June 2003 - cypherpunks-legacy

Re: Attacking networks using DHCP, DNS - probably kills DNSSEC
by Major Variola (ret) 30 Jun '03

30 Jun '03

At 01:05 PM 6/30/03 -0400, William Allen Simpson wrote: >"Steven M. Bellovin" wrote: >> >> I can pretty much guarantee that the IETF will never standardize that, >> except possibly in conjunction with authenticated dhcp. >> >Would this be the DHCP working group that on at least 2 occasions >when I was there, insisted that secure DHCP wouldn't require a secret, >since DHCP isn't supposed to require "configuration"? In some cases it would be trivial to distribute a key for DHCP trust purposes. My cable ISP distributes a CDROM which configures Wintel machines for it. (I don't use this.) It would be easy enough for them to distribute secret or public keys or even hash sigs that worked with their DHCP, *if* the clients could use it, and *if* the users paid attention to whatever UI accompanied problems. In other cases --the visitor who wants to connect a laptop to an office net-- there is a perhaps unacceptable burden.

1 0

1st amend: non commercial publishers not liable for libel
by Major Variola (ret.) 30 Jun '03

30 Jun '03

The Ninth Circuit Court of Appeals ruled last Tuesday that Web loggers, website operators and e-mail list editors can't be held responsible for libel for information they republish, extending crucial First Amendment protections to do-it-yourself online publishers. Online free speech advocates praised the decision as a victory. The ruling effectively differentiates conventional news media, which can be sued relatively easily for libel, from certain forms of online communication such as moderated e-mail lists. One implication is that DIY publishers like bloggers cannot be sued as easily. "One-way news publications have editors and fact-checkers, and they're not just selling information -- they're selling reliability," said Cindy Cohn, legal director of the Electronic Frontier Foundation. "But on blogs or e-mail lists, people aren't necessarily selling anything, they're just engaging in speech. That freedom of speech wouldn't exist if you were held liable for every piece of information you cut, paste and forward." The court based its decision on a section of the 1996 Communications Decency Act, or the CDA. That section states, "... no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider." Three cases since then -- Zeran v. AOL, Gentry v. eBay and Schneider v. Amazon -- have granted immunity to commercial online service providers. Tuesday's court ruling clarifies the reach of the immunity granted by the CDA to cover noncommercial publishers like list-server operators and others who take a personal role in deleting or approving messages for online publication. "Here, the court basically said that when it comes to Internet publication, you can edit, pick and choose, and still be protected," said Cohn. The case traces back to a North Carolina town in 1999, where handyman Robert Smith was repairing a truck owned by attorney and art collector Ellen Batzel. Smith claimed to have overheard Batzel say she was related to Nazi Gestapo head Heinrich Himmler. He said he concluded that the European paintings he saw in her home must be stolen goods, and shared this in an e-mail he sent to the editor of the Museum Security Network, an organization that publishes information about stolen art. Without telling Smith the e-mail would be published, Ton Cremers -- the sole operator of Amsterdam-based Museum Security Network –- made minor edits, then posted Smith's e-mail to a list of about 1,000 museum directors, journalists, auction houses, gallery owners and Interpol and FBI agents. Three months later, Batzel learned of the post. She contacted Cremers to deny both the stolen art and Nazi ancestry allegations. She also said Smith's claims were motivated by financial disputes over contracting work. Smith said he had no idea Cremers would publish a private e-mail on the list or on the Web. Batzel sued Smith, Cremers and the Museum Security Network for defamation and won. Cremers appealed. The appeals court questioned whether Cremers' minor edits to Smith's e-mail altered it so much that the post became a new piece of expression, and decided it had not. But because Smith claims he didn't know the e-mail would be published, the court also questioned whether the immunity provision of the Act applied, and passed the case back to the district court. The lower court will reconsider whether Cremers had reasonable belief that Smith's e-mail was intended for publication. "Some weblogs are interesting mixes of original and forwarded content, so this issue may come up again in the courts," EFF's Cohn said. "Where that legal line is drawn may become a point of contention." Ellen Batzel says the case changed her life. "This was a small, North Carolina mountain town -- I talked to the (district attorney) and he said 'Get a dog, get a gun, get a security system or better yet get out of town.' I sold my house and moved. I've been hurt in my professional reputation and in my private life. "I know what free speech is, and I support it, but this is about invasion of privacy and my civil liberty. Every time I meet someone now, I have to say, 'Hi, I'm not Himmler's granddaughter." Attorney Howard Fredman, who represented Batzel in the case, said the next legal steps could include a rehearing before the appeals court, or petitioning the U.S. Supreme Court. http://wired.com/news/politics/0,1283,59424,00.html

