December 2003 - cypherpunks-legacy

Snakeoil FAQ edit/comments
by gee 17 Dec '03

17 Dec '03

Matt: Thanks, and good work. My comments are indicated by [your text] in brackets, my comments >>> set off by >>>'s. To help separate, look for "-----------------------------" --------------------------- snake-oil-faq ---------------------------- Snake-Oil Warning Signs Encryption Software to Avoid $Id: snake-oil-faq.html,v 0.4 1996/09/16 13:52:26 cmcurtin Exp $ Distribution Please do not distribute this beyond the circles of cryptographic competence yet. This is an incomplete work-in-progress. Feedback is greatly appreciated. The Snake Oil FAQ is (to be) posted monthly to cypherpunks, sci.crypt, alt.security, comp.security, and comp.infosystems. We're targeting those who have influence over or direct involvement in the purchasing decisions of computer security software and equipment in the corporate and academic worlds, as well as individual users who wish to assert their privacy through the use of good cryptography. ----------------------------- >>> I wonder what a good assumption is about level-of-expertise. I should think rather low, since a more experienced person will not be in as much need of the doc in the first place. Think moderately-informed user: like the readers of InfoWorld, eh? Given that, there are several places where knowledge of the subject is assumed that the real consumer of the FAQ doesn't have. ----------------------------- Disclaimer All contributors' employers will no doubt disown any statements herein. We're not speaking for anyone but ourselves, based on our own experiences, etc., etc., etc. This is a general guideline, and as such, cannot be the sole metric by which a security product is rated, since there can be exceptions to any of these rules. ----------------------------- >>> Actually, I think there are some rules in here that there are no exceptions to. Check; nothing comes immediately to mind tho. ----------------------------- ----------------------------- [(But if you're looking at something that sounds familiar on several of the 'things to watch out for,' you're probably dealing with snake oil. ] >>> But if many of the items on the "Things to look out for" list seem to apply to a product, the product is very likely weak. ----------------------------- ----------------------------- >From time to time, a reputable and decent vendor will produce something that is actually quite good, but will use some [braindead] marketing technique, so be aware of exceptions. >>> "Braindead", eh, hmmmmm. Too dignified ;)----------------------------- Every effort has been made to produce an accurate and useful document, but the information contained herein is completely without warranty. If you find any errors, or wish to otherwise contribute, please contact the document keeper, C Matthew Curtin <cmcurtin(a)research.megasoft.com> Introduction Good cryptography is an excellent and necessary tool for almost anyone. However, there is a multitude of products around. Many good cryptographic products are available, both commercial (including shareware) and free. However, there are also some extremely bad cryptographic products (known in the field as "Snake Oil"), which not only fail do their job of providing security, but are based on, and add to, the many misconceptions and misunderstandings surrounding cryptography and security. ----------------------------- >>> They also prey on the inexperience of the consumer, rely on the mystery and mystique of mathmatical-sounding jargon, to make poorly engineered products seem to be something they are not. ----------------------------- Superficially, it is difficult for someone to distinguish the output of a secure encryption utility from snake oil: both look garbled. The purpose of this document is >>> to <<< present some obvious "red flags" [so that] >>> which <<< people unfamiliar with the nuts and bolts of cryptography can use as a guideline for determining whether they're dealing with snake oil or the Real Thing. For a variety of reasons, this document is general in scope and does not mention specific products or algorithms as being "good" or "Snake Oil". When evaluating any product, be sure to understand what your needs are. For data security products, what do you need protected? Do you want an archiver that [supports strong encryption? ] ----------------------------- >>> Problem: what is "Strong Encryption" ??? From a user's point of view this term is too fuzzy. Try: "that will keep data secure from your kid sister? A rogue government? For 5 minutes? Etc. etc. " ----------------------------- ----------------------------- [An E-mail client? Something that will encrypt on-line communications? Do you want to encrypt an entire disk or partition, or selectively some files? Do you need on-the-fly (automatic) encryption and decryption, or are you willing to select when and which files you want encrypted? ] >>> I'd leave that out: not pertinent to snake-oil vs. Good Stuff, but is about the kind of application user requires. How secure is "secure enough?" Does the data need to be unreadable by third parties for 5 minutes? One year? 50 years? 100 years? >>> see above. ----------------------------- ----------------------------- [Different products will serve different needs, and it's rare that a product will serve every need. (Sometimes a product won't be needed: it may be better to use a utility to encrypt files, transmit them over a network using standard file transfer tools, and decrypt them at the other end than to use a separate encrypted utility in some cases.)] >>> I don't understand: "sometimes a product won't be needed?" I think this paragraph could be left out. After all, OS utility or Snoop-Dooper-Doggy-Doo-Ware product, ya still gotta know what you're doing, right? So you everthing in the FAQ still applies; or maybe I'm missing the point here. ----------------------------- Some basics The cryptography-faq (found at ftp://rtfm.mit.edu/pub/usenet/cryptography-faq/) is a more general tutorial of cryptography, and should also be consulted. In an effort to make this FAQ more complete, some very basic topics are included below. Conventional vs. Public Key Cryptography ----------------------------- There are two basic types of cryptosystems: symmetric (also known as "conventional," [sometimes also called] >>> or <<< "private key") and asymmetric (public key). Symmetric ciphers require both the sender and the recipient to have the same key. That key is [applied] >>> used by the cryptographic algorithm <<<to encrypt the data >>> originated <<< by the sender, and again by the recipient to decrypt the data. Asymmetric ciphers are much more flexible, from a key management perspective. Each user has a pair of keys: a public key and a private key. The public key is shared widely, given to everyone, while the private key is kept secret. If Alice wishes to mail Bob some secrets, she simply gets Bob's public key, encrypts her message with it, and sends it off to Bob. When Bob gets the message, he uses is private key to decrypt the message. Asymmetric [cryptosystems] >>>algorithms<<< are much slower than [their symmetric counterparts.] >>> symmetric algorithms, and are almost exclusively used to encrypt short "session keys," which are then used to encrypt a message using the speedier symmetric algorithms. This use of public key cryptography is called "key exchange." ----------------------------- ----------------------------- [Also, key sizes must be much larger.] >>>I agree with one comment that discouraged comparing the 2 algo types.----------------------------- See the cryptography FAQ for a more detailed discussion of [the topic.] >>>these topics.<<< Key Sizes ----------------------------- Some ciphers, while currently secure against most attacks, are not considered viable in the next few years because of relatively small keysizes and increasing processor speeds [(making a brute-force attacks feasible).] >>> Again, I maintain that the audience for this stuff can't be relied upon to even know what that means. Try: "which makes the cipher vulnerable to breaking by trying every possible key combination (called a brute-force attack)." --- or something like that. ----------------------------- The tables below should give some general guidelines for making intelligent decisions about the key length you need. If the key is too short, the system will be easily broken, even if the cipher is a good one. In [1] and [2], we're presented with some guidelines for deciding appropriate key length. (It is important to note that this is based on the ability to predict computing power 40, 65, and 100 years from now. Major breakthroughs in computing power 30 years from now might render everything on this chart kiddieplay.) Security Requirements for Different Information Type of Traffic Lifetime Minimum [Symmetric] Key Length Tactical military information minutes/hours 56-64 bits Product announcements, mergers, interest rates days/weeks 64 bits Long-term business plans years 64 bits Trade secrets (e.g., recipe for Coca-Cola) decades 112 bits H-bomb secrets >40 years 128 bits Identities of spies >50 years 128 bits Personal affairs >50 years 128 bits Diplomatic embarrassments >65 years at least 128 bits U.S. Census data 100 years at least 128 bits ----------------------------- >>> Where is the attribution for the table?----------------------------- As mentioned earlier, asymmetric ciphers require significantly longer keys to provide the same level of security as their symmetric cipher counterparts. Here is a comparison table, again, from Applied Cryptography, second edition. Symmetric and Public-Key Lengths With Similar Resistance to Brute-Force Attacks Symmetric Key Length Public-key Key Length 56 bits 384 bits 64 bits 512 bits 80 bits 768 bits 112 bits 1792 bits 128 bits 2304 bits ----------------------------- >>> BEWARE, Danger: comparing public/private key cryptosystems again. I think if you really want to do so, then the comparison should really be explained. ----------------------------- Some Common Snake-Oil Warning Signs The following are some of the "red flags" one should watch for when examining an encryption product * Technobabble The vendor's description of the product may contain a lot of hard-to-follow use of technical terms to describe how the product works. If this appears to be confusing nonsense, it may very well be (even to someone familiar with the terminology). Technobabble is a good means of confusing a potential user and masking the fact that the vendor doesn't understand anything either. A sign of technobabble is a descrption which drops a lot of technical terms for how the system works without actually explaining how it works. Often specifically coined terms are used to describe the scheme which are not found in the literature. * New Type of Cryptography? Beware of any vendor who claims to have invented a "new type of cryptography" or a "revolutionary breakthrough". Truly "new break-throughs" are likely to show up in the >>> scientific <<< literature, and [many in the field] >>> professionals won't <<< [are unlikely to] trust them until after years of analysis, by which time they are not so new anymore. Avoid software which claims to use 'new paradigms' of computing such as cellular automata, neural nets, genetic algorithms, chaos theory, etc. Just because software uses to different method of computation doesn't make it more secure. ----------------------------- >>> As a matter of fact, these techniques are the subject of ongoing cryptographic research and nobody has published successful results based on their use yet. ----------------------------- Anything that claims to have invented a new [public key] cryptosystem without publishing the details or underlying mathematical principles is highly suspect. Modern cryptography, especially public key systems, is grounded in mathematical theory. The security is based on problems that are believed, if not known to be hard to solve. ----------------------------- >>> There are some other comments in cpunks on this last bit. I defer.