December 2003 - cypherpunks-legacy

BXA Crypto Meeting
by John Young 17 Dec '03

17 Dec '03

Federal Register: December 12, 1996 ----------------------------------------------------------------------- Bureau of Export Administration Information Systems, Technical Advisory Committee; Notice of Partially Closed Meeting A meeting of the Information Systems Technical Advisory Committee will be held January 7 & 8, Room 1617M-2, in the Herbert C. Hoover Building, 14th Street between Constitution and Pennsylvania Avenues, NW., Washington, DC. This Committee advises the Office of the Assistant Secretary for Export Administration with respect to technical questions that affect the level of export controls applicable to information systems equipment and technology. January 7 General Session 9:00 a.m.-12:00 p.m. 1. Opening remarks by the Chairmen. 2. Presentation on Office of Exporter Services outreach program. 3. Update on status of Export Administration Regulations. 4. Public discussion on encryption issues. 5. Other comments or presentations by the public. Closed Session 6. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. January 8 Closed Session 7. Discussion of matters properly classified under Executive Order 12958, dealing with U.S. export control programs and strategic criteria related thereto. The General Session of the meeting is open to the public and a limited number of seats will be available. To the extent time permits, members of the public may present oral statements to the Committee. Written statements may be submitted at any time before or after the meeting. However, to facilitate distribution of public presentation materials to the Committee members, the Committee suggests that public presentation materials or comments be forwarded at least one week before the meeting to the address listed below: Ms. Lee Ann Carpenter, TAC Unit/OAS/EA, Room 3886C, Bureau of Export Administration, U.S. Department of Commerce, Washington, DC 20230 Dated: December 6, 1996.

1 0

Life with Dale
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:From: Dale Thorn <dthorn(a)gte.net> :I spent part of my growing up years in Leroy West Virginia, pop. :about 15, give or take. I know about hillbillies, and I know about :guns. :If you had the impression I am a whiner, or that that defines me as a :person, you're about as clueful as the other old farts who attack :people they don't know anything about. Name one thing Dale has not experienced.

5 12

Solidarity with Peruvian Guerrilla!
by aaron＠burn.ucsd.edu 17 Dec '03

17 Dec '03

** See list of useful Web sites at end of this post! ** Companer@s, I am writing this while I am tired and should be asleep, since I think that this matter is too urgent to delay. I apologize for any careless formulations. By now, you all know that the Peruvian guerrilla group MRTA (Movimiento Revolucionario Tupac Amaru) has occupied the mansion of the Japanese ambassador in Lima and is holding several hundred prisoners. Unless you are in an unusual part of the world, you also have seen how the bourgeois media are discussing the matter as a problem of how to deal with 'terrorists.' For the working people and all the oppressed and exploited of the world, and for socialists, communists, and anarchists, the seizure of the ambassador's residence along with about 400 bourgeois dinner guests is a great accomplishment. It is a blow against the terrorism of the Peruvian state and its imperialist patrons! Those captured in the raid include many members of the Peruvian and international ruling elite, including the head of Peru's secret police! It will be politically very difficult for the Peruvian state to launch a military attack as a means of resolving the crisis, since that would create quite a few 'illustrious corpses' and lead to a falling out among bourgeois sectors.. (And it would be difficult to get the world's poor majority to join the bourgeoisie in mourning its dead!) It seems that there is already a falling out between Fujimori and the Japanese over Fujimori's refusal, so far, to negotiate. It is very important that the situation in Lima not be resolved in a way that can be seen as a victory for the bourgeoisie. It is our task to publicize who the real criminals are in Peru and to help wring concessions from the Peruvian dictatorship. In particular, we should demand the release of all political prisoners and prisoners of war from Peru's hideous torture-chamber prisons. In this context, let's not get involved in sectarian battles among the various factions of Peru's anti-government left. Whatever differences the groups have, and these are very serious, we must keep in mind that the Peruvian state and its imperialist backers (in Washington, Tokyo, London, Bonn, etc.) are the main enemy. All political prisoners must be released, whether of MRTA, the PCP (Shining Path) or neither. Thanks to the widespread publicity given to the events in Lima, many more people will be interested in what we have to say about Peru than normally would. Let's organize demonstrations at Peruvian Embassies, Consulates, airline offices, etc. Let's raise our voices in whatever forum may be available to defend the heroic guerrillas and to denounce the real terrorists. --In solidarity, --Aaron <aaron(a)burn.ucsd.edu> P.S. Plans are being made for a demonstration at the Peruvian Consulate in San Francisco, California -- probably on Monday, December 23. If you live in the area, please send me an e-mail message. Otherwise, do what you can in your area! SOME USEFUL WEB SITES: Web site on the current crisis: <http://burn.ucsd.edu/~ats/mrta.htm> What Are The Goals Of Your Embassy Occupation? -- Interview With Norma Velazco, Representative Of The Tupac Amaru Revolutionary Movement (MRTA) In Peru: <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0089.html> Partial list of hostages: <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0092.html> MRTA's web site in Europe: <http://www.cybercity.dk/users/ccc17427/> Lima's best bourgeois newspaper (in Spanish): http://ekeko.rcp.net.pe/LaRepublica/

