December 2003 - cypherpunks-legacy

Re: Censorship?
by Omegaman 17 Dec '03

17 Dec '03

> What say ye?? > > :From: Zimm2(a)gnn.com (Zimm2) > :Newsgroups: alt.security.pgp > :Subject: Cypherpunks engaged in censorship? > :Date: Wed, 02 Oct 1996 08:39:50 > : > :It has come to my attention that Cypherpunks no longer allows users of > :Microsoft browsers to access their archives. The "cypherpunks archives" is not owned by the cypherpunks or maintained by toad.com (which is the host of the actual list). The owner of infinity.nus.sg/cypherpunks webpage maintains the archive. It is his effort and his choice to restrict the browser. Anyone is free to provide an archive the list. And anyone can read the list. > :Is it contradictory for an organization who proclaims an interest in the free > :exchange of ideas through the mechanism of the Internet to limit the exchange > :of ideas using an individual's software decisions as the criteria? Agreed. But the cypherpunks is not an "organization" in the strictest sense. The only "official" aspect of cypherpunks is the list hosted at toad.com. > :Are issues of annonymity and privacy and the encouragement of private use of > :powerful encryption and remailer tools secondary to and less important than a > :crusade against a software manufacturer? Of course not. But the owner of http://infinity.nus.sg/cypherpunks disagrees and since it's his website and he pays for it and compiles it... me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

Can we kill single DES? #2
by Peter Trei 17 Dec '03

17 Dec '03

Yesterday I posted 'Can we kill single DES?', and I count about 20 responses, counting both those to the list, and those to me personally. One offer was made of a $1000 reward in return for a crack, if the offerer could make publicity hay of the offer (no, I don't have a problem with that, but I'd like it set up so that others could add to the reward as well). If the reward got big enough ($10k?) I think it would be a major incentive for otherwise uninterested people to run the screen saver. On the other hand, it might get into legal hassles - I don't know. The total cpu power pledged at the moment could sweep the key space in 300-400 years, if my speed estimates are correct. I'm concerned that the key scheduling may be worse than I estimated in my earlier letter - Phil Karn's code to generate the key schedule takes about 150x as long as my code takes to test the key. However, neither he nor I have bothered yet to optimize this part of the code, or reduce it to assembler. It looks like I can get this part down to two instructions per round, at least most of the time. ----------- I'm really concerned about the problem of a search failing, or succeeding only after too long a time. Perry's proposal of about a month of real time is on the right order, though I could see up to 3 months being possible. Here's what I'm thinking of doing: 1. Writing a prose description of the platform independent speedups. 2. Writing a proposal for a client-server protocol for doling out keyspace and returning results. Aside from the direct Internet interface, there will also be a mechanism for i/o via plain text - suitable for cut-and-paste, or simple CLI interfaces. 3. Writing a generic 'C' implementation of the keysearch client and server, which demonstrates the i/o and the various speedups. This should be highly portable (but probably non-exportable). You'd also be able to search randomly, or from a designated starting point. 4. Work on the screen-saver based version of the client. I'm still very interested in hearing about any hardware based approaches actually underway - not a pile of wild-assed guesses and hopes. Those who want to look at a fast DES in assembler should check out Phil's 386 version, which includes both generic C and a variety of assembler implementations for the actual encryption step. See: ftp://idea.sec.dsi.unimi.it/pub/security/crypt/code/des386.zip Phil also has a Pentium version (a little slower than mine) which he mails to US citizens. Peter Trei trei(a)process.com

