December 2003 - cypherpunks-legacy

SNET: United Nations plans SWAT team training to "control" citizens in Y2K crash
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

From: USCMike1(a)aol.com Subject: SNET: United Nations plans SWAT team training to "control" citizens in Y2K crash Date: Mon, 28 Dec 1998 15:34:16 EST To: KatieSouix(a)aol.com -> SNETNEWS Mailing List This is a multi-part message in MIME format. --part0_914877258_boundary Content-ID: <0_914877258(a)inet_out.mail.aol.com.1> Content-type: text/plain; charset=US-ASCII --part0_914877258_boundary Content-ID: <0_914877258(a)inet_out.mail.netdoor.com.2> Content-type: message/rfc822 Content-transfer-encoding: 7bit Content-disposition: inline Return-Path: <kepi(a)netdoor.com> Received: from rly-zd05.mx.aol.com (rly-zd05.mail.aol.com [172.31.33.229]) by air-zc01.mail.aol.com (v53.20) with SMTP; Sun, 13 Dec 1998 23:22:22 1900 Received: from netdoor.com (netdoor.com [208.137.128.6]) by rly-zd05.mx.aol.com (8.8.8/8.8.5/AOL-4.0.0) with ESMTP id XAA17219; Sun, 13 Dec 1998 23:22:12 -0500 (EST) Received: from kepi (port201.hat.netdoor.com [208.137.155.201]) by netdoor.com (8.9.1/8.9.1) with SMTP id WAA26607; Sun, 13 Dec 1998 22:21:38 -0600 (CST) Message-Id: <3.0.5.32.19981213222221.008aa4b0(a)mail.netdoor.com> X-Sender: kepi(a)mail.netdoor.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32) Date: Sun, 13 Dec 1998 22:22:21 -0600 To: Kepi <kepi(a)netdoor.com> From: Kepi <kepi(a)netdoor.com> Subject: Nations at UN conference suggest SWAT teams to handle Y2K crises Mime-Version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: quoted-printable Source: Star-Telegram.Com http://www.star-telegram.com/news/doc/1047/1:COMP73/1:COMP73121298.html Updated: Saturday, Dec. 12, 1998 at 17:58 CST Nations at UN conference suggest SWAT teams to handle Y2K crises By Leslie J. Nicholson Knight Ridder Newspapers NEW YORK -- In a stark demonstration of the global scale of the Year 2000 computer problem, representatives of 130 nations gathered at the United Nations Friday to hammer out plans for dealing with Y2K. The ideas included setting up national and international "SWAT teams" to handle crises caused by the computer glitch. The U.N. conference marked the first such gathering of Y2K coordinators from several nations, including many developing countries that lag far behind the United States in remediation efforts. Y2K refers to a programming glitch that will cause some computers, softwar= e programs and microprocessors to interpret the abbreviated date 00 as 1900 rather than 2000. The result could be incorrect data processing and equipment malfunctions. "We all know that we are competing in a race against time," said Pakistani ambassador Ahmad Kamal, who hosted the conference. "Despite all the effort= s and committed work of individuals and institutions, we are far from the objective of ensuring Y2K compliance by the inflexible deadline of Dec. 31= , 1999." Fixing Y2K problems is a daunting task that involves rewriting computer codes and potentially replacing billions of microchips. U.N. Undersecretary-general Joseph E. Connor called Y2K the largest computer project in the 50-year history of the information-technology industry, but said predicting its effects accurately was impossible. He said the global cost of fixing Y2K problems could reach as high as $600 billion with an additional $1.4 trillion going for litigation. "There's no way to draw on past experience and predict what is going to fail and what consequences these failures will have," Connor said. "All we know for sure is the timing." He said nations should attack Y2K on two fronts: by deciding which systems are critical and fixing them first, and by developing contingency plans fo= r coping with computer failures. "We have to get used to the fact that some systems and facilities will not be addressed," Connor said. Delegates spent most of the day in closed-door sessions to discuss Y2K problems affecting specific industries and regions and released few detail= s of those meetings. One goal was to organize on a regional basis, including implementing the SWAT-team idea. Kamal told reporters that such teams woul= d help nations deal with problems that cross borders, such as regional power grid failures. "You cannot stop at the political border of a country," he said. Distributed by The Associated Press (AP) =A9 1998 Star-Telegram ### =A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~= =A9~=A9~=A9~=A9~=A9~=A9 **COPYRIGHT NOTICE** In accordance with Title 17 U.S.C. Section 107, any copyrighted work in this message is distributed under fair use without profit or payment to those who have expressed a prior interest in receivin= g the included information for non-profit research and educational purposes only. [ Ref. http://www.law.cornell.edu/uscode/17/107.shtml ] =A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~=A9~= =A9~=A9~=A9~=A9~=A9~=A9 --part0_914877258_boundary-- -> Send "subscribe snetnews " to majordomo(a)world.std.com -> Posted by: USCMike1(a)aol.com

4 6

Spy News
by John Young 17 Dec '03

17 Dec '03

NYT reports today on a new book, "Blind Man's Bluff," which reports on the US's success at placing surveillance devices on Soviet subsea communications cables around the world. With much technical detail about how it was done, beginning with the simple but overlooked idea of locating shoreline warning signs about undersea cables then tracking from there. The devices, some up to 20 feet long for housing elaborate processing equipment, captured electronic emanations, thereby eluding detection measures aimed at physical taps. One was found by the Soviets but most were not and much information on the program is still classified. AT&T and Bell labs built many of them. The US Navy will not comment on the book, citing national security restrictions. The Times also has an obituary for Tommy Flowers, the gent who guided construction of Colossus machines at Bletchley Park to break top-level German codes during WW II. There's still interesting debate about the Paul Dore story of picking up signals from space, which he first thought were from aliens, but which seems more likely to be from a surveillance satellite, and possibly from a type not publicly known. Not enough data yet to show that the story is not a hoax, or disinformation by US/UK spy agencies, but it has led to informative discussion of what such signals could indicate. Notes on this at: http://jya.com/project415.htm More commentary welcome, here or privately. Some will recall a vigorous discussion here a few years back about listening in on US undersea cables, commencing at the landfall points (dense packs of them here in the NYC area), many handily marked on coastal seafaring maps. Or, for more up-to-date technology, setting a receiver to point in the direction of those on TLA bases (needing an x-ray of the concealing radome).