2 2

Dale defends free society from the NSApunks (was Re: Encryption ?
by nobody＠replay.com 17 Dec '03

17 Dec '03

I thought this was so funny I've saved it. Perhaps we could vote on the quality of Dale's ideas and arrive at an estimate of the proportion of NSA supporters on the list. THE AKOND OF SWAT :Date: Thu, 19 Dec 1996 07:36:03 -0800 :From: Dale Thorn <dthorn(a)gte.net> :To: SHARK <otaner(a)boun.edu.tr> :Cc: cypherpunks(a)toad.com :Subject: Re: Encryption ? : :SHARK wrote: :> :> I am a Mathematic student at Bosphorus University in Turkey. :> I am interested in both computer applications and mathematical base of :> encryption.Where can I find this kind of staff on internet. :> Is it necessary to have high level of mathematical background in order to :> deal with encryption?? :> :> By the way Is there any member of this list from Turkey? : :There are a lot of NSA people here on cypherpunks, and they try very :hard to control encryption, to make everyone think it is difficult, to :discourage independent inquiry. : :That is the main reason they accuse people of being snakeoil vendors, :to discourage people from inquiring about really new ideas, like some :of my ideas for example. : :Just so you know....

3 2

some clarification of jurisdiction in Berstein (long)
by attila＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- the question: ::I've seen two other reports (one from NBC) that say the ruling ::only covers the one federal district. ::Any lawyers want to clarify? The caveat: the following is a personal opinion and is not, in any way, to be considered either legal opinion or legal advice. Hire an attorney who specializes in these issues before you do anything rash which might qualify you for three hots and a cot. Basically, jurisdiction is all a question of who wants to honor whose decision until a higher level either affirms or rejects the lower court ruling (or sends it back w/o a full ruling but requiring a review of some part of the decision by the lower court). Generally speaking, the decision is valid for the Northern District of California, but a Federal district judge anywhere in the U.S. can make a concurring decision based on citing Judge Patel's decision that source code is protected under Amendment 1. In other words, the cite is valid anywhere, and can be used as the basis of a decision. Likewise, another district judge somewhere in the U.S. can issue a contrary ruling, still citing Judge Patel's ruling, but disagreeing with its tenants; or even ignore the decision and forge new ground. The basic rule of thumb is each federal judge is 'Judge Roy Bean, Law West of the Pecos' in his own courtroom, and able to virtually ignore even USSC rulings by claiming the action is not the same for some silly reason. He may be reversed on appeal... As for Judge Roy Bean, there have been a number who might qualify for the type in the Ninth Circuit who come to mind: Manny Real in LA, Hadder in LA, Foley in Vegas, and one in El Paso (whose name escapes me --maybe Peck), who was assassinated, probably by the drug trade, about 20 years ago. These are mavericks with a high percentage of cases reversed on appeal. Two of the four are of questionably diminished mental abilities, one was of questionable ethics, and one is just plain nuts --or at least off the wall (IMHO). I have not read the full Bernstein decision as yet, but I understand there are a fair number of unresolved issues such as binary objects. This again can spawn additional test cases, either by someone challenging the issue as Bernstein challenged the source code, which I consider was the correct decision as anyone can read source --understanding source code may be more difficult than reading a bad Russian translation of the nuances in Alice in Wonderland for some... (your mileage may vary...) Leaving government appeals out of the equation, if there are two or more district courts within an appeals circuit, whose fundamental opinion: 'source code is protected under Amendment 1 rights' do not agree, the obvious step is for the Ninth Circuit Court of Appeals, either by a 3 judge panel, or a full court review, to take jurisdiction and decide which of the two opinions suits their fancy. If a 3 judge panel does not give the decision expected, there is also a possible review by a full court on the motion of either party. Now, suppose the Ninth Circuit affirms Judge Patel. At that point every district court within the jurisdiction of the Ninth