December 2003 - cypherpunks-legacy

Technology and Privacy
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The Washington Post, July 1, 1996, p. A16. Technology and Privacy [Letter] In reference to the May 31 editorial "Plant Lights and Privacy" commenting on an 11th Circuit Court of Appeals decision to uphold the use of thermal imaging in cases involving indoor marijuana growing operations: The U.S. Supreme Court had just declined to review that 11th Circuit decision. On June 11, The Post published a letter from Jack King ["When Government Can Look Through Walls"] warning us that thermal imaging, as developed by the military and as used by civilian law enforcement agencies with the cooperation of the military, posed an Orwellian threat to citizens because the government could use the technology to tell if two people were making love in the privacy of their bedroom. To set the record straight, military thermal imaging is used to support civilian law enforcement only after other probable cause for a search warrant, such as power bills, observation of boarded-up windows, vents on the roof to draw away heat and buys by confidential informants, are documented. The military is then called in, using thermal imagers, to determine if there is an unusual heat source in the house as detected by heat escaping from the house. In dozens of cases where thermal imaging was used, I have not observed one case where it could detect the activity of people in a house, let alone a bedroom. I also have not observed the technology to have the ability to detect what people are doing in any room behind closed doors, covered windows and walls other than to detect blurs or shadows moving around behind light curtains. The United States v. Cusumano language quoted by Mr. King was reversed last month by the court because the original three judges decided it was an issue that didn't need deciding, i.e. the constitutionality of thermal imaging absent a search warrant, and did not exercise "judicial restraint." The trend to Mr. King's "militarization" of the war on drugs, based on a decision by then-secretary of defense Richard Cheney that drug use represented a threat to our national security, is being carried out with restraint, respect for the law and an appropriate appreciation for the privacy of our citizens. Barrie A. Vernon Alexandria The writer is an attorney with the National Guard Bureau at the Pentagon working in support of the counter-drug directorate. [End]

1 0

Re: The Net and Terrorism
by jya＠pipeline.com 17 Dec '03

17 Dec '03

To complement Tim May's essay on the Net and Terrorism: The Washington Post, July 1, 1996, Business, p. 22. Keeping the Military in High Tech [Excerpts] At Camber Corporation in Springfield, Va., posters, comic strips and colorful Silicon Graphics Inc. computers dot the office landscape. Employees banter as they work. Technical director Bryan Ware, 26, serves as the bridge between the college-age computer programmers and the military commanders who authorize the projects. "A lot of military people don't know or trust technology," he said. "A lot of computer nerds don't know or trust the military. I know and like both." The Army had a congressional mandate to prepare for terrorists using chemical, biological or even nuclear weapons and for civilian doctors having to figure out how to treat the victims. To that end, the Army contracted Camber to create the Nuclear Biological Chemical Medical Defense Information Server which has many more bells and whistles than the average Web site. On the opening page, "danger" signs line the background. Articles on the latest terrorist catastrophes appear in the center of the screen. Black illuminated links to the site's library, to news and to other information fill the left-hand side. Click on the library link, and medical manuals on nuclear, biological and chemical warfare treatments appear. To the left, a video section link becomes visible. Click on it, and an interactive session begins between the user and an actor playing the role of nuclear, chemical or biological warfare victim. If the user administers the proper treatment (it's good to read the library manuals before going to the video), the victim will survive. If the user fails to administer the correct procedures, the victim will die. "We try to have fun," said Alex Neifert, 21, who's working on the Army Web site project for the summer before heading back to the University of Michigan's Graduate School of Information in the fall. "We're hoping to improve the preparedness of the military and civilian communities to deal with these types of problems. This site will give doctors access to important information that could save lives in the event of a terrorist action," said the Army officer in charge of the project. Camber and the military hope that 1,000 visitors will view the Web site daily when it officially opens July 3. To access the site, point your browser to: www.nbc.gov/. -----

