- cypherpunks-legacy - lists.cpunks.org

lambda bulletin 2.08 / French Telco Act puts the Internet in leash
by jt＠freenix.fr 17 Dec '03

17 Dec '03

netizen's --> Lambda Bulletin 2.08 <-- contents French Telco Act puts the Internet in leash + New rules regulating Internet content + First key-escrow encryption rules As the Communications Decency Act was declared unconstitutional yesterday, June 12, the French Parliament (Senate and Assembly) passed a kind of Telco Act a la francaise last week, June 7. This law, aimed at providing new regulations for the telecommunications market (including the end of telephone monopoly in 1998), stresses two interesting points for Internet users : 1) a kind of CDA amendement was introduced en force in the Senate on Wednesday, June 5, just two days before it was voted Friday, at 3 in the morning. 2) the law establishes the first ever key escrow encryption rules created in industrialised countries. It will create trusted third parties (TTPs), private companies taht would keep encryption keys in custody for law enforcement purposes. It turns out that before the vote of the law, French military circles had already choosen which firms would be well suited to be TTP : Alcatel, Sagem and Bertin. All of them are well connected to the French military complex, and ! are all big defense contractors. The amendment number 200 in the Loi sur la Reglementation des Telecommunications (LRT) was sponsored by French Senator Larcher and introduced by French telmecom minister Francois Fillon. At first glance, it depenalizes Internet Access Providers for the content of text, images and documents that they are transmitted. But there is an IF. The condition stresses on that they must conform to future recommendations that will be establish by a French government's council : the Comite Superieur de la Telematique. Created in February 1993, the CST has a mission of regulation of Minitel services (text and voice based services), through a professional code of ethics. The CST will no longer depends upon the French telecom ministry, but will be placed under the tutelage of another famous regulation watchdog : the CSA (A for audiovisuel - a kind of French FCC), aimed at regulating radio and TV broadcasts. The law makes clear that if IAPs don't respond to "black" lists of Internet sites or newsgroups (in case where these sites may be in opposition to French law), the IAP will be held responsible for what it is carrying. These lists will be set up by the CST. Internet organisations and professionnals are scheduled to be members of the new CST -- today, in its "Minitel" form, it has 20 members, magistrates, ministry officials, France Telecom reprsentatives, Minitel providers, family and consumer organisations... So, the French amendment smells like the CDA, with the introduction of a so-called reprentative body. In the U.S. the IAP or ISP must control its content. In France this is a centralised body that will do the job. It feels that the French succeeded in what some in the US dreamt : to give the FCC the power to rate sites or content on the Internet. The French State, once again, plays the Big Mother (mother = the Republic) game with a huge sense of precipitation. Furthermore, the law broke in great haste -- and mess. Because before the amendment 200, telecom minister Fillon established an interministerial commission to work on guidlines and recommendations to enforce French law on the Internet. It came after a Jewish organisation sued IAPs for transmitting neo-nazi propaganda; and early in May, when 2 IAP directors were arrested for one day, and convicted, for transmission of pedophile pictures. The mess comes about because that Fillon didn't wait for the Commission : it was scheduled to publish a report on its work around June 15. Another mess concerns French pro-users organizations. The newly created French Chapter of the Internet Society (ISOC-France) decided, apparently with the government commission's consent, to organize a mailing list consultation on the issue. Another group, the AUI (Association of Internet users), published a report this week about ethics, Internet content selection, and so on. Both organizations were openly ignored by Fillon. He did this even after saying during various interviews that the problem of IAP legal responsability on the Internet will be the result of a "broad consensus". It turns out, however, that a small pressure group of IAPs (the AFPI) were consulted Monday, June 2, and had the opportunity to read the amendment before its final review in the Senate. The IAPs are quite satisfied now, because they didn't want to be treated as "pedophiles" and "neo-nazi" anymore. But they will have to adopt the CST guidelines. During my personnal inquiry of the CST last year, I found some clues to understanding how the CST has been working at regulating Minitel services. The CST has a surveillance assignment on the Minitel market (to ensure that each provider follows deontology principles written in his contract with France Télécom). But surveillance operations are not organized by the CST, but by a small army of France Telecom spook agents in Bordeaux: they are 5 to 8 people regulating hundreds of thousands of services! It is no surprise to learn that France Telecom regularly intervenes in this choice, and that France Telecom itself is a big Minitel provider, through a lot of business affiliates. It turns out that theses spook agents are infiltrating private discussions in adult-oriented forums to check for indecent speech (which may be sanctionned by the CST). Here is what here in France we have inherited to regulate the Internet! The second important point of this Telco Act concerns encryption. France was already the first country in the OECD to forbid an individual to use any crypto system not approved by the French authorities (ie, the military). Thus, PGP-like software were, de facto, forbidden. The new law introduces the first key-escrow regulation. It frees cryptography use ONLY for digital signature; but to ensure privacy of email messages, however, the liberation of use is under condition : to give encryption keys to a so-called TTP. Some confidential reports in the press said that one or three private companies are already on the list to serve as TTPs for the French government. The first is Bertin & Co., an engineering company that has some competence in cryptography, and the others seem to be Alcatel-Alsthom (a big industrial conglomerate in telecommunications, defense and public-works engineering), and Sagem, another telecom conglomerate. It seems clear that all of these companies were choose! n according to their defense expertise and good relations with the French military. The mess is that these choices, if confirmed, have been made before the vote on the law, and even before "applications decrees" were published (they may be prepared this summer). France has no NSA. But some big ideas. (During the oil crisis in the 70's, a government commercial stated : "In France we have no oil. But we have good ideas".)

