December 2003 - cypherpunks-legacy

Bidzos editorial moves across business wires
by David HM Spector 17 Dec '03

17 Dec '03

This just went out over the wires... attributed to Investors Business Daily Headline: Guest Editorial Nothing Safe About Encryption Bills ====================================================================== By D. JAMES BIDZOS Congress is intent on regulating encryption technology in the name of law enforcement, no matter what the cost. But the real debate's not about fighting crime. It's about the ability of American business to compete in our new networked world. The Senate is nearing a vote on a bill, by Sen. John McCain, R- Ariz., and Sen. Bob Kerrey, D-Neb., requiring all encryption products made, sold or used in the U.S. to provide on-demand government access to encrypted files with a court order. In the House, the story's more complicated. The Commerce Committee on Wednesday approved the Security and Freedom through Encryption Act, a bill by Rep. Bob Goodlatte, D-Va. that was written to bar domestic controls on encryption. A few weeks ago, SAFE was amended to resemble the Senate bill. But the Commerce Committee scrapped the change and restored the bill's original language. The battle now moves to the Rules Committee, where Rep. Gerald Solomon, R-N.Y., vows to restore the decoding provisions. FBI Director Louis Freeh wants encryption controls passed. He told the Senate Judiciary Subcommittee on Technology that without such a law, "Our ability to investigate and sometimes prevent the most serious crimes and terrorism will be severely impaired." No one wants the FBI stymied in its efforts to fight crime. Unfortunately, the debate in Congress so far has painted the Senate bill's opponents as ignorant of public safety and national security concerns, or, worse, willing to put commercial interests ahead of them. What's missing from the current encryption debate is a clear understanding of the implications of the Senate bill, and the identification of safeguards against abuse of a "key recovery" system. Key recovery means that someone other than the main user holds a copy of an encryption key. Everyone agrees that key recovery is useful, even necessary. The bottom line is, who should hold the keys? Strong encryption is already a fact of life in the U.S. and around the world. Advanced, strong, unescrowed encryption is used in millions of products, including every Web browser sold by Netscape Communications Corp. and Microsoft Corp. Law enforcement and the national security establishment view strong encryption as a threat to their efforts to safeguard the public from those who would encrypt incriminating data. But this is a myopic view. Fact is, in our evolving cyber-society, everything about us will be stored digitally. Contrary to the position of the FBI -which says it only wants to maintain wiretap capabilities as they have existed since 1968 - the proposal for key recovery is not the digital equivalent of putting alligator clips on phone wires. It's more like giving the government the keys to all of our personal and professional lives. While the FBI says such access will only be by authorized court order, it has not explained how controls and audits will prevent abuse of these valuable keys. Would people allow local and federal law enforcement to have and store a copy of the keys to their homes and their filing cabinets? The computer industry fears that a law requiring products to include U.S. government access will make them unable to compete in a market where roughly 60% of their revenues come from outside the U.S. And U.S. firms operating overseas are very concerned. Foreign governments with key recovery would have every reason to use it to steal trade secrets and pass them on to their own industries. In France and elsewhere, government spies often help state-owned firms steal trade secrets from U.S. companies. The FBI hopes that the U.S. encryption market can sway the rest of the world. But if other countries take the position - as Germany has - - that they will not control the export of encryption or require key recovery, how will U.S. industry compete? Along with Germany, encryption companies are springing up in South Africa, Ireland, Belgium, Switzerland and Singapore to exploit opportunities created by a restrictive U.S. export policy. The administration and Congress seem ready to accept that American industry will become a casualty of the crypto-wars as it struggles to comply with a law no one fully understands, and foreign suppliers step in to meet the demand. We can only hope that Congress will stop and think on this critical issue before enshrining key recovery in law. D. James Bidzos is president of RSA Data Security Inc. in Redwood City, Calif. ------- End of Forwarded Message -- ------------------------------------------------------------------------------- David HM Spector spector(a)zeitgeist.com Network Design & Infrastructure Security voice: +1 212.580.7193 Amateur Radio: W2DHM (ex-N2BCA) (ARRL life member) GridSquare: FN30AS -.-. --- -. -. . -.-. - .-- .. - .... .- -- .- - . ..- .-. .-. .- -.. .. --- "New and stirring things are belittled because if they are not belittled, the humiliating question arises, 'Why then are you not taking part in them?'" --H. G. Wells

