December 2003 - cypherpunks-legacy

Threats of Legal Action and C2Net/Stronghold Issue
by Tim May 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.cypherpunks, alt.privacy, comp.org.eff.talk) At 6:07 PM -0800 2/16/97, Sandy Sandfort wrote: >Curiously, in a subsequent telephone conversation, Tim May >proposed almost that exact suggestion as an alternative form of >moderation that he said would have been acceptable to him. Go >figure. The only phone conversation I had was with Doug Barnes, at the request of Doug that I urgently phone either him or Sameer. I called Doug as soon as I got the message. (Doug also said he was the only one in the room at the time, and that the call was *not* being recorded, so I have to surmise that Sandy got his version of things via a recap by Doug.) >> 21. Tim received a warning from C2Net's lawyers that if he did not >> desist from mentioning that Dimitri had posted an article criticising >> a C2Net product that he would be sued! > >Absolutely false. > What Doug told me was that Dimitri Vulis had already been served with a legal notice about his warnings about a security flaw in Stronghold, and that any repetition of Dimitri's claims by me or anyone else would result in similar legal action. Doug said that any repetition of the claims, even as part of a quote, would be seen as actionable by C2Net. "We'll vigorously defend our rights." (as best I can recall) He said he thought my messages, to the extent they merely _alluded_ to the claims were probably OK and that they would certainly go through to the list, as Sandy has already resigned from his role as moderator. (For the record, these messages DID NOT GO THROUGH, and have not gone through as of tonight, 8-9 days later. However, I have forwarded them to several people who requested them.) (I also did not have a recorder running, so I can't claim this is a verbatim summary of what was said. As to what I said about how the moderation thing might have been done differently, Doug and I chatted for a while about various alternatives. I raised the point I've made before, that having a "members only" policy, with some special provision for some amount of remailed messages, would probably best suit the notion of keeping the "community" running. What I told Doug was that my main objection was having Sandy sit in judgement to essays folks might have spent a long time composing, and I cited physical parties, where a host invites those he wants in attendance, but does not micromanage or screen conversations being held at the party. My sense was that Doug agreed, and agreed that the whole thing had been handled in a bad way...but Doug should comment to tell his view of things.) The next day, at the physical Cyperpunks meeting at Stanford, I briefly talked to Greg Broiles, working as a legal aide at C2Net. I told Greg he could "take his best shot," in terms of filing suit against me about my messages, as I'm prepared to fight C2Net in court on this matter, and have the financial resources to hire some pretty good lawyers. (I don't recall if Greg replied, or what his reply was.) In a message to Cypherpunks, I outlined my understanding of the Vulis report on security flaws in Stronghold, and put the claims in the context of messages not appearing on either of the two main lists, but none of my messages were sent to either the Main list or the Flames list. (I also had communication with several members of the list, some known to me and some only pseudonyms. I have taken the precaution of erasing these messages and copying files to the disk on which they resided to head off any attempts by C2Net seize my computer and disks as part of some "discovery" process.) I find it unfortunate that C2Net is behaving in such a manner, and their actions are generating far more publicity about the claimed security flaws in Stronghold than the original Vulis message ever would have generated. Sunlight is the best disinfectant, as a Supreme Court justice averred. And suppression is a breeding ground for all sorts of bacteria, fungi, and ugly growth, as a less articulate person said. Reporters interested in this story have already contacted me. They're interested in the situation surrounding the claims of a flaw. I told one reporter I had no expertise in Stronghold, SSL, etc., and could not say, but that I suspected strongly that the claim was made just as a "tweak" of C2Net. "Truth is an absolute defence against libel claims." (P.S. To repeat, I doubt there is a flaw in Stronghold, either introduced by RSA (Republic of South Africa, of course) or by the NSA, or by C2Net, or by anyone else. I said as much in my messages which never made it to the list.) --Tim May -- Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: The EFF
by Dale Thorn 17 Dec '03

