August 2004 - cypherpunks-legacy

HMAC?
by R. A. Hettinga 16 Aug '04

16 Aug '04

--- begin forwarded text

1 0

Re: SHA-1 rumors
by R. A. Hettinga 16 Aug '04

16 Aug '04

--- begin forwarded text

1 0

Re: SHA-1 rumors
by R. A. Hettinga 16 Aug '04

16 Aug '04

--- begin forwarded text

1 0

Not In The Cards (Re: Frank Barnako's Internet Daily: Internet goes lowercase at Wired News)
by R. A. Hettinga 16 Aug '04

16 Aug '04

At 10:51 PM -0400 8/16/04, CBS MarketWatch wrote: >NOT IN THE CARDS > >Credit card companies may have one less thing to worry about online: >being held liable for copyright infringements by customers, even when >said activity involves a card transaction. > >So ruled U.S. District Judge James Ware, freeing Visa, MasterCard and >other payment-related defendants from having to take responsibility for >sales of images pirated from Perfect 10, an adult entertainment venture >in Beverly Hills, Calif. > >Perfect 10 had sued the payment processors in an effort to recoup the >proceeds from unauthorized sales of Perfect 10's copyrighted material. > >"The ability to process credit cards does not directly assist the >allegedly infringing Web sites in copying plaintiff's works," Ware said >in a ruling handed down last week. "Defendants do not provide the means >for distributing those works to others, nor do they provide bandwidth or >storage space with which to transfer or store the works." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: RPOW - Reusable Proofs of Work + Article
by R. A. Hettinga 16 Aug '04

16 Aug '04

--- begin forwarded text

1 0

Gilmore VS Ashcroft opens today
by Sunder 16 Aug '04

16 Aug '04

http://www.papersplease.org/gilmore/ In this corner we have John Gilmore. He's a 49 year-old philanthropist who lives in San Francisco, California. Through a lot of hard work (and a little luck), John made his fortune as a programmer and entrepreneur in the software industry. Whereas most people in his position would have moved to a tropical island and lived a life of luxury, John chose to use his fortune to protect and defend the US Constitution. He's challenging the unconstitutionally evil stench of the Asscruftinator! Who will win? Place your bets, place your bets, the courtroom showdown begins today: http://www.boingboing.net/2004/08/16/john_gilmore_vs_ashc.html Ding! ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

