- cypherpunks-legacy - lists.cpunks.org

Estonia Tests "Contactless" ID-Cards (fwd from brian-slashdotnews@hyperreal.org)
by Eugen Leitl 09 Aug '04

09 Aug '04

The EU is about to follow suit in a couple of years, no doubt. ----- Forwarded message from brian-slashdotnews(a)hyperreal.org -----

1 0

Re: name of the Tor twin?
by Eugen Leitl 09 Aug '04

09 Aug '04

On Sun, Aug 08, 2004 at 03:55:07PM -0700, jrandom wrote: > We're not ready for widespread use yet, but I've been working on it > fulltime for over a year, and we've made a lot of progress. I'll Thanks. I've just got spare bandwidth I'd like to put to good use (and increase the amount of opaque traffic). > post more when there's more to post. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

"...and Mr. Hughes wants to give it to him."
by R. A. Hettinga 08 Aug '04

08 Aug '04

<http://www.linuxjournal.com/print.php?sid=3450> Linux Journal - The Premier Magazine of the Linux Community Guest Editorial Date: Thursday, July 01, 1999 Topic: Linux Community Eric Hughes The average Joe wants something for nothing, and Mr. Hughes wants to give it to him. I paid for my university education, in that I paid an institution for access to its faculty and for use of its facilities. The knowledge was free; all I had to do was take advantage of the fact that it was there for the learning. I've told many people about things I learned in school. I didn't need to pay a license fee to tell other people about Hamiltonian mechanics or Gvdel incompleteness. The academics who created this body of knowledge published papers and gave away their knowledge. As far as I'm concerned, I got something for nothing from them. Michael Faraday discovered electromagnetic induction and thereby paved the way for the electricity and electronics industry. The value he captured from this development was nowhere near all the value he created for everyone else. Such was his station in life. He made the choice to freely give his time to the advancement of science. Many others have followed his example, but nowhere near a majority. Yet this tiny fraction of people has exerted a significant, disproportional change on the world. Such is the fate of certain knowledge workers. Get used to it. On first blush, software appears to follow this academic pathway. Yet software has users, who must find the software useful to keep it. Researchers do not have to make their output useful, just accurate, novel and potentially useful. To wit, researchers don't have to do market research. Clearly, software developers don't think they have to understand their users. Developers need to understand their users only when they expect to have users. The distribution of software clearly follows the model of academic knowledge--create it once for free, then make the user pay for its distribution. Yet the creation of software does not mirror the creation of knowledge quite so accurately. The principle of ``academic freedom'' is about as antithetical to the principle of ``attaining user benefit'' as possible. The two just don't fit and can't. The university never had a monopoly on creating knowledge--or on developing free software--and it never will. The university, however, does embody the understanding that some development requires nurturing that cannot be easily obtained elsewhere. Software development has no such analogous institutions, and it needs one that is not the university. This new institution should be a non-profit, tax-exempt corporation especially created to pay for the design, construction and delivery of public software. Let's be obvious about this: giving away software for free is about as close as possible to the center of the charitable purpose requirement of a tax-exempt company. Like the university, the staff--no, let us call them the talent--the talent working at this institution are not motivated by dreams of entrepreneurial riches, but by the advancement of the craft. The talent needs to come from a wide variety of disciplines, essentially all that are present at a for-profit software company. This new institution will always be in competition with commercial interests for talent, so it will have to pay for talent accordingly. Talent gets paid, the institution creates some well-needed feeling of solidity, and regular folks get free software. ``Public software'' is any software that people can obtain and use without any entanglement with intellectual property issues. Public software also denotes the ubiquity of the software and the corresponding expectation that people encounter it frequently. Some open-source software is public software, some is not. Public software is a concept rooted in the nature of its end use, not in the means of creating it. All the wrangling over license terms for derivative works has obscured the obvious point that the license is in service of some goal; if you don't name your goal, you can't possibly attain it. I know what my goal is--it is free beer. I still can't figure out how the claim that the GNU Public License encourages free speech is not utterly disingenuous. The GPL is the opposite of free speech; it's a highly detailed copyright agreement with the purpose of restricting the expression of derivative works. If I can't keep an expression to myself, I am restricted. All license agreements begin from the starting point of complete restriction, that is, total prohibition against use, and then work forward from that point. The summit of free speech is public domain