- cypherpunks-legacy - lists.cpunks.org

CDR: RE: CIA in Oregon, Intelink
by John Young 25 Oct '00

25 Oct '00

Yes, the BXA ISTAC is familiar since I'm on its mailing list. The CIA ISTAC is a different dog. And it was the Oregon rep which surprised, not the Vienna, VA and DC addresses. Why Oregon? Intel, Microsoft, In-Q-tel, or another bedmate helping equip and run Intelink? Intelink is reportedly restricted to those with intelligence need to know, and is blocked to outsiders. However, IC.GOV has been around a while and I wondered if a wizard here might know a way to finagle access. Here are few specific URLs provided in the DoD Intelligence Information System Instructions 2000: Intelligence Community PKI activities: http://www.iccio.ic.gov/ DIA page: http://www.dia.ic.gov/proj/dodiis/dodiis.html JITF Intelink: http://web1.rome.ic.gov:82/vtf.cgi Here's the URL for the DoDIISI2000 doc: http://www.dia.mil/Graphics/Intel_community/dodiis_2000/0204_DoDIISInstr_Fin al.doc (The URL may wrap.) For the dark side of the Albright bearhug, the DIA FOIA site offers the "North Korea Country Handbook," May, 1997, prepared by the intel community, and published by the Marine Corps Intelligence Acitivity: http://www.dia.mil/Graphics/FOIA/nk/nkor.pdf (429 pages, 5.6MB) It could be useful to those intending to exchange URLs with the Chief of NOFOIA DPKR.

1 0

CDR: Privacy: Dems criticize GOP, Calif, Australia, and Carnivore
by Declan McCullagh 25 Oct '00

25 Oct '00

********* More privacy stuff at: http://www.cluebot.com/search.pl?topic=privacy ********* http://www.cluebot.com/article.pl?sid=00/10/25/2351218&mode=nested Democrats Criticize Census Data Sharing posted by cicero on Wednesday October 25, @06:49PM from the hypocritcal-congresscritters-so-what-else-is-new dept. David Sobel of EPIC just sent us a letter that a pair of Democratic legislators are circulating on Capitol Hill. Turns out they want to stop a Republican plan to share some Census data with other government agencies. The opposition from Carolyn Maloney and John Dingell is certainly welcome, but it's important to realize that this is a simple partisan manuevering. While they piously bleat that "Congress should be protecting personal privacy," neither voted for privacy-protective measures when they had the chance, according to a Wired News scorecard. The letter, dated October 25: http://www.cluebot.com/article.pl?sid=00/10/25/2351218&mode=nested http://www.cluebot.com/article.pl?sid=00/10/24/226242&mode=nested CIX: E-mail Headers Aren't Legal Carnivore Fodder posted by protozoa on Tuesday October 24, @04:38PM from the slippery-slope-vs-vertical-slope dept. The Commercial Internet Exchange Association has published this white paper (PDF format) arguing that e-mail headers shouldn't legally be considered the same thing as telephone numbers dialed. Why is that important? Because according to the paper's introduction,"[t]hrough programs like "Carnivore," the government seeks real-time access to the e-mail addresses and other transactional elements of e-mail communications under the low "pen register" standard used to trace the digits dialed on a telephone,". It's a tricky legal distinction, but a very important one -- such a finding in court could cut the FBI's net surveillance plans off at the knees. I've included the paper's introduction below. The CIX introduction (in HTML): http://www.cluebot.com/article.pl?sid=00/10/24/226242&mode=nested http://www.cluebot.com/article.pl?sid=00/10/21/1517258&mode=nested California Creates State Privacy Office posted by protozoa on Saturday October 21, @09:58AM from the you-said-what-to-who? dept. According to this press release, California Governor Gray Davis signed twenty bills yesterday tailored to protect privacy and other consumer interests for state residents. Most noteworthy of these bills is SB 129, which creates the first-ever statewide Office of Privacy Protection under California's Department of Consumer Affairs. Other new laws include and procedural assistance for identity theft victims and new consumer "opt-out" reqirements for credit bureaus. Dan Gillmor wrote a column about identity theft and privacy protection in California back in March, expressing his support for two stronger and more far-reaching bills in this arena. Neither of them were among those passed. http://www.cluebot.com/article.pl?sid=00/10/21/1421235&mode=nested Australian Privacy Legislation Inches Forward posted by protozoa on Saturday October 21, @09:07AM from the privacy-privacy-oi-oi-oi dept. An Australian Senate committee has produced a set of recommendations (in PDF form) governing private corporations' data collection practices. The bill is scheduled to be considered during the coming session. The Privacy Amendment (Private Sector) Bill 2000 aims to update regulations in light of the "dramatic developments in information technology and data communication practices" since the passage of the Privacy Act in 1988. The recommendations include an exemption for small businesses (except in instances where medical information is involved) and a strategy for accordance with the European Data Directive. Electronic Frontiers Australia called the bill "complex, unwieldy, ineffective and an insult to the citizens of Australia" in its testimony in May, citing numerous loopholes and inadequate enforcement provisions. Many of their concerns appear to have been ignored. ABC (that's A for Australian) ran a brief piece on Federal Attorney-General Daryl Williams' support of the bill. As it says at the bottom of the box: Post your comments below. Can any privacy legislation better than none? Is ineffectual privacy legislation worse than none?

