December 2003 - cypherpunks-legacy

U.S. CIA employee caught spying
by Tim Scanlon 17 Dec '03

17 Dec '03

This is on the local DC news; Harold Nicholson age 46, a CIA employee was arrested for spying today at Dulles airport. He allegedly has been working for the Russians for the past 2 years. He was caught after he failed a series of polys, and bank account irregularities had been noticed, as well as suspcious travel. They got him on hidden video apperently photocopying documents that he intended to pass along. Tim

1 0

Cpunks Frog Forwards discontinuation
by Damaged Justice 17 Dec '03

17 Dec '03

I will be discontinuing my "Cpunks Frog Forwards" filtering service within one week of the announcement of Perry Metzger's new crypto list, and possibly sooner if my patience runs out, because 1) I have too many other things to take care of in my life, 2) there really isn't as great a need for it anymore due to the number and variety of other filtering services, and 3) my sanity is being stretched to its limits having to wade through the mountains of bullshit that now infest my inbox, even with procmail's kindly assistance. Perry was right: Cypherpunks has become a sewer. As Robert Anton Wilson said, "Only a sewer accepts everything." Here is a list of the other filtering services I am currently aware of: o Alan Clegg runs an UNMODERATED cypherpunks digest, which only reduces the the volume of separate messages. Subscribe by mailing to majordomo(a)gateway.com (Standard majordomo list -- send "help" in the body for information.) o Eric Blossom runs a commercial "Cypherpunks Lite" for a modest fee, approximately 20.00US/year. Mail eb(a)comsec.com for more info. For a sample, read the archive at ftp://ftp.crl.com/users/co/comsec/cp-lite o Ray Arachelian runs a free filtering service, sticking mostly to news and technical stuff with a few other tidbits thrown in. Mail sunder(a)dorsai.dorsai.org for more info, or to be added. See you all on the other side. "Cypherpunks write code." -- I let go of the law, and people become honest / I let go of economics, and people become prosperous / I let go of religion, and people become serene / I let go of all desire for the common good, and the good becomes common as grass. .oOo. [Tao Te Ching, Chapter 57, Stephen Mitchell translation]

3 3

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 8:38 PM 11/17/1996, Huge Cajones Remailer wrote: >Before we complete your school assignment for you how about letting us >all know the due date and the credit value first. > >On Sat, 16 Nov 1996, Huge Cajones Remailer wrote: > >> Privacy is a hassle. Is it worth it? >> >> Which unfortunate situations does privacy prevent? What are the odds >> that they will occur? How much effort will it take to prevent these >> outcomes? As a model, use the present and future situation of a >> typical reader of this list. Insult is not enlightening. URL? Book?

1 0

Re: [NOISE] aga isn't on cypherpunks... (and I'm glad)
by Sven 17 Dec '03

17 Dec '03

>> I have a suggestion... How 'bout if everybody on this list dropped >> a procmail configuration that mailed aga(a)dhp.com and postmaster(a)dhp.com >> a copy of every message that originated from aga(a)dhp.com? Do you think >> he would start to "get it" then? Why are these people so uptight? Sven MOSER016.JPG |__ |--> SVEN: a.k.a. Chris Blanc Internet consulting/Web design [ http://www.loop.com/~sven/ ] Some only sample the dark wine of life's blood...

4 3

Re: Warfield's audience is terminated
by Sven 17 Dec '03

17 Dec '03

>I have been advised by my associates that you are a waste of my time. >My audience for your comments is therefore terminated. Right on -- that guy came across as a masturbator with the "I'm my own p0stmastur!1!!1" response and it's probably more effective for both of you to work separately. Fuck flames, Feed trolls. Sven |__ |--> SVEN: a.k.a. Chris Blanc Internet consulting/Web design [ http://www.loop.com/~sven/ ] Some only sample the dark wine of life's blood...

1 0

Re: The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 6:55 AM 11/18/1996, Sandy Sandfort wrote: >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >C'punks, > >On Sun, 17 Nov 1996, Huge Cajones Remailer wrote: > >> >> Informally, I don't know anybody who has suffered due to a loss of >> >> privacy. >> > >> >Your circle of associations must be limited. >> >> Examples [of people who have suffered due to loss of privacy]? > >Phil Zimmermann often tells the story of a woman whose marriage >was destroyed by the revelation of a long-past indiscretion. >After her husband divorced her, she committed suicide. Deceiving your spouse is not a good reason to protect your privacy. >Any number of celebrities have been stalked, attacked and even >killed by obsessed fans who found them through public records. Unfortunately most readers of this list do not have this problem. >Every year, children and business executives are kidnapped for >ransom. The proximate cause of these kidnappings is a breach in >privacy about the whereabouts and schedules of the victim. Or this problem. >Hitler's gun registration in Germany allowed the Jews to be >disarmed. I'm sure you are aware of the ultimate consequences >of that little invasion of privacy. Not a bad example, but genocide happens rarely. Those alert enough to protect their privacy in advance might be alert enough to get out in time, anyway. Subjective utility: low. >The US Post Office co-operated in the identification and >imprisonment of people of Japanese ancestry during the second >world war. 97,000 victims over a ~100 year period. Doesn't really show up on the scope, sorry. (Plus downside bad, but few were murdered.) >The problem with having a whole lot of private information about >you floating around in public is not what damage it can do to you >now, but rather the problems it potentially could cause in the >future. Just about everyone on this list has been to university. >Not long ago, a college education was essentially a death warrant >in Cambodia. Prior to that, a degree was considered a good thing >there. People saw no reason to hid the fact that they had been >in school. Trouble is, things changed. > >And the trouble today is that things can change now, too. Think >about the things that you have publicly done or advocated. Even >if they are as legal as church on Sunday NOW, how comfortable >will you be about them if there is extreme right or left takeover >in the future? Start to get the picture? These things CAN happen. Will they happen? Odds are low. BTW, are you operating under your True Name?

