- cypherpunks-legacy - lists.cpunks.org

PGP 3.0
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- Hello all, I've seen a couple of messages here about possibilities of what might be in pgp 3.0. I am in agreement that keys should be expirable. I produce new keys once a year anyway. This is probably excessive given my probable threat models, but I think it lends itself well to having a sort of time-stamp on documents. Given that it is true that I could keep a copy of my unrevoked key after I've formally revoked it, I still think that it is beneficial to have signed documnents produced over time bear keys that are time-bound at least as far as the way I use pgp. The main point of this post was really to ask if there is a page or rfc somewhere that describes what is expected to be in pgp 3.0. Is there a particular reason that this to-be-released-with-source program is shrouded in what appears to be secrecy? As usual, I'm confused. It would help me greatly if I were able to give people an idea of the added capabilities pgp will posess whenever it is finally released. This isn't a flame as I'd like to see it done right the first time rather than have it released then see 4 or 5 different bug fixes quickly come out that confuse the issue during its introduction. I found the FUD surrounding 2.6.x to be hard to overcome with some people. <non-ob-crypto:> Heck, I found a copy of pkz204e the other day on a pc in my office. The FUD surrounding this product was pretty great if y'all recall. <back on crypto:> I give talks occasionally about my company's internet offerings for business. It would be nice to be able to speak of the future of crypto with pgp with a bit more certainty. Thanks for your time and consideration, amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 January 7, 1996 15:12 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPApK4dTfgZXlXydAQHRagf/dqF+gF41JYIBroUlmddgX6Lur3ISBxrl MhtMAdcFzyBcRxrYIgPf+gkkzOqNSBeXHvwvZ/CWLuJpvbRXnCD0IL3hhoYGVIl5 UxvP2gh1M+wU7pEm6DYlQpq2z3OVxoG62LW6+v1YgVP6hHOEQNUYGn64TSFMDbdr cU63c3pXLusBb6yLM5dKaPZDqo8y2YHo6hYDT21SW+Tx0MxOK7/diL9qfbBXyitk 8tmNmgti6V0MCatRAh0L4xc7kkDq33RXhyEgjTimTTwt0QIgV/QLAPN1Mdj/ZEoj U599xGySNUfPXLwJz5mda0UDS3Pp1CNHpjdUzpFUbhDndSo1sh+ocA== =cxUU -----END PGP SIGNATURE-----

1 0

RE: "trust management" vs. "certified identity"
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:00 PM 1/7/96 -0800, you wrote: >We already operate largely in a "web of trust" model world. > >Here's a pertinent example. I've met perhaps 100 people from this list, >over the last several years. Not a single one--not even one--have I ever >seen any "proofs of identity" for. Did I say "Not a single one"? How many people ask for "proof of Identity" from their friends? Not very many, I can bet... (Maybe the excesivly paranoid.) >I deal with them as "persistent personnas," with either their physical >appearances (biometric security) or their writing styles/e-mail addresses >providing the continuity of their persistent personna. Things like this can complicate depending on your social circles. For those involved in the SCA (Society for Creative Anacrnyms) or Science Fiction conventions people may or may not go under a host of names. You may or may not know their "true" name. There are people who i have known for many years who are good friends and yet I do not know their "real" name. (And I am not really concerned about not knowing that name.) Some people I know by multiple names. (Makes conversations interesting when the nyms change every few sentences...) What matters is the continuity of the individual, not what nym they happen to be using at any given point. (The net makes this alot more complex though, as you usually do not have visual contact with the people you are responding to... Individuals are harder to forge than e-mail.) The criteria I use as to whether I can "trust" a source is based on a number of factors. Have they given reliable information in the past? Does the information corilate with other information from reliable sources? Does their attitude get in the way of the information provided? (Sometimes it takes heavy filters to discern fact from opinion or just a pissy attitude...) What gains my respect is similar, but also based on their general attitude and how they treat people. (Of course there is not cert mechanism for a "web of respect".) [examples cliped] >Frankly, the notion that a central government would issue proofs of >trustability, via identity cards and the like, is a modern invention. I find the idea that a little card "proves" my identity a bizarre form of mystisism. (Especially when that "proof" can suddenly expire or be revoked by the whims of the State.) >(The message of Vinge's "True Names" was partly ironic, that one's True >Name is important primarily in allowing tagging by the government. As has been said before, one of the main reasons for the Government's (and others) desire for "true names" is so those that offend them can be punished. >Ordinary >people rarely need True Names. As I said, I've never checked the supposed >True Names of those I deal with. Nor have most of you, I strongly suspect. >In fact, given the way credentials can be so easily forged, I wouldn't >trust a driver's license or even a passport. And given the government's >ability and demonstrated willingness to generate false >documentation--60,000 new identities in the Witness Security Program, plus >all the spies, narcs, etc.--I even more surely don't care what official >identification supposedly proves.) Government paperwork proves that "they" know who you are and have some sort of hooks into your persona. (taxation, legal, and/or otherwise.) This is, of course, if it is "real" identification and not forged by a competing interest. >I don't want official proof of my identity. If others want it, let them >make their own arrangements. > >"Papieren, bitte! Macht schnell!" "I don't have any papers. All I got is a pipe!" | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Toad Hop
by John Young 17 Dec '03