1 0

Cryptography Forum - Churchill Club
by stevenw＠best.com 17 Dec '03

17 Dec '03

Seen in ba.internet. This may be of interest to people living in the San Francisco area of California. ------------------------------------->8-------------------------------------- Information Security and the 20th Anniversary of Public Key Cryptography Monday, April 29, 1996 Marriott Hotel, Burlingame, CA 5:30 PM Full Dinner 6:30 PM Program Members: $20 Non-members: $35 KEYNOTE SPEAKERS: Senator Conrad Burns (R, MT) Senator Larry Pressler (R, SD) Congressman Robert Goodlatte (R, VA) David Morris, Vice President, Cylink Corp. Jim Omura, Chief Technology Officer, Cylink Corp. James Freeman, Special Agent in Charge, FBI Phil Mellinger, Chief Engineer, Government Securities Assoc. Paul Raines, Project Manager, United State Postal Service Whitfield, Diffie, Martin, Hellman and Ralph Merkle - Pioneers and original patent holders for public key cryptography Economic espionage is costing the nation billions of dollars in lost business every year. U.S. companies are in danger of losing everything from trade secrets and proprietary financial information , to the bottom line figures on contract bills. Three bills are now in Congress to protect government, business and home computer users from outside snooping of sensitive information. These proposed new laws have been written to encourage the use of encryption and loosen export restrictions on encryption technology. Congressman Goodlatte is the author of one of these bills. April 1996 is also the 20th anniversary of the creation of Public Key Cryptography. The three principal pioneers and patent holders will also be present to share their views on the need for strong encryption. Morris of Cylink Corp. will provide an overview of what state-of-the-art security solutions are needed, and available, to truly protect business from unauthorized access. James Freeman of the FBI will discuss the recent study on industrial espionage and Paul Raines from the U.S. Postal Service will talk about electronic postmarking and certificate authority key registry bureau. TO REGISTER: Please call (408) 371-4460 or fax reservations (408) 371-4180 or email chrchllclb(a)aol.com PRESENTED BY THE CHURCHILL CLUB - A NON-PARTISAN FORUM FOR SILICON VALLEY ------------------------------------->8-------------------------------------- ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: questions about bits and bytes
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:34 AM 4/12/96 -0500, Doug Hughes wrote: > >On Apr 12 at 8:07 >jim bell wrote: >> >>Are you sure they're not referring to 8 bits of data and a parity bit? In >>any case, please give the address to the list so that it can be checked out. > >Come on, give it up already and admit you were wrong. At least 8 different >people have cited examples of machines that supported non 8bit bytes. Your >pride is getting the best of you. Jim is unwilling to admit his errors, even in things he has little or no training in. (I remember him claiming at one point that he was not a programmer or did any coding for that matter. Why he continues to persist in such things I will not speculate on...) I have worked on a couple of machines (that are still in use today) that were non-standard bit sizes. Many of the legacy machines from the old mainframe days (about 20+ years ago) had non-standard bit sizes. (Which made communication between then an interesting mess.) The old Microdata PICK machines had a weird byte size, for example. Some of the old Vax machines had the same "difficulty". >If you mean 8 bits, you should really say Octets as has always been the >form of Internet RFC's where the distinction is important. Making the assumption as to the stability of the sizes of bytes, words, and characters can get you into alot of trouble in the coding world. Characters are a good case in point. Depending on your OS and/or language, you could be talking about 5, 7, 8 or more bits. With the need to distribute applications internationally, the need to support all sorts of character schemes makes it even more variable. Unicode is 16 bytes per character. Shift JIS can be variable. (Either 8 or 16, if I remember correctly.) It just depends on the hardware, software, and compiler being used. I am sure that alot of old code is getting broken by the assumption that a character is always 8 bits. Assuming the same about bytes on old machines will do about as much good. >It may be standard today, but it was not always so.. And the standards change. I expect that at some point, some standards group will change all the terms again. (And this argument will flare up again...) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: Word lists for passphrases
by William Knowles 17 Dec '03

17 Dec '03

Greg, >Are there any publically available word lists which contain just about >every word in the English language? It's not absolutley necessary, >but I'd also like the list to include english names. I would try this site out, It is very complete and should fill the bill. ftp://sable.ox.ac.uk/pub/wordlists/ Good Luck! -William Knowles erehwon(a)c2.org Finger for public key --

