue that they should filter it. The end point has to be able to read it for public messages (I'm not counting encrypted posts meant for one or a few people as public messages) to go out, so the end point would be vulnerable to lawsuits, etcetera if its identity were known. We've thus got to have the initial user choosing the ephemeral end point, and sending it to that end point encrypted for that end point. Since a well-known end point (e.g., everybody knows where to send mail to) is likely to get shut down quickly (much more so for its input end than would otherwise be the case, if the input and output ends are separate), I would suggest having the ephemeral end point owners send an appropriately encrypted message to the remailer operators, or (preferably) to a subset of them (thus being able to spot any corrupted remailer who consistently blows the gaff). This message would contain the public key for an end point or set of end points, a random number associated with that public key (although a KeyID or fingerprint might do instead), plus input end addresses for each of the end points run using that public key; this would all be signed with the public key in question. (Having it on the keyservers so as to build up reputation through signatures would be good in addition, with some appropriate pseudonymous UserID to link it with). Remailer users would then get the random number plus its associated public key upon mailing a remailer with an appropriate help request. If a remailer received for output a number it didn't recognize, I would suggest remailing the information - encrypted appropriately - to another remailer. One additional advantage of this system would be that the end users wouldn't need to know about changes in input end points - their mail would simply go to whichever of the available input end points corresponding to that public key & random number that that remailer knew and happened to randomly select. >There's been some discussion of delivering outgoing mail by >sending it through systems that don't add Received: headers; >it may make sense for non-root-owned remailers to do this >using telnet to port 25 instead of their local sendmail, >to prevent local logging and prevent their sendmail from >adding its own information. Some sendmails try to detect forgery, >but systems that aren't even configured to do Receive: probably don't. I had wondered about Port 25 as one possibility for this. Incidentally, I forgot to save the posting from someone who had commented about AOL sending out lots of membership kits with free net time - useful for ephemeral end points, although the anonymnity would be a problem. It might be interesting to find out what mailing lists they're getting their lists from - magazines catering to the middle+ classes is my guess. -Allen