Circuit uses the Bernstein case as a given, an affirmed precedent; the rulings will reflect that unless some clever clown adds a twist and the judge falls for it. Again, setting aside appeals, there are multiple circuit appeal regions. None of these are bound by the Ninth Circuit decision, but it is a citation of importance. Now, if there are significantly different opinions in the appeal circuits, then the Supreme Court will decide whether they will accept the decisions for review, deciding which decision is valid; or the USSC can ignore it. Personally, I would publish anything regardless. I've had more than one go around with the simpletons. The first time the goons in gray trenchcoats shake you out of the rack in the early morning, there is a real adrenalin rush; after that it's: "Oh, shit, you guys again, who wants some coffee?" Whatever you do: keep your mouth shut; even teh previous thought is risky the assholes might charge you with attempted bribary of a Federal official. I have been quiet for 20 years; as you get older you get a lot more cranky, and less concerned with your welfare. You know: "strike another blow for Liberty, FUCK the CDA" and so on. Be a martyr; give your all for the cause. Eventually you end up in Springfield, Missouri, home for Federal Criminally Insane political victims. Larry Flynt (Hustler) managed to get away from the Feds who can hold an "insane" individual in their custody indefinitely: certifying him insane with one hand, while the other hand gives him a chemical lobotomy. Larry Flynt was sent to Springfield by a Federal Judge in LA for contempt of court --wearing an American flag as a diaper in his wheelchair (paraplegic). Unless you're a little crazy, I don't think I would start publishing source code yet. Oh, I expect it would be difficult for the Feds to get convictions with a strong precedent decision. But, keep in mind, federal judges are appointed on the basis of an ad in the local bar rag: 'wanted: middle aged person with failing law practice and good political connections.' A Federal judge is appointed for life; after age 65 they are able to choose cases which interest them; most of them seem to die on the bench (some would dispute they were ever alive on the bench). It's been said, "what do you call a lawyer with an IQ of 40?" "Your, Honour." If you wish to lay down the bait trail in the Northern California district, by all means, go ahead, but you might find yourself charged in a criminal action, and the government presenting a case that your charges are 'different' than the Bernstein case: Bernstein just wanted to publish an academic paper, you are charged with violation of the munitions act and maybe treason and espionage. And, always remember your opponent is a drug-crazed 800 lb gorilla with a mission: conviction. This case is the big one: Bernstein was the plaintiff, in a civil action. You will be the _defendant_, in a criminal action. I would not put a scenario like this past the DOJ scum; maybe multiple times to try and obtain results which match their corroded mental image of peace, prosperity, and union harmony. The DOJ is not interested in either justice or the Bill of Rights. Federal attorneys are striving for high conviction rates, like Vietnam body counts --and are enforcing the policies of the administration, not the courts, the constitution, or the people. If you managed to get here through the convoluted logic, I would be careful of how you loosen the floodgates. At this point we have made a statement which is a serious breach of their armor. We obviously need additional test cases to clarify the position, and the decision must ultimately be decided by the USSC. I would caution for another reason: if the Feds choose a preferred defendant who is flagrant, obnoxious, and on flaky ground; _they_ may have a good precedent, not us. Academic challenges are certainly among the best --a bit easier to make the point for education than for pornography. The next step IMHO, should be a challenge that object code is just a shipping container for the source code. == I'll get a life when it is proven and substantiated to be better than what I am currently experiencing. --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMrp6r704kQrCC2kFAQHx/gP6AoTCk7gEIjylULrXJcTS+QnOtV8Ic5s1 R0iPC0q3/67z9kROekOGOGkD1SRD8umnrO5rb7NRgJDBpdSzt1Hlp+FWZlH1HgZQ HmR0FZ6QUy1JKC9QJrw0oNTCaful/u4UHTAQLi4R8sTSx1RM/uWfR4Lw4kMKSQ11 Xa6hPWcvNZE= =Of3t -----END PGP SIGNATURE-----