1 0

F.B.I. Goes Knocking for Political Troublemakers
by R. A. Hettinga 16 Aug '04

16 Aug '04

<http://www.nytimes.com/2004/08/16/politics/campaign/16fbi.html?ei=5006&en=8…> The New York Times August 16, 2004 F.B.I. Goes Knocking for Political Troublemakers By ERIC LICHTBLAU WASHINGTON, Aug. 15 - The Federal Bureau of Investigation has been questioning political demonstrators across the country, and in rare cases even subpoenaing them, in an aggressive effort to forestall what officials say could be violent and disruptive protests at the Republican National Convention in New York. F.B.I. officials are urging agents to canvass their communities for information about planned disruptions aimed at the convention and other coming political events, and they say they have developed a list of people who they think may have information about possible violence. They say the inquiries, which began last month before the Democratic convention in Boston, are focused solely on possible crimes, not on dissent, at major political events. But some people contacted by the F.B.I. say they are mystified by the bureau's interest and felt harassed by questions about their political plans. "The message I took from it," said Sarah Bardwell, 21, an intern at a Denver antiwar group who was visited by six investigators a few weeks ago, "was that they were trying to intimidate us into not going to any protests and to let us know that, 'hey, we're watching you.' '' The unusual initiative comes after the Justice Department, in a previously undisclosed legal opinion, gave its blessing to controversial tactics used last year by the F.B.I in urging local police departments to report suspicious activity at political and antiwar demonstrations to counterterrorism squads. The F.B.I. bulletins that relayed the request for help detailed tactics used by demonstrators - everything from violent resistance to Internet fund-raising and recruitment. In an internal complaint, an F.B.I. employee charged that the bulletins improperly blurred the line between lawfully protected speech and illegal activity. But the Justice Department's Office of Legal Counsel, in a five-page internal analysis obtained by The New York Times, disagreed. The office, which also made headlines in June in an opinion - since disavowed - that authorized the use of torture against terrorism suspects in some circumstances, said any First Amendment impact posed by the F.B.I.'s monitoring of the political protests was negligible and constitutional. The opinion said: "Given the limited nature of such public monitoring, any possible 'chilling' effect caused by the bulletins would be quite minimal and substantially outweighed by the public interest in maintaining safety and order during large-scale demonstrations." Those same concerns are now central to the vigorous efforts by the F.B.I. to identify possible disruptions by anarchists, violent demonstrators and others at the Republican National Convention, which begins Aug. 30 and is expected to draw hundreds of thousands of protesters. In the last few weeks, beginning before the Democratic convention, F.B.I. counterterrorism agents and other federal and local officers have sought to interview dozens of people in at least six states, including past protesters and their friends and family members, about possible violence at the two conventions. In addition, three young men in Missouri said they were trailed by federal agents for several days and subpoenaed to testify before a federal grand jury last month, forcing them to cancel their trip to Boston to take part in a protest there that same day. Interrogations have generally covered the same three questions, according to some of those questioned and their lawyers: were demonstrators planning violence or other disruptions, did they know anyone who was, and did they realize it was a crime to withhold such information. A handful of protesters at the Boston convention were arrested but there were no major disruptions. Concerns have risen for the Republican convention, however, because of antiwar demonstrations directed at President Bush and because of New York City's global prominence. With the F.B.I. given more authority after the Sept. 11 attacks to monitor public events, the tensions over the convention protests, coupled with the Justice Department's own legal analysis of such monitoring, reflect the fine line between protecting national security in an age of terrorism and discouraging political expression. F.B.I. officials, mindful of the bureau's abuses in the 1960's and 1970's monitoring political dissidents like the Rev. Dr. Martin Luther King Jr., say they are confident their agents have not crossed that line in the lead-up to the conventions. "The F.B.I. isn't in the business of chilling anyone's First Amendment rights," said Joe Parris, a bureau spokesman in Washington. "But criminal behavior isn't covered by the First Amendment. What we're concerned about are injuries to convention participants, injuries to citizens, injuries to police and first responders." F.B.I. officials would not say how many people had been interviewed in recent weeks, how they were identified or what spurred the bureau's interest. They said the initiative was part of a broader, nationwide effort to follow any leads pointing to possible violence or illegal disruptions in connection with the political conventions, presidential debates or the November election, which come at a time of heightened concern about a possible terrorist attack. F.B.I. officials in Washington have urged field offices around the country in recent weeks to redouble their efforts to interview sources and gather information that might help to detect criminal plots. The only lead to emerge publicly resulted in a warning to authorities before the Boston convention that anarchists or other domestic groups might bomb news vans there. It is not clear whether there was an actual plot. The individuals visited in recent weeks "are people that we identified that could reasonably be expected to have knowledge of such plans and plots if they existed," Mr. Parris said. "We vetted down a list and went out and knocked on doors and had a laundry list of questions to ask about possible criminal behavior," he added. "No one was dragged from their homes and put under bright lights. The interviewees were free to talk to us or close the door in our faces." But civil rights advocates argued that the visits amounted to harassment. They said they saw the interrogations as part of a pattern of increasingly aggressive tactics by federal investigators in combating domestic terrorism. In an episode in February in Iowa, federal prosecutors subpoenaed Drake University for records on the sponsor of a campus antiwar forum. The demand was dropped after a community outcry. Protest leaders and civil rights advocates who have monitored the recent interrogations said they believed at least 40 or 50 people, and perhaps many more, had been contacted by federal agents about demonstration plans and possible violence surrounding the conventions and other political events. "This kind of pressure has a real chilling effect on perfectly legitimate political activity," said Mark Silverstein, legal director for the American Civil Liberties Union of Colorado, where two groups of political activists in Denver and a third in Fort Collins were visited by the F.B.I. "People are going to be afraid to go to a demonstration or even sign a petition if they justifiably believe that will result in your having an F.B.I. file opened on you." The issue is a particularly sensitive one in Denver, where the police agreed last year to restrictions on local intelligence-gathering operations after it was disclosed that the police had kept files on some 3,000 people and 200 groups involved in protests. But the inquiries have stirred opposition elsewhere as well. In New York, federal agents recently questioned a man whose neighbor reported he had made threatening comments against the president. He and a lawyer, Jeffrey Fogel, agreed to talk to the Secret Service, denying the accusation and blaming it on a feud with the neighbor. But when agents started to question the man about his political affiliations and whether he planned to attend convention protests, "that's when I said no, no, no, we're not going to answer those kinds of questions," said Mr. Fogel, who is legal director for the Center for Constitutional Rights in New York. In the case of the three young men subpoenaed in Missouri, Denise Lieberman, legal director for the American Civil Liberties Union in St. Louis, which is representing them, said they scrapped plans to attend both the Boston and the New York conventions after they were questioned about possible violence. The men are all in their early 20's, Ms. Lieberman said, but she would not identify them. All three have taken part in past protests over American foreign policy and in planning meetings for convention demonstrations. She said two of them were arrested before on misdemeanor charges for what she described as minor civil disobedience at protests. Prosecutors have now informed the men that they are targets of a domestic terrorism investigation, Ms. Lieberman said, but have not disclosed the basis for their suspicions. "They won't tell me," she said. Federal officials in St. Louis and Washington declined to comment on the case. Ms. Lieberman insisted that the men "didn't have any plans to participate in the violence, but what's so disturbing about all this is the pre-emptive nature - stopping them from participating in a protest before anything even happened." The three men "were really shaken and frightened by all this," she said, "and they got the message loud and clear that if you make plans to go to a protest, you could be subject to arrest or a visit from the F.B.I." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Wrong Time for an E-Vote Glitch
by R. A. Hettinga 16 Aug '04