3 2

Re: HISTORY - pre-CDA, "compromise", untrue civil-liberties groups (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 17 Jul 1997 17:19:58 -0400 From: Jonah Seiger <jseiger(a)cdt.org> To: Seth Finkelstein <sethf(a)mit.edu>, fight-censorship(a)vorlon.mit.edu Cc: jberman(a)cdt.org Subject: Re: HISTORY - pre-CDA, "compromise", untrue civil-liberties groups At 4:44 PM -0400 7/17/97, Seth Finkelstein wrote: > I finally went back digging through my archives, to confirm my >memory that we had gone through almost exactly this sort of argument >in the run-up to the CDA. All the elements were there - the >"compromise" in terms of attempts to use labeling, the defensiveness >from EFF, CDT, compared to opposition from the ACLU, and so on. Not a >whole lot has changed. Mike Godwin was just as snide and snotty then >as he is now :-). > ><....> Ah, the old 'drag out CDT's funding list' trick. For the record, CDT is supported by companies and foundations who share our agenda and goals, and believe that we are effective advocates of our views. Search all you want for a consipracy -- you aren't going to find one. While CDT makes no apology for our position (along with EFF and others) to reluctantly support White's proposal 2.5 years ago given the context of the debate (read our statement at http://www.cdt.org/publications/pp311204.html) - the fact is that the Supreme Court decision settled this debate, and the White compromise was never passed by Congress. As for your claim that what happened yesterday at the white house is similar to the "compromise" of December 1995, you are way off base. White 1995 White House 1997 -------------------------------------------------------------------------------- Content Regulations imposed No content regulations, no law by Congress on all Internet or regulation of Net, no requiement Publishers. to label or rate content. Criminal Penalties for No criminal penalties for anything display of Harmful To besides trafficing in child Minors Material w/o good pornography, obscenity or faith effort to block stalking kids online (illegal before kids access CDA) The bottom line is that these are two remarkably different approaches. Even White himself is supportive of the direction the President articulated yesterday. Hope that helps clarify a bit. Jonah * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crypto.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager: +1.202.859.2151 <jseiger(a)cdt.org> http://www.cdt.org PGP Key via finger http://www.cdt.org/homes/jseiger/

