December 2003 - cypherpunks-legacy

INFO: Sen. Burns urges White House to follow NRC recommendations (6/2/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| SEN. CONRAD BURNS URGES CLINTON TO REASSES ENCRYPTION POLICY AND ANNOUNCES HEARINGS ON THE ISSUE for 6/12/96 REP. RICK WHITE (R-WA) SCHEDULED FOR HOTWIRED CHAT 6/5/96 9-10PM EST SEN. CONRAD BURNS (R-MT) SCHEDULED FOR HOTWIRED CHAT 6/11/96 10-11PM EST Date: June 2, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents News Text of Sen. Burns' letter to President Clinton How to receive crypto-news ----------------------------------------------------------------------------- NEWS Sen. Conrad Burns (R-MT), principal co-sponsor of legislation to ease restrictions on encryption, yesterday sent President Clinton a letter urging the Administration to reassess its encryption policy in light of a recent report by the National Research Council. The findings contained in the NRC study, released at a briefing in Washington DC on Thursday, raise serious questions about the rational for the Administration's current approach to cryptography policy. The study states explicitly, "Current national cryptography policy is not adequate to support the information security requirements of an information society." In his letter to the President, Senator Burns said that the NRC study presents overwhelming evidence that the current approach to encryption policy has failed. Burns also pledged to hold hearings in the Senate Commerce Committee on June 12 and 26. The night before the hearings (June 11 at 10 pm ET), Senator Burns will be live online at HotWired (http://www.hotwired.com/wiredside) Be sure to save the date and stop by to talk with the Senator about his efforts to encourage the widespread availability of strong encryption and get a preview of the hearings on the Pro_CODE bill. Information on Senator Burns' legislation, as well as information on the NRC report, is available at http://www.crypto.com DON'T FORGET! Representative Rick White (R-WA) will be on HotWired Wednesday June 5th at 9pm EST at http://www.hotwired.com/wiredside/ You can tune in and listen to the chat with the RealAudio software (http://www.realaudio.com) You can ask questions of the Representative through a moderator and get real, immediate responses. ----------------------------------------------------------------------------- TEXT OF SEN. BURNS' LETTER TO PRESIDENT CLINTON May 30, 1996 The President The White House Washington, D.C. 20500 Dear Mr. President, I urge you to reassess the administration's position on cryptography policy in light of the report released today by the National Research Council, "Cryptography's Role in Securing the Information Society." The report was put together by the NRC Committee to Study National Cryptography, which included members from across the spectrum of the business, academic, defense and intelligence communities. The fact that such a diverse roster of our brightest minds could achieve consensus after taking two years to pore over the details of encryption policy is remarkable, and their recommendations should be taken most seriously. The acronym of the report's title-CRISIS-is especially apt given the massive economic and national security costs of the current policy, which severely restricts the export of software containing strong encryption. As the report states, "Current national cryptography policy is not adequate to support the information security requirements of an information society. Indeed, current policy discourages the use of cryptography, whether intentional or not, and in so doing impedes the ability of the nation to use cryptographic tools that would help to remediate certain important vulnerabilities." As the Chairman of the NRC Committee to Study National Cryptography, Kenneth Dam, states in the report "the crisis is a policy crisis, rather than a technology crisis, an industry crisis, a law enforcement crisis, or an intelligence-gathering crisis..." The most recent version of the administration's policy, as reflected in the draft white paper of the interagency working group on encryption, unfortunately reveals a continuing commitment to government-imposed mandates rather than private-sector solutions. The proposal, which was quickly dubbed "Clipper III" because of its close alignment with the earlier rejected Clipper schemes, has the support of neither the software industry nor the Net community. Indeed, as the Committee noted, an essential flaw behind the administration's policy is the continuing reliance on the national security and law enforcement communities to drive the policy through administrative diktat rather than open legislative action. As the report states, rather than vainly attempting to reign in the inevitable widespread use of strong encryption, the administration should be actively promoting it. The use of strong encryption has become vital to both ensuring the privacy of individuals and fostering the growth of the Global Information Infrastructure into the 21st century. As for the national security aspects of encryption policy, the report states that cryptography can protect proprietary information and reduce economic espionage. In addition, strong encryption can protect nationally sensitive information systems and networks against unauthorized penetration. Therefore, the use of strong encryption serves to protect national security rather than hinder it. Simply put, "on balance, the advantages of more widespread use of cryptography outweigh the disadvantages." I further call your attention to specific recommendations by the Committee: *National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. *No law should bar the manufacture, sale, or use of any form of encryption within the United States. *Export Controls on cryptography should be progressively relaxed. *The U.S. government should promote the security of the telecommunications networks more actively. *The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. *Aggressive government promotion of escrowed encryption is not appropriate... *The debate over national cryptography policy can be carried out in a reasonable manner on an unclassified basis. *National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. A core recommendation of the Committee is that the administration foster an open public debate so that a national consensus on cryptography can be developed. I agree wholeheartedly and hope that the public hearings beginning on June 12 in the Commerce Committee's Subcommittee on Science, Space and Technology, which I chair, will help foster this process. Many of the NRC's recommendations are reflected in the "Burns Pro-CODE bill," S. 1726, which will be debated on that date, with an additional hearing to be held on June 26. Now that some of the best scientific and technical minds in the country have essentially endorsed the position that business and policy advocates have been taking for years, it's time for the administration to come around as well. In conclusion, I can only agree with the Chairman Dam's statement: We believe that our report makes some reasonable proposals for national cryptography policy. But a proposal for action. What is needed now is a public debate, using and not sidestepping the full processes of government, leading to a judicious resolution of pressing cryptography policy issues and including, on some important points, legislative action. Only in this manner will the policy crisis come to a satisfactory and stable resolution. Sincerely, /s/ Conrad Burns U.S. Senator ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