1 0

Fight-Censorship Dispatch #11: Landmark Crypto Study Released
by Declan McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- Fight-Censorship Dispatch #11 ----------------------------------------------------------------------------- Landmark NRC crypto policy report released ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- In this dispatch: National Research Council releases crypto policy study Summary of NRC report recommendations Update on online copyright legislation and the CDA May 30, 1996 WASHINGTON, DC -- The National Research Council released their hefty, long-awaited report on crypto policy today at a two-hour briefing this afternoon at the National Press Club in Washington, DC. The NRC's Computer Science and Telecommunications Board's congressionally-mandated study, named "Cryptography's Role in Securing the Information Society," calls for no restrictions on domestic use of crypto but falls short of recommending that export controls should be eliminated. Instead, the report says that controls "should be progressively relaxed." The inch-thick study is certain to pack a sizeable wallop in the DC crypto policy debate, coming on the heels of the Clinton administration's "Clipper III" white paper and the crypto legislation pending in Congress. Kenneth Dam, a law professor at the University of Chicago and the chair of the NRC committee, summed it up: "We're going to have a national public debate and Congress has to be involved. We hope this report contributed to it." After Dam's overview, Marc Rotenberg from EPIC asked: "There are many issues left unresolved or open by your report. What happens next with key escrow?" Rotenberg also asked about the right to speak anonymously online, which the report didn't address. Dam hedged, as he did throughout the Q&A session: "We did not set out to evaluate key escrow. With regard to the right to speak anonymously, we saw nothing in our report that requires us to take a position. Accountability is a competing interest. It was not vital to our report." The RAND Corporation's Willis Ware clarified: "We by no means advocate authentication in a universal sense." Strangely, the executive summary doesn't even mention Pretty Good Privacy -- the NRC only recommended that 56-bit DES "should be easily exportable," ignoring PGP completely. The text of Recommendation 4.1 says "products providing confidentiality at a level that meets most general commercial requirements should be easily exportable." But does that cover the export of PGP? The report also says, in Recommendation 5.4, that Congress should consider legislation that would criminalize the use of crypto to commit a Federal crime. This portion also attracted flames. Some audience members wondered if this means crypto would continue to be treated as a munition, like guns, that can be regulated. Bottom line: the report is much more favorable than we hoped for, though it doesn't have everything we want. It *is* surprisingly pro-crypto considering that all but three of the 16 committee members had security clearances and were subjected to the NSA's classified briefing -- widely rumored to be designed to scare the recipient into agreeing to restrictions on encryption. As David Sobel from EPIC told me: "These people *did* know what the NSA knew -- but they still rejected the administration's policy." CDT's Danny Weitzner wrote: "The study is without a doubt the most comprehensive and balanced analysis of the complex encryption policy debate yet published." Fortunately, the voluminous report comes with an 35-page executive summary that's available at <http://www2.nas.edu/cstbweb/>. The full text of the report will be available online next week. (Pre-publication hardcopies were distributed at the briefing and will be available from the National Academy Press for $45. Call 202-334-2605 in two months.) +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ SUMMARY OF NRC REPORT RECOMMENDATIONS +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ Recommendation 1: No law should bar the manufacture, sale, or use of any form of encryption within the United States. Recommendation 2: National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. Recommendation 3: National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. Recommendation 4: Export controls on cryptography should be progressively relaxed but not eliminated. 4.1 -- Products providing confidentiality at a level that meets most general commercial requirements should be easily exportable. Today, products with encryption capabilities that incorporate 56-bit DES provide this level of confidentiality and should be easily exportable. 4.2 -- Products providing stronger confidentiality should be exportable on an expedited basis to a list of approved companies if the proposed product user is willing to provide access to decrypted information upon legally authorized request. 4.3 -- The U.S. government should streamline and increase the transparency of the export licensing process for cryptography. Recommendation 5: The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. 5.1 -- The U.S. government should actively encourage the use of cryptography in nonconfidentiality applications such as user authentication and integrity checks. 5.2 -- The U.S. government should promote the security of the telecommunications networks more actively. At a minimum, the U.S. government should promote the link encryption of cellular communications and the improvement of security at telephone switches. 5.3 -- To better understand how escrowed encryption might operate, the U.S. government should explore escrowed encryption for its own uses. To address the critical international dimensions of escrowed communications, the U.S. government should work with other nations on this topic. 5.4 -- Congress should seriously consider legislation that would impose criminal penalties on the use of encrypted communications in interstate commerce with the intent to commit a federal crime. +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ UPDATE ON ONLINE COPYRIGHT LEGISLATION AND THE CDA +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ ON THE CDA: Folks involved in the case expect a decision within the next week from the Philadelphia three-judge panel hearing our challenge to the CDA. The Department of Justice has a few weeks to appeal to the Supreme Court if they lose. ON COPYRIGHT: There's plenty of action on the Hill -- and contrary to what I thought a week ago, there's even a fighting chance that this braindead copyright bill will pass this year. So far, full Senate judiciary and the House judiciary intellectual property subcommittee have held hearings. The House has taken the lead now, and the tentative date for the subcommittee markup of HR2441 is June 5. (It was to have been last week, but was cancelled at the last minute when no agreement was reached.) As Brock Meeks wrote in his Muckraker column on HotWired: Both bills contain intellectual property land mines. If they aren't defused, all online service providers - from the single-line BBS to commercial online services to internet service providers - could end up as de facto "copyright cops," made to rig their systems so that they can monitor every single bit of information trafficked by their users. Reason: both bills hold online service providers liable for any infringing information passing through or stored on their system. There are other reasons not to like this bill, including language that makes surfing the Net a copyright violation unless you happen to have a "license" for hitting a particular site with your browser. You see, the courts have ruled that simply sucking bits into your computer's memory, i.e. surfing, is the same as making a copy of something. No, I'm not making this up. Stay tuned for more reports. ----------------------------------------------------------------------------- Mentioned in this Fight-Censorship Dispatch: NRC report overview text: <http://www2.nas.edu/cstbweb/28e2.html> Info on online copyright legislation: <http://www.ari.net/dfc/> Brock Meeks' column on online copyright: <http://www.hotwired.com/muckraker/96/20/index3a.html> This and previous Fight-Censorship Dispatches are available at: <http://fight-censorship.dementia.org/top/> Want to subscribe to the low-traffic, moderated fight-censorship announcement mailing list for future Fight-Censorship Dispatches and related messages? Send "subscribe fight-censorship-announce" in the body of a message addressed to: majordomo(a)vorlon.mit.edu Other relevant web sites: <http://www.eff.org/> <http://www.cdt.org/> <http://www.aclu.org/> <http://www.ala.org/> -----------------------------------------------------------------------------