1 0

Re: Attacking networks using DHCP, DNS - probably kills DNSSEC NOT
by Steven M. Bellovin 30 Jun '03

30 Jun '03

In message <ilubrwggo11.fsf_-_(a)latte.josefsson.org>, Simon Josefsson writes: >Bill Stewart <bill.stewart(a)pobox.com> writes: > >>>* Your laptop see and uses the name "yahoo.com.attackersdomain.com". >>> You may be able to verify this using your DNSSEC root key, if the >>> attackersdomain.com people have set up DNSSEC for their spoofed >>> entries, but unless you are using bad software or judgment, you will >>> not confuse this for the real "yahoo.com". >> >> The DNS suffix business is designed so that your laptop tries >> to use "yahoo.com.attackersdomain.com", either before "yahoo.com" >> or after unsuccessfully trying "yahoo.com", depending on implementation. >> It may be bad judgement, but it's designed to support intranet sites >> for domains that want their web browsers and email to let you >> refer to "marketing" as opposed to "marketing.webservers.example.com", >> and Netscape-derived browsers support it as well as IE. > >It can be a useful feature, but it does not circumvent DNSSEC in any >way, that I can see. DNSSEC see yahoo.com.attackersdomain.com and can >verify that the IP addresses for that host are the one that the owner >of the y.c.a.c domain publishes, and that is what DNSSEC delivers. >The bad judgement I referred to was if your software, after DNSSEC >verification, confuses yahoo.com with yahoo.com.attackersdomain.com. > It's also not a new problem -- see RFC 1535. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

Re: God speaks to Dubbya
by Tyler Durden 30 Jun '03

30 Jun '03

Interesting quote. Reminds me of Hernan Cortes (who probably had an IQ in the Dubbya range). -TD >From: Harmon Seaver <hseaver(a)cybershamanix.com> >To: cypherpunks(a)lne.com >Subject: God speaks to Dubbya >Date: Mon, 30 Jun 2003 06:28:22 -0500 > >http://www.haaretzdaily.com/hasen/pages/ShArt.jhtml?itemNo=310788&contrassI… > >"According to Abbas, immediately thereafter Bush >said: "God told me to strike at al Qaida and I >struck them, and then he instructed me to >strike at Saddam, which I did, and now I am >determined to solve the problem in the Middle >East. If you help me I will act, and if not, >the elections will come and I will have to >focus on them."" > > >-- >Harmon Seaver >CyberShamanix >http://www.cybershamanix.com _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

Re: Attacking networks using DHCP, DNS - probably kills DNSSEC
by Steven M. Bellovin 30 Jun '03

30 Jun '03

In message <5.1.1.6.2.20030628124252.033e5600(a)idiom.com>, Bill Stewart writes: >Somebody did an interesting attack on a cable network's customers. >They cracked the cable company's DHCP server, got it to provide a >"Connection-specific DNS suffic" pointing to a machine they owned, >and also told it to use their DNS server. >This meant that when your machine wanted to look up yahoo.com, >it would look up yahoo.com.attackersdomain.com instead. > >This looks like it has the ability to work around DNSSEC. >Somebody trying to verify that they'd correctly reached yahoo.com >would instead verify that they'd correctly reached >yahoo.com.attackersdomain.com, which can provide all the signatures >it needs to make this convincing. > >So if you're depending on DNSSEC to secure your IPSEC connection, >do make sure your DNS server doesn't have a suffix of echelon.nsa.gov... > No, that's just not true of DNSsec. DNSsec doesn't depend on the integrity of the connection to your DNS server; rather, the RRsets are digitally signed. In other words, it works a lot like certificates, with a trust chain going back to a magic root key. I'm not saying that there can't be problems with that model, but compromised DNS servers (and poisoned DNS caches) are among the major threat models it was designed to deal with. If nothing else, the existence of caching DNS servers, which are not authoritative for the information they hand out, makes a transmission-based solution pretty useless. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book) --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

3 4

God speaks to Dubbya
by Harmon Seaver 30 Jun '03

30 Jun '03

http://www.haaretzdaily.com/hasen/pages/ShArt.jhtml?itemNo=310788&contrassI… "According to Abbas, immediately thereafter Bush said: "God told me to strike at al Qaida and I struck them, and then he instructed me to strike at Saddam, which I did, and now I am determined to solve the problem in the Middle East. If you help me I will act, and if not, the elections will come and I will have to focus on them."" -- Harmon Seaver CyberShamanix http://www.cybershamanix.com

