June 2004 - cypherpunks-legacy

Let the Patriot Act Die
by R. A. Hettinga 20 Jun '04

20 Jun '04

<http://www.capmag.com/articlePrint.asp?ID=3739> Let the Patriot Act Die by Tom DeWeese (June 17, 2004) Article website address: http://www.capmag.com/article.asp?ID=3739 Summary: Repealing our liberties in the name of fighting terrorism will not lead to peace. [CAPMAG.COM]President Bush has hit the campaign trail to save the Patriot Act, which will expire in 2005. In calling for its continuation, the President said, "we can no longer rely on false hope." Which false hope is that? The hope that America's free society will protect us like it has for more than 200 years? We who love American liberty have great fear of the Patriot Act. Its aim, according to the Justice Department, is to give federal law enforcement agencies the surveillance and investigative tools they need to deter future terror attacks, but the quick, emotional passage of the Patriot Act only weeks after the September 11th attacks allowed little time for scrutiny of its measures. In fact, most members of Congress did not read it before voting. Congressman Ron Paul said he couldn't even get a copy before the vote. As a result, provisions of the Act offer major opportunities for government abuses of law-abiding private citizens. The Act says that the government does not need to have a suspect or to even be conducting an investigation related to terrorism to monitor your visits into web sites on the Internet. The Patriot Act changes the definition of terrorism, allowing even legitimate protestors, such as pro-life activists, to be at risk of being labeled "terrorists" if violence erupted at their events. The Act expands the capability to obtain warrants and conduct searches without disclosing them immediately. Under the Act, law enforcement can walk into your home and take records without your knowing they were there. Of course a warrant must be obtained. But you may never know about it. It doesn't even require a real judge to obtain one anymore. The Act requires fuller identification of bank customers. A year before 9-11 more than 150,000 Americans protested these very provisions in a scheme by the FDIC called "Know Your Customer." But now, special software will help firms in 25 finance-related industries, covered by the law, to compare millions of customer records with thousands of entries on federal blacklists. Businesses such as car dealers, insurance companies, investment brokers, lenders and real estate firms will be required to file "Suspicious Activity Reports" to the Treasury Department. Here's an interesting fact. The Patriot Act only mentions protecting our northern border. It says not a word about the southern one. Our southern border remains, absolutely wide open, allowing anyone to literally walk into this country. In the name of fighting terrorism, we are witnessing a new kind of government "urban sprawl" oozing out of Washington, D.C. into every back alley, bedroom, and underwear drawer in America. The Government Electronics and Information Technology Association (GEIA) reports that there are more than 100 federal entities involved in forging the largest conglomeration of government/private contractor interests since the creation of the Pentagon. GEIA represents hundreds of corporate members seeking to cash in on the Homeland Security-citizen-surveillance-spending spree. In September 2002, dozens of major high-tech companies formed the "Homeland Security Industries Association." A key objective of the association is to win a piece of the action for the creation of national ID cards for travelers. Business Week reports that the SAS Institute is among many corporations scrambling to launch a whole new line of anti-money laundering software designed to help insurance companies, investment banks and brokerage firms spy on their clients' financial activities on behalf of the government in compliance with the Patriot Act. According to Bert Ely, the head of a consulting company for financial institutions, the new anti-money laundering provisions of the Patriot Act will do nothing to stop the financing of international terrorists. At best, he says, the new provisions will actually provide evildoers with a road map to avoid detection. What the new Patriot Act provisions are really about, says Ely, is to have the United States fall into line with an international campaign being waged by the Organization for Economic Cooperation and Development and the Financial Action Task Force against countries that serve as tax havens. It's all about tax collection! Business Week also reported that private-sector software makers are racing to develop programs to zero in on gambling. Business Week noted that, "the feds have put casinos on notice that they're next in the line of security." Now, how many terrorists have actually raised their funds in Las Vegas? In mid-September 2002, the U.S. Department of Commerce and the Office of Homeland Security held an expo in Washington. Medium and small firms from across the nation were invited in to showcase the very latest in citizen surveillance wares. The US Chamber of Commerce has hired the former deputy assistant to the Joint Chiefs of Staff to act as a liaison between the chamber and businesses seeking homeland security contracts. PoliticalMoneyline says that 444 groups and individuals have registered as lobbyists to deal with "terror" and "security" issues. IBM has opened a "Government Solutions Center" in Vienna, Virginia. The high-tech Unisys Corporation has established a similar exhibition for inspection by federal surveillance planners, called the "Homeland Security Center for Excellence." Both corporations are racing to cash in on billions of dollars for facial recognition systems at airports and, in anticipation of "trusted traveler" cards, a high-tech ID tied to extensive background checks and biometric identification. And finally this: with all of its new data banks, the Department of Justice announced last March (2003) that accuracy is no longer a concern for the building of one of the world's largest databases called the National Crime Information Center (NCIC). The NCIC has been exempted from the Privacy Act of 1974 that requires information entered into government databases be timely, relevant, complete and accurate. Also exempt are two other Department of Justice databases, the Central Records System and the National Center for Analysis of Violent Crime. The rational for exempting some of the nation's largest databases is that law-enforcement officers need bad data entered into NCIC in order to hurry in solving cases. The "false hope," Mr. President, is that repealing our liberties in the name of fighting terrorism will somehow lead to peace. Let the Patriot Act die and keep the American dream alive. About the Author: Tom DeWeese is the publisher/editor of The DeWeese Report and president of the American Policy Center: www.americanpolicy.org -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Linksys WRT54G (and clones)
by Eugen Leitl 20 Jun '04