17 Dec '03

aga wrote: > On Sat, 15 Feb 1997, Dale Thorn wrote: > > Toto wrote: > > > Timothy C. May wrote: > > > > At 9:36 AM -0800 2/14/97, Declan McCullagh wrote: > > > I have a brother-in-law who gives seminars to the Nouveau Riche in > > > the Bay Area, teaching them how to give their money away to 'good' > > > causes. I believe that one of the prime considerations in separating > > > the 'good' causes from the 'bad' causes has something to do with the > > > the proper wine being served with the cheese and cracker offerings > > > during their cocktail parties. > > Wine and cheese are the key. You hit that one on the head. I tried > > those Mensa parties in Beverly Hills a few times, but the girls want > > you to kiss their hands like some kinda princesses or something, > > whereas I think a simple handshake would suffice. So I just quit > > going. Maybe this has something to do with why there are no c-punks > > meetings in the L.A. area. > Dale, so you are in mensa? Did you have to take a test? I joined in 1986 at the urging of my sort-of lawyer (not a real lawyer, but much better actually) from Beverly Hills. He liked the parties since he was trolling for babes; recent (1986) divorce and all. Anyway, Mensa was accepting U.S. Military GT scores prior to 1980, and I scored 153 in 1966, which was the highest at the several posts I did duty in (Ft. Benning GA, Ft. Ord CA, Ft. Lee VA, 4th A.D. Europe). I gave up on it after a few meetings, since I didn't care for the parties, and there didn't seem to be any really active/interesting people there. There was a "rational sig" I wanted to attend, but never got around to. Mensa did put on some good speakers every now and then, but you could do as well by checking in with the Masons or the other local civic groups.

1 0

test 527
by Kent Crispin 17 Dec '03

17 Dec '03

test 527 -- Kent Crispin "No reason to get excited", kent@songbird.com,kc@llnl.gov the thief he kindly spoke... PGP fingerprint: 5A 16 DA 04 31 33 40 1E 87 DA 29 02 97 A3 46 2F

1 0

Re: The Science Generations, II
by E. Allen Smith 17 Dec '03

17 Dec '03

From: azur(a)netcom.com (Steve Schear) >Regarding amateur experiments with 'real' rockets, the Fed have passed a >plethora of laws effectively resticting what non-governmental bodies may >investigate. See 14 CFR PART 101, 22 CFR Sec. 121.16 and 49 CFR Sec. >173.88. I guess I can't play with matches anymore. Thank you Congress. What precisely do those laws say? As a scientist, I have somewhat of an interest in such subjects, and I don't have very good access to legal databases. (For instance, I tried the Library of Congress search system for laws passed since 1973... and the thing's indexed by _title_ of legislation, not the more standard designation you gave...). Thanks, -Allen