16 Aug '04

<http://www.wired.com/news/print/0,1294,64569,00.html> Wired News Wrong Time for an E-Vote Glitch By Kim Zetter? Story location: http://www.wired.com/news/evote/0,2645,64569,00.html 10:00 AM Aug. 12, 2004 PT It was simultaneously an uh-oh moment and an ah-ha moment. When Sequoia Voting Systems demonstrated its new paper-trail electronic voting system for state Senate staffers in California last week, the company representative got a surprise when the paper trail failed to record votes that testers cast on the machine. That was bad news for the voting company, whose paper-trail, touch-screen machine will be used for the first time next month in Nevada's state primary. The company advertises that its touch-screen machines provide "nothing less than 100 percent accuracy." It was good news, however, for computer scientists and voting activists, who have long held that touch-screen machines are unreliable and vulnerable to tampering, and therefore must provide a physical paper-based audit trail of votes. "It goes to our point that a paper trail is very much needed to (ensure) that the machine accurately reports what people press," said Susie Swatt, chief of staff for state Sen. Ross Johnson (R-Irvine), who witnessed the glitch in the Sequoia machine. With a paper-trail system, the voting machines would print out a record when voters cast ballots on a touch-screen machine. Voters could examine, but not touch, the record before casting their ballot. The paper would then drop into a secure ballot box for use in a recount. For nearly a year, voting companies and many election officials have resisted the call for a paper record. Election officials say that putting printers on voting machines would create problems for poll workers if the printers break down or run out of paper, and the paper records will cause long poll lines with voters taking more time to check the record. Voting activists maintain, however, that election officials don't want the paper trail because it opens the way for recounts and lawsuits if paper records don't match digital vote tallies. And they say that paper records would provide proof the machines are not as accurate as companies claim. Acting on public pressure for a paper trail, Sequoia became the first of the four largest voting companies to add printers to their voting machines earlier this year. Two smaller voting companies have had paper-trail machines for longer, but have had trouble selling the machines to election officials. During the demonstration of the Sequoia machine last week, the machine worked fine when the company tested votes using an English-language ballot. But when the testers switched to a Spanish-language ballot, the paper trail showed no votes cast for two propositions. "We did it again and the same thing happened," said Darren Chesin, a consultant to the state Senate elections and reapportionment committee. "The problem was not with the paper trail. The paper trail worked flawlessly, but it caught a mistake in the programming of the touch-screen machine itself. For some reason it would not record or display the votes on the Spanish ballot for these two ballot measures. The only reason we even caught it was because we were looking at the paper trail to verify it." Sequoia spokesman Alfie Charles said the problem was not a programming error but a ballot-design error. "It was our fault for not proofing the Spanish language ballot before demonstrating it," Charles said. "We had a demo ballot that we designed in a hurry that didn't include all of the files that we needed to have the machine present all of the voter's selections on the screen and the printed ballots. That would never happen in an election environment because of all the proofing that election officials do." Charles said the machine did record the votes accurately in its memory, but failed to record them on the paper trail and on the review screen that voters examine before casting their ballot. Swatt and Chesin could not confirm this, however, because the company did not show them evidence of the digital votes stored on the machine's internal memory. "We've been saying all along that these things are subject to glitches," Chesin said. "The bottom line is that the paper trail caught the mistake. Ergo, paper trails are a good idea." Charles agreed the paper trail worked exactly as it was supposed to work. "If this happened in an election, the first voter would see it and could call a pollworker. They would take the machine out of service if they saw a problem," he said. Ironically, just one week after the demonstration occurred, California took one step back from making sure voters in the state will have the reassurance that a paper trail provides. On Thursday, a Senate bill that would require a voter-verified paper trail on all electronic voting machines in the state by January 2006 suffered a setback when the Assembly Appropriations Committee, where the bill resided, decided not to push the bill forward during this legislative session, which ends Aug. 31. This means legislators will have to reintroduce a new bill next January when they reconvene. The bill (PDF), introduced by Johnson and state Senator Don Perata (D-Oakland), had bipartisan support and the backing of Secretary of State Kevin Shelley. "I'm a little mystified why the committee has stalled the bill," Swatt said. "E-voting machines, like them or not, are here to stay in California. It is clear that if we are going to be living with e-voting machines the only way to protect voters and to ensure that their votes are counted accurately is to have a paper trail." Swatt said she hoped the public would pressure the legislature to push the bill forward before the session ends. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Canadian Police chiefs want surveillance surcharge
by R. A. Hettinga 16 Aug '04

