December 2003 - cypherpunks-legacy

Re: Newt's phone calls
by Bill Stewart 17 Dec '03

17 Dec '03

>>I just caught the news reports of Newt Gingrich's cell phone calls being >>taped by "a little old retired couple" with a scanner. These were then >>given to a congressman, who gave them to a newspaper. Eavesdropping on cellphones is illegal, since there's an expectation of privacy. I don't know if tapping the signalling channel is illegal - it's not eavesdropping on conversations, but it's giving you traffic analysis including locating your victim. Cordless phones don't offer an expectation of privacy, by some legal definition, so it's not illegal, and anyone can listen in with scanners, including police, unless there are state or local laws to the contrary It'd be interesting to test the legal status of digital spread-spectrum cordless phones, which claim on the box to offer privacy, but there probably aren't enough police forces with sufficiently advanced scanners to crack them to make it worth transmitting lots of bait "Yo, Bubba, I hear you've got 10 kilos of dope for sale!" "Yeah, it's $10/gram, I'll bring it by your house at 1234 Main Street." >>The take on this that we won't hear is: "This is outrageous! Why don't >>cell-phones offer encryption to ensure our privacy?" Analog callphones don't. (U.S.) Digital cellphones may offer encryption, though it's really dumbed-down encryption. It'll probably still keep out Beavis and Butthead, and maybe your local police, but not professionals. I've forgotten if the CAVE encryption on John Young's site is the US version, or if the standard we're graciously permitted by our government to use is a different one, but it's about that strength. Phil Karn wrote some time ago about the NSA's armtwisting that bullied the standards committee into coming up with the stuff. > There is a very basic reason that cell phones are not encrypted; > the government does not want them encrypted. Analog cellphones were doing well to work at all, and manufacturers and service providers didn't want to add the complexity of encryption, especially as a retrofit, so they got a law passed instead. Tapping cellphones is more trouble than tapping wired phones - they move around, and to tap them from the phone company end requires taps everywhere that you activate when you know where somebody is. On the other hand, if you can just scan for them, and crack the wimpy encryption, it's really a lot less work. And if you overhear other interesting conversations while pursuing a legally authorized wiretap, that was "good faith"... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

10 12

Re: New US regs ban downloadable data-security software
by Bill Stewart 17 Dec '03

17 Dec '03

>> Therefore, it would seem that, as long as the security software on your ftp >> or WWW site is free of cost, it is OK to keep it there. Commercial >> security software, however, remains export-restricted. > I can't believe that there's no one taking advantage of this to make a >'shareware' version of their software available, and having available, >for export and sale, an 'enabler' to bring it to full functionality. In particular, if you allow free non-commercial evaluation of beta software, e.g. McAfee's virus protection software, that would probably qualify. It's interesting that they've structured their requirements to try to stay within the Constitutionally authorized powers (regulation of interstate and foreign commerce) while leaving out freeware which might lead to an annoying legal challenge. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Newt's phone calls
by Declan McCullagh 17 Dec '03

17 Dec '03

It's a gradual change, certainly. The Washinton Post hasn't mentied crypto in their exhaustive covering of the subject. But I maintain it's not that far beneath the radar. Watch the Lehrer Newhour (or whatever the hell it's called now) tonight, for instance. -Declan On Tue, 14 Jan 1997, Sean Roach wrote: > At 08:37 PM 1/13/97 -0500, Declan McCullagh wrote: > >Don't be too sure that crypto is that far beneath the radar. I spent > >Thursday through Saturday at an annual privacy conference for activists > >from around the country, and they understood the principles. Their > >voicemails were filling up with calls from reporters last Friday about the > >Gingrich incident, and I know they were talking crypto. > ... > Believe me, at least around here it is. > I am a college student studying computer science, and 80% of the people that > I talk to on a regular basis not only know how to play around with windows, > (and Netscape), but also at least a modicum of simple fixes to simple > problems, (such as unformatting a DOS disk). This is what I consider to be > bottom level for that 80%, however, very few of them know even as much about > cryptography as I do. And I barely know how to use PGP. > I have had Computer Science professors express ignorance as to what PGP is, > much less all of these others that I have learned about by hanging around here. > A few people know what crypto is, but most don't. > >

1 0

Re: Newt's phone calls
by John Young 17 Dec '03

17 Dec '03

Omnipoint has a full-page ad in the New York Times today which capitalizes on Newt's lack of privacy and claims that its spread spectrum phone would have protected him with with encryption and digital technology superior to cellular: http://www.omnipoint.com Nokia, for one, touts its use of the CAVE encryption in its latest unit, although its not clear which version. The CAVE algorithm and implementation is now at: http://www.replay.com/mirror/cave/ News may be forthcoming about CAVE -- which, to remind, is an acronym for Caller Authentication and Voice Encryption. It has apparently gone through several versions -- whether getting progressively stronger or weaker is a question soon to be answered authentically?