3 2

Re: Technology and Privacy
by declan＠well.com 17 Dec '03

17 Dec '03

The June 11 letter was from Jack King, a quite clueful and thoughtful D.C. attorney who has been diligent in tracking the war on (some) drugs. Hardly an alarmist. Why can't I quite bring myself to trust "Barrie A. Vernon?" -Declan > The Washington Post, July 1, 1996, p. A16. > > > Technology and Privacy [Letter] > > > In reference to the May 31 editorial "Plant Lights and > Privacy" commenting on an 11th Circuit Court of Appeals > decision to uphold the use of thermal imaging in cases > involving indoor marijuana growing operations: The U.S. > Supreme Court had just declined to review that 11th Circuit > decision. > > On June 11, The Post published a letter from Jack King > ["When Government Can Look Through Walls"] warning us that > thermal imaging, as developed by the military and as used > by civilian law enforcement agencies with the cooperation > of the military, posed an Orwellian threat to citizens > because the government could use the technology to tell if > two people were making love in the privacy of their > bedroom. > > To set the record straight, military thermal imaging is > used to support civilian law enforcement only after other > probable cause for a search warrant, such as power bills, > observation of boarded-up windows, vents on the roof to > draw away heat and buys by confidential informants, are > documented. The military is then called in, using thermal > imagers, to determine if there is an unusual heat source in > the house as detected by heat escaping from the house. In > dozens of cases where thermal imaging was used, I have not > observed one case where it could detect the activity of > people in a house, let alone a bedroom. I also have not > observed the technology to have the ability to detect what > people are doing in any room behind closed doors, covered > windows and walls other than to detect blurs or shadows > moving around behind light curtains. > > The United States v. Cusumano language quoted by Mr. King > was reversed last month by the court because the original > three judges decided it was an issue that didn't need > deciding, i.e. the constitutionality of thermal imaging > absent a search warrant, and did not exercise "judicial > restraint." > > The trend to Mr. King's "militarization" of the war on > drugs, based on a decision by then-secretary of defense > Richard Cheney that drug use represented a threat to our > national security, is being carried out with restraint, > respect for the law and an appropriate appreciation for the > privacy of our citizens. > > Barrie A. Vernon > Alexandria > The writer is an attorney with the National Guard Bureau at > the Pentagon working in support of the counter-drug > directorate. > > [End] > > > > > >

1 0

Re: mocking paranoia
by Deranged Mutant 17 Dec '03

17 Dec '03

On 29 Jun 96 at 5:58, nelson(a)crynwr.com wrote: > Earlier, someone mocked someone else for being paranoid. Sorry, but > this is a mistake. By definition, you have a non-empty threat model > when you set out to encrypt; therefore you must be paranoid to use > encryption. [..] Depends. If you're paranoia is irrational, then you may do irrational things that will hurt... For instance, there are people who believe that the NSA has control over every C compiler on the planet which inserts a back door into any version of PGP, and therefore the only 'safe' PGP is v1.0. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

(fwd) Re: Cookie problem here , cookie problem there ...
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

[Given the recent upset here regarding cookies, of which I only have the most cursory knowledge, I hope some will find this tidbit of use.] >From: jerryw(a)convex.com (Jerry Whelan) Newsgroups: comp.infosystems.www.authoring.cgi,comp.infosystems.www.authoring.misc,comp.infosystems.www.browsers.misc Subject: Re: Cookie problem here , cookie problem there ... Date: 1 Jul 1996 14:28:39 -0500 Lines: 28 In article <4r8m92$4u(a)news.istar.ca>, Gord Jeoffroy <crs1583(a)inforamp.net> wrote: -} Margaret <margaret(a)werple.net.au> wrote: -} -} >You can disable the warnings, you cannot disable the cookies. I am -} >cancelling every cookie I encounter (I usually avoid sites heavy -} >with cookies), reason - I hate invasion of privacy and in particular, -} >junk email from direct marketing. -} -} -} I completely agree with your sentiment, by the way. I'm planning to -} add an editorial to an online magazine I'm beginning. The article will -} be full of server-side includes to demonstrate to the person reading -} it that Big Brother definitely is watching. I don't have any connection with these guys, except that I use their software. Check out www.privnet.com and the Internet Fast Forward netscape plugin for Windows. It can selectively filter cookie transmissions to web servers as well as some other very cool stuff like filter out unwanted images, including but not limited to advertisements. You will be amazed how much more information you can get on your screen when you filter out the useless images, like the one netscape puts at the top of their home page. -- ------------------------------------------------------------------------------ Jerry Whelan -- Information Superman jerryw(a)convex.com -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information "We think people like seeing somebody in a uniform on the porch." -US Postal spokeswoman, quoted in AP 1/27/96. I don't know about you, but the only folks I know who'd enjoy seeing someone in uniform on their porch are leathermen...