1 0

Russian Sigint
by Dave Emery 17 Dec '03

17 Dec '03

> > I found this on The New American web page. ? > > > GRU Snooping Continues. The interception, taping, and publication of a > conference call between Newt Gingrich and other congressional leaders > demonstrates the susceptibility of microwave-transmitted electronic > communications to eavesdropping. A growing number of intracity phone calls, > e-mail, and faxes, as well as nearly all long-distance calls, are carried via > microwave. But it's not just itinerant Democratic Party activists with police > scanners who can listen in on microwave communications. > This is complete horse pucky. Microwave is less and less and less used for long distance communications in the US. Very little traffic now flows over microwave links - fiber has so much higher capacity and better data error characteristics that it has nearly completely taken over long distance telephone and data communications. A typical microwave link can carry 45 or maybe 130 megabits per second maximum per rf channel and maybe has 6 rf channels in use at a time maximum whilst current fibers carry 1.5 Gigibits per fiber and can be upgraded to 3.0 Gigabits easily and way more than 10 Gbs with current WDM technology. Typical installed fiber routes have around 30 or more fibers just because it is as easy to install that many as one. The remaining active microwave links are primarily used as backup for fiber routes and may not be carrying live traffic at all. Virtually every route that used to be microwave has now had one or more fiber routes installed to replace it and if it hasn't they are planned or being installed now. At the best there are a few remote places where installing fiber is impractical that still communicate with the world on microwave links and there are a few microwave systems still in service to carry certain vital national survival and security traffic where they provide redundancy. Also, essentially all current common carrier microwave is now digital rather than fm-fdm-ssb. These high capacity and bit rate 64-QAM or 256-QAM signals are significantly harder to intercept and demodulate and demultiplex than the FM signals used until the late 80's were. This is especially true of reception from sites that see only marginal scattered signals rather than the direct beam, as digital radio tends to not work at all with marginal signals rather than being just noisy. I think that probably less than 1% of US long distance public telephone and data communications currently travel by microwave at any point in their journey compared to more than 68% at the peak of microwave usage in the early 1980's. And this figure is dropping steadily over time as more and more fiber is put in service. > As the Center for Security Policy (CSP) points out, the GRU _ the Main > Intelligence Directorate of the General Staff of the Russian Armed Forces _ > maintains signals intelligence ("sigint") facilities in Lourdes, Cuba, and > Cam Ranh > Bay in Vietnam which are capable of intercepting nearly all microwaved > communication across the continental United States as well as the Atlantic and > Pacific. This is not entirely true. Intercepting microwave signals from over the horizon is not possible except under truly extraordinary propagation conditions and then only for brief periods of time with gigantic antennas and from relatively nearby places. And the resultant scattered signal is of very poor quality and getting usable high bit rate data out of such scatter signals, as would be required to intercept common carrier traffic, is not easily possible. At the very best the Lourdes facility might possibly be able to see occasional microwave scatter traffic from southern Florida and the Carribean on very good days. This is hardly traffic from the entire continental US and one can be very sure that the NSA and other agencies responsible for thinking about US communications security have long ago arranged in cooperation with the long distance carriers to ensure that nothing of any great use was showing up. There are two catagories of microwave traffic those facilities can intercept - domestic and international satellite traffic from US satellites with footprints that cover the Carribean and whatever radio traffic is intercepted by Russian low orbit ferret satellites as they pass over North America and by high orbit monitoring satellites parked over the western hemisphere. Very little public point to point telephone and data traffic between points in the US is currently transmitted via satellite. Fiber is so much cheaper and better in quality that the carriers gave up satellite transmission of domestic traffic some years ago. There are some compelling reasons for this - the long 240 ms delay in transmitting traffic via geosynchronous satellite is very noticable to many humans in the give and take of conversations, and without special protocol provisions many data communications systems give horrible throughput over links with that long a delay as well as giving unnacceptably long echo delays in interactive applications. And satellite bandwidths are even less than terrestrial microwave bandwidths and compared to the vast amount of fiber now in service are just a tiny fraction of the total. Domestic communications satellites are primarily used for point to multipoint traffic such as credit card authorization systems for gas stations and stores and distribution of video to TV stations and cable companies, and broadcasts of data to large numbers of receivers. It is rarely cheaper and more cost effective to put point to point traffic on communications satellites. And most of what is there is traffic sent by private users of one sort or another such as large companies and government agencies - much of which is securely encrypted if sensitive. And