December 2003 - cypherpunks-legacy

FinCEN reports from GAO
by Howard W Campbell 17 Dec '03

17 Dec '03

A GAO report to congress "MONEY LAUNDERING- Progress Report on Treasury's Financial Crimes Enforcement Network"(GAO/GGD-94-30) is available by snail mail free of charge for the first copy. All one needs to do is cut-and-paste the form below and send it to the address provided. The report gives a general overview complete with a few details describing methodologies. Of particular interest is the "Source Database" which "is designed to facilitate coordiation and cooperation among agencies that might be investigating the same suspects. The database serves as a central repository for information on suspects requested from FinCEN as well as ..." No doubt this will be part of the FAA/Airlines/Law enforcement data matching scheme when it is eventually implemented. The second report(GAO/GGD -95-156) supposedly details changes that the FinCEN people have suggested as needed improvements in the reporting system. I just recently requested the second report and haven't read it. Aloha, Woody email to : orders(a)gao.gov just fill out the name and address sections _______________________________________________________________________________________ Customer ID Number*: (* If using ID#, you ONLY need to provide your name) (**See FAQ Section 2.1 - Customer ID#'s - for details.) First Name: Last Name: Organization/Division/Office: Building: Room #: Street Address: City: State: Zip: Country (if not USA): ---- DOCUMENT/REPORT NUMBERS For example: HEHS-95-58 (You do not need to include leading "GAO/") DATE* Report #1:GAO/GGD-94-30 Report #2:GAO/GGD -95-156 Report #3: Report #4: Report #5: >>>CUT HERE<<<

1 0

Re: [IMPORTANT] Forgery detection
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

There's a rumor that Tim C[reep] Maypole sells his dead relatives as fertilizer as they constitute the best shit in California. _ {~} ( V-) Tim C[reep] Maypole '|Y|' _|||_

1 0

"Submit to over 500 urls" <new@valley-internet.com>
by Kerrie Mercel 17 Dec '03

17 Dec '03

Hi Do you know about the fully automatic submission program which will link your Web Pages to over 500 Search Engines & Directories? You Can Download the Program and have a FREE TRIAL at: http://www.freegoodies.com/wizard/submit.htm it's great mate! Happy New Year Kessa

1 0

Hardening lists against spam attacks
by jamie＠comet.net 17 Dec '03

17 Dec '03

A stopgap measure.... Perhaps an X-header that changes weekly, monthly, whatever. Is there a way to configure the list software to reject a message that doesn't have the X-header? This won't stop all spam, but it'd put a damper on a bunch of it. A lot of spammers don't even know what an X-header is (though a lot do), much less how to put one in a message. Lists are one of the last havens from spam, and though spam seems to be the grafitti and billboards of the future, I don't feel particularly amenable to having to waste time hitting the "D" key. jamie ------------------------------------------------------------------------------ jamie(a)comet.net | Comet.Net | Send empty message | Charlottesville, Va. | to pgpkey(a)comet.net | (804)295-2407 | for pgp public key. | http://www.comet.net | "Information wants to be $1.98." -I dunno who said it. ------------------------------------------------------------------------------

6 9

Re: Hardening lists against spam attacks
by John H West 17 Dec '03

17 Dec '03

The idea of distributing tokens by clever and complicated schemes seems interesting as a thought-experiment, but I wouldn't want to have to study the fine art of "cypherpunk posting technique" in order to insert my rare comments into a discussion thread. Charging posting fees is also interesting, but as already discussed, has many weaknesses. An easy solution would be to grant unlimited posting rights to anyone with more than one month's membership in the list. This idea could be called "the endorsement scheme." If anyone wishes to make an anonymous post, their submission would go into a "general pool" along with all the submissions from non-members and people who have subscribed for less than one month. The "general pool" would be a webpage somewhere which has on the screen an "Approve" button which would bring up a "Username/Passowrd" box. Anyone with more than three months membership in the list could apporove messages from the general pool. If the senior member (_any_ _one_ senior member) feels that a post in the general pool is worth sending on to the full list, then the message gets general distribution, date- and time-stamped: "Determined by --your_name_here-- (not the author) to be of possible interest to at least one member of the list." (no problem ... Vulis could still approve his "Huge Cajones Remailer" and his "Suck_My_Big_Juicy_Cock" postings, and none of us will ever figure out where they're coming from) Senior members would never be in any way reprimanded for any item that they forwarded, unless through some "call-for-votes" type of action their item-inclusion privileges were curtailed (that'll never happen). No one can "disapprove" or otherwise block any message from forwarding to the list. The principle to be followed for which items to approve would be "essentially everything." The idea is to strive to not block postings, but to leave "herbal remedy" ads hanging unendorsed. Maybe the unendorsed posts could expire if unendorsed after 72 hours -- of course, the item would be immediately removed from the general pool when it received an endorsement and went to the list. We have to be careful to not cause any legal liability to fall onto an endorser for approving an item (eg, source-code) which is later determined to be, eg, an ITAR violation, a copyright violation, etc. The endorsement must have an effective disclaimer. john