----------------------------- The strength of any encryption scheme is only proven by the test of time, >>> involving exhaustive analysis by cryptographers<<<. New crypto is like new pharmaceuticals, not new cars. * Proprietary Algorithms Avoid software which uses "proprietary" or "secret" algorithms. Security through obscurity is not considered a safe means of protecting your data. If the vendor does not feel confident that the method used can withstand years of scrutiny by the [academic] >>> professional and academic cryptographic <<< community, then you should be wary of trusting it. (Note that a vendor who specializes in the cryptography may have a proprietary algorithm which they'll show to others if they sign a non-disclosure agreement. If the vendor is well-reputed in the field, this can be an exception.) ----------------------------- >>> How can you tell a well-reputed vendor? I am thinging of one co. that promises to release their algo. details upon NDA, but at least in my case the details never showed up! This is slippery here! ----------------------------- Beware of specially modified versions of well-known algorithms. This may intentionally or unintentionally weaken the cipher. The use of a trusted algorithm, >>> availability of <<< [if not with] technical notes explaining the implementation ([if not availability of] >>> and preferably <<< the source code for the product) are a sign of good faith on the part of the vendor that you can take apart and test the implementation yourself. A common excuse for not disclosing how a program works is that "hackers might try to crack the program's security." While this may be a valid concern, it should be noted that such 'hackers' can reverse engineer the program to see how it works anyway. If the program is implemented properly and the algorithm is secure, this is not a problem. (If a hypothetical 'hacker' was able to get access you your system, access to encrypted data might be the least of your problems.) ----------------------------- >>> Add: The strength of a cryptosystem should depend ONLY on the security of the keys involved, and not the security of the algorithm. ----------------------------- * Experienced Security Experts and Rave Reviews Beware of any product claiming that "experienced security experts" have analyzed it, but it won't say who (especially if the scheme has not been published in a reputable journal). Don't rely on reviews in newspapers, magazines or television shows, since they generally don't have cryptologists (celebrity hackers who know about telephone systems don't count) take the software apart for them. Just because the vendor is a well known company or the algorithm is patented doesn't make it secure either. * Unbreakability Some vendors will claim their software is "unbreakable". This is marketing hype, and a common sign of snake-oil. Avoid any vendor that makes unrealistic claims. ----------------------------- >>> The reader is not qualified to evaluate realistic/unrealistic.----------------------------- No algorithm is unbreakable. Even the best algorithms are breakable using "brute force" (trying every possible key), but if the key size is large enough, this is impractical even with vast amounts of computing power. One-time pads are unbreakable, but they must be implemented perfectly, which is, at best, very difficult. See the next section for a more detailed discussion. ----------------------------- >>> Add: Avoid products that use huge numbers to impress you that it would take massive amounts of time to break them. This is ONLY true under the assumption that the only way to break the system is by exhaustively trying every possible key, and this assumption hass to be proved before the claim is valid. A cryptosystem using a keylength of 50,000 bits theoretically would take 2 raised to the 50,000th power to break (a ridiculously large number) if, AND ONLY IF the algorithm had no weaknesses. The hard part of cryptosystem design is making an algorithm with no weaknesses, such that exhaustive brute-force search is the only method of breaking it, not using long keys. ----------------------------- * One-Time-Pads A vendor might claim the system uses a one-time-pad (OTP), which is theoretically unbreakable. That is, snake-oil sellers will try to capitalize on the known strength of a OTP. It is important to understand that any variation in the implementation means that it is not an OTP, and has nowhere near the security of an OTP. A OTP system is not an algorithm. It works by having a "pad" of random bits in the possession of both the sender and recipient. ----------------------------- >>> Explain what you mean by a "pad" --- using a term which to the newbie may not usually be associated with crypto. Origin being the pads of paper that they used to use etc.etc. ??? ----------------------------- ----------------------------- The message is encrypted using [the next n bits in the pad as they key, where n is the number of bits in the message] >>> as many bits from the key as there are bits in the message. That is, for each bit in the message, there is a random bit from the one-time-pad.<<< ----------------------------- After the bits are used from the pad, they're destroyed, and can never again be used. The bits in the pad must be truly random, generated using a real random source, such as specialized hardware, radioactive decay timings, etc., and not from an algorithm or cipher. Anything else is not a one-time-pad. The vendor may confuse random session keys or initialization vectors with OTPs. * Algorithm or product XXX is insecure Be wary of anything that makes claims that particular algorithms or other products are insecure without backing up those claims (or at least citing references to them). Sometimes attacks are theoretical or impractical (requiring special circumstances or massive computing power running for many years), and it's easy to confuse a layman by mentioning these. * Keys and Passwords The "key" and the "password" are often not the same thing. The "key" generally refers to the actual data used by the cipher, while the "password" refers to the word or phrase the user types in, which the software converts into the key (usually through a process called "hashing" or "key initialization"). >>> Other comments addressed this paragraph. I defer. The reason this is done is because the characters a user is likely to type in do not cover the full range of possible characters. (Such keys would be more redundant and easier for an attacker to guess.) By hashing a key can be made from an arbitrary password that covers the full range of possible keys. It also allows one to use longer words, or phrases and whole sentences as a "passphrase", which is more secure. Anything that restricts users' passwords to something like 10 or 16 or even 32 characters is foolish. If the actual "password" is the cipher's key (rather than hashing it into a key, as explained above), avoid it. If the vendor confuses the distinctions between bits, bytes and characters when discussing the key, avoid this product. Convenience is nice, but be wary of anything that sounds too easy to use. ----------------------------- >>> Instead, try: be wary of any product that overly emphasizes ease-of-use without due attention to its cryptographic strength. ----------------------------- Avoid anything that lets anyone with your copy of the software to access files, data, etc. without having to use some sort of key or passphrase. Avoid anything that doesn't let you generate your own keys (ie, the vendor sends you a key in the mail, or it's embedded in the copy of the software you buy). Avoid anything by a vendor who does not seem to understand the difference between public-key (asymmetric) cryptography and private-key (symmetric) cryptography. * Lost keys and passwords If there's a third-party utility that can crack the software, avoid it. >>> Which - the utility or the crypto? If the vendor claims it can recover lost passwords (without using a key-backup or escrow feature), avoid it. If there is a key-backup or escrow feature, are you in control of the backup, or does the vendor or someone else hold a copy of the key? * Exportable from the USA If the software is made in North America, can it be exported? If the answer is yes, chances are it's not very strong. Strong cryptography is considered munitions in terms of export from the United States, and requires approval from the State Department. Chances are if the software is exportable, the algorithm is weak or it is crackable (hence it was approved for export). If the vendor is unaware of export restrictions, avoid the software: the vendor is not familiar with the state of the art. Because of export restrictions, some legitimate (not-Snake Oil) products may have a freely exportable version for outside of the USA, which is different from a separate US/Canada-only distribution. Also note that just because software has made it outside of North America does not mean that it is exportable: sometimes a utility will be illegally exported and posted on an overseas site. Other Considerations Interface isn't everything: user-friendliness is an important factor, but if the product isn't secure then you're better off with something that is secure (if not as easy to use). No product is secure if it's not used properly. You can be the weakest link in the chain if you use a product carelessly. Do not trust any product to be foolproof, and be wary any product that claims it is. Contributors The following folks have contributed to this FAQ. Jeremey Barrett <jeremey(a)forequest.com> ----------------------------- >>> OK, you can use my RealName:Gregg Weissman <geeman(a)best.com> <<< ----------------------------- Jim Ray <liberty(a)gate.net> Robert Rothenburg Walking-Owl <wlkngowl(a)unix.asb.com> References 1. B. Schneier, Applied Cryptography, second edition, John Wiley & Sons, 1996 2. M. Blaze, W. Diffie, R. L. Rivest, B. Schneier, T. Shimomura, E. Thompson, M. Wiener, "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security," available via ftp://ftp.research.att.com/dist/mab/keylength.ps ---------------------------------------------------------------------------- C Matthew Curtin Last modified: Mon Sep 16 09:51:41 EDT ---------------------------------------------------------------------- -- C Matthew Curtin MEGASOFT, INC Chief Scientist I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/

