December 2003 - cypherpunks-legacy

IP: Pentagon curbs Web content
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

From: believer(a)telepath.com Subject: IP: Pentagon curbs Web content Date: Sat, 19 Sep 1998 07:43:45 -0500 To: believer(a)telepath.com Source: ComputerWorld http://www.computerworld.com/home/news.nsf/all/98091838dod (Online News, 09/18/98 01:07 PM) Pentagon curbs Web content By Sharon Machlis Top Pentagon officials are scouring military Web sites to see if too much information is being made public -- data that could potentially help the country's enemies. Some observers fear that listing members of specific military units could help terrorists find revenge targets, for example, particularly after an operation such as the recent missile strikes in Afghanistan and the Sudan. "Basically, the military does stupid things," said Ira Winkler, a former analyst at the National Security Agency and author of the books Corporate Espionage and Through the Eyes of the Enemy. "The military does not exercise good operational security when it comes to their Web sites ... There's no valid reason for a military unit to have a Web site," Winkler said. Deputy Defense Secretary John Hamre and the military's Joint Staff have been checking for Web postings such as building plans, research and development efforts and "personnel information that could perhaps provide too much information," said Defense Department spokesman Kenneth Bacon, in a statement. A more formal, militarywide policy on what should and shouldn't be put on the Web is in the works, added department spokesman Susan Hansen. Winkler said it is ill-advised to post things such as personnel lists or commanders' biographies -- which often include family information -- on the Web. He also recommended against companies posting similar information about corporate officers. In fact, some companies already restrict the data they post about personnel and even product pricing -- although the concern is less about terrorists and more about competitors. "We're in the process now, as I believe many private companies are, of trying to sort out what the right balance is between providing useful information and providing more information than is necessary," Bacon said. Copyright © 1998 Computerworld, Inc. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer **********************************************

1 0

IP: Use of SWAT Teams on the Rise
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

From: believer(a)telepath.com Subject: IP: Use of SWAT Teams on the Rise Date: Sat, 19 Sep 1998 12:11:32 -0500 To: believer(a)telepath.com Source: Charlotte (N.Carolina) Observer http://www.charlotte.com/observer/local/pub/031225.htm Published Saturday, September 19, 1998 SWAT team approach less risky, police say Use of squads on rise around region, nation By LEIGH DYER Staff Writer Across the country, police departments are using SWAT teams to deal with high-risk situations like the Sept. 4 drug raid that ended with a Charlotte man dead. Court papers said police were looking for evidence of drug dealing, but they found no drugs in the Mayfair Avenue home. Charlotte-Mecklenburg police say the paramilitary-style squad reduces the risks to officers and the public in dangerous situations. But some critics say using the SWAT team for search warrants is too heavy-handed. Records show the Charlotte-Mecklenburg team is used sparingly. Last year, SWAT officers were involved in 14 of the 441 warrants served by Charlotte-Mecklenburg police. Of 251 warrants executed from January to Aug. 31, SWAT team members served 15. Of the 29 raids before Charles Irwin Potts' death, one resulted in minor injuries. Potts' death is the first shooting during a search warrant since the team organized in 1992. It's less clear how often the team succeeds in finding what it's after. In almost every raid, the team reports either an arrest or a seizure of weapons or drugs. But they don't always seize the goods they were looking for. The Sept. 4 raid netted three guns and gambling equipment -- but no evidence of the cocaine dealing an informant told them they'd find. Maj. Piper Charles, who is in charge of the Charlotte-Mecklenburg team, said that when the team is used is not based on the likelihood of finding drugs. Instead, it's based on the likelihood of facing armed resistance. ``The primary purpose is to save lives,'' said Charles. ``A successful mission is one in which absolutely no one gets hurt.'' More scrutiny SWAT calls range from negotiation with hostage-takers to quelling riots to raids for guns, drugs or evidence of other criminal activity. The 42-member Charlotte-Mecklenburg Special Weapons and Tactics team uses special equipment, including heavy body armor and laser-sighted guns. The duty is part time. Team members are also assigned to other regular patrol duties. Nationally, the increased use of SWAT teams has drawn praise from those who say their tactics are safer than traditional law--enforcement methods. But Peter Kraska, a criminology professor at Eastern Kentucky University who has tracked SWAT teams, said they have a downside. ``Often when you see them in a neighborhood piling out of a vehicle . . . it gives the community an impression they're kind of under siege,'' he said. Regionally, SWAT teams have become more active in counties including Gaston, Union and Cabarrus in recent years. Sgt. Jeff Eisenhour, commander of the Gaston County Police SWAT team, said most operations go more smoothly with such a well-trained team, rather than regular patrol officers. ``The biggest advantage is the training,'' he said. ``Everybody knows what everyone is doing.'' The Potts shooting has put the methods and policies of the SWAT team under a microscope, said Charlotte-Mecklenburg's Charles. Those methods include the use of ``flash-bangs,'' a diversionary device thrown into a room to stun and distract occupants with a bang and bright lights while SWAT team members storm in. ``My position is that you're not going to find a safer way to do it,'' Charles said. As SWAT teams grow in popularity, they have encountered more questions about their use. In Fitchburg, Mass., west of Boston, civil libertarians criticized a SWAT team after its members arrested a group of young men in 1993 for lingering on a sidewalk. And in Louisville, Ky., family members of a man killed in a SWAT raid in March 1997 sued, challenging the police procedures. The suit alleges that a flash-bang may have disoriented the man so much he didn't realize he was pointing his gun at police officers. The suit is pending. In Charlotte-Mecklenburg, though, officers say the devices may have saved lives many times, including during a raid on Jan. 22 when a suspect dropped a gun after a flash-bang went off. ``I have heard that sometimes people are not properly using their SWAT teams,'' said Roy House, an instructor at Central Piedmont Community College who conducts regional SWAT training. ``That's a leadership problem.'' House, who is also a reserve member of the Charlotte-Mecklenburg team, believes the benefits of the teams outweigh any criticism. ``I would think it's better to go in there and be a little heavy-handed than to go in there and be outnumbered . . . or outgunned,'' he said. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer **********************************************