1 0

In response to Declan's questions about crypto.com
by Jonah Seiger 17 Dec '03

17 Dec '03

This morning, a private note from me to Declan -- part of an ongoing personal conversation between Declan, CDT, and his editors at Time -- was forwarded to several public lists. It was not, as some have assumed, an attempt to obscure the substantive issues he raised. Unfortunately, this whole thing explored before CDT had a chance to respond to Declan's questions directly. I hope that the points below will help to clarify the issues: 1. CDT, along with VTW, EFF, ATR and Wired, spent the last two weeks rallying Internet users to call the Committee in opposition to Oxley-Manton. We generated thousands of phone calls from constituents to the Committee, which we believe was a decisive factor in the defeat of Oxley-Manton. 2. CDT rallied support among the computer and communications industries, including many companies that have not yet weighed in yet on this issue. Opposition from the baby bells, along with companies who have in the past been favorable to the Administration's position (like IBM and TIS), probably made the difference in defeating Oxley-Manton 3. CDT did NOT support, nor work on, the White-Markey proposal. We strongly oppose the increased criminal provisions (as well as the criminal provisions in the original SAFE bill). We are also concerned about the role of the NET Center and the proposed liability limitations for key recovery agents (though we do not believe that any liability limitations were included in the final bill) 4. CDT continues to support efforts to relax encryption export controls. We believe that export relief is critical to promoting privacy and security on the Internet, both at home and abroad. We are steadfastly opposed to ANY domestic requirements, mandatory or "voluntary", to incorporate key-escrow, key-recovery, or other "immediate access" requirements. 5. We expect that all efforts to enact encryption reform legislation are stalled for the remainder of this year, and we do not support any effort to bring SAFE to the House floor. All our efforts are focused on stopping Congress from passing any bill in the foreseeable future, unless and until it is clear that domestic law enforcement access requirements will NOT be a part of any legislation. 6. We are not working for a "compromise" with the FBI or any other supporters of domestic encryption controls. We also recognize the realities of politics. No matter how much any of us might wish it to be true, members of the Commerce Committee were not willing to stand up and simply oppose everything. It was not in the cards. White and Markey offered them a chance to defeat Oxley while throwing a small bone to law enforcement. We believe that passage of SAFE with the White-Markey amendment, despite the problems with the criminal provisions, is on balance, a step forward in the fight for encryption policy reform. That's why we have described the vote on cryto.com as a "vote in favor of privacy". I do not expect that this will convince all of our detractors, but I do hope this clarifies the substance of Declan's criticism. As always, I am happy to respond to queries about CDT's positions and tactics, but I am not interested in engaging in public flame throwing. Best, Jonah * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crypto.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager +1.202.859.2151 <jseiger(a)cdt.org> PGP Key via finger http://www.cdt.org http://www.cdt.org/homes/jseiger

5 4

No Subject
by CDR Filter Account 17 Dec '03

17 Dec '03

1 0

Plea from a parent who wants to keep their kid free of SSNs
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- John Bishop wrote: >Well, seeing how Mr. Treibs is not a Nazi, satan worshipper, or pagan >fundamentalist, I doubt that the ACLU will want much to do with him. This slur is unwarranted. The ACLU has a long tradition of defending religious rights, even those of Christians. My personal favorite is the case of the Jehovah's Witnesses in the 1950s. The Witnesses believe that they cannot honestly pledge allegiance to the flag. They believe that they owe allegiance to God. Were the government to act in a way that was other than God's intention, they would be unable to cooperate. This had to go all the way to the Supreme Court and it was the ACLU that did it when nobody else would. Be my guest to criticize the ACLU, but you'd do better to pick one of their weak points. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCtLP5aWtjSmRH/5AQG45Qf8Doesmpghrdt572xVCXtTCy1K/TY0h75I OwJV4hG/NHo/QnUyD2m3qoH0GzAPntCEyDcg8J5BLBJlkYPQXS8yDZu6irHtstIj 3gLSbL8sXQQ+0SfFPt4iRQPFd8x0erjZE7MH8wxvZGwUQJfHnUtrG8PaOdFWyzpg tg9/lBet+GAM18DtQhqYPN1/eJ+bkoW6MBq83ncSVJ2CD90mGQBK7/Ifunn8jLUG fZ1CMdanJjjCOhLOEWIGqx6kJXZQhmol3DMrCDYTYXemP3GNoaPeHScZJB5GsiPF WFzqzgyakncp+P1EGWqr+2+TG+4LV1cXg9kJOfD3q9z1uz+/n4CRvA== =9B3r -----END PGP SIGNATURE-----