Re: [Off-Topic] "Curfews"
by jim bell 17 Dec '03

17 Dec '03

At 07:45 PM 6/1/96 -0700, Timothy C. May wrote: >At 1:59 AM 6/2/96, Duncan Frissell wrote: > >>Of course curfew laws only control the inarticulate and scruffy. Well >>dressed children (coat and tie for the boys dress or suit for the girls) who >>can claim that they are out doing tons of protected things like work and >>school and worship and political campaigning and "trying to save street >>children for Jesus" will not be picked up. They can also say things like > >This, by the way, is the main thing that concerns certain civil rights >groups (including the Santa Cruz chapter of the ACLU). They say they'll be >monitoring enforcement patterns to see if more "children of color" are >picked up than their percentage in the population represents. This, the curfew situation, is yet another of the reasons I'd favor "playing hardball" with the government. I'm very much against discriminatory enforcement, but on the other hand I don't think my liberty should be dependent on getting an organization like the ACLU to look out for and complain against discrimination against me. I feel if a group of left-handed albinos think the police are being too hard on left-handed albinos, they shouldn't have to convince the ACLU of this, and should be entitled and able to fight back effectively and prevent what they view as abuse. True, such a situation may occasionally lead to abuses, but I strongly expect that those abuses will be far fewer than the current system. Jim Bell jimbell(a)pacifier.com

2 1

(no subject)
by ira 17 Dec '03

17 Dec '03

1 0

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 09:30 AM 6/2/96 -0700, Martin Minow wrote: >>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on >>the eagerly awaited (at least by this user) Java Crypto API. >---- ---- ---- >Notes from the security birds of a feather session >---- ---- ---- > >-- Need multiple security managers: if any say no, reject the request. >-- Servet, applet need different security managers. >-- Problem with firewalls: client accesses server via firewall via > proxy servers. May not be able to open a URL directly. >-- Java Commerce API coming for payment functions. >-- Problem with foreign applet vendors: how can a non-US security > class vendor certify a class to be used (outside the US). > Currently, it must be imported and signed by Sun. But, then > it can't be exported without a Commerce Department license. > No (current) plans to establish a signing authority outside > of the U.S. We've heard this assertion before. Why not import the software, generate a detachable signature, and then export the signature for re-attachment overseas? Surely export of signatures isn't controlled (even arguably) by ITAR. Jim Bell jimbell(a)pacifier.com