17 Dec '03

[Before it is publicized, KM describes for Littman the Christmas 1994 attack on Shimomura's systems as a "TCP/IP prediction packet attack." (. . .) below are by Littman.] Three days later, on January 23, Shimomura will describe the attack in a widely distributed public Internet post. IP source address spoofing and TCP/IP sequence number prediction are the technical terms Shimomura uses to describe it, much like Mitnick's description. But his analysis is extremely technical, and even some UNIX security experts find it tough going. That same day, about 2 P.M., CERT will blast out an advisory to its international mailing list of 12,000 Internet sites in the United States, Germany, Australia, the United Kingdom, Japan, and other countries. The vaguely worded report is much less specific than Mitnick's one-minute explanation on the telephone. Most likely, CERT is trying to provide enough detail so Internet sites can protect themselves against future attacks without providing so much detail that it could encourage copycat attacks. On one level, the hack is simple, a clever strike at a basic weakness of the Internet. Computers on the Internet are often programmed to trust other computers. The Internet was created to share information, and the attack on Shimomura, just like the Robert Morris Internet Worm attack seven years before, exploits that trust. The Internet has its own way of sending e-mail or files. Messages or files are split into smaller digital chunks or packets, each with its own envelope and address. When each message is sent, it's like a flock of birds that migrates to a planned location and reunites as a flock at the destination. Computers on the Internet often act like great flocks of birds that trust one another too. And all it takes is one enemy bird to infiltrate the flock. . . . On Christmas Day 1994 the attack begins. First, the intruder breaks into a California Internet site that bears the cryptic name toad.com. Working from this machine, the intruder issues seven commands to see who's logged on to Shimomura's workstation, and if he's sharing files with other machines. Finger is one of the common UNIX commands the intruder uses to probe Shimomura's machine. As a security professional Shimomura should have disabled the feature. Finger is so commonly used by hackers to begin attacks that 75 percent of Internet sites, or about 15 million of the more than 20 million Internet users, block its function to increase security. The intruder's making judgment calls on the fly about which commands will help him uncover which machines Shimomura's workstation might trust. He works fast. In six minutes he deduces the pattern of trust between Shimomura's UNIX workstation and an unknown Internet server. Then the automatic spoofing attack begins. It will all be over in sixteen seconds. The prediction packet attack program fires off a flurry of packets to busy out the trusted Internet server so it can't respond. Next, the program sends twenty more packets to Shimomura's UNIX workstation. The program is looking for a pattern in the initial sequence numbers -- the numbers used to acknowledge receipt of data during communications. The program deciphers the returned packets by subtracting each sequence number from the previous one. It notes that each new initial sequence number has grown by exactly 128,000. The program has unlocked the sequence number key. Shimomura's machine has to be idle for the attack to succeed. New Internet connections would change the initial sequence number and make it more difficult to predict the key. That's why the hacker attacks on Christmas Day. The attack program sends packets that appear to be coming from the trusted machine. The packet's return or source address is the trusted machine's Internet address. Shimomura's workstation sends a packet back to the trusted machine with its initial sequence number. But flooded by the earlier flurry of packets, the trusted server is still trying to handle the earlier traffic. It's tangled up. Taking advantage of the gagged server, the attacking program sends a fake acknowledgment. It looks real because it's got the source address of the trusted server, and the correct initial sequence number. Shimomura's workstation is duped. It believes it's communicating with a trusted server. Now the attacking program tells Shimomura's obedient workstation to trust everyone. It issues the simple UNIX "Echo" command to instruct Shimomura's workstation to trust the entire Internet. At that point, Shimomura's personal and government files are open game to the world. It's more than a humiliating blow to the security expert. By making Shimomura's machine accessible from any Internet site, the intruder has masked his own location. He can return from anywhere. The hacker can't believe his good luck. The attack is only successful because Shimomura has not disabled the "R" commands, three basic commands that allow users to remotely log-in or execute programs without a password. Tens of thousands of security-conscious Internet sites, representing well over a million users, routinely block access to the R commands to avoid its well publicized abuse by hackers. It takes a few keystrokes and about thirty seconds to shut off the R commands on an Internet server. You don't even have to turn off the machine. Why didn't Shimomura do it? . . . Mitnick laughs. "He's [Shimomura's] not happy. I have nothing to do with it. I'm just telling you what I hear through the grapevine." [Littman] "Who do you think might have done it?" I ask the likely suspect. "How did he figure it out himself?" "He [Shimomura] realized that somebody had edited his wrapper log, which shows incoming connections. Somebody actually modified those logs, and then he was able to reconstruct what happened through these logs that were mailed to another site unbeknownst to the intruder." Mitnick's actually telling me the evidence Shimomura collected to figure out the attack. The wrapper is supposed to control connections to Shimomura's server and log all connection attempts. It failed to protect Shimomura but still it logged the hacker's spoofed connection, and a copy of the log was e-mailed off-site. "So you were asking me if there's a secure e-mail site?" Mitnick continues, his voice suddenly hard. "My answer is no. This guy in my estimation is the brightest in security on the whole Internet. He blows people like Neil Clift away. I have a lot of respect for this guy. 