- cypherpunks-legacy - lists.cpunks.org

Larry Lessig on ending anonymity through "identity escrow"
by Declan McCullagh 05 Dec '03

05 Dec '03

See also: http://politechbot.com/pipermail/politech/2003-December/000268.html --- >Date: Fri, 05 Dec 2003 09:12:16 -0500 >To: politech(a)politechbot.com >From: Declan McCullagh <declan(a)well.com> >Subject: Larry Lessig replies to Politech over limiting anonymity [fs][priv] > > >--- > >[Why do I get the feeling that Larry Lessig doesn't like "absolute" >anonymity much at all? Systems for building and defending "absolute" >anonymity already exist in the form of anonymous remailers and Freenet, >among others. It would be foolish to follow Larry's advice and concede too >quickly that such technologies have so few legitimate uses that they >cannot be reasonably defended. Even the oft-benighted Eurocrats have >recognized this: a 1997 EC directive encourages anonymity, as does a >German federal law (http://www.iid.de/rahmen/iukdgebt.html) In the U.S., >since the Federalist Papers were published with effectively "absolute" >pseudonymity, surely the framers of the U.S. Constitution had them in mind >when crafting the Bill of Rights. Justice Thomas lists more >contemporaneous examples in his McIntyre concurrence >(http://supct.law.cornell.edu/supct/html/93-986.ZC1.html) Saying >anonymous technologies are indefensible concedes a crucial point: that the >government's power is so sweeping that police have the right to learn our >identity in all cases. So much for whistleblowing and anonymous reports of >public brutality. > >Perhaps more to the point, the twin privacy-encroaching technologies of >automated electronic surveillance and efficient large-scale databases did >not exist decades or centuries ago. "Absolute" anonymity lets us reclaim >some of that lost zone of privacy. Lastly, trying to remove "absolute" >anonymity from the Internet (banning strong encryption and computers that >can be programmed not to keep logs) would be far more disruptive, >destructive, and harmful than proposals like Hollings' CBDTPA that Larry >has rightly opposed. --Declan] > >--- > >From: Lawrence Lessig <lessig(a)pobox.com> >Cc: Declan McCullagh <declan(a)well.com> >Subject: Re: [Politech] Economist, Lessig want to preserve freedom by >ending anonymity [fs][priv] >Date: Fri, 5 Dec 2003 10:16:31 +0900 >To: Aaron Swartz <me(a)aaronsw.com> > >It's not an inaccurate quote, but it is taken out of context. > >What I said was that the trend in our laws was to destroy any privacy at >all -- that the idiocy of Patriot Acts, etc., was effectively eliminating >any form of privacy. There are two kinds of responses to this -- one to >try to defend and build a system protecting absolute anonymity; the second >is to build effective protections for pseudonymous life, which is >shorthand for traceable transactions, but where the permission to trace is >protected by something like a warrant requirement. I'm not saying the >government should build these systems, but that they should be permitted >and indeed encouraged. > >In my view, we will make no progress following path one, but that we would >strongly advance privacy if we could advance path two. A strong ethic and >architecture of pseudonymous identity, properly protected, would give us >more privacy than we have today. > >Of course, it is possible (and probably likely) that such an architecture >would not properly protect the link between a transaction and the privacy >of a person. Government officials, for example, upon mere suspicion would >be able to break the link, etc. That of course is not what I am promoting. >I would promote a regime where the gov't required a very strong >warrant-like reason before it could break the code that makes the link. >But I will not that the baseline from which we're starting is a world >where no real showing is necessary for this sort of surveillance. > > >On Dec 4, 2003, at 9:26 AM, Aaron Swartz wrote: > >>>To preserve freedom further, suggests Mr Lessig, anonymity could be >>>replaced by [warrant-traceable] pseudonymity. >> >>Can you explain this? The Economist article seemed to be total nonsense, >>but I'm surprised they paraphrase you as saying something like this. In >>general, for eliminating anonymity to make sense you need to answer three >>questions: >> >>1. Is anonymity the problem? Between DMCA subpoenas and national security >>letters, it seems that very few people on the Internet have even limited >>anonymity. >> >>2. Will the people who are anonymous evade things? The people who _are_ >>anonymous, of course, are people like crackers. If you outlaw anonymity, >>crackers will likely find security holes that let them hide their >>identity and pass their actions off as those of others (e.g. using the >>WiFi network of some squeaky-clean grandma to launch the attacks). >> >>3. Is it worth the cost? Even if you can answer the above questions, >>it'll be difficult to do without knocking large groups of people off the >>Internet. (If the digital divide is bad now, imagine what it'll be like >>when you need a credit card to get on the Net.) >> >>Were you misquoted? If not, can you answer these questions? Or is this >>more blind optimism? >>-- >>Aaron Swartz: http://www.aaronsw.com/ >----- >Lessig >Stanford Law School >559 Nathan Abbott Way >Stanford, CA 94305-8610 >650.736.0999 (vx) >650.723.8440 (fx) > > Ass't: <laura.lynch(a)stanford.edu> > <http://lessig.org/blog> > <http://creativecommons.org> > <http://eldred.cc> > > Help reclaim the Public Domain: Please sign this petition: > http://eldred.cc/sign > > How else can you help? Check out: > http://svcs.affero.net/rm.php?r=Lessig