1 0

[sexpot@zork.net: 6:30 pm Monday 30 June 2003 Refund Day II: The case of Adam Kosmin vs. Toshiba, in the matter of Adam's refund, may be be tried but might be put off for another day.] (fwd)
by Jim Choate 30 Jun '03

30 Jun '03

----- Forwarded message from Jay Sexpot Sulzberger <sexpot(a)zork.net> -----

1 0

Cypherpunks List Info
by cpunk＠lne.com 29 Jun '03

29 Jun '03

Cypherpunks Mailing List Information Last updated: Sep 12, 2002 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html or you can send posts to the list via cpunks_anon(a)einstein.ssz.com and your mail's headers will be stripped before posting. Note that this doesn't provide complete anonymity since the receiving site will still have log file entries showing the source of the mail (or you have to trust that they delete them). You also will be 'sharing' a reputation with the other entities that post through this alias, and some of them are spammers, so some subscribers will have this alias filtered. 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Ssz: Subscription: "subscribe cypherpunks" to majordomo(a)ssz.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)ssz.com Help: "help cypherpunks" to majordomo(a)ssz.com Posting address: cypherpunks(a)ssz.com Filtering policy: raw Message Modification policy: Subject line prepended with "CDR:" Reply-to cypherpunks(a)ssz.com added. Privacy policy: open Info: http://www.ssz.com/cdr/ --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Is Priceline Founder Walker's Plan To Police Sites Genius or Just Goofy?
by R. A. Hettinga 29 Jun '03

29 Jun '03

<http://online.wsj.com/article_print/0,,SB10569205648909100,00.html> The Wall Street Journal June 30, 2003 PORTALS By LEE GOMES Is Priceline Founder Walker's Plan To Police Sites Genius or Just Goofy? Jay Walker, who made a fortune with Priceline , the name-your-price airline ticket company, describes himself less as a businessman than an inventor, using the Internet to rethink how things work. Having helped remake the way the country buys plane tickets, Mr. Walker is now working on changing the way it fights terrorists. His USHomeGuard, a for-profit company that Mr. Walker and associates are now talking up in Washington and elsewhere, is one of those ideas that will either leave you applauding its cleverness and ambition, or cringing at its kookiness and opportunism. I think Mr. Walker is on to something, though not in quite the same way he probably imagines. As do most other terrorism entrepreneurs, Mr. Walker begins by noting that there are tens of thousands of pieces of "unprotected infrastructure" in the country: power plants, gas tanks, petroleum refineries and the like. USHomeGuard would point Webcams at all of them. Those photographs would then be distributed over the Internet to the home PCs of Americans who have signed up to earn money -- an estimated $10 an hour -- working as what Mr. Walker calls "citizen spotters." Most of us would just call them security guards. These spotters would be shown still pictures, one after another, selected randomly from somewhere around the country. If everything in the picture looks OK, they'd press the equivalent of an All Clear button. If something seems out of the ordinary -- a vehicle is parked where it isn't supposed to be -- they'd press a second button. Mr. Walker explains that since these are places no one is supposed to be, it would be easy to detect an interloper. When a spotter spots a potential problem, a central facility gets notified. USHomeGuard employees would then be able to talk with the intruder over a loudspeaker. If they weren't satisfied with his answers, they'd call the police. To make sure the citizen spotters were paying attention, every now and then, the system would send out a staged photo, purporting to show some sort of intrusion. Spotters would be required to recognize these as potential problems -- or else be briefly suspended from duty. It's easy to find flaws in all this. The bad guys in USHomeGuard's publicity material skulk around otherwise empty sites carrying satchels. In real life, they tend to drive trucks with bombs or board planes carrying box cutters. It's also unclear how someone not intimately familiar with a facility would know that the fellow in the truck parked next to a big gas tank, who can't hear the loudspeaker because of a passing rainstorm, isn't a terrorist, but rather Al, the maintenance guy, on his weekly rounds. Mr. Walker says he's come up with a highly effective way of preventing terrorism. It seems to me that he has come up with a minimally effective way of preventing a bunch of high-school kids from parking their van by the reservoir and getting stoned. And a likely side effect is an epidemic of false alarms, like the ones that happen with all those high-tech security systems in Beverly Hills. What I think Mr. Walker has done right, though, is the manner in which he has again recognized the transformational nature of the Internet, just as he did with Priceline. I can't imagine a remote monitoring system like USHomeGuard being used to protect anything truly critical. But for second-tier locales -- the infrastructure equivalents of the unsold airplane tickets that Priceline sells -- why not? Maybe one day soon, that reservoir will indeed be guarded by someone at a PC far away. But USHomeGuard isn't taking the economic and technical logic of the Internet to its logical conclusions. As Americans by the hundreds of thousands are learning, if a job can be done at a keyboard and monitor, chances are good it can be done anywhere in the world. In the publicity material for USHomeGuard, the citizen spotters look just like folks you see in a Charles Schwab brochure: earnest middle-class types wearing Lands' End sweaters, absorbed in their Dells. But there's no reason to pay citizen spotters even $10 an hour when the work can be done for a tenth or twentieth of that overseas. And I mean seriously overseas: the polite English-speaking programmers and help desk attendants of Bangalore, India, are vastly overqualified for this kind of work. You don't need English skills, or many skills at all, to know whether a truck is, or is not, in a TV picture. And they are no more or less handicapped at recognizing Al, the maintenance guy. Also, the safeguards used to prevent snoozing spotters in the U.S. would work equally well abroad. The real value of Mr. Walker's proposal is in the way it reminds us about the easy exportability of labor in the 21st century, if not for USHomeGuard, then eventually for someone else. How will we continue to pay for all the infrastructure Mr. Walker wants to guard when the earning power of Americans keeps heading overseas via the Internet? Now there's a problem I'd like to see an Internet entrepreneur try to crack. * Send your comments to lee.gomes(a)wsj.com 1, and check back on Friday for some selected letters at WSJ.com/Portals 2. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Legal marijuana in Ontario, Canada tries courts, police
by Tim Meehan 29 Jun '03

