- cypherpunks-legacy - lists.cpunks.org

[Full-Disclosure] JAP back doored
by error 02 Sep '03

02 Sep '03

This is a terrible day for privacy advocates that used the once (perhaps never true) "anonymous" Java Anonymous Proxy. According to a story ( http://theregister.co.uk/content/55/32450.html) by The Register (It was also posted to ("http://securityfocus.com/archive/1/334382/2003-08-18/2003-08-24/0) BugTraq) JAP was back doored by court order. It was a forced upgrade (after a service interruption) to monitor "one site" that continues to be unnamed. How sad it is when a group have a motto of "Anonymity is not a crime." and then hand logs to the police without a word? Clearly if they are able to defend themselves on alt.2600 (http://groups.google.com/groups?dq=&hl=en&lr=&ie=UTF-8&frame=right&th=f4ef43 f695ca29e8&seekm=3f3d3740%241_1%40news.vic.com#link10), they aren't under a gag. Read it and weep. -- error <error(a)lostinthenoise.net> [demime 0.97c removed an attachment of type application/RENAMED-99 which had a name of signature_asc.RENAMED-99]

4 4

Re: "domestic terrorism", fat lazy amerikans & ducks
by R. A. Hettinga 02 Sep '03

02 Sep '03

At 10:25 AM -0400 8/26/03, Sunder wrote: >I'm "afraid" of the oil companies Ah. You're afraid of markets. That makes you a socialist. *You*'re a terrorist, Sunder. ;-) Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

5 6

Re: "Terror Reading"
by Steve Schear 02 Sep '03

02 Sep '03

At 10:48 AM 6/26/2002 -0400, Kathleen Dolan wrote: >>In many states, it is illegal to store records showing who borrowed a >>book from a public library. Maryland, for example, requires destruction of >>the record after a point and even backups cannot be accessed without a >>court order. >> >>KAD > >Say a public library implements a policy of replying positively to all >such inquiries, that is, if asked by a patron the db admin will tell them >when their account is free of such inquiries. If a request does come in >then the db admin can either: fail to respond (monitoring implied), tell >them they are being monitored (violating the law) or lie and say they are >not even if they are. So, can the Feds require a librarian to lie to a >customer who inquires whether their library usage is being monitored? Looks like at least one library is trying a variation the method I suggested... "The Patriot Act also prohibits libraries and others from notifying patrons and others that an investigation is ongoing. At least one library has tried a solution to "beat the system" by regularly informing the board of directors that there are no investigations. If the director does not notify the Board that there are no investigations, it can serve as a clue that something may be happening. " http://www.ombwatch.org/article/articleview/1706/1/41 steve A foolish Constitutional inconsistency is the hobgoblin of freedom, adored by judges and demagogue statesmen. - Steve Schear

5 7

[cdr] SSZ CDR Policy Change
by Jim Choate 02 Sep '03

02 Sep '03

Greetings, We are closing the cypherpunks(a)ssz.com address to non-subscriber submissions. Actual subscriptions will remain open and unregulated. We have provided an alternate email address for specific submissions where sender anonymity is to be preserved, cpunks-anon(a)ssz.com. The list traffic will remain otherwise unmoderated and will mirror any and all traffic on the CDR backbone. These changes take place immediately. There were two basic reasons for this: 1. My thesis that any community will fractionate into 'tribes' that will preserve their particular 'view' of 'reality' has been demonstrated. This provides yet another point to the contrary for the validity of Crypto-Anarcho-Capitalistic-Libertarian (CACL) societal claims. The various policies of processes of the current nodes stands on primary evidence to the 'tribalization' tendency of human psychology. 2. I no long see a positive reason to leave the submissions open without consideration. The load on my time and system simply no longer justify such effort in light of #1. Don't worry, the SSZ CDR isn't going away...And we intend to continue to kick CACL butt! -- -- ravage(a)ssz.com jchoate(a)open-forge.com www.ssz.com www.open-forge.com

1 0

[cdr] Test #2 [No Reply]
by Jim Choate 02 Sep '03

02 Sep '03

-- -- ravage(a)ssz.com jchoate(a)open-forge.com www.ssz.com www.open-forge.com

1 0

[cdr] Test [No Reply]
by Jim Choate 02 Sep '03

02 Sep '03

X-Anonymous Submissions: cpunks_anon(a)ssz.com -- -- ravage(a)ssz.com jchoate(a)open-forge.com www.ssz.com www.open-forge.com

