April 2004 - cypherpunks-legacy

RE: Firm invites experts to punch holes in ballot software
by Michael_Heyman＠NAI.com 08 Apr '04

08 Apr '04

> From: owner-cryptography(a)metzdowd.com > [mailto:owner-cryptography@metzdowd.com] On Behalf Of Trei, Peter > Sent: Wednesday, April 07, 2004 1:17 PM > [SNIP] > > Frankly, the whole online-verification step seems like an > unnecessary complication. > Except to those of us who don't trust the system. Implemented correctly it could be cheap and complications could be hidden from the voter. It could be cheaper - no need to pay people to do an audit when "the people" will do it for you. You only need a small fraction of "the people" to verify their votes to get a high level of confidence that the election is valid. You only need one failure to cast doubt on the election. This requires an un-forgeable receipt that cannot be used for coercion. Un-forgeable we have been doing for a while now with lots of different PK options. A receipt that cannot be used for coercion cannot give any indication to others of who you voted for. Right now this is a big complication (at least to me - I don't know how to create such a receipt that doesn't require mental gymnastics on the part of the voter). -Michael Heyman --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

3 3

Fun with Lawyers
by R. A. Hettinga 08 Apr '04

08 Apr '04

What's annoying is that, given the kind of specious settlements in this field and other cases, the ambulance chaser in question could probably afford it. :-). Cheers, RAH --- begin forwarded text

1 0

Hard drives leak from Polish Ministry of Foreign Affairs
by "Paweł Krawczyk (IPSec.PL)" 08 Apr '04

08 Apr '04

Polish journal "Nie" (means "No") specialising in scandals has revealed partial contents from 12 hard drives that have leaked from Polish Ministry of Foreign Affairs. These drives contain more than 4000 documents from years 1992-2004, some of them labelled "secret". After the Ministry and ABW (Agencja Bezpieczenstwa Wewnetrznego, our NSA) have confirmed this leak, minister Cimoszewicz has resigned from his position. The resignation was however not accepted by the president. The drives have leaked when the Ministry has upgraded their computers. Old drives taken by a technical worker of the Ministry and sold to a retailer for a price of the drive itself . The retailer, however, realized economical potential of the data stored on the drives and sold them to the journalists. This case should teaches us a lot, indeed... -- Pawel Krawczyk, Krakow, Poland http://echelon.pl/kravietz/ ABA: http://www.aba.krakow.pl/ horses: http://kabardians.com/ crypto: http://ipsec.pl/

2 1

Gmail as Blacknet
by An Metet 08 Apr '04

08 Apr '04

The privacy news has been full of fuss and bluster lately about Google's proposed Gmail service. The latest complaint comes at http://www.privacyrights.org/ar/GmailLetter.htm with an open letter from dozens of privacy groups to the Google founders asking them to revamp the service. Cypherpunks have two somewhat contradictory positions on the issue. First, as lovers of privacy, they will share the concerns in the letter and they would be reluctant to use Gmail as configured, at least with any pseudonym which hoped to retain privacy. But second, as lovers of freedom, they would encourage Google and every other company to experiment with new services and new technologies, allowing individuals to freely decide whether to use them or not. One of the oldest Cypherpunk philosophical thought experiments was BlackNet, a hypothetical offshore data haven whose main job, paradoxically, was to defeat privacy. BlackNet would serve as a market and a storage facility for information that might be of value, one example being credit rating information. BlackNet demonstrated that even when third parties sought to prevent the flow of information, for example by mandating that credit report data be deleted after so many years, Cypherpunk technologies could keep the information available and alive. Oddly, few Cypherpunks appeared to notice the inconsistency with a supposedly privacy-oriented group promoting a technology which would harm privacy. The actual resolution is that Cypherpunks see privacy as a means to an end. That end is freedom. Privacy will lead to freedom by allowing people to communicate and contract without interference and meddling by interlopers. BlackNet is an example of the kind of system which would appear if people were truly free. That it harms privacy is merely an incidental side effect. The lesson is that Cypherpunks value freedom over privacy. They will therefore welcome Gmail as an institutional experiment that demonstrates the value of freedom, even if they personally would rather not partake of its services. Ironically, some of the features of Gmail bear resemblance to BlackNet. In particular, its claimed policy of retaining email indefinitely, even after the recipient has stopped using the account, is reminiscent of BlackNet's function as a data haven, as well as other Cypherpunk projects like the Eternity Network. This retention is objectionable to conventional privacy groups, but Cypherpunks will recognize it as being deeply in accord with their values. And of course the real lesson of Gmail is that we have no way of knowing whether Hotmail and other web based email providers are doing the same thing, but more quietly. These companies may be retaining and archiving email to a far greater degree than most people imagine. Cypherpunks know that trusting third parties to protect their information is the height of foolishness. >From the Cypherpunk perspective, the criticism of Gmail misses the mark; rather, all web mail systems should be understood as fundamentally inconsistent with privacy. If you want privacy, you have to do it yourself. Writing an angry letter is at best going to make the privacy violations more covert. It accomplishes nothing in the end.