1 0

Notes from SAFE meeting
by minow＠apple.com 17 Dec '03

17 Dec '03

Here are my raw, unedited, incomplete, and not to be trusted, notes from the SAFE meeting, July 1, 1996, at Stanford. (ps. thanks to the folk who did an amazing amount of work to put this on.) burns: fbi, cia, nsa presented to senate/congress: said nothing that wasn't already in public record (newspapers) telia (Swedish Telecom) representative (Mattias Soederholm) -- can't import strong encryption as NSA claims it would harass company. doesn't like having to tell customers that USA will read their mail. Whit Diffie - nuclear non-proliferation: proliferation of crypto does more good than harm: make sure that weapons are under your control: extensive development since Kennedy administration. Positive control over nuclear weapon: crypto. ---- Technical panel ---- whit diffie, eric thompson (forced decryption, fbi is a client), bruce schneier, tom parenty (sybase), matt blaze. We came to discuss policics, but were charged with discussing technology. key lengths -- too much jargon. question is work factor: how much work to break system. public keys used only for signatures; actual encryption uses "normal" crypto. 40 bits == 2^40 operations to get a key. First: two different points of view: security officer: every message must be secure, even against strong opponent. intelligence agency wants to read every message. 30, 60, 90, 120. 2^30 == one billion. any pc can recover any key. billion billion == des. very clear that can do it, not easy, however. 90 bits billion billion billion. won't be do-able in lifetime of business personal data. 120 bits can't be do-able in forseeable future. but, point of view of an intercept organization; meet in the middle? won't satisfy either party's interest. 40 bit can be exported. last year, demonstrated that can break 40 bit keys. Takes on order of few weeks to a month of Sun workstations. intercept device spends most of its time deciding whether to record data. has a fraction of a second to look at a message, 40 bits too large for intercept on that basis. eric thompson. access data. cryptanalysis -- break codes, build hardware to aid in this. specialize in defining parts and pieces to break e.g., rc40 amd2905 chips on a board breaks in $8,400 engineering cost. Sell under $20,000. little company, not well-funded government agency. des fpga about $1M/7 days per key. off the shelf design using 5 year old chips. what's realistic to expect the nsa, fbi can do? bruce schneier: foreign crypto. is it any good? yes. more done outside usa than inside. many countries asia, europe, pacific have strong groups. algorithm conferences: 90% of papers from outside usa. hard to get funding in usa. more academic research overseas. products with more options. here, products are hamstrung by baggage: key length, escrow. other countries can write without restrictions. best products from former yugoslavian folk working in swedish university. usa corp's cant compete: no talent, government restrictions. losing our share of research, developement, products. as internet becomes ubiquitious, we lose market share. restrictions won't stop, will only hurt us. tom parenty; worked for NSA: "in God we trust, the rest we monitor." key escrow ineffective. can today buy over 500 products from 60 countries. no usa monopoly. www.cypto.com home page; list of pointers for our favorite foreign crypto products (for some value of "our" and some value of "favorite.") crypto controls don't keep crypto out of child pronographer hands. keeps out of hands of legitimate individuals and corporations. criminal, terrorist, can layer foreign crypto on anything usa gov't does. will give protection. moral equiv of wiretaps? no! criminals: criminals talk to criminals, criminals talk to rest of world. crim to crim: use strong crypto. crim to airline, car rental, hotel: can go to airline etc. and subpeona their records: crypto buys nothing for wiretap. solve crimes, prevent crimes? would key escrow prevent oklahoma bombing? but without strong crypto, foreigner working outside usa can take plane down, grab medical records. etc., by hacking insecure networks. matt blaze: key escrow. ignore politics; doesn't make technical sense. fundamental flaws software engineering can't technically solve in a sensible way. first: enormous increase of engineering complexity. difficult to design even simply secure (alice, bob, eve + detective dorothy) system engineering. key escrow makes this even more difficult. engineering problem is too complex. classified world not far ahead of unclassified: blaze discovered protocol failure in clipper chip design -- can circumvent escrow field, can forge messages. reason failures occur not because nsa incompetent, but because problem is extremely difficult. second fundamental problem: operating key escrow center economically and technically difficult. 