expression--if you want to speak it again, go ahead, and for whatever purpose you care to seek. As much as I am an advocate of free speech and all other civil rights, my purpose with public software is not free speech--it's free beer. The crucial reason the GPL has achieved such limited success in scope is that its purpose is to benefit programmers who want access to code, not to benefit outside customers. Whatever benefit an outside customer gains is ancillary to the benefit to programmers. This observation also explains why most GPL code is in development tools and environments. To be blunt, the GPL is a selfish contract for selfish purposes which cannot possibly be generalized. The open-source model, by contrast, is a technique in search of goals. Open Source encompasses the goals of the GPL, and indeed found some of its initial inspiration there. Yet Open Source also encompasses other disparate goals, such as those for Mozilla. I want to promote Open Source, but as part of my desire to promote public software. My goal is compatible with Open Source, but I seek Open Source not to promulgate its own merits, but as an enabler of public software. Indeed, I fear sometimes that the Open Source movement may fall to the hazard that is the core selfishness of the GPL. In an attempt to seek openness, its promoters may forget that, whatever benefit they derive from access to code, they must place benefits to users first. By avoiding that hazard, I am confident good results will come from the hubbub of activity surrounding Open Source. I wish them well, but their effort is not identical to mine. My effort is toward public software. The natural venue for the release of public software is the new institution. The value of any software derives in large part from the solidity and gravity of the organization that creates it. Ferreting out those expectations about the future which affect the net present use value of software is another essay. Let me observe, without justification, that people overwhelmingly prefer code that is stable, architecture that is well-designed, products that can be repaired and upgraded, and companies that will endure. Most people lack the means to evaluate technical merit in software. Even more people prefer to do things other than evaluate software. For almost everybody, one's expectations about the institution stand in as a proxy for all that thinking. Since I want public software to become ubiquitous, I want the new institution to ship product. I have not yet mentioned sustainability of the new institution, because concerns about sustainability are concerns about means, not about goals. A coherent and organizing focus on what needs to be accomplished has been lacking; instead, we have had endless fretting about how to do it--whatever this ``it'' is. For all of its faults, at least Richard Stallman elucidated a clear goal for the GPL: ``Make all source code everywhere usable by me personally.'' A selfish goal, but at least it roused the mutually self-interested to action. I cannot name another general goal that has inspired more coherent effort in this area. There has been much agreement about techniques, but I have seen no successor--in goals--to the free software manifesto and the GPL. Nor do I want a single successor. I want to see many inspirations for creative technical work. Some may overlap; some may conflict--this is of no matter. I want to see manifestos that exult in the clarity of their vision. I want to see new approaches conceived in the understanding of the obstacles to victory. Here, for example, is one such possible goal for Linux: I want Linux to be the only conceivable choice for every commercial and personal use of operating systems. I want universal device support, instant installation, zero administration and a completely correct implementation. We will know we have succeeded when Microsoft's market capitalization suddenly drops to exactly its cash balance. No institution can survive on a single goal, for when that goal is accomplished, the purpose of the institution fades. The life spring of an institution, that whence all material support arises, is the stream of specific purposes that passes through it. Universities achieve this with tenure and academic freedom. The new institution, for its existence and its continuation, requires this same kind of stream of purposes. I want software for nothing; thus I require cooperation with others. Given my goal of just-use-it-ware, I propose the means of a new institution. As a means to a means, we now have to examine the grungy underbelly of institutional sustainability. Or, to wit, who pays? If you grant the desirability of the goal (no-fee software) and the usefulness of the means (the new institution), then we need not become spooked when we discover sustainability is hard. Once we know our goal, we may persevere in seeking it and not be distracted by less attractive or undesirable goals. The first, almost too-obvious place to look for resources is the existing network of public and government money that funds such non-profit endeavors as public broadcasting and particle accelerators. No one can do this alone. Who would give a few million dollars to a hastily organized bunch of technical guys who look suspiciously like the ``Hacker Development Environment League''? If the point of the institution is software that benefits the public directly as a whole (and not indirectly, with compilers), then we need representatives on the