20 Jun '04

Anyone here using that device? With Sveasoft's firmware? Building the firmware yourself, or using VPNs/IPsec? Sveasoft's forums contain lots of info, but are difficult to access. If you're looking for same information we could mutually help each other by starting a Wiki, or using a mailing list (WRT54G(a)yahoogroups.com is largely silent on crypto matters). -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

4 4

Novell-SUSE Sponsors Openswan (fwd from brian-slashdotnews@hyperreal.org)
by Eugen Leitl 20 Jun '04

20 Jun '04

----- Forwarded message from brian-slashdotnews(a)hyperreal.org -----

2 1

Re: A National ID: AAMVA's Unique ID
by John Gilmore 19 Jun '04

19 Jun '04

> The solution then is obvious, don't have a big central database. Instead use > a distributed database. Our favorite civil servants, the Departments of Motor Vehicles, are about to do exactly this to us. They call it "Unique ID" and their credo is: "One person, one license, one record". They swear that it isn't national ID, because national ID is disfavored by the public. But it's the same thing in distributed-computing clothes. The reason they say it isn't a national ID is because it's 50 state IDs (plus US territories and Canadian provinces and Mexican states) -- but the new part is that they will all be linked by a continent-wide network. Any official who looks up your record from anywhere on the continent will be able to pull up that record. Anyplace you apply for a state license or ID card, they will search the network, find your old record (if you have one) and "transfer" it to that state. So there's no way to escape your past record, and no way to get two cards (in the absence of successful fraud, either by citizens or DMV employees). This sure smells to me like national ID. This, like the MATRIX program, is the brainchild of the federal Department of inJustice. But those wolves are in the sheepskins of state DMV administrators, who are doing the grassroots politics and the actual administration. It is all coordinated in periodic meetings by "AAMVA", the "American Association of Motor Vehicle Administrators" (http://aamva.org/) Draft bills to join the "Unique ID Compact", the legally binding agreement among the states to do this, are already being circulated in the state legislatures by the heads of state DMVs. The idea is to sneak them past the public, and past the state legislators, before there's any serious public debate on the topic. They have lots of documents about exactly what they're up to. See http://aamva.org/IDSecurity/. Unfortunately for us, the real documents are only available to AAMVA members; the affected public is not invited. Robyn Wagner and I have tried to join AAMVA numerous times, as "freetotravel.org". We think that we have something to say about the imposition of Unique ID on an unsuspecting public. They have rejected our application every time -- does this remind you of the Hollywood copy-prevention "standards committees"? Here is their recent rejection letter: Thank you for submitting an application for associate membership in AAMVA. Unfortunately, the application was denied again. The Board is not clear as to how FreeToTravel will further enhance AAMVA's mission and service to our membership. We will be crediting your American Express for the full amount charged. Please feel free to contact Linda Lewis at (703) 522-4200 if you would like to discuss this further. Dianne Dianne E. Graham Director, Member and Conference Services AAMVA 4301 Wilson Boulevard, Suite 400 Arlington, VA 22203 T: (703) 522-4200 | F: (703) 908-5868 www.aamva.org <http://www.aamva.org/> At the same time, they let in a bunch of vendors of "high security" ID cards as associate members. AAMVA, the 'guardians' of our right to travel and of our identity records, doesn't see how listening to citizens concerned with the erosion of exactly those rights and records would enhance their "mission and service". Their mission appears to be to ram their secret policy down our throats. Their service is to take our tax money, use it to label all of us like cattle with ear-tags, and deny us our constitutional right to travel unless we submit to being tagged. We protest. Do you? John Gilmore