1 0

CDR: RE: CIA in Oregon, Intelink
by Trei, Peter 25 Oct '00

25 Oct '00

> ---------- > From: John Young[SMTP:jya@pipeline.com] > Reply To: John Young > Sent: Wednesday, October 25, 2000 6:34 PM > To: cypherpunks(a)cyberpass.net > Subject: CIA in Oregon, Intelink > > Would anyone in the Oregon area know about > a CIA organization acronymed ISTAC? > > Here's the NIC entry, which includes a CIA rep > in Bend, OR. Note that the other CIA rep used > only a last name initial. > > CIA (ISTAC-DOM) > 1820 Electric Avenue > Vienna, VA 21076 > > > Domain Name: ISTAC.GOV > Status: ACTIVE > Domain Type: Federal > > Technical Contact, Administrative Contact: > S, Dan (DS3) > 703-281-8087 > DAN(a)ISTAC.GOV > [...] Well, you *could* call up Mr. Dan and ask (the worst he could do is lie), but that would be too easy, wouldn't it? The most likely suspect appears to be a BXA advisory body. Of course, acronyms can get overloaded :-) Since the duties of this ISTAC appear to include advising BXA on encryption, I think it's relevant to the list. Peter. google gives: -------------------------------- http://207.226.239.89/990126mo.htm and http://bxatac.doc.gov/ suggests ISTAC = Information Systems Technical Advisory Committee That page also has links to minutes from the public parts of meetings, (which are held in DC) The next ISTAC meeting is November 15 &16, and is partially open to the public. Here's some cut&paste text WHAT ARE TECHNICAL ADVISORY COMMITTEES? Technical Advisory Committees (TACs) advise the Department of Commerce on the technical parameters for export controls applicable to dual-use commodities and technology and on the administration of those controls. The TACs are composed of representatives from industry and Government representing diverse points of view on the concerns of the exporting community. Industry representatives are selected from firms producing a broad range of goods, technologies, and software presently controlled for national security, foreign policy, nonproliferation, and short supply reasons or that are proposed for such controls, balanced to the extent possible among large and small firms. HOW ARE MEMBERS CHOSEN? TAC members are appointed by the Secretary of Commerce and serve terms of not more than four consecutive years. The membership reflects the Department's commitment to attaining balance and diversity. TAC members must obtain secret-level clearances prior to appointment. These clearances are necessary so that members can be permitted access to relevant classified information needed in formulating recommendations to the Department of Commerce. Each TAC meets approximately 4 times per year. Members of the TACs will not be compensated for their services. HOW MANY TACS ARE THERE, AND WHAT DO THEY DO? The following is a list of TACs that currently advise BXA, along with a short summary of each TAC's issue areas. You can access the committee's charter by clicking on its name. 1.Information Systems - Articles, materials and supplies of computers electronics, and telecommunications equipment. 2.Materials - Articles, materials, and supplies for radar absorption, jet engine turbines blades, super- conductivity, fluids, lubricants, composites, and for nuclear, missile, chemical, and biological weapons, including technical data and other information. 3.Materials Processing Equipment - Articles, materials and supplies of metal-working equipment, numerically controlled machine tools and robots, including technical data on the integration of numerically controlled machine tools and robotics equipment to form manufacturing cells and flexible manufacturing systems and enterprise automation technologies, as well as other information. 4.Regulations and Procedures - The Export Administration Regulations (EARs) and procedures implementing these regulations. 5.Sensors and Instrumentation - Articles, materials and supplies of sensors and instrumentation, including technical data and other information. 6.Transportation and Related Equipment - Articles, materials and supplies of transportation and related equipment, including technical data and other information.

