- cypherpunks-legacy - lists.cpunks.org

Re: Spoliation cites
by Eric Murray 07 Aug '01

07 Aug '01

On Mon, Aug 06, 2001 at 11:51:46AM -0400, Trei, Peter wrote: > > jamesd@echeque.com[SMTP:jamesd@echeque.com] wrote: > > > > I am unable to reconcile Black Unicorn's recent post, where he denounces > > almost the entire cypherpunk program as illegal by current legal standards > > and a manifestation of foolish ignorance of the law and obstinate refusal > > to take his wise advice, with the conjecture that Black Unicorn is aware > > of > > current recommended best practice in record keeping. > > > I've mostly been staying out of this stormy little teacup, but I'll > concur that BU is overreaching himself. When he starts to claim > that writing security software to best industry practices - erasing > sensitive data as soon as it's need has passed, clearing disks > and buffers, etc - all practices mandated for meeting certain > government FIPS levels, and widely documented as standard - > when he claims that writing programs correctly could get me > in trouble - then it's time to downgrade my estimates of his > knowledge and expertise. > > Peter Trei I read him as suggesting that some ambitious prosecutors might possibly try to extend spoliation to that point, not that they're doing so now. A bit of Googling finds a good definition of spoliation (in California): ---- Plaintiff possessed a potential defense to a claim for damages against a defendant. Defendant knew or reasonably should have known of this claim for damages by plaintiff. Defendant knew or reasonably should have known of the existence of the physical evidence and knew or reasonably should have known that it might constitute evidence in pending litigation involving plaintiff. Defendant knew or reasonably should have known that if he did not act with reasonable care to preserve the physical evidence, the potential evidence could be destroyed, damaged, lost or concealed. Defendant failed to act with reasonable care. Defendant's failure to act with reasonable care caused the destruction of, damage to, or loss or concealment of such evidence. As a result, plaintiff sustained damage, namely plaintiff s opportunity to prove its claim was interfered with substantially. ---- As BU points out, if "reasonably should have known" can be defined in court as "you were running a service that allowed drug dealers and pedophiles to send anonymous email", talking about FIPS 140 etc. won't help much in front of a jury of Oprah-watching "peers", even if it's factually and technically correct. Are things this bad already? I don't know, but it wouldn't suprise me. A murder case in silicon valley recently finished. The jurors were interviewed by the local paper. When asked why they convicted the defendant on circumstantial evidence, the answer was "he felt guilty". Eric

2 1

Safeweb [was: RE: Advertisements on Web Pages]
by Trei, Peter 07 Aug '01

07 Aug '01

> From: Tim May[SMTP:tcmay@got.net] > > > Just a note about what's happening with Web advertising. > > Went to a site, www.imdb.com, to check something about a film. Up popped > a doubleclick.net ad. In front of the main page, obscuring it. I clicked > the close box. Up popped a _different_ ad. I clicked the close box. Yep, > up popped a third ad box. I closed it. I think it stopped at this point. > [...] > --Tim May > I do a lot of my random web browsing thru www.safeweb.com, which allows me to disable pop-ups. It also 1: Causes the direction and content of my browsing to be obscured from any observer between me and the Safeweb site. 2: Obscures the target site from knowing who is surfing them. 3. Manages cookies intelligently. It's not perfect - safeweb.com could build a pretty good profile of where I surf. Ideally, you'd want to chain through two or more non-colluding Safeweb type services - think of it as a remailer for HTTP. Also, In-Q-Tel (the CIA VC firm) is one of Safeweb's investors The CIA's story is that they want a way for their agents to surf without leaving footprints. Safeweb appears to have been founded a group of programmers of Chinese descent, and is designed to act as a route around the Great Firewall of China. There's even a entry proxy called 'Triangleboy' which should allow Safeweb to be used if the main site is blocked. Unlike a lot of the people on this list, these guys actually write code. Peter Trei

1 0

[IRR] Using the Fluhrer, Mantin, and Shamir Attack to Break WEP
by Monty Solomon 07 Aug '01