1 0

Re: "Terror Reading"
by Tim May 01 Sep '03

01 Sep '03

On Monday, September 1, 2003, at 12:03 PM, Meyer Wolfsheim wrote: > The risk is not one "terrorists" have to fear. The biggest problem with > the librarian narc program is the same as most of these anti-terrorism > measures: completely innocent people are harassed, arrested, or placed > under suspicion. > > You won't catch a terrorist learning to be evil at a library, but you > might wrongfully snare an innocent citizen who happens to have an > interest > in "bad" books. > > How long until this program is extended to include anyone checking out > any > book that some part of the US law enforcement body deems bad? If you > read > Pikhal, do you end up on a watch list? The chilling effect is that libraries will get the message and remove "seditious" and "questionable" books. I'm not spending much time in public libraries, favoring the UCSC Science Library, but I'll bet that after 9/11 a lot of the old stand-by books on rocketry, explosives, hydroponic gardening, etc. were removed by helpful librarians. (A "lot" meaning at least 5% of the libraries doing at least some removal of books. In some states, if not in large cities.) Librarians are our first defense against terrorism! Ignorance is strength. --Thought Criminal "We are at war with Oceania. We have always been at war with Oceania." "We are at war with Eurasia. We have always been at war with Eurasia." "We are at war with Iraq. We have always been at war with Iraq. "We are at war with France. We have always been at war with France."

1 0

Re: Responding to orders which include a secrecy requirement
by J.A. Terranson 01 Sep '03

01 Sep '03

I wasn't even going to answer the absurd "hypothetical", but since it's now in play... On Mon, 1 Sep 2003, Sunder wrote: > In that case, I would suspect the ISP itself would have incoming/outgoing > feeds from other ISP's. Obviously, every ISP does. > If that single moral objector ISP refuses to > allow carnivores, the other, not quite as moral ISP's might be persuaded > to allow it, in which case the fedZ get what they want, just one > traceroute hop further up the chain. Perhaps not all of them, but perhaps > enough of them... Duh! Maybe I should have been clearer: the feds didn't show us at any of the small guys (AFAIK), such as the regional or small nationals - they showed up at the large multinationals (of which the one I work at was likely the smallest, with a mere 48 countries of footprint). They clearly understood that sniffing my peering/transit pipes wasn't technically *possible* (yet) - what they were interested in was sniffing my regional POPs, with [relatively] low speed OC3/OC12 pipes. To rephrase it: they were interested in *my* customers, not the traffic from other companies (they had other field officers at the other NSPs). > That's the thing about the internet - your packets must travel through > other ISP's (unless you're communicating with other nodes hosted by that > single ISP which is unlikely). It's a lot more likely than you seem to realize. The internet is a collection of aggregation points (ISPs): get the individual aggregations, and the rest is as visible as a reconstructed RAID5 stripe. > From the fedZ point of view, you need not > tap each and every single ISP. You can tap upstream, and still get the > data without tipping off the target, or his moral objector friends at her > ISP. This type of thing certainly goes on, but not in the vaccum cleaner world of large pipes. This is only technically feasible for targetted investigations. > At some point every ISP goes through MCI, Sprint, and AT&T, and don't > forget the local (phone company) loops. The loops are too far out on the edge to be useful for anyone but the loop owner themselves, and there are *way* too many [ever changing] paths out of any individual ASN - the aggregation point is where this kind of action *must* happen. > > Assuming that such a moral objector ISP would exist, As I noted: much to my amazement, many do exist. > it would be foolish > to assume that it would provide much of a measure of protection against > tapping cleartext transmissions. > Hence, encryption is important. Want > privacy and security? It's up to you to provide it: encrypt. Agrred. Encryption, properly implemented and executed, is the only real path to privacy. -- Yours, J.A. Terranson sysadmin(a)mfn.org "Every living thing dies alone." Donnie Darko