2 2

Privacy and Property on the Net: Research Questions
by Eugen Leitl 05 Dec '03

05 Dec '03

http://www.sciencemag.org/cgi/content/full/302/5651/1686 PERCEPTIONS OF SCIENCE ESSAY: Privacy and Property on the Net: Research Questions William Sims Bainbridge* The Net, which consists of the Internet plus the parallel networks of commercial and military data communication, raises serious issues of personal information vulnerability and ownership of intellectual property. Peer-to-peer sharing of music files over Internet, for example, challenges the existing system of copyright. Counterterrorism "data mining" systems hunt for signs of suspicious activity across vast databases of information about people who do not wish to be spied upon. Research by social and information scientists is needed to clarify many such issues. To a sociologist, perhaps the most interesting quality of Internet and other data transmission networks is their potential to alter power relationships with respect to personal privacy and intellectual property. Both are restrictions on the free flow of information. Government is implicated in both, on the one hand by providing legal support for them and, on the other hand, by potentially violating them in the pursuit of its own goals, such as national security. Social scientists have only just begun framing research projects to learn how the Internet is liberating information from traditional restraints or to understand the likely human consequences. Although both privacy and property are rooted deep in humanity's evolutionary past, they are variables, and societal norms change. For example, until a century and a half ago, U.S. census takers would post their completed enumeration forms in the town square for anyone to read, but from 1850 until 1954 when Title 13 of the U.S. Code forbade publication of an individual's records, a complex series of steps gradually increased confidentiality protections (1). Today, the Census Bureau keeps the data confidential for 72 years. This change has largely been driven by the increasing government collection of data about its citizens, to facilitate social services, taxation, and management of the economy (2). By offering confidentiality, government hopes the public will relinquish some of its traditional privacy. Whether citizens benefit from government collection of data about them is another matter. In Maryland, every prospective juror is asked what his or her religion is, even though this information is not used in the jury selection process. The religion data are kept confidential, but all information about prospective jurors that is used in the selection is made public. Thus, we have the bizarre situation of costly information being kept confidential precisely because it is useless. The idea that government should regulate intellectual property through copyrights and patents is relatively recent in human history, and the precise details of what intellectual property is protected for how long vary across nations and occasionally change. There are two standard sociological justifications for patents or copyrights: They reward creators for their labor, and they encourage greater creativity. Both of these are empirical claims that can be tested scientifically and could be false in some realms (3, 4). Consider music (5). Star performers existed before the 20th century, such as Franz Liszt and Niccolo Paganini, but mass media produced a celebrity system promoting a few stars whose music was not necessarily the best or most diverse. Copyright provides protection for distribution companies and for a few celebrities, thereby helping to support the industry as currently defined, but it may actually harm the majority of performers. This is comparable to Anatole France's famous irony, "The law, in its majestic equality, forbids the rich as well as the poor to sleep under bridges." In theory, copyright covers the creations of celebrities and obscurities equally, but only major distribution companies have the resources to defend their property rights in court. In a sense, this is quite fair, because nobody wants to steal unpopular music, but by supporting the property rights of celebrities, copyright strengthens them as a class in contrast to anonymous musicians. Internet music file sharing has become a significant factor in the social lives of children, who download bootleg music tracks for their own use and to give as gifts to friends. If we are to believe one recent poll done by a marketing firm rather than social scientists, 48% of American Internet users aged 12 to 17 had downloaded music files in the past month (6). In so doing, they violate copyright laws, and criminologists would hypothesize they thereby learn contempt for laws in general. A poll by the Pew Internet and American Life Project found that two-thirds of an estimated 35 million Americans who download music files do not care whether they are copyrighted (7). Thus, on the level of families, ending copyright could be morally as well as economically advantageous. On a much higher level, however, the culture- exporting nations (notably the United States) could stand to lose, although we cannot really predict the net balance of costs and benefits in the absence of proper research. We do not presently have good cross-national data on file sharing or a well-developed theoretical framework to guide research on whether copyright protection supports cultural imperialism versus enhancing the positions of diverse cultures in the global marketplace. It will not be easy to test such hypotheses, and extensive economic research has not conclusively answered the question of whether the patent system really promotes innovation. We will need many careful, sharp-focus studies of well-formed hypotheses in specific industries and sectors of life. For example, observational and interview research can uncover the factors that really promote cultural innovation among artists of various kinds and determine the actual consequences for children of Internet peer-to-peer file sharing. The classic sociological theory of privacy asserts two main principles that are relevant to current information debates (8, 9). First, private relations between individuals are not merely a personal luxury but the very basis of all societies. Thus, surveillance of