1 0

NRC Report Contents
by jya＠pipeline.com 17 Dec '03

17 Dec '03

[Report Cover] [Header all pages] May 30, 1996, Prepublication Copy Subject to Further Editorial Correction Cryptography's Role in Securing the Information Society Kenneth Dam and Herbert Lin, Editors Committee to Study National Cryptography Policy Computer Science and Telecommunications Board Commission on Physical Sciences, Mathematics, and Applications National Research Council National Academy Press Washington, D.C. 1996 ____________________________________________________________ Contents PREFACE Introduction Charge of the Committee to Study National Cryptography Policy What This Report Is Not On Secrecy and Report Time Line A Note from the Chair Acknowledgments EXECUTIVE SUMMARY A ROAD MAP THROUGH THIS REPORT PART I -- FRAMING THE POLICY ISSUES 1 GROWING VULNERABILITY IN THE INFORMATION AGE 1.1 The Technology Context of the Information Age 1.2 Transitions to an Information Society -- Increasing Interconnections and Interdependence 1.3 Coping with Information Vulnerability 1.4 The Business and Economic Perspective 1.4.1 Protecting Important Business Information 1.4.2 Ensuring the Nation's Ability to Exploit Global Markets 1.5 Individual and Personal Interests in Privacy 1.5.1 Privacy in an Information Economy 1.5.2 Privacy for Citizens 1.6 Special Needs of Government 1.7 Recap 2 CRYPTOGRAPHY: ROLES, MARKET, AND INFRASTRUCTURE 2.1 Cryptography in Context 2.2 What Is Cryptography and What Can It Do? 2.3 How Cryptography Fits into the Big Security Picture 2.3.1 Technical Factors Inhibiting Access to Information 2.3.2 Factors Facilitating Access to Information 2.4 The Market for Cryptography 2.4.1 The Demand Side of the Cryptography Market 2.4.2 The Supply Side of the Cryptography Market 2.5 Infrastructure for Widespread Use of Cryptography 2.5.1 Key Management Infrastructure 2.5.2 Certificate Infrastructures 2.6 Recap 3 NEEDS FOR ACCESS TO ENCRYPTED INFORMATION 3.1 Terminology 3.2 Law Enforcement: Investigation and Prosecution 3.2.1 The Value of Access to Information for Law Enforcement 3.2.2 The Legal Framework Governing Surveillance 3.2.3 The Nature of Surveillance Needs of Law Enforcement 3.2.4 The Impact of Cryptography and New Media on Law Enforcement (Stored and Communicated Data) 3.3 National Security and Signals Intelligence 3.3.1 The Value of Signals Intelligence 3.3.2 The Impact of Cryptography on SIGINT 3.4 Similarities and Differences Between Foreign Policy/National Security and Law Enforcement Needs for Communications Monitoring 3.4.1 Similarities 3.4.2 Differenees 3.5 Business and Individual Needs for Exceptional Access to Protected Information 3.6 Other Types of Exceptional Access to Protected Information 3.7 Recap PART II -- POLICY INSTRUMENTS 4 EXPORT CONTROLS 4.1 Brief Description of Current Export Controls 4.1.1 The Rationale for Export Controls 4.1.2 General Description 4.1.3 Discussion of Current Licensing Practices 4.2 Effectiveness of Export Controls on Cryptography 4.3 The Impact of Export Controls on U.S. Information Technology Vendors 4.3.1 De Facto Restrictions on the Domestic Availability of Cryptography 4.3.2 Regulatory Uncertainty Related to Export Controls 4.3.3 The Size of the Affected Market for Cryptography 4.3.4 Inhibiting Vendor Responses to User Needs 4.4 The Impact of Export Controls on U.S. Economic and National Security Interests 4.4.1 Direct Economic Harm to U.S. Businesses 4.4.2 Damage to U.S. Leadership in Information Technology 4.5 The Mismatch Between the Perceptions of Government/ National Security and Those of Vendors 4.6 Export of Technical Data 4.7 Foreign Policy Considerations 4.8 Technology-Policy Mismatches 4.9 Recap 5 ESCROWED ENCRYPTION AND RELATED ISSUES 5.1 What Is Escrowed Encryption? 5.2 Administration Initiatives Supporting Escrowed Encryption 5.2.1 The Clipper Initiative and the Escrowed Encryption Standard 5.2.2 The Capstone/Forteza (sic) Initiative 5.2.3 The Relaxation of Export Controls on Software Products Using "Properly Escrowed" 64-bit Encryption 5.2.4 Other Federal Initiatives in Escrowed Encryption 5.3 Other Approaches to Escrowed Encryption 5.4 The Impact of Escrowed Encryption on Information Security 5.5 The Impact of Escrowed Encryption on Law Enforcement 5.5.1 Balance of Crime Enabled vs. Crime Prosecuted 5.5.2 Impact on Law Enforcement Access to Information 5.6 Mandatory vs. Voluntary Use of Escrowed Encryption 5.7 Process Through Which Policy on Escrowed Encryption Was Developed 5.8 Affiliation and Number of Escrow Agents 