07 Aug '01

Using the Fluhrer, Mantin, and Shamir Attack to Break WEP AT&T Labs Technical Report TD-4ZCPZZ Authors Adam Stubblefield John Ioannidis Aviel D. Rubin Abstract We implemented an attack against WEP, the link-layer security protocol for 802.11 networks. The attack was described in a recent paper by Fluhrer, Mantin, and Shamir. With our implementation, and permission of the network administrator, we were able to recover the secret key used in a production network, with a passive attack. The WEP standard uses RC4 IVs improperly, and the attack exploits this design failure. This paper describes the attack, how we implemented it, and some optimizations to make the attack more efficient. We conclude that 802.11 WEP is totally insecure, and we provide some recommendations. http://www.cs.rice.edu/~astubble/wep/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

[IRR] Using the Fluhrer, Mantin, and Shamir Attack to Break WEP
by Monty Solomon 07 Aug '01

07 Aug '01

Using the Fluhrer, Mantin, and Shamir Attack to Break WEP AT&T Labs Technical Report TD-4ZCPZZ Authors Adam Stubblefield John Ioannidis Aviel D. Rubin Abstract We implemented an attack against WEP, the link-layer security protocol for 802.11 networks. The attack was described in a recent paper by Fluhrer, Mantin, and Shamir. With our implementation, and permission of the network administrator, we were able to recover the secret key used in a production network, with a passive attack. The WEP standard uses RC4 IVs improperly, and the attack exploits this design failure. This paper describes the attack, how we implemented it, and some optimizations to make the attack more efficient. We conclude that 802.11 WEP is totally insecure, and we provide some recommendations. http://www.cs.rice.edu/~astubble/wep/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

