- cypherpunks-legacy - lists.cpunks.org

IP: US Easing Bank Rules on Big Cash Transactions
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Mon, 05 May 1997 15:44:45 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: US Easing Bank Rules on Big Cash Transactions Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: New York Times http://www.nytimes.com/yr/mo/day/news/financial/cash-transactions-reuters.h… September 22, 1998 U.S. Is Easing Bank Rules on Big Cash Transactions By REUTERS WASHINGTON -- The Treasury Department announced Monday that it was trimming its requirements for reporting large cash transactions. The measures had been introduced to try to curb money laundering. Banks had criticized the requirements, the Treasury said, "because they mandated repetitive paperwork" for routine transactions. The changes will lighten the banks' paperwork load but will make bankers responsible for acting as monitors and reporting anything to the authorities that they think is out of the ordinary and that might indicate criminal activity. The new rules will permit banks to conduct most transactions with "cash intensive businesses" without having to report to the Government under the 1970 Bank Secrecy Act. But banks will still have to file reports on transactions of $10,000 or more with individuals and with certain types of businesses. "This rule does not exempt banks from reporting suspicious activity involving those exempted activities," the Treasury said. "In addition, certain categories of businesses, such as real estate brokers, automobile dealers and money transmitters, may not be exempted." The reporting requirements were originally established to help law enforcement officials combat money-laundering by drug dealers and other criminals who pass large amounts through businesses and banks to give an appearance of legality. The new rules, published today in The Federal Register, will permit a bank to exempt a domestic business that routinely needs large amounts of cash simply by filing a form stating that the business is exempt. The business must have been a customer of the bank for at least a year. Banks, savings institutions and credit unions can begin using the new rules on Oct. 21. The Treasury said businesses exempted from reporting rules by a bank must have their exemptions reviewed every two years. But it said it was dropping a requirement that banks include details about all of a customer's transactions on the renewal form. In 1997, the Treasury said, more than 12 million currency transaction reports were filed. It said that as a result of the latest rules changes, as well as an earlier streamlining of reporting requirements for transactions between banks, financial institutions should be able to reduce such filings by about 30 percent. Copyright 1998 The New York Times Company ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

CANADIAN PRESS REPORTS (was Re: CSE gets flak on TV)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 17 Nov 1995 anonymous-remailer(a)shell.portal.com wrote: > > Hmm, actually the news tape is reading a little strange here in Canada. > > Not AP, or REUTERS, but simply the Canadian Press newswire. [snip] > Taking three successive news stories from three days ... (press stories, > I've since pulled for my own reference) and pasting them together to > indicate some type of Machiaevellian?? (sp) exercise is simply "not done." I still feel such a sense of violation with what LD did, such an utter sense of helplessness at the character assassination I've suffered at his hands, that I feel that I must take some token action to "set the record straight". Something which clears my name. Here is the TRUE unedited story for the list which Deitweiler felt he had to TWIST to the nth degree. His attempt at making mountains out of mole hills will not succeed with this one. I won't have him attack me, and attack everything I'm trying to achieve on this list, through his games. It's a non-starter from the get go, LD. Here's what was truly written ... let the list decide for itself. COMMUNICATIONS SECURITY ESTABLISHMENT Canada spied on allies: ex-agent Top secret security agency accused of eavesdropping on South Koreans by former analyst The Canadian Press TORONTO Canada's electronic espionage agency has spied on friendly countries such as South Korea, Mexico and Japan despite Ottawa's denials, a former agent has told CTV News. "I have lived with this information for so long and I just think that it is time that Canada knows what CSE is doing, " Jane Shorten said in a report for broadcast late Sunday. Shorten, 38, worked as an analyst from 1986 to 1994 -- when she was laid off -- for the Communications Security Establishment (CSE), CTV reports. A separate entity from the better known Canadian Security Intelligence Service, CSE can be described as a technological peeping tom. It specializes in electronic espionage, monitoring radio and other transmissions for useful information. The Soviets and their allies were once the prime targets of such surveillance, but after the thaw in the Cold War, CSE shifted its attention to friendly countries, Shorten told CTV. The agency spied on Canada's allies and trading partners, eavesdropping on friendly embassies, consulates, diplomats in Canada and around the world, she said. Ottawa denies it. "Countries like Canada have understandings that they don't carry out these activities against each other, " Solicitor General Herb Gray said earlier this year in response to claims that the U.S. Central Intelligence Agency had spied on the Japanese delegation during auto trade talks in Geneva. Replies Shorten: "He does not know what's going on because CSE is certainly doing that ... I spied on the (South) Korean government for the Canadian government." CSE is part of the Defence Department but Shorten insists senior officials at the Foreign Affairs Department were fully aware of its activities and anxious for its information. "I know my reports went to the Ministry of Foreign Affairs," Shorten told CTV. "My reports were classified as Top Secret Umbra and that's as high as you can get, and these people were cleared to get that kind of information." Shorten, once described by a superior as a gifted intelligence analyst, told CTV she was aware her revelations could result in prosecution under the Official Secrets Act but felt the risk of prison was worth it. "I feel so strongly that it's time that people learned what CSE is all about," she said.