citizens in the name of national security undermines the very society it was intended to protect. Second, privacy and its violation are inescapably issues of power, with power defined as the ability to defend one's own privacy while being able to invade the privacy of others. Thus, citizens' privacy is violated by government surveillance, even if the information is kept confidential afterward by the agencies. Computer scientists have begun to develop systems that would defend people's information privacy (10). For example, the World Wide Web consortium, which is the chief forum for development of Web standards, has launched the Platform for Privacy Preferences, which automatically manages personal information when interacting with Web sites, following the explicit wishes of the user (11). Ethically informed research can be valuable for design and implementation of information systems. Data mining, for example, can be used in noncontroversial situations like intrusion detection, when you need to defend your own data against attack from outside. But it can also be used aggressively to sift through vast troves of data, pulled together via the Net in a process called data fusion, in a way that violates the privacy of law-abiding citizens while hunting for a few criminals or terrorists. In its recent report, Information Technology for Counterterrorism, the National Research Council blithely suggests that all airport security baggage x-ray machines could send their pictures to a unified computer network that would monitor the collective movements of terrorists boarding different airplanes in different cities, incidentally spying on everybody else who flies (12). Proper sociotechnical design could limit the harm. For example, an automatic data-mining system could seek patterns of suspicious behavior, without allowing any human being to see the data. Then, specially sworn court officials could carefully examine the suspicious cases, before reporting to law enforcement only those few that met statutory definitions of probable cause. What is the optimal design for such a multitiered confidentiality system? Would there be unintended consequences? Would it be acceptable to the public? Without good answers to such questions, information technology could fall under the same cloud of public suspicion that hangs over nuclear power and genetic engineering. Already, aggressive telemarketing has made people very reluctant to answer scientific surveys administered by telephone (13). Internet-based surveys have promise, but they typically lack the reliability of traditional random-sample polling. Another challenge is that impartial research on the real consequences of government security-motivated data fusion and mining may not be possible within the government security regime itself, because impartiality in science requires the research to be made public. Like other buzzwords, "data mining" is difficult to define precisely, and it is practically indistinguishable from a wide range of statistical and pattern recognition techniques used throughout the sciences. Thus, if it is brought into disrepute by privacy violations, science could be harmed. Similarly, many scientists use data that belong to other people, such as the social survey data archived at the Inter-University Consortium for Political and Social Research (14), so they would be affected by any change in the intellectual property regime. Internet arose as a medium of scientific communication and is an indispensable tool for scientists today. Thus, research on Internet privacy and property issues could benefit science itself, as well as society. Only an anarchist would argue for complete government deregulation of information, but any social scientist would find it interesting to contemplate the implications of major changes in government enforcement of intellectual property rights and government collection of data about its citizens. This essay has briefly sketched theoretical issues that would underlie research on information privacy and property in the age of Internet, and policy-makers should be aware that current practices may reflect cultural lag, the conflict-ridden situation when technological development has rendered traditional norms obsolete (15). References and Notes 1. R. McCaa, S. Ruggles, Scand. Pop. Stud. 13, (2002). 2. D. Bell, The Coming of Post-Industrial Society (Basic Books, New York, 1973). 3. C. A. Ganz-Brown, J. World Intellect. Property 1, (1998). 4. National Research Council, Computer Science and Telecommunications Board, The Digital Dilemma: Intellectual Property in the Information Age (National Academy Press, Washington, DC, 2000). 5. W. S. Bainbridge, in Social Sciences for a Digital World, M. Renaud, Ed. (Organization for Economic Co-Operation and Development, Paris, 2000). 6. Ipsos-Insight, "Legal issues don't hinder American downloaders" (14 March 2003); [cited from www.ipsos-reid.com 5 May 2003]; available at www/ipsos-insight.com. 7. M. Madden, S. Lenhart, "Music downloading, file-sharing and copyright" (July 2003) at www.pewtrusts.com. 8. B. Schwartz, Am. J. Sociol. 73 (1968). 9. W. S. Bainbridge, "Privacy," forthcoming in Encyclopedia of Community, K. Christensen and D. Levinson, Eds. (Sage, Thousand Oaks, CA, 2003). 10. National Research Council, Computer Science and Telecommunications Board, Who Goes There?: Authentication Through the Lens of Privacy (National Academy Press, Washington, DC, 2003). 11. World Wide Web Consortium at www.w3c.org. 12. National Research Council, Computer Science and Telecommunications Board, Information Technology for Counterterrorism (National Academies Press, Washington, DC, 2003). 13. D. El Boghdady, Washington Post, 8 September 2002, p. H1. 14. Inter-University Consortium for Political and Social Research at www.icpsr.umich.edu. 15. W. F. Ogburn, Social Change (Huebsch, New York, 1922). 16. The views expressed in this essay do not necessarily represent the views of the National Science Foundation or the United States. The author is in the Division of Information and Intelligent Systems, the Directorate for Computer and Information Science and Engineering, National Science Foundation, 4201 Wilson Boulevard, Arlington, VA 22230, USA. E-mail: william.bainbridge(a)verizon.net -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