16 Aug '04

<http://www.ctv.ca/servlet/ArticleNews/print/CTVNews/1092606743312_57/?hub=C…> - CTV News, Shows and Sports -- Canadian Television Police chiefs want surveillance surcharge CTV.ca News Staff Updated: Mon. Aug. 16 2004 12:44 AM ET Canada's police chiefs propose a surcharge of about 25 cents on monthly telephone and Internet bills to cover the cost of tapping into the communications of terrorists and other criminals. The suggestion is intended to resolve a standoff between police forces and telecommunications companies over who should foot the expense of providing investigators with access to phone calls and e-mail messages. Police say they cannot -- and should not -- be forced to pay the often hefty costs involved in carrying out court-approved wiretaps and message searches, warning that investigations will suffer if they are expected to pick up the tab. "This is a very, very serious issue for us. It has a potential for really paralysing operations," said Supt. Tom Grue, a member of the law amendments committee of the Canadian Association of Chiefs of Police. But the country's largest phone company believes that telecommunications firms and law-enforcement agencies, not subscribers, should split the costs. "We think there should be more of a partnership between the agencies and us, rather than getting the public to pay for it," said Bell Canada spokeswoman Jacqueline Michelis. The matter has taken on new urgency as the federal government prepares legislation aimed at preventing criminals from using new digital technologies to shield their communications from police and intelligence agencies. Authorities argue the measures are needed to keep up with sophisticated criminals involved in such activities as terrorism, money laundering, child pornography and murder. The legislative proposals, outlined two years ago, have raised the hackles of privacy advocates and civil libertarians. Bubbling in the background is the equally thorny debate about money. Under the federal proposals, service providers would be required, when upgrading their systems, to build in the technical capabilities needed by police and intelligence agencies, such as the Canadian Security Intelligence Service, to easily tap communications. The controversy revolves around the ongoing costs of looking up phone numbers, hooking up to networks and relaying communications from one city to another - individual services that may cost anywhere from pocket change to thousands of dollars. Currently, a hodgepodge of payment practices applies, from negotiation of fees by the parties involved to refusal by some police forces to accept the bills. Grue, a member of the Edmonton police force, said the costs should be spread as widely as possible to avoid unduly burdening a small number of parties. The association of police chiefs, which represents the majority of Canadian forces, argues one way to accomplish that is adding a fee to each subscriber's monthly telephone, cellular or Internet bill. "We're thinking, amongst ourselves, 25 cents. Whether that would cover off all the costs, we don't know. We haven't done the analysis on it," Grue said. "But if you impose too great of a burden or put too high of a fee, then it becomes less and less attractive, obviously." Grue compares the proposed fee to the one customers already pay to support 911 emergency service, which ranges from about 25 to 50 cents a month depending on the type of telephone plan. Bell Canada's Michelis wants to pull the plug on the idea of a wiretap charge. "We don't really think the cost should be flipped over to the general public," she said. "I don't know how popular that's going to be, something like that. Twenty-five cents is a really significant amount to add to everybody's phone bill." Tom Copeland, a spokesman for the Canadian Association of Internet Providers, said tacking a fee on monthly bills "might work" but could create a burdensome administrative regime that hampers companies, especially small ones with few staff. Grue said it's "a bit of a mystery" to him why the industry is decidedly less than enthusiastic about the idea. "All companies would have that fee on the bill, so it's not like you're giving one company a competitive advantage over another company." Federal officials have convened meetings of the various players to try to work out the issues. Internal Justice Department notes prepared following a roundtable session in December stressed the need "not to further exacerbate the situation." Bell Canada says it has invested heavily in infrastructure to allow for wiretaps and is only trying to recover its costs on the day-to-day services provided to police and intelligence agencies. "Bell has already spent millions of dollars on this initiative and it's going to continue costing us a huge amount of money going forward," Michelis said. "We are looking to get some sort of compensation on the ongoing costs." For the police, it's a matter of principle. "From our perspective, it's a very slippery slope to start paying for the execution of search warrants or any kind of a court order," said Grue. Lucie Angers, a senior Justice Department lawyer, indicated the issues will be resolved at the political level. "You have different interests at stake," she said. "There's good sums of money that are involved in taking these decisions." Federal officials are interested in a solution that would "balance the costs," said Simone McAndrew, a spokeswoman for the Public Safety Department. "Any proposal that is brought forward will be considered." CSIS had no comment. Copeland said if subscribers end up funding the surveillance effort through monthly fees, Canadians would "demand a great deal more explanation" about the initiative and how it affects their constitutional and privacy rights. And should the money come from law-enforcement budgets, the public will be contributing "out the back door" through tax revenues, he noted. "One way or another, Canadians are going to pay." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