3 2

Antipiracy bill targets technology
by R. A. Hettinga 18 Jun '04

18 Jun '04

<http://news.com.com/2102-1028_3-5238140.html?tag=st.util.print> CNET News Antipiracy bill targets technology By Declan McCullagh Staff Writer, CNET News.com http://news.com.com/2100-1028-5238140.html Story last modified June 17, 2004, 5:32 PM PDT A forthcoming bill in the U.S. Senate would, if passed, dramatically reshape copyright law by prohibiting file-trading networks and some consumer electronics devices on the grounds that they could be used for unlawful purposes. News.context What's new: A bill called the Induce Act is scheduled to come before the Senate sometime next week. If passed, it would make whoever "aids, abets, induces (or) counsels" copyright violations liable for those violations. Bottom line:If passed, the bill could dramatically reshape copyright law by prohibiting file-trading networks and some consumer electronics devices on the grounds that they could be used for unlawful purposes. More stories on this topic The proposal, called the Induce Act, says "whoever intentionally induces any violation" of copyright law would be legally liable for those violations, a prohibition that would effectively ban file-swapping networks like Kazaa and Morpheus. In the draft bill seen by CNET News.com, inducement is defined as "aids, abets, induces, counsels, or procures" and can be punished with civil fines and, in some circumstances, lengthy prison terms. The bill represents the latest legislative attempt by influential copyright holders to address what they view as the growing threat of peer-to-peer networks rife with pirated music, movies and software. As file-swapping networks grow in popularity, copyright lobbyists are becoming increasingly creative in their legal responses, which include proposals for Justice Department lawsuits against infringers and action at the state level. Originally, the Induce Act was scheduled to be introduced Thursday by Sen. Orrin Hatch, R-Utah, but the Senate Judiciary Committee confirmed at the end of the day that the bill had been delayed. A representative of Senate Majority Leader Bill Frist, a probable co-sponsor of the legislation, said the Induce Act would be introduced "sometime next week," a delay that one technology lobbyist attributed to opposition to the measure. Though the Induce Act is not yet public, critics are already attacking it as an unjustified expansion of copyright law that seeks to regulate new technologies out of existence. "They're trying to make it legally risky to introduce technologies that could be used for copyright infringement," said Jessica Litman, a professor at Wayne State University who specializes in copyright law. "That's why it's worded so broadly." Litman said that under the Induce Act, products like ReplayTV, peer-to-peer networks and even the humble VCR could be outlawed because they can potentially be used to infringe copyrights. Web sites such as Tucows that host peer-to-peer clients like the Morpheus software are also at risk for "inducing" infringement, Litman warned. Jonathan Lamy, a spokesman for the Recording Industry Association of America, declined to comment until the proposal was officially introduced. "It's simple and it's deadly," said Philip Corwin, a lobbyist for Sharman Networks, which distributes the Kazaa client. "If you make a product that has dual uses, infringing and not infringing, and you know there's infringement, you're liable." The Induce Act stands for "Inducement Devolves into Unlawful Child Exploitation Act," a reference to Capitol Hill's frequently stated concern that file-trading networks are a source of unlawful pornography. Hatch is a conservative Mormon who has denounced pornography in the past and who suggested last year that copyright holders should be allowed to remotely destroy the computers of music pirates. Foes of the Induce Act said that it would effectively overturn the Supreme Court's 1984 decision in the Sony Corp. v. Universal City Studios case, often referred to as the "Betamax" lawsuit. In that 5-4 opinion, the majority said VCRs were legal to sell because they were "capable of substantial noninfringing uses." But the majority stressed that Congress had the power to enact a law that would lead to a different outcome. "At a minimum (the Induce Act) invites a re-examination of Betamax," said Jeff Joseph, vice president for communications at the Consumer Electronics Association. "It's designed to have this fuzzy feel around protecting children from pornography, but it's pretty clearly a backdoor way to eliminate and make illegal peer-to-peer services. Our concern is that you're attacking the technology." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Feds: VoIP a potential haven for terrorists
by R. A. Hettinga 18 Jun '04

