December 2003 - cypherpunks-legacy

Intel RICO Billed
by John Young 17 Dec '03

17 Dec '03

The Washington Post, October 12, 1996, p. A6. Clinton Approves Intelligence Spending Rise Bill Is Also Signed to Make Theft of Trade Secrets a Federal Crime President Clinton signed a bill yesterday that boosts intelligence agency spending and another that makes theft of trade secrets a federal crime. Clinton said he signed the 1997 Intelligence Authorization Act despite objections to three provisions, including one that establishes three new assistant directors of central intelligence under CIA Director John M. Deutch. Although the nation's intelligence budget is an official secret, it is reported to total about $30 billion for the 1997 fiscal year, up 4.9 percent from 1996. In a statement, Clinton said he would support Deutch in asking the next Congress to repeal the provision that created assistant directors for intelligence collection, analysis and administration. "I share his concern that these provisions will add another layer of positions requiring Senate confirmation" without a corresponding increase in the CIA director's authority to manage the intelligence agencies, Clinton said. The bill: + Gives the FBI power to subpoena local telephone records. + Authorizes the CIA and the National Security Agency to collect data on foreign citizens abroad for U.S. investigations. + Requires Senate confirmation of the CIA's general counsel. That is meant to prevent political influence over a position designed to block illegal covert operations. + Prohibits federal employment of senior intelligence officials for three years after their departure from government. It also prohibits the CIA from using American journalists as spies. But the restriction could be waived in extraordinary circumstances and the CIA still could have its agents pose as journalists. The bill would not prohibit journalists who choose to provide information from doing so. Clinton also signed into law the Economic Espionage Act of 1996, saying it strengthens protections against theft or misuse of proprietary business information. "It will help us crack down on acts like software piracy and copyright infringement that cost American businesses billions of dollars in lost revenues," he said. The law makes the theft of trade secrets a federal crime and provides financial penalties and prison sentences for specific acts of economic espionage. It also preserves the confidentiality of trade secrets in court proceedings. Clinton said the measure also eliminates gaps in the criminal laws that cover attacks against computers and the information they contain. [End]

1 0

SPA Press Release on ISP suits
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Fri, 11 Oct 1996 12:36:55 -0400 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Michael Dodson <dodsonm(a)WANE-LEON-MAIL.SCRI.FSU.EDU> Subject: SPA Press Release on ISP suits To: CYBERIA-L(a)LISTSERV.AOL.COM The formatting may be a bit rough. I am not a pro at this. FOR IMMEDIATE RELEASE ((edited)) Contact: David Phelps, (202) 452-1600, ext. 320, dphelps(a)spa.org SPA Files Copyright Suits Against ISPs and End Users Internet Anti-Piracy Campaign Launched (Oct.10, 1996 --Washington, D.C.) -- The Software Publishers Association (SPA) announced today that it has filed five civil lawsuits for copyright infringement occurring on the Internet. Three of the lawsuits were filed against Internet service providers (ISPs), and the remaining two were filed against individual end users. Additionally, SPA launched its Internet Anti-Piracy Campaign, which includes education and enforcement components, in an effort to educate and work cooperatively with ISPs regarding copyright infringement. ISP lawsuits were filed on Oct. 7 and 8 against Community ConneXion of Oakland, Calif.; GeoCities of Beverly Hills, Calif.; and Tripod Inc. of Williamstown, Mass. The SPA members named as plaintiffs in all three suits were Adobe Systems Inc., Claris Corp. and Traveling Software Inc. In each case, SPA first contacted the ISP and requested that the infringing material be removed, but the ISP failed to respond and cooperate. SPA also filed suit against Jeffrey Workman of Auburn, W. V., and Patricia Kropff of Scottsdale, Pa, on behalf of Adobe Systems Inc., Claris Corp., Corel Corp., Datastorm Technologies Inc. and Novell, Inc. In each of these instances, SPA received reports of alleged copyright infringement on certain Web sites, and with the assistance of the ISPs, tracked the individuals responsible for posting the infringing material. "These lawsuits send a clear signal to ISPs and end users that neither direct nor contributory copyright infringement will be tolerated. The Internet does not provide a safe haven for these types of activities," said Ken Wasch, SPA president. SPA's Internet Anti-Piracy Campaign (IAPC), which is outlined at http://www.spa.org/piracy/iapc.htm, contains information explaining why ISPs may be liable for copyright infringement, the risks involved and seven warning signs that infringing activity may be taking place on the ISP's server. Additionally, ISPs may sign an ISP Code of Conduct to show they have adopted the operating practices encouraged under the copyright law. Upon receiving a report of alleged copyright infringement on the Internet, SPA confirms the unlawful activity and sends a letter to the ISP servicing the infringing user. In most cases, the ISP cooperates and remedies the situation. If the infringing user can be identified -- as alleged in the Workman and Kropff cases -- SPA may then choose to seek action against the end user. If the ISP is unwilling to stop the unlawful activity, SPA may choose to file suit against the ISP. "Our intentions are to work cooperatively with ISPs. A key element of the IAPC is the ISP Education Program devoted to alerting ISPs to their potential liability and providing them with the tools and guidance to protect themselves," said Joshua Bauchner, SPA's Litigation Coordinator. "The IAPC maintains SPA's traditional balance between education and enforcement. We first make contact in an effort to amicably resolve the matter, and only when absolutely necessary do we turn to litigation." An integral part of the cooperative effort between SPA and ISPs is the ISP Code of Conduct. This simple agreement asks that ISPs protect themselves from liability by stopping pirate activity on their systems. In return, SPA will attempt to contact the ISP if it receives a piracy report concerning it -- before initiating other action. ((end of edited release)) See http://www.computerworld.com/news/news_articles/961010spa.html for early reactions. Michael Dodson dodsonm(a)wane-leon-mail.scri.fsu.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