1 0

IP: Crypto Controls Threaten Human Rights
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

From: believer(a)telepath.com Subject: IP: Crypto Controls Threaten Human Rights Date: Fri, 18 Sep 1998 17:06:43 -0500 To: believer(a)telepath.com Source: OneWorld Magazine http://www.oneworld.org/news/today/index.html Crypto Controls Threaten Human Rights Vienna conference warned against restricting free expression (New York, September 18, 1998) -- Human Rights Watch today urged an international conference on technology, now meeting in Vienna, not to expand controls on encryption technologies. The organization said that cryptographic products are critical to the ability of human rights defenders around the world to transmit sensitive information without detection by repressive governments. The conference is reviewing the 1996 Wassenaar Arrangement, an international agreement signed by 30 countries to govern the proliferation of military technology. Dissidents and human rights organizations under repressive regimes frequently use encryption technologies to share information. Encryption has the power to authenticate the identity of these authors to their partners abroad, while protecting their identity from despots at home. The United States has adopted relatively restrictive encryption policies, which prohibit the global dsitribution of software used to encrypt text. In particular, Washington has outlawed the export of the most popular software among human rights activists, Pretty Good Privacy (PGP), although the Wassenaar Arrangement explicitly exempts crypto-software, like PGP, that is widely available in the public domain. Human Rights Watch warned the other participants in the Vienna conference not to incorporate such restrictive policies into the Wassenaar Arrangement, or to further limit the global distribution, development, or use of strong encryption hardware or software. "Encryption is more than a shield for human rights activists," said Jagdish Parikh, associate online researcher at Human Rights Watch. "Coded language is still language, and it must be protected as a basic human right to free expression." Parikh noted that the right to free expression is set forth in Article 19 of the International Covenant on Civil and Political Rights, to which most members of Wassenaar Arrangement are party. Human Rights Watch said that encryption is also an important bulwark against violations of privacy in an age where computerization and data banks enable the collection of huge amounts of personal information about individuals. Moreover, international law requires states not only to refrain from arbitrary interference with privacy, but to affirmatively protect its citizens from such attacks. "The sorts of countries most eager to ban the use of encryption, such as China and Iran, are not known for respecting freedom of speech," said Parikh. "Using encryption should not subject an individual to criminal sanction, any more than using Pig Latin or Swahili does." Many human rights activists around the world would be spared retaliation and abuse if crypto-software were more widely available, Parikh said. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer **********************************************

