- cypherpunks-legacy - lists.cpunks.org

Economic Surveillance, the NSA, and the 40+24 Lotus Position
by tcmay＠got.net 17 Dec '03

17 Dec '03

[Note: Once again, could I suggest that people take the effort to trim the distribution list? I've trimmed out the several names getting separate copies.] At 11:06 AM 1/19/96, david d `zoo' zuhn wrote: >// Now how about the percentage of *foreign* people who trust the US govt.? >// Given that it has said that it'll spy commercially... (if memory >// serves). > >Memory serves me oppositely -- denial that it has done so in the past and >saying that they would not do so in the future. This came a couple of >months ago during trade negotiations with the Japanese government. I don't think anything is resolved on this "economic espionage" issue. I've been interested in this topic since around 1988 (for an unfinished novel I was working on then--don't ask). Here are a few misc. points: * There is direct information that business information was intercepted by the NSA and other SIGINT agencies and used by the U.S. for economic advantage. This goes back to the 1940s, with intercepts of ITT and other cable traffic, and continues up to the present. Bamford gives a bunch of examples. * However, there is no direct knowledge that I am aware of that non-DOD-linked companies (i.e., ordinary American companies) received significant amounts of economic intelligence on their competitors. Thus, I doubt that General Motors was fed production data on Nissan that NSA plucked out of the ether in its Japanese listening posts (such as the huge NSA SIGINT facility at Misawa). Some companies may have received selected intercepts, sub rosa, but I doubt that this was a matter of regular policy. * Reports came out in the last couple of years that the NSA aided the U.S. trade negotiators in talks with Japan by providing intercepts covering the Japanese trade position. (I'm not sure if this was denied by the Administration, or acknowledged, or what. But it's pretty likely to be true. This is of course a different type of economic intelligence than helping individual American companies, though the effects are similar.) * Over the past 5-7 years there have been noises coming out of the intelligence community about redefining their mission to include economic espionage of various sorts (from the type they have always done, as above, to more direct aid to American industry). I first heard comments on this circa 1990, and they may have even come from a current or former DIRNSA...I can't recall. (I took meticulous notes on what I was reading in the press, but these notes are squirrelled away in "Tornado Notes" (Info Select) on an old Toshiba laptop!) * Shifting to more active economic intelligence gathering has *NOT* been announced as a new mission for the NSA, despite rumors here on the Cypherpunks list. If anyone can show us a real statement, or a plausible report that deduces this to be a new mission, I would be grateful. Rather, what I think we've been hearing are a bunch of reports and rumors that such a shift is being considered. (One list member contacted me by phone when I expressed similar doubts, some months back, and offered to put me in touch with a friend of his who claims to have evidence that such a shift has occurred. Not being an investigative reporter, and not being in the Beltway, I declined.) * Having said all this, that a certain type of economic surveillance and espionage is unlikely (e.g., Intel isn't being informed of Japanese chip yields), certainly other types of surveillance of foreign companies is likely. The NSA and its affiliated agencies are of course likely to surveil Western companies for evidence of arms shipments to other countries (a la Toshiba's propeller-quieting technology shipped the U.S.S.R., France's shipments of Exocets to various countries, nerve gas precursors, etc.). In this sense, economic surveillance _is_ one of the main missions of the NSA. I think it unlikely that the "NSA-enabled" Lotus solution will fly in these countries. Will Matra really be happy to use the "40+24" solution for sensitive inter-site communications, knowing full well about the many large NSA SIGINT dishes scattered throughout Europe? Knowing that the NSA has the 24-bit extra key material and that 40-bit keys are easily breakable? Somehow I think that these foreign governments, notably Germany and France, will explicitly block these products from being imported into their countries. A matter of national pride and all. (After all, imagine a product made in Japan that is known to be "Chobetsu-enabled." The U.S. government would not be too happy to see U.S. companies embracing such a product.) By making crypto restrictions "slide down easily," Lotus and IBM have not done us any favors. Fortunately, I think their scheme is doomed. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

QLG_ate
by John Young 17 Dec '03

17 Dec '03

Two articles comment on the creation of a quantum logic gate by NIST researchers, as reported in Physical Review Letters recently: "Quantum leap for code-cracking computers," Mark Ward, New Scientist, 23 Dec 95. "Approaching the Quantum Gate," David Voss, Science, 12 Jan 96. QLG_ate

1 0

Re: Elitism on Cypherpunks
by Corey Bridges 17 Dec '03

17 Dec '03

At 08:55 PM 1/18/96 -0800, Alan Olsen wrote: >It has been said that "Cypherpunks write code". They must do more than >that. Cypherpunks need to teach. Just remember you brought this up... Not all of us even write code. Some of us write (horrors!) books! Yes, my brethren, I earn my pay as a lowly scribe. Do I code? Nope. Am I a Cypherpunk? Christ, I don't care. I'm on this mailing list; that works fine for me. My brain expands almost daily from contact with such seditious sods. Do I contribute to the health and growth of this list? Maybe. Do I preach the Cypherpunk doctrine through my work at my company? Definitely. Just thought I'd point out that we aren't all code-monkeys. (And I mean that in the best sense of the word.) Corey Bridges Security Documentation Netscape Communications Corporation home.netscape.com/people/corey 415-528-2978