1 0

Re: 56 kbps modems
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 15 Sep 1996 01:31:19 -0700, Bill Stewart wrote: >and still get the original 56kbps back out. But if they can, well, >yee-hah, ISDN is nearly dead :-) (Not totally dead; the signalling is >still useful for some applications, the convenience of two channels on >one wire pair is nice, and the fact that people can get 56kbps without Also, can't you add ISDN b-channels ? (I.e. get another 64kps channel) >the phone company's help will pressure them into offering ISDN for >a lower price in areas where the Phone Company's idea of "all the market >will bear" is substantially higher than voice pricing.) ISDN is more elegant; this sounds like a 'kludge' of sorts. OTOH, we've all seen how well a cheap kludge can do, right? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: Diffie Hellman - logs in Galois fields
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> I think polluting this mailing list with trivial questions such as this is > just as bad as polluting it with personal attacks. Read the FAQs. Get a fucking life, seeing as you haven`t yet posted anything relating remotely to the technical aspects of cryptography to this list I think you need to take a long hard look at what your saying loser.... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

3 2

Re: Assassination Politics, was Kiddie porn on the Internet
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Mon, 16 Sep 1996, Steve Schear wrote: > >> Someone wrote: > >> >The problem is that assasination rarely leads to the installation of >> >a government that is any better. In most cases it gets worse. > >[...] > >> We've all heard these arguments, but are they true? Who says so, and how >> can they be certain? Jim's suggestion has never, to my knowledge, been >> tried on a consistant, large, scale. When all conventional alternatives >> have been tried and fail, what have we or the starving children got to >> lose? > >I think "Lord of the Flies" answers this question quite well. Does it? LOTF was fiction. Can you identify a recent instance in which a non-governmental organization attempted to influence political/military events via a concerted AP? > >> Is it legal for citizens of the U.S. to engage in contract killing of >> foreign military, politations, etc? How about U.S. or foreign non-profits? > >As to the first, yes. (There are several anti-mercenary statutes on the >books) As to the second, I don't understand the question. > So, you're saying it is legal for citizens? The second question was whether a non-profit org. could raise tax-deductible funds to conduct such operations. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to perscription DRUGS.

