December 2003 - cypherpunks-legacy

SAFE = Security and Fascism through Escrow
by Tim May 17 Dec '03

17 Dec '03

As our Big Brothers in D.C. continue to abuse the language by taking SAFE in a direction 180 degrees from the original intentions, it seems only fair that we rename the bill the Security and Fascism through Escrow Bill. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

BXA TAC meeting in Portland yesterday
by Greg Broiles 17 Dec '03

17 Dec '03

As noted previously by John Young <http://www.jya.com/bxa082597.htm>, the Department of Commerce's Bureau of Export Administration's Technical Advisory Committee held a meeting yesterday in Portland, OR. C2Net paid for me to fly up to Portland and attend the meeting. The following are notes re what happened - It was difficult to determine precisely who is on the Committee and who isn't; the meeting room had a table with seats for (approx) 15 people; at that table were seated approx. 10 people who were representing hardware/software manufacturers, law firms, 2 people from BXA, two "special guests" from European companies (whose names I didn't recognize), and two "special guests" from Japanese companies - Susumi Hirai for Sony, and Kobashi Toduchi for NEC. (apologies for the spelling re Japanese names, those are my guesses at the correct spellings, but I bet they're wrong.) There were seats in an "audience section" for another 30 people, all of which were occupied. Among the companies represented (either in the audience or on the committee) were Tektronix, Boeing, Dept of Energy, Motorola, Intel, Rockwell, Novell, McDonnell-Douglas, Boeing, Cisco, and Sun, and C2Net. The attorney who spoke at a Cypherpunks meeting this spring re export control was there, don't know if he was there on behalf of PGP and/or other clients. (arrgh, didn't write his name down because I remembered it, now I can't remember it.) There was an attorney representing a consortium of manufacturers. The meeting opened with a short summary/discussion of current events - this part produced the most information relevant to crypto and export control issues. Eileen at BXA (didn't get her last name), who seems to be in charge of drafting regulations and granting/denying export licenses, said that they've been slow recently re actions on crypto-related licenses because they're understaffed, but they have recently hired 10 people to process crypto-related applications, 8 of whom are in public-contact positions. She said that they don't have a technical background, but are considered policy analysts; that they've been receiving technical training from "other agencies", but their technical training (and their ability to get straight to work) has been hampered by the slowness of getting security clearances for them. 2 of the 10 have already been cleared/approved. She said that they've been learning about the "history of encryption". The public-contact positions will each handle a section of the alphabet - so, for example, the first person will handle export applications from individuals/companies with names starting from A through F, and so on. Eileen said that they have been circulating a new draft of encryption regulations relating to/concerning financial institutions; a draft of it was apparently circulated (I think) to a closed-session meeting of the Committee previously. One of the committee members asked her for a ballpark estimate of the date when those regs will be released for public comment, and she deferred, saying that there were "so many agencies" that had to look at them that it was too difficult to guess. Apparently, the most difficult/controversial part of these regulations concerns the definition of a financial institution (FI); she said that they've been granting licenses to applicants who are clearly FI's, and that organizations who think that they might qualify as an FI should write to BXA and request an advisory letter or opinion letter about whether or not they qualify. She also said that they've been drafting and circulating export regulations designed to implement the Wassenaar Arrangement; they've been circulating inter-agency. She said that they anticipate having the final draft finished at the end of this week or the beginning of next week, at which point it'll be sent to the Federal Register for publication; and that FR publication will take 2 more weeks, so these ought to be available to the public sometime in mid-October. She also noted that BXA has been relatively inactive with respect to enforcement actions re cryptography, but that the enforcement/compliance section of BXA has also made new hires, and that they anticipate ramping up enforcement. 5-6 people from the enforcement section were at the meeting (turns out I sat right next to them) but they all left at 10 AM for another meeting - among them a DOC/BXA attorney I recognized from the Bernstein hearings. After that, the committee spent approx. 