5.9 Responsibilities and Obligations of Escrow Agents and Users of Escrowed Encryption 5.9.1 Partitioning Escrowed Information 5.9.2 Operational Responsibilities of Escrow Agents 5.9.3 Liabilities of Escrow Agents 5.10 The Role of Secrecy in Ensuring Product Security 5.10.1 Algorithm Secrecy 5.10.2 Product Design and Implementation Secrecy 5.11 The Hardware/Software Choice in Product Implementation 5.12 Responsibility for Generation of Unit Keys 5.13 Issues Related to the Administration Proposal to Exempt 64-bit Escrowed Encryption in Software 5.13.1 The Definition of "Proper Escrowing" 5.13.2 The Proposed Limitation of Key Lengths to 64 Bits or Less 5.14 Recap 6 OTHER DIMENSIONS OF NATIONAL CRYPTOGRAPHY POLICY 6.1 The Communications Assistance for Law Enforcement Act 6.1.1 Brief Description of and Stated Rationale for the CALEA 6.1.2 Reducing Resource Requirements for Wiretaps 6.1.3 Obtaining Access to Digital Streams in the Future 6.1.4 The CALEA Exemption of Information Service Providers and Distinctions Between Voice and Data Services 6.2 Other Levers Used in National Cryptography Policy 6.2.1 Federal Information Processing Standards 6.2.2 The Government Procurement Process 6.2.3 Implementation of Policy: Fear, Uncertainty, Doubt, Delay, Complexity 6.2.4 R&D Funding 6.2.5 Patents and Intellectual Property 6.2.6 Formal and Informal Arrangements with Various Other Governments and Organizations 6.2.7 Certification and Evaluation 6.2.8 Nonstatutory Influence 6.2.9 Interagency Agreements Within the Executive Branch 6.3 Organization of the Federal Government with Respect to Information Security 6.3.1 Role of National Security vis-a-vis Civilian Information Infrastructures 6.3.2 Other Government Entities with Influence on Information Security 6.4 International Dimensions of Cryptography Policy 6.5 Recap PART III--POLICY OPTIONS, FINDINGS, AND RECOMMENDATIONS 7 POLICY OPTIONS FOR THE FUTURE 7.1 Export Control Options for Cryptography 7.1.1 Dimensions of Choice for Controlling the Exportof Cryptography 7.1.2 Complete Elimination of Export Controls on Cryptography 7.1.3 Transferral of All Cryptography Products to the Commerce Control List 7.1.4 End-use Certification 7.1.5 Nation-by-Nation Relaxation of Controls and Harmonization of U.S. Export Control Policy on Cryptography with Export/Import Policies of Other Nations 7.1.6 Liberal Export for Strong Cryptography with Weak Defaults 7.1.7 Liberal Export for Cryptographic Applications Programming Interfaces 7.1.8 Liberal Export for Escrowable Products with Encryption Capabilities 7.1.9 Alternatives to Government Certification of Escrow Agents Abroad 7.1.10 Use of Differential Work Factors in Cryptography 7.1.11 Separation of Cryptography from Other Items on the U.S. Munitions List 7.2 Alternatives for Providing Government Exceptional Access to Encrypted Data 7.2.1 A Prohibition of the Use and Sale of Cryptography Lacking Features for Exceptional Access 7.2.2 Criminalization of the Use of Cryptography in the Commission of a Crime 7.2.3 Technical Non-Escrow Approaches for Obtaining Access to Information 7.2.4 Network-based Encryption 7.2.5 Distinguishing Between Encrypted Voice and Data Communications Services for Exceptional Access 7.2.6 A Centralized Decryption Facility for Government Exceptional Access 7.3 Looming Issues 7.3.1 The Adequacy of Various Levels of Encryption Against High-Quality Attack 7.3.2 Organizing the U.S. Government for Better Information Security on a National Basis 7.4 Recap 8 SYNTHESIS, FINDINGS, AND RECOMMENDATIONS 8.1 Synthesis and Findings 8.1.1 The Problem of Information Vulnerability 8.1.2 Cryptographic Solutions to Information Vulnerabilities 8.1.3 The Policy Dilemma Posed by Cryptography 8.1.4 National Cryptography Policy for the Information Age 8.2 Recommendations 8.3 Additional Work Needed 8.4 Conclusion APPENDIXES A Contributors to the NRC Project on National Cryptography Policy B Glossary C A Brief Primer on Cryptography D An Overview of Electronic Surveillance: History and Current Status E A Brief History of Cryptography Policy F A Brief Primer on Intelligence G The International Scope of Cryptography Policy H Summary of Important Requirements for a Public-Key Infrastructure I Industry-Specific Dimensions of Security J Examples of Risks Posed by Unprotected Information K Cryptographic Applications Programming Interfaces L Laws, Regulations, and Documents Relevant to Cryptography M Other Looming Issues Related to Cryptography Policy N Federal Information Processing Standards [End Contents]