RE: Spoliation cites
by Aimee Farr 07 Aug '01

07 Aug '01

james wrote: > If one keeps records, and suddenly someone sues one, and THEN one > starts shredding, yes, then one can get into trouble. If > however, one shreds away indiscriminately, on a routine and > regular schedule, one is in the clear. As a remailer operator > said to the courts "Sorry, I do not keep > records". > > Now if he had kept records, and then erased them on being > summoned to the court, he would have had a problem. But because > he erased them routinely, no problem. If you read any of those cites and shep'd them, you will see there are circumstances where defendants didn't know the documents were relevant to a specific lawsuit. There is support for the words "SHOULD HAVE KNOWN" might NOT equivocate to: "a lawsuit has been filed." Nor even "expect a specific lawsuit." Furthermore, in Lewy, they did adhere to a destruction policy and plaintiffs got a jury instruction allowing for a negative inference. Does this tell you anything? Normally, you consider the following in a retention policy: o pending or threatened litigation = easy answer, keep it. o statute-specific retention requirements = easy answer.... o statutes of limitations = starts getting fuzzy here, usually the length of the relationship, plus the limitations periods.... o real estate = long time. o IP = forever. o email = most say a few weeks, unless it is a complaint, etc. It's not so simple as many think. It's document specific. ------- In certain cases, opponents may argue that the high-risk nature of certain enterprises amounts to a state of continual pending or threatened litigation, although non-specific in nature. They also may argue, as in Lewy, that destruction pursuant to a retention policy and normal business practice -- is not good enough. The court will look beyond the practice to ask if the policy is reasonable GIVEN THE PARTICULAR NATURE OF THE DOCUMENT AT ISSUE. The root of the matter is: SHOULD YOU HAVE KEPT IT? The court seemed to infer in Lewy that the nature of the business and the likelihood of litigation is a consideration. -------------------------------------------------------- Lewy v. Remington Arms Co. 836 F.2d 1104 (8th Cir., 1998) -------------------------------------------------------- ..."We hold that there was sufficient evidence from which the jury could find that Remington knew the M700 was dangerous. The following evidence was before the jury: complaints from customers and gunsmiths that the Model 700 would fire upon release of safety, some of these complaints dating back as far as the early 1970s; .... .....Remington was unable to produce several documents that were destroyed pursuant to Remington's "record retention policy." Remington argues that destroying records pursuant to routine procedures does not provide an inference adverse to the party that destroyed the documents. Smith v. Uniroyal, Inc., 420 F.2d 438, 442-43 (7th Cir. 1970). The record reflects that Remington had its record retention policy in place as early as 1970. In addition, the records that have been destroyed pursuant to the policy -- complaints and gun examination reports -- were kept for a period of three years and if no action regarding a particular record was taken in that period it was destroyed. Vick v. Texas Employment Commission, 514 F.2d 734, 737 (5th Cir. 1975) (records destroyed pursuant to regulations governing inactive records). ...First, the court should determine whether Remington's record retention policy is reasonable considering the facts and circumstances surrounding the relevant documents. For example, the court should determine whether a three year retention policy is reasonable given the particular document. A three year retention policy may be sufficient for documents such as appointment books or telephone messages, but inadequate for documents such as customer complaints. ****************** ...Second, in making this determination the court may also consider whether lawsuits concerning the complaint or related complaints have been filed, the frequency of such complaints, and the magnitude of the complaints. ***************** [i.e., not just lawsuits - complaints. The court probably wanted to know if the defendant was on notice that this information would be sought in future NON-SPECIFIC litigation.] **************** Finally, the court should determine whether the document retention policy was instituted in bad faith. Gumbs v. International Harvester, Inc., 718 F.2d 88, 96 (3rd Cir. 1983) ("no unfavorable inference arises when the circumstances indicate that the document or article in question has been lost or accidentally destroyed, or where the failure to produce it is otherwise properly accounted for."); Boyd v. Ozark Air Lines, Inc., 568 F.2d 50, 53 (8th Cir. 1977) ("We recognize, however, that the destruction of business records may be sufficient to raise an unfavorable inference."). In cases where a document retention policy is instituted in order to limit damaging evidence available to potential plaintiffs, it may be proper to give an instruction similar to the one requested by the Lewys. Similarly, even if the court finds the policy to be reasonable given the nature of the documents subject to the policy, the court may find that under the particular circumstances certain documents should have been retained notwithstanding the policy. ************ For example, if the corporation knew or should have known that the documents would become material at some point in the future then such documents should have been preserved. Thus, a corporation cannot blindly destroy documents and expect to be shielded by a seemingly innocuous document retention policy. Gumbs, 718 F.2d at 96 ("Such a presumption or inference arises, however, only when the spoliation or destruction [of evidence] was intentional, and indicates fraud and a desire to suppress the truth, and it does not arise where the destruction was a matter of routine with no fraudulent intent.") (quoting 29 Am. Jur. 2d Evidence ' 177 (1967)). ### In some high-risk endeavors, opponents may argue that destruction or purposeful non-retention = fraudulent intent. I don't think Remington REALLY wanted to keep those complaints 3 years, James. Ask yourself why they did even that. Look, we are just trying to envision what opponents are likely to try. The outcome will depend on the facts. Finally, the fact that a case (within the range of hypotheticals we have discussed) has not arisen is not dispositive on the issue. If that were the case, James, precedent would have no value, because the law could never move forward. Indeed, precedent, by it's very nature usually involves something novel. Otherwise, it wouldn't get to court, because everybody would know the answer. > You guys keep telling us we are not allowed to routinely purge > records, You keep speaking in absolutes. It's more complicated. > But if you routinely destroy records on the basis that all > records of type Y more than X days old shall be destroyed, unless > there is some specific reason for keeping them, routine, > regularly scheduled erasure of logs, then you are not destroying > them in specific anticipation of a lawsuit. You > may well be destroying them in general anticipation of the > general possibility of lawsuits, as Microsoft quite obviously is, > as most companies quite obviously are, but Microsoft is not > destroying them in specific anticipation of a specific lawsuit, > so they are in the clear. See above. ~Aimee