1 0

IP: "Bioarmageddon"
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

From: believer(a)telepath.com Subject: IP: "Bioarmageddon" Date: Sat, 19 Sep 1998 06:56:14 -0500 To: believer(a)telepath.com Source: New Scientist http://www.newscientist.com/nsplus/insight/bioterrorism/bioarmageddon.html Bioterrorism Special Report: Bioarmageddon By Debora MacKenzie Sooner or later there is going to be a biological attack on a major city. Are we prepared to deal with it? Not a chance, says Debora MacKenzie It begins with a threat. A terrorist group declares that unless its demands are met within 48 hours, it will release anthrax over San Francisco. Two days later, a private plane flies across the Bay, spreading an aerosol cloud that shimmers briefly in the sunlight before disappearing. Scenario one: thousands are killed in the panic as 2 million people flee the city. Another 1·6 million inhale anthrax spores. Antibiotics are rushed in, but the hospitals are overwhelmed and not everyone receives treatment. Most of the country's limited stock of anthrax vaccine has already been given to soldiers. Emergency crews provide little help as there are only four germ-proof suits in the whole city. More than a million of the Bay Area's 6.5 million residents die. Scenario two: in the two days before the attack, citizens seal their doors and windows with germ-proof tape. They listen to the radio for instructions, their gas masks, drugs and disinfectants ready. Few panic. When sensors around the city confirm that the cloud contains anthrax spores, hospitals receive the appropriate antibiotics and vaccines. Trained emergency teams with germ-proof suits and tents set up in the places where automated weather analyses show the deadly cloud will drift. With advance preparation and rapid response only 100,000 people die. A terrorist who plans to drop anthrax over San Francisco tomorrow can count on causing the murder and mayhem described in the first scenario--at least according to the simulation that generated these scenarios last year. The question facing policy makers now is: how do we move toward the second scenario? That terrorists may someday turn to biological weapons is no longer a matter of debate (see "All fall down", New Scientist, 11 May 1996, p 32). "Terrorism has changed," says Brad Roberts of the US government-backed Institute for Defense Analyses in Virginia. "Traditional terrorists wanted political concessions," he says. "But now, some groups say their main aim is mass casualties. That makes biological weapons appealing." Terrorists would have little trouble getting their hands on the technology. Hearings in South Africa in June revealed that the apartheid government produced terrorist weapons containing anthrax, Salmonella and cholera. Soviet scientists who have prepared weapons-grade anthrax and smallpox are known to have emigrated, possibly to well-funded terrorist groups like the one run by Osama bin Laden in Afghanistan. Even small groups such as the Aum Shinrikyo sect in Japan have been able to cook up vats of Salmonella or botulin, the toxin that causes botulism. With bioweapons so readily available, how can governments protect us from a terrorist armed with anthrax, smallpox or plague? In May, scientists, policy makers and security experts gathered in Stockholm to discuss how to limit the devastation of a biological attack on civilians. Until now, most biological defence strategies have been geared to protecting soldiers on the battlefield rather than ordinary people in cities. The situations are quite different, and novel technologies are needed for civilian defence. Suppose a commuter stumbled across a time bomb filled with anthrax on an underground railway platform. Until this year, no police force in the world had any way to disarm such a device safely. One novel solution that attracted attention at Stockholm was a tent full of antiseptic foam. Researchers at Irvin Aerospace in Fort Erie, Ontario, have developed a dome-shaped tent made of ultratough Mylar that can be filled with a stiff foam--the exact composition of which is a closely guarded secret--that kills germs and also neutralises chemical weapons. Once covered by the foam-filled tent, the bomb can be safely detonated. But what if germs are already in the air? The protective suits and masks used by most emergency services don't have seals tight enough to exclude microorganisms, making them useless against biological attacks, says Jack Sawicki, a former fireman who now works for Geomet Technologies near Washington DC. And the lack of standards for gas masks sold to civilians in most countries makes it as likely that a mask will suffocate you as save you, he says. The suits developed for the military do work--their tight joints and zippers keep bugs out--but they are too pricey for the average fire department. Both Geomet and Irvin Aerospace are about to market civilian bio-suits. In the meantime, other companies are designing protective gear that actually kills pathogens. Molecular Geodesics in Cambridge, Massachusetts, for example, is developing a suit made of a tough, sponge-like polymer that traps bacteria and viruses, which are then destroyed by disinfectants incorporated into the fabric. Stealthy attack None of this gear will do any good, however, if the emergency services do not know there has been an attack. And an assault may not be obvious. A terrorist might not use a weapon that goes off with a dramatic bang, or even produces an obvious cloud of germs. The first hint of a biological attack may be a sudden cluster of sick people. Even that will be missed unless someone is watching. And few are. In the US, financial cutbacks have crippled programmes to track disease outbreaks, natural or deliberate. Some could be either, such as food poisoning caused by Escherichia coli O157 or Salmonella. Medical agencies fear that the extra money requested by President Bill Clinton this spring as part of an anti-terrorist initiative will not be enough to create an adequate surveillance network. In Europe, disease surveillance is only beginning to be organised on the continent-wide scale needed to track a biological emergency. But in addition to monitoring infected people, Nicholas Staritsyn of the State Research Centre for Applied Microbiology near Moscow says that more effort should be made to find out which bugs live where. For example, a particular variety of anthrax may occur naturally in South Africa, but not in Canada. Having access to such information could help authorities to distinguish between natural outbreaks and deliberate attacks. Even when infected people start turning up at local hospitals, early diagnosis of their illness might not be easy, says Steve Morse, who heads the US programme on new diagnostic technologies run by the Defense Advanced Research Projects Agency (DARPA). The first symptoms of anthrax, plague and many other potential agents of bioterrorism resemble those of flu: headaches, fevers, aching muscles, coughing. What's more, some of these symptoms might be brought on by panic attacks, which are likely to be widespread among people who have just been told that they are the victims of a biological attack. One answer discussed in Stockholm would be for hospitals to have the type of high-tech detectors being developed to identify airborne