December 2003 - cypherpunks-legacy

Call for Participants: The Financial Cryptography 1997 Workshop for Senior Managers and IS Professionals
by Robert Hettinga 17 Dec '03

17 Dec '03

CALL FOR PARTICIPANTS The Financial Cryptography 1997 (FC97) Workshop for Senior Managers and IS Professionals February 17-21, 1997 The InterIsland Hotel Anguilla, BWI <http://www.offshore.com.ai./fc97/> Workshop Update: January 29, 1997 FC97 is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> C2NET <http://www.c2.net/> See Your Name Here! <mailto: rackliffe(a)tcm.org> FC97 Workshop for Senior Managers and IS Professionals February 17-21, 1997 FC97 Conference and Exhibition, February 24-28, 1997 The Inter-Island Hotel Anguilla, BWI Workshop and Conference Reservations: <http://www.offshore.com.ai./fc97/> The world's first intensive financial cryptography workshop for senior managers and IS professionals will be held Monday through Friday, February 17-21 1997, from 9:00am to 6:00pm, at the Inter-Island Hotel on the Carribbean island of Anguilla. This workshop will be the prelude to the world's first peer-reviewed financial cryptography conference and commercial exhibition, Financial Cryptography 1997 (FC97), which will be held the following week, February 24-28, 1997. The goals of the combined workshop, conference and exhibition are: -- to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, -- to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, and, -- to showcase the newest products in financial cryptography. Workshop and Conference participants are encouraged to bring their families, though Workshop participants should expect to be busy the first week. :-). The Workshop Ian Goldberg, the Workshop chair, has picked an outstanding team of instructors in financial cryptography and internet financial system security to teach the courses in this workshop. The Workshop will consist of 40 hours of intensive instruction and lab time over 5 days. Each student will have their own internet workstation, and the lab will be open 24 hours. The SSL internet commerce server used in the workshop will be Stronghold, developed by C2NET, of Berkeley, California. For information on Stronghold, please see <http://www.c2.net/>. Thanks to C2NET for their gracious donation of this outstanding software to the FC97 Workshop. Who Should Attend The Workshop is intended for senior IS managers and technical professionals who want to get completely up to speed on the design, development, and implementation of financial cryptography systems, the core technology of internet commerce. After the workshop, senior managers will have a hands-on understanding the strengths and liabilities of currently available financial cryptography and internet transaction security software and hardware, and thus be able to make better asset allocation decisions in this area of explosive technology growth. Senior technical professionals with strong IS experience will be able to implement those technologies and to pass on what they've learned to their clients and colleagues when they return home. The Workshop will be held in a casual but intensive atmosphere at the very cutting edge of financial technology on the internet. Someone has likened the experience to a financial cryptography bootcamp. At the end, Workshop attendees will be utterly conversant in cryptography as it applies to finance, and will be quite prepared for the technical papers in the FC97 conference the following week. Workshop participants will not only know what everyone else is doing now in internet commerce, but, more important, because they understand the implications of strong financial cryptography on ubiquitous public networks, they will be able to know what to do *next*. The Workshop Leader Ian Goldberg is a Ph.D. student in security and cryptography at the University of California, Berkeley. Just last night, he cracked RSA Data Security Inc.'s 40-bit challenge cipher in just under 3.5 hours. In late 1995, he discovered what became a much-publicized flaw in Netscape's implementation of SSL. He is a recognized expert in electronic payment systems, and in DigiCash's ecash digital bearer certificate protocol in particular. He has produced several ecash clients for Unix and Windows, as well as an ecash module for the Stronghold web server, which has extended the existing ecash system for better security, privacy, and ease-of-use. The Principal Instructors Gary Howland worked on digital cash systems for DigiCash, and then moved to Systemics, where he developed the SOX protocol, a flexible payments system currently in use in a bond trading environment, soon to be available to the public. He also developed the Cryptix and PGP libraries in Perl, and assisted on the Cryptix and PGP library implementations in Java. Adam Shostack is a security consultant based in the Boston area. He has extensive background in designing, implementing and testing secure systems for clients in the medical, computer, and financial industries. His recent public work includes 'Apparent Weaknesses in the Security Dynamics Client Server Protocol,' 'Source Code Review Guidelines,' and