December 2003 - cypherpunks-legacy

RE: FW: [RANT] Giving Mind Control Drugs to Children
by blanc 17 Dec '03

17 Dec '03

From: E. ALLEN SMITH Actually, my Ritalin was one of the things that led me to come to the conclusion that drug laws were nonsense. It's a Schedule II drug that I never felt _any_ addiction to; I was off it on evenings, weekends, and during holidays. So at least in my case it had a pro-libertarian effect. ........................................................................

1 0

CDT Policy Post 2.27 - No New News on Crypto: Gore Restates Support for Key Escrow
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 27 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 27 July 12, 1996 CONTENTS: (1) No New News on Encryption - VP Gore Reiterates Support for Key Escrow (2) How to Subscribe/Unsubscribe (3) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) NO NEW NEWS ON ENCRYPTION - VP GORE REITERATES SUPPORT FOR KEY ESCROW Despite the growing pressure from Congress, privacy advocates, the computer industry, and the public for the reform of US encryption policy, the Administration continues to embrace its Clipper III key-escrow encryption proposal. In a written statement issued Friday (7/12), the Vice President announced that the Administration will continue to push for the adoption of a massive public key infrastructure to enable law enforcement access to encryption communications and continue to rely on cold war-era export controls. [The full text of the announcement is available on CDT's Encryption Policy Issues Page: http://www.cdt.org/crypto/] CDT is disappointed that the Administration's latest statement offered no new solutions to what is becoming a critical policy issue for the future of the Internet and the development of a secure and trusted global information infrastructure. Friday's announcement comes amid growing concern from bi-partisan members of Congress, computer industry leaders, privacy advocates, and the public. Recent calls for changes in current US encryption policy include: * Bipartisan legislation in both the House and Senate designed to relax US encryption export controls and encourage the widespread availability of strong, easy to use encryption technologies. * The Security and Freedom through Encryption (SAFE) Forum, held on July 1st, where members of Congress, computer industry leaders, privacy advocates and the public discussed the need to reform US encryption policy. * The recent report by the National Research Council which criticizes current policy as failing to address the needs of an information age society. These developments represent a growing consensus among members of Congress, the computer industry, and privacy advocates that current US encryption policy is harming the competitiveness of US industry and endangering the privacy of computer users. Our understanding of this consensus does not match the conclusion the Vice President reaches that: "A consensus is emerging around the vision of a global cryptography system that permits the use of any encryption method the user chooses, with a stored key to unlock when necessary". CDT sees no evidence of broad support for a key escrow approach. While the Administration seems to acknowledge the importance of encryption for privacy and electronic commerce, neither the current policy nor its predecessors have met the needs which virtually all involved in this debate now see. Since 1992, the Administration has continued to offer solutions which fail to recognize the privacy needs of individual computer users and the realities of the global economy. While law enforcement and national security considerations are important factors which must be addressed, the Administration's current proposal, along with Clipper I and Clipper II, continues to put law enforcement and national security concerns above the privacy and security needs of the American public. SUMMARY OF VICE PRESIDENT GORE'S STATEMENT While putting forward an initiative ostensibly designed to make encryption more available to computer users, the Administration would do so at a high price: Individuals would be required to place their most private personal encryption keys in the hands of third parties. Today's statement is essentially a re-statement of the Clipper III proposal released in May. Among other things, the Vice President: * Called for the liberalization of export controls provided computer users participate in a "global key management infrastructure" designed to make personal encryption keys accessible to law enforcement. * Reiterated the Administration's opposition to the bipartisan encryption legislation introduced this Spring in the House and Senate, which would ease export controls. * Announced that a Cabinet Committee will send detailed recommendations regarding implementation of this proposal to the President by early September. * Indicated that the Administration "is considering" interim measures until a key escrow system is in place, including: - Liberalizing export controls for certain industries, - Developing performance standards for key recovery systems that will be eligible for export. - Launching key recovery pilot projects. - Moving jurisdiction over encryption export licenses from the State Department to the Commerce Department (The Burns/Leahy Pro-CODE bill contains a similar provision). The full text of the Vice President's Statement, along with the Clipper III proposal, the text of the Pro-CODE bill and other legislation, and detailed background information on the encryption policy debate, is available on CDT's encryption policy resource page: http://www.cdt.org/crypto/ CDT believes that a far more sensible approach to encryption is offered by the bipartisan legislation introduced this Spring to ease export controls, including: S. 1726, the Pro-Code Act introduced by Senators Burns (R-MT), Leahy (D-VT), Pressler (R-SD), Lott (R-MS), Wyden (D-OR), Simpson (R-WY), Murray (D-WA), and others; S.1567, authored by Sen. Leahy with many of the same co-sponsors; and H.R. 3011, introduced by in the House of Representatives by Reps. Bob Goodlatte (R-VA), Anna Eshoo (D-CA), Tom Campbell (R-CA) Zoe Lofgren (D-CA), and a bi-partisan group of over 20 others. NEXT STEPS CDT will continue to work with Senators Burns, Leahy, Pressler, Wyden and Reps, Eshoo, Goodlatte, and others to encourage the widespread availability of strong encryption by pushing for passage of legislation to relax export controls on encryption. The full Senate Commerce Committee, chaired by Senator Larry Pressler (R-SD), is expected to hold hearings on the Pro-CODE bill during the week of July 22. CDT is working to cybercast that hearing live on the Internet. Please continue to visit CDT's encryption policy issues page for the latest information on this issue. ------------------------------------------------------------------------ (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.27 7/12/96 -----------------------------------------------------------------------