1 0

Insider Trading and Inside Information
by mpd＠netcom.com 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) writes: > And, how can someone who acts on overheard information--as > in the elevator example Sandy cited--be charged with any > crime? Unless they are "insiders," covered by SEC rules > about trading, they are free to act on essentially anything > they hear. "He who hesitates to act on inside information is > lost." > (To elaborate on this: I was never classified as an > "insider" during my time at Intel, and I certainly bought > and sold the stock based on what products and news I knew > was coming out or what rumors I'd heard. Only a select group > of executives and staff in the specific departments > generating earnings announcements, auditing, etc., were > covered. And senior executives are covered by various rules > about trading stocks. And family members and friends may be > covered, if they learn of "inside" (in the SEC sense) > information. The SEC, in cooperation with the courts, has been gradually shifting the definitions of "insider" and "inside information" to more all-encompassing ones. It used to be that an insider was an officer of the company, or someone with a fiduciary relationship to the firm, such as a auditor or investment banker with which the firm did business. Inside information was also similarly limited to a narrow collection of material subject to regulatory restrictions on its disclosure. Nowdays "inside information" has been expanded to include anything that the general public is not privy to, and "insiders" can be almost anyone as well. Indeed, the current definitions can subject to criminal sanctions low level employees trading their company's stock on the basis of rumors, or newspaper columnists trading in anticipation of reaction to their published speculations. It's not even safe to trade on what formerly would have been known as "hot tips" any more, unless the average person in the street had a mechanism to access the information. The legal theory behind all this is that anyone, no matter who they are, trading on any publicly unavailable information, no matter what it is, might be perceived as profiting at the expense of the zillions of ordinary investors, whose continued playing of the Stock Lottery^H^H^H^H^H^H^H Market the govermment and big business definitely want to encourage. Not to mention the huge public support for the prosecution of anyone who the public thinks has "gotten away with something" that Joe Six-Pack didn't have the opportunity to do, and made a few bucks in the process. If this trend continues, I won't even be able to take an Intel janitor to lunch, and trade the stock based on his impression that Andy Grove looked particularly happy while having his office cleaned, without risking an "insider trading violation" should the stock go up. A new and interesting manifestation of the "Surveilance State." -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Ok, what about PGP (was: MD5 collisions)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 May 96 at 1:26, Chris Adams wrote: > How about a NSA-stomper option that would use all-of-the-above? For the truly paranoid (or > owners of Pentium-Pro 200Mhz multi-processor machines Chances are that if the algorithms alone aren't "NSA-stompers", an all-of-the-above option won't be. > Also, what's the verdict on IDEA? Is there a switch yet that would allow straight RSA? > (with the obvious speed decrease...) That would actually be less secure. RSA may be PGP's weakest link. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

penet to be compromised again? More Scientology lawsuit crap
by Deana Holmes 17 Dec '03

