- cypherpunks-legacy - lists.cpunks.org

Crypto-continuation in Washington: FBI/DoJ keep up the pressure
by Declan McCullagh 17 Dec '03

17 Dec '03

Crypto is hot in Washington. Don't think the battle's over; it's just beginning: * This afternoon when the Senate Intelligence committee met to consider a new CIA deputy director, Sen. Bob Kerrey said "there's a real urgency" to get an encryption bill passed. (Presumably, that would be his bill, the "Key Escrow Infrastructure" McCain-Kerrey/S.909.) Anyone still think that the Senate will do the right thing on crypto? Think again... * Last week Janet Reno talked at her weekly press conference about balancing law enforcement rights with privacy rights -- through mandatory domestic key escrow. * Yesterday Louis Freeh spoke at length before the House International Relations committee about the spread of nuclear weapons... and reminded committee members about the problems the FBI has with nonescrowed crypto... * Sen. Jon "Mandatory Domestic Key Escrow" Kyl said on Sunday that the Clinton administration's export controls on crypto were *not tight enough*... More info: http://cgi.pathfinder.com/netly/opinion/0,1042,1385,00.html http://www.jya.com/declan8.htm -Declan **************** HEARING OF THE SENATE INTELLIGENCE COMMITTEE NOMINATION OF LT.-GEN. JOHN A. GORDON TO BE DEPUTY DIRECTOR OF THE CENTRAL INTELLIGENCE AGENCY CHAIRMAN: SENATOR RICHARD SHELBY (R-AL) 106 DIRKSEN SENATE OFFICE BUILDING WASHINGTON, DC 2:00 P.M. EDT WEDNESDAY, OCTOBER 1, 1997 SEN. KERREY: I hope no doubt that you've heard of and perhaps had the opportunity to read the recommendations made by Senators Helms and Moynihan, but I think they're excellent. It's an excellent examination of, first, the need in some instances to classify, as well as the need to examine that classification system. It's not really a question, General Gordon. I think it's imperative that, on the issue of encryption, that the president exert some authority and try to pull together the congressional leaders and say, "We need a secure public network." There's counter-intelligence concerns. There's national security issues here at stake, obviously, balanced against the concerns for civil liberties and the concern for commercial interests and the need to develop. But there's lots of action up here on the Hill, both in the House and the Senate, in half a dozen committees or eight or nine committees, or Lord knows how many altogether, more than I realized existed. And I think there's a real urgency to get something passed both for the private sector, so they can have some stability, but also on the public-sector side, so we can protect the nation's interests. MR. GORDON: Senator, I have not delved that deeply into the encryption issue. I certainly take your point on this point. But I do know that if the Senate does confirm me that that will be squarely on my plate. **************** ATTORNEY GENERAL JANET RENO'S WEEKLY MEDIA AVAILABILITY U.S. DEPARTMENT OF JUSTICE WASHINGTON, DC THURSDAY, SEPTEMBER 26, 1997 Q No, wait - ATTY GEN. RENO: You've got to be quicker than that. Q (Inaudible) - yes, ma'am. Director Freeh and Director Constantine both have complained that U.S.-made encryption devices are giving the drug cartels an advantage whereby interdiction becomes impaired. Would you favor, as Mr. Freeh does, some kind of giving of the keys to these devices to the FBI and DEA? ATTY GEN. RENO: I don't think that Director Freeh favors giving keys to the FBI and to the DEA. Q No? ATTY GEN. RENO: What Director Freeh has talked about is what we have today - if someone is going to tap a phone, they don't just go in and tap the phone, if they're going to do it legally. What law enforcement does is it develops probable cause to believe that the telephone is being used to commit a crime and that to overhear would provide evidence of a crime. That is submitted to a judge, both in federal court and in many states courts where wiretapping is authorized. The judge reviews the sufficiency of the affidavits in support of the petition and enters an order directing the telephone company to provide that opportunity. What Director Freeh is hoping to achieve is the same thing with respect to encrypted products; so that the court would direct that the key be provided to the telecommunications system, or the other system, in order to decrypt the encoded message. What we're trying - what the administration is trying to do is to recognize that there are two important interests at stake here. One is the law enforcement interest, which is so vital with respect to terrorists, with respect to being able to decrypt the drug dealer's computer when I - I can get a search warrant now and seize his black book and I can read his black book or decipher what he's talking about. But if he can encrypt the information on his computer, that will be a significant obstacle to law enforcement. At the same time, the whole purpose of encryption with modern telecommunication is to provide for the privacy interest, of commercial interest of the average citizen. And so I think it's important that we work together to ensure the law enforcement capacity and ensure that