1 0

Social Security/CommerceNet/PitneyBowes try digital signature W-2's
by John Gilmore 17 Dec '03

17 Dec '03

Date: Tue, 14 Jan 97 10:06:55 EST From: John.T.Sabo(a)ssa.gov Message-Id: <9700148532.AA853265294(a)ccsmtpgw2.ssa.gov> To: members(a)lists.Commerce.Net Subject: Test Opportuity for CommerceNet Member Small Companies +----------------------------------------------------------------------+ This message was addressed to: members(a)lists.commerce.net +----------------------------------------------------------------------+ To CommerceNet Members Who Are Small Employers: CommerceNet member companies who are small employers (approximately 30 employees) are invited to participate this month with the Social Security Administration and PitneyBowes, Inc. in an important proof-of-concept project in which the Social Security Administration will accept digitally-signed W-2 and W-3 data via the Internet, with PitneyBowes issuing test software and public key certificates to participating employers. (I mentioned this test at the December CommerceNet Members' meeting.) Participation will require completion of a field test agreement with SSA, submission of a request for certification by PitneyBowes, and installation of software on a Windows PC which will enable the generation of a signature key pair as well as software which will generate, sign and transmit the wage data to Social Security. The software also produces W-2 paper forms for distribution to employees. If a company already uses a software product to create W-2's, the output file can be used for this test. (Please note that the test is not designed to evaluate all aspects of public key cryptography - for example, no certification practice statement has been developed.) If you are interested in participating in this important public/private sector test of digital signature wage reporting, please contact me as soon as possible and I'll arrange for Mr. Chuck Liptz, SSA's Project Manager, to contact you immediately to provide additional details. (Chuck can also be reached directly at (410) 965-7057 or <chuck.liptz(a)ssa.gov>. John Sabo Social Security Administration (410) 965-1550 ---------------------------------------------------------------------------- James M. Galvin galvin(a)commerce.net CommerceNet +1 410.203.2707 3209-A Corporate Court FAX +1 410.203.2709 Ellicott City, MD 21042 http://www.commerce.net/ http://www.eff.org/blueribbon http://www.eff.org/goldkey

2 1

Re: Newt's phone calls
by Sean Roach 17 Dec '03

17 Dec '03

At 08:37 PM 1/13/97 -0500, Declan McCullagh wrote: >Don't be too sure that crypto is that far beneath the radar. I spent >Thursday through Saturday at an annual privacy conference for activists >from around the country, and they understood the principles. Their >voicemails were filling up with calls from reporters last Friday about the >Gingrich incident, and I know they were talking crypto. ... Believe me, at least around here it is. I am a college student studying computer science, and 80% of the people that I talk to on a regular basis not only know how to play around with windows, (and Netscape), but also at least a modicum of simple fixes to simple problems, (such as unformatting a DOS disk). This is what I consider to be bottom level for that 80%, however, very few of them know even as much about cryptography as I do. And I barely know how to use PGP. I have had Computer Science professors express ignorance as to what PGP is, much less all of these others that I have learned about by hanging around here. A few people know what crypto is, but most don't.

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Tim C. Maya has been a source of endless embarassments to his sympathizers on and off the net. |||~ (0 0) _ooO_(_)_Ooo__ Tim C. Maya

1 0

Re: Newt's phone calls
by Clay Olbon II 17 Dec '03

17 Dec '03

At 02:48 PM 1/14/97 -0800, you wrote: >It is also possible that somewhere in the chain of information between >mom&pop, the media, and us, the distinction between "cordless phone" >and cellular phone. I gather it was a conference call that was >intercepted. All it takes is one participant using a cordless phone in >range of one scanner, and the whole conversation is compromised. The congressman (Boehner? from Ohio) whose cellphone was "eavesdropped" stated today that he was parked in the lot of a Waffle House in Lake City FL. The couple said that they just happened to be driving by when they overheard and began taping the conversation. I have a problem with making it illegal to listen to parts of the electromagnetic spectrum. Seems sort of unnatural. Maybe they will decide that people who can see the color green will go to jail next ;-) Technological solutions are much more elegant. Of course, they are not nearly as sexy as legal remedies (I can't wait to see if the congressman who gave it to the Times is indicted!) Clay ******************************************************* Clay Olbon olbon(a)ix.netcom.com sys-admin, engineer, programmer, statistitian, etc. **********************************************tanstaafl

8 9

Leaving the infowar list.
by null＠infowar.com 17 Dec '03

17 Dec '03

Thank you for your participation in this list.

1 0

Karn case challenging crypto rules -- oral arguments online
by Declan McCullagh 17 Dec '03

17 Dec '03

I've placed my notes from and a report on last Friday's Karn crypto- hearing online in the "Afterword" section of netlynews.com. (Incidentally, Netly relaunched yesterday. Stop by and check it out). The oral arguments were a battle of metaphors: is the text of a cryptographic algorithm more like a tank guidance system or a Shakespearean sonnet? At one point Judge Williams compared a floppy disk to "a machine." Judge Ginsberg is known as somewhat of a libertarian, a fellow who home schools his child; he was considered for a Supreme Court seat until reports of marijuana use derailed his bid. Judge Williams is a conservative and a bit of a First Amendment purist -- at least in traditional media. I think it was Williams who (correctly) dissented in the _Turner_ "must carry" cable broadcasting case. -Declan --- Full text at "Afterword" -- http://netlynews.com/ United States Court of Appeals for the District of Columbia Karn v. U.S. Department of State January 10, 1997 Ken Bass, attorney for Phil Karn: The government says this diskette cannot be exported. Period. They claim to make an argument that even though it is identical information, it's worth restricting this diskette... We submit that it is an arbitrary, capricious, and totally irrational decision for the government to draw such a distinction... Judge Ginsberg: Can the courts evaluate the military and security distinction between the disks and the book? Bass: The Supreme Court said it can. The mere intimation of national security is not some talismanic trump card. Judge Ginsberg: But that's not what they're doing. They're putting something on the munitions list. In what way can we say that's not significant militarily? Bass: Courts are not incompetent to review decisions to see if they're irrational... [...]

1 0