2 1

Re: I@Week on crypto export loophole 6/24/96
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >As I see it, the most important issue is not the legal status of the one >actually doing the export/mailing, but in fact the organization which is the >recipient and thus, the beneficiary of this act. _THAT_ organization will >be well-identified, yet will not have done anything obviously illegal. Is >there any indication that Baker was trying to distinguish between the one >physically mailing it, and those receiving it? Yup. He was speaking only of the US company. As you mentioned, odds of anyone getting caught are fairly low in many cases, but even lower for anyone outside the US. The odds the US would go after a foreign company would seem pretty remote, unless based in a country that strongly suppported US policy. The UK comes to mind, but few others. I'll leave it others to decide who else should be on that list. Will -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMebLF0cByjT5n+LZAQF3Owf5AbJCUK/9sbaUGDVV4eZcqggSuOgH+ubr fbx3W7HXaXcAlqvATFRt+mw5h6GMubNrRCC+Ka6CJYC60QESWnHCw8/XX000I2UQ ucBwRMTID+KZuNHN9vD4/hE+JBLkWDQyu2S4IDWkCR0+7UJDFQQ9z3kSVmqgczlB jGyOtUwVpNHETg0yGreuQVCMz6gzxX1eZf0Hv38BJQqD8ROOLVCmYC1grRlrltRV VJqRohsVustzqgu35OoKKzZES3hJxqvmXaNHIDMKhZmnbeHiZeAKs0tQ9hJz7Znp oNAGcwIugB7S7mANIr6bd0EPHiljOP2Ipe13LgMAtkhidipTDQgtRQ== =6+G6 -----END PGP SIGNATURE-----

2 1

Re: Can the inevitability of Software privacy be used to defeat the ITAR? (fwd)
by Cindy Cohn 17 Dec '03