the present capacity to get court-ordered authorities for surveillance are continued and are made real, while at the same time ensuring privacy. Q So you're saying that the phone company would have the responsibility? Do they have the capability of encrypting? ATTY GEN. RENO: The phone company doesn't have it. There would be a system whereby a key would be provided through third parties or otherwise. But this is something that we need to work together on to ensure that law enforcement interests are protected and that privacy interests are protected as well. **************** HEARING OF THE HOUSE INTERNATIONAL RELATIONS COMMITTEE SUBJECT: ORGANIZED CRIME CHAIRED BY: REPRESENTATIVE BEN GILMAN (R-NY) LOUIS FREEH, DIRECTOR, FEDERAL BUREAU OF INVESTIGATION 2172 RAYBURN HOUSE OFFICE BUILDING WEDNESDAY, OCTOBER 1, 1997 10:00 A.M EDT REP. : Following up on what Mr. Hyde said on your need to fight international crime and terrorism, what do you need, as an agency director and for your agency, in terms of specifics to wage a fight that you can win? MR. FREEH: Yes, sir. As I mentioned in my statement, I think we need it on three levels. We need the permanent and minimal FBI presence overseas to develop the kinds of relationships that Dr. de Gennaro and I have had now for 18 years. We have asked for, and the Congress approved last year, in August of 1996, a plan to expand the FBI's Ligat (sp) program from approximately 23 to 43 Ligats. That would call for, by the end of 1999, 146 special agents in 42 different countries with 116 support employees. That's a total of 262 people. As I mentioned, the plan was submitted last year. It wasn't just an FBI plan. It was jointly submitted by the State Department and the attorney general. And we've asked for funding in the 1998 and 1999 budgets to reach that level. We've also asked for a continuation of the training. As I mentioned, we've been able to train thousands of police officers around the world. The benefit of that training is two-fold. First of all, we can give them what they need most of all, which are the basic tools to conduct their own investigations. Just as importantly, we develop through those relationships, as Dr. de Gennaro described it, the cop-to-cop contacts and relationships. So an FBI agent or a DEA agent can pick up the phone and speak to a police commander in Uzbekistan or Kazakhstan, if that's the place where we need to do our work. So the training is a very important part of the whole program. And again, and finally, we need the technological tools to do our work. We have to be able to communicate rapidly and securely. We have to deal with encryption. We have to deal with cyber-crime. And those are all part of a larger technological challenge which we're trying to meet. [...] REP. LINDSEY GRAHAM (R-SC): Thank you, John. Director Freeh, appreciate your testimony. It's been quite riveting, actually. One of the briefing papers we have indicates that the American public, in a recent poll, whatever you want to take polls worth, say that 70 percent of the American people who were surveyed found it likely that the United States could be attacked by terrorist groups within the next decade using smuggled nuclear devices. If you were asked that, what category would you be in? MR. FREEH: I think it's a threat and a possibility that should occupy our highest priority. I think we've seen attacks certainly in Oklahoma, in New York City. We know that many of the state sponsors of terror, including Iran, are rapidly and very aggressively acquiring nuclear technology, both in terms of warheads and launching devices. We know that many of the state sponsors of terrorism, particularly Iran, sponsor and fund and control Hezbollah groups, including groups which have connections and operations in the United States. So the links, although I don't think I've seen them in a documented form, clearly suggest that if a terrorist is willing to use a truck bomb to blow up a building with thousands of people at risk, the accomplishment of the particular objective would not be changed or influenced by the opportunity to use a much more devastating (nuclear?) or biological or chemical agent. So I think we have to take the possibility extremely seriously and we have to take drastic steps to try to prevent and detect that. **************** [This thanks to John Young. --Declan] Remarks by Senator Jon Kyl at the First International Conservative Congress--September 28, 1997 [...] The Clinton Administration pursues a foreign policy without clear goals or the will to act decisively and is squandering the national security means left to it by a dozen years of Republican presidency. It emphasizes hope over reality and reliance on arms control agreements like the Comprehensive Test Ban Treaty (CTBT), the Anti-Ballistic Missile (ABM) Treaty, and the Chemical Weapons Convention (CWC) over a stronger defense. And political benefit over national security, as in its decisions to cave in to the concerns of some in industry in irresponsibly relaxing export controls on key items like encryption technology and supercomputers. **************** ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