board who are believable and legitimate to the various constituencies who might provide funding. That means people outside the computer industry. As a rule of thumb, the university takes one-third of each grant to support the institution. This is simply the necessary overhead to have an institution and not just a group of researchers. Rather than worrying about the shibboleth of ``efficiency'' of the grant allocation, accept that the very existence of the institution is of separate efficacy. The institution creates value--value in solidity, value in stability, value in longevity--that individuals and informal groups can never provide. The total value of software is far more than the actual running code. Software of uncertain provenance and indeterminate future is mostly worthless. If you disbelieve this, go look at market share estimates. Put an institution behind that same code and it suddenly becomes valuable. To be generous, maybe one-quarter of the total value of software comes from the product. We can get the other three-quarters value from an institution and pay for the institution with only half the money we spend directly on talent. Still worried about efficiency? Three times the value for half the money, and institutional maintenance is looking six times more productive than the talent. It's not that the developers are unproductive. The mythos of the hacker community rests in the power of a small number of programmers to change the world. When put this way, the effort is discrete and the change is instantaneous. In other words, the formulation is one of magic, not of economics. Extensive change comes only from sustained effort by numerous people with aligned goals. Unless there are people who nurture the project without interruption, these efforts at change wither and become of no consequence. Those who have set their lives around the mythos of the magical coder urgently need assistance in completing their work. I believe in this mythos. I do not identify it as magical in order to kill it, but rather to feed it. The new institution I advocate herein is a completion of the creative spark at the heart of all good software. The activity here is not merely inventing such mechanisms and analyzing them, but also mounting experiments. The institution needs fiscal solidity in order to have the confidence to attempt new forms of support. A first, concrete funding goal would be to build an endowment fund. Rather than endowing a chair in which a single researcher sits, I want to endow a table around which a release committee shall meet. Here's a specific beginning goal for such a new institution: a $25 million endowment for the Linux Release Table. The residual investment income would be adequate for five members of the table, two paid interns and two administrative staff members, all full-time positions. This table would not do any technical work, but would coordinate planning, architecture, development and release. Now this table could not possibly encompass the breadth of activity generated from a ubiquitous, dominant Linux; clearly, more people and more money and more structures would be necessary. Yet this first endowment could be the seed of a full set of institutional structures surrounding Linux. The focus on endowed tables for release is one of the lessons learned from the open-source world and from Java. Namely, who matters more than how--the party who releases new versions of a product matters more than how the license terms read. The new institution needs to focus strategically on branding and compatibility as keystones to generating value for users. No matter what the licenses for intellectual property are, the association of the institution with the product is the critical element in delivering the value of the institution. Branding is the manifestation of this association and is the initial point of its delivery. Compatibility prevents pollution of the brand and thereby ensures its longevity. Trademark licensing enables control of the brand and subsequent control over compatibility. Sun has masterfully demonstrated with Java how to pull off this trick. How much better if one of the new institutions had pulled it off instead! I have suggested a new institution; I also suggest a new idea for an institution. A mature field of public software creation could not subsist on a single organization of this new type. No initial efforts in creating these new institutions should be taken as an excuse to defer one's own effort away from building a ``competing'' institution. The principle of the new institution is public and cooperative, not singular and nepotistic. I should hope for jockeying for position between institutions, only as a convivial process of mutual betterment. The average Joe wants something for nothing. With knowledge and information, we can come as close as possible to this ideal. Let the scarcity economists haggle over flesh. We won't appreciably change GDP figures. The new institution is an exercise in abundance economics. Free knowledge and information add untold real wealth to the world. Let our revenge upon scarcity be that its limitation upon wealth become miniscule. Eric Hughes (eric(a)sac.net) was one of the founders of cypherpunks, and has been worried about software infrastructure ever since. He is Chief Technology Officer of Signet Assurance Company, LLC, a development company soon to announce its first products and services. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