18 Jun '04

VOIP operators: The fifth horsemen of the infocalypse? Cheers, RAH ------- <http://zdnet.com.com/2102-1105_2-5236233.html?tag=printthis> Feds: VoIP a potential haven for terrorists By Declan McCullagh CNET News.com June 16, 2004, 10:54 AM PT URL: http://zdnet.com.com/2100-1105-5236233.html WASHINGTON--The U.S. Department of Justice on Wednesday lashed out at Internet telephony, saying the fast-growing technology could foster "drug trafficking, organized crime and terrorism." Laura Parsky, a deputy assistant attorney general in the Justice Department, told a Senate panel that law enforcement bodies are deeply worried about their ability to wiretap conversations that use voice over Internet Protocol (VoIP) services. Get Up to Speed on... VoIP? Get the latest headlines and company-specific news in our expanded GUTS section.?"I am here to underscore how very important it is that this type of telephone service not become a haven for criminals, terrorists and spies," Parsky said. "Access to telephone service, regardless of how it is transmitted, is a highly valuable law enforcement tool." Police been able to conduct Internet wiretaps for at least a decade, and the FBI's controversial Carnivore (also called DCS1000) system was designed to facilitate online surveillance. But Parsky said that discerning "what the specific (VoIP) protocols are and how law enforcement can extract just the specific information" are difficult problems that could be solved by Congress requiring all VoIP providers to build in backdoors for police surveillance. The Bush administration's request was met with some skepticism from members of the Senate Commerce committee, who suggested that it was too soon to impose such weighty regulations on the fledgling VoIP industry. Such rules already apply to old-fashioned telephone networks, thanks to a 1994 law called the Communications Assistance for Law Enforcement Act (CALEA). "What you need to do is convince us first on a bipartisan basis that there's a problem here," said Sen. Ron Wyden, D-Ore. "I would like to hear specific examples of what you can't do now and where the law falls short. You're looking now for a remedy for a problem that has not been documented." Wednesday's hearing was the first to focus on a bill called the VoIP Regulatory Freedom Act, sponsored by Sen. John Sununu, R-N.H. It would ban state governments from regulating or taxing VoIP connections. It also says that VoIP companies that connect to the public telephone network may be required to follow CALEA rules, which would make it easier for agencies to wiretap such phone calls. The Justice Department's objection to the bill is twofold: Its wording leaves too much discretion with the Federal Communications Commission, Parsky argued, and it does not impose wiretapping requirements on Internet-only VoIP networks that do not touch the existing phone network, such as Pulver.com's Free World Dialup. "It is even more critical today than (when CALEA was enacted in 1994) that advances in communications technology not provide a haven for criminal activity and an undetectable means of death and destruction," Parsky said. Sen. Frank Lautenberg, D-N.J., wondered if it was too early to order VoIP firms to be wiretap-friendly by extending CALEA's rules. "Are we premature in trying to tie all of this down?" he asked. "The technology shift is so rapid and so vast." The Senate's action comes as the FCC considers a request submitted in March by the FBI. If the request is approved, all broadband Internet providers--including companies using cable and digital subscriber line technology--will be required to rewire their networks to support easy wiretapping by police. Wednesday's hearing also touched on which regulations covering 911 and "universal service" should apply to VoIP providers. The Sununu bill would require the FCC to levy universal service fees on Internet phone calls, with the proceeds to be redirected to provide discounted analog phone service to low-income and rural American households. One point of contention was whether states and counties could levy taxes on VoIP connections to support services such as 911 emergency calling. Because of that concern, "I would not support the bill as drafted and I hope we would not mark up legislation at this point," said Sen. Byron Dorgan, D-N.D. Sen. Conrad Burns, R-Mont., added: "The marketplace does not always provide for critical services such as emergency response, particularly in rural America. We must give Americans the peace of mind they deserve." Some VoIP companies, however, have announced plans to support 911 calling. In addition, Internet-based phone networks have the potential to offer far more useful information about people who make an emergency call than analog systems do. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