2 1

Re: "Show me an example of terrorists using the Internet or crypto"
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cynthia Brown wrote: >On Wed, 1 Oct 1997, Alex Le Heux wrote: >> This sucks. > >I agree wholeheartedly. >IMNSHO the best way to fight crime is not with bigger guns than the >"bad guys", but with better social programs such as universal health >care, and improved day care so single parents can show their kids >what a productive lifestyle looks like. Of course you agree wholeheartedly, you are an exploiter. It is wrong. You should be ashamed of yourself. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDLA95aWtjSmRH/5AQFykwf+Nh/3MKqyK30Tc90Wj0MCvKLvyZYzkKiZ KV/H8+7Of5hPh0pUEZNDBxr7A3x02+0jhYwJymzYcHJuXAP0+RmXtWRyAWz9TFE3 AB23HgLODI2IrsD1NvlwbjHQzpLVqfT99QEYIaolZScilc5hw1uZV8dAK4SjXDnZ +K4QG3RZpAxpKZUSWduErtJ+8JAzavH4ybeR95hO2uY2na1ckmwWm39ERg+u+N4k rP2wd3E4IQ7XWbPCrHWEPoDs4PHMg09lK/Y+fv9ejE8+ehq/YeO1WYtZtlaCURtU CE7JXH4b60+NmDuISybaMWdv70IFOneukz64zasAT1wp9w4Mxqjw7Q== =VYI9 -----END PGP SIGNATURE-----

2 1

Re: Request for illegal electronic surveillance examples and cases
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Declan writes: >So I'm putting together a special report featuring examples of illegal >wiretapping by governments -- to show why we shouldn't trust them with >mandatory domestic key escrow. Also illegal electronic surveillance, >generally speaking. Especially more recent ones. Maybe non-U.S. examples >too. > >Any suggestions? I'm thinking things like: MLKjr, Mrs. Roosevelt, _Irvine_, >_Socialist Workers Party_, Dewey-FBI alliance, mail opening, Emma Goldman, >Brownell's blanket microphone surveillance, _Katz_, _Alderman_, CISPES. I'd figure pretty much anything from Bamford's _The Puzzle Palace_ would work, but the stuff on Operation Shamrock (interception of cable traffic) might be of particular interest. Also the parts about "intelligence sharing" with the Brits and Australians -- just because the NSA can't tap it doesn't mean they can't get it from our "friends." No doubt the Men From Fort Meade have been as helpful in the other direction as well. A particularly nice detail about Shamrock is that the FBI was using the NSA to conduct warrantless electronic surveillance of "un-American" groups by using ELINT, which was -- of course -- "born classified." I'd cite details, but my Bamford seems to be MIA. Maybe the MIB came for it. . . Ratbert

2 1

Re: "Show me an example of terrorists using the Internet or crypto"
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alex Le Heux wrote: >On 2 Oct 1997 01:29:33 +0200, in list.cypherpunks you wrote: >>Cynthia Brown wrote: >>>On Wed, 1 Oct 1997, Alex Le Heux wrote: >>>> This sucks. >>> >>>I agree wholeheartedly. >> >>>IMNSHO the best way to fight crime is not with bigger guns than the >>>"bad guys", but with better social programs such as universal health >>>care, and improved day care so single parents can show their kids >>>what a productive lifestyle looks like. >> >>Of course you agree wholeheartedly, you are an exploiter. It is >>wrong. You should be ashamed of yourself. > >Can you explain who exactly exploits who here? How about our friend J.F. Avon? He has the misfortune to share citizenship with Ms. Brown. Thus, while he may be minding his own business, doing nobody any harm, and pursuing happiness, should he decline to spend thousands of hours of his life working to pay money into Ms. Brown's socialist schemes, armed men will come to his house, put him in a cage, and leave him there for years. That's not a very friendly way to treat a neighbor, is it? In the United States, many thousands of people correctly recognize this situation. Many thousands of people are gun owners. Many thousands of people are not only gun owners, but combat veterans. The logical outcome would be great violence directed towards the government. Yet, this has not happened (recently ;-). Why? Certainly if the sums at stake were involved between governments, there would be fodder for many wars. The only conclusion that can be drawn is that civilians, even armed civilians with combat experience, are so overwhelmingly peace loving that they will bend very far backwards to avoid trouble, even if it means thousands of hours of work. Can the same be said of career military or government people? >PS. What's the point in posting anonymous when you have this sig? > >>Editor in Chief >>Smile Magazine >>http://www.neoism.org/squares/smile_index.html >>http://www.neoism.org/squares/cantsin_10.html Tools which are not used are not improved. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDPgFZaWtjSmRH/5AQEQ8wf+PwFFagIxuwKkoR5rUAxnseSP8DzrRsrw tQD5gCZ0t1JTBdXUinhZzr2NsyKDtGoPcauDtrxqWyMdAem5ZCf2v6D8Cgm34n3Q bkmvSJbo2bSuD9ggzboENp6rhvsbJ7THf7I4eMHRIUrnPgnQbaWTOXKqBPtG5w+W qPrgHAb7s6oaB8aRqX0sPByWKqbd853RLjsy62Tl3oMc7hp70TAKwXCtXKQTUhL+ CeNBpNFvnN1nR1L3AqL5aji0/BaN+7foptPRDH3eZfUwLx547+1R+DdLKAb7u5tL RJaza5h0O3Zkg+ImlqR2cKe5awxwB6NNkm2oR1GD1p0f80+mGUHtcQ== =C9wS -----END PGP SIGNATURE-----