that which is not encrypted is readily accessible to anyone with the right commonly available equipment and a vanilla satellite dish of the sort there are literally millions and millions of scattered throughout the US, Canada and Mexico - the potential threat from this source dwarfs what the Russians might do with the information (and is readily controlled by link encryption). Even international communications from the US are less and less routed via satellite as high capacity fiber trans-ocean cables are installed. I have seen numbers on the order of less than 10% satellite transmission of international traffic and as new optical amplifier cables are installed (which one can assume the UKUSA partners such as the US NSA get the entire bitstream from) this number is also plunging. And most international satellite communications can be monitored from the other end and do not have to be monitored from near the US. As a point of fact I would be more concerned that Russian submarines have tapped the trans-Atlantic and trans-Pacific cables somewhere than that the Russians pick up satellite communications. One hopes that the bitstreams on those cables are really securely link encrypted - doing so would seem to be a no-brainer - but I have never seen any reference to this being the practice. What capabilities Russian sigint satellites still have in the post USSR era of economic collapse where Russia has not been able to launch a single imaging spy satellite for several months and has no usable ones in orbit, according to a recent NY Times story, is not clear. Russian satellites have generally had a much shorter useful life in orbit than US satellites do and Russia and the Russian space program has been pretty poor and disorganized for the last several years. At best such sigint satellites could conceivably be used to monitor some few domestic microwave links that happened to put a usable signal in the direction of the satellite and were far enough away from other transmitters on the same frequency to be separated by antenna directivity enough to stand out. While a satellite in geosynchronous orbit could see all of North America, it is pretty certain that it could see only a rather small fraction of modern digital microwave links well enough to recover traffic from them. And it is absolutely certain that the capacity of the satellite to intercept and relay traffic is only a few microwave links simultaneously at most. This is hardly everything or more than a small piece in fact. It has been reported that Russian sigint satellites use laser optical links back to Lourdes rather than the Ka and higher frequency band microwave links that US equivalents have used to pass the signals they intercept, but one suspects that the relevant US agencies have probably used whatever means were necessary to find these links and determine what US traffic is being monitored and ensure that that anything truly important was routed by fiber instead. In any case, the value of Lourdes is primarily as a base for intercepting US satellite communications and as a conveniant place to put a ground station for sigint and ferret satellites where satellite to satellite relay is not required to get the signals back to a ground station. If Lourdes were shut down most of the sigint functions of these satellites could be operated from Russia using satellite to satellite communications of one sort or another. The only major loss would be the ability to intercept certain domestic communications satellite signals which use focused beams and not readily intercepted from other places where the Russians may have space to put antennas. And one suspects that the Russians could probably do most of this interception from covert sites under cover as legitimate satellite installations in the US and Canada or other Caribbean or Central American countries. In any case it is certainly not true that Lourdes can intercept a significant fraction of US telecommunications simply because most US telecommunications do not any longer travel via microwave radio. Lourdes undoubtably can intercept enough useful stuff to justify continuing its operation, but this is partly because of blind US government policy on encryption rather than anything else. This especially applies to cellular communications which can be intercepted from satellites (and of course by anyone with a scanner or modified cellphone as well). How well even satellites with large 100 or 200 foot dishes do at intercepting the dense network of US and other cellular systems with hundreds of transmitters going at once on the same frequency in the area of the footprint of the satellite receive antenna at 800 mhz I do not know. And tracking and identifying calls of interest when the satellite can intercept only some cells on some cellsites reliably must be fairly hard. In any event the US operates several sigint satellites of much more advanced design and capability than Russia and has for many more years than the Russians have. And it is widely reported that the US has worldwide ground monitoring stations listening to essentially all communications satellites in the Clarke orbit and probably any that aren't that could possibly carry useful traffic. Our capabilities and technology and expenditure in this area is well beyond anyone elses. Furthermore, according to the CSP, "it is believed that both the > Russians > and the Cubans are developing capabilities at Lourdes to conduct information > warfare (IW). Such a capability would permit these facilities to be employed not > only to intercept information [but also to] make it possible for Moscow or > Havana > to manipulate telecommunicated information so as to deny the American people > and their government vital services or otherwise work against U.S. interests." > There may be some