2 1

No Subject
by Robert Hettinga 17 Dec '03

17 Dec '03

Hi everyone, Well, I guess it's official now. I'm going to speak at MacWorld on Thursday the 7th. If your planning to go to MacWorld, feel free to stop by and talk about e$ and financial cryptography on the Macintosh. > ---------------------------------- > * DIGITAL COMMERCE FOR THE REST OF US [Session 92, Thursday 8/7, 4:00-5:15 > pm, World Trade Center] -- What are the fundamental forces in the technology > of digital commerce? What effect will digital commerce have on society? What > are Mac's strengths are in this environment? What are some very specific > things that Apple and the Macintosh community can do, right now, to > participate as a full partner in the development of digital commerce on > public networks? What are the technologies that Mac people should concentrate > on to be first movers in the new geodesic economy? Solo Speaker: BOB > HETTINGA, Freelance Digital Commerce Analyst, e$, 44 Farquhar Street, Boston, > MA 02131; http://www.shipwright.com/ > ---------------------------------- Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Center for Security Policy calls for domestic key escrow (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 17 Jul 1997 16:00:27 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: Center for Security Policy calls for domestic key escrow In the boxing ring of Washington, the Center for Security Policy packs a hefty punch. Its faxed alerts appear once or twice a week on the desks of thousands of key decisionmakers. They're predictably hawkish, with titles like "The Nation Needs MORE B-2s." A recent one focused on encryption. The message: The Clinton administration isn't doing *enough* to control crypto, especially domestically: But a national information infrastructure also needs selective transparency on call to support users' needs to get at their encrypted data... U.S. law enforcement agencies in carrying out criminal investigations also need to be able to access voice communications, data records and data transmissions consistent with constitutional protections. The loss of this investigative technique, which is subject to strict judicial scrutiny -- would be disastrous for law enforcement. Regrettably, the Clinton Administration has been unwilling to stand up and say, here is what needs to be done -- perhaps out of a fear of alienating a key constituency, the computer industry. Read on for the full text of the alert and a well-reasoned response by ATR's Jim Lucier. -Declan Additional articles on crypto: http://pathfinder.com/netly/editorial/0,1012,931,00.html http://pathfinder.com/netly/opinion/0,1042,1022,00.html ************** No. 97-D 88 DECISION BRIEF 25 June 1997 For Immediate Release (202) 466-0515 Breaking the Code on the Encryption Debate: National Security Interests Are Being Jeopardized (Washington, D.C.): With relatively little fanfare, a truly momentous public policy debate is taking place in Washington. Unfortunately, all other things being equal, it seems likely that the outcome of this debate concerning the domestic use, foreign export and international regulation of encryption techniques will do grievous harm to the national security interests of the United States. 'You Can't Tell the Players...' Such an extraordinary, and ominous, result is in prospect due to several factors: By its very nature, encryption -- a generic name for numerous means of encoding computer, voice or other transmissions of data so as to conceal the contents from unauthorized access -- is one of the most complex and obscure of sciences. Given its direct relevance for the protection of classified U.S. government information and for the penetration of foreign governments and other entities' secure communications, the U.S. National Security Agency (NSA) has jealously tried to shield from public view as much as possible about the technology and techniques involved in encryption and code-breaking. The necessary secretiveness associated with what NSA does and how the spread of encryption systems might affect the American ability to perform signals intelligence (SIGINT) by intercepting and monitoring foreign communications enormously complicates this debate. Robust encryption at home contributes to national security as well as protecting American industry, critical information networks and citizens' privacy. But a national information infrastructure also needs selective transparency on call to support users' needs to get at their encrypted data. U.S. law enforcement agencies in carrying out criminal investigations also need to be able to access voice communications, data records and data transmissions consistent with constitutional protections. The loss of this investigative technique, which is subject to strict judicial scrutiny -- would be disastrous for law enforcement. Widespread use of unbreakable encryption is exactly what terrorists, drug lords, pedophiles and their ilk want to see. But law enforcement needs a controlled window into this encryption as part of its responsibility to detect, prevent or prosecute criminal behavior. Experience with court-ordered wiretaps suggests that, by requiring judicial approval of such electronic monitoring, this function critical to the rule of law and a civil society can be performed without risk of serious abuse. Due to advances in information techniques, the know-how and means for providing sophisticated encryption capabilities has proliferated dramatically in recent years. With the burgeoning use of the Internet and other electronic devices for conducting business, the demand for means to keep voice communications, data records and data transfers private has also grown tremendously. U.S. manufacturers of computer software and hardware -- many of whom have been key supporters of and enjoy great influence with President Clinton and his Administration -- are demanding an opportunity to meet this demand with encryption products that will be exceedingly robust, if not impenetrable. They typically point not only to the trade benefits such sales would represent but to the prospect that foreign manufacturers of encryption technologies will gladly supply products not available from American sources. Similar arguments have proven effective in obtaining Administration support for the wholesale elimination of export controls on powerful computers -- even supercomputers. President Clinton has already issued an Executive Order substantially liberalizing the export of powerful encryption capabilities. Under its terms, encryption programs involving up to 40-bit keys (in layman's terms, the number of variables used in combination to conceal a given piece of encrypted message traffic, one of several factors determining the robustness of an encryption program) can be exported without a license. The Executive Order also permits programs of any strength to be exported provided they have a "key recovery" capability (i.e., a code-breaking spare key has been created) -- even if that key resides with the purchaser of such encryption. Civil libertarians -- including some conservatives with well-deserved reputations for concern about U.S. national security -- have taken the position that techniques which impede or preclude government monitoring of electronic transmissions are highly desirable. Their enthusiasm for the most widespread proliferation of encryption techniques, both domestically and internationally, provides tremendous political cover for others with more suspect motivations. Counter-culture opponents of U.S. government power, including some holding high office in the Clinton Administration, appear untroubled by the diminution of American capabilities to perform signals intelligence -- historically an area of decisive and strategically vital advantage for the United States.