pathogens on the battlefield. With a detector at each bedside, doctors could pick out the volatile molecules released by damaged lung membranes at a very early stage of infection and instantly tell whether a patient was a victim of a biological attack, says Mildred Donlon, head of environmental detection research at DARPA. Eventually, DARPA would like to develop a detector that weighs no more than 2 kilograms, can identify as few as two particles of 20 different biological agents in a sample of air, costs less than $5000 and does not give false negatives. Such detectors could be deployed around cities to give early warning of airborne disease. In the meantime, researchers led by Wayne Bryden at Johns Hopkins University in Baltimore are working on revamping the traditional laboratory workhorse, the mass spectrometer, for use in the field or in hospitals. They've reduced this unwieldy piece of equipment to a suitcase-sized machine that can distinguish between, say, Shigella, which causes dysentery, and Salmonella. A shoebox-sized version, says Bryden, could be ready in five years. Other researchers are experimenting with devices that would not seem out of place in an episode of Star Trek: Voyager. Tiny electronic chips that contain living nerve cells may someday warn of the presence of bacterial toxins, many of which are nerve poisons. Like a canary in a coal mine, the neurons on the chip will chatter until something kills them. "Anything that stops it singing is immediate cause for alarm," says Donlon. While the "canary on a chip" could detect a broad range of toxins, other devices are designed to identify specific pathogens. One prototype consists of a fibre-optic tube lined with antibodies coupled to light-emitting molecules. In the presence of plague or anthrax bacteria, or the toxins botulin or ricin, the molecules light up. Outwitting our defences Devices based on antibodies are far from foolproof. First, you need to have the correct antibodies--not easy when you consider the vast number of pathogens you'd need to include, and their ever-changing repertoire of surface proteins. "And even the right antibodies can identify only what is on the outside of a particle," Donlon points out. Bugs can be encapsulated in gels or biological polymers to foil antibodies, or normally harmless bacteria engineered to carry nasty genes. "I want to know what is on the inside," she says. To do this, DARPA-funded researchers are developing identification techniques based on RNA analysis. Unlike DNA, which is now used to identify unknown organisms, RNA is plentiful inside cells and need not be amplified before identification begins. And messenger RNA molecules reveal not only what a microorganism is, but what toxins it is making. Once the biological agent has been identified, how do you combat it? Vaccinating people before they are exposed is one answer. This is the strategy the military is betting on. Last year, the US military launched a programme to develop vaccines against potential biological weapons. It will create jabs for diseases for which none exist, such as Ebola, and improve existing vaccines--including the 30-year-old anthrax vaccine being given to 2·4 million American soldiers. But vaccines are no cure-all. An attacker need only generate a germ that sports different antigens to those used in a vaccine to render that vaccine ineffective. Plus, as bioterrorists get more sophisticated, they will develop novel, possibly artificial, pathogens against which conventional vaccines will be useless, predicts Morse. To get around these problems, DARPA is looking at ways of developing vaccines quickly enough for them to be created, mass-produced and distributed after an attack. The first step, which many researchers including those in the fast-paced field of genomics are now working on, involves speeding up DNA sequencing so that an unknown pathogen's genes could be detailed in a day. The resulting sequences could then be the basis for developing an instant DNA vaccine. Making the vaccine is only half the problem, however. Soldiers can be ordered to take shots, but immunising the rest of the population is another matter. Civilians are unlikely to volunteer for the dozens of vaccinations that would be necessary to protect them against every conceivable biological threat. An attack would make many change their minds, but in such circumstances there might not be enough to go around. Although Clinton has called for the stockpiling of vaccines, the US has only 5 million doses of smallpox vaccine--not enough to contain a hypothetical attack, says Ken Berry, president of the American Academy of Emergency Physicians. Ken Alibek, the former second-in-command of the Soviet germ warfare programme who revealed earlier this year that the Soviets had weaponised tonnes of smallpox, argues that it is short-sighted to put too much effort into developing vaccines. Instead, says Alibek, who is now at the Batelle Institute in Virginia, researchers should concentrate on ways to treat victims of biological weapons. Today's antibiotics may be useless because germs could be equipped with genes for resistance to all of them. Russian scientists have already created such a strain of anthrax (This Week, 28 February, p 4). For any treatment to be effective amid the potential chaos of a bioterrorist attack, speed will be of the essence. At the Stockholm meeting, researchers reported their efforts to develop drugs that work against a wide variety of infections and so can be used even before definitive diagnosis. Some are trying to take advantage of recently identified similarities in the way many pathogens produce disease to develop broad-spectrum drugs. For example, Ebola, anthrax and plague all kill their victims by inducing a widespread inflammatory reaction similar to toxic shock syndrome. A team in Cincinnati is testing an anti-inflammatory drug that could stop all of them. Another gang of bacteria--including plague, Salmonella, Shigella and Pseudomonas aeruginosa (one of the bacteria that can cause pneumonia and meningitis)--relies on very similar proteins to latch onto human cells and inject toxins. Drugs that block this system might save people from all these germs, Åke Forsberg of the Swedish Defence Research Establishment in Umeå told the meeting. The trouble with all these new anti-bioweapon gizmos, gadgets and medicines is that it's far from certain that they would be available in time to shield the first major city targeted for a bioterrorist attack. At the moment, the US is one of the few countries taking the bioterrorist threat seriously. Sweden, France and Israel have trained emergency teams and stockpiled gas masks. Other countries do not seem concerned. "The threat of bioterrorism has not seized our European friends," says Mike Moodie of the Chemical and Biological Arms Control Institute, a think-tank near Washington DC. "They feel it's too improbable." Perhaps they should reconsider. Berry, who helped run the doomsday simulations that ravaged San Francisco, says: "Security experts are not asking if a biological attack on a civilian population is going to happen, but when." >From New Scientist, 19 September 1998 © Copyright New Scientist, RBI Limited 1998 ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer **********************************************