1 0

CDR: Re: Re: Illicit words
by Bill Stewart 25 Oct '00

25 Oct '00

At 09:37 AM 10/25/00 -0400, Riad S. Wahby wrote: >There is also the 'spook.lines' file that has come in every Emacs >distribution at since 19.34 or earlier. On my machine it's >/usr/share/emacs/20.7/etc/spook.lines >You can use M-x spook to pull several random ones from a file and put >them in the current buffer, like the following: >CIA Legion of Doom Peking Noriega cracking Waco, Texas domestic >disruption bomb security Kennedy KGB $400 million in gold bullion >counter-intelligence colonel Semtex Makes a fine substrate for steganography as well :-) Pick 64 spookwords or spookphrases, which gets you six bits per word, or four bits with some duplications to level out distributions a lot. Heroin Intel Detonator DomIntel Echelon Noriega Semtex Terrorism Umber Feinstein Phreaking Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

CDR: At last!
by clubbers chat 25 Oct '00

25 Oct '00

Hi, At last clubberschat has arrived! Some time ago we contacted you with news of a forthcoming service Clubberschat. Clubberschat is a site that is linked up to hundreds of other clubbing sites worldwide, which should solve that age-old problem of empty chat rooms! We are having three main rooms at first with a view to add more when necessary, chill out room, dance floor room and on the pull room! We are now live and are in a promotional fortnight of signing up affiliates. Within these two weeks, signup is free. If you do decide to join us you will get your own personalised page with your logo and background colours to blend in with your site. This is a great way to offer YOUR COMMUNITY more value from your site, plus your hits will increase as people come back time and time again to use the chat, they will also tell their friends. You will get your own personalised page linking directly into the chat. If you are interested in signing up or want to see how the chat works then please visit: www.globalchatlink.com for more details plus a sign up procedure! Affiliates and their link pages are done on a first come, first served basis. Can you really afford not to be part of this unique opportunity? Add chat, add value, add hits, add Clubberschat! If this is not for you, or we have your mail address in our database by mistake, please accept our apologies we will not send this mail out again. Richard Howlett Business Development Clubberschat is a service offered by www.globalchatlink.com

2 1

CDR: Al Gore goes cypherpunk?
by Declan McCullagh 25 Oct '00

25 Oct '00

http://www.rollingstone.com/sections/magazine/text/excerpt.asp?afl=rsn&lngF eatureID=120&lngStyleID What's in your top five from the past year? Being John Malkovich; East Is East; Shall We Dance? I liked Gladiator a lot - I thought that was an excellent movie. I loved The Matrix. I loved the metaphor. Somebody gigged me in the mainstream media for not liking too much violence in the movies but simultaneously liking that movie. Well, you know, it was rated for adults. It was very violent, but it was a terrific movie. And I can hardly wait for the sequel.

8 14

CDR: Re: Non-Repudiation in the Digital Environment (was Re: First Monday August 2000)
by Ed Gerck 25 Oct '00