1 0

Re: Remailers and ecash (fwd)
by Anonymous 17 Dec '03

17 Dec '03

Jim Choate: >For the sender to chain from remailer to remailer to destination the >destination has to be in the header info somewhere. Now in the most secure >system each packet header will only contain the address of the next hop. When >the next site gets it the packet contents are de-crypted (otherwise reading >the chaining info is trivial) and the contents are uncovered to reveal another >packet with the next hop header and another encrypted block. And on and on >we go. > ><Question: Are there any remailer sets that impliment the encrypted nested > packet system?> Jim Choate has been amazingly clueless throughout this discussion, but this takes the cake. Does he really not know about encrypted nested chaining? My God! Of course remailers work this way, Jim. They've worked this way practically from the beginning. All remailers work this way. The mixmaster remailers are built around this idea, making each packet a constant size and adding dummy packets as new ones are stripped off, so outgoing messages look just like incoming ones. How can you be arguing about remailers when you know so little about how they work? ><speculation: an encrypted chain could be made stronger if the next > hop header depended on which key was used to decode it. > In other words, remailer A's key will produce one next hop > address while remailer B's key will send it elsewhere. This > is a subset of the different plaintext - same cyphertext > problem - a hard problem as I understand it. Find two > distinct texts that encrypt with different keys to the > same cyphertext> That won't help. There would be no point in doing this. I'd ask you to explain, but that would just prolong the agony.

1 0

new in EFC's media archives - Mondex, crypto (fwd)
by Martin Janzen 17 Dec '03

17 Dec '03

Electronic Frontier Canada's David Jones (djones(a)insight.dcss.McMaster.CA) posted the following to the EFC mailing list: ------------------------------------------------------------------------------- New in EFC's media archives: 1. Plastic treasure ... not so smart after all http://www.efc.ca/pages/media/guardian.24sep97.html This article reports that a team in the Netherlands made a "successful attack" on a Mondex chip (Hitachi H8/3101) by activating a test mode in which the chip dumps its contents to a serial port. John Beric, security manager for Mondex simply says "I have never SEEN a report saying they have broken Mondex". (Is this plausible deniability?? ;-) The article also makes mention of EFC getting hassled by the National Bank of New Zealand over a leaked memo. In the mean time, Mondex is trying to ramp up deployment of its new chip, the Hitachi H8/3109, which (for the first time apparently) implements public key crypto. 2. If cops can read E-mail, so can the bad guys http://www.efc.ca/pages/media/gazette.24sep97.html Some coverage of the "crypto" issue in the context of a major international privacy conference held in Montreal last week. EFC scored some coverage for its position statement on crypto: http://www.efc.ca/pages/crypto/policy.html including a quote in favour of strong crypto: "There is a far greater risk to individuals, businesses, and the government if we are unable to effectively prevent criminals from gaining unauthorized access to our records and communications." -------------------------------------------------------------------------------

4 4

Re: Remailers and ecash (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 2 Oct 1997 06:35:55 +0200 (MET DST) > Subject: Re: Remailers and ecash (fwd) > From: nobody(a)REPLAY.COM (Anonymous) > The question is will people pay money for this. Nobody gives a damn if you > think it's useful or not. Shure they do because one of the things I would love to do is run a commercial anon remailer. If I as a businessman motivated to get into it can't justify it how in the world can somebody with less technical experience justify it? How would you justify it to your bank for a $10k loan? I suspect that if I can find a way to overcome my anal retentive penny pinching then it will sell others as well. > The customer is always right, and all that. You obviously have never done business with me. I've turned more than one customer away because they were either stupid or wanted something that was completely out of line. I provide my customers a specific set of services at specific fees with specific results, period. If they don't like the way their baby looks that is their problem, I just deliver 'em. I do this out of love, not a need to feed. <trivia: Bill G. once said that the computer industry was the only industry that ate its children> > Obviously, some people had a reason to take the time to write those thousands > of posts, the question is will they pay the remailers to post them. Depends on their motivation...a question we all seem to be grappling with. If it's possible I am shure that one of the thousands of posts that we generate on this issue will be the trigger. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Possible Security Hole in Internet Explorer 4.0
by Martin Minow 17 Dec '03