comparisons of freely available cryptographic libraries. His clients include Fidelity Investments and the Brigham and Women's Hospital, in Boston. Additional Instructors The Workshop will have student-to-instructor ratio of 5 to 1, not including the Workshop leader. The Workshop will have an initial enrollment of 10 students, and an additional instructor will be added for each 5 students up to a 25 student maximum enrollment. Workshop Topics The following is the complete list of topics that the workshop will cover: Security on the Internet Internet Protocols: IP, TCP, UDP Higher-level Protocols: Telnet, FTP, HTTP, SSL Solid Foundations for Cryptographic Systems A History of Internet Attacks Building Internet Firewalls Building a Bastion Host Turning your Bastion Host into a Web Server Non-internet Internet Security Cryptography The Need for Cryptography History of Cryptography Classical Methods Modern Methods Private and Public Key Cryptography Authentication vs. Security Certification and Public Key Infrastructures Cryptographic Protocols Engineering a Cryptographically Secure System Why Cryptography is Harder than it Looks Security Through Obscurity and How to Recognize Snake Oil Internet Payment Systems Payment models: coin-based, cheque-based, account-based Security Issues Privacy and Anonymity Issues Smartcards vs. Software Existing Payment Schemes Credit Cards First Virtual CyberCash DigiCash Forthcoming Payment Schemes SET Mondex Millicent micropayments Setting Up an ecash-Enabled Web Server Setting up the Web Server Signing up for ecash Installing the ecash Module Setting Prices Logging Advanced Methods ecashiers moneychangers The workshop has been covered by Wired Magazine, and FC97 was the featured conference in the January 1997 "Deductible Junkets" section. So, if you have already decided to come to the FC97 Workshop and Conference, please register and make your plane and hotel reservations as soon as possible. Workshop space is extremely limited. The price of the workshop is $5,000 U.S. You can pay for your FC97 workshop ticket with Visa or MasterCard, with ecash, or with any of a number of other internet commerce payment protocols, at the regstriation site: <http://www.offshore.com.ai/fc97/>. The workshop price includes meals (but not lodging) at the InterIsland Hotel and lab space, plus the delivery and installation of hardware, network access, internet commerce software, all to a location like Anguilla. And, of course, 40 hours of instruction and structured lab activity. We have priced the workshop to be competitive with other comprehensive business and professional technology workshops of similar total session length. In addition, the first 10 FC97 workshop participants will receive a 50% reduction in their FC97 Conference and Exhibition fee, for a savings of $500 off the $1,000 conference admission. You can register, and pay for, your workshop ticket at: <http://www.offshore.com.ai/fc97/> Air Transportation and Hotels Air travel to Anguilla is typically done through San Juan, St. Thomas or St. Maarten/Martin. There are several non-stop flights a day from various US and European locations. Connection through to Anguilla can be made through American Eagle, or through LIAT, or in the case of St. Maarten, with a short ferry ride to Anguilla. See your travel agent for details. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your aviation staff for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties. PLEASE NOTE: Your FC97 Workshop fee only covers *meals* at the InterIsland Hotel. The InterIsland is actually a small guesthouse attached to a large conference facility, and so rooms there are in short supply. Fortunately, there are lots of small hotels and guesthouses nearby. For more information on these hotels, please see <http://www.offshore.com.ai/fc97/> for more information. Other hotels on Anguilla range from spartan to luxurious, all within easy walking or driving distance of the Workshop at the InterIsland. More information about Anguillan hotels can be obtained from your travel agent, or at <http://www.offshore.com.ai/fc97/>. Registration and Information for Other FC97 Events To register and pay for your ticket to the FC97 conference itself, see: <http://www.offshore.com.ai/fc97/> For information the selection of papers for the FC97 conference see: <http://www.cwi.nl/conferences/FC97> If you're interested in Exhibition space, please contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in sponsoring FC97, also contact Julie Rackliffe: <mailto:rackliffe@tcm.org> Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published on the web by the Journal for Internet Banking and Commerce. <http://www.arraydev.com/commerce/JIBC/>. The FC97 Organizing Committee: Vince Cate and Bob Hettinga, General Chairs Ray Hirschfeld, Conference Chair Ian Goldberg, Workshop Chair Julie Rackliffe, Conference, Exhibit, and Sponsorship Manager And our sponsors... The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> C2NET <http://www.c2.net/> See Your Name Here <mailto: rackliffe(a)tcm.org> ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