[IP] Markle Report -- Creating A Trusted Information Network for Homeland Security (fwd from dave@farber.net)
by Eugen Leitl 05 Dec '03

05 Dec '03

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Uniform Police apparently unconstitutional
by kawaii ryuko 04 Dec '03

04 Dec '03

http://www.constitution.org/lrev/roots/cops.htm "Police work is often lionized by jurists and scholars who claim to employ "textualist" and "originalist" methods of constitutional interpretation. Yet professional police were unknown to the United States in 1789, and first appeared in America almost a half-century after the Constitution's ratification. The Framers contemplated law enforcement as the duty of mostly private citizens, along with a few constables and sheriffs who could be called upon when necessary. This article marshals extensive historical and legal evidence to show that modern policing is in many ways inconsistent with the original intent of America's founding documents. The author argues that the growth of modern policing has substantially empowered the state in a way the Framers would regard as abhorrent to their foremost principles." (Stolen from Declan's Politech list and reposted here.) Ever lovable and always scrappy, kawaii

1 0

[IP] The Third Annual Workshop on Economics and Information Security (fwd from dave@farber.net)
by Eugen Leitl 04 Dec '03

04 Dec '03

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Recommended Pro freedom discussion list
by Freematt357＠aol.com 03 Dec '03

03 Dec '03

[Note from Matt Gaylor: I've been on this list for a couple of years and on occasion I find the discussion lively and interesting. It's coming from Kent State University, the place where actual real assault rifles were used May 4, 1970 to wound 9 and kill 4 student war protesters. Ohio Guardsmen opened fire during a noontime demonstration. For a chronology of the shooting please go to: http://members.aol.com/nrbooks/chronol.htm. I can think of no better way to remember the fallen, than by discussing liberty via the school they attended.] -=> the libertarian discussion list <=- ldl(a)listserv.kent.edu The ldl list is intended for discussion of libertarian issues, as well as announcements of local and state events. We encourage lively and active discussion, and discourage mean, derogatory, or wildly off-topic posts. - To subscribe, send 'subscribe ldl' in the body of an email message to listserv(a)listserv.kent.edu - To get a reference of listserv commands and options, send 'info ref' in the body of an email message to listserv(a)listserv.kent.edu - For other problems or questions, send email to list owner Bob Hart at bobhart(a)neo.rr.com

1 0

Re: [p2p-hackers] Peer-to-Peer Journal (P2PJ) CFP (fwd from sam@neurogrid.com)
by Eugen Leitl 03 Dec '03

03 Dec '03

Right now we're getting increasing FUD from the sides of Elsevier & Co against emerging open content journals. I don't think there's a turning of the tide, though, as early adopters have already embraced alternative channels of publication (physicists and math people foremost in arXiv), and it's only a matter of time before more conservative branches of science (medical, chemistry and biology people: that's you) are to follow. We might be getting the publishing monopolists to try grasping for DRM for paper copyright. I'm wondering why they haven't started watermarking their .pdfs yet, shough a crawler looking for phrases or computing document hashes would do just as nicely. Either way, the librarians are attempting to revolt using whatever little leverage they have. Fact is, the budgets are shrinking, and the shelves are emptying, while the content owners have established a de facto pay per view. ----- Forwarded message from Sam Joseph <sam(a)neurogrid.com> -----

