December 2003 - cypherpunks-legacy

Internet Child Pornographers Convicted [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > CNN logo > Navigation > > Infoseek/Big Yellow > > > Pathfinder/Warner Bros > > > > > Main banner AST. Working For Your Business. rule > > INTERNET CHILD PORNOGRAPHERS GET LONG JAIL TERMS > > October 23, 1997 > Web posted at: 3:24 p.m. EDT (1924 GMT) > > SAN JOSE, California (Reuters) -- Three members of an international > child pornography ring that used the Internet to transmit pictures > of children were sentenced to jail. > > The men were jailed for their part in a wide-ranging, Internet-based > conspiracy in which several children, aged 10 or younger, were used > in sexually explicit acts to produce pornographic pictures and > videotapes, the U.S. Attorney's office said. > > U.S. District Judge James Ware on Wednesday sentenced the three > members of the "Orchid Club" in a San Jose courtroom after a long > hearing that included poignant personal statements by the victims. > > The U.S. Attorney's office in San Jose said Ronald Riva, 38, of > Greenfield, California, was sentenced to 30 years in prison; David > Tank, 35, of Cheney, Washington, to 19 years and 7 months; and > Christopher Saemisch, 38, of Lawrence, Kansas, to 11 years. > > Copyright 1997 Reuters Limited. All rights reserved. > > > rule > > Related stories: > * Officials focus on Internet use in sex crimes - October 8, 1997 > * FBI: Internet pedophiles a growing threat - April 8, 1997 > * FBI cracks down on child pornography on the Internet - April 7, > 1997 > * 12 arrested in computer pornography sweep - September 14, 1995 > > Related sites: > > Note: Pages will open in a new browser window > * Crime on the Superhighway > * Child Safety on the Information Highway > > > > External sites are not endorsed by CNN Interactive. > > > _________________________________________________________________ > > Infoseek search ____________________ ____ ____ > > _________________________________________________________________ > > > rule Message Boards Sound off on our > message boards > > You said it... [INLINE] AST. Working For Your Business. rule > To the top > > © 1997 Cable News Network, Inc. > All Rights Reserved. > > Terms under which this service is provided to you. >

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

aba(a)dcs.ex.ac.uk wrote: > We didn't say: "don't have disaster recovery for stored data." (Well > I didn't and I don't think Mark did either). Yep. While there are much better options, I think PGP's CMR would be a tolerable short-term solution for stored data. The problem is that it's not for stored data, it's for email (or so 'Commerical MESSAGE Recovery') would imply. Note that solely using CMR for stored data would not require that the CMR 'feature' be built into freeware or personal versions of PGP, but only into the corporate version. That in itself would be a big win. Mark

2 1

Universal Piracy Service
by Dan Fabulich 17 Dec '03

17 Dec '03

While browsing I came across an announcement for the Eternity Service which mentioned that Eric Hughes gave a talk at DEFCON IV regarding a "Universal Piracy Network," but I couldn't find anything using web searches. Does someone have more information on this? -ACCEPT NO IMITATIONS-

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Kent Crispin wrote: >Words fail me. This is completely idiotic. Indeed. It's just as idiotic as people being killed for receiving encrypted mail in Iraq. It is, however, just as possible, and anyone who believes the contrary obviously hasn't worked for a big company before; I've seen them do far, far, more idiotic things in the past. Mark