IRS may use First Data info for help in finding tax evaders
by R. A. Hettinga 08 Aug '04

08 Aug '04

<http://www.denverpost.com/cda/article/print/0,1674,36%257E33%257E2312378,00…> The Denver Post IRS may use First Data info for help in finding tax evaders By Andy Vuong Denver Post Staff Writer Wednesday, August 04, 2004 - A federal judge has granted the Internal Revenue Service the right to seek information from First Data Corp. about certain credit-card transactions the company has processed. The IRS wants the information as part of its crackdown on tax evaders. Specifically, the IRS wants information about holders of American Express, Visa and MasterCard credit cards that were issued by or on behalf of certain offshore financial institutions. The government listed more than 30 offshore jurisdictions, including Aruba, the Bahamas, Bermuda, the Cayman Islands, Hong Kong, Singapore and Switzerland. The IRS said in a court filing that it believes those account holders "may fail, or may have failed, to comply with internal revenue laws." The IRS is targeting people who held such accounts between Dec. 31, 1999, and Dec. 31, 2003. The government is seeking the names of the account holders, their credit-card statements, their credit limit and information on when they opened their accounts. "We haven't seen the order, but we always comply with the law," said First Data spokeswoman Staci Busby. She declined to comment further about the order by U.S. District Judge Phillip Figa, which was made Monday. In 2003, Greenwood Village-based First Data processed 12.2 billion payment transactions, Busby said. Judges have granted so-called "John Doe" summons in five similar situations, the IRS said in court documents. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 2

name of the Tor twin?
by Eugen Leitl 08 Aug '04

08 Aug '04

I recall a TCP/IP traffic remixing network (not a socks proxy like Tor) coming over the list a while back. My bookmarks are away, what's the name of the thing? Not p2net, something similiar. Hello Brain, this is Pinky. Please help. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

2 1

Re: Is Source Code Is Like a Machine Gun?
by Major Variola (ret) 08 Aug '04

08 Aug '04

Re "Is Source Code Is Like a Machine Gun?" A better thought experiment would be a numerically controlled machine and a control tape, which, when the machine is turned on, produces sculpture that is also a machine gun (or merely the sear for a machine gun which can be dropped into a semi-automatic commodity rifle). The NCM is as neutral as the CPU. Also Junger is incorrect when he says "the function of a machine gun is to kill". The function of a machine gun is to propel bullets at a given rate, given a supply of cartridges, when asked to do so by a human. The human who points the machine gun decides whether to kill or merely punch holes in paper. If you don't understand the distinction you should probably avoid handling sharp objects. And you probably don't understand that a P2P program is not for ripping off hollywood but for free communication; its the user who decides what content to use the tool with. >> Eugene Volokh has posted a message on the Cyberprof email list seeking comments on a thought experiment as to whether the same scope of first amendment protection should be accorded to a sculpture which happens also to be a working automatic weapon as to the ``source code'' of a computer program that can be used for illegal activities.<<

1 0

Bluesniper question
by Major Variola (ret) 08 Aug '04

08 Aug '04

Why do the long range RF folks always use Yagis? Aren't Yagis supposed to be fairly broadband? Aren't there other highly-directional (ie high gain in one direction) antennae which (simply by virtue of being narrow bandwidth) would be better? Or is it that Yagi's broadband-ness allows for more slop in manufacturing, as when you're using pringles & hardware-store washers? BTW seems to me that a (wire-mesh, thank you Morlock) parabolic would be better. The optical scope can look right through the mesh. (Use a night vision scope and IR beacon on your target if the target agrees, or is in a parked car with hot brake pads. In Calif NV scopes can't be put on rifles that launch projectiles but you're not launching anything but photons (in the case of sending Bluetooth commands.) PS: From the photo the Yagi rifles look like they are polarization sensitive, having linear (vs + shaped) directors.