France: Crypto-in-a-crime (was re: Crypto Law Survey updated - version 22.2)
by R. A. Hettinga 16 Aug '04

16 Aug '04

--- begin forwarded text Approved-By: Bert-Jaap Koops <E.J.Koops(a)UVT.NL> Date: Mon, 16 Aug 2004 12:28:12 +0200 Reply-To: Bert-Jaap Koops <E.J.Koops(a)uvt.nl> Sender: Mailinglist about existing and proposed laws and regulations on cryptography <CRYPTOLAW-L(a)NIC.SURFNET.NL> From: Bert-Jaap Koops <E.J.Koops(a)uvt.nl> Subject: Crypto Law Survey updated - version 22.2 To: CRYPTOLAW-L(a)NIC.SURFNET.NL I have updated my Crypto Law Survey to version 22.2. http://rechten.uvt.nl/koops/cryptolaw/ ============================================================ NEWS France has enacted the first law in the world that raises the maximum punishment for a crime when cryptography was used to prepare of facilitate a crime. ============================================================ AFRICA * Egypt ('02 mention of regulatory intention) * Ghana (no controls) * Kenya (no controls) * Mauritius (no controls) * Morocco ('02 mention of regulatory intention) * Rwanda ('98 report mentions regulatory intention) * South Africa (decryption order) * Tunisia (import and domestic regulations) EUROPE * France (elaborate new law, including raising punishments for crypto-enhanced crimes) * Russia (FAPSI > FSB) * United Kingdom (new OGEL) ASIA * Singapore (export controls) Any additions you may provide are greatly welcomed. Bert-Jaap Koops Tilburg University 16 August 2004 -------------------------- You may forward this message in its entirety. -------------------------- To unsubscribe from this mailing list, send a message to <LISTSERV(a)NIC.SURFNET.NL> with in the body of the message "UNSUBSCRIBE CRYPTOLAW-L". To subscribe to this mailing list, send a message to <LISTSERV(a)NIC.SURFNET.NL> with in the body of the message "SUBSCRIBE CRYPTOLAW-L". When you change your e-mail address, please unsubscribe the old address and subscribe the new one. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0