2 1

Re: "Remailers can't afford to be choosy"
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Sep 1996 23:58 EDT, E. Allen Smith wrote: >fetters to win. (In the ultimate extreme, I include gun control under the >fetters that communism/etcetera need to win... the "redistribution" from >producers ("rich") to welfare drones ("poor") during the Rodney King riots >would have been nicely prevented by some shopkeepers with automatic weapons. As I recall this actually happened in a couple cases, didn't it? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: Uses of Computational Chaos
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Sep 1996 23:37 EDT, E. Allen Smith wrote: > It is reasonably obvious that using _computational_ (as opposed to >physical) chaos won't increase entropy. But how about using it to make an >attacker work harder to use any flaws in your method of generating random >bits? As a simplistic example, say that the scribble window you're using tends >to result in a 1 for each 3rd bit. Nice and simple for an attacker to exploit. Supposing, too, that you know these weaknesses, would using separate algorithms for different portions of the number work well? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

[NEWS] Some crypto-relevant wire clippings for a change
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

WITH INTUIT ACQUISITION, CHECKFREE WILL SERVICE ONE MILLION CheckFree Corporation announced an agreement to acquire Intuit Services Corporation (ISC) for 12.6 million shares of common stock in CheckFree Corporation. Intuit Services Corporation is a wholly owned subsidiary of Intuit Inc. Based on the September 13 closing price of 18 1/16 for CheckFree stock, the indicated price CheckFree is paying for ISC is $227 million. After completion of the acquisition, CheckFree will provide home banking and bill payme nt services to over 180 financial institutions. The acquisition will bring CheckFree's base of home banking and bill payment users to over one million. CheckFree Corporation markets its electronic commerce processing capabilities exclusively to financial institutions, which, in turn, use them to provide home banking and bill payment services to their customers. CheckFree's approach is behind the scenes: providing banking and bill payment transaction processing. -- PR Newswire, 9/16/96 French Bank Note Printer Buying U.S. Card Maker By VALERIE BLOCK Francois-Charles Oberthur Group of France, the third-largest bank note printer in the world, has agreed to purchase Kirk Plastic Co., the second- largest card manufacturer in the United States. The deal, announced last week, follows the sale of other North American plastic card producers to European companies over the last two years. Gemplus bought a U.S. manufacturing base from DataCard Corp., and competitor Schlumberger acquired Malco Plastics. Giesecke & Devrient of Germany bought Security Card Systems of Canada, and De La Rue of Great Britain bought McCorquodale. Los Angeles-based Kirk Plastic had announced a joint venture with Orga Card Systems Inc., a German smart card company, in July 1995, but those negotiations were terminated several months ago. Kirk R. Hyde, president of Kirk Plastic, a 77-year-old family-owned business, said Oberthur made a better partner. Mr. Hyde, 53, will sign a three-year employment contract with Oberthur, also a family business, which is 70%-owned by Jean-Pierre Savare. Kirk Plastic will keep its name and 2,500 employees. Mr. Hyde said he'd had reservations about selling his company, but "if we don't make the deal, we could be out of business in five years if smart cards take over." He said his competitors were purchased by large European concerns driven by smart cards and technological changes. "I could no longer keep up with investments to remain competitive," he added. The new owner will infuse capital and technology, and add distribution channels. Mr. Hyde would not disclose specific terms of the deal, which is scheduled to close within 30 days. Industry observers see the European invasion as concrete evidence that smart cards are gaining ground in the United States. "It's another indication that many companies are betting millions that the U.S. market will develop very quickly," said Dan Cunningham, senior vice president of business development at Phoenix Planning and Evaluation Ltd., a Rockville, Md.-based consulting firm. Mr. Cunningham headed Gemplus' U.S. subsidiary before it acquired the DataCard manufacturing facilities. In Atlanta, Visa is testing Visa Cash, the stored-value smart card system launched in conjunction with the Olympic Games. By early next year, Visa will join with MasterCard, Citibank, and Chase Manhattan Bank in a potentially crucial "interoperability" test on Manhattan's Upper West Side. In other signs of U.S. progress in the smart card industry: Wells Fargo and Co. and AT&T Universal Card Services became owners of Mondex International, the company formed by National Westminster Group of London; several universities are implementing smart card systems on campuses in conjunction with banks; and U S West rolled out card-reading phones in several western states. Even so, smart cards are not producing income here. Mr. Cunningham said acquisitions of profitable companies like Kirk can generate funding for early smart card development. Kirk Plastic, with annual revenues of more than $25 million, said it will produce 125 million magnetic stripe cards this year. Oberthur, an international producer of lottery tickets and plastic cards in addition to bank notes, participates in a joint venture, CP8 Oberthur, which is one-third owned by Bull Group of France, another top smart card producer with U.S. facilities. CP8 Oberthur produces 50 million smart cards annually in two French factories, supplying nearly 70% of French bank cards. Oberthur's U.S. subsidiary, Banknote Corporation of America, is the second-largest security printer in the United States. ComputerWorld: August 26, 1996 Opening Soon: Microsoft National Bank If Bill Gates can persuade the Justice Department to go easy on Microsoft's monopoly in PC operating systems, just imagine how easily he could persuade regulatory agencies to grant him a bank charter. Give up a few tons of documents, hold several meetings that consist of silly bureaucratic bantering and voila! he's got an $ 18 billion de novo bank with millions of online "branches" overnight. And not a trowel of mortar needed. Why speculate about the notion of a Microsoft bank? Because Gates is an impatient man. He doesn't believe bankers are moving fast enough to make home banking a success. The entrepreneurial instinct of such a highly successful person suggests that if conventional approaches don't work, he will bypass them and take over. Gates is a helluva marketer and promoter; he could sell the concept with pizzazz. There's also a bit more to this proposition than meets the eye. A recent phone call from Microsoft's lead person in the home-banking fray revealed some interesting insights. First, the only reason this well-informed and well-connected gentleman called me is that he knows how I feel about home banking it's a solution searching for a problem. I think he's trying to swing me (and at least one other highly visible skeptic) over to his camp. Second, the executive said, home banking has to be sold aggressively by banks. He figures consumers aren't likely to rush in and sign up. He's absolutely correct about the absence of a rush. The part about having to sell online banking aggressively to consumers worries me. If that's the case, then home banking is a cat that has already used up eight lives in the past 25 years. Every major bank has tried home banking and has failed. If the last chance depends on the typical banker's sales skills, then home banking is dead for sure. Consumers are smarter than ever. Give them good reasons to switch, and they don't have to be pushed. Home banking doesn't yet provide compelling reasons. Today's consumers are in love with the checkbook. They aren't complaining about checks. (Banks, of course, hate checks because they're expensive to process.) Consumers don't want to expose their spending habits on the Internet,either. They just aren't ready to say, "I think I'll jump on the Internet today and pay my bills." The promoters of home banking point to surveys that show the increasing penetration of PCs in U.S. households. But that doesn't mean those PCs will be used for online banking. If a poll said 80% of U.S. homeowners have a back yard, does it mean they all want to plant tomatoes? Even banking's technocrats don't do online banking when they go home. If compelling reasons to bank from home are missing, then the next best chance for success will depend on a cultural shift. Maybe the future yuppies, who are now in grade school, will embrace home banking just because it fits in to their electronic lifestyles. The "Gomwatms" grumpy old men with all the money will eventually fade out of the picture. Home banking is a sure thing, once we find its right decade. By M. Arthur Gillis; Gillis is president of Computer Based Solutions, Inc., a banking technology consultancy in Dallas. His Internet address is artgillis(a)aol.com Financial Times:Thursday, August 29, 1996 Online Shopping Plan Claims Better Security Uunet Pipex on the Internet not only met widespread concerns about security but was more secure than buying by phone or in a shop with a credit or debit card. The company, the UK subsidiary of MFS, the US telecoms operator bought earlier this week by WorldCom of the US and one of the largest European Internet service providers, believes its system is in advance of US developments. The British system is backed by National Westminster Bank, which will act as the clearing house for online debits and credit card transactions. Uunet Pipex said the system, called "The Bureau", will enable customers to buy goods from electronic "shops" on the Internet in safety and with security. Merchants trading on the Internet will be able to take advantage of an established payments mechanism without the cost of building their own. Shopping over the Internet has been possible for some time but its popularity has been held back by concerns over security. Potential customers are reluctant to trust the Net with their credit card information. Nevertheless, online electronic commerce is believed to be worth $300m ({GBP193m) annually at present and rising. Among the organisations seeking to develop secure shopping and payments systems are card companies Visa, Mastercard and American Express and software developers Microsoft, Netscape Communications and Verifone. Internet merchants sign up with Uunet Pipex and pay 5 per cent of the purchase value per transaction. The system is activated when a customer presses the "buy" key and enters his or her credit information. It is then stored securely by Uunet who instructs NatWest to pay the merchant for the purchase. When the deal is complete electronic confirmations are generated for customer and merchant. Mr Richard Nuttall, Uunet Pipex director of electronic commerce, said: "Until now, security concerns have deterred buyers and sellers from doing business over the Net. We have created a comparatively low cost system that is more secure than buying goods on an ordinary credit or debit card." Four merchants