25 Oct '00

"Arnold G. Reinhold" wrote: > In public-key cryptography "Non-Repudiation" means that that the > probability that a particular result could have been produced without > access to the secret key is vanishingly small, subject to the > assumption that the underlying public-key problem is difficult. If > that property had be called "the key binding property" or "condition > Z," or some other matheze name, we would all be able to look at this > notion more objectively. "Non-repudiation," has too powerful a > association with the real world. Your definition is not standard. The Cryptography Handbook by Menezes defines non-repudiation as a service that prevents the denial of an act. The same is the current definition in PKIX, as well as in X.509. This does not mean, however as some may suppose, that the act cannot be denied -- for example, it can be denied by a counter authentication that presents an accepted proof. Thus, non-repudiation is not a stronger authentication -- neither a long lived authentication. Authentication is an assertion that something is true. Non- repudiation is a negation that something is false. Neither are absolute. And they are quite different when non-boolean variables (ie, real-world variables) are used. They are complementary concepts and *both* need to be used or we lose expressive power in protocols, contracts, etc.. Cheers, Ed Gerck > > > To transfer the cryptographic meaning of "non-repudiation" to a legal > presumption against repudiation requires legislative acceptance four > things: > > 1. the mathematically unproven assumptions in public key cryptography > > 2. the binding of a particular public key to a person > > 3. the ability of an ordinary individual to keep a private key secret > > 4. holding the individual responsible for failure to do so. > > As for 1, note that at the moment there is not even consensus as to > the long term security of , say, a 1024-bit RSA key. As to 2., read > the Verisign certification practice statement. As to 4. not that in > the US we do not presently hold individuals responsible for loss of a > credit card. > > The most problematic assumption is 3. McCullagh lists a couple of > attacks, but there are many more. Here is my incomplete list: > > 1. Planting a program on the user's computer to capture their keyring > and passphrase. > > 2. Replacing the users copy of the cryptographic program with a > doctored version > > 3. Planting a bug in their keyboard to capture key strokes > > 4.* Using a microTV camera to capture passwords and PIN numbers > > 5.* Substituting documents. (You think you are buying a pizza but you > are actually signing a deed to your house. > > 6. Public/private key pairs generated by a third party who's security > is less than perfect > > 7. Poor or deliberately weak random number generation at key creation > > 8.* Algorithm substitution (e.g. multiprime) that weakens security to > reduce computation times > > 9. Guessable passphrases and PINs > > 10.* Allowing someone else to use your key (does the president of > World Wide Widget really hold the key token, or does he give it to > his secretary?) > > 11.* Con artist techniques ("I'm an field agent from CyberSec -- > here's my ID card -- and we'd like your help in tracking down child > pornography dealers on the Internet. We'll need your key token and > PIN. ") > > 12.* Finding ways to penetrate "tamper proof" mechanisms, e.g. power > fluctuation attacks. > > McCullagh believes that "trusted systems," which he defines as "at > least Bl (TCSEC)/E3(ITSEC)/ or even possibly B2(TCSEC)/E4( ITSEC)" > can provide a basis for non-repudiation in the legal sense. He is > under the apprehension that "A trusted computing system performs in > accordance with its documented specification and will prevent any > unauthorised activity." Since Mr. McCullagh background is in law, > let me provide an equivalent statement: "Laws reflect the public's > consensus of what is right and wrong and the judicial system fairly > and accurately enforces those laws." Both are statements of a lofty > goal, not a reality that anyone has been able to achieve. > > Well designed cryptographic tokens can counter some of the attacks I > listed, but not all. The ones I marked with an asterisk are still > applicable and there is still the problem of verifying and auditing > the token manufacturer, a lucrative target for organized crime. > > I can't address the legal arguments he makes since he is in > Australia, but my understanding of the recently enacted electronic > signature law in the US is that it attempts to put electronic > signatures on exactly the same legal footing as paper signatures. It > has no special status for PKC signatures. Clicking an http "I Accept" > button is just as valid, as I understand the law. > > The term "non-repudiation" should be retired. The best that one can > say about public key signature systems for use by the general public > is that they can make forgery much more difficult. That difficulty > should result in reduced rates of attempted fraud, but should never > be a valid pretext for changing the legal burden of proof. > > Arnold Reinhold

12 25

CDR: RE: Denver Judge rules Cops can seize bookstore records
by Carskadden, Rush 25 Oct '00