1 0

Re: No matter where you go, there they are.
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>While we may disagree with Ms. Denning on a number of political matters, >she's quite intelligent; I suspect the paper is well-founded. Yes, that was my initial reaction too, but the content just don't support that. I suspect this is a case of a person well-qualified in one area (crypto) working in very different area (GPS) where she is not qualified and does not understand what is going on. >GPS receivers are line-of-sight only; only a small portion of the earth can >see the same satellites. Well, sort of. The satellites are up at 11,000 miles, which makes for a large footprint. You'd certainly see most of the same satellites from several states away. >It might be possible to seperately record the signals from several >different satellites, delay them each just the right amount of time, and >then recombine them to simulate being at another nearby location (within >several hundred miles). Right, that's what several of us have been saying. >However, this might not be possible. Examine the >following quote from Denning's paper: > >:The location signature is virtually impossible to forge at the >:required accuracy. This is because the GPS observations at any given time >:are essentially unpredictable to high precision due to subtle satellite >:orbit perturbations, which are unknowable in real-time, and intentional >:signal instabilities (dithering) imposed by the U.S. Department of Defense >:selective availability (SA) security policy. Sure, but that is nonsense. Here's why. The time delay you need to introduce a 200 mile shift is 1 ms. The effects Denning et al. are talking about are LOW FREQUENCY effects. This is obvious for orbital perturbations, since we're talking about small motions of large heavy objects here, and it is also true for the S/A dither. Indeed it has to be that way, since any high frequency jitter would prevent the receiver from locking on the spread spectrum code that's at the core of how GPS works. In other words, at the millisecond level, none of those effects exist. Re Hal's comments: >Note however that Denning did not mention the Internet in her spiel. > >I believe her method would be workable across lower latency networks, if such >exist or eventually exist. Perhaps direct connections or leased lines would >provide low enough latency; I don't know. In any case networks are likely >to become faster in the future and her method might eventually work. >Actually the issue is not just latency but whether the latency can be >lied about, and for some kinds of networks that would be harder. What a checking system actually observes is: at time T2 it receives a message that claims to have been generated at time T1 by a system at location X. It would accept the authentication as valid if the elapsed time T2-T1 is small enough to be believable. How small this is depends on (a) the transmission latency, (b) the processing delay in X and in the checker. There are two flavors of attack on this: 1. Attacker Y uses the real-time signals from the satellites, delayed as needed. It sends those after processing, just as X would have done (except that X doesn't insert the processing delay). The elapsed time seen by the checker differs from the case of X by the sum of the processing delay and the incremental transmission latency (since Y is at a different place than X, so its connection to the checker may have either less or more latency). This fools the checker if the incremental latency is within its tolerance. Suppose that I'm using a LAN -- in that case a transmit delay on the order of 1 ms is plausible. X and Y would be about the same (of course it has hard for Y to get on the LAN unobserved...). If X is less than 20 miles away, the processing delay is under 100 microseconds, which is "in the noise". If I'm in a WAN, then the latency is likely to be greater, but even if is is 1 ms, I can be many miles away before it becomes obvious. The above of course assumes that the signal processing is done in hardware (or fast DSP) so it can indeed be done in well under 1 ms. Not a big deal... That seems to be one Denning mistake, the thinking only of replay in the sense of long delayed spoofing messages. 2. Attacker Y synchronizes to the satellites but constructs a signal locally that effectively "anticipates" what the satellite is about to send. This allows it to get the effect of a negative delay (thus avoiding the "node in the ground" problem). Since the signal is entirely predictable at the few-ms level, this is not difficult, though it requires a bit more effort than the simple delay approach. This way Y can construct a signal acceptable to the checker, even if its transmit latency to the checker is greater than it is for X. It simply anticipates by the difference plus whatever it needs to fake the position. Finally... As Hal also pointed out, if the system allows users to have partial sky view, then the attacker can avoid the need for negative delays entirely by selecting satellites closer to him than to the legitimate user. For anyone interested in an intro to GPS, Trimble (one of the leading companies in the industry) puts out some skinny paperbacks with nice clear explanations. They sometimes are a bit at the "see Spot run" level, but they do have the correct story. paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "Be wary of strong drink. It can make you shoot at tax collectors ! -- and miss!" ! -- Robert A. Heinlein, "The Notebooks of Lazarus Long" ! in "Time Enough for Love"

1 0

Re: Protocols at the Point of a Gun
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Should this nonsense of adding "Adult bit" to IP headers actually be implemented, I will sponser a contest: A free emailed "Thanks" to the first person who (truefully) reports that an Adult Internet access username and password has been posted (or scrawled on the bathroom wall) at a US high school. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Email privacy policies at universities
by Rich Graves 17 Dec '03

17 Dec '03

We don't really have one, because we respect privacy in general. Kind of a "congress shall make no law" approach. Skidmore seems to have a pretty reasonable policy at http://www.skidmore.edu/help/rules/mail-privacy.html If you know of others, please pass along for the discussion on the resnet list, http://www.acns.nwu.edu/resnet/resnet-forum/resnet-forum.html The subject line there reads "off topic" for that list, but I don't think it is. -rich

1 0

Re: In Your EAR...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Other possible destinations can be found at: http://cgibin.erols.com/ivsw/presspg1.htm StarShip CowBoy wrote: > Suggestions for final destinations for your illegal and > prosecutable communication: > ~To yourself, at both U.S. and foreign email server sites. > ~To your immediate family members at U.S. and foreign email > server sites. > ~To foreign embassies of U.S. allies. > ~To foreign embassies of U.S. enemies. > ~To U.S. embassies in foreign countries. > ~To foreign government email addresses, with instructions > for delivery to individuals presently incarcerated for > terrorist crimes. > ~To anywhere you damn well please...