1 0

Edited ACLU News
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 30-MAY-1996 01:11:39.86 From: Phil Agre <pagre(a)weber.ucsd.edu> >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >This message was forwarded through the Red Rock Eater News Service (RRE). >Send any replies to the original author, listed in the From: field below. >You are welcome to send the message along to others but please do not use >the "redirect" command. For information on RRE, including instructions >for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >Date: Wed, 29 May 1996 11:57:30 GMT >From: ACLU Newsfeed Owner <owner-aclu-news(a)aclu.org> >To: news(a)aclu.org [...] > *Ban on "Offensive" Comments Ruled Vague* >SAN FRANCISCO -- A state law against "offensive" personal comments by lawyers >was ruled unconstitutionally vague Friday for the second time, despite the >State Bar's attempt to define it, the Associated Press reports. >The 9th U.S. Circuit Court of Appeals first struck the law down in April >1995, overturning a disciplinary order against a Los Angeles attorney who >denounced women lawyers, the AP reported. In a 3-0 ruling, the court said the >law was so broad and undefined that lawyers wouldn't know when they were >violating it. >The panel granted a rehearing last December to give the state and the State >Bar, not previously parties, a chance to defend the law. >The bar cited its new policy, adopted in October, that said the law would be >enforced only against conduct in a courtroom or similar setting, such as a >sworn deposition, that was so serious as to be "prejudicial to the >administration of justice." They also said the law merely enforced an ethical >code that lawyers were required to know as part of their profession. >The court was unpersuaded, AP said, reaffirming its previous decision in a >2-1 ruling. >The case involved a disciplinary order against attorney Frank L. Swan, who >wrote an angry note in May 1993 to a female prosecutor who had gotten him >removed from a case. He attached the following statement to the note, >photocopied from a magazine article: >"Male lawyers play by the rules, discover truth and restore order. Female >lawyers are outside the law, cloud truth and destroy order." >In overturning the disciplinary order, the appeals court said the note showed >a "patently sexist attitude'' but did not impugn the female prosecutor's >integrity or interfere with the administration of justice. >The American Civil Liberties Union defended Swan. The National Organization >for Women was among those opposing him. One notices that the court did not strike this down on the obvious grounds of free speech. I believe this may be an example of a law, not struck down on such grounds, that fits TCMay's description that Rich disputed. >---------------------------------------------------------------- > *Clinton Expands National ID* >Seeking to further demonstrate its tough stance against illegal immigration, >the Clinton Administration announced Thursday a national expansion of a pilot >program in California that requires participating employers to verify the >legal status of job seekers, according to a front page article in the New >York Times. >Specifically, the Immigration and Naturalization Service reached agreement >with the nation's four largest meat-packing companies (representing 80 >percent of the industry's 70,000 employees) to use a computerized data system >at 41 plants in 12 Western and Midwestern states to determine if job >applicants are documented workers. >The ACLU and other civil libertarians have long criticized the plan, saying >it would lead to an costly, intrusive and error-prone national identification >card. >The effort announced today builds on the seven-month-old pilot program in two >Southern California counties, Santa Ana and the City of Industry. >Meanwhile, immigration bills approved by the House and the Senate, and now >awaiting resolution in a conference committee, include differing provisions >that would expand pilot programs even further to allow the INS to more >quickly evaluate among different systems. >"These pilot programs all lead down the same path," said Greg T. Nojeim, an >ACLU Legislative Counsel. "Unless the public steps up its pressure to stop >them from proceeding, the government will build a giant computer registry >that will require every single hiring decision in this country to be cleared >through a centralized database."