'Cuz I know a lot about him. He doesn't know anything about me, hopefully, but he's good. "On the Internet, he's one of the best in the world." [pp. 222-25] ----- [KM] "I don't know what his motive is. I don't know the man at all. Alls I know is he's very technical and he's very good at what he does. He's in the top five." [JL] "What makes Shimomura so good?" [M] "When someone penetrates his system he knows what to look for. When you compile a program, it uses external files and libraries. This is the type of guy that would look at the access times of the files to try to figure out what type of program somebody was compiling. The guy's sharp." On UNIX systems it's possible to tell the last time a file was read. Mitnick's guessing that Shimomura could determine the type of application that was compiled (converted into the computer's most basic machine language) by examining the date stamps in certain system directories. He's also acknowledging he knows that the intruder compiled a program while he was on Shimomura's machine. Once again, Kevin Mitnick seems to have an amazing amount of detail on how Shimomura analyzes an attack. [M] "He's just very good at -- well, he's a spook. What do you expect? This is only what I hear in the grapevine." ... [L] "But does the grapevine say he's primarily a spook?" [M] "Unknown. He's good in security and he consults with companies like Trusted Information Systems, the people that develop Internet fire walls, and a lot of people in D.C. and the Virginia area." Trusted Information -- the name strikes a bell. Markoff quoted someone from Trusted Information in his front-page "Data Threat" article. [L] "Where is Trusted Information?" [M] "Oh, in Maryland, 301 area code. Baltimore, I believe." [L] "What are some of the Virginia companies Shimomura works with?" [M] "I just have the phone numbers," Mitnick reveals casually. "I haven't called them yet to see." [pp. 252-53] ----- Why not ask John Markoff about the real reason he called me twice this morning? So I ask him about the Shimomura Newsweek story, and the odd reference to cellular phones. He comes back with a stunning revelation. "Somebody hit a different Tsutomu machine last summer and the NSA was pissed," Markoff tells me. "They freaked out. There's no question about it." Why didn't he mention this in his New York Times stories? Why create the false appearance Shimomura was first hacked Christmas Day? "But it was a different machine?" I ask. "Am I being interviewed here?" It strikes me as an odd question. Markoff was the one who called me twice in the space of an hour. Who's interviewing whom? "Let's get on the same wavelength," Markoff suggests. "I'm glad to share this stuff with you, but I want to know where it's going to show up. 'Cuz I'm pretty close to Shimo and it's an issue for me." Before I can respond, he starts talking about Shimomura again. "I wrote that profile of Tsutomu because after I mentioned him in the bottom of my story ["Data Threat"] I basically outed him and a million reporters were all over him." "He wasn't happy about that?" "No, Tsutomu loves it," Markoff says. "He's playing his own games. "I'II tell you it's unclear what was taken [referring to the Christmas hack], and point two, I can send you a public posting by an Air Force information warfare guy who described what was taken and their assessment of the damage. "And there are lots of little snips of code that a brilliant hacker could probably use. But Tsutomu's mind works in very cryptic ways. It's not clear that without Tsutomu you're going to be able to do anything with it. "Now in this break-in I don't actually think a lot of stuff was taken." This break-in? Just how many times was Shimomura hacked before Christmas? But I ask a different question. "Why would an Air Force guy post something?" "Oh, Tsutomu," Markoff casually replies. "He produced a lot of software for the Air Force." "Where would he post this?" "Oh, to a mailing list. A lot of people were concerned about what was taken from his [Shimomura's] machine. What they [the hacker] got was a lot of his electronic mail. Some of it's kind of embarrassing. [But] I don't think people are going to find new ways to attack the network based on this particular attack. "There is another issue," Markoff cautions in a serious tone. "Tsutomu is a very sharp guy, and it is not impossible that that was a bait machine, which is why I stayed away from the issue." Is Markoff implying Shimomura, a rumored NSA spy, laid a trap? And what about Markoff's New York Times articles? Were they part of the trap, too? "Think about it for a second," Markoff pauses dramatically. "And you get into this wilderness-of-mirrors kind of world. And a lot of people that are writing don't know everything, and I don't know everything. "I've been protecting him [Shimomura] for five years. I get the profile and the [Wall Street] Journal is on him. They don't know how close he is to the military. It would make perfect sense. Who knows what's on the code? The guy is in the counterintelligence business." [pp. 258-60]