1 0

Re: In Your EAR...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Six wrote: > > Suggestions for final destinations for your illegal and > prosecutable communication: Full list at: http://www.bxa.doc.gov/Text/1_denial.txt U.S. DEPARTMENT OF COMMERCE BUREAU OF EXPORT ADMINISTRATION Table of Denial Orders Currently in Effect (Revised March 6, 1998) TABLE OF DENIAL ORDERS CURRENTLY IN EFFECT (a) Contents This table lists orders that currently deny export privileges in whole or in part. Orders are published in full in the Federal Register as cited in the column entitled, "Federal Register Citation." (2) Publication of orders. New or amended denial orders are published in the Federal Register as they are issued, and their issuance announced in Export Administration Bulletins. Although diligent efforts have been made to ensure the accuracy of the information in this table, the Federal Register is the authoritative source for denial orders. (3) Table: This table is updated as new orders are promulgated and existing orders expire. The table does not appear in the Code of Federal Regulations. Paper copies of this table are available from: Office of Export Services P.O. Box 273 Washington, D.C. 20044 (b) Effect of Denial Orders Section 787.12 of the Export Administration Regulations (15 CFR 787.12) makes it unlawful, without prior specific authorization from Export Administration, for any person to: (1) Apply for, obtain, or use any license, Shipper's Export Declaration, bill of lading, or other export control document relating to an export or reexport of commodities or technical data by, to, or for another person then subject to an order revoking or denying his export privileges or then excluded from practice before the Bureau of Export Administration, or (2) Order, buy, receive, use, sell, deliver, store, dispose of, forward, transport, finance, or otherwise service or participate; (i) in any transaction which may involve any commodity or technical data exported or to be exported from the United States. (ii) in any reexport thereof, or (iii) in any other transaction which is subject to the Export Administration Regulations, if the person denied export privileges may obtain any benefit from or have any interest in, directly or indirectly, any of these transactions. (3) A denial order applies not only to the persons or firms named in the order, but may also, after notice and opportunity for comment, be made applicable to other persons with whom the respondent(s) may then or thereafter be related by ownership, control, position of responsibility, affiliation, or other connection in the conduct of trade or related services. (See Section 788.3(b) of the Export Administration Regulations (15 CRF 788.3(b))). (4) Some denial orders have different restrictions than those noted above. Summaries of the export privileges that each order denies are printed in the column headed "Export Privileges Affected". The exact scope of the denial is set forth in the applicable Federal Register Notice(s). If you have questions about the scope of a particular denial order, you may contact the Office of Enforcement Support, U.S. Department of Commerce, Room 4065, 14th Street and Constitution Ave., N.W., Washington, D.C. 20230, Telephone (202) 482 4255, Fax (202) 482-0971. Federal Name and Address Effective Expiration Export Privileges Register Date Date Affected Citation Abelairas, 6/5/95 6/5/05 General 60 F.R. 31140 Amancio J. and validated a.k.a. Gonzalez, licenses, all Jesus commodities, 6486 S.W. 9th any destination, Miami, Florida also exports 33144 to Canada and d.b.a Estrella Del Caribe Import and Export Inc., 5529 S.W. 9th Street Miami, Florida 33144 Ace, Ian 8/8/97 8/8/17 Standard 62 F.R. 43503 8/14/97 with addresses at 4 Mimosa Way Pinelands South Africa A. Rosenthal (PTY) Ltd. P.O. Box 3721 13 Loop Street Cape Town South Africa and A. Rosenthal (PTY) Ltd. P.O. Box 44198 65 7th Street Denmyr Building 2104 Linden South Africa ADT Analog and 9/10/81 Indefinite General 46 F.R. 46154 Digital Technik, and validated 9/17/81 8019 Niederseeon, licenses, all 46 F.R. 19290 House 21, commodities, 3/30/81 Federal Republic any destination, of Germany also exports to Canada. See: Bruchausen, Werner J. Aeriotechnics 4/11/83 5/31/01 General 47 F.R. 18403 (Pte) Ltd. and validated 4/29/82 and Claypro licenses, all 48 F.R. 16527 (Pte) Ltd. commodities, 4/18/83 Suite 606, any destination, 6th Floor also exports Colombo Court to Canada. and 4E See: Kwik, Richard Dayson Road Singapore Agnese, Andree 7/11/85 Indefinite General 50 F.R. 29244 22 Rue du and validated 7/18/85 11 November 1918 licenses, all Pantin commodities, France any destination, also exports to Canada. See: Agnese, Rodolphe Agnese, Helene 7/11/85 Indefinite General 50 F.R. 29245 37 Rue de and validated 7/18/85 la Quintinie licenses, all Paris 75015 commodities, France any destination, also exports to Canada. See: Agnese, Rodolphe Agnese, Rodolphe 3/15/90 3/15/00 General 55 F.R. 10641 individually and and validated 3/22/90 d/b/a Development licenses, all Engineering commodities, and Electronics any destination, 37 Rue de also exports la Quintinie to Canada. 