(1) Evidently, they are no more concerned by the other side of this coin: Thanks to the Clinton-approved transfer of American supercomputers and other powerful data processing systems, foreign governments are likely to have much enhanced capabilities to perform their own code-breaking operations, further reducing U.S. dominance in the field. The Legislative Context Against this backdrop, several bills have been introduced reflecting two basic approaches. The first sponsored by Senators Conrad Burns (R-MT) and Patrick Leahy (D-VT) in the Senate and by Rep. Robert Goodlatte (R-VA) in the House would essentially eliminate controls on the export of encryption. This legislation is favored by the computer software and hardware industries and a number of civil libertarians. Senate Majority Leader Trent Lott has thrown his support behind the Burns-Leahy bill. A bill recently introduced by Senator John McCain, chairman of the Senate Commerce Committee, presents an alternative approach. It attempts to "split the difference," addressing domestic law enforcement concerns by way of creating incentives for U.S. manufacturers to participate in a key management infrastructure (i.e., establishing means whereby federal agencies, with appropriate court orders, can obtain the ability to read encrypted communications). While the incentives to do so are significant, the companies would be under no requirement to take part in this arrangement. As a sop to the encryption industry, however, the McCain legislation would make several concessions that could be injurious to the national security. First, it would raise the threshold for unlicenced exports from 40 bits to 56 bits. This represents a dramatic increase in the power of encryption programs that will find their way into the hands of hostile powers, international terrorists and other foreign criminal elements -- and will add dramatically to the time and computing power required by U.S. intelligence to monitor their activities. Second, the McCain legislation calls for the creation of an industry-government advisory board tasked to consider and jointly develop recommendations concerning future standards for encryption exports. Such an arrangement would put those responsive to multinational stockholders on an essentially equal footing with government agencies responsible for the national security. In addition, the bill would mandate foreign-availability assessments -- a pretext frequently used by industry to argue for even the most irresponsible transfers of U.S. technology.(2) Parsing Out the Issues There are, in fact, three separate issues involved in the present encryption debate -- issues that have, to some extent, been commingled by the Clinton Administration, it appears in an effort to obscure what is at stake for a vital national security capability. 1. Domestic Policy Encryption products are the future for the privacy and security of communications and information. Americans have a right to be secure in the knowledge that their private communications and information remain private, and that they can conduct electronic commercial transactions reasonably safe from fraud or compromise. Security embedded in consumer goods (as well as in information systems) needs to become a common part of how business works in this country. There is today no restriction on the use of encryption within the United States. Americans may import any encryption devices and software into the U.S. There are, however, restrictions on the export of U.S. encryption items. Unfortunately, encryption in the hands of domestic criminals can be a menace to American business and society, enabling them to hide illicit records and transactions. For law enforcement today, encrypted communications mean no electronic surveillance. Court-ordered wiretaps may be unenforceable. Because of the importance of court-ordered electronic surveillance to law enforcement, law enforcement agencies across the country believe the impact of widely proliferating encryption will be disastrous for them, unless they have a means of lawfully and promptly decrypting communications and information of criminal suspects. Accordingly, the United States requires common standards for accessing encrypted data and communications (known as "key recovery"). Importantly, such standards are required not only by law enforcement but in order to support commercial needs (for example, companies need to be able to get at their electronic records if the person who encrypted them dies or turns into a vindictive disgruntled employee). Consumers also have a vested interest in ensuring that standards exist whereby they can be assured that encryption will be reliable and easily interoperable (e.g., to manage interfaces between various network systems). A domestic public key recovery infrastructure is the answer to these requirements, A public key recovery infrastructure is, however, particularly essential for law enforcement. Increasingly, criminals are utilizing techniques to encode their phone calls, concealing their computer transmissions and keeping their records locked up in encrypted computer disks or drives, rather than in file cabinets. Subject to the limits of U.S. constitutional guarantees, law enforcement needs to be able to continue to do its job in the information age. Law enforcement does not need more intrusive authorities or abilities than it has now; it needs merely to be able to continue to be able to make use of the same investigative techniques presently available with respect to wiretaps. Alternatively, if the government does nothing but passively watch as encryption proliferates with no standards to guide it, law enforcement will lose critical investigative capabilities. In all likelihood, it will be forced to turn to more intrusive techniques (microphones in the room or car rather than taps on telephones), measures that are more invasive of privacy and which put more police officers' lives at risk. Criminals (drug dealers, kidnappers, thieves) will enjoy safe havens they do not presently have, and more good citizens will find themselves victims of unsolved crimes. Regrettably, the Clinton Administration has been unwilling to stand up and say, here is what needs to be done -- perhaps out of a fear of alienating a key constituency, the computer industry. The Administration clearly appreciates the need to support law enforcement (law and order is, after all, good politics). But when asked, its spokesmen say they are afraid their endorsement of a domestic policy would prejudice its chances of enactment, citing their experience with the public relations disaster of an earlier encryption management initiative known as the "Clipper Chip." The truth is that there is no one better positioned than President Clinton to provide leadership, given his well known ties to the hardware and software industries. 2. Export Controls In some respects, the Clinton Administration's policy has been worse than doing nothing: It has tied the domestic encryption issue to liberalizing export controls on encryption techniques, ostensibly in the hopes of buying the support of the producers of encryption products for greater cooperation with regard to domestic key management arrangements. This is most regrettable since export controls are the single most important tool the United States has for protecting sensitive national security interests in this arena. The unavoidable reality is that U.S. national security is heavily dependent on being able to collect intelligence by listening in on what its adversaries -- actual and potential -- are up to. This intelligence saves lives, wins wars, and preserves the peace. And in an era of information warfare, having superior information systems may be determinative of military power. This reality was reflected until last year by treating encryption technologies as part of the State Department's Munitions Control List. President Clinton's Executive Order, however, moved export controls on such technology over to the much less rigorous Commerce Department. It also further adulterated the export controls regime by directing that: 40-bit encryption programs may be exported without a license; 56-bit encryption programs may be exported without a license provided the exporter is working on a public key recovery technology base; and any product that is part of a public key recovery system may be exported without a license. American products should enjoy the lion's share of the market (U.S. software has 75% of the global market today), but U.S. exporters of highly capable "crypto" -- 40-bit and above -- should be required to get a license to minimize the likelihood that their products will fall into the wrong hands. Any further weakening of export controls would have a deeply debilitating impact on national security. With all of the focus on domestic encryption regime, and with no advocacy from the Executive Branch, national security interests are not being represented -- and are losing out. 3. International Dimension To make matters worse, the Clinton Administration -- under the "leadership" of a controversial former Carter Administration official, David Aaron, who has been designated as its "Ambassador for Encryption" -- has come up with a curious and dangerous gimmick: It proposes to "multilateralize" yet another area of sovereign U.S. policy