2 1

RE: Re: How the FBI/NSA forces can further twist SAFE
by jay holovacs 17 Dec '03

17 Dec '03

========================== >From: "Paul Spirito" <berezina(a)qed.net> >Date: Thu, Sep 25, 1997 11:58 PM > >And next year *is* an election year. If nothing awful happens, it shouldn't be much of an issue, but sooner or later there'll be a big bang made by terrorists who've used crypto in the plotting, & then anyone who opposed the FBI line will get drubbed, perhaps fatally (i.e. they'll lose their seat). On the other hand a publicized security disaster or "infowar" attack could spin things in the other direction. Jay

2 1

Technology center
by John Smith 17 Dec '03

17 Dec '03

One of the parts that got added to the SAFE bill is this new Technology center. It is supposed to help the FBI when they run into encryption. We all know that's not going to work. Not very well anyway. Maybe if it's some bogus encryption like the SMIME that has a new crack program out for it, they'll get through it. But if it is real crypto then there's no way the Technology center is going to be cracking keys. What I think they'll do is work on virus software. They can write something which will hack the crypto on your PC and make it weak. If they want to wiretap some drug dealer, they get him to download one of their programs somehow. Maybe they've got a Java bug which lets them hack files when he goes to a certain web page. Or maybe they get him to download some free demo of a game or interaction service (hotchicks.com) Whatever, the program actually looks for PGP and other crypto software and hacks it. Now the FBI can read his stuff. This is probably even legal. If they could break into his house and stick a bug in his computer, why can't they do the same thing electronically. They might even want to set things up ahead of time so that crypto software gets hacked for everyone. They won't look, see, unless they get a judge to OK it. But they get some utility that everybody uses like realaudio or winzip, and they convince the author to put in their hack. Now everybody who uses this has their crypto broken. The FBI promises not to do any decryption without a warrant, so they haven't actually stolen anyone's privacy. Maybe they could even set it up so that it was only broken for the FBI, that anybody else wouldn't be able to read it. Do you think would try this? What would you do if you were an a**hole and ran the Technology center? "John ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re: Chutzpah! FBI Calls Privacy Extremists Elitist
by Jay Holovacs 17 Dec '03

17 Dec '03

At 11:54 PM 9/25/97 -0400, David HM Spector wrote: > >The absolute positions "handcuffed" law enforcement while also raising >rights for citizens to levels that were unreasonable and that would >have been foreign to the nation's founding fathers. Extreme privacy >positions were ultimately elitist and nondemocratic in that they >presumed the views of a knowing privacy cognoscenti should pre-empt >the views of the nation's elected officials and the Supreme Court, >McDonald said. Elected officials? FBI and NSA lifers are about as far as possible from accountable elected officials. (And the whole point to elected officials is that they can be influenced by the constituents) I was told by a House staffer (a relative) that within the FBI many of the agents resent Freeh, they feel he is giving away the store (!!!) because of some policies he supposedly has taken to prevent another JE Hoover (though I can hardly imagine what). Anyhow this staffer said, he would really worry about such gung-ho agents having access to private communications. > Jay