capability to jam US commercial communications satellites which for the most part have not any kind of protection against such jamming. Vital US military communications satellites do. Successfully conducting man-in-the-middle attacks on terrestrial microwave communications from Clarke orbit is difficult at the very very best and probably essentially impossible simply because of the 240 ms delay involved and the enormous difficulty of sucessfully interjecting the right kind of signal into a microwave link that uses highly directional antennas and modulation techniques that are amplitude sensitive such as QAM. And one can certainly assume that the US is carefully watching Russian sigint satellites at all times and would certainly know immediately if they started radiating enough signal to disrupt or spoof US communications systems. Of course all sigint yields information such as passwords and encryption keys and spectral signatures of speakers and call addressing and routing information (traffic analysis) that can be used to good advantage in later active man-in-the-middle attacks. And one can certainly assume that the Russians and many other governments including the US have spent considerable effort developing active penetration and disruption capablity. It has even been reported that the US has been using this to force network traffic to be routed in Europe via facilities the US can monitor. > According to former GRU Colonel Stanislav Lunev, "The strategic significance of > the Lourdes facility has grown dramatically since the secret order from Russian > Federation President [Boris Yeltsin] of 7 February 1996 demanding that the > Russian intelligence community step up the theft of American and other Western > economic and trade secrets. It currently represents a very formidable and > ominous > threat to U.S. national security as well as the American economy and > infrastructure." > > Yet the Clinton Administration insists that it is in America's interest to > allow the > GRU to continue its eavesdropping on the U.S. In congressional testimony > delivered on March 16, 1995, Assistant Secretary of State for Inter-American > Affairs Alexander Watson asserted that pressuring Russia to discontinue sigint > activities in Cuba "could limit our ability to promote reform and stability > in Russia" > as it could "be seen by the Russians as interfering with the exercise of > their right > under the START Treaty to monitor compliance with the agreement...." > And of course if we pressure them and other governments to abandon sigint operations they can and will start to do the same to us. And ours are greater in magnitude and productivity than theirs. > As with so many other issues, the Clintonites and the Soviets are reading > from the > same page regarding the Cuban sigint facility. Izvestia reported last > November 30th > that the U.S. "does not object in principle to the continuing existence of the > electronic center in Cuba...."i > One can make the argument that sigint for national security purposes is stabilizing and not altogether a bad thing. Many of us who are at least dimly aware of the technology fear its potential in the hands of a future fascist police state greatly, but one suspects that the Russians do not use the information effectively to damage US interests. After all we are the top economic and military power in the world and they are nearly in third world status economicly and have a rapidly deteriorating military. Perhaps the greatest risk from their Soviet era sigint capabilities is that information will leak from starved intelligence agency employees and officials to the Russian criminal mafias and benefit organized crime. There is certainly potential there for mischief, especially considering that a good amount of criminally useful information flows unencrypted over radio communications in the US. If I was in the US government and thinking about the threat of the Russian sigint capability I would be pushing for more use of encryption in domestic commercial communications and especially such things as cellphones and wireless data systems. Universal link encryption with secure ciphers of such radio based communications systems should not impact lawful interception of communications one iota since the government can always request wiretaps using their spiffy new digital telephony tapping capablity. The carriers would always have access to the unencrypted traffic after all and could forward it to the government. And many of us think that end-to-end encryption of traffic is a better choice in the long run than no encryption, even if it locks out the government (and everyone else) from easily, and in large quantities, fishing through traffic. One supposes that the government will always be able to obtain most traffic it wants badly enough, through cryptanalysis, TEMPEST, rubber hose cryptanalysis, black bag jobs, bugging, and the perfidy of informants of one sort or another, and of course most of all - carelessness and ignorance about INFOSEC and bugs and configuration problems in software. But I would also be mindful that the Russians have decreasing intelligence capability to monitor US intentions and perhaps allowing them some access will keep them from developing paraniod fears of US intentions. The Russians probably still have a few working ICBMs after all... In any case enough of these speculations. Perhaps a semi-retired telecommunications/computer engineer such as myself with access only to public information gets the picture completely wrong. And perhaps not. I do know it is definately and without a doubt not true that more and more domestic communications flow over microwave point to point radio, however. And I think that anyone propagating that myth deserves a correction. Dave Emery die(a)die.com Weston, Mass.