concern(3) by getting OECD nations to take the lead in an area it is reluctant to champion domestically, namely in implementing national key recovery regimes. As in other issues -- ranging from environmental regulation to family planning -- the Administration appears to hope that the creation of common international practice and standards will provide a basis for imposing arrangements domestically that would otherwise be highly controversial, and perhaps politically costly. Not surprisingly, the Administration has come under some criticism from allies for the hypocrisy of trying to make them go first with respect to developing key recovery infrastructures even as it declines to step up to the issue at home. But this is worse than simple hypocrisy. It is flatly inconsistent with American values for U.S. officials to argue that foreign governments -- many of which do not recognize the basic individual rights of their citizens -- should have unfettered access to their private communications. Few of these governments actually observe the strict limitations on electronic surveillance which pertain in the United States. It is one thing for the U.S. to have a domestic key recovery regime which is subject to the rigorous and proper constraints of its Constitution and system of justice. It is quite another to say that, as a foreign policy objective of this country, Washington wants to guarantee the ability of foreign governments to spy on their own citizens, or (worse) on Americans who may communicate with those foreign citizens or travel within those countries. The Bottom Line The Clinton Administration appears once again to have gotten the answers exactly wrong. Their efforts have confused the debate and helped to divide the ranks of those who generally are concerned with national security -- even as they are jeopardizing vital national security interests, evidently out of a desire to avoid antagonizing major political donors. Domestic policy, export controls, and international accords concerning encryption are different concerns, each in need of understanding and debate on the merits. And the vital American national security requirement for electronic intelligence abroad must be supported. On an even more fundamental level, those who traditionally are sensitive to national security concerns must not allow differing perceptions of domestic law enforcement to translate into legislation that may not only endanger the defense of the United States but undermine its rule of law domestically. A lawless society is no defender of American liberties. The undeniable fact is that U.S. national security is dependent upon our ability to collect intelligence in peacetime on foreign threats, from terrorist groups to the proliferation of "weapons of mass destruction" to the status of thousands of nuclear-tipped missiles in potentially unfriendly hands. Likewise, success in foreign matters (from trade to diplomacy to support for friends and allies) requires intelligence to identify opportunities for the U.S. officials to act in defense of our values and interests around the world. The U.S. ability to gather SIGINT therefore is not something about which responsible Americans can afford to be ambivalent. This is a vital national security priority. And it is, to be sure, one that must take precedence over the commercial advantages of selling U.S. software abroad. 1. During both World War II and the half century of the Cold War, SIGINT was far and away the most important type of intelligence the U.S. gathered. Without the ability to collect and read enemy codes and ciphers, the U.S. might well have lost the Second World War. Without SIGINT, the Cold War might have ended far differently and might well have turned into a hot war at critical junctures; certainly, the U.S. would have been almost blind to many of the Soviet Union's malevolent activities. 2. It is unclear on what basis other industries selling sensitive products -- for example, the supercomputer, chemical and biotechnology, machine tool, chip manufacturers, etc. -- would be denied similar vehicles for demanding the elimination of any remaining export controls on the transfer of their respective products. What is more, it not self-evident that the national security will be well served by advertising which foreign encryption products are of concern to the U.S. government, let alone encouraging American manufacturers to supply superior -- i.e., less breakable encoding techniques -- in place of such products. 3. See in this connection, the Center's Decision Brief entitled Truth or Consequences #9: C.W.C. Proponents Dissemble About Treaty Arrangements Likely to Disserve U.S. Interests (No. 97-D 46, 27 March 1997). *************** Americans for Tax Reform Memo To: Frank From: Jim Lucier CC: Friends Date: June 26, 1997 Re: Encryption and National Security Dear Frank: I think we both agree that total U.S. dominance of all technologies across the board is a vital guarantor of national security. We disagree on factual premises. The powerful encryption methods under discussion are universally published mathematical techniques taught in universities everywhere to people like my brother who studied them at the undergraduate level. I particularly recommend the fine textbook by Bruce Schneier, Applied Cryptography. It is a mistake to assume this information, once disseminated, can be controlled. It is also incorrect to assume there is only one type of encryption which the U.S. could somehow keep secret. In fact, there are an infinite variety of techniques, some more elegant than others and all with their quirks, but many offering effective security. Indeed, almost any routine that manipulates data --including file compression algorithms -- can be considered a type of encryption. The case of encryption is dramatically unlike that of supercomputers, where one or two manufacturers in the U.S. may be uniquely capable of producing cutting edge equipment. Bad actors will not voluntarily participate in a key management system they can easily opt out of. The impact on crime will be zero. Only law-abiding people will be trapped in a system that opens them to maximal violations of privacy by governments and technically sophisticated rogue agents. This is not a case of greedy software companies that want to "sell encryption" overseas. In fact, encryption software is a low-margin commodity product that only a few specialists sell profitably. U.S. companies want to sell high-margin products like Lotus Notes, cc:Mail, Domino, secure servers, and Oracle databases, and sophisticated financial management tools that operate in a networked environment. U.S. companies dominate the market for these enterprise-wide, mission-critical applications. For now. The problem is that without encryption modules, the American products are useless for conducting secure business, and the power of networking, which gives them their unique value-added quality, is eliminated. U.S. regulations even prohibit American companies from selling software with "hooks," where foreign-made encryption products can be plugged in. The result is increasing inroads by foreign competitors. The German, Japanese, and Chinese governments are pointedly encouraging their programmers to make hay while they can. Dozens of companies around the world explicitly advertise that they sell products not subject to U.S. export restrictions. There is also the chance that the United States will lose the opportunity to set and dominate standards in vital areas such as digital currency, which involve encryption now subject to control. Currently, Europeans lead in this field. The use of telephone wiretaps has exploded under the Clinton Administration, and under legislation passed last year the number of people impacted by telephone wiretaps is slated to grow still further. For many, this gives ample ground to doubt that wiretaps are used sparingly, or that cases of abuse are minimal. The real restraint on the use of telephone wiretaps is that they are very expensive, and they require human intervention. Technology does not yet allow machines to monitor calls. On the Internet, by contrast, "packet sniffing" is virtually cost-free, and the packets of data are machine readable. Thus there is nothing to prevent widespread abuse of privacy. The single-sentence Frist Amendment to McCain-Kerrey which purports to solve this problem is totally meaningless. The claims of law enforcement are wildly exaggerated and not offered in the context of any statistical evidence to make serious risk assessment possible. Strong encryption is