2 1

Re: FinCEN reports from GAO
by John Young 17 Dec '03

17 Dec '03

The GAO reports Woody cites(*) and others are available online at: http://www.access.gpo.gov/su_docs/aces/aces160.shtml Here's a list on money laundering reports, and one which reports on the burgeoning federal law enforcement agencies. (*) Money Laundering: Progress Report on Treasury's Financial Crimes Enforcement Network (Letter Report, 11/08/93, GAO/GGD-94-30). Money Laundering: Characteristics of Currency Transaction Reports Filed in Calendar Year 1992 (Fact Sheet, 11/10/93, GAO/GGD-94-45FS). Money Laundering: U.S. Efforts To Fight It Are Threatened By Currency Smuggling (Chapter Report, 03/09/94, GAO/GGD-94-73). Money Laundering: The Volume of Currency Transaction Reports Filed Can and Should Be Reduced (Testimony, 03/15/94, GAO/T-GGD-94-113). (*) Money Laundering: Needed Improvements for Reporting Suspicious Transactions Are Planned (Chapter Report, 05/30/95, GAO/GGD-95-156). Money Laundering: Stakeholders View Recordkeeping Requirements for Cashier's Checks as Sufficient (Letter Report, 07/28/95, GAO/GGD-95-189). Money Laundering: Rapid Growth of Casinos Makes Them Vulnerable (Letter Report, 01/04/96, GAO/GGD-96-28). Counterfeit U.S. Currency Abroad: Observations on Counterfeiting and U.S. Deterrence Efforts (Testimony, 02/27/96, GAO/T-GGD-96-82). Money Laundering: U.S. Efforts to Combat Money Laundering Overseas (Testimony, 02/28/96, GAO/T-GGD-96-84). Money Laundering: A Framework for Understanding U.S. Efforts Overseas (Letter Report, 05/24/96, GAO/GGD-96-105). ---------------------------------------------------------------------- Federal Law Enforcement: Investigative Authority and Personnel at 13 Agencies (Letter Report, 09/30/96, GAO/GGD-96-154). [Excerpt] Pursuant to a congressional request, GAO provided information on the 13 federal agencies with the largest number of law enforcement investigative personnel. ATF - Bureau of Alcohol, Tobacco and Firearms DS - Bureau of Diplomatic Security CPDF - Central Personnel Data File DEA - Drug Enforcement Administration FBI - Federal Bureau of Investigation INS - Immigration and Naturalization Service IRS - Internal Revenue Service NCIS - Naval Criminal Investigative Service NPS - National Park Service OPM - U.S. Office of Personnel Management GAO found that: (1) 10 agencies employ over 90 percent of federal law enforcement investigative personnel and 3 agencies have 700 or more such personnel; (2) these agencies investigate criminal violations including organized crime, bank fraud, civil right violations, illegal immigration, violations of mail integrity and security, custom, drug trafficking, and money laundering violations, income tax violations, and passport and visa fraud; (3) the agencies derive their investigative authority primarily from statutory laws which are implemented through executive orders, agency regulations, and interagency agreements; (4) the 13 agencies employed about 42,800 law enforcement investigative personnel at the end of fiscal year (FY) 1995 and, except at the Immigration and Naturalization Service (INS), 100 percent of the personnel could execute search warrants, make arrests, and carry firearms; (5) there was a 19 percent overall increase in investigative personnel between 1987 and 1995; and (6) the change in the number of law enforcement investigative personnel ranged from an increase of about 66 percent at INS to a decrease of about 14 percent at the Naval Criminal Investigative Service.