75010 Paris France Agnese, Saba 7/11/85 Indefinite General 50 F.R. 29244 a/k/a Saba Ambaye and validated 7/18/85 37 Rue de licenses, all la Quintinie commodities, Paris 75015 any destination, France also exports to Canada. See: Agnese, Rodolphe Alex Goh 9/10/93 9/10/13 See: Goh, 58 F.R. 48821 Sian Lake 9/20/93 Ali Reza 11/9/93 7/26/99 General 58 F.R. 60842 Foyuzi Yousefi and validated 11/18/93 P.O. Box 1341 licenses, all and commodities, 38 Firouzkh any destination, Tajresh, also exports Tehran, Iran to Canada. Alkadi, Essam 2/20/98 2/20/01 Standard 63 F.R. 10188 P.O. Box 201 3/4/98 Dammam 31411 Saudi Arabia Al-Kadi. Essam 2/20/98 2/20/01 Standard 63 F.R. 10188 P.O. Box 201 3/4/98 Dammam 31411 Saudi Arabia Almori, Robert 10/8/87 Indefinite General 52 F.R. 38495 80-82 Rue and validated 10/16/87 Saint Dominique licenses, all Paris 7, France commodities, any destination, also exports to Canada. Ambaye, Saba 7/11/85 Indefinite General 50 F.R. 29244 a/k/a Saba Agnese and validated 7/18/85 37 Rue de licenses, all la Quintinie commodities, Paris 75015, any destination, France also exports to Canada. See: Agnese, Rodolphe American 4/23/90 4/23/05 See: Tai, 55 F.R. 18147 Semiconductor, Philip T.J. 5/1/90 Inc. Los Gatos, California American 6/26/95 6/26/05 General 60 F.R. 34504 Technology Trading and validated 7/3/95 Group licenses, all 44 Montgomery St. commodities, Suite 500 any destination, San Francisco, also exports California 94104 to Canada. Amiri, Reza 9/25/93 9/25/13 General 56 F.R. 58552 Panjtan and validated 11/20/91 and a/k/a licenses, all 57 F.R. 21057 Amiri, Ray commodities, 5/18/92 and individually any destination, 57 F.R. 24242 with an address also exports 6/8/92 and at: to Canada. 57 F.R. 57155 13165 12/3/92 and E. Essex Dr. 58 F.R. 31361 Cerritos, 6/2/93 and California 58 F.R. 51610 and d/b/a 10/4/93 Ray Amiri 60 F.R. 8221 Computer 2/13/95 Consultants now a/k/a CCC Inc. with addresses at: and Heinrichstrasse 9-11 D-6000 Frankfurt 1, Germany and c/o Pars Hafezeh Mirdamad Avenue, Mohsseni Square, Farnaz Street Tehran, Iran Annexfield, Ltd. 12/14/84 Indefinite General 49 F.R. 49666 152 Budbrooke Rd. and validated 12/21/84 Warwick, licenses, all United Kingdom commodities, any destination, also exports to Canada See: O'Hara, Daniel J. Appelberg 6/19/89 6/19/04 See: Appelberg, 54 F.R. 26816 Financial Lennart 6/26/89 Services Saltajobaden, Sweden Appelberg, 6/19/89 6/19/04 General 54 F.R. 26816 Lennart (Lennert) and validated 6/26/89 individually licenses, all and d/b/a commodities, Appelberg any destination, Financial also exports Services to Canada. Filip Manssonsvag 1, S-13300 Saltajobaden, Sweden Applied Systems 12/14/84 Indefinite General 49 F.R. 49666 Methods and validated 12/21/84 and Technology licenses, all (ASMAT) commodities, Rochford, Essex any destination, United Kingdom also exports to Canada. See: O'Hara, Daniel J. ATC Lab 12/5/89 12/5/99 See: Schmidt, 54 F.R. 51048 Electronic A.S.S. 12/12/89 Service, Segelflygsgatan 35, 122 52 Enskede, Sweden Attia, Ben H. 10/30/97 10/30/12 Standard aka Attia, Adnan 1614 Nine Island Boulevard Miami Beach, FL 33134 dba General Polyphase, Inc. 15 rue de Kamel Attaturk 1001 Tunis, Tunisia Avomair Ltd. 12/14/84 Indefinite General 49 F.R. 49666 a/k/a and validated 12/21/84 Microcircuit licenses, all Technology commodities, 3 Featherby Way any destination, Purdey's also exports Industrial to Canada. Estate See: O'Hara, Rochford, Daniel J. Essex, United Kingdom Barbarits, Bruno 5/3/88 5/3/08 General 53 F.R. 16441 individually and validated 5/9/88 and d/b/a licenses, all Cosmotrans AG commodities, a/k/a any destination, Cosmotrans Ltd. also exports P.O. Box 30978 to Canada Fracht West See: Wirth, Hans Building Office 274 CH 8058 Zurich, Switzerland and Cosmotrans USA, Inc. JFK International Airport Jamaica, New York Behrmann, 1/23/92 5/10/00 General 57 F.R. 3613 Symone Morris and validated 1/30/92 11 Goldfinch Ct., licenses, all #505 commodities, Toronto, Canada any destination, also exports to Canada. Belgium 3/5/91 3/5/01 