3 2

Prove it in Court First
by Duncan Frissell 17 Dec '03

17 Dec '03

>From the Software Publisher's Association Code of Conduct for ISPs: "It is also a violation of the copyright owners rights for an ISP to post, or to allow others to use its server(s) to post, materials, like serial numbers or cracker utilities, that make it possible for others to execute and use pirated software. Such acts, which either induce or materially contribute to copyright infringement by someone else, constitute contributory infringement, and expose ISPs to the same liability for damages, penalties and injunctive relief as a direct infringer." Here is how you violate the copyright of the book "Unix for Dummies" : 1) Get copy of book 2) Go to copy machine 3) Copy the book I hereby demand that you copraphageous cretins sue me immediately for providing this information. DCF

3 2

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Jim Bell <jimbell(a)pacifier.com> writes: >> At 08:49 AM 10/11/96 +0100, Adam Back wrote: >> > [...]. Microsoft's CAPI arrangement is that they will not >> > sign non-US CAPI compliant crypto modules (Examples of enforcement of >> > no-hooks interpretation). >> >> Does that fix the "export only the signature" problem (for the >> government)/opportunity (for the rest of us)? You know, present Microsoft >> with the software, don't tell them it's already out of the US, and they sign >> it. Export the signature only (who cares if this is legal!) and edit the >> international software to contain the signature. > >Export the lot, signature included :-) > >(I doubt exporting only the signature once the story came out would >offer you any more protection legally than exporting the software). > >As you say who cares if it's illegal: things get exported all the >time. > >The problem however, is finding a non-US site to hold the hot potato >once it has been exported. For example 128 bit Netscape beta was >exported a while ago. I don't see it on any non-US sites. This is >due to Netscape's licensing requirements, you need a license to be a >netscape distribution site, the license doesn't include the right to >mirror non-exportable versions on non-US sites. > That's one good application for remailers, and .warez newsgroups. at. >If the exported software is `PGP3.0 for CAPI' or whatever, I think it >should be fair to conclude it will be cheerfully mirrored by all, and >Phil Zimmermann won't be complaining. (PGPfone is on ftp.ox.ac.uk, >plus other places, for example.) So yes, I agree, for software with >appropriate distribution licenses. > >Another approach, which has been discussed lately is the use of a >patch to usurp Microsoft as the signatory for CAPI modules. I wonder >what Microsoft would say about an unauthorised patch, to fix an ITAR >induced `bug' in windows. Bill Gates doesn't sound pro-GAK. If they >aren't going to complain, perhaps such patches could be distributed >widely outside the US also. > >The new owner of the CAPI signatory key would need a good reputation, >and presumably a policy of signing any (non-GAKked) CAPI modules >signed by microsoft, and anything else that anyone wants signed. > An excellent suggestion.