1 0

FWD: PGP-fone Mailing List Archive
by Bill Stewart 17 Dec '03

17 Dec '03

>Date: Fri, 20 Dec 1996 07:32:52 -0500 (EST) >From: "Fred B. Ringel" <fredr(a)rivertown.net> >To: pgp-fone(a)rivertown.net >cc: pgp-users list <pgp-users(a)rivertown.net> >Subject: Mailing List Archive >Hi all- > > Finally got around to doing something I had meant to do. I have set >up an HTML-ized version of the PGPfone Mailing List archives. It is >reachable off the PGP Fone Registry, but the exact URL is : > > http://pgp.rivertown.net/pgp-fone/archives > >Now any newcomers to the list will find it easier to catch up, or if you >need to look something up, the archives are indexed by date, author, >and subject/thread. Hope you find it useful. Until I figure out how to >update it automatically over an NFS mounted system, I will manually update >them at least once a week. > > I'm sending this to PGP-Users too so anyone interested in the >PGPfone list can get a taste of what is going on there. The PGPFone list is >up to almost 100 subscribers and growing (tell your friends!!) > > Fred >/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ >Fred B. Ringel -- Rivertown.Net Internet Access >Systems Administrator -- http://www.rivertown.net >and General Fixer Upper -- Voice/Fax/Support: +1.914.478.2885 > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:42 AM 12/20/1996, Bill Frantz wrote: >At 11:16 PM -0800 12/19/96, Peter Hendrickson wrote: >> Or, you could turn in the broken processor and have the manufacturer >> certify that it was turned in to the software vendors and that >> a new version of the software should be generated. > I meant processor backup of course. When my processor breaks at 2AM and I > need to get the report out by 8AM, I'm going to call the software support > line and get help. If your processor dies you are SOL whether or not you have software. If it's worthwhile having a backup processor around, then you just have to spend a little more to have backup software, too. > Or the friendly hardware manufacturer is going to come > right out and certify my processor is dead. Come on and get real. With > most software vendors I can't even submit a bug report. If the reissuance of software is not possible (which I don't believe), it's an acceptable risk. Processors die far far less often than disks, and disks are getting pretty reliable. If the software companies can't get it together to reissue software, then it would certainly be easy to sell processor insurance to people who wanted it. This would allow them to replace their ~$10,000 software library. (You can buy theft insurance for roughly the same payoffs, so it's a feasible business. Theft is harder to verify and in my judgement occurs much more frequently than processor failure.) > Note that I am not saying there is a technical problem here. I do see big > problems with infrastructure and marketing. The last time software > companies tried to market copy protection, it failed in the market place. > I predict that encyphered instruction streams will too, and for the same > reasons. If the old copy protection just worked, it would have been widely accepted. Old copy protection had many problems. It didn't stop piracy. Sometimes it crashed your machine. Some schemes worked on some Intel machines but not on others. Backups were a problem. Etcetara. Peter Hendrickson ph(a)netcom.com