2 hours discussing nonproliferation controls (related to nuclear/biological/chemical weapons) - I didn't bother with a lot of notes about that, since it's not especially interesting to me right now. There was a lot of discussion about how difficult it is to determine whether or not an export is allowed or not - as I understand the regs it's not permissible to export *anything* which will be used in aid of producing N/B/C weapons, even otherwise unassuming things like lightbulbs or ballpoint pens or carpeting or whatever. (I don't know much about this area of export law, so please don't take my impressions as especially informative, haven't done reading/research re this and I may be full of shit. caveat emptor.) Everyone who doesn't work for the government expressed frustration re the difficulty of figuring out how much effort they need to put into tracking down the ultimate user(s) and purpose(s) of otherwise innocuous exports - the BXA folks weren't very helpful, pointing out that they're going to exercise their discretion not to enforce/punish exporters who really weren't at fault, but that there were no hard and fast rules available, either. The discussion here reminded me very much of recent testimony by the Commerce Dept before Congress - they're more concerned with intelligence (collecting data re who's buying what, in what quantities, and when) than they are with preventing people from gaining access to goods. There was also some discussion about foreign implementations of crypto export controls and Wassenaar - apparently Jim Lewis (the name isn't familiar to me) and David Aaron are currently in London, lobbying re crypto export control/key escrow, and a delegation will go to France, Bonn, and Tel Aviv later this month on a similar mission. One speaker said that he expects the UK to adopt controls re "intangible" items - by this he seemed to mean control over the export of "technical data" and "technical assistance" related to controlled items, similar to the US' control over providing data/information/assistance to foreigners related to export-controlled items. It was also noted that there are a lot of "informal contacts" in the UK between universities and employers and the visa office, such that the UK has been able to control some access by foreign people to technical data and information, by refusing them a visa or otherwise making their desires clear to the people in the UK who they expect would have contact with the foreign person. Re Japan, it was noted that Japan began enforcing much stricter export controls at the end of 1996, shortly after NTI developed a 3DES chip; MITI (Japan's "technology" ministry? perhaps someone can provide more data here) has concluded that exports of crypto stronger than 56 bits should be subject to strict export control. Japan does not have a "general license" scheme, whereby some products are generally considered eligible for export, which would apply to crypto - apparently all exports equire a license. About 100 Japanese companies have applied for or been granted (couldn't tell from the context) export licenses for crypto. Japan does not have special "financial institution" exceptions to its crypto export control laws; but it does implement the "mass market software" exception for crypto which is part of the Wassenaar Arrangement. There was some discussion re crypto export control in the EU; the speakers noted that crypto control laws apply to GSM phones, which (potentially) would have made them non-portable across national borders, which everyone (including governments) thought was a stupid result, so GSM phones are (formally? informally? couldn't tell) exempt from the export control laws. Similarly, it is now legal to have/use crypto on a laptop for personal use; at one time, this was not the case, but large companies' policy was that crypto should be used anyway, regardless of the export control laws. EU countries are also (apparently) writing the "mass market software" exception to the WA's control over crypto into their regulations; one speaker commented that the EU countries are "working on" key recovery. (the term used was "key escrow"). The consensus of the speakers seemed to be that the TTP/key escrow draft legislation for the UK is effectively dead, due to the shift in power to Labor. It was also noted that the Walsh Report re crypto in Australia recommends that purchasers of crypto equipment in Australia avoid depending solely on US-based sources for crypto, because of the danger that the US may implement mandatory key recovery. I'm on the mailing list to get formal minutes from the meeting, but that can apparently take up to 90 days. The next meeting will be 12/9/97 in D.C.. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