2 1

Open Gates?
by kdf＠gigo.com 17 Dec '03

17 Dec '03

[Please respond via netmail, as I have only limited access to the list.] Does anyone have a _current_ list of open mail-to-news gates? As far as I can tell, the only one is: group.name(a)pubnews.demon.co.uk Thanks for any help. -- : Fidonet: John Erland 1:203/8055.12 .. speaking for only myself. : Internet: kdf(a)gigo.com

1 0

Re: "Re: NSA says strong crypto to china??
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:32 PM 1/7/96, Alan Olsen wrote: >I can also think of another good reason that no dissident in their right >mind would want to use US escrowed GAK. How many times have individuals >been sold out for some "greater good". I can just imagine some dissident >getting sold out as the result of some mega-trade deal or the like. (And I >am sure that they can too...) As when the Cossacks who fled the U.S.S.R. after the war and pledged to help the West fight Communism were returned by the British to Stalin, where they were executed. (I was reminded of this by the latest Bond movie, where Bond avers, "Not exactly Britain's finest moment.") Had they been using Brit-GAK, then even more of them could've been rounded up by the Brits and send packing. >Why does this news report sound more like someone trying to sell GAK to the >US public and not "chinese dissidents? Was Noriega our friend or our enemy, and when? If his followers were using the U.S. as their friendly keyholder, how would this have played out when the U.S. government decided to switch sides? When governments change, the U.S. often switches sides as well. The U.S. holding the keys of dissidents will not fly. The notion that the U.S. will become the GAK-holder for the world's dissidents is too absurd to waste more time on. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

No Subject
by jc123＠arn.net 17 Dec '03

17 Dec '03

Could you send me some information about crypto stuff.

1 0

Re: NSA says strong crypto to china??
by James M. Cobb 17 Dec '03

17 Dec '03

Tim, On 01 07 96 you say: ...the crypto anarchy notions we talk about makes collection of taxes increasingly problematic. You also say: Today, and especially with strong crypto and all the develop- ing methods we talk about, how will the Ruler know what to tax? You conclude: ...I believe that this issue [collection of taxes] is one of the motivations to restrict the use of strong crypto and to make transactions monitorable. In 02 96 Internet World, science fiction writer Vernor Vinge is interviewed: Suddenly [about 1984] people realized that if a 100 million people each had computers that were one-tenth of one percent as smart as the government's computers, they had much less to fear about government. Now we've entered an era where the government understands this. One the one hand, police forces are legitimately [?] frightened; law enforcement could become much more difficult. But at the same time --with some new laws and technology-- police powers could be much greater than before.... You've heard of ubiquitous computing, but how about UBIQUITOUS LAW ENFORCEMENT? Developing that line of thought, Vinge says: ...the old Clipper chip proposal recommended that GOVERNMENT LOGIC be present in certain communications equipment. For the future I think this aspect of Clipper was as significant as the crypto issues. What would it be like if a certain amount of GOVERNMENT LOGIC were mandated in the design of every host in a country? And Vinge concludes: WE COULD HAVE REAL-TIME TAXATION. and ...very fine-grain CONTROL would be possible. Capitalization in the above excerpts is mine. The whole interview is worth reading. Its title is: Reality & Fiction. It starts at page 82. Jeff Ubois asked the questions. Every HOST in a country? As Larry Ellison says in 12 26 95 / 01 02 96 Computerworld 41: The ideal operating system arrives across a network when you turn your computer on. The GOVERNMENT LOGIC arrives too... Cordially, Jim