1 0

Re: COE Recommendation No. R (95) 13
by viking＠pacifier.com 17 Dec '03

17 Dec '03

>>MS> However, if I have a wall safe and >>MS> they get a warrant to search it, can I be jailed for contempt if I >>MS> don't give them the combination? >> >> Well, IANAL, but yes, I believe that you can be. Or, worse, >>obstruction of justice. Especially if they cut it open and find that >>the knife was in the safe. > >So presumably the same would apply to the password that unlocks my >PGP private key. But there's an interesting twist. Once they open >up the wall safe, they can see for sure what is and isn't in it. This >ain't necessarily so for an encrypted file. Suppose my software has the >fiendish sophistication to disgorge different keys depending on what >password was given, and different pieces of cleartext depending >on what key was used. (Again, I apologize if this notion has already >been extensively discussed.) Is there a way to set it up such that >the cops couldn't be sure -- even using a logic analyzer -- that I >hadn't given them the complete set of keys, so as to read all the >cleartexts in the file? Assume that cyphertext files are guaranteed >to be larger, by some random factor, than the sum of all the cleartexts >in them, so the mere fact that a smaller quantity of cleartext was >disgorged than cyphertext supplied would tell them nothing. I guess this >is a kind of steganography, isn't it? Or at least something similar -- >the point would be that they couldn't tell genuine cyphertext from >camouflaging noise, without the key that tells them where to look. > >Which brings us, in turn, to the bottom line: the only things we >can be certain the bad guys _won't_ do, are the things they _can't_ >do. > > >--Michael Smith The interesting thing about PGP is that any incriminating cypher text one might have on his or her hard disk would, most likely, be in someone else's public key. So, even if they had your secret key the only thing that could be uncovered would be cyphertext that someone else had written to you. Granted, that this could be incriminating but, then again, not necessarily. I'm sure that for the purposes of conducting a criminal investigation, your own cyphertext would be far more incriminating than someone else's. (The above is only true unless you use the single key encryption option offered for personal files in which case your files would be readable.) What one should be more concerned with is sloppy handling of plain text files used prior to encryption. A good example of that is if you're using Windows based applications such as MS Winword. It has an auto-store function that generates a "Temp" file. Such files aren't wiped in the same fashion that PGP uses when it wipes a text file prior to encryption. I think that the paramount thing to consider is if you have something to hide then it is best to store it is inside your head. Any computer based storage system is bound to have certain limitations that may be bridged by a determined government agency. The other alternative is to ensure that potentially incriminating files be purged regularly to avoid such potential problems. Robert East viking(a)pacifier.com