25 Oct '00

How do they subpoena records from garden supply stores looking for people who buy too many grow lamps or hydroponic setups? Do they just subpoena all of these stores on a regular basis? What do they claim they are looking for in the subpoenas? My understanding is that you pretty much have to know what you are looking for and be fairly specific about it in the subpoena. If you do not already know who is buying "too many" grow lamps or hydroponic setups, how do you structure the subpoena? The only signed subpoenas that I have seen that were grossly general and unsure of what was needed were either A) Internet related (taking advantage of a seeming lack of knowledge on the part of judges) or B) a case where the person who is being subpoena'd is actually a victim of the crime being investigated. Do you have more information on the garden supply store thing? ok, Rush Carskadden -----Original Message----- From: Greg Broiles [mailto:gbroiles@netbox.com] Sent: Wednesday, October 25, 2000 2:45 PM To: cypherpunks(a)cyberpass.net Subject: Re: Denver Judge rules Cops can seize bookstore records Interesting - the article is a little confused on a few points - specifically, this is not the first time this has happened, the DEA subpoena'd records from a publisher of mushroom growing books back in the mid 90's. They also subpoena records from garden supply stores looking for people who buy too many grow lamps or hydroponic setups. Also, it doesn't sound like they're talking about a search warrant - those aren't issued by DA's, nor do their targets have an opportunity to argue about what's searched prior to the search, because the searches take place without notice and at gunpoint. It sounds like they're talking about a subpoena, which does afford the recipient a chance to get an attorney and argue about it prior to releasing information. Still, it's a good reminder that it can be dangerous to trust even good people with sensitive information - the good people may not willingly betray you, but they may be forced to divulge the information on pain of losing money, property, or their life, or it may simply be stolen by armed gangs. At 12:45 PM 10/25/00 -0500, No User wrote: >Real-To: No User <no.user(a)anon.xg.nu> > >"If we can save but one child from the awful scourge of drugs..." > >Of course, the real issue here is why the bookstore was keeping such >personalized records in the first place. > >-------- >Judge: Cops can seize bookstore records >http://www.denverpost.com/news/news1021b.htm > >By Susan Greene >Denver Post Staff Writer > >Oct. 21, 2000 - Police will be allowed to search customer purchase records >at the Tattered Cover Book Store to investigate a narcotics case, a Denver >judge ordered Friday. > >Civil libertarians decried the order - believed to be the first of its >kind nationwide - for protecting law enforcement's ability to obtain >evidence over individual rights to read without interference from >authorities. > >Tattered Cover owner Joyce Meskis said the order could have a "chilling >effect" on the First Amendment and on store patrons, who might hesitate to >buy books knowing that police have access to their purchase records. She >is considering an appeal. > >"A bookstore is a house of ideas," she said. "We certainly have the >responsibility to protect customers' rights to those ideas, and the right >to privacy that goes along with that." > >Law enforcers hailed the order as a victory. > >"If it only takes one or two records from a bookstore to help us eliminate >drugs on the street, then so be it," said Lt. Lori Moriarty, commander of >the North Metro Drug Task Force, which is seeking the Tattered Cover >records. "We need all the tools possible to help law enforcement do its >job." > >The controversy stems from a March 14 raid on an Adams County mobile home >in which task force members found a methamphetamine lab and two books: >"The Construction and Operation of Clandestine Drug Laboratories" by "Jack >B. Nimble," and "Advanced Techniques of Clandestine Psychedelic and >Amphetamine Manufacture" by "Uncle Fester." > >Investigators also found a bookshipping envelope containing an invoice >number from the Tattered Cover in Lower Downtown Denver. They are hoping >bookstore records will help pinpoint which of the six people who >frequented the mobile home bought the books and, presumably, operated the >lab. > >The task force first sought a search warrant from the Adams County >district attorney's office, which rejected the request partially on >grounds that executing it would give police a public relations "black >eye." > >Task force members then turned to the Denver DA's office, which granted >the warrant. > >Meskis blocked police from going through her store's records, saying they >should instead use other investigative measures such as fingerprinting to >find their suspect. > >Denver District Court temporarily blocked the task force from seizing the >records, pending the outcome of a hearing before Judge Stephen Phillips. > >Most states have laws protecting public libraries from police searches >except under exceptional circumstances, but there is no special law that >protects bookstores. > >The issue made headlines in 1998, when independent counsel Kenneth Starr >subpoenaed two Washington, D.C., bookstores for information on gifts >exchanged between President Clinton and White House intern Monica >Lewinsky. Barnes & Noble and Kramerbooks hired lawyers and challenged the >subpoena in federal court. > >A federal judge quashed Starr's request for the records. Lewinsky, >meantime, agreed to testify in exchange for immunity, rendering the whole >issue moot. > >Still, the case was a watershed for bookstore owners and privacy >advocates, who have been watching the Tattered Cover's legal battle with >intense interest. > >Phillips, in his order, recognized the First Amendment right to "receive >information and ideas, regardless of social worth," but he cited a legal >balancing test weighing such rights against the importance of law >enforcement to investigate crimes. > >Phillips ruled that the identity of the drug lab operators is "of >significant public interest" and that "the purchase of how-to books is a >highly important piece of evidence." > >The judge wrote that there's no other reasonable way, aside from seizing >store records, for investigators to obtain the information they're >seeking. He lauded the task force for asking only for specific invoices, >not "stumbl(ing) through other private records." > >Phillips deemed the Tattered Cover case "dramatically different" than the >Lewinsky case, about which he wrote: "The subpoenas were exploratory in >nature, and the government was unable to show any need nor any nexus to a >criminal event." > >And so Phillips denied investigators' broad request for a month's worth of >records that might show all titles purchased by the unnamed suspects. >Still, he granted police access to the specific invoice whose number >appeared on the book mailer. > >Meskis has 15 days to appeal before the task force seizes her records. > >Moriarty insists it was never her unit's intent to comb through reading >records of the general public. Rather, she said, Phillips' order will give >investigators "an important piece of a puzzle" needed to nab their >suspect. > >Critics say one arrest is a high price to pay for allowing a war against >drugs to chip away at civil rights. > >"Key principles of the right to privacy and freedom of speech have >ultimately been compromised in the decision," said Sue Armstrong, >executive director of the American Civil Liberties Union in Colorado. > >Judith Krug, director of the Office for Intellectual Freedom at the >American Library Association, said she worries that drug investigators >unfairly are "making the connection between what people read and what they >do." > >"Just because you read a book on homosexuality, for example, doesn't mean >you're gay. And reading a book on the symptoms of cancer doesn't mean you >have the disease," Krug said. > >"Our concern is that what people read, what goes into their heads will no >longer remain private." > > >KEY QUESTIONS: > >Denver District Judge Stephen Phillips posed four key questions as part of >a legal balancing test in his ruling: > >1. Is there a legitimate and significant government interest in acquiring >the information? > >2. Is there a strong nexus between the matter being investigated and the >material being sought? > >3. Is the information available from another source? > >4. Is the intrusion limited in scope so as to prevent exposure of other >constitutionally protected matters? > >Copyright 2000 The Denver Post. All rights reserved. > >Related: >Bookstore fights search warrant >http://www.denverpost.com/news/news1018d.htm -- Greg Broiles gbroiles(a)netbox.com