3 2

Solidarity with Peruvian Guerrilla! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, MRTA is a bunch of terrorists, irrespective of whether the issues they are trying to deal with are legitimate. They have threatened to kill people if they don't get their way. This alone is enough for me to not support them. They also have taken their internal bitch outside their unhappy home and involved other nationalities. If they were my neighbors I would call the cops and if allowed on the jury I would give them the max. What I would suggest is that the Japanese take as many of the MRTA out as they possibly can. I support the Japanese. Screw the MRTA and the Peruvian government, little Hitlers are little Hitlers. Banzai! Jim Choate CyberTects Forwarded message: > From cypherpunks-errors(a)toad.com Fri Dec 20 14:21:00 1996 > Message-Id: <v02130501aee03559777a(a)[136.152.11.117]> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Fri, 20 Dec 1996 06:16:20 -0800 > To: aaron(a)burn.ucsd.edu (All recipients) > From: aaron(a)burn.ucsd.edu (Aaron) > Subject: Solidarity with Peruvian Guerrilla! > Cc: nyt(a)blythe.org (nyxfer), seac+nafta(a)ecosys.drdr.virginia.edu, > bc05319(a)binghamton.edu (TAZ), BAYLEFT(a)cmsa.Berkeley.EDU, > red-skinheads-l(a)eart.com, anarchy-list(a)cwi.nl, spg-l(a)xs4all.nl, > LABOR-L(a)YORKU.CA, a-infos(a)lglobal.com > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > ** See list of useful Web sites at end of this post! ** > > Companer@s, > > I am writing this while I am tired and should be asleep, since I think that > this matter is too urgent to delay. I apologize for any careless > formulations. > > By now, you all know that the Peruvian guerrilla group MRTA (Movimiento > Revolucionario Tupac Amaru) has occupied the mansion of the Japanese > ambassador in Lima and is holding several hundred prisoners. Unless you are > in an unusual part of the world, you also have seen how the bourgeois media > are discussing the matter as a problem of how to deal with 'terrorists.' > > For the working people and all the oppressed and exploited of the world, > and for socialists, communists, and anarchists, the seizure of the > ambassador's residence along with about 400 bourgeois dinner guests is a > great accomplishment. It is a blow against the terrorism of the Peruvian > state and its imperialist patrons! Those captured in the raid include many > members of the Peruvian and international ruling elite, including the head > of Peru's secret police! It will be politically very difficult for the > Peruvian state to launch a military attack as a means of resolving the > crisis, since that would create quite a few 'illustrious corpses' and lead > to a falling out among bourgeois sectors.. (And it would be difficult to > get the world's poor majority to join the bourgeoisie in mourning its > dead!) It seems that there is already a falling out between Fujimori and > the Japanese over Fujimori's refusal, so far, to negotiate. > > It is very important that the situation in Lima not be resolved in a way > that can be seen as a victory for the bourgeoisie. It is our task to > publicize who the real criminals are in Peru and to help wring concessions > from the Peruvian dictatorship. In particular, we should demand the release > of all political prisoners and prisoners of war from Peru's hideous > torture-chamber prisons. In this context, let's not get involved in > sectarian battles among the various factions of Peru's anti-government > left. Whatever differences the groups have, and these are very serious, we > must keep in mind that the Peruvian state and its imperialist backers (in > Washington, Tokyo, London, Bonn, etc.) are the main enemy. All political > prisoners must be released, whether of MRTA, the PCP (Shining Path) or > neither. > > Thanks to the widespread publicity given to the events in Lima, many more > people will be interested in what we have to say about Peru than normally > would. Let's organize demonstrations at Peruvian Embassies, Consulates, > airline offices, etc. Let's raise our voices in whatever forum may be > available to defend the heroic guerrillas and to denounce the real > terrorists. > > --In solidarity, > --Aaron <aaron(a)burn.ucsd.edu> > > P.S. Plans are being made for a demonstration at the Peruvian Consulate in > San Francisco, California -- probably on Monday, December 23. If you live > in the area, please send me an e-mail message. Otherwise, do what you can > in your area! > > SOME USEFUL WEB SITES: > > Web site on the current crisis: > <http://burn.ucsd.edu/~ats/mrta.htm> > > What Are The Goals Of Your Embassy Occupation? -- Interview With Norma > Velazco, Representative Of The Tupac Amaru Revolutionary Movement (MRTA) In > Peru: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0089.html> > > Partial list of hostages: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0092.html> > > MRTA's web site in Europe: > <http://www.cybercity.dk/users/ccc17427/> > > Lima's best bourgeois newspaper (in Spanish): > http://ekeko.rcp.net.pe/LaRepublica/ > >