have already signed up to use the system. Responsibility for establishing an electronic shop on the Net remains with the merchant. Many believe the quality of the images of goods for sale is a more effective deterrent to Internet commerce than fears over payment security. The principle advantage of "The Bureau" over competitive systems seems to be the ease and low cost of adoption. Mr Susen Sarkar of the London technology consultancy, Ovum, said: "The launch of The Bureau will remove anxieties for both merchants and consumers." Other UK groups, notably Barclays Bank, already offer Internet shopping services and British Telecommunications is testing a large-scale online shopping service. American Banker: Thursday, August 29, 1996 On-Line Banks Unsure About What Kind of Web to Weave JENNIFER KINGSON BLOOM Most banks want to do more with their Web sites, but aren't exactly sure what, according to a survey of banks that have presences on the Internet. Netmarquee Online Services Inc., a Needham, Mass., company that offers on-line information for family businesses, conducted the survey this month. Of 150 banks in the survey, 65% wanted to enhance their content so that people would visit the Web sites more often. "A good number of these banks put Web sites up nine months or a year ago, and they're saying, 'Now what?'," said David Gumpert, president of Netmarquee. "They're coming to realize that they need to do something more than an electronic brochure, to provide some kind of value added to their prospects and customers besides just saying, 'Aren't we great?'" Mr. Gumpert's survey, conducted by telephone, found that traffic ranged from 100 to 500 visits a month. Only 5% of banks surveyed said they were actively promoting or advertising their Web sites. The survey also found that the larger the bank, the more interested it was in using the Internet for business purposes. Banks now are devising a variety of ways to draw repeat traffic to their sites, including trivia quizzes and mortgage calculators. Mr. Gumpert's company sells packages of information relevant to small businesses, and he is trying to coax banks to subscribe to his information service, which provides monthly updates. One bank that is considering a subscription to Netmarquee's product is Bank of Boston Corp. Ray Graber, marketing manager for the Web site, said the bank is looking at ways to provide interactive features, like on-line account applications or account transfer capabilities. Mr. Graber said the bank is also considering a service called "Rentnet" that lists apartment rentals on the Internet and might prove helpful to the many college students in the Boston area. Financial Post (Canada): Tuesday, August 27, 1996 Smart Cards Don't Have All the Answers-- Yet By MOTOKO RICH and GEORGE GRAHAM In Mission Impossible, Tom Cruise's latest film, the fearless Ethan Hunt breaks into the CIA computer room, disarming a technological stronghold by punching in numerical codes and submitting his eyes for a retina scan. While most viewers see such high-tech wizardry as fantastic, some of the gadgets may not be far from reality. Researchers worldwide are experimenting with technology that would allow not only security barriers but also electronic payment systems to use the retina, the handprint or even a facial expression as an identification method. "We are moving into the electronic age where money will just be information about the wealth you have," says Hans van der Velde, president of the European Union region of Visa International. Some companies believe that parts of the body, rather than paper or coins, can be used to establish the amount of money somebody has available to spend. For the time being, however, most participants in the payment industry believe the best alternative to cash remains the humble, but universal, plastic card. An increasing number of payment card organizations are replacing the magnetic strip -- the present industry standard -- with a tiny computer microchip that enables cards to be used not only to carry out financial transactions, but also to store data about the card's owner. A chip-based card is much more difficult to counterfeit than the magnetic stripe card and can carry details of a cardholder's insurance policies, medical history or driver's licence. It can be used to manage a retailer's loyalty program and even be used as a key for house or car. Above all, as a plethora of experiments demonstrates, it can be used as an "electronic wallet" storing value instead of petty cash. Pilot programs from the U.S. to Australia are testing the capabilities of these cards. In Britain, the most advanced trial is being conducted by Mondex, originally backed by National Westminster Bank and Midland Bank, and now owned by 17 banks. During the past year, Mondex has invited customers to use the cards in Swindon, where they can pay for small items like newspapers or chocolate bars without coins or notes. The cards are loaded up with value debited from the customer's bank account at automated teller machines or on "smart" telephones. Retailers can then take funds off the card without having to authorize each transaction online. While Mondex is in a race with other global payment organizations to develop and market its version of the electronic wallet on a global basis, several regional projects are harnessing the smart-card technology for a number of payment applications. Transcard, operated in western Sydney by Card Technologies Australia, combines an electronic bus pass with a re-loadable cash card that clocks up loyalty bonus points for buying McDonald's hamburgers or entry to the local swimming pool. In France, customers can pay for taxi rides, newspapers and phone calls with virtually ubiquitous smart cards. Sponsors of these projects are enthusiastic about the early results. "The technology works. That's probably more of a shock to people than anything else," says Beth Horowitz, MasterCard's vice-president for chip card business in Australia. Live testing has resolved some questions. Almost everyone now agrees that the electronic wallet must be reloadable, not a disposable fixed-value card that has been used for telephone cards or in Visa's Atlanta pilot. But for those who wish to exploit the global market -- worth an estimated US$ 4.3 trillion -- for card payments, there are some issues that remain unresolved. One is standards, an issue that plagues all new technological innovations, from the Internet to videocasette tapes. Although Europay, MasterCard and Visa, the largest global retail payments organizations, have developed international standards for chip cards, some systems -- notably Mondex -- do not comply. "The issue of standards has complicated the market for 15 years," says Gerald Hawkins, manager of card services at Lloyd's TSB in Britain. "It is one of the reasons why Mondex, while clearly a very advanced development, has taken a bit of a knock." The idea of a standard is that it would guarantee interoperability among systems, because retailers will want multiple terminals to accept different cards. Mondex argues that the market, rather than standards, will determine which cards will operate in point-of-sale terminals. It says that a number of these terminal suppliers have already demonstrated that interoperable equipment can be made to accept Mondex and all other magnetic stripe and chip cards. In fact, the EMV standards themselves have been criticized because they stick to "contact" technology, in which the chip must come into physical contact with a reader inside a slot. For high-volume applications in places such as railways or buses, contactless technology, in which a card contains a small radio transmitter or a stripe that can be read with a quick swipe, are considered more appropriate. "A contact smart card in a mass transit environment is just too slow," says John Hall, general manager for retail banking services for the Credit Union Services Corp. of Australia. The biggest problem of all, however, is ensuring the smart card makes financial sense. "The reason for all these projects is that no one has proven the business case. I'll be really interested to see if anyone makes money out of this," says Eugene Lockhart, president and chief executive of MasterCard International. The business case for the smart card has receded because telecommunications charges that once made online verification expensive are now coming down, and with them fraud rates. "Ten years ago you could justify the wallet on the basis that it would cut costs," says Peter Hirsch, managing director of consultants Retail Banking Research. "But now telecommunication costs are coming down and the business case is getting weaker. The chip is too expensive to give short-term returns." But at about US$ 14 apiece, a smart electronic wallet -- though more expensive than a magnetic stripe card -- is not completely devoid of financial advantages. Cash, which the wallet would partly displace, is expensive. The Association of Payment Clearing Services in London estimates that handling cash costs the British financial services industry about US$ 4.24 billion a year. For banks, the wallet could offer the chance to undo some of their past mistakes. In Australia, for example, the banks have pressed cards so far that they are being used for much lower value purchases than banks would like. "We don't think much of paying 20 cents to process a 95 cents transaction at McDonald's," says Hall of the Australian credit unions. For merchants, the replacement of cash means the elimination of considerable hassle. "If you take cash, you have to take it home, count it, put it into a night safe and then pay it into the bank the next day," says Richard Jackson, manager of Victoria News in Swindon, which accepts the Mondex card. But many retailers are likely to resist paying for the "privilege" of accepting the wallets. "Of course, there will be tough negotiations between individual banks and retailers," says Ron Clark, chief executive of Mondex in Britain. "We had this battle over Switch [the British debit card brand] with retailers who said they wanted us to provide it for free. But over time they have paid for it because it is a business proposition." Consumers, on the other hand, may prove much more difficult to convince that an electronic wallet is worth paying for when they can get cash for free. But Transcard charges US$ 7.82 a card, and says customers gladly pay it because the cost is covered within two weeks by the free bus rides they earn through a loyalty bonus scheme. "We have categorically proved that the consumer will pay," said David MacSmith, managing director of Card Technologies Australia. But it still may be difficult to persuade consumers to abandon cash altogether. "We are going to have a migration period of at least 10 years," said Lockhart of MasterCard. It will take even longer for more technologically advanced developments like the retina scan to move out of the film world into the marketplace. Richard Tyson-Davies, director-general of Apacs said: "The card is one of the most standardized items in the world. It is tremendously accepted and recognized so it would be a very bold person who threw that away." --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Child pornography -- Expert witness for Federal jury trial
by mpd＠netcom.com 17 Dec '03