1 0

Re: Wired on Navy's new version of Onion Routing
by Major Variola (ret) 08 Aug '04

08 Aug '04

At 04:58 AM 8/6/04 -0700, Sarad AV wrote: >Since they are using symmetric keys, for a network of >'n' nodes, each node need to know the secret key that >they share with the remaining (n-1) nodes.Total number >of symmetric keys that need to be distributed is >[n*(n-1)]/2. Key management is harder when they >network gets larger. That's not the problem ---if your node freely gives out its public key, no problem collecting them. The real problem is: how do you know its truly a given node's key? The web of trust is full of holes :-), trust isn't transitive, and Verislime is 1. not liable 2. 0wn3d by the Fedz.

1 0

Every Vote Counts - If It's Counted
by R. A. Hettinga 08 Aug '04

08 Aug '04

<http://www.campaigndesk.org/archives/000805.asp> CJR Campaign Desk: Archives Critique and analysis of 2004 campaign coverage from Columbia Journalism Review The Longer View August 08, 2004 Every Vote Counts - If It's Counted By Susan Q. Stranahan On November 2, millions of Americans will vote on computers, many of which may be vulnerable to partisan hackers, disgruntled poll workers, or anyone else with a desire to alter the outcome of the election, writes Ronnie Dugger in the current issue of The Nation. "The result," he says, "could be the failure of an American presidential election and its collapse into suspicions, accusations and a civic fury that will make Florida 2000 seem like a family spat in the kitchen." Dugger's detailed analysis of the problems of electronic voting and the potential for fraud and error would seem to be a crucial election story of 2004, full of the stuff journalists love -- hints of skullduggery, cronyism, and conflicts of interest. But, with a few exceptions, the advent of e-voting has remained an issue hovering persistently beneath the media's radar. The stories that have appeared largely have been local, piecemeal and rarely rise much beyond the "he said/she said" level of reporting. As a result, the public -- to the extent that it's even aware of the controversy -- is left to its own devices to figure out a complex issue, with considerable ramifications. New York Times editorial page writer Adam Cohen is one of the very few who has delved into the subject, spending much of the year writing about the "mechanics" of democracy in a series entitled "Making Votes Count." Electronic voting -- and its lack of accountability -- has been a frequent topic. Cohen, a lawyer with an interest in politics and technology, opened his series last January with this warning: The morning after the 2000 election, Americans woke up to a disturbing realization: Our electoral system was too flawed to say with certainty who had won. Three years later, things may actually be worse. If this year's presidential election is at all close, there is every reason to believe that there will be another national trauma over who the rightful winner is, this time compounded by troubling new questions about the reliability of electronic voting machines. This is no way to run a democracy. Given the media's lack of interest in the subject, it can also be said: This is no way to cover one, either. Come November, can you be sure that your vote will be accurately recorded? It seems a rather fundamental question that cries out for an answer. About one-third of the expected computerized vote this fall will be tabulated by touch-screen machines that will provide no paper trail of a voter's choices, and, as a result, are vulnerable to tampering. Writes Dugger: "The United States therefore faces the likelihood that about three out of 10 of the votes in the national election this November will be unverifiable, unauditable and unrecountable." In Florida, where the outcome of the 2000 presidential election remained in limbo for 36 days due to voting irregularities, more than half the state's voters will rely on paperless touch-screen systems. Florida is a crucial swing state, with its winner garnering 27 electoral votes -- 10 percent of the total needed. Ironically, it was the chaos of the Florida returns four years ago that catapulted the nation towards electronic voting. In 2002, Congress passed the Help America Vote Act, and when President Bush signed it, he declared that "when problems arise in the administration of elections, we have a responsibility to fix them." But, as the Times' Cohen noted earlier this year, the president's budget provided only $40 million of the $800 million promised by Congress for election improvements at the