AOL and Ellison Kiss and Make Up
by Eric Cordian 18 Jun '04

18 Jun '04

You may remember back in 2000, former literary icon turned copyright pest Harlan Ellison sued AOL because people were able to access a couple of his short stories in the Usenet newsgroup alt.binaries.e-book, prompting AOL to block the newsgroup on its servers. This earned Ellison a Big Brother award, which he no doubt keeps next to his Hugo for ""'Repent, Harlequin!' Said the Ticktockman," a story about slavery to punctuality and mindless conformity. At the time, I said that if Harlan would send me an address, I would be more than happy to send him money everytime I read one of his stories on the Internet for free. AOL originally got a summary judgment dismissing Harlan's claims, but Harlan appealed, and the summary judgment was partially reversed, leaving open the possibility of a trial in which AOL would have to defend its role as a "passive conduit" for Internet data. Well, it now appears the parties have reached a settlement, and a joint press release has been issued, in which Ellison opines... <<"Through this litigation, I have come to realize that AOL respects the rights of authors and artists, and has a comprehensive system for addressing the complaints of copyright holders. I would not have settled this case if I were not sure that AOL is doing what it can do to fight online piracy. Because not all Internet service providers are as responsible as AOL, and because individual acts of online piracy continue, I am glad to have called attention to the problem of online piracy through this litigation. As promised, I will be repaying every cent of the monies contributed to the KICK Internet Piracy Fund by writers and readers.">> You can read the whole blurb at... http://media.aoltimewarner.com/media/cb_press_view.cfm?release_num=55254033 Harlan still doesn't get that it was not a useful thing to get an entire newsgroup blocked over four of his stories, and that like the xeroxing of paperback books, his unhappiness is best addressed not by jackbooted persecution of copyright violators, but by making the works widely available at a reasonable price so people will not have an incentive to reproduce them by other means. Perhaps we can all donate to a fund to buy Harlan a clue. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