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 7:43 AM 12/20/1996, Hal Finney wrote: >> The manufacturer is going to publish a list of ALL of the public keys? >> We're talking one key per chip, right? Isn't that an AWFUL lot of >> keys, like, in the millions range? > Probably an easier way would be for the chip manufacturer to issue a > key certificate (signature) on the chip keys. Then it is a trivial > matter for any software manufacturer to verify that a proferred chip > key is legit; just check the cert. Now why didn't I think of that! >>> One approach is for the manufacturer to authenticate software submitted >>> by approved vendors. The vendors are then tasked with encrypting it >>> for the correct processor. >> I'm not sure the "approved" bit would go over too well... one idea >> would be to license the compiler writers, who would build the >> encryption into compilers. It's still not horribly great, but >> better. > Hey, it's a free world, right? Some people only run authenticated > code from big companies; other people turn off the authentication > bit in the CPU and can run any old thing they stumble across on the net. > Everybody's happy. Maybe not everybody. My scheme would not let you turn off the authentication bit. That means that if somebody does find way to get at the secret key, they still can't run the code without doing something expensive with particular processors. Basically, this won't be worth the trouble. > The first group doesn't have to worry about viruses, > or at least they have somebody to sue if they see one, and the second > group gets to run all the freeware and PD code they can today. The second group would have to buy a different processor altogether, the way I proposed it. But, that does not seem unreasonable. One could even imagine systems which have a "free" processor and a decrypting processor. While they would have to have completely different instruction sets, they could be pin compatible. >> Right; the only reason I could see people using this would be for >> economical reasons. > Yes, I think this is a point often missed in these discussions. People > say, why would I want a CPU which will limit the software I can run, > something which will let a software maker give me a version of his > program which will only run on my CPU and which I have no ability to > share with others? What's in it for me? > The answer presumably is that the software manufacturer will sell software > with such limits for much less than he will sell unlimited software. That's > because software piracy is such a major problem, and this way he can be > protected against piracy from this copy of his program. So people with > these CPU's can buy their software a lot cheaper. I agree with all of this. Some people might be happier if they think of this as just another kind of agreement that people can make. Right now the software development agreement is weak because piracy is so easy. We rely a little bit on the law and a whole lot on the integrity of customers. Really, that isn't ideal. It would be nice if people could make strong agreements to write software. My judgement is that software piracy is less of a problem in the U.S. than it is elsewhere. My impression is that there are many other countries in the world where the whole "I should help pay for the development of this software because I am using it" idea just doesn't really show up on the screen. This processor would make it possible to sell software to the whole world without really worrying too much about how well each government enforces its laws or how ethical the people in foreign countries are. > Of course the big downside is that the track record of tamper resistant > hardware has not been too strong lately! If a system like this gets into > widespread use and somebody finds out that shooting X-rays at the chip > exposes its secret key, you've got a big problem. Processors are really only good for 3 years or so. The vendor is only betting that attacks won't become widespread in that time period. That is not a perfectly safe bet, but it isn't bad. The attacks can exist, but so long as they are expensive or hard to generalize to all processors, the software vendors are safe. Peter Hendrickson ph(a)netcom.com

1 0

The CyberSitter Diaper Change, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