17 Dec '03

I just received some information on IRC channel #scientology that Julf Helsinghuis is being sued by $cientology *yet again* for a name. Apparently this has to do with the deposition request to Homer Wilson Smith (lightlink.com) Scamizdat #3 was posted through lightlink.com and the $cientologists have wanted for a long time to figure out who did it. (Which is why they sued Grady Ward.) Homer, in response to the deposition request, consulted his logs, and said that the original post came from penet.fi. So $cientology has apparently gone to the Finns again to ask that Julf be forced to give up the name. I'm appending a copy of the IRC log, as I'm too lazy to edit it down to particulars. It includes the name of the police officer involved (Kaj Malmberg) as well as a Finnish newsgroup and article id for the whole story. If someone knows Finnish and can give a rough translation, it would be terribly appreciated by a lot of people. <enclosed IRC transcript> <Ignatius> hi guys... do you have the latest news on Julf Helsingius' case? > Ig: what do you mean, latest news? <Sherilyn> The julf case? * Sherilyn didn;t know there _was_ a julf case... <Ignatius> ok... copyright offences are crimes under Finnish law, not torts. <Ignatius> Kaj Malmberg, the Finnish police officer who handles the investigation of the copyrighted material through penet.fi, posted an article to a domestic newsgroup today. <Sherilyn> Do you have the message-id and group name? <Ignatius> the scienos have filed a motion at a local court in Helsinki to force Julf Helsingius to give out the name of the poster. <Ignatius> sherilyn, are you good at Finnish? <Sherilyn> ig: lol! <skaplin> Who posted what through penet?? <Ignatius> the hearing is scheduled for the beginning of next week... perhaps already tomorrow. <Sherilyn> So was penet the server before lightlink in the scamizdat case? <Sherilyn> Homer gave them the name of the prior server, or was going to *** skaplin changes topic to "Penet under attack...Again!" <Sherilyn> Well this needs to be put out loud on groups where people use penet <skaplin> Ignatus: How good are you at translating? <Sherilyn> Last attack on penet got the scientologists a very bad rep > Ig: We need that post. > IN ENGLISH > ASAP! > even if it's a lousy translation. <Sherilyn> This cop guy speaks English <Sherilyn> Didn't he post in English to a.r.s.? > Sheri: he may not want to post it on a.r.s <Sherilyn> It's true, skap <Ignatius> i don't know more than what I already mentioned. The police officer didn't even mention Scientology; he just mentioned that he was investigating a copyright offence. <Sherilyn> She would make a lovely domina > sheri: you should see what I'm reading now :) <skaplin> We're sure penet is under attack for a name though... <Sherilyn> Bloody hell fire! <Sherilyn> I have 6440 posts downloading! <Ignatius> i'm writing an article to post to the ng:s, but it's obvious we don't have all the bits of the puzzle yet. <skaplin> Want some kippers with your spam sheri?? :) <skaplin> Ignatus: What newsgroup was it in? > ig: please post it asap. > also, send it to rnewman(a)cybercom.net. <Ignatius> skap, sfnet.keskustelu.laki; <4os5bu$flp(a)idefix.eunet.fi> <Ignatius> the police officer, Kaj Malmberg, is at kaj.malmberg(a)helsinki.poliisi.fi <end of transcript> Deana Holmes mirele(a)xmission.com

1 0

Re: Java Crypto API questions
by minow＠apple.com 17 Dec '03

17 Dec '03

Jim Bell writes: >>-- Problem with foreign applet vendors: how can a non-US security >> class vendor certify a class to be used (outside the US). >> Currently, it must be imported and signed by Sun. But, then >> it can't be exported without a Commerce Department license. >> No (current) plans to establish a signing authority outside >> of the U.S. > >We've heard this assertion before. Why not import the software, generate a >detachable signature, and then export the signature for re-attachment overseas? > I suspect (but don't have any direct knowledge) that strong crypto classes are distributed after encryption by Sun's private key. The corresponding public key is enbedded in the Java Class Loader and/or virtual machine (or the security framework class -- I'm only speculating here). This means that "rogue" encryptors can't work under Sun's security manager as they will be rejected as "unloadable" Martin Minow minow(a)apple.com