See: Sanders, 56 F.R. 10537 Trading Marcel 3/13/91 Company Lokeren S.A. Sijpstratt 6 9101 Lokeren, Belgium Berg, H. Leonard 5/12/94 1/29/02 General 59 F.R. 27531 750 Kappock Street and validated 5/27/94 Apartment 103 licenses, all Bronx, New York commodities, and any destination, at the time the also exports order was issued to Canada incarcerated at: U.S. Bureau of Prisons Low Security Correctional Institution-Allenwood White Deer, Pennsylvania Beta Computer 6/13/95 6/13/05 General 60 F.R. 32300 Trading Pte. and validated 6/21/95 Limited licenses, all One Rockor Canal commodities, Road any destination, Sim Lin Square also exports # 06-67 to Canada Singapore, 0718 (See Waldemar, Znamierowski and Prandecki, Paul Bin Wu 9/7/93 9/7/03 See: Wu, Bin 59 F.R. 47302 Virginia Beach, 9/15/94 Virginia Bose, Sidhartha 6/16/95 6/16/05 General 60 F.R. 32940 a/k/a/ Dr. Bose and validated 6/26/95 individually and licenses, all d.b.a. commodities, Perfect Technologies, any destination, LTD. also exports 212 Golders to Canada Green Road London, NW11 9BY England and Ragunathan, Thirunavkkarasu individually and d.b.a. W.K. Agencies and as Computer Focus Services PTE. LTD. with an address at 18 Jalan Kechil, #06-22 Eastern Mansion Singapore 1543 Bose, Dr. 6/16/95 6/16/05 See Bose, Sidhartha 60 F.R. 32940 6/26/95 Brandstetter, Herbert 6/15/87 6/15/07 General 52 F.R. 23325 c/o Scan Trade and validated 6/19/87 Handelsgesellschaft licenses, all m.b.H. commodities, Wiednerhauptstrasse 135 any destination, A-1050 Vienna, also exports Austria to Canada. Brero, Mario 6/26/95 6/26/00 General 60 F.R. 34505 Apt. 87 and validated 7/3/95 Route de Bougy 1170 licenses, all Aubonne, Vaud commodities, Switzerland any destination, also exports to Canada. Brownhill, David 9/11/95 10/6/03 General 60 F.R. 48961 13 Robin Road and validated 9/21/95 Northcliff Ext. 12 licenses, all Johannesburg, South Africa commodities, any destination, also exports to Canada. Bruchhausen, 3/24/81 Indefinite General 46 F.R. 19290 Werner J. and validated 3/30/81 D8019 Niederseeon licenses, all Federal Republic commodities, of Germany any destination, also exports to Canada. Burger, Peter 3/25/93 3/25/13 General 58 F.R. 18368 individually and and validated 4/9/93 as agent for licenses, all Helling KG commodities, 54 Sylvesteralle any destination, 22000 also exports Hamburg 54, to Canada. Germany and Int'l. Business Connections 11 rue Aldringen 1-2960 Luxembourg, Luxembourg Butcher, Brian A. 3/21/86 3/21/06 General 51 F.R. 10418 a/k/a and validated 3/26/86 Brian A. licenses, all Moller-Butcher commodities, c/o Contel Equipment any destination, 5 Bear Court also exports Danshill East to Canada. Industrial Estate See: M.E.S. Basingstroke, Equipment, Inc. Hampshire England Caesar 12/19/90 12/19/05 General 55 F.R. 53016 Electronics, Inc. and validated 12/26/90 40C, Corbin Avenue licenses, all Bayshore, New York commodities, any destination, also exports to Canada CAE Services 5/29/91 5/29/11 General 56 F.R. 25654 Lowengasse 2A and validated 6/5/91 A-1030 Vienna, licenses, all Austria commodities, any destination, also exports to Canada. See: Kovar, Alexander Callaghan, 1/23/92 7/20/00 General 57 F.R. 3614 Maryanne E. and validated 1/30/92 39 Congress St. licenses, all Warwick, Rhode Island commodities, any destination, also exports to Canada. Carlson, Paul C. 3/5/85 3/5/00 General 50 F.R. 9699 P.O. Box 3125 and validated 3/11/85 Brockton, licenses, all 50 F.R. 18281 Massachusetts commodities, 4/30/85 and any destination, 87 Springhill Avenue also exports Bridgewater, to Canada. Massachusetts See: Contel Equipment CCC Inc. 9/25/93 9/25/13 See: Amiri, Reza 57 F.R. 57155 Frankfurt, Germany 12/3/92 and c/o Pars 58 F.R. 31361 Hafezeh 6/2/93 and Tehran, Iran 58 F.R. 51610 10/4/93 and 60 F.R. 8221 2/13/95 Chan, Anthony 12/6/84 Indefinite General 49 F.R. 48591 a/k/a and validated 12/13/84 Chan Sum-Tai Anthony licenses, all c/o Shuttle commodities, Long Co., Ltd. any destination, Ka Wah Bank also exports Center Building to Canada. 19th Floor See: Wysh Data 232 Des Voeux Road Systems, Ltd. Hong Kong Central Chan Sum-Tai Anthony 12/6/84 Indefinite See: Wysh Data 49 F.R. 48591 a/k/a Systems, Ltd. 12/13/84 Anthony Chan c/o Shuttle Long Co. Ltd. Ka Wah Bank Center Building 19th Floor 235 Des Voeux Road Hong Kong Central Chemco 8/7/89 8/26/98 See: Walaschek, 54 F.R. 8582 Seigburger Peter; 3/1/89 Strasse 223 Colimex; 54 F.R. 33253 5000 Cologne 21, Far-Trade 8/14/89 and Federal Republic Pharma- 56 F.R. 57875 of Germany Vertrieb 11/14/91 GmbH Chua Tok Peng 9/10/93 9/10/13 See: Tok Peng 58 F.R. 48821 Chua 9/20/93

