December 2003 - cypherpunks-legacy

Re: Building crypto archives worldwide to foil US-built Berlin (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 9 Dec 1998 07:33:32 -0500 > From: Robert Hettinga <rah(a)shipwright.com> > Subject: Re: Building crypto archives worldwide to foil US-built Berlin > Walls > ==== > > Q: Is it better for the providers of crypto resources to alarm/log > accesses to their websites or not? > > I'd strongly argue not; > Team Despot will disguise itself and we are surveilled as we speak; > Team Legion loses if it creates targets for harvesting. > > ==== >From a security standpoint it is advised to log access and all resource use for about 4-5 days so you can get a sample big enough to look for under_the_radar_hacking. On the flip side you don't want to keep them longer than that because they could be used in an incriminating manner, whether an actual criminal act occured or not. I use the default buffer time (4 days) for my mail package as my ttl value. Once that time is past the files are bye bye. If the security of the site is compromised then it's pretty worthless as an archive. > Q: Is coordinated integrity control (code signing) a Good Thing? > > I'd weakly argue not; > Alternative argument; > ==== The code shouldn't be signed by any of the archive sites, they shouldn't put their butts on the line. The code should be signed by the originators of same. This verifies that ALL the archive sites have the same package and not individualy modified ones. The archive sites should provide some sort of hash to verify successful transfers. > Q: Should requestors routinely avoid surveilled identification? > ==== There isn't any way around this one. If the site is up and it's advertised and publicly accessible then expect to be identified. Either the owner of the domain/network resources you're using or your registration to the relevant domain name authorities will provide ample pointers. Of course there is the strategy of registering the domain for a year only and then each year register a new one. Then you could provide bogus address and owner information. This of course won't slow a packet sniffer down for long. Onion and CROWDS won't help here unless you're connected directly to the anonymizer. If you're that close they'll find you by following the wires. > it. If one of us goes off the air, step into > their place. You so glibly throw people away...it's better to fix a system such that there is a legal ramification (ie resistance) for the LEA's applying the pressure; a fight in court. Beside shutting the sites down another primary goal of LEA's is to keep the conflict off the evening news. There is ample evidence of LEA's dropping charges because the group made it known they were going to use their day in court as a platform for espousing their agenda. ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Re:
by Mbishop645＠aol.com 17 Dec '03

17 Dec '03

>HaB wrote: ><snip> >> That's a good place to begin, though. "Would you send a letter to >> someone without an envelope?" "Then why not put your email in the >> electronic equivalent of one?" >> >> balance. > >Would I send a letter to someone without an envelope? >One word: postcard. Ahh, but would you tape a check for your phone bill to a postcard? Other than writing a greeting to someone what else do you use a postcard for? --- Paul Weinstein <http://www.weinstein.org> <webmaster(a)weinstein.org> <http://members.aol.com/paulw37280> <paulw37280(a)aol.com> <http://www.waubonsie.com> <pdw(a)waubonsie.com> <http://www.c2.net <pdw(a)c2.net> --- Windows 98(n) - 32-bit extensions and graphical shell for a 16-bit patch to an 8-bit operating system originally coded for a 4-bit microprocessor, written by a 2-bit company that can't stand 1 bit of competition. --- Visit LCARS: A Macintosh Reference at http://www.weinstein.org/lcars