4 3

Re: The Utility of Privacy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:57 AM 11/18/96 -0800, Huge Cajones Remailer wrote: > >At 8:38 PM 11/17/1996, Huge Cajones Remailer wrote: >>> Privacy is a hassle. Is it worth it? >>> >>> Which unfortunate situations does privacy prevent? What are the odds >>> that they will occur? How much effort will it take to prevent these >>> outcomes? As a model, use the present and future situation of a >>> typical reader of this list. Risks of not employing privacy techniques: 1) You might have to pay 30%+ of your income in taxes. 2) Your driver's license might be capable of being suspended. 3) Your children will be more likely to be grabbed by Child Protective Services. 4) You are *much* more likely to come to the attention of the authorities. 5) Your usenet posts on gun control may be reported to the local sheriff's office and an armed agent of the state may call you. 6) You may be dunned by debt collectors. 7) Your property will be at greater risk of forfeiture to the government or loss to private litigation. 8) You may have to pay thousands of dollars a year in auto insurance. 9) You are more likely to lose a job because of something your employer finds out about you. 10) If you live in a "non-attainment area" your older car may fail emissions inspection. That's all for now. I've got a million of them. DCF

1 0

Re: The Utility of Privacy
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 11:13 PM 11/17/1996, Huge Cajones Remailer wrote: > Examples? How about the draft? The privacy protected child has options the others do not. Legal risk okay - beats getting shot. diGriz

2 1

Re: HP announcing some International Cryptography stuff on Monday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:49 PM 11/15/96 -0800, Timothy C. May wrote: >It sounds ominous to me. Another backroom deal, probably for some form of >key recovery strategy, aka GAK. I'd bet GAK too. RSADSI has been working on GAK protocols, so these ones might actually work. I feel as pessimistic about this one as Lucky usually is. At 12:05 PM 11/15/96 -0800, John Gilmore wrote: >Are they the next Big Company to knuckle under to the Feds? Their >pcmcia-with-local-country-surveillance-chip-socket initiative never >seemed to go anywhere. Since I am inherently optimistic, one ray of light may be that the San Jose Mercury News was mentioning the ability to export the system, and then when the necessary licenses (US and foreign) were obtained, turn on the encryption. I guess from this that the encryption is in hardware. Now, software/hardware interfaces are usually fairly simple, so what we have here is a software system with a crypto hook. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