[From this morning's Netly News. Check out the HTML version of the article at netlynews.com for links to the threatening letters, etc. --Declan] The Netly News http://netlynews.com/ December 20, 1996 The CyberSitter Diaper Change By Declan McCullagh (declan(a)well.com) Brian Milburn is angry. The president of Solid Oak Software, makers of the CyberSitter Net-filtering software, has seen his company's product come under heavy fire this year. Its offense? Critics say that CyberSitter has reached far beyond its mandate of porn-blocking and instead has censored innocuous, even invaluable web sites. I admit I'm one of its critics. In a CyberWire Dispatch that Brock Meeks and I published in July, we revealed that the censorware bans such places as the International Gay and Lesbian Human Rights Commission and the online home of the National Organization for Women. Our Dispatch showed the world -- or at least our readers -- that the makers of CyberSitter have a clear political agenda. The article prompted follow-ups in CyberTimes and the National Law Journal and an editorial in the Washington Post with an exchange of letters to the editor between a NOW executive and a representative of Focus on the Family, a conservative group that markets CyberSitter. To Milburn's mind, our act of revealing the truth about his company's product was, literally, criminal. In August, he told us that he had asked the U.S. Department of Justice to launch a criminal investigation into the publication of our article. He was particularly upset with one paragraph that included a fragment of his database demonstrating that CyberSitter expressly bans info about gay society and culture. He wrote: "Your willful reverse engineering and subsequent publishing of copyrighted source code is a clear violation of US Copyright law. While we would easily prevail in a civil court in seeking damages... we will seek felony criminal prosecution under 17 USCS sect 503(a) of the Copyright Act, and are preparing documentation to submit with the criminal complaint to FBI [sic]." Milburn was upset because CyberSitter's database is scrambled to prevent kiddies from grabbing addresses of porn sites from it. It's lightweight encryption, sure, but just enough to frustrate Junior. The scrambled database also allows Solid Oak to add and delete banned sites without the user's knowledge -- something that we believe is a dangerous practice. Now, I should point out here that neither I nor Brock did the actual decrypting; we had received a copy of the descrambled filter list from a confidential source. In any event, Dispatch's attorneys replied to Milburn, saying that the article was "protected by the full force of the First Amendment to the United States Constitution" and fell squarely within the copyright act's "fair use" provisions. We never heard back from him or the FBI. But that nastygram from Milburn wasn't his last. As criticism of CyberSitter becomes more intense, he's stepped up his counterattacks, threatening legal action, blocking critics' sites, or both. Take Bennett Haselton, a college student who cobbled together a site called Peacefire in August. This fall he started an anti-CyberSitter page that listed some of the more controversial actions of the software. Milburn complained. On December 6 he wrote to Haselton's Internet provider, Media3 Technologies, and tried to persuade them to give Peacefire the boot. His e-mail said: "One of your subscribers has made it his mission in life to defame our product as he appearantly [sic] has a problem with parents wishing to filter their children's access to the internet." Another charge was that Haselton had linked to a copy of our Dispatch. Solid Oak then added Peacefire and Media3 to its list of blocked sites. To Marc Kanter, Solid Oak's marketing director, it was necessary. "The site directly has links to areas that have our source code decoded on it.... There's no reason that our users should be able to go to sites that effectually inactivate our program," he said. Milburn also accused Haselton of reverse-engineering CyberSitter to get the text of its database -- that is, of being the confidential source for the CyberWire Dispatch. "Reverse engineering had to have been done in order to get the information, and we believe Mr. Haselton was the one who did it," Milburn wrote. Note to Millburn: Haselton wasn't our source. Then there's the case of Glen Roberts. His web page giving instructions on how to disable CyberSitter is now banned -- as is his Internet service provider. That's because CyberSitter differs from its competitors CyberPatrol and SurfWatch, which can restrict access by URL; instead, CyberSitter has to block access to the entire ripco.com domain. So what's my problem, really? If people don't want to use CyberSitter or other nanny apps, they don't have to. It's voluntary. It's effective. It protects children, and it sure is better than the Communications Decency Act. I have one major objection to all of the software filters currently on the market: Consumers have no way of knowing what's being blocked. Without knowing what's on the filter list, parents can't know what Junior will or won't be seeing. When reporters who try to reveal that information are faced with potential criminal investigations, the press's ability to shed light on these companies is threatened. Such programs also give parents near-complete control over what their children can and can't read. Traditionally, kids have been able to browse the stacks of a library away from parental supervision. But when the library is online, access can be completely controlled by censorware. Pity the closeted gay son of homophobic parents, prevented by CyberSitter from accessing soc.support.youth.lesbian-gay-bi. Finally, it's a kind of intellectual bait-and-switch. The "smut blockers" grab power by playing to porn, then they wield it to advance a right-wing, conservative agenda. Family values activists would never have been able to pass a law that blocks as many sites as CyberSitter does. Besides censoring alt.censorship, it also blocks dozens of ISPs and university sites such as well.com, zoom.com, anon.penet.fi, best.com, webpower.com, ftp.std.com, cts.com, gwis2.seas.gwu.edu, hss.cmu.edu, c2.org, echonyc.com and accounting.com. Now, sadly, some libraries are using it. Solid Oak claims 900,000 registered users. ###

1 0