2 1

Wassenaar/Crypto News
by John Young 17 Dec '03

17 Dec '03

A BXA spokesperson said today that the text of the recent Wassenaar agreement had been received yesterday and it is now being prepared for release on the BXA website (www.bxa.doc.gov) maybe by the end of the week but maybe not until next week. She said she expected the US to be the first to publish the doc, after I cited the WA message below from Caspar Bowden. She also said that the Practising Law Institute (www.pli.edu) session on encryption controls yesterday was taped and inquiries should be made to PLI (a continuing legal ed org; ) 1-(800) 260-4PLI. And that Bill Reinsch did not participate in the session, only gave the speech on Dec 7 noted here yesterday: http://jya.com/war120798-2.htm An inquiry to PLI (Betty Gray) has not been returned. >From UK Crypto: From: "Caspar Bowden" <cb(a)fipr.org> To: "Ukcrypto (E-mail)" <ukcrypto(a)maillist.ox.ac.uk> Subject: More from Wassenaar Secretariat Date: Wed, 9 Dec 1998 09:19:09 -0000 Message-ID: <000401be2355$07529ec0$dc77e4d4@cpsb> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal -----Original Message----- From: Wassenaar Secretariat [mailto:secretariat@wassenaar.org] Sent: Tuesday, December 08, 1998 16:54 To: Caspar Bowden Subject: Re: Attn: Dirk Weicke Mr. Weicke is still away, however, I can assure you that the Secretariat has been recently authorized by all member states to publish the new Lists on the web site. This will be done as soon as possible. Please be patient, we are a very small Secretariat. Glenn Sibbitt Special Advisor WA Secretariat Caspar Bowden wrote: > Dear Mr.Weicke, > > We spoke by telephone on Fri afternoon. > > You mentioned that the text and details of the new agreement would be > published on the Wassenaar website this week. > > I understand that you have been away sick for a few days (my > commiserations), but there have been reports from your colleagues > that there will in fact be no publication on your Website. > > I'd be most grateful if you could just confirm when publication of > details will take place, in particular the "Cryptography Note" detailing > key-length limits, and definitions of categories. > > Kind regards > -- > Caspar Bowden http://www.fipr.org > Director, Foundation for Information Policy Research > Tel: +44(0)171 354 2333 Fax: +44(0)171 827 6534

1 0

Re:
by Joel O'Connor 17 Dec '03

17 Dec '03

They say education is power abd naybe they were correct. I agree with the fact that more people need to use encryption, the problem (as you stated) is that people do not understand how to use it, or even know it exists. Unfortunate for us, fortunate for big brother. While the only way we can counteract this debate is through empowerment, the question remains, how do you spread the word to up to a million people, enough to get their interest and keep it, enough to take the time to teach them how to use the tools. I work for an IT department and the users I train rank from intelligent to "where the hell did you come from?!" Teaching people who have no want or need is the hardest part, just ask Christians, they know what it's like. Our greatest problems lie within our inability to train and make use of what lies in front of us, if people don't see the need, then why would they? Another point, some people feel that if they have nothing to hide, then why use it. An acquaitance of mine has the same stubborn attitude, what steps do you take to thwart that? That excuse bothers me beyond belief, but it is a common thought that if you need to take the steps to hide something, then it must be wrong. God help us. . . ---Anonymous <nobody(a)replay.com> wrote: > > I think setting up mirror sites of crypto archives > across the world is a great idea. However, I also > think we need to focus on getting more and more > people to use crypto. I would guess that the vast > majority of computer users worldwide see no use > for encryption in their day-to-day lives -- and > even those that do don't also use it. > > If everybody in the world is using encryption, it > is going to be extremely difficult for "democratic" > governments to tell them they can't use it any more. > > Unfortunately, it's easy for governments to blame > crypto for terrorism and a host of other crimes, > simply because the average citizen doesn't understand > the concept of an "electronic envelope". > > > == Ogre bounces like sonar. . .Peace. Ogre _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

5 4

What happened to this NY Times article on STOA and Echelon?
by Ernest Hua 17 Dec '03

17 Dec '03

Does anyone have any idea what happened to this article on STOA and Echelon? http://www.icdc.com/~paulwolf/nytimes.htm I cannot seem to find it in the NY Times archives. Is it really from 1998? Could it be from 1997? Anyone been in contact with the author? Ern