state level. Wrote Cohen: "[N]either the president nor Congress is very serious about fixing the system." Some states scrambled to switch to electronic voting, and for the limited federal funds to buy new equipment. About 20 percent of the nation's 3,114 counties will have switched completely to computerized voting by November, according to Election Data Services, Inc., a Washington, D.C. research company. (Some of those machines offer a printed copy of the ballot as a backup; some do not.) But the states also discovered that there are no federal guidelines or security standards for the equipment. That will come at a later date, long after this presidential vote. (The Election Assistance Commission, appointed by President Bush to set those standards and oversee the transition, has been slow to get organized, in part because of a lack of funding.) The electronic voting market is dominated by a handful of companies, which stand to make huge profits from the shift to touch-screen computers and the software that runs them. Nearly 100 million votes will be cast on the computers operated by this tiny group, which has aggressively promoted its product and just as vigorously defended the secrecy and reliability of its technology. Diebold, Inc., of North Canton, Ohio, holds about 45 percent of the equipment market. Its track record thus far has been less than impressive, and not necessarily reassuring. As Dallas Morning News reporter Vikas Bajaj noted (registration required), Diebold has "become a lightning rod for the industry": In April, California Secretary of State Kevin Shelley, citing security concerns, banned Diebold machines in four counties. He has also required that any electronic voting machines the state buys must have verified paper trails. Ohio's legislature in May required that all electronic voting machines have paper trails by 2006. In July, the state's secretary of state, J. Kenneth Blackwell, stopped the use of Diebold machines in three counties, saying they hadn't met security requirements. Diebold's problems don't stop there. Critics cite a fund-raising letter written last year by the company's chairman and chief executive, Walden O'Dell, who said he was "committed to helping Ohio deliver its electoral votes to the president." He has since apologized. More worrisome to many experts, however, is the apparent vulnerability of the so-called source code used in the Diebold machines. "Given the gravity of the security failings the computer security community has documented, it is irresponsible to move forward without addressing them," Dr. Avi Rubin, a computer science professor and technical director of the Information Security Institute at Johns Hopkins University told a House committee last month. As Knight Ridder's Sumana Chatterjee wrote: "The main problem, according to Rubin, is that there's no way for election officials to be sure that electronic machines are free of codes designed to manipulate results. Companies are reluctant to share their 'source code,' the proprietary software that controls voting and tabulating results, so their software can be checked independently." Backers of computerized voting -- among them many state and local election officials -- dispute the critics' worries about vulnerability. Chatterjee quoted Linda Lamone, Maryland state administrator of elections, who also testified before the committee: "Although any electronic voting system is hypothetically 'hackable,' I am confident that the likelihood of this occurring is extremely remote." Hackers would need a working knowledge of the software's specific programming language and gain physical access to computer servers and voting machines, she testified. Unlikely, maybe, but the first of those two conditions has already been met. Bev Harris, a Seattle literary agent and voting rights advocate, has become something of a legend among critics of e-voting. Miami Herald columnist Jim Defede wrote about Harris last month: Concerned about the lack of security, Harris Googled Diebold, hoping to find a computer engineer or programmer who could put her fears to rest. Instead, she stumbled across a link to 40,000 files of the company's ultra-secret source codes, which she downloaded and posted on her own web site, asking experts for help in analyzing the information. Diebold obtained a court order shutting down her site. Ultimately the codes were posted on the congressional website of Democratic Rep. Dennis Kucinich. Diebold claims the code was outdated and no longer in use. In Georgia during the run-up to the 2002 Senate