6 5

CDT Policy Post 2.38 - President Takes First Steps TowardsClipper 3.1.1
by Bob Palacios 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 38 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 38 November 18, 1996 CONTENTS: (1) President Takes First Steps Towards Clipper 3.1.1 (2) Details of the Executive Order (3) How to Subscribe/Unsubscribe (4) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) PRESIDENT TAKES FIRST STEPS TOWARDS CLIPPER 3.1.1 In a move that leaves major unanswered questions about the privacy of global communications on the Internet, President Clinton has taken the first concrete steps towards implementing the government's controversial key recovery encryption proposal. On Friday November 15, the President appointed an ambassador-level "Special Envoy for Cryptography" and signed an Executive Order that gives the Commerce Department jurisdiction over encryption exports but includes the Justice Department in all such export decisions. These developments do little to change the underlying regulations on encryption that have prevented the development of a strong worldwide encryption standard needed to protect privacy and security on the Internet. The full text of the executive order and other relevant background materials are available on CDT's Encryption Policy Page: http://www.cdt.org/crypto/ Friday's White House announcements demonstrate the Administration's commitment to its dangerous key recovery approach to worldwide encryption. This approach fails to meet the fundamental privacy needs of computer users and industry because: * International communications are still vulnerable since products sold by the dominant U.S. hardware and software manufacturers must conform to U.S. export controls. * Key recovery won't protect privacy internationally and institutionalizes a global government surveillance mechanism without privacy safeguards. * U.S. exports are still controlled and uncompetitive making it harder for the market to develop a secure global encryption standard. The Administration policy, initially announced on October 1st and dubbed "Clipper 3.1.1," leaves Internet users without the technical means to secure their communications or the international legal standards needed to protect their privacy. In other developments this week, Hewlett-Packard and other companies announced preliminary approval to export new "dormant encryption" products, which contain strong encryption that can only be activated with a special license. While this new architecture is expected to make it easier for industry to market encryption products, this technology does not change the underlying privacy problems created by the Administration's export control policy. Granting of licenses to use strong encryption will still be subject to the current export controls limiting key length and requiring key recovery for strong encryption. CONTINUING A DANGEROUS KEY RECOVERY POLICY The Administration's announcements mark the first real steps towards implementing an approach to encryption policy based on the dangerous and untested idea of global key recovery. This approach would institutionalize worldwide governmental access to encrypted communications without providing any privacy standards for electronic communications or stored data. The Administration's approach leaves computer users at risk operating on a global network without the technical security provided by strong encryption or the legal privacy rights afforded here in the United States by the Fourth Amendment and federal law. For example, the Administration policy would not solve the following privacy problems: * International communications are still vulnerable. For example, an American individual doing business with someone in France would still be forced to use weaker forms of encryption, or use key recovery systems that make their communications accessible to law enforcement officials of both countries. * Key recovery won't protect privacy internationally. A Chinese dissident communicating with supporters in the U.S. and fearful of weaker encryption would be to forced to use key recovery. The Administration indicates that such key recovery mechanisms would be based on bilateral key-access arrangements between governments. Even if the dissident's keys were recoverable only in the U.S., such a global key access policy would almost certainly make those keys accessible to the Chinese government. If the United States expects China to assist U.S. law enforcement with key recovery for issues of national interest, such as anti-piracy efforts in China, we can also expect China to require U.S. disclosure of keys to its law enforcement community. * Exports are still controlled and uncompetitive. A Japanese company using exportable U.S. encryption products would be forced to use lower strength encryption -- or use an key recovery agent approved by the U.S. law enforcement community. This is unlikely to help the global market develop a worldwide standard for secure communications. As a result of this policy, computer users all over the world will be left with a lowest common denominator infrastructure that does not provide for either technical security or legal privacy for sensitive communications and data. CDT believes that any workable U.S. encryption policy must be designed to protect the privacy and security of Internet users. ------------------------------------------------------------------------ (2) DETAILS OF THE EXECUTIVE ORDER The Executive Order signed by the President on Friday does not change the type of encryption products that will be exportable. Rather, it lays the groundwork for the eventual transfer of encryption export control jurisdiction from the State Department to the Commerce Department pending Final Regulations by both departments. Encryption exports have traditionally been regulated as "munitions" controlled by the State Department. While the Commerce Department is widely viewed as more sensitive to the needs of business and individual encryption users, Commerce is still constrained by Administration encryption policy. Additional provisions of the Executive Order indicate that the Commerce Department's encryption controls will continue to be dominated by law enforcement and national security interests: * New Justice Department role in export review committee -- In an unusual step, the Order adds the Justice Department to the interagency group reviewing Commerce encryption export decisions. * Source code treated as a "product" -- The Order specifically singles out encryption source code to be given the stricter review scrutiny of a "product" rather than a "technology." * Broad definition of export -- The export of encryption source code or object code is extended to explicitly include posting to FTP sites or electronic bulletin boards unless "adequate" precautions are taken to prevent transfer abroad. As reflected by a recent Federal Court finding in the CDA indecency case that Internet users rarely have control over the parties accessing materials via FTP, Usenet, or the Web, this provision could have the chilling effect of preventing most dissemination or discussion of new cryptographic tools on the Internet. The Administration's announcements will have little effect on the existing encryption privacy problem unless the underlying policies governing the export and use of encryption are changed. These announcements do little to address the unanswered questions about how privacy will be protected in the key recovery system envisioned by the Administration. APPOINTMENT OF THE "SPECIAL ENVOY FOR CRYPTOGRAPHY" On Friday the President also designated Ambassador David L. Aaron as the new "Special Envoy for Cryptography." According to the White House, this Special Envoy will have "responsibility to promote the growth of electronic commerce and robust, secure global communications in a manner that protects the public safety and national security. . . . Ambassador Aaron will promote international cooperation, coordinate U.S. contacts with foreign governments on encryption matters and provide a focal point for identifying and resolving bilateral and multilateral encryption issues." Ambassador Aaron is currently the U.S. Ambassador to the OECD. CDT hopes that the new Special Envoy, as a representative of the United States, will work to represent the needs of Americans to communicate privately in the currently insecure global environment. Until now, U.S. encryption representation abroad has been dominated by law enforcement and national security interests. CDT hopes that the new Special Envoy will also consult with the computer user community, consumers, privacy advocates, and industry to promote their need for secure networks worldwide. NEXT STEPS In the coming months, both the Department of Commerce and the State Department must issue rules to implement the Administration's new encryption policy. * The State Department will issue a rule transferring its jurisdiction of encryption licensing to the Commerce Department. * The Commerce Department will issue rules spelling out exactly how it will approve products for export, and what the requirements for approved key recovery centers and key recovery plans will look like. CDT hopes and expects that the Administration will provide an opportunity for public comment in the rulemaking process to allow input from those concerned about privacy and security in the formulation of U.S. encryption policy. ------------------------------------------------------------------------ (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.38 11/18/96 -----------------------------------------------------------------------

1 0