2 1

Declan talks to Zennstrom about Skype
by Eugen Leitl 18 Jun '04

18 Jun '04

http://gizmodo-cnet.com.com/2008-7352_3-5112783.html Skype's VoIP ambitions By Declan McCullagh Staff Writer, CNET News.com http://news.com.com/2008-7352-5112783.html Story last modified December 2, 2003, 1:30 PM PST Niklas Zennstrom may be Sweden's most famous serial entrepreneur. The 37-year-old Stockholm resident co-authored the legendary software used in the Kazaa file-sharing network. After he and his partners sold the rights to Kazaa last year, Zennstrom turned his attention to Joltid, which sells a caching technology to help network providers deal with the growing amount of peer-to-peer traffic. Now Zennstrom and Kazaa co-creator Janus Friis have launched their most ambitious effort so far: Skype, a start-up that hopes to convince people to use voice over Internet Protocol (VoIP) technology instead of the traditional phone system. CNET News.com recently spoke to Zennstrom, Skype's chief executive, in Stockholm about VoIP, privacy, security, and the lessons he's learned from his other start-ups. Q: What's different about Skype? Lots of instant-messaging clients already offer voice communications. A: We don't see them as competitors. We see our competitors as being Deutsche Telecom, British Telecom, AT&T and Verizon. We think there's going to be a migration from circuit-switched telephony services to Internet telephony. This is a second kind of driver for broadband. P2P file sharing has been driving broadband adoption. I've been meeting a lot of Internet operators in Europe and they say users aren't getting broadband to check their e-mail. Broadband penetration in Europe is around 10 percent to 12 percent. The U.K. is only around 4 percent. It has a long way to go to reach dial-up. One way to do that is to make it more useful. Are you hoping to sign distribution deals with Internet providers? Absolutely. We're speaking to a few broadband operators right now. They're quite interested in offering Skype to their users. Will Skype continue to be free? Now it's free--it's free in the beta phase. When we launch it'll continue to be free. We think it's very, very important that people can use it for free and for the momentum to grow. We want people to spread it around. We have to be very good in up-selling users to premium services like voice mail and conference calling. That's what people are asking for. One of the great things about P2P for this product is that we don't have any incremental cost for a new user. There's no marketing because we don't run marketing campaigns. It's being spread virally by users. We don't have any operational costs because they make calls peer-to-peer. It doesn't cost us any more. You permit mirror sites? Yes. We're encouraging people to spread this to each other. Then we have an established base of users. If we can encourage a few percent of people to get premium services, that's an advantage to us. What we're saying is that telephony is just an application. You can use this software application that does all the call setup and routing, which traditionally has been done by big company switches. Telephony is software. It's not big software in a centralized system. It's software that people run on their laptops at home. What we're saying is that telephony is just an application. How do you keep track of who's logged in and able to receive voice calls? We have a distributed database on the P2P network that keeps track of your IP address, firewall condition, and so on. We've taken (Kazaa's) FastTrack concept of supernodes and taken it one step further. Are there any privacy implications to this public database approach? There would be a privacy consideration if you and I are talking to each other and it's being proxied through John. That's why calls are being end-to-end encrypted. I can check my e-mail from anywhere in the world and senders don't know where I am. I can answer my cell phone from any GSM country and callers don't know where I am. But when I connect to Skype to receive phone calls, my IP address becomes public, which tends to reveal details about my physical location. The way for me to find your IP address would be when I set up a phone call to you, I see your IP address if it's a direct connection. If you're using a proxy server, I won't. Let's say I'm trying to track someone--in a divorce case, I want to prove that a spouse is in Stockholm when he or she is supposed to be in New York City. If I monitor the public Skype database over time, I can roughly follow their movements secretly. It's not an "anonymized" system. For some people it could be labeled as a privacy issue. That has never been any design goal. Your advice for divorcees? I would recommend that you set up all your Internet connections through a proxy server. How many downloads have you had? We've had 1.6 million downloads. That's not 1.6 million people. I think there are around 900,000 registered users. People are downloading multiple versions? This is the same ratio that you see at Download.com (Download.com is owned by CNET Networks, publisher of News.com) There are usually about twice as many downloads as users. People are either downloading multiple versions or initiating the download again. Compare that to Free World Dialup. It's growing considerably faster than that. When will you have a gateway to the telephone network? We're working on it...It's something that's going to be much later on. When? The interesting thing is that in the feedback we get from users this is not the highest priority. They're more interested in conference calling and voice mail. People are much more comfortable with using the Internet for communications. People are being much more mature with the Internet. They say, "This is my primary way to communicate. The people that I'm calling I'm encouraging them to get on Skype." People are quite happy with that. If you had to set a date? Next year. How much have you received in seed funding? We haven't disclosed how much we raised. But it's the normal seed funding. We haven't raised tens of millions. Are you funding any of this yourself? No. Just hard labor and things like that. We had the Draper family--Bill Draper--as investors from the beginning. You said Skype is different from IM voice clients. How about P2P voice clients, such as PGPfone, which is encrypted, free, open source, and has been available for years? When we're talking about peer to peer it's much more today. It's a self-organizing network that can adapt itself to different firewall configurations and network address translation boxes. You cannot set up a direct connection in most cases. The problem is that there are a lot of different configurations. Some