race, as The Times' Adam Cohen reported, Diebold machines were plagued by hardware and software problems, and the company on several occasions sent "patches" -- programming updates -- for installation. (The software was installed without the required review and approval by the Georgia Secretary of State.) When the votes were counted, Sen. Max Cleland, a Vietnam war hero and triple amputee, who held a strong lead in the polls before Election Day, suffered a decisive loss to challenger Saxby Chambliss (who also ran ads picturing Cleland with Osama bin Laden). Critics, like Bev Harris, questioned whether the patches could have converted Cleland votes into Chambliss votes. Because there was no paper trail, there was no evidence to prove or disprove the allegation. In his series, Cohen notes that the secrecy over source code may be a red herring. Source code can be produced, if authorities insist. Nevada gaming officials have instant access to source codes and all equipment at casinos in the state without compromising proprietary information. Ironically, he says, "gamblers are more protected than voters." Critics of e-voting come from two camps -- a growing number of local activist groups around the country which last month sponsored a national "The Computer Ate My Vote Day,' and computer security experts. The Nation's Dugger quotes one of the most outspoken, Dr. David Dill of Stanford University: Last fall during a public talk on "The Voting Machine War" for advanced computer-science students at Stanford, Dill asked, "Why am I always being asked to prove these systems aren't secure? The burden of proof ought to be on the vendor. You ask about the hardware. 'Secret.' The software? 'Secret.' What's the cryptography? 'Can't tell you because that'll compromise the secrecy of the machines.' ... Federal testing procedures? 'Secret'! Results of the tests? 'Secret'! Basically we are required to have blind faith." Dugger also quotes recent testimony from Johns Hopkins' Avi Rubin to the federal Election Assistance Commission: "I do not know of a single computer security expert who would testify that these machines are secure." Advocates of e-voting have portrayed criticism as coming from a handful of unhappy academics, or as being motivated by partisan politics -- claims the media have largely bought into. Among the chief proponents of the new system is Gov. Jeb Bush, who presided over the 2000 debacle from which his brother emerged with an official winning margin of 537 votes. As the Miami Herald reported last month, Gov. Bush has suggested that, as the paper put it, "people who repeatedly raise questions about the touch-screen machines were doing it to motivate their voters in the upcoming presidential election, in which Florida will be a battleground state." But that's not necessarily true elsewhere. The Republican secretaries of state in Nevada and Missouri -- both expected to be hotly contested this fall -- have expressed concerns about the reliability of the equipment. As a result, they have required that touch-screen voting machines also be equipped with a "voter-verified paper trail" in November. (This is an inexpensive add-on to the machine, which allows a voter to confirm manually his or her vote before it is cast; that confirmation is retained independently of the computer tally in the event a recount is required.) It is this type of backup that Adam Cohen and others believe will eliminate many of the potential problems with e-voting. Nevada's 2,000 electronic voting machines will all come equipped with printers this fall. Secretary of State Dean Heller told the Associated Press that paper receipts are "an intrinsic component of voter confidence." Nevada is the first state to institute such a policy statewide. Nationally, legislation requiring printed backups is pending in both the House and Senate -- but no action is expected before November. So, the question remains: Will this year's contested presidential election proceed smoothly, or will the scenario be closer to what a letter-writer to The New York Times predicted: "[T]he havoc wreaked by the butterfly ballot [in 2000] will soon be compounded by a plague of worms, the kind encoded in electronic voting machines that leave no 'voter verified paper trail.'" No one knows. But it sure sounds like a story worth pursuing by more than a few lonely souls like The Nation's Ronnie Dugger and the Times' Adam Cohen. Posted 08/08/04 at 12:01 AM -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Is Source Code Is Like a Machine Gun?
by R. A. Hettinga 08 Aug '04