6 6

Re: Binding cryptography - a fraud-detectible alternative to key-esc
by Bill Stewart 17 Dec '03

17 Dec '03

I haven't seen the technical papers behind the postings you've made to the net, but the overall approach sounds very similar to "Clipper II", the Software Key Encryption work that the TIS people (Steve Walker?) and Dorothy Denning were touting a year or so ago. It wasn't in your references, and it's clearly close enough to be worth your attention. The design was interesting - it chose a set of public and symmetric key encryption that allows the recipient to validate the sessionkey-encrypted-to-key-copy-holder*. A not-highly-technical description of the TIS CKE Commercial Key Escrow system is at http://www.tis.com/docs/products/cke/present.html, particularly present9b.html. It's worth reading for the appalling graphics alone :-) I don't seem to have a copy of the technical description anywhere. <IMG href="http://www.tis.com/docs/products/cke/pres7a.gif"> A major capability that was missing from Walker's SKE work is the ability to split the copied* key into two or more parts, all of which are need to recover the session key, while making it possible to validate that the pieces do add up to the session key. (This was also missing from the Clipper chip in hardware, which pretended to do it in the master key setting process.) Can you extend the approaches you're using to allow an outside party, or at least the recipient, to validate that the two parts of the copied key contain the complete session key? [* I'm using the terms "copied key" and "Key copy holder" to refer to the copy of the key that you're giving to some third party and the third party. The term "escrow" is generally not applicable to the applications that transmit a copy of the key to some third party, and the technologies involved don't specify, communicate, or enforce conditions for access. TIS's CKE does at least cart around a 32-bit user-defined string for specifying recovery conditions, but there's not technical enforcement. ] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

[NOISE] About piracy & key recovery / hacked pages & Clinton-Gore
by scrappo.reverb＠juno.com 17 Dec '03

17 Dec '03

Hmmm... let's see... At about the same time I see people talking about major software/hardware companies going into the key recovery biz and piracy sites _not_ getting taken off of servers (SPA). Piracy. Software companies. Don't they have a common bond somewhere? Wouldn't it be ironic if a rash of piracy occurred with said companies products being pirated? I also noticed two other parallels: Hacked web pages and (although not here) the Clinton/Gore re-election. Hmm... Didn't somebody say something about the real Dole page getting a lot of hits? Maybe the Clinton page gets a lot of hits too. Wouldn't that be a hoot if somebody hacked their page and changed it to something more meaningful, say, how they are pushing the terribly dangerous key-recovery project. Even a subtle hack, such as putting a link to national and international sites carrying PGP, would have an effect. In the true spirit of the subject, I am not responsible. err... I am not responsible if this happens. Food for thought/no need to reply.

1 0

Re: Production of ALPHACIPHER Snake Oil Cancelled!
by ! Drive 17 Dec '03

17 Dec '03

: From: Timothy C. May <tcmay(a)got.net> : At 9:11 PM -0700 10/17/96, ! Drive wrote: : >This may have already been posted, but I found it interesting... : > : >from: http://www.aa.net/cyber-survival-hq/ : > : > Development of the ALPHACIPHER product line has been voluntarily : >cancelled : >due to the possibility of : > non-compliance of users of ALPHACIPHER with the new key : >escrow : >law. : : : And just which _law_ might that be? Care to name an Act? Or even a Bill? I don't know, I'm only affiliated by the ISP, goto the page and find a mailto link and ask the owner. : : Come to think of it, just what the hell is "Alphacipher," and why should we : care? : : : > ALPHACIPHER currently has no built-in key generation function, and the : >proposed release of an : > ALPHACIPHER key generator has been terminated. All purchasers of ALPHACIPHER : >are entitled to a complete : > refund, and this has already been done. : : Were there any actual purchasers? : : > The New ADFGVX cipher is still offered for sale, as it is a breakable : >cipher, at least in theory. Why would one want to purchase something advertised as breakable? 'course advertising that its not breakable would would keep me away also. : : Ah, yes, now I understand. Sounds like just a new marketing ploy for the : same old snake oil. : : --Tim May

1 0

Re: More threats from FOTM (Friends of Timmy May)
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 15 Oct 1996 21:54:20 -0700 (PDT), Sandy Sandfort wrote: >Does anyone remember the Russian word for "uncultured"? It was >in one or two of Tom Clancy's books. nekulturny? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Microsoft Millionaires and Billionaires
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Wed, 16 Oct 1996 07:54:06 -0700 (PDT), Brad Shantz wrote: >You obviously don't know as many developers at Microsoft as I do. They >treat alot of their developers like farm animals. I just had an interview >at Microsoft last week. Very few if any of the people I met with were >millionaires. I've heard a lot of people say that the 5+ year Microsquishies are leaving in droves because 'it's not a fun place to work anymore'. The pain of success, I guess. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