1 0

IP: Tougher laws are sought to seize cash
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Thu, 17 Sep 1998 08:45:24 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: Tougher laws are sought to seize cash Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: Bergen (New Jersey) Record http://www.bergen.com/news/njmone199809154.htm Tougher laws are sought to seize cash Tuesday, September 15, 1998 By ADAM PIORE Washington Correspondent WASHINGTON -- Federal law enforcement officials on Monday unveiled a plan they say will help stop the flow of billions of dollars in drug money across the nation's borders every year. Hailed as a "major step forward" in the fight against money laundering, the Justice Department proposal would broaden the government's ability to seize the profits of such illicit activity as drug dealing. It now is illegal to try to leave the country with more than $10,000 in currency without reporting it to U.S. Customs officials. Violations are punishable by up to five years in prison and seizure of the money. But in June, the U.S. Supreme Court dealt a serious blow to efforts to seize the unreported cash, ruling in a precedent-setting case that such seizures often violate constitutional protections against "excessive fines." The new proposal is aimed at correcting the loopholes opened up in the June court decision. It would for the first time allow law enforcement officials to arrest people concealing currency before they even reach the border. It would allow the seizure of $10,000 or more at the nation's ports and highways -- hundreds of miles from any crossing -- if agents can prove that there is intent to smuggle the concealed money out of the country. But it goes beyond that, giving agencies tools they have not had in the fight to stop the flow of illegal drug profits out of the country, said Stefan D. Cassella, the assistant chief of the money-laundering and forfeiture section of the U.S. Department of Justice. "This is a major step forward to address a new problem," Cassella said. "We know that the covert movement of currency across borders is indicative and inherently related to criminal activity." Civil libertarians condemned the proposed law, which the Justice Department sent to Congress on Monday, because they said it would expand the ability of law enforcement agencies to seize currency and keep it. A series published in The Record this year revealed how New Jersey, with its sprawling seaport, international airport, lax laws, and proximity to New York and Philadelphia, had emerged as a hub for money laundering and currency smuggling over the past 15 years. Cassella said the decision to push for the more stringent laws was inspired in part by The Record's stories. In its letter to Congress, the Justice Department cited the series as evidence of the growing problem in currency smuggling. The proposed law would give officials the ability to go after a wider range of smuggling that has been difficult for them to stop. Every year, for instance, billions of dollars in illegal drug profits is smuggled across the border unchecked, crammed into washing machines, refrigerators, or hidden under false bottoms in suitcases and trucks bound for the border. Over the past nine months, customs inspectors have seized more than $11 million at the border that stretches from Texas to California. And at Port Newark, Customs agents seized $5.5 million in fiscal year 1997, the fourth-highest amount seized among all U.S. ports. Cassella said the Justice Department hopes its proposal will be offered as an amendment to money-laundering legislation being considered by the House. But several congressional staffers were skeptical that the proposal would be considered by this Congress, because of the controversy over civil forfeiture. Congress is slated to adjourn is less than a month. In addition, the new regulations, if passed, would likely face immediate legal challenges. In June, the U.S. Supreme Court overturned the seizure of $357,144 from a Hollywood, Calif., gas station owner. Federal officials seized Hosep Krikor Bajakajian's money after the Syrian immigrant tried to carry it out of the country without reporting it -- even though he was told of the federal reporting requirements by customs agents. A divided court ruled the fine was excessive because the only impact of Bajakajian's crime was to deprive the government of "information on a piece of paper." By creating a category of crime called "bulk cash smuggling," law enforcement officials hope to convince the Supreme Court that efforts to evade detection could have a direct impact on the "security and integrity" of the nation's borders, Cassella said. The crime would be punishable by up to five years in prison and forfeiture of the money involved. "Bulk cash smuggling is an inherently more serious offense than simply failing to file a customs report," Justice Department officials wrote in an explanation of the bill provided to Congress. "Because the constitutionality of forfeiture is dependent on the 'gravity of the offense' . . . it is anticipated that the full forfeiture of smuggled money will withstand constitutional scrutiny in most cases." Local prosecutors hailed the proposed change. "Clearly, it's an effort to convince the Supreme Court that Congress did view this as more than a mere reporting violation and that forfeiture of the smuggled money is appropriate," said Marion Percell, an assistant U.S. Attorney in Newark who specializes in money-laundering cases. Critics attacked the bill, calling it just another effort by overzealous law enforcement officials to expand seizure powers that deprive citizens of due process. Roger Pilon, director of the Center for Constitutional Studies at the Cato Institute, warned that civil asset forfeiture is subject to abuse by law enforcement authorities. "This is unbelievable," he said. "Everything that Justice does in this area is characterized as a 'major step.' But that's no justification. Since when is it a crime to take money out of the country? After all, whose money is it?" Rachel King, legislative counsel of the American Civil Liberties Union, agreed. "The problem is they have too much power to seize property," she said. "The laws need to go the other way. What they can do already is scary." Staff Writers Julie Fields and Thomas Zambito contributed to this article. Copyright © 1998 Bergen Record Corp. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

No Subject
by Anonymous 17 Dec '03

17 Dec '03

So I fly home Friday from San Jose. Probably because I was in a hurry, after walking through the magnetometer and x-raying my stuff, a security dude grabbed my laptop and said he wanted to 'analyze' it. Yeah sure whatever, I decided not to protest I was late for my flight. This analysis, it turned out, was wiping a coffee filter over the strap of its bag, and sticking the coffee filter into a slot on a machine. No solvent even. The machine had columns labelled TNT RDX NITRO PETN HMX. I recognized the first four as high explosives. Later, I wondered if people with angina (who take nitro orally) ever set this off. Most of them, of course, are not bearded eastern-european/semetic guys in their 30's who look worried and in a hurry. Anyway, that was it, and I made my flight. Didn't even open the laptop's case. The machine name was ION-something; I wonder whether it sucked vapors from the fiber disk or whether it was a neutron-spectrometer (?) device. (Had this been a UK Customs 'inspection' of the contents of the disk, I might have had to explain the half-gig of "noise" I have on the disk. Only, it really is noise. Really.) Anyway, the moral of the story: Don't store your laptop with your explosives :-)