2 1

The politics of crypto archives
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 09 Dec 1998 17:46:37 +0100 > From: Mok-Kong Shen <mok-kong.shen(a)stud.uni-muenchen.de> > Subject: Re: Building crypto archives worldwide to foil US-built Berlin Walls (fwd) > Let there be a large number of sites. If part of these fail, there > are others that are successful. (Compare evolution.) But two sites don't reproduce to make a 3rd site, some set of sites don't deny environmental resources to others, etc. etc. Your analogy is flawed on many levels. If the sites go down that often what motive would somebody else have if they know they'll face the same sorts of problems and won't have any additional resources to help them face it? Why would you put up a site if you knew that the 14 others before had failed and that nobody would help with your legal fees when you did go down? It's one thing to put your neck on the block for yourself, it's a whole other issue when you start asking other people to do it for your benefit (they obviously don't need an archive since they have the resources already) when you make it clear that you won't reimburse or otherwise recognize their efforts for YOU. > > > If the 'economies', 'infrastructure' 'religon' and what not of the > > > countries do not (yet) affect crypto laws, why care about them? If > > > > They effect crypto by defintion. > > How, for example, can they affects the functioning of an archive, if > you get the right people and machine? Because those machines have to be available and paid for, their utilities need to exist and need to be reliable, the police need to have some sort of legal boundary to cross, and you need some recognized and guaranteed legal recourse for your own self defence. Those are just a couple of the issues involved in running a archive site. Things don't exist in vacuum. You naively take WAY(!!!) too much for granted. I'll tell you what. Just as an experiment put up a CDR node for 6 months and see what it's like. Keep the box up 24 hours a day, pay the electricity, phone lines, domain name, etc. We're talking less than $500 total if you already own a box. Such an experiment is within the reach of just about any person who has sufficient resources (even students) to surf the web. If you don't have the infrastructure to send the email in the clear then crypto won't effect that one whit. And putting up an archive that nobody can get to is not worth the effort either. > > If they don't have crypto laws it's likely they don't have a lot of other > > sorts of laws and the social and economic structure those laws imply. This > > makes it very difficult to operate a archive with any sort of stability or > > protection. > > It is not true that there are more gangsters in the small than in > the powerful nations. What do you mean by stability (which has plenty > of meanings)? Well of course not, the populations aren't comparable. However, it is clear that smaller 3rd world countries have much more stringent regulations or because the instability causes there to be no standards to regulation and lack many of the protections we in the US take for granted. It makes the continued existance of the archive problematic. Putting up an archive on Monday only to have it go down on Tuesday is pyrrhic at best. I use stability in the commen political meaning. The country has a political and social system that is long-lived, has a well defined mechanism for transfer of power (if they even recognize transfer of power), etc. If you're in a situation where some rebels or other forces start lobbing mortar shells into your immediate area then crypto is the least of your worries. Or as in Columbia where a group drove into town, drug people out into the street and shot them in the head. Consider S. Korea. Even though it's a democracy it's illegal to operate a firewall. The closest place S. Koreans can get in many cases to a firewall and network security (for groups outside of S. Korea) is Australia. Now how do you expect to seriously run a crypto site when the military and police have a legal authority to come rummage in your system at will? And can put you in detention if you deny them that access? Those sorts of places are where crypto is needed but clearly can't do the job for themselves. > > And what about the costs and effects incurred by that person you so glibly > > throw away? > > I suppose that running an archive is a voluntary (self-sacrificing) > act of a benovolent person ready to offer his service to the public. > If his site has to close down sometime later, he has to accept his > bad luck. Why should you care so much minutely for him? (And you > say below that the money problem is trivial!) No, it isn't self-sacrifice. It's sacrifice for the users of that archive. Their motives are not self-centered, they're society centered. As users of those archives you OWE them. I would suggest strongly(!) that you spend more time studying ethics and morality. > So it rests to find people who have the time and (that small) money > and energy to run sites and some countries that aren't going to > have strict cryto laws in the near future. THAT, however, is > difficult, I believe. Duh. I wonder why....(well, actualy I don't) ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: No Subject ( camera nonsense )
by Michael Motyka 17 Dec '03

17 Dec '03

> I think we read a message not so long ago from a 'punk who > spotted the prototype of these 'bomb-sniffing cameras' along > a California highway, no? > Don't remember the date but when asked to pinpoint the thing so someone else could actually go take a look there was no response from the original poster. I wrote it off as babbling. There is one device above the westbound section of 580 on the Livermore side of the Altamont pass. About the size of a small SpectraPhysics Laser, the surface appears solid - i.e. no visual sensor. My best guess - radar for either speed measurement or traffic density measurement. Chemical sniffer - NOT. Radiation detector - perhaps, but I doubt it. Best bet - traffic analysis. These counties here are always fighting about population growth and the traffic implications. As if one stinking town owns the entire godamned federal interstate. Little, carpetbagging Napoleans everywhere you look. As for neural systems detecting illegal activity - yeah? what? Two people talking? Looking disreputable? Having their hands *appear* to coincide for a second? This "technology", if detected in a public place, should be zapped and the promoters tarred and feathered*. *Superglue or RTV and polyfill may legally be substituted for the traditional materials. m