1 0

[IP] Arrests key win for NSA hackers (fwd from dave@farber.net)
by Eugen Leitl 08 Apr '04

08 Apr '04

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Passive E-Mail Monitoring Leads To Arrest
by Poindexter＠SAFe-mail.net 07 Apr '04

07 Apr '04

www.2advanced.net writes "The world's first arrest resulting from passive monitoring of electronic communications is being reported by Globe Technology. In the article, sources reveal that 'an e-mail message intercepted by NSA spies precipitated a massive investigation by intelligence officials in several countries that culminated in the arrest of nine men in Britain and one in suburban Orleans, Ont. -- 24-year-old software developer Mohammed Momin Khawaja, who has since been charged with facilitating a terrorist act and being part of a terrorist group.'" http://slashdot.org/articles/04/04/07/1450230.shtml?tid=137&tid=158&tid=215… JP

1 0

Some more anarchy and capitalism -- Fwd: [dgc.chat] Starving the Bastards in Bolivia
by Steve Schear 07 Apr '04

07 Apr '04

>Bolivia is a poor country. Nevertheless, no one, however poor, ever >starves in Bolivia: food is dirt cheap and readily available. > >In contrast, the government is starving to death. What joy! It is >desperate for increased revenue and is preoccupied with schemes for >new taxes etc. You may recall that last year the president, Gonzalo >Sanchez de Lozada, was driven out of the country because he tried to >impose an income tax. The new president, Carlos Mesa, has proposed >3 (three!) separate programs in the last few months for various new >kinds of taxes to raise revenue. And he has been forced to withdraw >all of them. > >The bureacrats' whining is getting deafening. > >http://www.el-deber.net/20040317/nacional_3.html > >Mesa negocia fondos externos para salarios >Mesa seeks external fund for salaries > >El Presidente insistis ayer en Cochabamba en la necesidad de mejorar >la situacisn financiera del Estado >Yesterday in Cochabamba, the president urged the necessity of >improving the >financial situation of the State. > >El gobierno teme un colapso fiscal. Ya no hay dinero para pagarles a los >funcionarios >pzblicos y por ello apela a un pacto para salir de la crisis. >The government is afraid of a fiscal collapse. There is now no money to >pay the public >servants and for that it appeals for an agreement for escaping the crisis. > >Tras alertar sobre la posibilidad de un colapso fiscal del pams, el >presidente Carlos Mesa >revels ayer que su gobierno negocia con la comunidad internacional fondos >para el pago >de salarios en el sector pzblico. >Announcing the possibility of a fiscal collapse of the country, the >president Carlos >Mesa revealed yesterday that his government is negotiating with the IMF in >order >to pay the salaries of the public sector. > >Note that he says there might be a fiscal collapse of the *country* when >it is not >the country but the government that might collapse. There is no chance of >the civil >society collapsing. We can only hope that the government does so the >society will >be freed from it. Also note what foreign aid is sought for: not to aid >the people of >Bolivia but to prop up the apparatus of the State. > > >Best, > >CCS > > >------------------------------------------------------ Anarchy may not be a better form of government, but it's better than no government at all.