29 Jun '03

http://www.mapinc.org/cancom/2870ddf8-d939-49a0-babb-a629a4384311 Pubdate: Sunday, June 29, 2003 Source: Ottawa Citizen (CN ON) Contact: letters(a)thecitizen.southam.ca Website: http://www.canada.com/ottawa/ottawacitizen/ Author: Jake Rupert Messy marijuana law tries courts, police Right now, there is no law against possessing marijuana for personal use in the province, due to a couple of recent court rulings. Police officers, lawyers and judges are asking what happens next. Jake Rupert The Ottawa Citizen If you're confused about whether it is legal or illegal to possess marijuana in Ontario, you're not alone. And you have some pretty good company. It seems the answer to the simple question of whether possession of marijuana is legal right now depends on who you ask. Police and federal Crown attorneys will tell you that, in their opinion, it's still illegal to possess marijuana. On the other hand, judges and defence lawyers will tell you there is no law against having marijuana for personal use. The fact is that, right now, in law and in practice, there is no law against possessing marijuana for personal use in the province, due to a couple of recent court rulings. The proof can be seen in our courts these days as judges in Ottawa and across Ontario are simply dismissing the charges against people because the charges have no legal merit. Justice Bruce MacPhee, Eastern Ontario's regional senior Ontario Court judge, said he quashed three of them in the week of June 16-20. "In my view, the charge of simple possession of marijuana, less than 30 grams, is no longer capable of finding its way onto a proper information." Barring a drastic move by the federal government -- which isn't going to happen anytime soon -- there will be no law against possession at least until the Ontario Court of Appeal rules on the case that nullified the law. There is no date for that case to be heard at the province's highest court. Brian McAllister, the Windsor lawyer who brought down the law, thinks the hearing will happen in late July or early August. A ruling will follow sometime after that. "As it stands, it looks like we were heading for a summer of unregulated marijuana use in Ontario," said Mr. McAllister. "We're actually in the middle of an interesting social experiment. It will be interesting to see what happens. Will people use marijuana more? I don't know. "Maybe we should look at the results to see what direction we will take on the issue in the future." Things got to this point because of a federal law, coupled with a series of court rulings based on the law. In the early to mid-1990s, social activists began clamouring for a law allowing people suffering from various ailments to smoke marijuana because it helped ease their pain and suffering. At the same time, doctors began writing prescriptions for marijuana. In June 1999, then-health minister Allan Rock started granting exemptions to people for medicinal use. However, these people still had to obtain the drug through illegal connections. The exemptions were also being granted at the minister's discretion. In July 2000, the Ontario Court of Appeal struck down the section of the Controlled Drugs and Substances Act prohibiting possession of less than 30 grams of marijuana. In the ruling, the court agreed that the possession law violated the federal charter rights of Terry Parker, a man suffering from severe epilepsy who'd been arrested twice by Toronto police for cultivation and possession of the drug. The court found that if the government wasn't going to make a legal supply of the drug available, it couldn't make it a crime for people to grow it and possess it themselves. The appeal court gave the federal government a year to replace the possession law -- or it would cease to exist. Instead of filling the void created by the decision, the government came up with marijuana medical-access regulations. Still, this program didn't provide a legal supply of the drug to people with minister's exemptions. The bomb dropped on Jan. 2 this year when Mr. McAllister successfully argued to Ontario Court Justice Douglas Phillips that a charge of marijuana possession against a 17-year-old client in Windsor should be thrown out because the government hadn't replaced the law that was struck down by the appeals court, and, therefore, according to the July 2000 appeal court ruling, the law no longer existed. The judge agreed the law prohibiting possession was legal no more and tossed out the charge. The Crown appealed. Hard on the heels of this decision, after hearing a month of arguments last fall, Ontario Superior Court Justice Sydney Lederman declared the government's medicinal-marijuana program unconstitutional because it didn't provide a legal source of marijuana for sick people. The Crown appealed. In the spring, the Crown's appeal