1 0

cancel subscription
by DONN CARROLL 17 Dec '03

17 Dec '03

Please cancel my sbscription to the encription letter. there are to many. Donn, syzygy(a)mymail.net

1 0

What is a crypto product. Was [nobody@replay.com: Re: "priorproducts"]
by Martin Minow 17 Dec '03

17 Dec '03

(I've changed the list from coderpunks to cypherpunks, as this is getting off-topic for the former list.) At 12:48 AM -0500 9/17/97, Black Unicorn wrote: > >This brings up interesting coding implications. What is a "cryptographic >product" and to what extent can key generation be seperated from the >definition. To what extent do we want it to be? > I would say that a "cryptographic product" is any [insert patent lawyer language here] that can be used to encrypt or decrypt a message, and a "key" (the thing you escrow) is the mechanism by which a message is converted between plaintext and encrypted text. (Note, then, that I am including both halves of a public key pair.) By this, admittedly devil's advocate, reasoning, the sender would have to escrow the actual session key, not just the private key that the receiver uses to recover the session key. After all, if you use PGP to encrypt a message using a public key -- and don't possess the corresponding private key -- you couldn't read your own message, but my reading of the law is that the government still must have immediate access to the plaintext. Martin Minow minow(a)apple.com

1 0

FWD: Dear Representative Oxley
by Anthony Garcia 17 Dec '03

17 Dec '03

For what it's worth. -Anthony Date: Wed, 24 Sep 1997 17:47:37 -0500 (CDT) From: Anthony Garcia <agarcia(a)Starbase.NeoSoft.COM> To: Mike.Oxley(a)mail.house.gov cc: agarcia Subject: Dear Representative Oxley At this time, it looks like your ignorant, anti-Constitutional amendment to the Safety And Freedom through Encryption Act will be passed by the Commerce Committee. This legislation may go on to be passed by Congress and signed into law by the President. In case this occurs, I would like you to make note of my home address and telephone number. They are: Anthony Garcia [address & phone elided for broadcast on cypherpunks list] If I move to a new address in the future, I will update you. I telling you this because I fully intend to willfully break your stupid law exactly 1 minute after the moment it goes into effect on January 1st, 1999. I will: - Manufacture an encryption product that does not support key escrow (I will compile source code for encryption software which does not support key escrow.) - Offer to sell that encryption product to any takers for the sum of $1. - Offer that encryption product for free to the public via FTP or HTTP file transfer over the Internet. - Import an encryption software product which does not support key escrow by means of file transfer over the Internet from a foreign source. So, get ready to arrest me, Big Mike. Get out your old FBI shield and shine it up, because I AM GOING TO BREAK YOUR LAW. GOT IT? Sincerely, -Anthony Garcia agarcia(a)neosoft.com P.S. When you have some free time, look up a document known as the "Bill of Rights", and review the sections titled "First Amendment" and "Fourth Amendment".

1 0

bombs
by JuanPyro＠aol.com 17 Dec '03

17 Dec '03

im writing a screenplay and need very detailed instructions on how to make a bomb

3 2

Just don't get GAK
by Reusch 17 Dec '03

17 Dec '03

>From the DOJs' letter to all CongressPersons in re SAFE, http://jya.com/hr105-108-pt4.htm, signed by Reno and Freeh, one has "Further, today's international drug trafficking organizations are the most powerful, ruthless and affluent criminal enterprises we have ever faced. We know from numerous past investigations that they have utilized their virtually unlimited wealth to purchase sophisticated electronic equipment to facilitate their illegal activities." How can anyone expect that mandated GAK will do anything at all to prevent "affluent criminal enterprises" from using steganography, covert channels, etc. and why is this point never directly addressed? Lord knows I can use the dinero and I can stego this months' receipts mui pronto. Entende amigo? Am I supposed to believe that tools for steganography, etc. are not already widely and irretrievably disseminated? Or am I to assume that gaked traffic between inept felons is so valuable as to justify the $? infrastructure implied by the Weldon/Dellums and/or Oxley amendments (what awaits in the Senate)? US security agencies have recently emphasized the value of intelligence received from unencrypted channels (don't remember where). Perhaps, this is because they decrypt ever less and less of the remainder. But if traffic between the duh set is that great, why not just maintain the status quo? Or is this some evil plot to listen to our bathroom sounds? Abracos, Puzzled