1 0

RE: Firm invites experts to punch holes in ballot software
by Trei, Peter 07 Apr '04

07 Apr '04

> Michael_Heyman@NAI.com[SMTP:Michael_Heyman@NAI.com] wrote: > Peter Trei wrote: > > > > Frankly, the whole online-verification step seems like an > > unnecessary complication. > > > Except to those of us who don't trust the system. > > Implemented correctly it could be cheap and complications could be > hidden from the voter. It could be cheaper - no need to pay people to do > an audit when "the people" will do it for you. You only need a small > fraction of "the people" to verify their votes to get a high level of > confidence that the election is valid. You only need one failure to cast > doubt on the election. This requires an un-forgeable receipt that cannot > be used for coercion. Un-forgeable we have been doing for a while now > with lots of different PK options. A receipt that cannot be used for > coercion cannot give any indication to others of who you voted for. > Right now this is a big complication (at least to me - I don't know how > to create such a receipt that doesn't require mental gymnastics on the > part of the voter). > As Ian has noted, self-auditability and uncoercibility seem to be to be mutually exclusive requirements. If you're going to assume that the whole system is untrustworthy, you're still screwed despite the receipts - if the website says that yes, your vote counted in the final total, that still does not tell you that the right candidate was declared the winner. That would only happen if enough voters pooled their verifications to show that that had to be the case (this is equivalent to a recount). In a close-run two candidate race, if a number of voters equal to half the gap between the the candidate's totals failed to verify and report that their vote was recorded correctly, the result is still untrustworthy. ....and any system which relies on advanced mathematics will be unintelligible and mistrusted by the average voter. Peter