RE: Binding cryptography - a fraud-detectible alternative to ke
by everheul＠mail.rijnhaave.nl 17 Dec '03

17 Dec '03

Bill Stewart[SMTP:stewarts@ix.netcom.com] wrote: >I haven't seen the technical papers behind the postings you've made Our original is on: http://cwis.kub.nl/~frw/people/koops/binding.htm At the end of that (also available as http://cwis.kub.nl/~frw/people/koops/bindtech.htm) there is a technical description of one implementation of Binding Cryptography. >to the net, but the overall approach sounds very similar to "Clipper >II", the Software Key Encryption work that the TIS people (Steve >Walker?) and Dorothy Denning were touting a year or so ago. It >wasn't in your references, and it's clearly close enough to be worth >your attention. The design was interesting - it chose a set of >public and symmetric key encryption that allows the recipient to >validate the sessionkey-encrypted-to-key-copy-holder*. They are mentioned in the final paper. /* I will only go into the technique now, not the politics */ In fact our technique is inspired on that technique (that is being used by several other as well). In this technique users' encrypted messages basically consist of three components: 1. the (actual) message encrypted with any symmetric system, using a random session key; 2. the session key encrypted with the public key(s) of the addressee(s); 3. the session key encrypted with the public key of a Trusted Retrieval Party (TRP). With the TIS scheme a TRP is called Key Escrow Agency (KEA), but that is just a name. When a law-enforcement agency is conducting a lawful intercept and strikes upon an enciphered message, they take the third information component to the TRP. If shown an appropriate warrant, the TRP decrypts the information component and hands over the session key, so that the law-enforcement agency has access to the message. The TIS commerical Key Escrow (CKE) leaves it at that. So unilateral (i.e without help of the recipient) fraud is easily possible; just send another (or none) session key in the thrid component. Nobody is going to know; the three packets look OK. Only when there is a law-enforcement agency is conducting a lawful intercept then they will know fraude is committed. (BTW "fraude" means using something (voluntarily) without complying with the *AGREED* rules. Hence fraude in voluntary systems is possible. PLEASE PLEASE PLEASE let us not have that discussion again!). Not willing to jeopardize the investigation, the LEA is then probably not going to do much about it. In the "TIS software key escrow paralleling Clipper" this unilateral fraude has been made impossible: as the recipient knows the session key (from decrypting the second component), he is capabel to recalculate the third session key and compare it with it the actual sent to him. Of course this comparison is incorperated in the software of the recipient; if the comparison fails then the decryption of the first component will not take place (in France your monitor might explode (-;) Although preventing unilateral fraude, this does not prevent colluding of frauders. Indeed, by a conceptually simple manipulation in the decryption software the outcome of the comparison can be made "positive" all the time. So in this fashion, without anybody knowing (seeing) about it colluding people will use the security benefits of the system, but not it "law enforcement" disadvantages. We liked the general techinque as it is rather liberal and internationally useable (you don't have to escrow any secret keys, the choice of TRPs is very flexible), but we did not like the colluding property. The idea in our scheme is that the colluding fraude is still possible, but must be at least *detectable* by third parties that have access to all data anyway (network operators, internet service providers). Moreover, for this detection no secret information is needed (or gained), so user' privacy is not jeopardized by it. With respect to this; I was surprised to read in the papers that Bangemann (European Commision) proposed to make Internet Service Provides responsible for checking the authenticity of certain types of sent data. In resume: we believe that our scheme is the middle of key-escrow (Clipper III) and the TIS scheme and is flexible enough to form a worldwide security infrastructure, where each participating country can implement its *own* crypto policy with. In particular, if, how (random, offline?) and by who checking is done is a matter for each country to decide on his own. Also the organization of TRPs is a matter of each country of its own. > A major capability that was missing from Walker's SKE work is the > ability to split the copied* key into two or more parts, all of > which are need to recover the session key, while making it possible > to validate that the pieces do add up to the session key. Splitting the session-key in binding data can be done by the sender (sending all shares to different TRPs); this can be checked by anyone. More importantly, in our ElGamal implementation of binding cryptography the splitting of the secret keys of TRP can be done in a very elegant way, that seems to be put there for (controlled) LEA-use. We will put that in the technical paper as well. Best regards, Eric

1 0