1 0

No Subject
by Jonathan Keith Barrow 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My internet service provider does not carry alt.sex at all is there anyway that i can still get into these newsgroups? Sorry if this question is a little elementary to some of you, but i have to learn somewhere. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMO/2Ax34sJAQcsCpAQFUugP/TThD+3F5ifba118ktl5NhHzzmiMTRxoG 8D///RbTgna0OvPhNpgz5MrHGewGhyHfDtbedI0MieHiGEj+az7xSp2qIgOlMKKm i7mz9IFIxBzjLqV/n27gYuW12yb6eeEau9GkkvYeF7gq49AocenYUw1BrlFn58zJ BfFxTRPsGjI= =Dyre -----END PGP SIGNATURE-----

1 0

Re: Microsoft has a way to go on E-Mail
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Perry say: >The problem is that microsoft has made the mistake of using >their own software, which doesn't understand the distinction >between envelope and header addresses. I've been on the phone >with contacts there and I'm going to start threatening going >to the press soon. I'm sure they're scared. What press? NBC News? The Seattle Times? The Wall Street Journal? Windows Magazine? Maybe Michael Kinsley will run a hard-hitting expose. About a dozen recognizable computer magazine reporters and editors are on the win95netbugs mailing list. For months, the majordomo welcome message has told subscribers the bugs they should come to expect in Exchange: 1. Return-Path overrides From:. This is a Major Bummer on, for example, majordomo lists, because by default all replies go to the list owner. 2. No .signature support. Combine with the above and you have a real problem. 3. Annoying WINMAIL.DAT ms-tnef attachment. 4. Annoying "if you don't have a standard MIME mail reader, you need to upgrade" prepended to every message. Suddenly Microsoft supports IETF standards. 5. The alternative to ms-tnef is quoted/printable, not text/plain. Not all MUAs handle the quoted/printable generated by Exchange properly. Microsoft Mail and Pine, for example. - - -rich owner-win95netbugs(a)lists.stanford.edu http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: I have no further comment at this time. iQCVAwUBMPBlho3DXUbM57SdAQEOcgP8DSRKwW44fKpWWxDBZOBvb2hKfX8b6p85 NnhYgzjUlNC7wneOww2NcO+Lb+F9pPfBYWVgCeUN3kUWHbp4b/MMx+RmzQXxmwLL lNghzWxBTY4JR3/088mOPNMnp8xfLArS75lvtM+13/fIBlibAoye5uq57r5h1tGT DC/X6n2/TLQ= =zgD4 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMPBlPSoZzwIn1bdtAQFk1wF+NhPXjVnj35ZgKdVq+aCOipXIDlly5hbe zbiuXjrzd32XZuzIUgixnQnAKJTh8EJ/ =BnVe -----END PGP SIGNATURE-----

1 0

(fwd) Private SSN Collection Project (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