2 1

Re: Democracy...
by Brian B. Riley 17 Dec '03

17 Dec '03

On 9/15/98 10:27 PM, Jaeger (Jaeger(a)hempseed.com) passed this wisdom: > >hey, would you care to show us where "seperation of church and state" is >to be found in the constitution/bill of rights? absolute right and >wrong is not a religious belief (necessarily).. your religious beliefs >do not affect the nature of reality. there are absolute truths by [snip] >> Ever heard of seperation of church and state? Democracy? the rights of >> >> the individual? While you certainly have the right to practice your >> religion in what ever manner you so choose demanding that everyone >> else >> does, or that the president of the us of ais subject to you PERSONAL >> faith decisions is outragous The first amendment states only that there shall not be 'an establishment of religion' it says nada about 'separation of church and state.' The intention was simple; that there would never be an 'official' state religion. It didn't say religion had no place. They were escaping a regime with an established state religion that used the goverment to stamp out religious deviationism. That was the sole reason for that clause in the 1st amendment. Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "...if you drink much from a bottle marked "poison." and it is almost certain to disagree with you, sooner or later" _Alice in Wonderland_: (Lewis Carroll)

1 0

Re: Hack Lotus?
by Peter Trei 17 Dec '03

17 Dec '03

Phill writes: > > I've been thinking about how I would do the lotus hack. I certainly would not be > wanting to do a public key operation for the benefit of the government on every > message. How about the following: > > During installation of program: > Select a random key ER, encrypt it under the govt. public key to give Eg(ER). > To start encrypting, > > chose a random value R, encrypt under destination public key to give Ek(R) > set 40 bits of R to 0 to produce R' > Encrypt R' under ER to give E-ER(R') > Hash R, E-ER(R') and Eg(ER) with a one way function (MDMF like) to produce the > actual key. > Send across Ek(R), E-ER(R'), Eg(ER) > To decrypt the message one needs the information for the escrow authority. > > Phill Wouldn't this interoperate only with other systems which had a similar setup? I suspect the Lotus wants the US-Domestic and the International versions to interoperate transparently, including with their older versions. Kaufman describes the encryption setup of Notes in moderate detail on pages 448-454 of 'Network Security'. It's a typical mixed system, with a secret key encrypted under the recipient's Public key (a short one or a long one, depending on the local of the recipient and/or sender). I suspect that Lotus has not completely reworked it's security system for the international version, and that they are in fact doing a second public key operation on the 3 bytes of GAK'd data. If they're nasty, they'll check on the receiving side as well, to ensure that the LEAF and/or the espionage-enabling key have not been patched in the sending 'International' version. Peter Trei trei(a)process.com Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

3 2

Husband/Wife jailed for saying Clinton SucksHusband/Wife jailed for say
by John C. Randolph 17 Dec '03

17 Dec '03

> Frankly, I'd rather have a president who didn't feel the need to be > protected by thugs. Well, wouldn't that require a president who had a clear conscience? I don't think we've had one of those since Eisenhower! -jcr

5 4

RE: Cypherpunk Enquirer
by blanc 17 Dec '03

17 Dec '03

Hee-hee-hee-haa-haa-haaaaaaa. The UpYours CPunk News Update. .. Blanc

1 0

"whom T. C. May has killfiled"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:09 PM 1/19/96, Rich Graves wrote: >Yusuf's statement that my January 16th email is the first that he had >heard of the .PWL problem is both patently ridiculous and directly >contradicted by private email from anonymous sources on this list whom >T. C. May has killfiled. ^^^^^^^^^^^^^^^^^^^^^^^ ??? Mind explaining this reference? In public, preferably, as the charge was made here. If it's a joke, I don't get it. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: authenticating intrahost crypto providers
by James A. Donald 17 Dec '03

17 Dec '03

At 11:37 AM 1/18/96 EST, James Leppek wrote: > > I have been doing some research on the development of an abstract > security services API(not just a CAPI) and have hit a road block. > The problem revolves around the need to authenticate a > security service provider to an application. No such need. If the attacker can introduce his own module to supply crypto services then he must have administrator (NT equivalent of root) privileges, in which case your are stuffed regardless. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

ITAR and hash functions (Perry's question)
by Phil Karn 17 Dec '03

17 Dec '03

Perry quoted part of the joint declaration of facts in my case and asked >Would this not mean that the government is estopped from ever again >claiming that hash functions are export controlled under the ITAR? Not according to them. They have made it clear throughout their filings that they consider each CJ request on a case-by-case basis. Furthermore, they repeatedly assert that under the power delegated to them by the President, they have the absolute power to add and delete items from the Munitions List and to make inexplicable, inconsistent and arbitrary rulings whenever they damn well feel like it, and no court can overrule them. They even feel free to ignore their own rules whenever they get too inconvenient. See my attorneys' brilliant analysis of why the ITAR as written clearly permits the export of public domain crypto code under the public domain exemption. It's about halfway through http://www.qualcomm.com/people/pkarn/export/karnresp.html But State wrote the rules, so they can ignore 'em whenever they feel like it. Why gosh, National Security is at stake! And that's something we mere mortals can't possibly know anything about. Grep for the word "estoppel" in their arguments -- I know they used it at least once to discuss this exact point. So the bottom line is this: at the moment the ODTC will let you export hash functions as long as they don't encrypt data. They'll probably grant CJ requests to that effect. But they could change their minds at any time if they feel like it. Isn't it wonderful to live under a government of laws, not of men? Phil

3 2