1 0

Something that just crossed my mind. Sorry.
by snow 17 Dec '03

17 Dec '03

In some of the discussion on this list there has been some concern about the governments position on anonymous fund transfers. Well, maybe concern is incorrect. We _know_ (or should) what it is. They are dead set against it. My thought was that business would be against it as well, which would make it even harder to implement. Now maybe this has been dicussed in the years before I got here, so if it has, sorry. The discussion here seems to assume that business will accept, or even welcome the ability of it's customers to remain unknown, or nymknown. It is my position (until proven wrong--please) that larger business DON'T want anonymity. They _want_ to be able to track purchases and use of their product for several reasons. These are still pretty rough, but: 1) Marketing. Here in chicago, there is a grocery store that issues a discount/check cashing card. Because this card is a Check Cashing card you need to give financial data to get it. This data includes address, bank account info etc. This card is presented at purchase time, and is of course personalized and your purchases are (assumptions from here to end) tracked, and can be used to develop targeted marketing (with the development of print on demand systems, this becomes even easier). The use of anonymity (at this point you don't _need_ to get the card, unless you want to use a check, so cash (how I pay, my wife is different) is still viable) would ruin this. Why would they want to change? 2) For larger purchases, this data gathering is even more important. I am sure that GM, Ford, Toyota et. al. keep and compile extensive demographic information on their customers for use in product development and target marketing. It is my belief that it is infact big business that drives the legislation in this country, and if they want anonymous fund transfers, they will get it. Most people would be more than willing to use anonymous purchasing, but big business doesn't currently want it, and IMO, they never will. Smaller business would welcome it, but many of these businesses are the very businesses that many fundamentalist/feminist/statist types would like to eliminate. Porn, Sex trade, and drug trade(which is already pretty anonymous) all fall into this category. The questions that this raises are: 1) Am I full of shit. This is very possible. 2) What pressure can we put on the government to go against both their own wishes and the wishes of Big Business (answer: none, or very little) 3) Given 2, what can be done to change the minds of Big Business? Not to say that the protocalls and software shouldn't be developed and deployed. It should, to prove that it works, and to allow those willing to use it to do so. If it proves popular and economically viable, it could do 3, and then 2 would not be necessary. Then again, given 1... Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)crash.suba.com

1 0

Possible out-of-US remailer sites, 2nd edition
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