dangerous? Compared to what? No encryption? A government-sponsored system only incompetent criminals will use? For decades people have been predicting the death of SIGINT. It never happens. The reason is that as the volume of communications goes up, the opportunities for SIGINT also increase. In a networked environment, virtually any interaction with legitimate businesses, and even public infrastructure, can create a database of transaction streams greatly useful to law enforcement and intelligence agencies, who can examine this data with powerful heuristic searching tools. The information age will give, and is giving, law enforcement officers and intelligence agencies astonishing new powers. Law enforcement officials who claim they will be powerless in the future are being somewhat disingenuous. What really worries them is missing the opportunity to gain powers they dont have now, plus the stress of learning to operate in a different environment. The key management infrastructure (KMI) called for in McCain-Kerrey is a fiction. Detailed technical standards for such an infrastructure do not exist and may take several years to develop. A recent technical paper by leading private-sector cryptographers claims that the requirements of building a KMI are beyond the current expertise of the field. A central problem is that the Justice Department's insistence on real-time access to data in transit is not consistent with existing models of key recovery for stored data. If KMI works, it offers no advantage and many grave dangers. If it doesn't work, it is a costly drain on the economic sectors currently driving U.S. economic growth. A global KMI in which the U.S. arbitrarily limits its own information security and somehow expects other countries to participate is an atrocious idea. Reasonable people can debate the issue of export controls. The weight of evidence suggests that controls should be loosened, but there can be legitimate argument of how far and how quickly we should go. The McCain-Kerrey bill is by no means a "compromise" on export controls. It is legislation totally different from the Burns, Goodlatte, and Leahy proposals Congress has long been considering. For the first time, McCain-Kerrey would seek to impose controls on U.S. domestic use of cryptography through a combination of regulation, criminal penalties, civil liability exposure, and taxpayer-financed industrial policy. It is highly significant that the Administration forced this legislation through the Commerce Committee without a single day's hearings. Senators were given only three days to study the legislation and supplied with misleading and incorrect information about who supported it. McCain-Kerrey probably could not have withstood public scrutiny in the Commerce Committee. As it is, the bill will very likely never move to the Senate Floor, but the Administration now has substantial leverage to pursue its regulatory agenda. The relaxation of exportable key lengths from 40- to 56-bits is not a sop to industry but a pathetic offering that raises the time-to-break for a foreign intelligence agency stealing U.S. trade secrets from ..0002 seconds to 12 seconds. McCain-Kerrey actually represents a step backward from previous Administration positions on the issue of export controls and exemplifies the bad faith and intransigence this Administration has consistently shown. Last year, for instance, the Administration announced it was relaxing export controls from 40 to 56 bits and then reversed itself, saying the relaxation, if offered, would only be temporary and contingent on businesses developing plans to comply with Administration key-recovery standards. In short, the Administration has been using export controls solely as a club to get unprecedented domestic regulation. In economic terms, McCain-Kerrey represents a stunning arrogation of power by Congress to itself for the purposes of regulating digital commerce which, as the digital age begins, is probably at least as significant as the Communications Act of 1934. This makes the "three days-no hearings" approval process in committee all the more astonishing. A vigorous national security debate is welcome on this issue. The issue of encryption involves profoundly difficult choices and any decisions we make must be taken with grave deliberation and great care. We can postpone these choices but we cannot put them off forever. Ultimately, these decisions turn on findings of fact as to whether control of encryption is still possible. The Administration has made no effort to show its entire proposal is not based on wishful thinking and a regulatory mindset. The United States does have enormous investment in its SIGINT capabilities, which are many and varied. These will also not disappear overnight. But tomorrow will not be like today. Peter Drucker has written movingly of the stress undergone by companies who feel they owe their existence to a particular product but who discover that markets have changed and they must do something different. Companies that succeed are the ones that can innovate. A similar mindset is in order for national security policy. The United States has always competed by out-innovating our adversaries, and on this basis we have always won. The risk to be avoided all costs is a Maginot Line mentality. French planners obsessed with fighting the first World War lavished untold fortunes and considerable engineering brilliance on a structure that was not only useless in the following conflict but locked France into a defensive posture that guaranteed France would be defeated in days by the Germanys mechanized army. The fundamental national security interest of the United States is best served by total dominance of world markets in information technology as well as information technology products and services, financial services, telecommunications and a host of other fields. Our goal should be raw commercial power in all these areas -- especially information products and information flows -- backed by impressive military and intelligence capabilities. However, we do not reach this goal by saddling U.S. business with irrational regulation and ill-conceived industrial policy. When U.S. companies dominate the world markets for advanced management software which foreign businesses must use to remain competitive and telecommunications services which have no equal on the planet, there is tremendous scope for the NSA to work productively with U.S. business. Indeed, the national security community has long enjoyed such a relationship, and law enforcement agencies are well-advised to develop one. The essence of such a relationship, however, is that it must be maintained quietly. We do not need to advertise worldwide exactly how the United States plans to conduct its foreign intelligence or how law enforcement agencies, in truly exceptional and Constitutionally permissible cases, plan to conduct domestic surveillance. Meanwhile, we must remember that the United States has the most to protect in terms of intellectual property, proprietary knowledge, global business dealings, and critical information infrastructures that keep all aspects of our societyincluding the military and strategic onesrunning smoothly. We should be the worlds masters of encryption, the tools to break it, and the ways of getting around it. We should protect our information security by having a diversified environment that relies on no one government-mandated information standard. It should be a stated goal of U.S. policy in the Information Age and the global economy to force totalitarian societies and welfare states to play by our rules or collapse. Our friends in Europe need a wakeup call. Our trusted allies in Asia need reassurance the United States can still exert powerful influence in their region. Developing nations need the model of U.S. economic growth. Russia must see unthreatening but overwhelming U.S. power. The Chinese regime should experience outright destabilization when its totalitarian system breaks down under a coordinated U.S. information technology assault through peaceful means such as Radio Free Asia and Internet communication. These are worthy goals, and they are eminently attainable, as long as technology boondoggles dont sidetrack us along the way. In short, I salute you for making the best possible case for caution at a time when caution is due. However, it is also a time to examine a changing world carefully and prepare for the future as best we can. Let's set our sights on a new American Century. ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