4 5

Re: (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 9 Dec 1998 07:26:21 -0800 (PST) > From: "Joel O'Connor" <ogrenivek(a)yahoo.com> > Subject: Re: > They say education is power abd naybe they were correct. I agree with > the fact that more people need to use encryption, the problem (as you > stated) is that people do not understand how to use it, or even know > it exists. Unfortunate for us, fortunate for big brother. While the > only way we can counteract this debate is through empowerment, the > question remains, how do you spread the word to up to a million > people, enough to get their interest and keep it, enough to take the > time to teach them how to use the tools. I work for an IT department I'd say the obvious answer is to buy a spammers mailing list and then use it to send out a one-time-only missive on the issues with a directive of where to go for more information. Mass email letters to newspapers all over the US (or whereever you are). Hit usenet with copies. Buy add space in newspapers and magazines. Hit up the local media for PSA's. Use the local public access television stations. etc. It's not the how that people are having a hard time with, it's the why. ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Intelligent cameras, a reference
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Scientific American Apr. 1996 Smart Rooms Alex P. Pentland pp. 68 - 76 ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

LEA Interviews
by John Young 17 Dec '03

17 Dec '03

This is attorney protected information. We've been having discussion with a legal person about being interviewed by law enforcement officials and/or signing a statement. These comments are offered by permission (and might be coupled with DCF's advice of saying only "I Want a Lawyer"): [Begin comments] > What do you mean, that they would use the information to > "impeach" a possible witness? Do you mean that he would not > be called to testify against a defendant? Sorry to be opaque - "impeachment" means, basically, making a witness lose credibility with the jury. The only use I've been able to imagine for wanting a written statement is to make you look bad, in the event that you are called by either side to testify, and end up testifying favorably to the defendant. If you appear to be a "hostile witness", it's even possible that you can be impeached by the attorney/party who asked you to testify. The scenario I see looks something like this - 1. You're called as a defense witness to testify to the effect that you've been on the list for years, messages like the defendants's weren't unique or especially unusual, that you understood them as satire or political commentary and not as actual threats, given the wider context in which they occurred. The general impression conveyed by your testimony is that you're a rational, reasonable, respectable person who the jury can like and trust, that you think the defendant is perhaps weird but basically misunderstood and harmless. 2. The prosecution cross-examines you about your conclusions re the defendant - they're going to ask you how well you really knew/know him, how much you knew about his other behavior (they're likely to try to sneak in information about the defendant's other alleged misbehavior here, if they haven't already), and so forth. To the extent that you say you didn't know him, your direct testimony becomes less and less relevant - and if you start to say that you did know him well, they're likely to produce the document you wrote/signed, and ask you a series of uncomfortable questions about it, designed to create the impression you were lying to the jury earlier during your testimony, e.g., if the statement says "I didn't know that the defendant had done these other creepy things, and they make me question whether or not I know him very well, and I feel differently about his threats now that I know about those creepy things", the prosecutor will make a big production out of pointing out the differences between your testimony at trial and what you wrote during the LEA interrogation. Understandably, you probably wanted to distance yourself from the defendant when the LE agents were in your home, especially after they'd given you a list of creepy things he supposedly did - but they're going to hold you to the same degree of distance from him and his thoughts/actions if you end up testifying at trial. Writing it down and having you sign it serves several purposes - it gives the prosecutor a document s/he can wave around, ask you to read from, and otherwise organize a little production around - it also lets you be impeached with your own words, instead of calling the cops to the stand to dispute your recollection of your conversation, which takes on a "he said/she said" tone, and might make it look like the big mean cops were picking on poor little you. If they can make poor little you eat his own words, they look good, and you look bad. So .. that's what I'm afraid the document is for. I've been trying to think of something else - but especially where the agents asked you to pick out just key bits of your conversation, and assert that they're true, and let the rest of the information be lost to memory and time .. it makes me think the information they selected was important to them. The information they got seems helpful to them only in the context that you end up testifying at trial - I can't think of any other reason it would be useful to them. It sounds like the psychological factors of the questioning were pretty well optimized to make you want (probably partly subconsciously) to distance yourself from the defendant, both to avoid implied guilt by association, and to maintain a common ground of reasonableness with the cops while discussing other things like politics. The current issue of the Utne Reader has a piece by the Unabomber's brother and his wife talking about how the FBI manipulated them into providing evidence against the Unabomber by appearing sympathetic and reasonable, forming a common "us (good people) versus the actions of they crazy guy, who needs us to work together to help him get better" bond which was ultimately used to try to kill the crazy guy, to the horror of the brother/wife. While I do think that they may have pulled a fast one on you, I don't think that reflects badly on you as a person .. it's pretty difficult to tell which cops are actually reasonable people, and which are pretending to be reasonable people in order to further their own agendas. [End comments]

1 0