1 0

Re: RC5-12/32/5 contest solved
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Any bets on whether the $5000 RC5-12/32/6 contest will be solved before the www.rsa.com contest status web page is updated? :-) Or how long before someone in the government starts talking about how 56 bits takes 65,000 times as long to solve as 40 bits, which is 26 years for a whole building full of computers, and even 48 bits ought to take a month and a half for a whole building full of computers (or supercomputers, if they hype it up....)? At 09:55 PM 1/28/97 +0100, Germano Caronni <caronni(a)tik.ee.ethz.ch> wrote: >challenge: RC5-32/12/5 >time: from start of contest until Tue Jan 28 21:54:58 1997 >method: massive distributed coordinated keysearch, details later which was a bit slower than Ian Goldberg's crack, but pretty close. How many machines were you using, on average? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: AltaVista sprouts a hole ...
by Jeremiah A Blatz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert Hettinga <rah(a)shipwright.com> writes: > --- begin forwarded text > > > Sender: e$(a)thumper.vmeng.com > Reply-To: Russell Stuart <R.Stuart(a)rsm.com.au> > MIME-Version: 1.0 > Precedence: Bulk > Date: Wed, 29 Jan 1997 08:07:27 +1000 > From: Russell Stuart <R.Stuart(a)rsm.com.au> <snip> > However, the doubleclick.net ads appear to bear no relationship to the > keywords being searched, and they appear not only in the URL for the > hyperlink to follow, but also in the IMG SRC URL. This means that in > order > to avoid disclosing my keyword lists to doubleclick.net, I have to > disable > automatic loading of inline images when using AltaVista! Actually, the ads *do* relate to the keywords. Try doing a search for "flowers" and a search for "sex." http://www.anonymizer.com/ Jer "standing on top of the world/ never knew how you never could/ never knew why you never could live/ innocent life that everyone did" -Wormhole -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMu9TH8kz/YzIV3P5AQEL8AL/Tj6fj0hRMYZVK1ppuh/DSxtB89urgSDy DDmA6ycn0DmmUg1TL7w8k2vkN/srUfvddA6pu3vZGU8Pa3unA4LSAe3ipCygzuGK d1s0BW+Cy15HDjdTdFe9I0tYfjdNQo2B =26sJ -----END PGP SIGNATURE-----

1 0

Re: Best Computer School?
by Jeremiah A Blatz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matthew Toth <mst114(a)psu.edu> writes: > MIT is one the best schools in the country for C.S. > Close behind is Carnegie Mellon University (C.M.U.) in Pittsburgh, > PA. (the folks who put out CERT.) Not sure how much Crypto they do, though. I think there's one class on crypto (explicitly), but there's some talent here. One who was interested could get an independant study or a research job without too much trouble. After all, MIT isn't the only place that writes kerberos, AFS, and the like. (In case you're wondering, the "A" in AFS stands for "Andrew," of Andrew Carnegie.) Jer "standing on top of the world/ never knew how you never could/ never knew why you never could live/ innocent life that everyone did" -Wormhole -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMu9V+skz/YzIV3P5AQH/XgL/VFA/4M1XTD8xl86Y6GrtU46YGpmGnhn6 lDKSA/xaxAzUToPTXQdyNqY5xg5CpfwYraVEiyLIvWKsIvOWtJgG3cZzF+xqlx39 sgbM0L6aMXrXkGqLdosZMjrr9Rqc6KE5 =FTU1 -----END PGP SIGNATURE-----