1 0

Re: In response to Declan's questions about crypto.com
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Jonah Seiger didn't have any better sense than to write: > We also recognize the realities of politics. No matter how much any of us > might wish it to be true, members of the Commerce Committee were not > willing to stand up and simply oppose everything. It was not in the > cards. White and Markey offered them a chance to defeat Oxley while > throwing a small bone to law enforcement. We believe that passage of SAFE > with the White-Markey amendment, despite the problems with the criminal > provisions, is on balance, a step forward in the fight for encryption > policy reform. ARE YOU FUCKING CRAZY!!!!????!!!!???? Do you remember the NRA? You know, the organization that used to refuse to compromise on defending the Constitution? Well, they decided to play DC's game, and now they are nothing more than a bunch of lame fucks who spend their time trying to explain to their dwindling membership that people with half-a-brain and a modicum of common sense need to give up their right to self-defense so that brainless retards won't get murdered with their own guns. Louis Freeh wants cryptographers' nuts and the CDT wants to tell us that giving him *one* nut is "a step forward." NEWS FLASH FOR THE LAME FUCKS AT CDT!!!! The Constitution and the Bill of Rights *do*not* end with the words: "...just kidding!" "...unless it's too much trouble." "...except for drug dealers, pedophiles, pornographers and terrorists." "...except for niggers, spics, wops and kikes." "...except for women." "...except for communists." "...except for Dr. Dimitri Vulis, KOTM." "...unless the 'legitimate needs of law enforcement' necessitate the abandonment and/or abrogation of all basic human rights." "...up until the time comes when people purporting to defend basic human rights guaranteed under the Constitution decide to support the compromise of the rights of others." > That's why we have described the vote on cryto.com as a "vote in favor of > privacy". I do not expect that this will convince all of our detractors, > but I do hope this clarifies the substance of Declan's criticism. Declan's criticism does not *need* clarifying. What needs clarifying is how CDT and it's bum-buddy organizations can possibly claim to justify the turning of 'rights' into 'privleges' which can then be revoked by those who claim to 'grant' them. Is CDT going to desribe the vote for the law allowing the citizens of the US to take 'reasonable' breathes of air as "a vote in favor of breathing?" Do us all a favor and stand next to the lawyers so that Shakespeare doesn't have to waste bullets when people of reason get tired of letting the lame fucks rule the planet. Toto (posting anonymously) > As always, I am happy to respond to queries about CDT's positions and > tactics, but I am not interested in engaging in public flame throwing. > > Best, > > Jonah > > * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * > Adopt Your Legislator - http://www.crypto.com/adopt > > -- > Jonah Seiger, Communications Director (v) +1.202.637.9800 > Center for Democracy and Technology pager +1.202.859.2151 > <jseiger(a)cdt.org> > PGP Key via finger > http://www.cdt.org > http://www.cdt.org/homes/jseiger