I thought this was interesting. -bd ---------- Forwarded message ---------- Date: Sun, 31 Dec 1995 00:01:48 -0800 From: Clint Danbury <danbury(a)shell.wco.com> Thank you for your response. Please send Full names and Social Security Numbers of anyone you know, including government officers and/or employees, to: Clint Danbury, Box 750037, Petaluma, CA 94975-0037 email: danbury(a)ssnShirt.com Questions And Answers On The Nationwide SSN Collection Project. -1- Why are you collecting SSNs ? Answer: For fun and amusement. -2- What do you plan to do with them ? Answer: Put them on sweatshirts and sell them through specialty clothing retailers. It has been suggested also that I post them on large billboards along the Mexican border, but I don't have enough capital to pull of such a stunt at this time. -3- How long do you intend to continue this ? Answer: Until it becomes illegal. The moment any legitimate government authority informs me of the specific laws which (A) Forbid the collection, recording, and distribution of SSNs by private parties, and (B) Provide legal recourse for the individual citizen against private parties which do so, I will stop. -4- What if the government finds out what you're doing ? Answer: First off, the government knows very well what I'm doing. I've been "reported" multiple times to the SSA and the Secret Service. Secondly, the government can find me quite easily (I'm in the phone book). Third, I will cooperate completely with any legitimate government authority. -5- Here's my ex-spouse's SSN; will you make him/her miserable for me ? Answer: Hell No ! If you want me to engage in illegal activity for you, then go somewhere else ! -6- Isn't what you are doing illegal ? Answer: Not according to the SSA. They have declared the private use of the SSN unrestricted. (More on this in a few questions) -7- If My name/SSN were in your database, would you tell me ? Answer: In order for me to confirm this, you must first tell me what your full name and SSN is, then I will tell you if you were already in there. If this sounds like two-faced hypocrisy, great! I got the idea from CBI-Equifax; that's their very own policy. If you don't tell them what your SSN is, they won't tell you what they've got on you. Therefore, I have decided to do the exact same thing. (If you don't believe it, then why don't you call them and ask for yourself?) -8- What if someone did the same thing to you ? How would YOU feel ? Answer: This already has happened to me. I told the SSA office about it, repeatedly, and they would take no action. (The story appears in the next answer.) -9- How did this all start ? Answer: In 1985, a co-worker learned that I object to the "Uni-Number" concept of identifying a single person across multiple databases. I was (and still am) specifically concerned about the use of the SSN for Non-Tax identification. The company placed our SSNs on our name tags, which, thankfully, we did not have to wear constantly, although we would occasionally have to display it for a guard during certain times. This co-worker went poking through my briefcase while I was out of my office, copied down my SSN, and then, for his own fun and amusement (I'm guessing at his motives, I don't know his true reasons) displayed it for me, and would not tell me where he got it. Seeing that this angered me, he then went to other co-workers, who joined him in making my SSN even more public. They then went to the personnel files, (which the company made no attempt to keep locked) and double-checked the number with my job application. After that, they memorized it, and, (again, I'm guessing here) for their own amusement, they would recite it in unison around the lunch table. (I know this sounds impossible, but it really did happen.) After that job ended (not very happily, surprise) I let myself cool off for a few months, and then moved to another city. During my time in that other city, I contacted the SSA office there, seeking another SSN. I made dozens of phone calls and wrote letter after letter, all to no avail. My letters got shorter and to-the-point, not long drawn out things. It took only 30 seconds to read them. This continued for several months. The result was always the same: words without action, and no replacement SSN. The company in that city went down the tube, and I had to move again. I wrote and called off-and-on over the next few years, and got the same treatment; empty words, stall-him-off, and they would make no statement one way or the other. In September of 1993 (perhaps an earlier date, I'm not sure) the SSA finally came out and gave their official written approval for unrestricted use of the SSN by private individuals and private organizations for any purpose, including fun and amusement. The pamphlet is entitled "Your Social Security Number", is SSA Publication 05-10002, and dated September/1993. You can get a copy by calling them at 1-800-772-1213. On page 9 of that pamphlet, they have finally removed all restrictions on the private use of the SSN and they've put it in writing... "Because there is no law concerning the use of a person's Social Security number by a private individual or organization, Social Security has no control over such use." So, if those are the rules they've made, fine. Those are the rules by which I'll act. The collection and distribution of other people's SSNs is (as you've just read) a legally unrestricted activity and that's exactly what I'm doing. -10- Where do you get the SSNs ? Answer: "...there is no law..." so, just like CBI, TRW, TU, et.al., I don't have to tell you where I got yours. Ask CBI where they got your SSN; they won't tell you, and neither will I. -11- How do you check for accuracy ? This question bothered me a lot at first, however, it has become astoundingly simple to check whether a number is accurate or not. So, just exactly how do I do this ? CBI doesn't have to tell, and neither do I. "...there is no law..." -12- How can I get a copy of your list ? Answer: Unfortunately, I have found the drones to outnumber the worker-bees by a factor of about 10-to-1. This is not the soup-kitchen, it's a group project. If you want SSNs from me, then I want SSNs from you. In the past, I offered a 1-for-1 exchange. I will no longer make that public offer. What is offered is this: If you will send me full names and SSNs of prominently elected officials, media-babes, et.al., then I will (to the extent my database allows) send you back full names and SSNs of other prominent politicians and media babes, 1-for-1 if I can. Of course, full names and SSNs of any individual or group are still welcome, they just don't qualify for the 1-for-1 offer. Copyright, 1995 by Clint Danbury

1 0