1 0

CDA Court Challenge: Update #6
by Declan B. McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- The CDA Challenge, Update #6 ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- In this update: BYU/CMU's Dan Olsen's net-censorship boondoggle ACLU's 4/9 motion to suppress obscene images -- DENIED The new "I am a child" Internet protocol Who cares about kids: Who are the adults? Olsen as an expert witness -- on what? April 11, 1996 PITTSBURGH, PA -- The U.S. Department of Justice wants to split the worldwide Internet into "adult" and "minor" sections. That's their plan, assuming they can find someone to testify that this audacious boondoggle is even remotely feasible under current technology. If the DoJ gets this testimony in the record, then their attorneys will argue that the Communications Decency Act is constitutional and should be upheld. Well, they found their man. The Justice Department stoolie who's testifying tomorrow is none other than Dan R. Olsen, Jr., the incoming director of the Human Computer Interaction Institute at Carnegie Mellon University, now the head of the computer science department at Brigham Young University. Olsen concocted this scheme that he calls L18, for "Less than 18." Under it, every net-user must label every USENET post, email message, FTP site file, web page, chat room, IRC channel -- any collection of public bits spewed on the Net -- if the content is "inappropriate for minors." If you think you're clever 'cuz you labeled some "indecent" materials as suitable for kids, guess again, pal. Try that trick and the Feds'll throw your ass in jail for two years and send you a bill for $250,000. (Owners of anonymous remailers might be for in some surprise visits from the Feds if their systems are used to post "indecent" stuff that's labeled L18.) The censorhappy geeks at Brigham Young University put together a demo to prove that this scheme works. First Olsen stuck L18 tags on half his web pages. Then they set up a "Netscape proxy server" so it denied access to pages with L18 tags unless the user was verified as an adult. The experiment was a success -- and a hit with the DoJ! By now cybersavvy readers are wondering: "But how will a server know how old a user is?" The DoJ has a couple ideas that they're going to throw at the three-judge panel in Philadelphia tomorrow. The government's idea seems to be that if the judges accept even one of them, they'll uphold the CDA. The DoJ's proposals are: 1. Servers with "indecent material" will register users as adults or minors. 2. Every ISP will tag accounts as adults or minors. 3. A custom router will only allow users to access "indecent" sites if an adult types in the password first. Olsen's Grand Design for the Net incorporates Proposal #1. He's pushing the idea that web servers or proxy servers with "indecent" material will give out "adult verification passwords" before you can access their web page. This means: * A lengthy pre-registration process before you can access the site. * The server has to keep a database with the identities of all the adult users, complete with the credit card numbers that presumably will be used for verification. * If you want to access hundreds of web sites with "indecent" material, you've got to get hundreds of different passwords. If you run a web site with material that a Federal prosecutor anywhere in the U.S. may find "indecent" or "patently offensive," under Olsen's plan you have to verify that your users are adults. Somehow, I don't expect overseas sites will go for this. What, doesn't the DoJ realize that we're not just talking about the U.S. here? +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ ACLU'S MOTION TO SUPRESS OBSCENE IMAGES -- DENIED! +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ It's not about cybercensorship. It's about cybersex. At least that's what the DoJ wants everyone to believe. Justice Department attorneys have been flooding the court with printouts of hundreds of pages of dirty pictures, a lot of them pretty damn raunchy. Some of them might even be "obscene" -- that is, they fall into a legal class of images that flunk a three-part test that includes only images without "serious literary, artistic, social, political, or scientific value." Pretty hardcore stuff. GIFs like coeds fraternizing with german shepherds -- with the help of 25' of rubber tubing and a Tibetan yak. On April 9, the ACLU/EFF plaintiffs filed a motion to close the floodgates on the DoJ's deluge of porn, asking that the government be barred from introducing exhibits "unless they believe in good faith the material could not be prosecuted under existing obscenity or child pornography laws." The idea behind this motion was to educate the court and remind them that the CDA outlaws "indecency," not "obscenity." EFF attorney Mike Godwin explains the difference in his forthcoming book _Cyber Rights_: The term "indecency," although never defined by Congress or the courts, is a far broader concept than "obscenity" (examples of "indecency" include George Carlin's famous "Seven Dirty Words" monologues, at least some portions of Howard Stern's radio broadcasts, and, according to one court, the text of Allen Ginsberg's "Howl"). Not one of our plaintiffs has "obscene" or even titillating pictures on our web sites, but all of us are subject to a $250,000 fine and two years in prison if a minor stumbles across our URL. Yesterday the court denied our motion, saying that it understood that we weren't challenging obscenity laws and that, unlike the situation that might occur if there were a jury, the judges would not be prejudiced by any pictures introduced. The court ruled *they* were capable of understanding the difference, so there was no need to separate the materials. They did admit that we had raised an important issue, and the court understood the reason for the motion. I guess we have to trust them. +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ THE NEW "I AM A CHILD" INTERNET PROTOCOL +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ There's a second way to answer the question of: "How do you know who the children are?" Another option the DoJ appears to be pushing -- we'll know details tomorrow -- is this idea of reprogramming every computer on the worldwide Internet to run software that tags users as adults or minors, so a server will know whether it can send out "indecent" material. This shifts the burden of establishing age-identity from the content provider to the business or school giving out the Internet account. It also would allow any unscrupulous net.lurker to troll for "I am a child" tags and follow them back to the originating site -- not exactly the best way to protect the children! I should have realized this DoJ strategy earlier. Last week when I was arguing with Bruce Taylor, an architect of the CDA, we went 'round and 'round on the issue of children on the Net. He maintained that every Internet user has to have an account somewhere, so the provider of that account can tag the user as a minor or adult. I asked Taylor how his proposal was possible with the TCP/IP protocol -- the nerve system the carries all the data flowing through the Net. He replied that technical problems can be solved by technical people, and wasn't there a new protocol being developed, anyway? Basically, his position was: "Your side comes across to the court as saying that it can be done but we won't do it. You're a bunch of geeks who want to protect their porn and the court isn't going to buy it." The "new protocol" being developed is IP Version 6, which the DoJ zoomed in on in cross-examination of one of our witnesses, Scott Bradner from the Internet Engineering Task Force: 13 Q Would it be fair to say, to summarize what you've just 14 said, that the IP Next Generation group is working on a new 15 generation of the IP Protocol itself? 16 A That is correct. 