of Judge Phillips' ruling in the Windsor case was heard, and, on May 16, was rejected by Ontario Superior Court Justice Steven Rogin. The law didn't exist anymore, Judge Rogin found. The Crown is appealing this ruling to the province's highest court. But because Judge Rogin was sitting as an appeals court judge, the ruling is binding on every other lower court in Ontario -- which means all the courts that hear cases of simple possession. "This is a binding ruling," Judge MacPhee said. "Judges have discretion, but most are following the Superior Court's direction that the law is nullified." As a last-ditch effort, the Crown applied to the Ontario Court of Appeal for an order setting aside this precedent until the appeal is heard. Earlier this month, this failed when a judge at the court ruled that she simply didn't have the authority to set aside the ruling. The situation is giving law-enforcement officials fits -- in large part because there is currently no law to enforce. Across the province, after consultation with lawyers, police chiefs have instructed their officers not to lay any new charges of simple possession of marijuana. However, in many jurisdictions, including Ottawa, officers have been instructed to continue doing investigations -- including seizing cannabis, submitting exhibits and fully documenting the investigation and seizure with an eye to laying charges later if the appeals court overturns Judge Rogin's decision or the federal government changes the law. This process has some potential legal pitfalls. First off, when embarking on any investigation including search and seizure, police officers must have reasonable and probable grounds to assume that a law has been broken. However, there is currently no law against possession to break, according to the court rulings. This means police are acting on shaky legal ground if they stop people, question them, search them, seize drugs, or even ask a person their name when they think somebody might be in possession of marijuana. "This is a very tough situation for police, and there's a potential for some pretty nasty situations," Mr. McAllister said. "I worry there will be a person who refuses to co-operate with an officer who is intent on taking marijuana from them. "It's well-established in criminal law that you have the right to resist a wrongful arrest." The second problem with police continuing to investigate marijuana possession is what will happen if the Ontario Court of Appeal upholds Judge Rogin's decision. Police will then be in a situation of having seized people's property without the authority to do so. "They're running a risk with this practice," said legal scholar David Paciocco. "They're gambling that the Court of Appeal will find Judge Rogin's decision was wrong, and the law will come back. If it doesn't, they will be in a position where they've seized people's private property, and that could have legal ramifications." In a statement, Ottawa police Chief Vince Bevan said the situation has put the police in a difficult position and is undermining public confidence in the integrity of the criminal justice system. "These are matters of law and are of great import to the police and to the community at large," he said. "I call upon the government of Canada to take immediate action to resolve this urgent matter." Recently, the federal government introduced legislation that would decriminalize marijuana possession. The legislation is being debated by the justice committee, and with Parliament not sitting until the fall, it won't be passed anytime soon. Furthermore, the legislation would only decriminalize possession -- it doesn't propose legalizing marijuana. This means people caught with the drug would be fined instead of charged with a criminal offence. However, the Ontario court rulings legalize marijuana. So even if the bill is passed sometime in the future, it falls short of remedying the situation in Ontario. And it all adds up to a messy situation for federal Crown attorneys in Ontario who prosecute drug offences. Jim Leising, the man who oversees federal criminal prosecutions in the province, says he's been instructing his assistants not to take any cases to trial until the situation is sorted out. Instead, they've been asking for adjournments or stays of proceedings. "We're trying to exercise our discretion as even-handedly as we can," he said. "In our opinion, there's a valid prohibition on the books against possession of marijuana, but in the face of that, there's a binding court decision saying it's nullified." The Ottawa-area's head of federal prosecutions went even further when he directed stays of proceedings against all people charged with the crime in his jurisdiction. Eugene Williams said it was the right thing to do because the prohibition against the crime is effectively gone.

1 0