6 6

Repost in text: IDEA(tm) weakness
by Anonymous 17 Dec '03

17 Dec '03

[INLINE] Privacy [INLINE] How private is your electronic communication ? [taken from the PGP FAQ] You should encrypt your e-mail for the same reason that you don't write all of your correspondence on the back of a post card. E-mail is actually far less secure than the postal system. With the post office, you at least put your letter inside an envelope to hide it from casual snooping. Take a look at the header area of any e-mail message that you receive and you will see that it has passed through a number of nodes on its way to you. Every one of these nodes presents the opportunity for snooping. Encryption in no way should imply illegal activity. It is simply intended to keep personal thoughts personal. Do you trust your mail servers/gateways/virtual redirects ? With the increasing use of virtual email accounts which allow you to keep the same email address no matter if you change jobs, ISPs, etc, the opportunity for snooping increases. Is PGP secure ? PGP uses acombination of IDEA, RSA and MD5. RSA is used to allow the transfer of session keys and MD5 is used to generate a unique message digest from the passphrase for generating the IDEA key and signatures. IDEA is the core algorithm used to encrypt the actual message. Thus the security of IDEA is also means the security of PGP <read the section 'is IDEA secure'>. Is IDEA secure ? The IDEA algorithm (patented by ASCOM) is the core algorithmm used in PGP. It is based on a rotating 128 bit key split into 16 bit segments. The algorthm converts 64 bits of data at a time using the following operations '+', '^' (exclusive-or) and '*'. The formulas are : 64 bit data => D1, D2, D3 and D4 (all 16 bits) => K1,K2,K3....rotating extra 25 bits after all 128 bits are used There are 2 phases in each round and 8 rounds in total + 1 final round of just phase 1. Phase 1: R1 = D1 * K1 R2 = D2 + K2 R3 = D3 + K3 R4 = D4 * K4 Phase 2: E1 = R1 xor (((R2 xor R4) + ((R3 xor R1) * K5)) * K6) E2 = R3 xor (((R2 xor R4) + ((R3 xor R1) * K5)) * K6) E3 = R2 xor ((((R2 xor R4) + ((R3 xor R1) * K5)) * K6) + ((R3 xor R1) * K5)) E4 = R4 xor ((((R2 xor R4) + ((R3 xor R1) * K5)) * K6) + ((R3 xor R1) * K5)) Given a large random data message (ie 1000 samples - 64*1000 = 8Kb file). The distribution of the above operations can be used to break the key. ie both the '+' and the '^' operations give an even distribution but the '*' operator gives a biased distribution towards '0'. Distribution (where '*' has a bias towards 1 of a) R1 = a R2 = even R3 = even R4 = a (a5 & a6 are the bias for K5 and K6) E1 = (bias a5) * (bias a6) E2 = (bias a5) * (bias a6) E3 = (bias a5) - (2 * (bias a5) * (bias a5) * (bias a6)) + ((bias a5) * (bias a6)) = (bias a5) * (1 + (bias a6) - (2*(bias a5)*(bias a6))) E4 = (bias a5) - (2 * (bias a5) * (bias a5) * (bias a6)) + ((bias a5) * (bias a6)) = (bias a5) * (1 + (bias a6) - (2*(bias a5)*(bias a6))) Also as the '*' operator is biased towards its own bit for the result '1' - approx (60% to 100% depending on bit position). [Working from the low bit upwards will provide an even greater approximation as then you would have the relevant Key bits against a random data. ie for 1st bit, it is 100% dependant on the bit for a '1',...] eg using a simple 3x3 matrix on second bit, gives (only demonstrating the ratio): if K bit is 1 => bias a ~ (2/8), if K bit is 0 => bias a ~(1/8) ==> We can determine when : K5=0 and K6=0 as (bias a5) and (bias a6) will be at their highest ==> E1 & E2 are highest K5=1 and K6=1 as (bias a5) and (bias a6) are at their lowest ==> E1 & E2 are Lowest To determine between K5=0,K6=1 and K5=1,K6=0. K5 can be determined by check with E3 & E4 as they are both equal to : (bias a5) * (1 + (bias a6) - (2*(bias a5)*(bias a6))) => directly relate to (bias a5) => K5 =>When K5=0, both E3 & E4 will be low. => When K5=1, both E3 & E4 will be high. The Key rotation start bits are : Phase K1 K2 K3 K4 K5 K6 1 0 16 32 48 64 80 2 96 112 25 41 57 73 3 89 105 121 9 50 66 4 82 98 114 2 18 34 5 75 91 107 123 11 27 6 43 59 100 116 4 20 7 36 52 68 84 125 13 8 29 45 61 77 93 109 final 22 38 54 70 n/a n/a Working backwards with these distributions you can deduce the key. ie work out K5 (93..108) and K6 (109..124) from its distribution pattern [using just the distributions for E2 & E3, as E1 & E4 have had the '*' operation applied in the final phase], then with K5 and K6 work out K1..K4 (22..85). You now have the key values for K1 to K6 !!!. Modify the Samples such they are back a phase and repeat (ie for each sample work backwards using known K1..K6 to find the E1..4 values). MAJOR ASSUMPTION : Assume that a large random sample provides a close to even distribution at the end of each phase (For E2 & E3) such that the bias (ie a5 & a6) used to determine E2 and E3 are the only significant factors. Reasoning : If the distribution is not even, then it is very much easier to break (ie only the key values can cause the change in distribution pattern => know the pattern, know the key). I have developed a program which does just this (NOTE: not tested with real PGP data, as I have not had the time to investigate how the PGP file is structured, ie where the IDEA code starts and ends). It is available under a copyleft license similar to GNU. The Java Source code can be found at : [Application will not be released until beginning of 1999 when enough people are aware of the potential problem, and solutions are widely available - thus the threat to the general users privacy is kept to a minimal. Software houses which would like a delay in the release of this application so as to provide a solution should email: SGOSHA33(a)mailexcite.com with their request] What can we do ? The above crack works because there is a large sample involved. If however you pre-encrypted the file such that you got your pre-encrypted file and a key file, where this key file is small and contains only the key required to open the pre-encrypt file. You then PGP the two files, this would make it much harder to break as the key file cannot be broken from the sampling technique descibed above. I have developed an application which does just that. It is available under a copyleft license similar to GNU. The Java source code can be found here : kiss.zip To run the application you will need Java installed on your machine. Place the files in a directory named KISS. The command line is : java KISS.kiss e <filename> - encrypt java KISS.kiss d <filename> - decrypt (do not add the kiss extension to the filename) After encryption you will get 2 files. The '.kiss' file is the encrypted file and the '.lips' file contains the key used to encrypt the file. You should then encrypt both files with PGP. What is in the pipeline for the future ? Task 1 The above 'kiss' pre-encryption is not 100% safe from non-bruteforce cracking !! As the majority of files encrypted are text messages which are based mainly on the characters 'a' to 'z' thus the Ascii codes of the characters are of the form 011xxxxx. From this you can see that the rotating distribution as used above will tend toward '1'. Thus with enough samples they can deduce the key with the simple equation. KeyValue xor 1 = CommonValue ==> KeyValue = !CommonValue To prevent this my next application (codename Stable) will be a stabiliser program which will ensure that the distribution of the data has an even distribution. Target Release Date : 30/9/98. Task 2 The integration of both 'kiss' and 'stable'. Target Release Date : 15/10/98. Task 3 Port of both kiss and stable to C/C++ (for speed and also for Task 4). [Wrote Kiss and Stable in Java to test the speed of Java and also how it handled bit manipulation operations]. Target Release Date : 31/10/98. Task 4 Integration with PGP to provide uses with a much easier encryption method. Target Release Date : 31/11/98. Author : SGOSHA33 Return to Albert's Home Page. [INLINE]