17 Dec '03

At 09:38 AM 7/11/96 -0400, Michael Froomkin wrote: >Here's a fun legal issue that cropped up on the cypherpunks list Nice try, but no cigar. The problem with all of the "ITAR loophole" ideas is that they only work where the rules are clearly articulated and carefully followed by the administrative agencies. Neither of those exist with the ITAR.. There are no restrictions on the ODTC's ability to interpret the ITAR however they see fit and to change those interpretations as they wish to meet their goal: stopping folks from getting strong crypto easily. The best example of this is the mislabelled "crypto with a hole," in which ODTC interprets the regulations as allowing them to limit software with no cryptography in it at all but only hooks which could allow the insertion of crypto later. The ITAR says that they only regulate "software with the capability of maintaining secrecy" and so on its face would not extend to software which only has hooks for crypto. But this doesn't stop ODTC and there is no mechanism in place to allow anyone else to stop them short of a lawsuit or a change in the law by Congress. So, having said that, here's where I think they could fit in the "piracy" sublicense maneuver: First, entering into the sublicensing agreement could be interpreted as a "defense service." By giving them a license you are "assisting the foreign person" because, presumably, life is easier for them if they have a license. Second, call the sub-license agreement "technical data" since it is related to the crypto. Or, as they did with Zimmermann, they just assume that the company had something to do with the unauthorized export and begin an investigation. If it goes to indictment, better hope you have iron-clad evidence to convince the jury that you had nothing to do with it. If you've gone ahead and sub-licensed afterwards, making money off of the illegal act, I think it would be difficult to convince a jury that you didn't have something to do with it. Gotta write a brief now, Cindy Cohn > >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) >Associate Professor of Law | >U. Miami School of Law | froomkin(a)law.miami.edu >P.O. Box 248087 | http://www.law.miami.edu/~froomkin >Coral Gables, FL 33124 USA | It's hot here. And humid. > >---------- Forwarded message ---------- >Date: Thu, 11 Jul 1996 04:06:05 +0000 >>From: Paul Elliott <paul.elliott(a)hrnowl.lonestar.org> >To: cypherpunks mailing list <cypherpunks(a)toad.com> >Subject: Can the inevitability of Software privacy be used to defeat the ITAR? > >-----BEGIN PGP SIGNED MESSAGE----- > >All software companies who sell (really licence) software >must deal with the inevitability of software piracy. It >is a brute fact that any usefully product sold in the U.S. >will eventually appear as an unauthorized copy for sale >abroad. This fact must be recognized in the software companies' >business plan. > >The question occurs to me "why can not this fact be used to >defeat the ITAR?" > >What is to prevent a U.S company to licence a foreign company >to sublicence and distribute a Crypto product abroad, if that >foreign company obtains that product on the pirate market? > >I am not a lawyer, but I look at the definition of "export" >on page 612 of Applied Cryptography and nothing seems to >obviously apply. > >The scenario I imagine is this: U.S. company produces a crypto >product. To be generally useful, the product supports all languages. >(Those CDROMs really do hold a lot of data.) >After all, Americans do need to do business with foreigners. >The company licences and distributes the product in the U.S. >taking special care not to distribute the product to any foreign persons. >When inevitability, the product appears in the pirate market outside >the U.S., the company makes a contract with a foreign company >allowing it to distribute it and sublicence it. The foreign company >can get their copy from the pirate market, being authorized to get >the copy by the U.S. company. When this deal is cut copies >have already been exported and are already being sold by the >pirates, against the will of the U.S. company. > >In this scenario, the U.S. company had done everything >it possibly could to prevent the illegal export of its product. But >when its efforts have inevitably failed, it makes money by >sublicencing. > >When I look at the definition of Export on page 612 of applied >cryptography, I see one clause that defines transferring registration >as export, but only for aircraft, vessels and satellites. > >OK, cypherpunk legal types, there has got to be something wrong >with this idea. There are a lot of smart people in the world, >so if this idea was good, somebody else would have thought of >it before now! But what is specifically is wrong with it? >I want to be educated! > >- -- >Paul Elliott Telephone: 1-713-781-4543 >Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 > Houston Texas 77063 > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3 >Charset: cp850 > >iQCVAgUBMeR9nvBUQYbUhJh5AQGkYAP/bN0lmkjF6uZ92MmWIqdZwVmLmsiIUg9L >XbtYaeawNCMdi2BnkDUu4j/G1rNngFuAmRwABE9UxKOnwjMU5lfmxHev5RP9/CBF >81AnYc1bWeh52EuKJCKu47LMDn9PqfiCIGBwfRehgkZ72gO0+ywIP1fZrkwNNCF+ >Md76LqUE5Z4= >=k7M5 >-----END PGP SIGNATURE----- > > ************************ Cindy A. Cohn McGlashan & Sarrail, P. C. 177 Bovet Road, 6th Floor San Mateo, CA 94402 (415) 341-2585 (tel) (415)341-1395 (fax) Cindy(a)McGlashan.com http://www.McGlashan.com

1 0

Re: Can't block caller ID in Massachusetts? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, Forwarded message: > Subject: Re: Can't block caller ID in Massachusetts? > Date: Fri, 12 Jul 1996 19:37:42 -0400 (EDT) > From: "Michael H. Warfield" <mhw(a)wittsend.com> > > Eric Murray enscribed thusly: > > > Caller ID isn't for people, it's for businesses who want to > > track callers. They're willing to pay for that service, enough > > to make it worth the while of the phone companies to spend many > > millions on a campaign of lies (excuse me, "PR") to convince us > > that we need CID for "safety". > > number was to be able to log and track that information. Every wonder > about those local companies who still had you call a 1-800 number. Guess > what. That was the easiest (and sometimes the cheapest) way to get ANI. > I ran a Harris 20/20 PBX switch for a company over 6 years ago and remember > looking over and discussing the ANI specs with the management. We decided > not to pursue trying to get ANI on our DID lines but the switch supported > it and that switch was considered out of date technology at THAT time! > I can verify this ability of telephone switches and number tracking. From 1984 to 1990 I worked for the University of Texas at Austin in their Physical Plant Telco shop. I worked on a NT SL-1 based switch feeding voice, data, and analog signals all over campus as well as interfacing to SWBT's trunk lines. I personaly used the system to track on campus phreak and hack attacks as well as feeding the universities computerized security system. We used a Charles Rivers 68/35 running building control software. With it we could track various aspects of the telephone switch and log them offline. We used the system strictly for input of signals for physical security (ie door switches, mag-locks, PIR's, etc.) over the dry pair of the switch. Watch your 6's. Jim Choate CyberTects ravage(a)ssz.com