2 1

CDT Policy Post 2.35 - Latest Admin Crypto Policy Pushes KeyEscrow
by Bob Palacios 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 35 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 35 October 3, 1996 CONTENTS: (1) Latest Administration Crypto Policy Continues Push Towards Key Escrow (2) Analysis of the Administration's Next Step: Short-Term Export Relief to Compel Long-Term Key Escrow (3) How to Subscribe/Unsubscribe to the Policy Post list (4) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) LATEST ADMINISTRATION CRYPTO POLICY CONTINUES PUSH TOWARDS KEY ESCROW This week the Administration announced the latest in a series of encryption policies designed to promote the use of key escrow systems, both domestically and abroad. This latest initiative continues the drive towards a global guarantee of law enforcement access to all encrypted communications and stored data. CDT believes that such governmental access systems -- whether through "key escrow" or "key recovery" -- threaten the fundamental privacy rights of computer users, both domestically and abroad. The latest Administration proposal would promote key escrow by temporarily easing current export restrictions on moderately strong encryption products. The proposal would raise the current export limit from 40 bits to 56 bits for companies that agree to produce key escrow products. Companies would be required to report their progress every six months. After two years, all exportable encryption systems stronger than 40-bits would have to include key escrow. Encryption producers will be compelled to be part of this scheme in order to stay competitive, eventually producing and adopting key escrow systems which so far have been largely rejected by the public. An overview of the latest Administration policy, considered within the context of the government's relentless drive towards key escrow, is attached below. - THE UNSWERVING GOAL: GOVERNMENT ACCESS TO ALL COMMUNICATIONS AND STORED DATA The long-standing goal of every major encryption plan by the Administration has been to guarantee government access to all encrypted communications and stored data. In 1993, the Clipper Chip policy achieved access through keys held by the government. In 1995, the "Clipper II" proposal allowed export relief for commercial key escrow systems. This summer, "Clipper III" sought access to keys through the dual incentives of export controls and a new government "key management infrastructure." In each case, the ultimate goal has been a guarantee of government access to the plaintext of encrypted information. Law enforcement and national security interests have driven this process. The attempt to institutionalize key escrow worldwide is a fundamental threat to the privacy and security of Internet users both domestically and abroad. * GUARANTEED ACCESS TO INTERNET COMMUNICATIONS AND STORED DATA WOULD BE A DRAMATIC EXPANSION OF CURRENT LAW ENFORCEMENT CAPABILITIES. Guaranteed access to Internet communications and stored files is a far greater intrusion into the privacy of computer users than current wiretapping. As individuals conduct more aspects of their lives online, key escrow is tantamount to guaranteeing law enforcement access to all of our most intimate conversations, sensitive personal records, musings and thoughts in a way never available before. Within the United States, Congress and the courts have established a delicate balance in electronic surveillance between law enforcement and individual privacy rights. Key escrow destroys that balance, providing law enforcement with a comprehensive dossier of individual lives and activities. * GLOBAL KEY ESCROW ENDANGERS THE PRIVACY RIGHTS OF COMPUTER USERS COMMUNICATING IN COUNTRIES THAT HAVE NO FOURTH AMENDMENT OR OTHER PRIVACY PROTECTIONS. An international key escrow scheme will necessarily entail the escrow of key information in foreign countries, with access by foreign governments through much weaker privacy protections. Such global key escrow jeopardizes the privacy rights of any American who communicates or stores files abroad, where key information might be released with few privacy protections. Moreover, global key escrow endangers the privacy and free expression of computer users everywhere by establishing the global machinery for government surveillance without privacy protections. * THE CHOICE TO ACCEPT THE COSTS AND RISKS OF KEY ESCROW SHOULD BE MADE BY INDIVIDUAL USERS, NOT FORCED UPON THEM. Additional access points to encrypted data will create added vulnerabilities, new security problems, and additional costs. While some users may decide that the benefits of key escrow outweigh the costs, governments should not be imposing these costs and risks on users who do not want them. Individuals should be able to choose the type of encryption they want. The global adoption of government access systems has serious, negative consequences on the privacy of computer users. The recent Administration announcement is another step in that wrong direction. ----------------------------------------------------------------------- WHAT YOU CAN DO -- ADOPT YOUR LEGISLATOR As Members of Congress head home for the fall elections, they need to hear from Internet users about the importance of encryption policy reform for the future of the Net. Adopt your legislator -- tell them that the Administration's Key Escrow plan threatens the basic privacy rights of Internet users, and let us know what they say! Please take a moment to join the "Adopt Your Legislator" campaign. By taking a moment to sign up to contact your member of Congress, you can make a critical difference in the debate over privacy and security on the Internet. Details can be found at: http://www.crypto.com/ and http://www.cdt.org/crypto/ Tell them it's "My Lock, My Key!" (The Adopt Your Legislator Campaign is a joint effort organized by the Voters Telecommunications Watch (VTW), the Electronic Frontier Foundation (EFF) and the Center for Democracy and Technology (CDT)). ----------------------------------------------------------------------- (2) ANALYSIS OF THE ADMINISTRATION'S NEXT STEP: SHORT-TERM EXPORT RELIEF TO COMPEL LONG-TERM KEY ESCROW The latest Administration encryption policy, announced October 1, continues this trend towards governmental access to all encrypted information. Using a carrot-and-stick approach, the plan promises moderate, short-term export relief in return for the development and eventual adoption of key recovery systems. The Administration unveiled its encryption initiative at a White House briefing by CIA Director John Deutch, Domestic Policy Advisor to the Vice President Greg Simon, Undersecretary of Commerce William Reinsch, and high-level representatives of the Department of Justice and the Office of Management and Budget. The basic outlines of the proposal included below were culled from the Administration's statement and Tuesday's White House briefing. Major features of the new policy include: * ALLOWS EXPORT OF 56-BIT ENCRYPTION PRODUCTS FOR THE NEXT TWO YEARS, "contingent upon industry commitments to build and market future products that support key recovery." Six-month licenses for 56-bit exports would be granted and renewed for up to two years -- contingent on satisfactory progress towards key escrow. * REQUIRES KEY ESCROW CAPABILITIES AFTER TWO YEARS in all exportable products with more than 40 bits. * "ENCOURAGES" THE ADOPTION OF KEY ESCROW SYSTEMS through international agreements, standards processes, and a new key management infrastructure. * TRANSFERS JURISDICTION OVER ENCRYPTION EXPORT LICENSING TO THE DEPARTMENT OF COMMERCE, but grants the Department of Justice a formal vote in the process. The President is expected to sign an Executive Order enacting many of these changes in mid-October. Other pieces will be published as agency rules or regulations; a small part of the proposal (rules governing key holders) may require legislation. WHAT IT ALL MEANS FOR INTERNET USERS: In the short run, computer users may see more widespread availability of moderately stronger encryption products (up to 56-bit key length) if vendors choose to and are able to meet the "commitments" required under the proposal. In the longer term, however, even these moderately stronger products will only be exportable with key escrow. Ultimately, this proposal is designed to force the widespread adoption of key escrow systems, both domestically and abroad. A. EXPORT CONTROL RELIEF AS AN INCENTIVE FOR KEY ESCROW: The Administration proposal would allow for short-term export of 56-bit DES equivalent encryption products in return for commitments from exporters to develop "key recovery" systems. * Starting on Jan. 1, 1997, the Administration would begin granting six month general licenses for export of 56-bit encryption products. * Licenses would be granted "contingent on commitments from exporters to explicit benchmarks and milestones for developing and incorporating key recovery features into their products and services." * Additional six month licenses would be granted "if milestones are met." * In two years, "the export of 56-bit products that do not support key recovery will no longer be permitted." * Export of longer key lengths would continue for certain sensitive financial applications. * Export of longer key lengths may be allowed more generally once key escrow mechanisms are in place. Questions remain as to exactly what form the commitments from exporters will take, who will qualify for these relaxations, and what will happen at the end of two years to 56-bit non-escrow products in the marketplace and how they will be supported. No interoperability restrictions on products have been mentioned, and the Administration seemed to indicate that it would be willing to tolerate a greater degree of interoperability between products. WHAT EXPORT CONTROLS MEANS FOR INTERNET USERS: This Administration export control scheme coerces industry into developing key escrow systems, domestically and abroad, whether they want to or not. Since 1992, export controls have been the favorite vehicle for enforcing the adoption of such key escrow systems. The strong public desire for secure global communications has allowed government to use key escrow as a precondition for export relief. Export controls are a force for key escrow in the domestic market as well as the international market because of the need for secure international communications and the cost of producing product lines for U.S. use only. The Administration realizes this: as CIA Director Deutch stated at the White House press briefing, he was more concerned with encryption that people "buy at Sears" than about less popular strong encryption products that the Administration concedes will always be available. In addition to their impact on the market for key escrow, the proposal's export controls and key length limits themselves hurt user privacy and security. * Export controls don't make sense for a global Internet; they place business at a competitive disadvantage and prevent deployment of a secure global infrastructure. * 56-bits is not enough for many applications. CDT welcomes the Administration's recognition that 40-bit products are not strong enough, but last winter's study by a panel of encryption experts argued that DES keys can be cracked relatively quickly by well- financed groups, and that 70- to 90-bit keys are more appropriate. * Key length limits are a flawed approach because they presuppose that some entities should be able to break keys and some should not -- a solution that is unlikely to appeal to worldwide consumers of encryption. B. "KEY RECOVERY": Government access to the plaintext of encrypted data remains the centerpiece of the Administration proposal. Major features of the key escrow requirements in the latest proposal include: * Key escrow systems would rely on a trusted party to recover a user's confidentiality keys for use by law enforcement acting under "proper authority." * The trusted recovery party might in