4 9

RE: [spam score 5.00/10.0 -pobox] RE: Spoliation cites
by Aimee Farr 07 Aug '01

07 Aug '01

> > jamesd@echeque.com[SMTP:jamesd@echeque.com] wrote: > > > > I am unable to reconcile Black Unicorn's recent post, where he denounces > > almost the entire cypherpunk program as illegal by current > legal standards > > and a manifestation of foolish ignorance of the law and > obstinate refusal > > to take his wise advice, with the conjecture that Black Unicorn is aware > > of > > current recommended best practice in record keeping. > > > I've mostly been staying out of this stormy little teacup, but I'll > concur that BU is overreaching himself. When he starts to claim > that writing security software to best industry practices - erasing > sensitive data as soon as it's need has passed, clearing disks > and buffers, etc - all practices mandated for meeting certain > government FIPS levels, and widely documented as standard - > when he claims that writing programs correctly could get me > in trouble > - then it's time to downgrade my estimates of his > knowledge and expertise. > > Peter Trei You guys are acting like Uni said, "THOU SHALT NOT WRITE CODE." Put down your pungi sticks. ~Aimee

2 1

Ricardo "el gato Perez web site
by ricardoel gato perez 07 Aug '01

07 Aug '01

!! HI !! I hope YOU like my site www.gatoperez.com Check it out and enjoy. !!! HOLA !!! Espero que les agrade mi pagina web www.gatoperez.com Mirenla y disfrutenla. Regards Saludos RICARDO P :-)

1 0

Re: Voice crypto: the last crypto taboo
by David Honig 07 Aug '01

07 Aug '01

At 06:05 PM 8/6/01 +0200, Eugene Leitl wrote: >On Mon, 6 Aug 2001, David Honig wrote: > >> And nautilus and PGPfone. Maybe on a pocket PC if they have >> decent audio. How do you make money on this approach, though? > >By selling wireless bandwidth? Hardware? Leather accessoires and GUI >skins? Consulting? The future of crypto is selling faceplates... >I don't think the apps themselves should be commercial. It only leads to >featuritis, lousy code and backdoors. Yeah, you need open code to be trusted, but this leads to the bizmodel problems ("opportunities"). "Integration services" / "branding" for the less competent/more busy/less interested, perhaps.

1 0

Federal cops to get more power in DC
by Declan McCullagh 07 Aug '01

07 Aug '01

Great. Just what DC residents need. --Declan SOCIAL ISSUES D.C. Metropolitan Police and the Federal Protective Service News conference to announce a compact that will allow federal police forces to patrol and make arrests for D.C. Code offenses that occur near their agencies. Participants: Del. Eleanor Holmes Norton, D-D.C.; D.C. Police Chief Charles Ramsey; Kenneth Wainstein, acting U.S. attorney and Andre Jordan , director, Federal Protective Service Location: HC-9, U.S. Capitol. 10 a.m. Contact: Joyce Patterson, 202-225-8050 **NEW**

1 0

Save 30% to 65% on Prescription Costs for You or Your Loved Ones
by Lead Generation 07 Aug '01

07 Aug '01

This is a one time mailing. You are not on a mailing list. If you do not know of someone who can save on their prescription costs please delete this message and you will not be mailed again. If you do know of someone who would benefit from this program please do them a favor and forward this on to them. ----------------------------------------------------------------------------------------------------------------------------------------- Do you spend more than $30 per month on prescriptions? Would you spend $7.00 per month to save 30% to 65% on your prescription costs? Would you spend $7.00 per month if you could use any local or national pharmacy or even mail order? To qualify for this phenomenol program you must: * Spend at least $30 per month on prescriptions * NOT carry prescription insurance or a discount card with the exception of: AARP, People's, Medicare or a drug store discount card * Have a checking account or hold a major credit card * Live in the United States of America If you qualify and would like to be contacted by our customer care specialists please send a message to: saveonprescriptions(a)yahoo.com or just reply to this email with your name, telephone number including area code, time zone and preferred time of day to be called, (morning, afternoon or evening) in the body of the message. A customer care specialist will call to confirm your interest, contact information and will also ask you the following: * What do you spend per month on medications? ** Specifically what medications, strength, quantity and price that you pay * You also qualify for an optical plan at no additional charge if you have a checking account or credit card. Do you have either of these? Our customer care specialist will also provide you with the Better Business Bureau number to call and our registered number so you can check us out for your safety and peace of mind.

1 0