08 Aug '04

<http://samsara.law.cwru.edu/blog/archive3/Is_Source_Code_Is_Like_Mach.html> Next: August 2, 2004 Up: August 6, 2004 Previous: August 6, 2004 Contents Is Source Code Is Like a Machine Gun? Eugene Volokh has posted a message on the Cyberprof email list seeking comments on a thought experiment as to whether the same scope of first amendment protection should be accorded to a sculpture which happens also to be a working automatic weapon as to the ``source code'' of a computer program that can be used for illegal activities.1 That inspired the following response on my part: Date: Thu, 05 Aug 2004 14:19:49 EDT To: CyberProf List . . . From: "Peter D. Junger" <junger(a)samsara.law.cwru.edu> Subject: Re: Source code distribution restrictions as speech restrictions I will try to respond without quoting at length from Eugene's message since I think that the basic difference that we have has to do with our differing understandings of the nature of computer programs, including source code and that it is probably easier to address that difference directly. In the first place I cannot see how source code differs significantly from any other computer program or, for that matter, from any other data stored or transmitted as text, including as a string or stream of binary digits. Something very important seems to be missing from Eugene's thought experiment: any reference to a computer. Yet it is a computer, and not a computer program, that corresponds to Eugene's machine gun. The computer and the machine gun are both tangible objects that persist for a period of time in three dimensional space. Source code or any other data that is processable by a computer is, on the other hand, pure information--nothing more or less than a pattern or a number--and though a representation of that information can be stored in, or on, some tangible medium like a compact disk or a piece of paper, that compact disk or piece of paper is not the source code or other data. (This is, I believe, equivalent to the fact that in the law of copyright a copy of a work fixed in a tangible medium of expression is not the intangible work itself.) Come to think of it, one can merge the machine gun and the source code by etching the source code on the side of the machine gun, just as runes used to be etched on sword blades or the words ``drink me'' were affixed to the bottle that Alice came across at the bottom of the rabbit hole. Frankly I don't see how that could somehow make it unconstitutional for the state to outlaw the possession of the sword or the machine gun or the pure food and drug people to outlaw the sale and distribution of the liquid contents of Alice's bottle. But I would rather focus on the computer, rather than on the example of the compact disk, because a compact disk just sits there and doesn't do anything by itself whereas the computer --like the machine gun--actually does something and so is functional in the way that a machine gun is functional and source code, whether or not fixed in a tangible medium, isn't. There is, of course, an important distinction between the functionality of a machine gun and that of a computer. The function of a machine gun is to kill. The function of a computer, on the other hand, is to compute, and to compute is to process information. Computers, by the way, used to be people, who came equipped with ten digits. Modern computers, on the other hand, are machines that are wired (or otherwise structured) to process information represented as binary digits. Now, since the computer has to a large extent replaced printing presses and linotype machines, I find it difficult to believe that the freedom of the press protected by the first amendment would permit the outlawing of computers even though the need for a well regulated militia protected by the second amendment does not forbid the outlawing of machine guns. But Eugene's thought experiment does not deal with computers so I do not need to pursue the question of whether computers can be outlawed constitutionally. All that a computer does is process information. Data encoded in the form of binary digits--which can be called ``source code''--is fed into a computer which then processes that data in accordance with way in which it is wired and outputs other data encoded in the form of binary digits--which can, if one wishes, be called ``object code.'' Now rewiring a computer is called programming a computer, and that object code can--if it satisfies various syntactical requirements--be fed into the computer in a way that causes the computer to be reprogrammed, that is, to be rewired. But the program does not do anything and it certainly does not rewire the computer. To run the program someone must, directly or indirectly, flick a switch that causes the computer to rewire itself in accordance with the specifications (the ``instructions'' or the ``description'') contained in the program. And it is the computer that, like the machine gun, has the moving parts and thus does the functioning. Another way to put it is that all that a computer does is to manipulate text. The input is text, the program is text, and the output is text. And all that source code, or any other code, is is text. Now, of course, the protections of the first amendment are not absolute, so the writing and publication of source code, like any other text, can be forbidden if there is a strong enough justification. But, since code in no way resembles a machine gun, its resemblance to a machine gun cannot be that justification. And by the way, the fact that some text may be too ``functional'' to be copyrighted in no way suggests that it is not protected by the first amendment. If a text is useless there is, in fact, little reason to give it first amendment protection. This was written in considerable haste and undoubtedly contains large gaps in its reasoning. I have, however, some other work to do, and so I will end it here. After I posted that response to the Cyberprof list, I received the following inquiry off list: Just out of curiosity, would you liken software to the thought processes that are used to control the computer (and the machine gun)? If so, would restrictions on source code be more akin to thought control, rather then restrictions on devices? Here is my response to that question: [T]he quick answer is that I think of computers properly programmed as prosthetics that help us think (and perceive) like glasses and hearing aids and paper and pencils (and the invention of the alphabet and of mathematical notations) and so I do think that restrictions of software and also on computers amount to thought control. Consider the fact that there is hardly anyone left in the world who can calculate square roots now that it is so easy to do the calculation using a calculator. I consider doing arithmetical and logical calculations to be a (very small) part of what is involved in thought, but they definitely are thought processes. (I wouldn't say though that the thought processes are programs if one considers a program to be text. Programs are not processes, they are descriptions of or instructions for implementing a process.)2 For discussions of related issues see the entries on Expression Has Nothing to Do with It, Publishing Bombmaking Information and the First Amendment, and Copyright and the Confusion of ``Software''. Next: August 2, 2004 Up: August 6, 2004 Previous: August 6, 2004 Contents Peter D. Junger 2004-08-07 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0