17 Q Does it have -- does the IP Next Generation group have 18 recommendations regarding a specific architecture of the 19 packet traffic on the Internet, including the format of the 20 packet? The DoJ is going to argue that IPv6 can include such an adult/minor tag in each datagram. Chris Hansen, the head of the ACLU's legal team, says: Olsen is going to push this tagging idea that the government has, that you can imbed in your tag -- in your address -- an adult or minor tag. They're going to suggest that the market will come into existence that will make that tagging relevant. It's more like the *judicial penalties* will evolve to make the tagging not just relevant, but mandatory! On the cypherpunks list, Bill Frantz, a computer consultant, outlines one problem: One of the migration paths suggested for IPV4 to IPV6 migration is to tunnel IPV4 packets within IPV6 packets. IPV4 packets do not provide for an adult/minor tag, so until the transition to IPV6 is fairly well along, this approach will be ineffective. If the people who are worried about minor's accessing smut want something this century, they should go with PICS. A member of the IETF replies: Neither, for that matter, do IPv6 packets -- there is no provision for them. Furthermore, were anyone to create an end to end header of that sort, it would be eight bytes of wasted space in every packet in the net, especially since the implementation of such a tag is a technical impossibility as there is no way to force the originating system to tell the truth. The "high-touch" argument against this is important as the high-tech one. I just received the following mail from someone who would be unable to continue his work if the DoJ's IPv6 scheme is implemented: We provide free anonymous access to the net to sexual abuse survivors. We don't even know who they are, nor do we care - a lot of them are hiding out from their perps, and to try and identify them would be a tremendous breach of trust, as they are depending on us for their anonymity, much as a reporter would protect their anonymous source. I also have been told by these folks themselves that some of them are under the age of 18 - hell, I've had a few that tell me that they are 13 or 14 years old, and that they are still at home, still being raped by their perps. We provide an outlet for their frustrations, emptional support, a community for them, people to talk to, and support for them if they choose to report their abuse. None of this would be possible if Taylor and friends had their way. Sure, we could trace each and every one of them back to their providers, and find out who they are, but I'm not going to do it, and I'm perfectly willing to go to jail to protect their identities. My integrity is worth a whole hell of a lot more than any government law. +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ WHO CARES ABOUT KIDS: WHO ARE THE ADULTS? +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ The third way to answer the now-tiresome who-are-the-kiddies question is to turn it on its head and ask: "Who are the adults?" Hardware to answer that question already exists. The March 25 issue of Interactive Week reports that Livingston Enterprises, Inc. has colluded with Senator Exon's staff to design an "Exon box" -- a router that lets ISPs cut off unrated or "indecent" or unrated sites. To get around the block, an "adult" enters a secret password that tells the router to open a session and let the packets flow. Exon's staff is heralding this as an example of how easy it is to comply with the CDA. The only problem is that, like many such hamfisted censorship "solutions," it sucks, and it ain't going to work. One of the original architects of the Internet, David P. Reed, wrote: I do work to protect my children from inappropriate material, but pressure from Senators to mandate technically flawed solutions, and opportunistic, poorly thought-through technologies from companies like Livingston are not helpful. +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ OLSEN AS AN EXPERT WITNESS -- ON WHAT? +-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+ As I was writing this, I started wondering why Olsen got picked as the DoJ's expert witness for tomorrow's hearing, especially when his research is *not* in distributed computing environments and protocol design. It's in human computer interaction and user interfaces. One of Olsen's former students at Brigham Young University contacted me last week, saying he had initially hoped that Olsen was "lending a neutral opinion" on technical issues "but that hope proved false." I asked if his former faculty member has "done any work relating to distributed computing environments like the Internet?" His reply: "The closest thing I'm aware of is a paper on interactive bookmarks." Network engineering that ain't. On April 7th I sent Olsen email, asking him: "What kind of research have you done related to distributed computing environments like the Internet?" As of April 11, still no response -- even though he had replied to my earlier messages almost immediately. (I wouldn't put it past the DoJ's tame attack ferret, Jason Baron, to try and muzzle Olsen as well.) Vanderbilt Professor Donna Hoffman writes about Olsen: A colleague at CMU told me that Dan Olsen is largely an administrator at BYU and will assume administrative duties at CMU as the temporary head of the HCII... I've seen his vita and talked to some colleagues in CS and related fields about his work and it doesn't seem that he has done much, if any, research related to the distributed computing environments like the Internet. His vita is difficult to parse because he has numerous items I can't identify - for example, are they book chapters, working papers, proceedings? Where were they published? And so on. He is the Editor of a new journal published by CACM which started a few months ago, related to human-computer interaction. His main research interest seems to be in user interface issues, but he hasn't published much in scholarly journals so I would conclude that his work has had little impact on the field. (I should point out here that a member of the HCII at CMU sent me mail saying that conference proceedings are the main form of publication in the field.) Still, I wonder why the DoJ couldn't get a real net-expert to defend the CDA and the network protocol schemes they're proposing? Grey Flannel Suit (aka Air Force Special Agent Howard A. Schmidt) is going to take the stand tomorrow and do a live demonstration of how he can find cybersleze on the Net. I can hardly wait! Grey Flannel has been involved in a half-dozen porn prosecutions in the past: two dealing with civilian porn sites and and four dealing with military ones. From the deposition he gave in Washington, DC earlier this week, the extent of his testimony seems to be: "I went onto the Net and found dirty pictures." The following clue as to Grey Flannel's history of porn-prosecutions flowed into my mailbox the other day: It would be interesting to find out if Schmidt was involved in _US v. Maxwell_, 42 M.J. 568 (USAF Ct Crim App 1995), a military justice case concerning a USAF colonel who used AOL to communicate "indecent language" to another servicemember and to traffic in pornographic matter. USAFOSI was clearly involved in the investigation, but no agents are named in the opinion. Flannel will be followed by our last witness, MIT's Albert Vezza, and then Dan Olsen. Stay tuned for more reports. ----------------------------------------------------------------------------- We're back in court on 4/12, possibly 4/15 as a last day of witness testimony, 4/26 for rebuttal if necessary, and 6/3 for closing arguments. Mentioned in this CDA update: Michael Froomkin: "The Internet as a Source of Regulatory Arbitrage" <http://www.law.miami.edu/~froomkin/arbitr.htm> Wired: "How Anarchy Works -- Inside the Internet Engineering Task Force" <http://www.hotwired.com/wired/3.10/departments/electrosphere/ietf.html> Net-Guru David Reed's article: "CDA may pervert Internet architecture" <http://fight-censorship.dementia.org/fight-censorship/dl?num=2093> Michael Froomkin's LONG article on anonymous remailers: <http://www.law.miami.edu/~froomkin/ocean1-7.htm> Dan Olsen at BYU <http://www.cs.byu.edu/info/drolsen.html> BYU's censorship policy <http://advance.byu.edu/pc/releases/guidelines.html> Internet Eng Task Force <http://www.ietf.org/> Rimm ethics critique <http://www.cs.cmu.edu/~declan/rimm/> Int'l Net-Censorship <http://www.cs.cmu.edu/~declan/zambia/> CMU net-censorship <http://www.cs.cmu.edu/~kcf/censor> University censorship <http://joc.mit.edu/> Grey Flannel Suit <howardas(a)aol.com> This report and previous CDA Updates are available at: <http://fight-censorship.dementia.org/top/> <http://www.eff.org/pub/Legal/Cases/EFF_ACLU_v_DoJ/> <http://www.epic.org/free_speech/censorship/lawsuit/> To subscribe to the fight-censorship mailing list for future CDA updates and related net.censorship discussions, send "subscribe" in the body of a message addressed to: fight-censorship-request(a)andrew.cmu.edu Other relevant web sites: <http://www.eff.org/> <http://www.aclu.org/> <http://www.cdt.org/> -----------------------------------------------------------------------------

1 0