1 0

Kremlin v1.04
by Mark Rosen 17 Dec '03

17 Dec '03

I'm sure you all remember my program, Very Good Privacy, and have been waiting for the release of the new version with bated breath. Well, it's finally here! Only, after being contacted by PGP, Inc. regarding a possible trademark violation, I've changed its name to Kremlin. Remember: it's like an iron curtain for your data. The new version still uses the same algorithms. The algorithms can be grouped into three categories: ASCII and Vigenere, which give little security, but are extremely fast, DES, NewDES, and Safer SK-128, which will protect against all but the most well-funded adversaries, and Blowfish, IDEA, and RC4, which are perhaps the most secure algorithms available today. The key-size of the algorithms ranges from 64-bits (actually 56-bits) in DES to 128-bits in IDEA, NewDES, and Safer SK-128, and infinite length in ASCII, Blowfish (up to 448-bits), RC4, and Vigenere. If the "Hash Passkey" option is checked, then the passkeys are hashed with a 64-bit per-source file salt using SHA1 to form a 160-bit passkey; extra bits not used by the fixed-length algorithms are discarded. Without the "Hash Passkey" option checked, the passkey is only XORed with the salt and retains its original size. If the "Encrypt Headers" option is checked, then the filename and file size of the files are encrypted, giving an attacker no information about the source files. Once the files have been encrypted, you have the option of securely deleting them by overwriting them a user-definable number of times with random data; the most secure encryption algorithm in the world is useless if the plaintext is left unsecured on the hard drive. All of this is done through one simple dialog box. To launch Kremlin, just drag a file or directory (or a combination of files or directories) onto the Encrypt icon on the Windows 95 desktop. To decrypt a file, just double-click on it and enter the passkey; no unwieldy tabbed dialog boxes or file directory navigation boxes. Plus, as a added bonus, anyone who orders 10 or more copies of Kremlin will receive a can of Spam (TM) for free! For more information on Kremlin, e-mail mrosen(a)peganet.com To download Kremlin, go to: http://www.geocities.com/SiliconValley/Pines/2690

1 0

new restrictions in EAR (over ITAR)
by Adam Back 17 Dec '03

17 Dec '03

(from "http://jya.com/bxa123096.txt") : a. ``Software'' specially designed or modified for the : ``development'', ``production'' or ``use'' of equipment or ``software'' : controlled by 5A002, 5B002 or 5D002. : b. ``Software'' specially designed or modified to support : ``technology'' controlled by 5E002. large integer libraries? (modexp functions?) : c. Specific ``software'' as follows: : c.1. ``Software'' having the characteristics, or performing or : simulating the functions of the equipment controlled by 5A002 or 5B002; : c.2. ``Software'' to certify ``software'' controlled by 5D002.c.1; this one (I presume) is addressed at people like microsoft with CAPI certifications, you can't export the signing software : c.3. ``Software'' designed or modified to protect against malicious : computer damage, e.g., viruses; - Virus scanning software? (Winn Schwartau's info warfare hype is rubbing off on the spooks) Makes one wonder, if it's purportedly in the national security interests to bar the export of virus scanners (of any quality), logically it's also in the national security interests for the NSA to write and distribute virii. - Programs which checksum themselves as a crude check against viruses/modification? (some _operating systems_ qualify on this basis) - md5file from rfc1321? (rfc1321 is the MD5 rfc, md5file checksums files with md5, useful for checking what's changed)? - firewalls! (whoops there goes a few more million in US trade) Madness, Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Hardening lists against spam attacks
by Bovine Remailer 17 Dec '03

17 Dec '03

So, we had a spike of spam attack around Christmas, primarily using the mechanism of subscribing the cypherpunks list to other mailing lists. Now, everybody is off designing methods to limit postings to the list. You know what this reminds me of? The enthusiasm displayed by the the current US government administration to get bills passed that would curtail even more rights of its citizens in the wake of the TWA flight 800 crash. Cypherpunks, you have met the enemy and it is you.

2 1

benefits of EAR (not)?
by Adam Back 17 Dec '03

17 Dec '03

Reading through "http://jya.com/bxa123096.txt": > 1. This interim rule has been determined to be significant for > purposes of E.O. 12866. A cost benefit analysis has been prepared and > is available upon request by contacting James A. Lewis at (202) 482- > 0092. Anyone availed themselves of this offer of a CBA for EAR? Just curious as to what the supposed benefits are :-) Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

4 3