4 3

ArcotSign (was Re: Does security depend on hardware?)
by Ryan Lackey 17 Dec '03

17 Dec '03

[from a discussion of tamper-resistant hardware for payment systems on dbs(a)philodox.com, a mailing list dedicated to digital bearer systems, where Scott Loftesness, of DigiCash and Arcot Systems, mentioned ArcotSign.] You mentioned the URL for Arcot, and I looked at the site. It seems rather lacking in technical details, and makes a very strong claim -- that it can provide tamper resistance in software on a hardware/OS/etc. platform which is generally hostile (a general purpose computer). I noticed that there are some big name cryptographers signed on as advisors -- Hellman and Schneier, who make some pretty glowing comments about the product. I'm not generally swayed by anything but mathematics, physics, and logic when it comes to cryptography and security, despite generally agreeing with the analyses of those cryptographers. I can see a couple of ways you could approximate real security using untrusted hardware -- either a one time password system retained by the user (I've investigated this in the past, and it generally ends up being a hardware token or a printed book of codes), or a remote system like Kerberos where there exist out of band key protection mechanisms, or it's not real security. I'd love to be convinced otherwise, particularly if the technology will be available for others to license. I also noticed that the system is patent pending -- this would seem to rule out the existing hardware token/one time pad system, or the Kerberos-style central authentication server releasing security credentials when presented with a passphrase system, as there are decades of prior art in each encompassing all reasonable variations. I guess this means it's something new and interesting -- I'm sure everyone would be interested in details. Of course, in any system where all you do is authenticate yourself to a remote system, but you're not provided with a link directly between the user and the remote authority guaranteeing Confidentiality, Integrity, and Authentication, you can't really make any claims other than that the user has authenticated herself to some server -- any transactions the user could do are subject to a man in the middle attack, so while the user has successfully authenticated themselves to a remote server, and signed that *some* transaction is acceptable, there's really no legal assurance that the user has signed *any particular transaction*. This is far weaker than the promise of trusted hardware, where you could have a guarantee that as long as the protocol hasn't been violated, the user has authorized a *particular* transaction. This may be acceptable for authenticating access to an online retail banking web site, or corporate information, but it would not be sufficient for an actual payment system (DBS, account based, or other). Always interested in learning something new which would chance my assumptions, Ryan rdl(a)mit.edu