1 0

Re: [DES] DES Key Recovery Project, Progress Report #7
by Anil Das 17 Dec '03

17 Dec '03

On Jan 25, 10:49am, James Robertson wrote: > > Are there any efforts being made to develop a version of the > software that can be used by us non-US residents? > > I would certainly like to participate in the Challenge. I'm > sure there are many other interested people out there, in the > big wide world ... No such development outside the US has been publicized. However, it is easy enough to roll your own. What you need: 1) Eric Young's libdes. ftp://ftp.psy.uq.oz.au/pub/Crypto/DES 2) Svend Olaf Mikkelsen's fast replacement for the core DES routine. http://inet.uni-c.dk/~svolaf/des.htm The latest libdes is supposed to have this faster routine incorporated already, so you may not need it. 3) Peter Trei's article on "Optimizing DES Key Recovery in Software". It is available at HKS's news server. news://nntp.hks.net/<199610171918.MAA23054(a)toad.com> For a first pass, you can just implement the Gray Code technique. That gives most of the speedup. 4) Some information on how to implement Gray Codes. "The Gray Code" by Robert W. Doran. Tech Report 131 from http://www.cs.auckland.ac.nz/~techrep/1996.html Given these resources, it shouldn't take long for a good programmer to implement a DES key search program that is in the same ballpark of performance as Peter Trei's implementation. -- Anil Das