2 1

Inferno: PBS | I, Cringely . Archived Column (fwd)
by Jim Choate 03 Dec '03

03 Dec '03

What I find most interesting in this article is not MS marketing noise but the comment about the White House, robot.txt, and Google... http://www.pbs.org/cringely/pulpit/pulpit20031120.html Truly a despicable act for a -public servant-. -- -- Open Forge, LLC 24/365 Onsite Support for PCs, Networks, & Game Consoles 512-695-4126 (Austin, Tx.) help(a)open-forge.com irc.open-forge.com Hangar 18 Open Source Distributed Computing Using Plan 9 & Linux 512-451-7087 http://open-forge.org/hangar18 irc.open-forge.org James Choate 512-451-7087 ravage(a)ssz.com jchoate(a)open-forge.com

1 0

Japan police arrest two Winny/Freenet users
by R. A. Hettinga 02 Dec '03

02 Dec '03

<http://asia.cnet.com/newstech/security/printfriendly.htm?AT=39159923-390011…> Japan police arrest two P2P users By Staff, CNETAsia 3/12/2003 URL: http://asia.cnet.com/newstech/security/0,39001150,39159923,00.htm A Japanese peer-to-peer (P2P) file-sharing network which claimed to keep user identities untraceable has failed to work--two users in Japan have been arrested. The developer of the P2P software has also had his home searched by police, according to a report in the Mainichi Daily. There are around a quarter of a million users of the supposedly anonymous file-trading network, called Winny, which rides on the more well-known Freenet network. Such networks differ from other file trading software such as Kazaa in that they claim to be able to hide the Internet Protocol (IP) addresses of users. It is not known how the police managed to track down the two users, or why criminal action is being taken against them. In other countries, P2P users have been hit with civil lawsuits instead. The creator of Freenet, Ian Clarke, has cast doubt on whether Winny uses Freenet's full identity-cloaking features or its cryptography, according to a report in New Scientist. Freenet is an open-source project and is most prominent of a growing number of projects aimed at giving people the ability to communicate online without being tapped, traced or monitored. The software marks an attempt to create a network that exists as a parallel Internet, where content of any kind can be uploaded and downloaded without any way to track who created a given "site". Unlike other peer systems, Freenet has a built-in method of pushing content between different computers, so that a given file can migrate around the network between different people's hard drives until it is stored near regions where it is most often used. The arrested are two men, aged 41 and 19, said the Mainichi Daily report. Among other charges, the older man is accused of sharing the Hollywood movie A Beautiful Mind while the teenager is being held for making the game Super Mario Advance available online. Several companies, including game maker Nintendo, are pressing charges against the pair. This is the first known case of legal action being taken on users on anonymous file-sharing networks. In Korea and Taiwan, lawsuits have been filed against users of P2P networks. A copyright body in Taiwan is suing three users of file sharing networks while in Korea, recording companies are threatening to do the same. In both countries, creators of file sharing software have been brought to court, but defendants are arguing they are not responsible for what people choose to share. Both cases involve homegrown P2P networks sharing local-language music. In Taiwan, the International Federation of the Phonographic Industry (IFPI) has sued three P2P users who are said to have shared files on the locally-popular Kuro and Ezpeer networks. Unlike internationally popular networks such as Kazaa, both Taiwanese services are fee-based. The Recording Industry Association of Korea (RIAK) is said to be mulling suing end users of free-use P2P software Soribada. Soribada's 4.5 million users have lost the recording industry millions in revenue, claimed the RIAK. The makers of the software have been slapped with a US$16,300 fine, despite claiming that they are not responsible for the actions of its users. In the U.S., the Recording Industry Association of America (RIAA) has targeted hundreds of P2P users for legal action. There is some evidence that the controversial RIAA lawsuits against ordinary computer users are making a dent in the file-swapping world. According to Web analysis firm Nielsen/NetRatings, weekly usage of the Kazaa software in the United States plummeted from a high of 7 million people in early June to just 3.2 million people in late October. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Silly Linux Kernel Bug
by Eric Cordian 02 Dec '03

02 Dec '03

As reported today on Slashdot, in linux kernels prior to 2.4.23, it is possible to map the kernel into user space with brk(), since apparently no one ever bothered to check that the argument passed was in the lower 3 gig of the address space. This is almost as funny as early linux kernels in which the LDT was user writable. In any case, the patch is to stick the following check in do_brk() in /mm/mmap.c if ((addr + len) > TASK_SIZE || (addr + len) < addr) return -EINVAL; This is of course a serious bug, since anyone on a vulnerable machine has access to kernel memory by writing a terse no-brainer C program, of which I will not give an example, because enough people on the Internet hate me already. :) An interesting occurrence, because it demonstrates that massive numbers of open source participants auditing the code aren't sufficient to ferret out every giant coding blunder. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

4 4