1 0

Installation Procedures
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

----- Begin Included Message ----- <forwards have descended> ------------------------------------------------------------------------ INSTALLING THE SOFTWARE: Introduction Thank you for purchasing InCom's PowerComp Libraries. At InCom, customer satisfaction is our number one priority, and we hope that you will be pleased with the power of our libraries. Please follow all of the instructions in order to enjoy a quick and easy installation. Getting Started In this guide, information which you will need to supply will be enclosed in angle brackets, <like this>. Commands which you will have to enter will be indented, like this. You will need to provide a loading directory, in which to load the material from tape (/tmp/pcl is recommended), and a permanent installation directory (/usr/local/pcl is recommended). Loading From Tape First create and change directory to the loading directory: mkdir <working directory> cd <working directory> Now you are ready to load the software from tape. The specific device name needed to load the tape varies with hardware vendors, and may be found in Appendix A, "Vendors and Device Names". Load the software from tape: tar xvf /dev/<device name> You have now loaded all of the software from tape, and are ready to compile and install the PowerComp libraries. Compiling and Installing the PowerComp Libraries Compiling and installing the libraries is handled by a user-friendly shell script. You will need to provide some information to the script, such as your organization name and registration number. To run the script, type /bin/sh pcl/pcl.install -d <installation directory> Follow the script's directions, and provide the information which it prompts for. When the script prompts you for the directory in which the distribution files are located, you will find that you are unable to provide it with any directory which the script will deem satisfactory. That is because it is necessary to order the following additional parts which are necessary to continue with the installation: Part Number Qty Name Price GM-96-3026 1 Goat, male 1000.00 CB-13-2395 1 Candle, black 50.00 CG-63-6376 1 Chalk dust container 10.00 IB-89-3335 5 Incense sticks 5.00 DE-44-8846 1 Dagger, ebon, curved 500.00 AS-87-2319 1 Altar, silver 10000.00 Wait until the additional parts arrive; you will be ready to continue the installation the next Friday the 13th at midnight. Ritual for Successfully Completing Installation Stand in front of the computer. Pour out the chalk dust in an inscribed pentagram around you; be sure that it is without breaks. Set an incense stick at each of the five corners, the altar in front of the computer, and the candle in front of the altar. Light each of the incense sticks and the candles, chanting in a low voice: Daemons and spirits of the netherworld Forces of all that is chaotic and mysterious Essence of Netscape and MicroSoft I am coming here to appease you I offer you this goat That my software may work I bind you here Do not make my system crash Let the software install as advertised Place the goat on the altar, and slaughter it with the dagger. May this goat feed you Sate your lust for blood Into it may your mischief fly Not my computer Make the software work For this is the only way Then spit into the computer's ventilation slots. This will complete different circuits inside the computer, causing its motherboard and cards to function in ways that the engineers never intended, thereby making your system compatible with our libraries. Reboot your computer. The installation is now complete. ----------------- End Forwarded Message ----------------- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Systems Guides bstaud(a)sysgu.com Bill Staudenheimer Vox: 415-917-8170 PO Box 4130 Fax: 415-917-8172 Mountain View, CA 94040-0130 http://www.sysgu.com ----- End Included Message -----

1 0

oxley amendment
by Ariel Glenn 17 Dec '03

17 Dec '03

a fine statement which I would be proud to echo. however I heard (I've been calling every hour) from a staffer in Tauzin's office that the amendment was defeated after all! he didn't have the numbers and I couldn't find out about the competing propossal, but he was quite sure that oxley went down in flames. I wish I could confirm this from some other source, but the news will be out there one way or another tomorrow morning so we'll all know... yes, I found it on cdt's home page, they must have just put this up! the committee ditched the earlier amendment adding extra export restrictions, but they did approve the white amendment which toughens the criminal penalties for use of encryption to further a crime. *whew* we actually won one! but there is a long way to go yet... Ariel Glenn ariel(a)columbia.edu

1 0

Soviet spies at NSA
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

http://customnews.cnn.com/cnews/pna.show_story?p_art_id=341606&p_section_na… [look at the last paragraph] Former Army Clerk Sentenced for Cold War Espionage AP 24-SEP-97 PHILADELPHIA (AP) A former Army clerk at the National Security Agency was sentenced to 18 years in prison Wednesday for selling secrets to the Soviet Union three decades ago. Robert S. Lipka, 51, pleaded guilty in May to conspiracy to commit espionage. He was arrested last year after his ex-wife betrayed him. "I put this to rest many years ago, and I never dreamed it would come out like this," a tearful Lipka told U.S. District Judge Charles R. Weiner. "I owe an apology to a lot of people." Lipka was trained as an intelligence analyst and had top security clearance with the NSA at Fort Meade, Md., where he was responsible for distributing and destroying classified documents. Between 1965 and 1967, Lipka photographed documents with a camera provided by the Soviets and dropped the film off in a park for up to $1,000 a drop, prosecutors said. He allegedly got a total of $27,000 from the KGB. In the late 1960s, Lipka told his then-wife, Patricia, that he was selling NSA materials to the Soviets. The couple married in 1966 and divorced in 1974. In 1993, after Lipka's wife went to authorities, Lipka recounted the arrangement for an FBI agent posing as a Soviet spy. After his arrest, the coin collector and gambler from Millersville threatened to reveal government secrets on the Internet if his case were not dropped. The judge also fined Lipka $10,000.

1 0