1 0

Re: Modified Clipper chip - HA! (fwd)
by Dave Emery 17 Dec '03

17 Dec '03

>For all of you who didn't see the last X-Files ... >Mulder made a visit to The Lone Gunman about breaking into some >impenetrable system. >Byers points out that "Yeah, that system is pretty hard to get into." >Mulder then inquires "well how did you guys get in?". >Byers replies cooly: "We used a modified Clipper chip we bought back from >the Chinese." >I didn't stop laughing for 5 minutes ... :) >_________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ I don't know whether this guy knows it or not but mainland China buys huge quanities of DoD surplus scrap electronics. The material is required to be mutilated but stuff slips through. I have seen it myself. The little bit on X-files noted above is not as far fetched as one might believe. ..Jim <:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:> <:> Jim Conrad - Ocean View Communications - jjc(a)infi.net <:> <:> 757-490-8127 Office - 757-587-8251 Fax - 757-473-6740 Pager <:> <:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:>

1 0

The Science Generations, II
by azur＠netcom.com 17 Dec '03

17 Dec '03

Just a short update to our discussions regarding the 'dumbing down' of America. Although Gilbert appears to have gone out of the business I did find a few chemistry sets at my local hobby store. They were certainly a far cry from the bunsen burner and lab glassware I grew up with, they all appear to use micro amounts of reagent in pipette tubes. I doubt they will generate the excitement we experienced. BTW, regarding the difficulty in obtaining chemical reagents (unless you're in a qualified educational program or professionally employed at a large industrial company), I came across a relatively new company targeting the amateur scientist, Chemical Resale of Santa Barbara <http://www.sb.net/wirehead>. It carries only a limited selection and prices seem very high (undoubtedly due to his small volume). Regarding amateur experiments with 'real' rockets, the Fed have passed a plethora of laws effectively resticting what non-governmental bodies may investigate. See 14 CFR PART 101, 22 CFR Sec. 121.16 and 49 CFR Sec. 173.88. I guess I can't play with matches anymore. Thank you Congress. --Steve

2 1

SSZ Test [No Reply]
by Jim Choate 17 Dec '03

17 Dec '03

Test Sunday - No Reply

1 0

test 527
by Kent Crispin 17 Dec '03

17 Dec '03

test 527 -- Kent Crispin "No reason to get excited", kent@songbird.com,kc@llnl.gov the thief he kindly spoke... PGP fingerprint: 5A 16 DA 04 31 33 40 1E 87 DA 29 02 97 A3 46 2F

1 0

Re: When and where?
by Bryan Reece 17 Dec '03

17 Dec '03

Delivered-To: reece(a)taz.nceye.net Date: Sun, 16 Feb 1997 20:57:51 -0500 (EST) From: Jeremiah A Blatz <jer+(a)andrew.cmu.edu> Sender: owner-cypherpunks(a)toad.com Precedence: bulk -----BEGIN PGP SIGNED MESSAGE----- camcc(a)abraxis.com (Alec) writes: > Please post the date when this list will shift to Usenet if that is indeed to > happen. I have not been able to sort out the facts (?) from the speculation, > argument, and gas. > > I have requested my ISP to add alt.cypherpunks to the mail server asap. I hope you misspelled "news server." alt.cypherpunks (and subgroups) is a newsgroup. > I don't want to miss a second of the resurrected (or is that born again?) > c'punks. You should join one of the distributed mailing lists (choose the list admin you like/trust the most). There is supposed to be a gateway between the mailing list and the newsgroup, but it is not up yet. Here's the overview: cypherpunks(a)toad.com is going away. In its place is a distributed forum. This forum is currently made up of a network of mailing lists, which send all their messages to each other. In the future, the newsgroup alt.cypherpunks will be added to this network (posts to the newsgroup go to the mailing lists, mail to the lists goes to the newsgroup). The mailing lists will be faster than the newsgroup, the newsgroup will probably let you use better filtering tools. Your choice. HTH, Jer "standing on top of the world/ never knew how you never could/ never knew why you never could live/ innocent life that everyone did" -Wormhole (Cool, "newsgroup" is the first word in four consecutive lines. I did not do this on purpose, even.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMwe7G8kz/YzIV3P5AQE/lwMAl9FsFoIKk8KF87nDUfczmO3dxo4bDANe bxaF9/daqiyR+Ck8vuTZw7YNc0DrsmEDY+Mr0WMuUrcybngagIxsQyuo56jETdLC T93ixsHuO7jhW4075ipfH/5MWMkI1zKz =G83r -----END PGP SIGNATURE----- --

1 0