1 0

Re: uae_1.html (UAE censoring Internet)
by Wayne Clerke 17 Dec '03

17 Dec '03

I've checked the filtering out already ... it's pretty extensive. Far, far more than Singapore's 'hundred' or so pages. The granularity is such that things like http://www.domain/~user/main may be passed, while a link from that page to a subpage may be blocked. I guess they can afford to do this with so few users and little traffic. Never thought I'd be real interested in how Net Nanny worked ... but I am now. I'd be happy to hear from anyone with good ideas (or (accessible) pointers) about how to minimize the effects of this stupidity ... :-( Regards, Mail: <a href=mailto:wclerke@emirates.net.ae>Wayne Clerke</a> PGP key ID: AEB2546D FP: D663D11E DA19D74F 5032DC7E E001B702 PGP mail welcome. Voice: +971 506 43 48 53 If you're not living on the edge, you're taking up too much space. ---------- > From: Lynx_User(a)linux.nycmetro.com > To: cypherpunks(a)toad.com > Subject: uae_1.html > Date: Tuesday, 28 January 1997 12:26 > > > Reuters New Media > > > [ Yahoo | Write Us | Search | Info ] > > > [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | > Entertain | Health ] > > _________________________________________________________________ > > Previous Story: UK Bill To Fight Millennium Computer Bug Moves On > Next Story: Intel to Europe: Get Online Or Fall Behind > _________________________________________________________________ > > Monday January 27 9:50 AM EST > > UAE Launches Service To Censor Internet > > DUBAI - The United Arab Emirates's monopoly Internet provider launched > a service Saturday to censor sites in cyberspace that breached local > moral values and traditions. > > Officials from state telecommunications company Etisalat said the new > Proxy Service would be compulsory for the UAE's 9,669 subscribers, who > will have to configure their web browsers that navigate the net by > February 2. > > "The service was launched today as part of our efforts to improve the > Internet service to our subscribers after lengthy study and research," > said one official at Etisalat. > > "We were working on it before some official statements were made on > the need to control access to some sites on the service," he told > Reuters. > > The move follows repeated calls to regulate access to the Internet in > the conservative Gulf region, where most women are veiled, magazine > pictures revealing cleavage or bare legs are blacked out and > questioning the existence of god can be punishable by death. > > Some are worried about the spread of pornography as well as religious > and political material through the worldwide network of interlinked > computers. > > Last year, Dubai Police chief Major General Dhahi Khalfan Tamim > created a rare public row in the UAE saying the information ministry > and the police, rather that Etisalat, should be authorized to issue > Internet licenses as it was their job to monitor data coming into the > UAE and maintain security. > > Telecommunications experts say the Proxy Service will not be "fully > water-tight," but would help block access to known and unwanted sites > -- a list of which could be constantly updated. > > The proxy server will be pre-fed with Internet addresses where access > is blocked off, industry sources said. But the server will be unable > to block access if addresses of prohibited sites are changed, as > frequently happens. > > Etisalat says it will disconnect any customer who abused its Internet > services and violated "order and clear laws." > > "Singapore has succeeded to a great extent in its drive to control > harm done by the Internet," said another Etisalat official. "Why > cannot we?" > > Singapore government measures to regulate political and religious > content on the Internet and keep it free of pornography became > effective in July last year. They require all Internet service > operators and local content providers to be registered with the > Singapore Broadcasting Authority. > > Copyright, Reuters Ltd. All rights reserved -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2i mQDNAy/T4WIAAAEGAMoa0wYpHlGTFe7fEJeKoDs9xaiSt0/lSjN8u8APrqRg1S+v Z9AXoZ9jnDWzEE8t75PieCPNx8PlX5Z1rnwXfYjpEGR4JiYFBC4ThO8zHE+3V4vv 3JihVe8RpI6Cl+6lLspxh5xVlC6Ode5s+CGvUG1aKqNG5PcI9KSzmnUgyC7UFV66 63ySxOiG2I8KPF3Dx9svk2B76JV/f+9LmuHcJuargmlZSZ3+LXdAOIHJoXKH4uPA fkpiJUvUX8gorrJUbQAFEbQmV2F5bmUgQ2xlcmtlIDx3Y2xlcmtlQGVtaXJhdGVz Lm5ldC5hZT6JAJUDBRAw418r3ic1/dqHwMcBAdZxA/9KFTdRSV12mvi9PogHZ+Vp qXwwxfi7PufQsnZ+QJyXcZ9AXlZg4KGok6/EHCrRmolGyNvmn48nY46BTF/ztS// KpK14TQPnBytKg3cz+bqq9yVVKga5ryF56PYK5SSp3doouNG8yOQkLK6NppbPc7O wjyfHWkgZzKuVDpf/w/Hf7QpV2F5bmUgQ2xlcmtlIDx3Y2xlcmtlQGV4dHJvLnVj Yy5zdS5vei5hdT6JAJUDBRAw42AT3ic1/dqHwMcBAaYUA/9+H96ZnKQpQ2igwRkb hCy1MrvoOddvfSyL5g+V2PdhraLQDE753hJNtC+rRnZYRI9DdrIh3Pio8hqlCoqF cWo2GRaaxh4nqe+UXcTCOKFZ8sX6S8Jfvz2NeYjdkDsuza7r4vI3w9fxWjFG/Q6A +UAuDLfuIF54oA7fXap4r98eS4kA1QMFEC/T5sDUX8gorrJUbQEBbcEF/1x4XLSo UheynBv9lZtVDYdzg5qBQRUKMlHeKHvuDvLHHhCnxy0EqID4sloQAW3hAIf33sCE Os08LWB+VsNtE3nqkrfs54vEdm+OnCiBTwT2o9bcjMXjwSUhEBT0/1dsDGP4boGg gsR6fgaks8kIjuTiLeCJ0aSlVz7VVNgBr8klj1Vi8vMrTrs5jpx9Rh4/DLa8HvXl isr4RHDx290J5yd66U5dwPtwL5PcSGqFWtGfyFUpFjrB92sIzU4cE9+WzokAVQMF EC/T5pxJuCRZ+BFKkwEBHtoCAI/0vtRlvDE4+IMWTfOmU/TuJM80ltVZl9+MOdn3 4EGSf5TO5MIGu9sLIO+mTTTZXZNbFNo0AMyUZAEVDh+JEGQ= =fHhI -----END PGP PUBLIC KEY BLOCK-----