some cases be internal to the user's organization, but in all cases notice to surveillance targets that their key information had been released would be prohibited. * Access to keys internationally "would be provided in accordance with destination country policies and bilateral understandings." * The Administration will pursue legislation to govern the release of keys, provide criminal and civil penalties for unauthorized releases or theft of keys, and provide liability protection for key holders. * The Administration will continue to "encourage" the adoption of key escrow systems through it's broad efforts to promote international key escrow agreements, government key escrow purchasing standards, and the creation of a key management infrastructure. None of the officials at the White House briefing were able to give specific information about the requirements to be placed on key holders (e.g., response times, security clearances, etc.) The Administration did indicate a broader approach to allowing industry key escrow systems that more limited access to confidential information through, for example, recovery of specific plaintext or separation of key information. NOTE: KEY ESCROW V. KEY RECOVERY -- CDT recognizes that real progress has been made in the development of systems that provide access to the plaintext of encrypted data while minimizing the collection and disclosure of sensitive key information. However, from a privacy policy perspective these approaches have the same basic privacy problem: they are designed to provide law enforcement with guaranteed access to all encrypted information. WHAT "KEY RECOVERY" MEANS FOR INTERNET USERS: CDT recognizes that some companies and users may wish to use key escrow systems. The Administration's apparent recognition that these systems are best designed in the private sector is welcome. However, this policy's acknowledged desire to widely promote key escrow is dangerous and threatens the privacy of users: * Users are being pushed towards key escrow, whether they want it or not. The Administration is using the enormous pressure of export controls, competitive markets, and industry standards to force adoption of key escrow. Each user should be free to decide for themselves whether to accept the costs of key escrow. * International key escrow doesn't protect privacy in a world without a Fourth Amendment -- What legal standards apply to communications when keys are held in foreign countries? Officials have been unable to clearly explain how the privacy of computer users will be preserved. * Key escrow dramatically expands law enforcement capabilities -- Guaranteed access to encrypted information is a far greater intrusion into our lives than the delicate balance struck under U.S. privacy law. * Key escrow is unproven -- The NRC's recent study argued that a policy relying on key escrow is "not appropriate at this time" and "is likely to have a significant negative impact on the natural development of applications." * Key escrow creates new security vulnerabilities, such as the creation of large aggregations of sensitive key information, that are poorly understood. C. TRANSFER OF JURISDICTION TO THE COMMERCE DEPARTMENT: According to the White House, "after consultation with Congress, jurisdiction for commercial encryption controls will be transferred from the State Department to the Commerce Department." * Encryption licenses will be reviewed under the Commerce Department's "normal process" by a committee with representatives from the Departments of Commerce, State, Defense, Energy, and for encryption exports, Justice. * The Justice Department will have a single vote in the review committee, which will make its decisions by majority rule. * The State Department will only have jurisdiction over special, single customer, military-specific encryption products. WHAT TRANSFERRING JURISDICTION MEANS FOR INTERNET USERS: While the switch to Commerce has been perceived as helpful by some, CDT believes the benefits are unclear if fundamental policy remains unchanged. The switch to Commerce will have little impact on the underlying policy direction aimed at institutionalizing key escrow. Moreover, the Commerce Department's review committee is heavily weighted towards the law enforcement and national security perspective (State, Defense, Justice, and Energy), with the Commerce Department the lone representative of industry and consumer interests. Finally, the presence of domestic law enforcement in export control decisions raises serious questions about the ultimate goal of this policy. IV. CONCLUSION The Administration's latest encryption proposal remains wedded to a flawed, key escrow and export control oriented approach that does not address the privacy concerns of users. While it contains some welcome ideas, at its heart the Administration proposal uses the short-term easing of export controls to promote key escrow through a Faustian bargain with an industry desperate to produce strong security products. Such manipulation of the market for encryption products is designed to forward law enforcement's dangerous agenda of worldwide governmental access to all encrypted information. The march towards institutionalized key escrow is a real threat to the privacy of computer users, particularly in a world where not everyone has a Fourth Amendment. The United States should be a force for Internet privacy and security worldwide. Rather than forcing key escrow on a wary public, the Administration should look to work with Congress, privacy and Internet advocates, the user community, and industry to craft a truly voluntary policy that meets the privacy and security needs of computer users in the global Information Age. ----------------------------------------------------------------------- (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: http://www.cdt.org/ FTP ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.35 10/3/96 -----------------------------------------------------------------------