17 Dec '03

A Cyber-Liberties Advocate writes: > I just got a call from two Federal Public Defenders whose client is > charged with possession of child pornography stored in the /tmp > directory of a Unix system, in a zip'd file. (These lawyers seem to be > reasonably cyber-savvy, and told me they're following what I've been > writing about cyber-liberties.) Is this the Leachman/UPitt thing? --- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

RE: Risk v. Charity (was: RE: Workers Paradise. /Politica...
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Black Unicorn <unicorn(a)schloss.li> wrote: >On Tue, 17 Sep 1996 jbugden(a)smtplink.alis.ca wrote: >> Black Unicorn <unicorn(a)schloss.li> >> >You are saying that everyone on the planet has a right to health >> > insurance and disability insurance whether they can afford it or not. >> > This is folly. The result is serious moral hazard problems. >> >> Almost, but not quite. I'm saying that within our two countries at least >> (Canada, U.S.) everyone could have access to medically necessary >> procedures because the *society as a whole* can afford it. > >The decisions about what is or is not medically necessary must by >design be made by government in a socialized medicine regime. People do make decisions that affect other people. If you feel safer in the good hands of Allstate than at the government trough, good for you. Personally, I trust in Allah, but I still tie up my camel. > This evades an important point as well. Namely, who cares if society > can afford it? Some things are seen as investments in the future of a society. I view both Education and Health through this lens. >> But there is a balance between accurately pricing the risk and >> minimizing the cost of the bureacracy that polices this pricing. > > Oh, I see. Let's give the program to the government then. Good idea. > That will reduce the cost of the bureacracy. The point is still valid. Are we not trying to minimize this cost? >> There are also many ways to modify behaviour, not all of them direct. > > And all of them buy into the notion that people are not to be made > personally responsible for their high risk behavior. There it is again. Blame the sick for their lack of moral fibre. Not every victim of lung cancer smokes. Besides, people are notoriously poor at evaluating the probability of unlikely events (see reference below). A "punishment" that happens 30 years after the "crime" is no deterrent. Prevention is usually cheaper than treatment. > I prefer market solutions. I prefer solutions. James