1 0

Anarchy and Capitalism in Africa of all places...
by Gabriel Rocha 07 Apr '04

07 Apr '04

http://www.economist.com/World/africa/PrinterFriendly.cfm?Story_ID=2559183 (it requires a login... article pasted below) I specially like the part about taxation and the difficulties of implementing it... Somalia Coke and al-Qaeda Apr 1st 2004 | MOGADISHU >From The Economist print edition Reuters Africa's most chaotic country is a bit calmer, but probably still home to anti-western terrorists Get article background THERE are two ways to run a business in Somalia. You can pay off the local warlord, not always the most trustworthy of chaps, and hope he will stop his militiamen from murdering your staff. Or you can tell him to get stuffed and hire your own militia. After 13 years of civil war, businessmen are increasingly plumping for the latter option, and their defiance has been rewarded. A veneer of normality is returning to the world's most chaotic country. An economy, of sorts, is beginning to thrive. Somalia's first Coca-Cola bottling plant opened in the capital, Mogadishu, last month. That its carbon dioxide chambers are encased in mortar-proof reinforced concrete is almost beside the point. Somalis now have the opportunity to rot their teeth like anyone else, and that feels good. Countrywide distribution will be smoothed by the presence of hundreds of experienced security guards, who are also responsible for protecting the odd foreign expert who drops in. Newcomers are encouraged to calm their nerves by firing off a few rounds or lobbing a hand-grenade shortly after arrival. It really works, enthuses a visiting Kenyan engineer. Perversely, this renaissance has been made possible by Somalia's continuing fragmentation. There is still no proper central government but, where once there was only a handful of warlords, there are now at least 24, and that is only the serious ones. With smaller fiefs to pillage, few can now afford the $100,000 or more that it costs to wage a six-hour battle, so such battles are less common. This is what passes for peace in Somalia, and it is enough to tempt many homesick exiles to return. They bring money as well as skills and contacts. In the past few years, hospitals, schools, businesses and even a university have appeared. In some ways, anarchy makes doing business easier. There are no formal taxesgiven how heavily-armed the average Somali is, these would be hard to collectand no regulation whatsoever. But the costs of chaos outweigh the benefits. You can roar through a warlord's road block unmolested if you have ten gunmen in the back of your pickup, but you have to pay your gunmen. Nationlink, one of the country's three mobile-phone operators, employs 300 guards to protect 500 staff. Everyone yearns for a restoration of stability and a proper government. A dozen attempts at negotiating a formal peace have failed. But since September 11th 2001, western governments, anxious to prevent al-Qaeda from using Somalia as a base, have pressed the warlords to make peace. On January 29th, after talks in Kenya, they were rewarded with a power-sharing agreement providing for a 275-strong parliament that is meant to represent all the country's main clans and minorities. Somalis are sceptical, however. Under the accord, warlords will choose the MPs, whose appointment will be confirmed by traditional elders. Who will pick the elders? Many worry that the warlords will. Some even argue that western support for the peace process encourages violence, by rewarding thugs with a share of power. Businessmen and other non-violent types have been excluded from the talks. We have built schools, repaired hospitals and rebuilt roads. Yet no one is asking us what we think, says Nationlink's managing director, Ahmed Abdi Dini. Since the power-sharing agreement, the talks have stalled. Amid the acrimony, consensus was reached on one issue: the warlords, many of them barely literate, unanimously agreed to abolish a clause barring those without a secondary education from parliament. Meanwhile, a decade after its botched intervention to protect food-aid deliveries in Somalia, the United States is back; this time, hunting for terrorists. American intelligence officers are working with two warlords to gather information about suspected al-Qaeda people in Somalia. Last year, an American commando raid on a Mogadishu hospital netted a Yemeni terrorist suspect, now in Guantanamo Bay. Hussein Aideed, son of the warlord whom American troops tried but failed spectacularly to capture in 1993, was apparently paid $500,000 for 41 Strela missiles to ensure they did not fall into bin Ladenite hands. It is rumoured that other warlords have also been paid: enough, possibly, to restock dwindling weapons supplies. Your correspondent saw some impressive hardware, including four gleaming Howitzers, at the base of one of the warlords, Mohamed Qanyare Afrah. Short tempers, tall stories President George Bush's war on terror has won him few friends in Somalia. In 2001, America forced the closure of Somalia's biggest remittance bank, on the ground that it was used to launder terrorist funds, and froze the assets of al-Haramain, a Saudi charity with alleged terrorist links. This may have made life harder for al-Qaeda, but it also made it harder for expatriate Somalis to send money to their relatives back home, and led, among other things, to the recent closure of Somalia's biggest orphanage. Since America is offering Somalis nothing by way of compensation, they are furious. We must become terrorists, says Abdulkadir Ahmed, a militiaman who claims to be training to fight America. With typical Somali bravado, he adds that: Palestinians who do suicide bombings and just kill a few people are stupid. If I had to sacrifice my life, I would take between 1,000 and 7,000 Americans with me. Copyright ) 2004 The Economist Newspaper and The Economist Group. All rights reserved.

1 0

RE: Firm invites experts to punch holes in ballot software
by Trei, Peter 07 Apr '04

07 Apr '04

> Ian Grigg[SMTP:iang@systemics.com] wrote: > > Trei, Peter wrote: > > Frankly, the whole online-verification step seems like an > > unneccesary complication. > > It seems to me that the requirement for after-the-vote > verification ("to prove your vote was counted") clashes > rather directly with the requirement to protect voters > from coercion ("I can't prove I voted in a particular > way.") or other incentives-based attacks. > > You can have one, or the other, but not both, right? > > It would seem that the former must give way to the latter, > at least in political voting. I.e., no verification after > the vote. > > iang > Yes, that seems to be the case. Note that in the current (non computer) systems, we have no way to assure that our votes actually contributed to the total, but the procedural stuff of having mutually hostile observers to the counting process makes deliberate discarding of one side's votes less likely. (Non-deliberate losses - such as the recent failure to record cards marked with the wrong kind of pen - can still happen). VoteHere, while they seem to be well-meaning, have not solved the problem. Mercuri & Rivest have described how to do it right; we just need someone to buld or retrofit the machines appropriately. Peter Trei

1 0