1 0

RE: Can't block caller ID in Massachusetts?
by Bill Olson (EDP) 17 Dec '03

17 Dec '03

What's worse, is that if you just want to call and get information about a particular product, they can log you for their marketing database. >---------- >From: David Mazieres[SMTP:dm@amsterdam.lcs.mit.edu] >Sent: Friday, July 12, 1996 8:55 AM >To: cypherpunks(a)toad.com >Subject: Can't block caller ID in Massachusetts? > >My last phone bill said that Nynex is now giving out people's names in >addidtion to their phone numbers over caller-id. I therefore called >Nynex and told them to block caller-id on my phone line. > >They said no problem, but... They said nothing I can do will block it >when I call 800 numbers. "The people with 800 numbers have special >software, and there is nothing you can do to block your identity when >calling them. Not even *67." > >Wow. Maybe I'm not paranoid enough, but I never expected this. I can >never again call an 800 number anonymously to get information about >something unless I go out to a pay phone. What an incredible >inconvenience, and how truly depressing. > >I know 800 number owners probably used to be able to get lists of >calling phone numbers on their phone bills, but this is less >disturbing as it would take significant effort to match up the lists >after the fact. I just want to be able to call up companies and say, >for instance, "If I buy your product, can it do X?" as opposed to, for >instance, "I'm stuck with your product, can it do X?". People are >often more helpful in the former case. Now, though, they'll know >exactly who I am before they even say hello. > >David >

1 0

Good dictionary files?
by Sentiono Leowinata 17 Dec '03

17 Dec '03

As many people say, a good password cracker is very dependent on the dictionary file(s). When one has a very good dictionary file(s), the chances of password being cracked is bigger. I am wondering if someone can tell me where I can get good dictionary file(s). Search on the web result to nothing. I have one large dictionary file (about 14Mb) to check it, but I still not feel comfortable to say it's a good one. This might be off topic from cryptography, but until we can reverse engineer (decrypt the crypt or crypt(3)) functions, nothing we can do but to rely on those good dictionaries. Thank you and I apologize for anyone who might get offended by my post. Regards, Sent.

2 1

Re: Can't block caller ID in Massachusetts?
by Dana W. Albrecht 17 Dec '03

17 Dec '03

David Mazieres writes: > My last phone bill said that Nynex is now giving out people's names in > addidtion to their phone numbers over caller-id. I therefore called > Nynex and told them to block caller-id on my phone line. > > They said no problem, but... They said nothing I can do will block it > when I call 800 numbers. "The people with 800 numbers have special > software, and there is nothing you can do to block your identity when > calling them. Not even *67." > > Wow. Maybe I'm not paranoid enough, but I never expected this. I can > never again call an 800 number anonymously to get information about > something unless I go out to a pay phone. What an incredible > inconvenience, and how truly depressing. > > I know 800 number owners probably used to be able to get lists of > calling phone numbers on their phone bills, but this is less > disturbing as it would take significant effort to match up the lists > after the fact. I just want to be able to call up companies and say, > for instance, "If I buy your product, can it do X?" as opposed to, for > instance, "I'm stuck with your product, can it do X?". People are > often more helpful in the former case. Now, though, they'll know > exactly who I am before they even say hello. > > David 800 (And 888/900 etc.) numbers use a different mechanism (ANI) than caller ID to provide your telephone number to the person you are calling. This has been around far longer than caller ID, and really doesn't have all that much to do with the caller ID service, which is entirely different. So in essence, nothing's really changed with regard to 800 numbers, except that people are now becoming _aware_ that the called party has access to their telephone number. If you want additional information, I'd recommend starting with the FAQ for the alt.2600 newsgroup. Dana W. Albrecht dwa(a)corsair.com

1 0

EFA attitude to crypto
by Sherry Mayo 17 Dec '03

17 Dec '03

Just to clear up Rich Grave's comment regarding the Electronic Frontiers Australia's attitude to crypto. EFA did not object the the ABA's report and it's comment about crypto. They did object to an earlier government report which said that crypto should be *mandatory* - since turning people into criminals for transmitting plaintext is just as daft as turning them into criminals for transmitting encrypted text. Hope this puts things straight. Sherry

1 0

Re: Another bad idea
by Deranged Mutant 17 Dec '03

17 Dec '03

On 12 Jul 96 at 10:23, Alan Olsen wrote: [..] > Of course this is all a moot point, because it has been proven by computer > projections that all informative net traffic will be buried under > advertisements by the year 2000 anyways. I expect some legislative body to > try and make money fast on the net by selling ad space on IP packet headers. Yes. They can follow the American model and rather than censor communications, allow advertising. Nobody will be able to get an inteeligent thought from the net without being interrupted by an ad every five minutes... and people will pay good money for this 'privledge' (sp?) too. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0