1 0

Re: Fighting Clipper III
by apteryx＠super.zippo.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- erm, a boycott means not _buying_ a product, as opposed to not _using_ a product. In the case of PGP, I never intended to purchase it from RSA. As for Netscape, there are other browsers out there (or so I heard). Realistically, a boycott is likely to be ineffective. Writing letters to companies and congresshmucks and working with non-US crypto companies to create a standard that can be legally imported into the US (for now) would be more effective, IMHO. Boycotts rely on large numbers of participants, and not enough people understand or care about encryption. We'd be better off trying to change that first. Mark On Thu, 3 Oct 1996 06:37:45 -0700 (PDT), Declan McCullagh <declan(a)eff.org> wrote: >You'll have trouble doing a successful boycott of RSA. What, you won't >use Netscape Navigator or PGP? > >-Declan > > >On Wed, 2 Oct 1996, Jim McCoy wrote: > >> Rich Burroughs <richieb(a)teleport.com> wrote: >> [...] >> >>>On Wed, 2 Oct 1996, John Young wrote: >> >>> >> >>>> The New York Times, October 2, 1996, pp. D1, D8. >> >>>> Executives of the International Business Machines >> >>>> Corporation said late yesterday that they were still lining >> >>>> up the final list of companies in the alliance. Those >> >>>> involved will include Digital Equipment and smaller >> >>>> data-security companies including RSA Data Security, Cylink >> >>>> and Trusted Information Systems. >> >>> >> >>>We are in deep trouble. >> >> >> >>Wouldn't a letter-writing campaign be in order here? >> >[snip] >> > >> >The word "boycott" leaped into my mind. I personally do not believe that I >> >will be buying products from any of these companies, as long as thay >> >participate in this GAK charade. >> >> Such an initiative will need publicity and letter-writing early in the >> campaign will help us set the tone and points of debate on this issue. >> A boycott works best when everyone knows why and there are a few key >> phrases which can be used to get the message across. Something like >> "company X is helping build big brother, boycott their products" or a >> few similar sound bites are needed fast. The big brother inside stickers >> from the last campaign were nice, maybe people can come up with variations >> of various corporate logos or marketting phrases which help get the message >> across? >> >> jim >> >> > > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com // > > > -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMlQmC936bir1/qfZAQF9dwL/fN1HZhHWbnOa6gZ71WMwf32nuOGS1CGm H2f9MlNvZhYF6TVAwCmfUG4hgeJQLkC97GrR/0hIfNYzir0Eb+qmF2Mptvl5tUiJ I89H2WRVl+BJBoqThGXJx8BqL6uVDX9H =sBVJ -----END PGP SIGNATURE----- Mark Heaney finger snipe(a)starburst.cbl.cees.edu for public key PGP Fingerprint= BB D8 9B 07 51 87 05 AC 47 7B F2 4F A6 AB 1A CD ----------------------------------------------------------------- Vote against government *** Vote Libertarian

2 1

Re: support for "crack DES"
by jim bell 17 Dec '03

17 Dec '03

At 01:26 PM 10/3/96 +0000, Omegaman wrote: >Considering the situation -- considering that RSA has even signed on >to this scheme -- I'd have to say that I don't give a rat's ass what >Bill Gates claims. If Micro$oft bucks the system, I'll gladly >applaud their stand. > >The situation is not good at all. > >Cracking DES (whether distributed or through a hardware crack, or >both!) seems critical at this point. Just remember that it would be far better to make the crack look easy, than to make it look hard. quantity 9000+, $1,000 Pentiums for a year (plus maybe $500,000 in electricity) looks "hard." 1000 dedicated chips (whether they be FPGA or custom or...) for 1.5 months or so looks "easy." The latter crack looks far more likely to be repeated. The former is OBVIOUSLY a stunt. Jim Bell jimbell(a)pacifier.com

2 1

Re: [FACTS] Mountain Meadows Massacre
by Deana Holmes 17 Dec '03

17 Dec '03

On 3 Oct 96 at 14:42, Dr.Dimitri Vulis KOTM wrote: > "Deana Holmes" <mirele(a)xmission.com> writes: > > <snip mor(m)on propaganda> > > > > <snip Dmitri Vulis nonsense> > > No wonder the criminal cult doesn't want its foul deeds subjected to > public scrutiny by "dead-agenting" its critics. Is Timmy May a > paid cult apologist? Sheesh. You know you're doing good when both Dmitri Vulis and Attila both badmouth you. (For the record, Attila's badmouthing consisted of stating via private email that I was "the same air head pseudo-intellectual who has poisoned her own life with hatred and ignorance in so many other venues.") Some people are just terribly threatened, I guess. Deana Deana M. Holmes April 1996 poster child for clueless $cientology litigiousness alt.religion.scientology archivist since 2/95 mirele(a)xmission.com