3 2

ESPN hacked -- got info? (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 17 Jul 1997 17:56:29 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: ESPN hacked -- got info? [From a friend. Any responses? --Declan] ---------- Forwarded message ---------- Declan -- Do you have any information about the ESPN/SportZone web site store being hacked? Or a contact? The pro-crypto folks on the Hill are quite interested to know if 1) this site was using encryption before being hacked and 2) what type of encryption they are using now (one of the press stories noted that crypto was one of the security measures implemented after the hacking). I realize this was probably an inside job, but it's good fodder for the Hill. Any insight you might have -- or other examples -- would be great. Thanks in advance.

3 2

PGMedia Comments on the Failure of the NSI-Controlled DNS System
by pgp＠pgmedia.net 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE: NATIONAL DISTRIBUTION: _____________________________________________ PGMedia Comments on the Failure of the NSI-Controlled DNS System (New York, New York) The breakdown of the Internet's Domain Name System ("DNS") yesterday, purportedly caused by human error at Network Solutions, Inc. ("NSI") as well as NSI's antiquated hardware, brought internet traffic to a crawl. This and other recent troubles that NSI has experienced in its operation of the Internet's Domain Name System are textbook examples of a monopolist's inertia in developing new and more secure systems to preserve and protect the integrity of the central facilitator of the Internet. The end-users of the Internet demand and deserve better. In NSI's desire to protect its monopoly profits, particularly in view of its stated intention to offer public stock based on that artificially inflated cashflow, NSI has placed the entire Internet at risk. NSI's intransigence to the change demanded by PGMedia, Inc. d/b/a name.space in the antitrust litigation commenced in Federal Court in New York has also led to the recently reported investigation by the U.S. Department of Justice for NSI's alleged antitrust violations. PGMedia, through its name.space service (http://namespace.pgmedia.net) has developed and implemented a rationalized Top-Level-Domain system that allows for registration under unlimited TLDs such as ".art" "news" ".cameras", ".inc" ".sports" and ".weather". The name.space service is housed on a state of the art network with thirteen root servers located in five countries. The name.space system has been fully operational since August 1996, and was not affected by the "human error" which ground NSI's system to a halt yesterday. If end-users of the Internet wish to secure for their own use, and at no cost, a far more reliable DNS system, all they need do is access the above-referenced URL and follow the simple steps therein to redirect their default TCP name server addresses to the name.space network. In addition, PGMedia believes that the name.space shared product and service oriented TLDs, when fully resolvable, will open up the Internet to far greater commercialization and render the wealth of information on the Internet far more accessible to the end-user. PGMedia's demand for access to the central root zone file exclusively controlled by NSI which would render PGMedia's TLD's and the domain names registered thereunder universally resolvable is currently pending consideration by The Honorable Robert P. Patterson, Jr., U.S.D.J., in Federal Court in New York. PGMedia also wishes to stress that it has no affiliation with and does not support the anticompetitive approach propounded by the loose group of purported registrars known as "eDNS." For more information, please contact the PGMedia, Inc. legal counsel at mjd(a)pgmedia.net; the Amended Complaint in the above-referenced Federal Antitrust Action may be viewed and downloaded at http://namespace.pgmedia.net/law

1 0

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner Click here to play IBM's virtual tennis @ www.wimbledon.org rule DATABASE PROBLEM SLOWS SOME INTERNET TRAFFIC July 17, 1997 Web posted at: 9:53 p.m. EDT (0153 GMT) (AP) -- A problem with the database that keeps track of all Internet addresses slowed network traffic for several hours Thursday morning, effectively blinking some Web sites out of existence. The problem appeared to be resolved by midafternoon. During the trouble, computers couldn't always find someaddresses ending in .net and .com, sometimes e-mail didn't go through and attempts to look up some Web sites came up empty. A user seeking an address ending in .com, for example, wouldhave received an error message that read "Could not resolve DNS," said Aggie Nteta, a spokeswoman for Network Solutions Inc., which runs the main registry of Internet addresses, called InterNIC, under an arrangement with the U.S. government. Every morning at 2:45 a.m. EDT, the files listing all Internet addresses for North America are updated and sent out through the network. On Wednesday morning, two of those files somehow became corrupted, setting off error alarms. However, the system administrator on duty chose to release the files anyway, creating a situation in which many Web sites effectively blinked out of existence, at least in the eyes of browsers. "The big effect was that our site became invisible," saidChris Caldwell, chief engineer at NDA, a Web site design company in Woburn, Massachusetts. Problems with addresses The files were corrected and re-released about four hours later, although it may have taken several more hours for the corrected information to spread throughout the network, Nteta said. The problem is the latest in a series of addressing glitchesover the past few days. Last weekend AlterNIC, an InterNIC rival, briefly took over InterNiC's address on the Web. AlterNIC described this on its Web site as a form of protest over InterNIC's current monopoly on distribution of Internet addresses. InterNIC has also encountered numerous problems with badinformation on its database. Some businesses have been double billed, while others have had their Web sites dropped from the address lists by mistake. Dave Crocker, a computer consultant and founder of theInternet Mail Consortium, said it was a problem of qualityassurance. "The fact that they are growing quickly is not an excuse forthis. The rate of errors they are having would not be tolerable for any other professional organization doing a technical task," he said. Copyright 1997 Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule Related site: Note: Page will open in a new browser window * Welcome to the InterNIC External sites are not endorsed by CNN Interactive. Search for related CNN stories: ________________________________________ ______ [Help] Tip: You can restrict your search to the title of a document. Infoseek grfk Example: title:New Year's Resolutions rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards Tell us what you think! You said it... [INLINE] Click here to play IBM's virtual tennis @ www.wimbledon.org rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

court order required for keys?
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