1 0

Net anonymity service un-backdoored
by R. A. Hettinga 01 Sep '03

01 Sep '03

<http://www.theregister.co.uk/content/6/32533.html> The Register 28 August 2003 Updated: 17:42 GMT Net anonymity service un-backdoored By Thomas C Greene in Washington Posted: 28/08/2003 at 13:31 GMT The Java Anonymous Proxy (JAP) service, a collaborative effort of Dresden University of Technology, Free University Berlin and the Independent Centre for Privacy Protection Schleswig-Holstein, Germany (ICPP), has been allowed to suspend its monitoring of users' IP traffic pending a decision on the legality of back-dooring it. Collectively known as the AN.ON Project, the operators appealed a lower court's decision allowing the German Feds to obtain reports on users' access to a particular IP address (no doubt having to do with KP or bomb-making, etc). The appeals court has allowed the operators to discontinue logging until their appeal has been answered. When a decision has been reached, the JAP team says they will document the whole affair, but cannot do so until the court issues its ruling. A single record of access to the forbidden IP address has been logged but not yet disclosed to the Feds pending the higher court's decision, the JAP team says . In a previous article The Register criticised the way the JAP team handled its initial confrontation with the Feds, ie., by waiting quietly until a user discovered the back door before acknowledging the situation. We believe there were better ways of dealing with the court order, either by posting a prominent warning that the service might be subject to monitoring by the authorities, by leaking the information to the press outside Germany, or by disabling the affected proxies temporarily in protest. We hope that if the JAP team should lose its appeal and be ordered to resume monitoring, particularly under a gag order, it will find a way of giving the public a proper heads up. Their previous performance hardly inspires confidence, but there is always opportunity for redemption. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

11 17

[AntiSocial] Syracuse U tracks the Department of Homeland Security (fwd)
by J.A. Terranson 01 Sep '03

01 Sep '03

Of interest to many here, I am sure. Tim: hide your eyes... -- Yours, J.A. Terranson sysadmin(a)mfn.org "Every living thing dies alone." Donnie Darko ------- FORWARDED MESSAGE ------------------- I don't know how many people have seen this already... Interesting new data released Monday by Syracuse University on the Dept. of Homeland Security. It includes employees by county for the entire country: http://trac.syr.edu/tracreports/tracdhs/030825/county_full.html which, curiously, shows Boulder with zero full-time DHS employees but San Miguel (Telluride) with 7! It also includes this, from http://trac.syr.edu/tracreports/tracdhs/aboutdata030825.html "TRACs direct experiences with the DHS in connection with the FOIA law thus far have not been encouraging. Most of our FOIA requests to the department, for example, have yet to be acted upon although -- given the short time that has elapsed since our initial requests -- this may not be entirely surprising. More disturbing is the fact that many of public records that the Freedom of Information Act requires be posted on the agencys web site are not yet available. "But there have been a number of additional specific incidents that heighten our concern. In an attempt to telephone the departments public affairs office in June, for example, TRAC was twice informed that the direct-dial number of this office was not a matter of public record. On a second occasion, after a FOIA officer in one of DHS sub-agencies promised to fax TRAC a list identifying documents that the FOIA specifically mandates be made public, the promise was withdrawn. Then another DHS sub-agency informed TRAC it would not act on our FOIA request -- an outcome flowing from its failure to classify Syracuse University as qualifying as an educational ...institution whose purpose is scholarly or scientific research. On yet another occasion, a TRAC request for more timely information to update material posted some months before on a sub-agencys public web site was summarily refused." They also track FBI and other govt ops... ---------- Forwarded message ---------- Date: Thu, 28 Aug 2003 13:30:43 -0400 (EDT) From: TRAC <trac(a)MailBox.syr.edu> Subject: Department of Homeland Security (DHS) TRAC's first special report on the DHS is now available. This report provides comprehensive information about the staff of an agency which now employs one out of every twelve full-time federal workers: where they work, what they are paid, what they do and the agencies within the department that employ them. Analysis, maps, tables and graphs are available. Also presented are data documenting staff changes between 9/11 and March 31, 2003. For more information go to: http://trac.syr.edu/media David Burnham and Susan B. Long, co-directors Transactional Records Access Clearinghouse Syracuse University 488 Newhouse II Syracuse, NY 13244-2100 315-443-3563 trac(a)syr.edu http://trac.syr.edu

2 1