2 1

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 02:05 PM 10/3/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >Alas, a common fallacy. > >You have committed a prohibited export when the stuff lands outside the >USA....It's not illegal when it goes up ("by reason of the launching" and, >e.g. *stays up* in orbit) but it is illegal when it comes down abroad. Sure about that? The regulation said something like "launch vehicle" or "launch," apparently indicating that a "launch vehicle" could actually be exported, THEN launched, etc, without violating ITAR. And since the regulation does not go into any detail about the "launch", other than it is a "launch" (and does not explicitly prohibit landing subsequent to launch) the implication is that there is no prohibition. I still think the regulation was just written sloppily. Jim Bell jimbell(a)pacifier.com

2 1

Key recovery/RSA/Bidzos/WTF?!?
by Walt Armour 17 Dec '03

17 Dec '03

What's up with some of these press releases? Can anyone clear up the confusion with RSA/Bidzos/Key recovery? Here are some quotes: ================= >From NYT:CyberTimes (2 Oct) "Clinton Encryption Plan Is Generating Resistance" Executives of the International Business Machines Corp. said late Tuesday that they were still lining up the final list of companies in the alliance. Those involved will include Digital Equipment and smaller data-security companies including RSA Data, Cylink and Trusted Information Systems. ================= >From NYT:CyberTimes (2 Oct) "Clinton Encryption Plan Is Generating Resistance" "The government announcement is disastrous," said Jim Bidzos, chief executive of RSA Data Security, one of the country's leading developers of data-scrambling software. "We warned IBM that the National Security Agency would try to twist their technology." ================= >From BusinessWire (2 Oct) "JOINT PRESS ANNOUNCEMENT/ HIGH-TECH LEADERS JOIN FORCES TO ENABLE INTERNATIONAL STRONG ENCRYPTION" "Export controls are a fact of life," said Jim Bidzos, president of RSA Data Security. "The key recovery alliance's approach will allow companies to use cryptography with differing levels of security in an interoperable way. When the alliance implements this technology it will give the user a new level of flexibility that did not exist before. In an imperfect world this technique will at least allow you to take advantage of what governments around the world will allow." ================= So is RSA part of this or not? Is the middle quote above mis-attributed? walt

2 1

Margaret Milner Richardson loses her breakfast...
by Robert Hettinga 17 Dec '03

17 Dec '03

>From the Wall Street Journal Wednesday October 2, Page 1: Use of the internet to attract tax-dodgers rings alarm bells at the IRS. The rapidly expanding new worlds of the internet and electronic money are stirring deep concern at the IRS. "We know that some foriegn banks are now using the internet to solicit new customers with promises of complete anonymity and a haven from all taxes," IRS commissioner Margaret Milner Richardson said. She said this issue is being "carefully monitored" by tax administrators around the world. Ms. Richardson, in a recent speech, cited a world-wide-web advertisement offering a "one-of-a-kind book" covering topics such as, "Banking in Silence" and offering information on setting up an offshore trust that "could include protection from a large IRS assessment." Ms. Richardson's reaction: "I almost take that personally." Another ad touts "excellent interest rates, offered in a stable, tax-free environment...Clients communicate with the bank any time from anywhere via the internet." Ms. Richardson said: "How would you like to be responsible for administering tax laws and have to read these ads over breakfast?" Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

4 4

Re: ITAR satellite provision
by Greg Broiles 17 Dec '03

17 Dec '03

On Thu, 3 Oct 1996, jim bell wrote: > The wording was > clearly intended to be an exception to a rule. What the wording doesn't > include is the "exception to the exception," most likely because they > weren't thinking in too great a detail when they wrote the regulations. Yow. The "if we put it in a rocket it's exportable" interpretation made me think twice before posting the text of that definition, because it's seductive and wrong. I posted it because it's amusing to think about and because we all had a good laugh about it at the Mac crypto conference; but I'd feel like a jerk if someone got themselves in a lot of trouble with an enthusiastic misreading of that sentence out of pages and pages of regulations (plus quite a few more pages of opinions interpreting those regulations). > It appears that the government left a loophole so large that you could > drive a truck...er...shoot a rocket through it. If you think you've found an enormous loophole in a regulation which has been around for 15-20 years, you should double-check your research and get a good nights' sleep. Law is like science this way - if you think you have found room-temperature fusion you should stop and check your work. It's much more likely that you're not reading carefully or you've missed something. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0