2 1

The Expat Tax Is Law - The Door Is Now Closed!
by tcmay＠got.net 17 Dec '03

17 Dec '03

I'm forwarding this message to the list, as it relates to several themes we've been discussing recently. The imposition of draconian taxation policies effectively says that the U.S. is now doing what the Soviet Union did to emigrants: demand that they "pay back" various costs the government claimed they had incurred. Here, the U.S. is telling would-be expats that they cannot take their property with them, that they must effectively "escrow" (there's that horrid word again) their assets in a form and place that the tax collector can access, even if they no longer live in the United States and no longer use services, and even if they had paid their full taxes on income while they _were_ in the U.S. It makes me want to just put my stock certificates in my luggage and just drive on down to Mexico and cross the border (no border checks) and go from there to some safer haven. (However, I imagine the Feds can effectively block sales of my stock--the stock is still formally only an accounting entry, as stock certificates are not "bearer instruments." I could probably relocate to a foreign haven and sell the assets before the IRS would even notice...unless they computerize. I suspect this is coming.) Anyway, here's the article: > From: taxhaven(a)ix.netcom.com(Adam Starchild) > Newsgroups: alt.privacy > Subject: The Expat Tax Is Law - The Door Is Now Closed! > Date: 17 Sep 1996 01:30:43 GMT > Message-ID: <51kv03$d82(a)dfw-ixnews5.ix.netcom.com> > > The Expat Tax Is Law - The Door Is Now Closed! > > by > > Marc M. Harris > > After last year's failed attempt to pass an American > expatriate tax, the U.S. Treasury Department succeeded in > sneaking the provisions into the miscellaneous revenue positions > of the recently passed Health Coverage Availability and > Affordability Act of 1996. Given the failure of their high > profile campaign last year, the Treasury Department switched > strategies this year and undertook one of stealth. While the > press was talking about tax-deductible contributions to medical > savings accounts (MSAs), provisions tightening the expatriation > tax rules were implemented. Foreign grantor trust rules were > also tightened under the law. > In order to provide the health insurance and care benefits > provided under the law, a separate tax title adds certain revenue > raising provisions. In general, these revenue offsets add > provisions aimed at making certain the United States get their > fair share plus some when U.S. citizens and permanent residents > expatriate. In short, Uncle Sam would like to tell its > expatriates that they earned their money from the United States, > not in it. > A review of selected sections of the Congressional Record > provides some additional insight into the thinking behind these > new provisions. > > "It has come to the attention of Congress that some > very wealthy individuals have been relinquishing their > citizenship to avoid U.S. income, estate and gift tax. The > bill does not want to discourage citizens from exercising > their right to expatriate, but does not want to provide a > tax incentive for such an action..." > > If Congress truly wanted to eliminate the incentive for > expatriation, it might be better to eliminate high taxation and > put an end to the litigation crisis rather than creating another > layer of government regulation and bureaucracy. > > "Congress believes the changes are consistent with > existing tax treaties in conferring a tax credit for taxes > paid in the foreign country, and to the extent they are > inconsistent, the Treasury Department will re-negotiate the > treaties to account for the changes. The new provisions > take precedence over any treaties..." > > To make certain that other countries will not benefit from > America's brain drain, the United States will once again embark > on a campaign to bully other nations into accepting America's > oppressive system of taxation and regulation. > > "This bill would subject former citizens to the > expatriation provisions with no inquiry into their motive > and requires individuals who exchange property that would > otherwise be exempt from U.S. taxation as foreign source > income must immediately recognize U.S. source income on any > gain from such a transaction. The Secretary is authorized > to issue regulations to treat removal of tangible property > from the U.S. and other conversions to foreign source > income. For example, any income from stock transferred to a > foreign source, such as dividends, would be converted to > U.S. source and immediately taxed..." > > Logic dictates that if this tax were to approach 100%, it > would look quite similar to currency controls and foreign > investment prohibitions. Since it only goes about half of the > way, we can assume that we are 50% down the road toward American > currency and foreign investment controls. > > "A new information reporting requirement has been added > requiring former citizens and long-term residents to > complete information reporting at the time of > expatriation..." > > Just to make certain that no one escapes from the United > States without leaving all their wealth behind, the new > information reporting requirements will make certain that the > Treasury Department always knows where your assets are placed. > Of course, if you fail to report, civil and criminal sanctions > will apply. The new treaty negotiations will most likely include > provisions to extradite those "expat tax evaders" back home for > their "criminal act" of leaving a country that was once known as > the home of the free. Our sources at the Internal Revenue > Service tell us this treaty provision will be known as the Hotel > California provision -- you can check out, buy you can never > leave. > > "The bill also requires that a U.S. person that > receives a distribution from a trust must report that to the > Service..." > > Now Uncle Sam is not only seeking to penalize those patriots > that have placed their funds out of harm's way, but now the > potential recipients of those receipts. If the logic of current > money laundering statutes apply as they do in most tax cases, the > bank that accepts the cashing of the beneficiary's distribution > check from a foreign trust will be a co-conspirator in this > "unpatriotic" affair. > > "Effective for transfers made after February 6, 1995, > if a non-resident alien becomes a resident within five years > of transferring property to a foreign trust, the transferor > will be considered to have transferred the property on the > date he became a resident..." > > The Statue of Liberty stands as America's great symbol of > open immigration with its famous inscription "give us your tired > and poor." With this provision, any person who hopes to emigrate > to the United States will definitely become tired of complying > with U.S. regulations and poor after he complies with them. > > "If a U.S. person receives more than $10,000 worth of > gifts from one foreign person during any tax year, he must > file a report with the Service. If he fails to file a > report, the Service has the sole discretion to determine the > taxation of the property received by the U.S. person and the > person is liable for a penalty of 5 percent of the value of > the gift for each month he fails to file a report..." > > Currency controls and foreign investment restrictions work > both ways. Not only will governments prevent you from sending > your money out, but they will also prevent you from sending your > money in without their fair share plus some. > > "The Service has the power to prescribe regulations to > prevent the avoidance of the Estate, Trust and Beneficiary > part of the Code..." > > This provision is known as an Abusive Transaction provision. > It is commonly referred to by international human rights > organizations as the arbitrary and capricious application of > laws. > > "Once the Secretary of the Treasury establishes a > reasonable belief that the expatriate's loss of U.S. > citizenship would result in a substantial reduction in > estate, inheritance, legacy, and succession taxes, the > burden of proving that one of the principal purposes of the > loss of U.S. citizenship was not avoidance of U.S. income or > estate tax is on the executor of the decedent's estate..." > > If these provisions were making you feel a bit suicidal, > please forget it. Uncle Sam is not only going to pursue you to > the grave, but also your executors and heirs. > > Other items in the Congressional Record provide an even > greater insight into Washington's motivations: > > "Because U.S. citizens who retain their citizenship are > subject to income tax on accrued appreciation when they > dispose of their assets, as well as estate tax on the full > value of assets that are held until death, the Committee > believes it fair and equitable to tax expatriates on the > appreciation in their assets when they relinquish their U.S. > citizenship. The Committee believes that an exception from > the expatriation tax should be provided for individuals > whose income and net worth are relatively modest..." > > If you are poor, you may leave; however, if you were a > productive American in the United States that no longer exists, > you must stay and pay or leave behind the fruits of your > productivity. America's Second Civil War has begun and it is > known as Class Warfare. > > "Exceptions from the expatriation tax are provided for > individuals. (An) exception applies to a U.S. citizen who > relinquishes citizenship before reaching age 18-1/2, > provided that the individual was a resident of the United > States for no more than 5 taxable years before such > relinquishment..." > > Since one cannot renounce their American citizenship prior > to their 18th birthday, the