1 0

OpenPGP approved for standards track by IETF
by Damaged Justice 17 Dec '03

17 Dec '03

-- forwarded message -- Path: wmich-news!gumby!newspump.wustl.edu!rice!bcm.tmc.edu!news.msfc.nasa.gov!newsfeed.internetmci.com!204.238.120.130!jump.net!grunt.dejanews.com!not-for-mail Date: Fri, 26 Sep 1997 13:51:52 -0600 From: nospam(a)synernet.com Subject: OPEN-PGP" APPROVED FOR STANDARDS TRACK BY IETF Newsgroups: alt.security.pgp,comp.security.pgp.discuss,alt.security,talk.politics.crypto,alt.privacy,alt.privacy.anon-server Message-ID: <875299757.20568(a)dejanews.com> Reply-To: nospam(a)synernet.com Organization: Deja News USENET Posting Service X-Article-Creation-Date: Fri Sep 26 18:49:17 1997 GMT X-Originating-IP-Addr: 166.82.194.182 (estone.vnet.net) X-Http-User-Agent: Mozilla/3.0 (Win95; U) X-Authenticated-Sender: nospam(a)synernet.com Lines: 99 Xref: wmich-news comp.security.pgp.discuss:5111 "OPEN-PGP" APPROVED FOR STANDARDS TRACK BY INTERNET ENGINEERING TASK FORCE Working Group formed to pave worldwide protocol for secure communication SAN MATEO, Calif. (Sept. 25, 1997) -- In a milestone decision for the standardization of secure electronic communications worldwide, the Internet Engineering Steering Group today unanimously approved the formation of an official IETF (Internet Engineering Task Force) Working Group to develop a secure email specification called "Open-PGP." The proposed Open-PGP standard will build on Pretty Good Privacy, Inc.'s (PGP) encryption technology, which already is used by millions of individuals around the globe. To facilitate an international standard and promote growth of the Internet, as well as related industries worldwide, PGP released change-control of its technology to the Internet Society (ISOC), and the Internet Engineering Steering Group (IESG). "As the IETF Security Area Director, I'm very pleased that PGP Inc. yielded change control to the standards body," said Dr. Jeff Schiller, manager of Computer Services at MIT. "MIT has been a proponent of PGP from the very start -- in 1991, MIT distributed the first non-commercial version of PGP for free, and since then, has been hosting the public key (certificate) server for worldwide access," he said. Phil Dunkelberger, president of PGP, said, "This development is in keeping with PGP's commitment to protecting security of business and personal communications, and our founding principal of the universal right to privacy. We've never been interested in industry domination at the expense of the users." According to Charles Breed, director of security technology, PGP, and co-chair of the IETF Working Group, "Despite the industry's reputation for aggressive competition, there was unilateral support when Open-PGP was first proposed at the Munich IETF meeting a month ago. More than 150 people representing US companies were present, as well as businesses from Singapore, Japan, the UK and Europe." "Open-PGP" will tackle a major obstacle to the growth of the Internet, plagued at present by policy and technical incompatibilities from country to country. The proposed standard is an unencumbered, non-proprietary specification that will guarantee interoperability of encrypted and digitally signed messages, and provide strong encryption and non-repudiation with digital signatures. Open-PGP will be developed by a consortium of experts, using technology that has provided privacy to Internet email and electronic files since 1991 in products from more than 80 manufacturers worldwide. The Open-PGP specification will be available for peer and public review as it develops. Alternative proposals that have failed in the past, such as PEM (Privacy Enhanced Mail), MOSS (MIME object Security Systems) and most recently, S/MIME (Secure MIME from RSA), depended on complex infrastructures or were encumbered by legal patents, royalties, and export restrictions forcing the use of weak encryption practices. "I expect the Open-PGP specification will progress quickly, because it's well understood, simple and our mailing list on the topic suggests it has a great deal of vendor support already. It has all the elements for a comprehensive solution: trust models, certificate infrastructure, encoding rules, securing MIME and the cryptographic algorithms," said Paul Hoffman, director of the Internet Mail Consortium (IMC), a non-profit organization that promotes the growth of Internet protocols. "Open-PGP applications will be easy for corporations and individuals to use, and will be based on strong, freely available, well-known cryptographic techniques that are the foundation of PGP's technology," said John Noerenberg, senior development manager at Qualcomm's Eudora Division. "Eudora is the top-selling Internet mail application and our users are very pleased with the PGP-based security component." For more information about Open-PGP or subscribe to the IMC mail list, visit the IMC worldwide web site at http://www.ietf-open-pgp.imc.org. About PGP San Mateo-based, Pretty Good Privacy, Inc. (PGP), is the pioneer and worldwide de facto standard for business security and personal privacy, with an estimated four million users of its encryption products, including more than half of the Fortune 100 companies. PGP is committed to providing the most advanced security products for the digital age, safeguarding the communication and storage of information. For more information, visit our website at http://www.pgp.com. Contact: Robin Rootenberg/Monika Madrid Access Communications 1-800-393-7737 ext. 282/227 rrootenberg@accesspr.com/mmadrid@accesspr.com" -- ---------------------------- Ed Stone estone(a)synernet-robin.com remove "-birdname" spam avoider ---------------------------- -------------------==== Posted via Deja News ====----------------------- http://www.dejanews.com/ Search, Read, Post to Usenet -- end of forwarded message --

1 0

We're in BIG trouble now! / Re: CDT complains to my editors after post to cypherpunks
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The Graham-John Bullers autobot wrote: > On Fri, 26 Sep 1997, Dr.Dimitri Vulis KOTM wrote: > Declan is smart. > > I think Vulis needs each of us to send ten copies of this back to him. > > Do you understand why now. Shit! The Graham-John Bullers autobot has learned how to think in a rudimentary fashion that allows it to respond to posts in a manner that comes close to imitating rational thought. How long, I ask you, until it decides to run for President? Igor (posting anonymously)

2 1