24/7/365, 2 hour response to law enforcement request. key escrow doesn't distinguish between comm key, data storage keys, and signature keys. releasing latter may be devistating. --- diffie: if you collect data; it will be used (census data used to round up Japanese in California, Jews in Germany, Holland, Denmark). schneier: data harvesting: insurance company wants to know who filled perscription for AZT. crpyto prevents against non-invasive attack; not against fbi entering house to install bugs. diffie: crypto requirements of bad people: terrorists need tight-knit, unified in purpose. tools to secure communication are readily available "closed crypto." ordinary folk need open crypto; delayed by government restrictions. --- legal issues: ken bass: counsel for telecom policy: national security? non-escrowed strong encryption? balance? costs? what are they, what do we lose? escrow born by nsa mission. didn't hear law enforcement concerns initially; now nsa stands behind shield of fbi. nsa/fbi has created arms race among cryptographers. most people would have been happy with des, which nsa can probably break, but not others. nsa discovered it was doing itself great damage by pursuing export controls: but biggest danger to nsa is explosion of protocols, routings, etc. nsa wants to read everything to see what it wants to look at. fbi, however, knows what it wants to see. nsa knows that crypto puts it out of business. nsa needs to preserve fiction of crypto (i.e, that they can read, but you think they can't). fbi wants to preserve status quo. law enforcement can't undertake survelience until it knows who the target is. don't need crypto to find crooks. needed only after you know who the crooks are. fbi foolish to try to convince us that crypto (escrow) is golden bullet of law enforcement. why does fbi need to have crypto to monitor people for whom they already have probable cause (that they need in order to get warrant to wiretap). jim lucire: americans for tax reform. IRS doesn't follow constitutional protections. barry steinhardt (ACLU). law enforcement concerned to preserve its wiretap capability. wiretap happy administration. set records for number of wiretaps (both in criminal and national security). law requiring wiretap capability in telecom infrastructure. additional crimes where wiretap allowed. Janet Reno: four challenges -- threat that encryption poses to law enforcement; ability to search for stored information. wiretapping. why does aclu find it so odious. fourth amendement "particularized suspicion" -- government must have a reason to search you. wiretapping is a "generalized search." in 1970's, 50% of wiretaps produced useful information. now 17% reveal useful info. warrant to search 100 homes to find criminal info in 17 homes? ability to continue wiretapping is in question. what is cost to individuals who are wiretapped? cindy cohn, lawyer: export problems with ITAR: scientists lose. bernstein case (can export crypto research): export rules squelch discussion and reseach: first amendment; right of people to talk about science, art, literature; not just politics. broadness: IATR is overlly broad. defines export to prevent publication. prevents export to "ordinary" people, but only intended to prevent export to terrorist. procedural problems: no hard boundaries. barbara simons (acm) -- copyright? net community suprised when CDA was passed. major voices heard are those of lobbiests; not technology focus; focussed only on their lobby-needs. monitor net? only to preserve copyright. goals will work only if you shut down the net. copyright legislation makes illegal to manufacture device to violate copyright (camera? vcr?) john gilmore (eff): can we trust the courts? won't be won on a single front: need to keep pressure up. "for purposes of first amendment analysis, court finds that source code is speech." will go to supreme court. need help from legislature. want to bring light into export control process. want to have clear rules so you can read rules, build product and export it. michael froomkin (law school, univ of miami): legal status of privacy? can't count on courts. don't take wait and see attitude. wiretap still has some value. Legal status of no export has been successful: no strong crypto in w/95. ken bass question: froomkin: crypto is a constitutional right (200 pages). very few nsa cases; mostly 4th amendment ('drug exception to constituion). korn case, bernstein case. briefs in cases required reading for congress (first amendment). crypto useful to protect free speech (Phil Zimmerman talked about human rights people in Burma who use PGP to protect their messages from government.) [representative zoe lofgren (Dem CA) -- someone proposed 4th amendment in congressional debate amending criminal law. Defeated on party lines.] implication for information sharing between cia/fbi/nsa with foreign intelligence agency? guatamala tragedy example of problem. the dumb criminal theory? blow up buildings with trucks they rent in their own names. --- With apologies for incoherence, errors, and incompleteness --- Martin Minow minow(a)apple.com