children of an American resident > overseas have only 6 months to renounce their citizenship and > avoid the application of these laws. Ho many 18 year olds are > capable of making this type of decision? > > "Under the provision, an individual is permitted to > elect to defer payment of the expatriation tax with respect > to the deemed sale of any property. Under this election, > the expatriation tax with respect to a particular property, > plus interest thereon, is due when the property is > subsequently disposed of. In order to elect deferral of the > expatriation tax, the individual is required to provide > adequate security to ensure that the deferred expatriation > tax and interest ultimately will be paid... In the event > that the security provided with respect to a particular > property subsequently becomes inadequate and the individual > fails to correct such situation, the deferred expatriation > tax and interest with respect to such property becomes due. > As a further condition to making this election, the > individual is required to consent to the waiver of any > treaty rights that would preclude the collection of the > expatriation tax." > > Only in Congress could one dream of a law that requires its > former citizens to waive their rights in a foreign country in > order to escape from the political, social, and economic tyranny > of the United States. > > "Under the provision, special rules apply to trust > interests held by the individual at the time of > relinquishment of citizenship or termination of residency. > In addition, an individual who holds (or who is treated as > holding) a trust interest at the time of relinquishment of > citizenship or termination of residency is required to > disclose on his or her tax return the methodology used to > determine his or her interest in the trust, and whether such > individual knows (or has reason to know) that any other > beneficiary of the trust uses a different method..." > > The latter provision is known as the "Stool Pigeon" clause - > - you are required to turn your fellow beneficiaries over to the > Internal Revenue Service. Similar laws existed in Nazi Germany > that encouraged children to turn their parents and neighbors over > to the authorities. > > "If the individual holds an interest in a trust that is > not a qualified trust, a special rule applies for purposes > of determining the amount of the expatriation tax due with > respect to such trust interest. Such separate trust is > treated as having sold its assets as of the date of > relinquishment or citizenship or termination of residency > and having distributed all proceeds to the individual, and > the individual is treated as having recontributed such > proceeds to the trust. The individual is subject to the > expatriation tax with respect to any net income or gain > arising from the deemed distribution from the trust. A > beneficiary's interest in a non-qualified trust is the basis > of all facts and circumstances. If the individual has an > interest in a qualified trust, a different set of rules > applies. In determining this amount, all contingent and > discretionary interests are resolved in the individual's > favor (i.e. the individual is allocated the maximum amount > that he or she potentially could receive under the terms of > the trust instrument)..." > > The United States is quite generous in calculating the tax > based on the maximum possible distribution. In their arrogance, > it appears that the law does not detail how to recover the excess > tax if the maximum level is never reached. Alternatively, > Congress never intended for former Americans to comply with this > law. > > "If the individual does not agree to such a waiver of > treaty rights, the tax with respect to distributions to the > individual is imposed on the trust, the trustee is > personally liable therefor, and any other beneficiary of the > trust will have a right of contribution against such > individual with respect to such tax." > > Based on the above, no foreign financial institution with > offices or business in the United States would accept the > trusteeship of an American's assets. > > "Under the provision, an individual is permitted to > make an irrevocable election to continue to be taxed as a > U.S. citizen with respect to all property that otherwise is > covered by the expatriation tax. This election is an "all- > or-nothing" election;..." > > Congress is quite generous with this provision in allowing > expatriating Americans to continue being chased by tax collectors > for the rest of their lives overseas. > > "Under the provision, an individual is treated as > having relinquished U.S. citizenship on the date that the > individual first makes known to a U.S. government or > consular officer his or her intention to relinquish U.S. > citizenship... A U.S. citizen who furnishes to the State > Department a signed statement of voluntary relinquishment of > U.S. nationality, confirming the performance of an > expatriating act with the requisite intent to relinquish his > or her citizenship is treated as having relinquished his or > her citizenship on the date the statement is so furnished > (regardless of when the expatriating act was performed), > provided that the voluntary relinquishment is later > confirmed by the issuance of a CLN (Certificate of Loss of > Nationality). If neither of these circumstances exist, the > individual is treated as having relinquished citizenship on > the date a CLN is issued or a certificate of naturalization > is cancelled. The date of relinquishment of citizenship > determined under the provision applies for all tax > purposes..." > > Based on this provision, almost any American who now wishes > to undertake the expatriation route will be subject to the tax. > In short, the door has closed for most Americans. > > "Under the provision, the exclusion from income does > not apply to the value of any property received by gift or > inheritance from an individual who was subject to the > expatriation tax. Accordingly, a U.S. taxpayer who receives > a gift or inheritance from such an individual is required to > include the value of such gift or inheritance in gross > income and is subject to U.S. income tax on such amount..." > > This implies that if an American expatriate sends funds back > to support his aging parents, his parents will need to treat > these gifts as taxable income. If the parents fail to report > these amounts, they could also suffer civil and criminal > penalties associated with tax evasion. > > "Under the provision, an individual who relinquishes > citizenship or terminates residency is required to provide a > statement which includes the individual's social security > number, forwarding foreign address, new country of residence > and citizenship and, in the case of individuals with a net > worth of at least $500,000, a balance sheet..." > > Given the desire to obtain balance sheets from expatriating > Americans, it is only a matter of time before the IRS requires > the inclusion of personal balance sheets of individual taxpayers > with their Form 1040s or at least those they suspect might wish > to expatriate. > > "In the case of a former citizen, such statement is due > not later than the date the individual's citizenship is > treated as relinquished and is provided to the State > Department..." > > In short, this means that you cannot obtain your certificate > of loss of nationality without providing the information to the > United States government. > > "Further, the provision requires the Secretary of the > Treasury to publish in the Federal Register the names of all > former U.S. citizens with respect to whom it receives the > required statements or whose names it receives under the > foregoing information-sharing provisions..." > > Now your friends and neighbors can know that you have > expatriated. Although Congress respects the right of Americans > to expatriate, it will publish your name in the federal register > as if expatriation were a criminal act. > > "The provision directs the Treasury Department to > undertake a study on the tax compliance of U.S. citizens and > green-card holders residing outside the United States and to > make recommendations regarding the improvement of such > compliance. The findings of such study and such > recommendations are required to be reported to the House > Committee on Ways and Means and the Senate Committee on > Finance within 90 days of the date of enactment..." > > Uncle Sam has awoken to the fact that most Americans living > overseas are the most likely individuals to expatriate and as a > result, they are gearing up to create a machine to attack them as > well. > > The provision is effective for U.S. citizens whose date > of relinquishment of citizenship (as determined under the > provision occurred on or after February 6, 1995. U.S. > citizens who committed an expatriating act with the > requisite intent to relinquish their U.S. citizenship prior > to February 6, 1995, but whose date of relinquishment of > citizenship (as determined under the provision) does not > occur until after such date, are subject to the expatriation > tax..." > > This means that if you have not already relinquished your > citizenship or have only done so recently, you are subject to the > expat tax. The door has closed, but not completely. > > About the Author > > Marc M. Harris is a certified public accountant and > president of The Harris Organization. He has already developed a > strategy for legally avoiding the expat tax, which he discusses > only in personal appointments. > > Copyright 1996 by Marc M. Harris > > ----------------------------------------------------------------- > > Posted by Adam Starchild > The Offshore Entrepreneur at http://www.au.com/offshore -- Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1