1 0

CDR: Fwd: Wen Ho Lee Petition for Blue Ribbon Investigation & Presidential Pardon - Discussion Zaplet
by WenHoLee.org 25 Oct '00

25 Oct '00

WenHoLee.org has sent you an interactive Zaplet about 'Wen Ho Lee Petition for Blue Ribbon Investigation & Presidential Pardon '. Based on the email software you are using, the best way to access your Zaplet is on the web. <a href="http://zaplet.zaplet.com/servlet/Z?m=2_QA_ilcQHUVhK2PZCHF68CjKC">Click here to view this Zaplet</a> Thank You WenHoLee.org ---------------- If you are unable to reach the link above, go to the following address using your web browser: http://zaplet.zaplet.com/servlet/Z?m=2_QA_ilcQHUVhK2PZCHF68CjKC If you require assistance, please email us at support(a)zaplet.com To learn more about Zaplets, visit us at www.zaplet.com Thank you for using Zaplets!

1 0

CDR: For small values of "Ideal" (was: Re: why should it be trusted?)
by Secret Squirrel 25 Oct '00

25 Oct '00

Nathan Saper wrote: > Having socialized healthcare would be ideal. However, I think that "Having total gun control would be ideal," "Having self censorship would be ideal," "Having salary standardization would be ideal," and now: "Having socialized healthcare would be ideal." What next? "Having crypto export controls would be ideal"? If I set up a Killfilepunks list, will you migrate?

1 0