17 Dec '03

>From a message in MacOSRumors <http://rumors.netexpress.net/> (I have not independently verified this) --- Begin quote --- Internet Explorer 4.0 ships with major security hole.... With the Microsoft Internet Explorer 4.0 for Windows release only hours old, users have already discovered a major security hole that smacks painfully of Big Brother: Most folks will remember the Netscape java bug that allowed you to snoop on what people where visiting. Well IE4.0 goes a bit further than this - Logging of your actions, even when you would otherwise be shielded by proxies is BUILT-IN. The channel definition format (.CDF) http://www.microsoft.com/standards/cdf-f.htm includes a LOGTARGET feature that allows a web site provider to make your browser deliver logs of your usage via an http post or put. Even hits from cache are logged. This is all not so good and getting worse. Not only is the information posted material, you wouldn't want to give to a provider, (considering) "http post/put" is normally spoofable anyway. Unanswered question for next time - or for folks with more time than me to follow up Can you put other sites in your channel definition and get logs of when they read your competitor's site (with this system)? Definitely not confidence-inspiring. It appears the Mac version is affected by this same problem, as well...and neither platform has any means of disabling this "feature" at present. --- [Internet Explorer 4.0 has not yet been released for the Macintosh platform.] Martin Minow minow(a)apple.com

1 0

Re: "Show me an example of terrorists using the Internet or crypto"
by alexlh＠yourchoice.nl 17 Dec '03

17 Dec '03

In article <34302d8d.8163438(a)newshost.cyberramp.net> you wrote: [lots of ranting deleted] : Banning guns because criminals might use them equates to banning : encryption because criminals might use it. And if you really believe : that both should be banned, then perhaps you should be banned from : using oxygen, because criminals breath it too. You people just don't get it do you? A gun has one purpose: To kill. Just like any other tool, a gun, if it is available _will_ be used at some point. So making sure there are lots of guns around only serves to make a lot of people very dead. This is a Bad Thing. Gun control laws are not the issue. It's a matter of mentality. In Europe, where we have rather strict guncontrol laws, and have had them for a long time a decent human being will not even think of shooting someone else. In the US, where guns are tradition and part of the American way, many people would not think twice before shooting someone. The result of this is that the number of people getting killed by guns is enourmous, be they criminals, little kids, old grannies, or presidents. This sucks. We are not trying to export our stupidity, we're just trying to explain to you how we live. We live in a place where we don't even have to think about getting a gun, because the chances of us encountering a gun in the hands of an adversary are negligible. Wake up and smell the coffee, dude. If you have lots of guns around, you're gonna end up with lots of people getting shot. Alex --- /// I dabble in techno-house and sometimes, /// I do that badass hip-hop thang... /// But the F U N K gets me every time!

13 19

Re: Forwarded mail...
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/2/97 11:36 AM, Mark Rogaski (wendigo(a)ne-wendigo.jabberwock.org) passed this wisdom: >An entity claiming to be Brian B. Riley wrote: > >:: ... nothing personal, but why is it people keep deluding >themselves : with the idea that they can shoot to wound. You cannot >know what a > >Because that's what all the cops on TV do. Most people see >non-lethal leg shots on TV all the time, so they assume that it's >probable. Even worse was "The A-Team" where hundreds of rounds were >fired, but no one ever got hurt. It was intended to reduce the >amount of violence on TV, but (in my opinion) only made gunplay >seem like a safe recreational activity. ... oh, I well know the answer to the question ... just waxing a little bit rhetorical ... I would seriously like to be there to look into they eyes of the yahoos who so bithely espouse dropping the hammer on a person right after they have watched the life drain from someones eyes the for very first time and see just how well they feel and how cocky and cavalier they still are. I wouldn't wish that burden on anyone. You just can have no idea unless you have been there. We send men off to war and then get all upset when so many come back with there brains on crooked ... the sheeple have no idea what they have done to these men (and now women) !!! -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDQS3sdZgC62U/gIEQLMfACdEDkNNtzbeccxGJGcuvuUkp810IoAoJZV 0HbGxZ0ogu2gzzGNIYhilxM+ =8vrU -----END PGP SIGNATURE----- Brian B. Riley --> http://www.macconnect.com/~brianbr For my PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "...error reading WinOS. (A)bort, (R)etry, (M)acintosh?"

1 0