2 1

Sameer on C-SPAN
by bluebreeze＠nym.jpunix.com 17 Dec '03

17 Dec '03

:From: Alex Strasheim <alex(a)crawfish.suba.com> :Date: Mon, 1 Jul 1996 11:32:21 -0500 (CDT) : :Janlori Goldman, at the Center for Democracy & Technology, just mentioned :Sameer's anonymizer on C-SPAN during a segment of Internet privacy. : :They showed a shot of the screen and everything. Not everything. No picture of Sameer!? That's what I'd like to see.

2 1

Iron Censorship
by Duncan Frissell 17 Dec '03

17 Dec '03

The New York Times reports that: "Tipped off by an anonymous source named "nobody," Simon & Schuster Inc. and its literary police are engaged in the Internet equivalent of a high-speed car chase: tracking down a runaway book pirated on right-wing and anarchist sites on the World Wide Web. In the last month, the publishing house's monitors have discovered more than seven Internet sites containing the text of "Report from Iron Mountain," first published in 1967 and intended as political satire, and re-released early this year by a Simon & Schuster imprint, the Free Press." http://www.nytimes.com/library/cyber/week/0701iron-mountain.html Taking up the challenge, I fired up AltaVista and quickly found: http://www.cwi.nl/htbin/jack/mailfetch.py?2383 (2646 lines) I haven't checked this version against my dog-eared first edition so I don't know if this one has been modified by the Great Enemy. DCF "Who wonders what ever happened to the Regional Government Conspiracy. Anyone out there remember "Blame Metro", "Terrible 1313" and other chronicles of what used to be called the Metropolitan Government movement?"

1 0

Re: rsync and md4
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11.36 AM 7/1/96 -0400, David F. Ogren wrote: >2. >(quoted from Mr. Perry in an article entitled "MD5 breaks, etc.") > >> checked. However, the result is widely known. MD5 is *not* >> something that should be trusted going forward, and I hope the next >> version of PGP uses SHA-1. > >As I understand the current plans, PGP 3.0 _will_ incorporate a SHA option. >In fact, I believe that there may already be "bootleg" versions that >incorporate SHA. What is the difference between SHA and SHA-1? Is this algorithm subject to the same licensing as MD5? Could someone point me to such a bootleg version for DOS, please? Thanks. =============================================================================== David Rosoff (nihongo o sukoshi dekiru) ----------------> drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Non-technical beginner's guide to PGP ---> http://www.arc.unm.edu/~drosoff/pgp/ Anonymous ok, PGP ok. If it's not PGP-signed, you know that I didn't write it. === === === === === === === === === === === === === === === === === === === === "Truth is stranger than fiction, especially when truth is being defined by the O.J. Simpson Defense Team." -Dave Barry -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMdiLyBguzHDTdpL5AQHACgP/dmJJ6aQ0ZVlHN3WcAsPkaGoAypU/iCz4 F8HSK6nxbmG+pBd5+82Flzqpquy23Wfp+uk2l+CIv7oygoOMXVvadRLTQKXZEe+h 8/rk0pLATszwLakwa427P5xgGs4mfwvKjzBi0LpEIu1qkUmWYGQphl7KPAumdLc+ +3Wpc0INmHY= =qXUq -----END PGP SIGNATURE-----

2 1

Re: rsync and md4 [NON-CRYPTO ALGORITHM]
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:50 AM 6/30/96 +1000, Andrew Tridgell wrote: >It effectively creates binary diffs of the two files, without direct >(local) access to both files. As far as I know this is a new type of >algorithm. I worked with an algorithm which sounds similar to this one back about 20 years ago when creating a diff for VM/370 at Tymshare. Here's a quick description of the algorithm so you can see how much the hashing discussion below applies to your problem. (1) Chose a way to break the files into "units". We chose line ends. (2) Hash each unit in both files making two vectors of hashes. (3) Identify which units exist once and only once in a file by: (3a) Initialize a (large) vector of 2-bit entries to all zeros. (3b) Use the hash of each unit to index the vector. If the entry is 00 change it to 01. If it is 01 change it to 10. If it is 10 leave it alone. (4) And the two 2-bit entry vectors together to get the units that exist once and only once in both files. These units are anchors of similarity between the files. (5) Find the hashes which represent these anchors of similarity in both files and link them together. (6) Link the neighbors of already linked units. (7) The unlinked hashes represent differences between the two files. Note that this algorithm finds units that have been moved. I had to do something intelligent with this information to allow for diff-like output. To handle binary files you may need to change the definition of "unit". We used a simple barber poll hash. We went for a number of years before we had a hash failure. (I know, there was a bug in the code that handled hash failures.) A hash based on a CRC calculation would probably be better. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0