1 0

Libel & the 1st Amendment
by Jim Choate 17 Dec '03

17 Dec '03

Hi, It has been asserted by at least one member that the 1st Amendment protects libelous or other defamatory speech. This is hokem. The 1st most certainly does not protect lies in any form. It protects opinion, this is distinctly different then stating a untruth about some party or distribution of material with the attributation to them without their permission. No civilized society can exist that permits lies and other defamations of character and expect to survive for any length of time. Simply for no other reason than contracts and other such instruments would not be worth the paper they were printed on. Let alone any laws or other issuances from the government itself. ARTICLE I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. Where in there do you see a right to lie, cheat, or steal? If it did, it would be a lie because it would not protect the very freedom it says it is. Jim Choate CyberTects ravage(a)ssz.com

3 2

Re: Last nail for US crypto export policy?
by Steven Bellovin 17 Dec '03

17 Dec '03

It is dangerously naive to label this success the ``last nail for US crypto export policy''. Everyone concerned with this issue, from the NSA to the FBI to anyone who wants to use crypto, understands this and accepts it. 40-bit keys are good for protection against casual snooping, and nothing more -- and no one is going to claim that you need supercomputers to crack them. In fact, I assert that the U.S. government is *happy* about these results -- because it's going to push folks towards wanting stronger crypto for export. The only problem, of course, is the terms under which such code can be exported... I'll go further -- in my opinion, the only reason the government doesn't want DES to fall just yet is that alternatives aren't ready. That is, the banks and financial institutions, and for that matter the government agencies, have not converted to 3DES or Clipper or what have you, and can't do so on short notice; the commercial products they need just aren't ready yet. No one wants to risk a loss of confidence in the financial system. Two years from now, though, when some key escrow products are ready, it may be a different story.

1 0

Re: Getting into MIT is impossible
by Rick Osborne 17 Dec '03

17 Dec '03

At 06:45 AM 1/29/97 +0100, Anonymous (Xanthar) wrote: >Most intelligent people apply to several schools, knowing that >admissions practices are subject to the vagaries of reality. If you are implying that I was not intelligent enough to apply to more than one school, then you are mistaken. MIT was the *only* school out of the six I applied to (including CMU, CalTech, GaTech) that turned me down. >My guess is that "other factors" were involved. I'm sure that was probably true. I'm just saying that I doubt the admissions process is as Financial-Aid-blind as they would have us believe. >MIT offered me a substantial economic aid package, in the form of loans, >grants, and various campus jobs. What does this tell you? It tells me that you're a better man than I, I guess. I'm sorry if I sound bitter, but one does not work for a goal for over a decade of his life, get rejected for it, and then just "forget it". Anyone who tells you otherwise needs to see a therapist. _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Don't have awk? Use this simple sh emulation: #!/bin/sh echo 'Awk bailing out!' >&2 exit 2

1 0

FBI=LIE
by Adam Shostack 17 Dec '03

17 Dec '03

http://www.nytimes.com/yr/mo/day/news/washpol/fbi-lab.html Login cypherpunks, password cypherpunks. WASHINGTON -- For decades the FBI's reputation as a crime-fighting agency has rested heavily on its high-tech forensic laboratory, which could solve baffling crimes from a speck of blood, a sliver of paint or the thinnest filament of human hair. But an investigation by the Justice Department's inspector general has put the FBI laboratory, and the way the agency has used it, under the glare of public scrutiny. The findings, which were turned over to FBI officials last week, are threatening to shatter the image of an agency on the cutting edge of scientific sleuthing. [...] -- "It is seldom that liberty of any kind is lost all at once." -Hume

2 1