routers allow outgoing connections but not incoming. Some others allow UDP (User Datagram Protocol) connections. Others allow TCP (Transmission Control Protocol). Most existing Internet telephony applications don't work that well in consumer environments. How does Skype get around that? We're setting up hot standby connections. We set up four, maybe five standby paths. When both parties are behind NATs (Network Address Translation), they can't actually set up a connection between each other. It's being synchronized. It works sometimes. Sometimes? It only works sometimes. It depends on the routers. What lessons have you learned from your experience with Kazaa and FastTrack? It's quite amazing that when you do something that catches on over the Internet you get people all over the world to use it. Several lessons. One thing is that the whole viral effect--when you do something that works virally you can get a lot of people using it. It's quite amazing that when you do something that catches on over the Internet you get people all over the world to use it. You should not try to do things that are artificially viral like an "Invite a friend to use this service" feature. Those don't really work. We've had that feature on Skype but it doesn't really bring in the users. The product has to be fundamentally viral in itself. How many supernodes share the Skype database? It grows. There are a few hundred clients per supernode. How do you become one? You have to qualify to be a supernode. You have to have enough memory, bandwidth, and a good uptime. Then you're connected to supernodes. If they feel that they're getting too much load they tell the other clients around them, "Can you help me out?" It's a distributed process which is not centrally run. What happens if someone sets up a malicious supernode with false "phone number" data? First of all, the data is populated by the users themselves. What we do in Skype is have all users' identities protected in a public key infrastructure. In order to avoid malicious supernodes or people saying, "I am Nicholas," they have to do a challenge response saying that the keys are correct. What you want to avoid is identity theft. What happens if someone creates and distributes, say, Skype Lite, which recognizes user IDs "minted" by someone else? That's so much fun. On Slashdot, people are saying, "I'm not going to touch this," saying they don't want the advertisements (on Skype) and will wait for Skype Lite. But there are no advertisements. OK, say someone makes a hacked version. You and I wouldn't be able to set up calls with each other. We'd both need the hacked version. Are you afraid of intruders targeting your server that signs user ID keys? The signing server is like Fort Knox. Where's it located? I won't tell you. That's kind of a sensitive part of (the company). It's very, very secure. Will we ever see a Skype telephone? We have a phone that plugs into the USB port that's working now. How about an 802.11 Wi-Fi phone running Skype? That's a natural step to take later on. On cell phones too? The cellular phone is a relatively closed platform. I have a Nokia phone with Java but it doesn't give you access to the IP stack. (For competitive reasons) they're going to make sure that the telephone is very, very closed--though 802.11 phones are eventually going to be affordable in the next year or so. Where do you hope to make money from Skype users? This is software. Our business model is to sell value-added services. It doesn't matter what client you're going to use--whether it's a Windows client or a PDA client or an embedded client. Any plans for Macintosh or 'nix versions? That's one of the things we have on our wish list. We don't have any release date planned. Are you targeting business users as well as individuals? We're starting with individuals. We're doing this bottom up. It's grassroots for businesses too. It's being used by business clients already but not through the IT departments. News.com ran an article a few months ago talking about how the FBI wants to force VoIP providers to make their networks subject to wiretaps. If it gets adopted, what would this proposal mean for you? The landscape is changing. In the old world you had issues like lawful interception of telephone calls. In Sweden the police can get a court order and wiretap a telephone call if the crime would lead to six years in jail or something like that. And if the Swedish police came to you? We cannot do anything because we don't have access to the data stream. The old way of thinking was easy. You'd go to the local telephone company and they'd get a wiretap. That's not a problem because the telephone service owns the infrastructure, provides the service, and operates in one country. The Internet is a bit different. What you would have to do is to go to the Internet service provider. Assume the police can get a court order and conduct the tap. But the Skype conversation is encrypted and they only can hear gibberish. I'm just trying to say in general what the issues are. I don't have a solution. In general it's not as clear cut as it was in old POTS (plain old telephone service) days. My point is that it's not as easy as it was before. Have you been contacted by any law enforcement or national security agency? No. What if we got contacted by the Chinese government, or the U.S. government, or North Korea, or the Swedish? If you're operating something that's only available in one country it's an easy clear-cut case. But if it's available worldwide, that's different. Even Phil Zimmermann, inventor of PGP (Pretty Good Privacy), has said he's concerned about terrorists using his software to plot crimes. He concluded, though, that the benefits outweigh the negatives. How about you? The Internet is great. There's a lot of bad things happening on it but it's still great. If you were a sophisticated criminal and you really wanted to hide away, then you should probably not use something that is a commercially closed source system such as Skype. I don't think this is an issue. If the FBI or Europol came to you and said, "We order you to include a secret backdoor for unencrypted wiretapping in the next version of Skype," what would you do? I don't have the answer to that. Obviously we would work with authorities in whatever jurisdiction we would be subject to. Sure, we would sit down and talk to them. But we would not just say here's the backdoor and just bluntly do it. Currently Skype is not subject to telecommunications regulation, therefore we do not have any legal obligation to provide any means for interception. This is software that's not any different from e-mail or chat. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