This is the second edition of my listing of possible good companies outside the US from which to run an anonymous remailer, assuming telnetting to a UNIX shell in most cases. (Those marked with a + have access through PPP, SLIP, or similar protocols). I have removed Malaysia from the listing due to its government's suppression of free speech/press, which Rich Graves was kind enough to point out to me. The countries on here are a mixture of those with strong support for free speech/press, and those with useful laws regarding offshore companies, through which a for-profit remailer might be run with limited liability. _Country/Area_ _Name_ _Email_ Anguilla Cable & Wireless webmaster(a)candw.com.ai Anguilla Offshore Information Services*** info(a)offshore.com.ai Antigua Cable & Wireless scholla(a)candw.ag Barbados CaribSurf webmaster(a)caribsurf.com Denmark cybernet.dk info(a)cybernet.dk Finland Clinet clinet(a)clinet.fi Finland Net People helpdesk(a)netppl.fi Finland Xgateway Finland* pal(a)xgw.fi Iceland Multimedia Consumer Services mmedia(a)mmedia.is Isle of Man Advanced Systems Consultants** info(a)advsys.co.uk Jamaica InfoChannel icquery(a)infochan.com Liechtenstein Ping Services afink(a)ping.ch Liechtenstein Online Store webmaster(a)onlinestore.com Malta maltaNET info(a)maltanet.omnes.net New Zealand +PlaNet Free NZ support(a)planet.gen.nz New Zealand +PlaNet FreeNZ Wellington tich(a)wn.planet.gen.nz New Zealand The Internet Group info(a)ihug.co.nz New Zealand +Manawatu Internet Services info(a)manawatu.gen.nz New Zealand Wave Internet Services accounts(a)wave.co.nz Sweden FX fx(a)uni-x.se Sweden Internet One** Support(a)one.se Sweden Kajplats 305 info(a)kajen.malmo.se * = This organization has on its main page a link to a document called the "Declaration of an Independent Internet." It thus may be possible to persuade them to support a remailer at reduced or no charge as part of this. ** = This organization's main page has the EFF blue ribbon, unlike others. *** = This organization is run by a cypherpunk, Vince Cate. It does have the disadvantages of requiring $50 a month or $420 a year for a telnet-only UNIX shell, with a limit of 50 MB/month for mail without extra charges. However, its charge is $20 a month or $168 a year for a POP account, although the limit is then 20 MB/month for mail without extra charges. I would appreciate comment on all aspects of this list. These include: additional companies and countries to add; companies or countries to take off (international politics & law is not my subject); and suggestions about where to look for more (it is quite possible that I did not locate all the lists of out-of-US ISPs). -Allen

2 1

Re: Possible out-of-US remailer sites, 2nd edition
by Bill Stewart 17 Dec '03

17 Dec '03

>_Country/Area_ _Name_ _Email_ >Anguilla Cable & Wireless webmaster(a)candw.com.ai >Anguilla Offshore Information Services*** info(a)offshore.com.ai .... Cool list - thanks! Cable & Wireless, by the way, is a major carrier in a number of places in the world, so it may have to tolerate government regulations more than a small or non-telecom business would. On the other hand, when I've done traceroutes to Vince's machine, they went through C&W, so if there were really major pressure on C&W, they might end up having to cut of Vince and other small remailers anyway. There are a number of small countries that aren't part of the US/European/Chinese/Singaporean Hegemonies, where telecom is expensive and Fidonets and uucp are the way to get email there. If you're willing to pay some money to support one, you might get some real anonymity for financially critical data. Also, there are periodic articles in magazines like Wired about how George Soros is wiring the Balkans; perhaps someone there would like to make some money running remailers. There was one in Slovenia for a while, though I don't know if it was physically there or only had a .si domain. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: NRC Cryptography Report:
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Some dumb questions from a citizen. Note: Recommendation summaries are from "Fight-Censorship Dispatch #11: Landmark Crypto Study Released", posted by Declan McCullagh <declan(a)eff.org>. Thanks Declan. >Recommendation 4: Export controls on cryptography should be >progressively relaxed but not eliminated. > > 4.1 -- Products providing confidentiality at a level that > meets most general commercial requirements should be easily > exportable. Today, products with encryption capabilities that > incorporate 56-bit DES provide this level of confidentiality > and should be easily exportable. How do you reconcile this recommendation with the recommendation of the Cryptography experts group that data which needs to be kept secret for 20 years should be protected by at least 90 bit keys? The current export restrictions inhibit using strong crypto domestically. How do this recomendation free domestic crypto for commercial development? Another way of asking is, how can strong crypto be distributed in the US so as to preclude prosecution for exporting it? How do future export controls affect software posted to FTP/web sites? > > 5.3 -- To better understand how escrowed encryption might > operate, the U.S. government should explore escrowed > encryption for its own uses. To address the critical > international dimensions of escrowed communications, the U.S. > government should work with other nations on this topic. How do government experiments with key recovery systems help us learn about their vulnerablities to human level attacks, e.g. bribery? How much negotiable value will these government systems carry? How will GAKed systems protect US business from spying by foreign governments? France is rumored to be particularly active in commercial spying, and will want access to all keys used in France. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0