2 1

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

>Gee, Mark, I thought it was the SMTP filter that did the enforcing. >Maybe if PGP didn't call it "CMR" but instead called it something >neutral like the "key link field". Duh, without the 'mandatory voluntary' encryption to multiple keys, the enforcer couldn't work. Sure, the Feds could say 'encrypt to the FBI key or else', but users wouldn't be able to do so automatically without getting scripts to do so and the revolt would be too large for even the FBI to handle. It must be done automatically in the software, or it won't work. >Let's see, your scenario involves putting super sniffers at strategic >positions throughout the net, and passing laws that not only supports >this, but makes it illegal to go around them. I suggest that if such >laws are passed PGP's software is the least of your problems. How is this significantly different from mandatory wiretap access laws which already exist? Since it only requires action on the part of Internet providers, it's not going to raise the kind of outcry that other more widespread laws would create. >To make it plain, Mark, I "explain it away" this way: fundametally, >your scenario assumes what it is trying to prove -- you assume that >incredibly draconian laws are in place, Incredibly draconian? In what sense? Having to set a bit in your generated PGP keys? It certainly would be draconian if the FBI passed such a law today and required everyone to dump their software in favor of new, GMR-enabled software, but all new copies of PGP are already GMR-enabled. In fact, the FBI could probably stage a public relations coup by giving away free copies of PGP to anyone who asked. Draconian would be coming around to your house and taking your keys by force. Draconian is not merely enabling an option which your software currently supports. The whole point of not wanting PGP to ship this system is that it would allow the FBI to snoop *without* truly draconian laws. Without the current CMR system the FBI would have to force everyone to change to new software; deployment wins. As I said, 'don't worry, it won't happen, be happy'. Nothing new. Mark

1 0

Forgery
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Forgery is the sincerest form of plagiarism.

1 0

IW resources
by Steve Schear 17 Dec '03

17 Dec '03

I was cleaning up my HD when I came across a 43 page PowerPoint presentation by Carlo Kopp called "The E-bomb - A Weapon of Electrical Mass Destruction." It contains a good amount of technology, use and threat assessment data for this sort of EW device. Very professional. It was given at IWC-V 1996. A good candidate for amateur experimentation ;-) A little alta-vista search brought up Kopp's home page (with links to the above paper) and a wealth of related material, in particular http://www.au.af.mil/au/2025, the Austrailian Air Forces Year 2025 look in to the future, with a link to http://www.xp.hq.af.mil/xpx, the US Air Force's Strategic Planning Directorate. Very good IW reading. --Steve

1 0

RE: PGP Employee on MKR
by Fisher Mark 17 Dec '03

17 Dec '03

>> Not to mention that *ANY* crypto system can be turned into GAK if >> the FBI & NSA get congress to pass the laws that they want. > >Yes, but PGP WANT TO BUILD THIS INTO EVERY SYSTEM THEY SELL!!!!! I don't >care that any Perl hacker can write a script which builds CMR into PGP >2.6.2, because those scripts are restricted to those who wish to use >them. PGP ARE BUILDING THE FUNCTIONALITY INTO EVERY PRODUCT THEY SELL!!!! But the changes to add GAK/GMR/CMR to PGP (or any other crypto product that permits multiple recipients) are close to trivial. Don't be fooled into thinking that if PGP takes this "feature" out (can't be a bug -- it's documented :) that that will make it a lot harder to add that feature back in once the appropriate laws are passed. Still, in retrospect, PGP's engineers and scientists should have thought about all the security implications of CMR -- they might have implemented CDR to begin with. ========================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm(a)indy.tce.com Indianapolis, IN "Their walls are built of cannon balls, their motto is 'Don't Tread on Me'"

2 1

The spoofers have gotten more sophistocated!
by vcarlos35＠juno.com 17 Dec '03

17 Dec '03

The people that have been spoofing Jason Bobier, Philip Zimmerman, and Randall Framer have recently become more sophistocated in their techniques. They started with barely disguised headers and moved to equally lame PGP signed messages (that nobody in their right mind would accept, since the public keys have NO TRUSTED INTRODUCERS). Next, they progressed to faking the server-bounce messages to avoid giveaway headers. For example, they did a very good forgery of a email message supposedly coming from PGP, even included the "shival.pgp.com" and "fusebox.pgp.com" portions with correct IP addresses and all. I have a feeling this problem will only get worse....

1 0

Re: PGP Employee on MKR
by mark＠unicorn.com 17 Dec '03

17 Dec '03

whgiii(a)invweb.net wrote: > There is a simple solution to that don't work for one if you don't like > their policies. I agree; that's why I don't. But I see an inconsistency here. PGP keep telling us that CMR isn't so bad because you can work around it, or superencrypt, or otherwise avoid the company's right to snoop on all communications. Yet you, who believe in this right, support CMR, which can be used to defeat that right, over simple escrow of employee's corporate communication keys. Why? Again, I'm not saying that the companies have no such right. Personally I'd rather escrow my corporate key than see widespread CMR in its current form. Mark

2 1