1 0

Class III InfoWar: TST Article
by jya＠pipeline.com 17 Dec '03

17 Dec '03

This is the article Winn Schwartau cited to last night: ---------- The Sunday Times (London), June 2, 1996, pp. 1, 24. City surrenders to L400m gangs [Insight column] City of London financial institutions have paid huge sums to international gangs of sophisticated "cyber terrorists" who have amassed up to L400m worldwide by threatening to wipe out computer systems. Banks, broking firms and investment houses in America have also secretly paid ransom to prevent costly computer meltdown and a collapse in confidence among their customers, according to sources in Whitehall and Washington. An Insight investigation has established that British and American agencies are examining more than 40 "attacks" on financial institutions in London and New York since 1993. Victims have paid up to L13m a time after the blackmailers demonstrated their ability to bnng trading to a halt using advanced "information warfare" techniques learnt from the military. According to the American National Security Agency (NSA), they have penetrated computer systems using "logic bombs" (coded devices that can be remotely detonated), electromagnetic pulses and "high emission radio frequency guns", which blow a devastating electronic "wind" through a computer system. They have also left encrypted threats at the highest security levels, reading: "Now do you believe we can destroy your computers?" The authorities have been unable to stem the attacks, which are thought to onginate from the United States. In most cases, victim banks have failed to notify the police. "They have given in to blackmail rather than risk a collapse in confidence in their security systems," said a security director at one blue-chip merchant bank in the City. A senior detective in the City of London police said: "We are aware of the extortion methods, but the banking community has ways of dealing with it and rarely reports to the police." European and American police forces have set up special units to tackle the cyber criminals, who, Ministry of Defence sources believe, have netted between L200m and L400m globally over the past three years. But law enforcement agencies complain that senior financiers have closed ranks and are hindering inquiries. Experts in the field of information warfare met in Brussels last month to discuss defensive measures. Representatives included Captain Patrick Tyrrell, assistant director of computer information strategy at the Ministry of Defence; General James McCarthy, professor of national security at the US Air Force Academy; General Jean Pichot-Duclos, director of the economic intelligence department of the French Defence Council, and senior figures from the civilian computer industries. A separate closed meeting involving representatives from Whitehall and the intelligence community was held to analyse the 40 attacks on British and American financial centres since 1993. A further secret seminar took place in Washington this weekend. Kroll Associates, the international investigating firm, confirmed last week that it had acted for financial institutions that have been blackmailed. "One of the problems we face is that the potential embarrassment from loss of face is very senous," said a spokesman in New York. Kroll had evidence that firms in London and New York had been targeted. "The problem for law enforcement is that the crime is carried out globally, but law enforcement stops at the frontier," he said. Yesterday a Bank of England spokesman acknowleged the threat from the extortionists: "We are aware of this. It does exist. It is extortion and fraud." But the spokesman also insisted: "It is not the biggest issue in the banking market." Scotland Yard is now taking part in a Europe-wide initiative to catch the cyber criminals and has appointed a senior detective from its computer crime unit to take part in an operation codenamed Lathe Gambit. Such is the secrecy that few details about the inquiry have emerged. In America, the FBI has set up three separate units to investigate computer extortion. The NSA believes there are four cyber gangs and has evidence that at least one is based in Russia. The agency is now examining four examples of blackmail said to have occurred in London: + January 6, 1993: Trading halted at a broking house after blackmail threat and computer crash. Ransom of L10m paid to account in Zurich. + January 14, 1993: a blue-chip bank paid L12.5m after blackmail threats. + January 29, 1993: a broking house paid L10m in ransom after similar threats. + March 17, 1995: a defence firm paid L10m in ransom. In all four incidents, the gangs made threats to senior directors and demonstrated that they had the capacity to crash a computer system. Each victim conceded to the blackmailers' demands within hours and tranferred the money to offshore bank accounts, from which it was removed by the gangs within minutes. The techniques have varied. In London, criminals posing as marketing firms have gained detailed knowledge of a target's system by interviewing the heads of information technology departments. In some cases, they have even issued questionnaires to unsuspecting officials. Armed with this information, they have been able to breach security and leave encrypted messages warning of their capability. The gangs are believed to have gained expertise in information warfare techniques from the American military, which is developing "weapons" that can disable or destroy computer hardware. Some are also known to have infiltrated banks simply by placing saboteurs on their payroll as temporary staff. Little is yet known about the identities of the gangs but, according to the NSA, America is the main source of the attacks. It believes that at least one other group originates from Russia and has followed the movement of money to the former Soviet states. A spokesman for the Metropoiitan poiice said: "There is potential for extortion from those purporting to know how to damage computer systems. "The computer crime unit liaises where necessary with its Euro counterparts to discuss cross-frontier crimes." One merchant bank director said yesterday: "You will never get a financial institution to admit it has an extortion policy, let alone that it has paid money to blackmailers." ----- Additional reporting: Peter Warren [End]

4 4

No subject
by an633169＠anon.penet.fi 17 Dec '03

17 Dec '03

replying to ping --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0