Posted online news accounts of the McCain-Kerrey bill have implied that the a court order is required under the bill to get keys. Eg, from recent postings, [AP, 07/09/1997] As with wiretaps, authorities would have to obtain court orders to make the keys available for law enforcement. ^^^^^^^^^^^^^^^^^^^ ... Sponsored by Kerrey and Sen. John McCain, R-Ariz., that bill would set up a key recovery system to give computer companies strong incentives to make keys available to investigators who obtain a court's permission. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [Wired, 11.Jul.97] Law enforcement could then access that copy of your key through a court order. ^^^^^^^^^^^^^^^^^^^^^ I find this distressing, because I have read the bill, and a court order is most emphatically NOT required. Only a form specified by J. Reno. This is a tricky point in the bill, but notice that: (1) Court orders are not required for wiretaps in the US. While it may be true that court orders are used most of the time when wiretap evidence is used in a criminal trial, there are a number of exceptions. (2) There is no restriction in the bill to getting keys to decipher communications covered by the wiretap laws. It lets cops get keys to many other communications. Part of the point to using encryption is to use public networks where access to the encrypted data need not be hidden or withheld from the public. Under S.909, if the cops can get access to the data, then they can get the keys without any court order. (3) Even if there is a court-ordered wiretap, there is no obligation to notify the judge that keys will also be seized. While it may seem obvious that if a judge is willing to order a wiretap, he is willing to order key seizure, I don't think this is necessarily the case. When a judge orders a wiretap, he is supposed to be balancing the possibility of getting incriminating evidence against the invasion of privacy of innocent parties. If the keys of innocent parties are being seized as well, it may affect the judge's balancing. (4) In S.909, all of the requirements on law enforcement officials can be lifted by executive order. Am I wrong, or are all the news accounts wrong? Please let me know if there is any flaw in my analysis. Roger Schlafly rschlafly(a)attmail.com (Please CC me on any followup, as I only occasionally read this list.)

1 0

Something of Interest
by IRS Inspection 17 Dec '03

17 Dec '03

United States Attorney Western District of Washington FOR IMMEDIATE RELEASE July 18, 1997 JAMES D. BELL PLEADS GUILTY TO OBSTRUCTING THE IRS AND USING FALSE SOCIAL SECURITY NUMBERS United States Attorney Kate Pflaumer announced that JAMES DALTON BELL, 39, pleaded guilty today in the federal court in Tacoma to two felony charges. BELL, a resident of Vancouver, Washington, pleaded guilty to obstructing and impeding the Internal Revenue Service (IRS), and to falsely using a social security number with the intent to deceive. United States District Court Judge Franklin D. Burgess presided over today's proceedings. The charges stem from an investigation initiated in October, 1996 by IRS Internal Security Inspectors into reports that BELL was gathering the names and home addresses of IRS employees. In previous court hearings, IRS Inspectors testified that BELL had obtained the names and home addresses of 70 IRS employees as part of "Operation LocatIRS." In the eight page plea agreement signed by BELL, he acknowledged that he had gathered the names and addresses of the IRS employees in order to intimidate them in the performance of their official duties. During the course of their investigation, IRS Inspectors discovered that BELL was advocating a scheme called "Assassination Politics", whereby persons would be rewarded with "digital cash" for killing certain undesirable people. BELL identified these undesirables as government employees, such as IRS employees, who would be intimidated from enforcing internal revenue laws for fear of being assassinated. In the plea agreement, BELL admitted that he suggested using "Assassination Politics" as an enforcement mechanism for the "Multnomah County Common Law Court", and that this was part of his effort to obstruct and impede the enforcement of internal revenue laws. In affidavits previously filed in this case, IRS investigators identified BELL as a participant in the "Multnomah County Common Law Court", which was described as a self-appointed anti-government extremist group which purports to hold "trials" of IRS and other Government employees for the performance of their official duties. The affidavits indicated that in January, 1997 the "Multnomah County Common Law Court" held a "trial" of IRS and other Government officials. In the plea agreement, BELL also admitted that on March 16, 1997, he conducted a chemical "stink bomb" attack on the IRS office in Vancouver, Washington, using the noxious chemical mercaptan. In affidavits filed with the Court, IRS Inspectors tied BELL to two previous mercaptan attacks against non-government targets: one being a lawyer's office in 1984, and the other a vehicle in 1989. The IRS investigators also linked BELL to two purchase orders for noxious chemicals, one in 1994 and one in 1996. According to the plea agreement, the attack on the IRS office resulted in a cost to the government of $1,359, and caused a number of IRS employees to have to leave work. In an affidavit previously filed in this case, IRS Inspectors indicated that the mercaptan attack may have been linked to the February 20, 1997 seizure of BELL's vehicle by the IRS for unpaid taxes. As part of the plea agreement, BELL also admitted that he used several different social security numbers in order to hide assets from the IRS and thus to impede the IRS's ability to collect taxes he owed and to prevent the IRS from levying his wages. Federal agents had previously executed two search warrants on BELL's residence. On April 1, 1997, IRS agents seized computers, documents, and firearms during a search. In a follow-up search, the Environmental Protection Agency seized a variety of dangerous chemicals which had been discovered during the execution of the IRS warrant. BELL was arrested by IRS Inspectors on May 16, 1997. BELL continues to be held in custody based on a May 23, 1997 ruling by Magistrate Judge J. Kelley Arnold that BELL posed a danger to the community and was a flight risk. BELL faces a maximum sentence of three years in prison and a $250,000 fine for the obstruction charge, and five years and a $250,000 fine for using a phony social security number. The IRS received assistance in the investigation of BELL from the Portland Police Bureau, Oregon Department of Justice, Oregon State Police, Federal Bureau of Investigation, and the Vancouver, Washington Police Department.

1 0