International conference targets Internet hate speech
by R. A. Hettinga 17 Jun '04

17 Jun '04

<http://www.cnn.com/2004/TECH/internet/06/17/online.hate.ap/index.html> CNN International conference targets Internet hate speech Thursday, June 17, 2004 Posted: 10:14 AM EDT (1414 GMT) International delegates are meeting for two days in Paris. PARIS, France (AP) -- European neo-Nazis post online pictures of paint-smeared mosques. Web sites of Islamic radicals call for holy war on the West. Aliases like "Jew Killer" pop up on Internet game sites. International experts met Wednesday in Paris to tackle the tricky task of fighting anti-Semitic, racist and xenophobic propaganda on the Internet -- seen as a chief factor in a rise in hate crime. Purveyors of hate have found a potent tool in the Internet, spreading fear with such grisly images as the beheading of Wall Street Journal reporter Daniel Pearl in 2002. The new technology has proven to be a boon for hatreds of old, many experts say. "Our responsibility is to underline that by its own characteristics -- notably, immediacy and anonymity -- the Internet has seduced the networks of intolerance," French Foreign Minister Michel Barnier said in opening remarks at the two-day conference. France, which is spearheading the effort, has faced a surge in anti-Semitic violence in the last two years. Some fault the growth of Internet use among hate groups. But differing views about the limits of free speech and the ease of public access to the nebulous, anonymous Web largely stymied officials hoping to find common ground in Wednesday's talks. A sticking point was whether the United States, which has championed nearly unfettered free speech, would line up with European countries that have banned racist or anti-Semitic speech in public. The dilemma is all the more acute because the Internet is global, easy to use and tough to regulate -- as shown by widespread sharing of music online, an illegal practice that has confounded record companies. Terror groups have also used the Internet to plot attacks. American approach differs There are no easy solutions, delegates said. Many urged more youth education, better cooperation between governments and Internet service providers, or new studies on links between Web racism and hate crimes. The Organization for Security and Cooperation in Europe, a 55-country body that promotes security and human rights, organized the conference with the backing of the French government. Six countries in the Middle East and North Africa also sent envoys. The meeting is one of three OSCE conferences on anti-Semitism and racism this year. U.S. Assistant Attorney General Dan Bryant acknowledged the American approach differs from that of other countries. "We believe that government efforts to regulate bias-motivated speech on the Internet are fundamentally mistaken," Bryant said. "At the same time, however, the United States has not stood and will not stand idly by, when individuals cross the line from protected speech to criminal conduct." He said the United States believes the best way to reduce hate speech is to confront it, by promoting tolerance, understanding and other ideas that enlighten. Robert Badinter, a former French justice minister, said that of 4,000 "racist sites" counted worldwide in 2002, some 2,500 were based in the United States. Growing problem There are signs that online hate is getting worse. The French foreign minister cited a recent report in Britain that showed the number of "violent and extremist sites" had ballooned by 300 percent in the last four years in 15 OSCE countries surveyed. France last year banned a Web site responsible for thousands of daily racist messages, one of which claimed responsibility for dousing mosques with paint in the colors of the French flag, the International Network Against Cyber Hate wrote in a report released Wednesday. Christopher Wolf, chairman of the Internet Task Force of the U.S. Anti-Defamation League, pointed out how one student on a blog site at Brandeis University described playing an Internet video game against a rival who had nicknamed himself "Jew Killer." In Egypt, some sites have shown pictures of American soldiers in Iraq to dredge up anti-U.S. feeling; one purportedly showed the June 8 killing of American civilian Robert Jacobs in Saudi Arabia. Rabbi Abraham Cooper, associate dean of the Simon Wiesenthal Center, a Jewish human rights group based in Los Angeles, said one strategy is for Internet service providers in the United States to honor anti-racism language in their own contracts. But even that won't stamp out Internet hate, he said. "Will this put the (Ku Klux Klan) out of business? No. They will be able to find some way of getting their messages back online," he said. "But it will put a crimp in that subculture on the Internet." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

thanks for all the blowfish
by Major Variola (ret) 17 Jun '04

17 Jun '04

Well after over a decade of learning and teaching on cypherpunks and Perry's cryptography list, and before that comp.risks, reading Cryptogram, scanning bugtraq until I got bored of yet another buffer overflow or MS legacy hack, accumulating a row of crypto books, and zero professional certs or classes, but interacting with a hardcore privacy friend, I'm now employed as a security consultant at a Big Company, at least for a month or two. No govt clearances required, of course. And let me tell you, things are really hilarious out there. Eg the same fixed key in every machine everywhere, and in every driver. And my future boss proposing a million fixed keys to make it harder, where you send the index. A million times more hilarious. One day interviewing, wearing a visitor badge, I hear two building-security people yell a building-access password to each other. Furthermore its a lame password. My future boss was amused at that bit of accidental social engineering and he pointed out that the security company manages several other companies, so the regexp (based on the company name) used for this building was probably extrapolatable to other companies. Humans are such silly critters. Anyway, to everyone who's contributed to my informal education, thanks. I'm not going away, but neither will I have "Il dulce far niente" (The sweetness of doing nothing -S Schear's elegant unemployment motto) Major Variola (ret)

1 0