15 33

atheism (was: RE: Democracy... (fwd)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: pjm(a)spe.com > Date: Sat, 19 Sep 1998 11:24:32 +0200 > Subject: atheism (was: RE: Democracy... (fwd)) > Not all philosophies are religions. If we are talking philosophies of the range to include 'natural philosophy' (ie physics) then you are correct. Fortunately, this attempt at shifting the topic of discussion away from personal or individual philosophies relating to the relationship between individuals, God, and the cosmos won't work. This is called a straw-man. Pick an argument that you want to (dis)prove but don't know how. Then pick a similar but non-identical (or fail to prove the identity) which one knowns how to (dis)prove. Finaly claim that the second easier (since it is (dis)provable) problem is identical to the first. > Asserting so is an attempt > to make one or both of the terms meaningless. And trying to change the subject of discourse is as well. A philosophy is a set of beliefs, period. In this particular case we are discussing personal or individual philosophies and from definition and practice they are identical. Religion after all is nothing more than a set of beliefs and therefore falls under 'personal philosophy'. Just remember this, it's your ugly baby. > There are two forms of atheism (visit alt.atheism.moderated for > an unending discussion). "Strong" atheists state that they "believe > that god does not exist." "Weak" atheists state that they "do not > believe that god exists." Changing the side on which the 'do not' resides doesn't change the meaning. These two sentences are identical in content and meaning. I belive god does not exist I do not believe god exists or, ^(A) = (^A) > Do you believe in leprechauns, because there is no proof that > they don't exist? Do you believe in the Hindu pantheon? Whether I believe in them makes no difference to their existance (you really really need to quit taking drugs). This is the same sort of crap reasoning the UFO nut-cases partake in. They run around asking "Do you believe in aliens?" when the question that needs asking is "How do we prove aliens have been here?", and in many cases they take the two to be equivalent. Hindu pantheon is a different form of Pantheism that I practice. I don't agree with many of the points that Hindu, Aztec, Buddhist, New Age, etc. pantheist practice, it's too anthropocentric for my taste and in the case of New Age Pantheism (gag) they've simply given transcendance a new form. And I further believe that the Hindu practice of sweeping ants out of ones way and wearing a veil to inhibit bug inhalation is taking it too far the other way (though I respect and practice the spirit of their actions). Respect does not mean subserviance. > Without reason and logic, how do you propose to prove these > assertions? I'm not trying to prove anything, you are. I'm just blowing holes in your reasoning. > Reason and logic don't "constrain", they provide a > framework for discovery. This framework is unavailable to, and indeed > actively rejected by, believers in the supernatural. Any meaningful > definition of the word "inquiry" presupposes the use of logic. Ohhhh, supernatural is by definition in this discussion equivalent to transcendental. I'll say it again, there are two types of religion - those who believe transcendentalism exists (ie traditional religions) and those that don't (eg Pantheism). It is not reasonable nor logical to expect the natural rules of experience to be recognized by the supernatural. Now I can inquire into many things without using a particular type of logic (you keep writing as if there is only one form of logic - perhaps this is the root shortcoming in your reasoning). So trying to say that inquiry is equivalent to using logic is a misunderstanding of both inquiry and logic. The question that you are skirting around is: If God exists and created the universe, does this imply that it is constrained by that creation? You can answer that question with three answers: Yes Pantheism and some other forms of pagan religions No Traditional religions ? Agnostic (if you'd like to know, Nihilism (if you believe the question is irrelevant), etc. > All faith-based assertions are by definition irrational. Mystics > frequently speak of transcendence as if the word denotes a concept > with a particular meaning, but never provide a coherent definition. > Perhaps you'll surprise me? Transcendence is the belief that there is something more than the earthly veil. In other words, if you practice a transcendantal religion then by definition you believe in a ghost-in-the-machine of one form or another. If you like you can think of it as one set of religions believes there is purpose and reason in existance whereas others believe that it is all random dice (and yes that is a broad brush I'm painting with). ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

CJ Update
by John Young 17 Dec '03

17 Dec '03

>From Alia Johnson <lodi(a)well.com>, CJ's sister, today: I'm writing to say that CJ has arrived at the Springfield Medical Referral Center, where he will be held for a month or more (the phone says U.S. Medical Center for Federal Prisoners) for "examination". Here is the address: Carl E. Johnson Register # 05987-196 U.S. Medical Center for Federal Prisoners P.O. Box 4000 Springfield, Missouri 65801 Also, to my delight, I received a letter from him today. He sounds okay. CJ in his letter asks for physical mailing addresses for some of the cypherpunks (no one specifically) so that he can send you things to post since I will be travelling. [End Alia] --------- We'll be happy to digitize and/or post any mail from CJ folks want to share, anonymous and/or encrypted always welcome: Fax: 212-799-4003 Vox: 212-873-8700 Snail: John Young 251 West 89th Steet, Suite 6E New York, NY 10024 We've put all our PGP keys at: http://jya.com/jya-keys.txt And a bunch of keys for the wild bunch of Totos: http://jya.com/totos-keys.htm

3 2