1 0

Air Force hacks Navy? Eeeek!
by Light Ray 17 Dec '03

17 Dec '03

Read this. It's from the Electronic Telegraph, a neat web site in the UK. This article was later posted to comp.risks, and hence, Risks Forum digest, which is where I found it. The paragraphs have been numbered for easy reference. ---------------------------------------------------------------------------- (paragraph 0) http://www.telegraph.co.uk/et/ (paragraph 1) A few clicks and then the e-mail message entered the ship's control system... War of the microchips: the day a hacker seized control of a US battleship (paragraph 2) BY SIMPLY dialing the Internet and entering some well-judged keystrokes, a young US air force captain opened a potentially devastating new era in warfare in a secret experiment conducted late last September. His target was no less than gaining unauthorised control of the US Navy's Atlantic Fleet. (paragraph 3) Watching Pentagon VIPs were sceptical as the young officer attempted to do something that the old Soviet Union had long tried to do and failed. He was going to enter the very heart of the United States Navy's warships - their command and control systems. (paragraph 4) He was armed with nothing other than a shop-bought computer and modem. He had no special insider knowledge but was known to be a computer whizzkid, just like the people the Pentagon most want to keep out. (paragraph 5) As he connected with the local node of the Internet provider, the silence was tangible. The next few seconds would be vital. Would the world's most powerful navy be in a position to stop him? (paragraph 6) A few clicks and whirrs were the only signs of activity. And then a seemingly simple e-mail message entered the target ship's computer system. (paragraph 7) First there was jubilation, then horror, back on dry land in the control room at the Electronic Systems Centre at Hanscom Air Force Base in Massachusetts. Within a few seconds the computer screen announced "Control is complete." (paragraph 8) Out at sea, the Captain had no idea that command of his multi-million-dollar warship had passed to another. One by one, more targeted ships surrendered control as the codes buried in the e-mail message multiplied inside the ships' computers. A whole naval battle group was, in effect, being run down a phone-line. Fortunately, this invader was benevolent. But if he could do it ... (paragraph 9) Only very senior naval commanders were in the know as the "Joint Warrior" exercise, a number of experiments to test defence systems, unfolded between September 18-25. Taking over the warships was the swiftest and most alarming of the electronic "raids" - and a true shock for US military leaders. "This shows we have a long way to go in protecting our information systems," said a senior executive at the airbase where the experiment was conducted. (paragraph 10) The exact method of entry remains a classified secret. But the Pentagon wanted to the first to test the extent of their vulnerability to the new "cyberwarriors" - and had the confidence to admit it. (paragraph 11) Now they believe they know what they are dealing with and the defences are going up. (paragraph 12) Reply to Electronic Telegraph - et(a)telegraph.co.uk Electronic Telegraph is a Registered Service Mark of The Telegraph plc -------------------------------------------------------------------------- This sounds very fantastic, like the plot of a movie. Indeed, _Hackers_ featured a "worm" that took over control of the ballast of oil tankers. Perhaps this is a case of a journalist being a good writer but not fully understanding the topic at hand. Does anyone know how true this article is? Or where we could find more info? If it is true, then this is almost scary. Let's pick the article apart: In paragraph (1), the author refers to "the day a hacker siezed control over a US battleship." I assume that "hacker" and "battleship" are being used loosely, as, as noted in an IW-list posting that I received a few minutes ago, there are no currently active US battleships. (?) In paragraphs (2) and (5), the author refers to the "hacker" "dialing the internet" and "[he] connected with the local node of the Internet provider." This implies that the whole operation was conducted over the internet. Do battleships even have internet connections? They may. But the military certainly wouldn't dialup through a civilian ISP where their data goes through unknown hands to perform a very secret operation. Everything is doubtlessly encrypted - was the attack performed with or without keys? Or was the crypto somehow bypassed? The intruder is referred to as "young US air force captain" in par 2, a "young officer" in par 3, a "computer whizzkid" in par 4, an "invader" in par 8, and a "cyberwarrior" in par 10. Who was he? I would assume that it was more likely a group of people who were "in the know." Even the average "Joe Hacker" (is there such a thing?) would have trouble controlling a "batteship" let alone through an ASCII connection. In par 2, the author states that the intruder was attempting to gain "unauthorised control of the US Navy's Atlantic Fleet" (sic). If these were indeed "Joint Warrior" experiments, then it would be authorized. Throughout the article, references are made to the attack beginning with "a simple email message." This could be possible, but it seems that a higher means of control would be necessary. Anyhow, the whole article seems factually incorrect. I'm very interested in finding out more on what ACTUALLY happened, tho.. Tobin Fricke fricke(a)roboben.engr.ucdavis.edu

4 3

Re: taking electronic privacy into our own hands
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 15 Dec 1995, Eric Anderson wrote: > Would it be possible to write a program ( i.e. a worm or > Trojan) to ferret out personal information that is stored in databases > and encrypt it? > > I was just wondering what such an undertaking would entail. Actually, there is no need to write any such code. AT&T distributes just such a beast to any and all comers. It can take personal information and send it out over a secure socket layer. I think a couple of partners in crime, Cheswick and Bellovin of AT&T research had a hand in its continuing distribution. > Eric Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re:
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

> [snip] > There is a company called Optoelectronics that markets a radio reciever > called the Interceptor. This is a broad band (several hundred MHz) > device designed to lock on to the most powerful signal around, > regardless of frequency. As supplied, it only has a rubber duck > antenna, but a broadband, directional antenna (Log Periodic?) could be > attached. There are AM and FM versions that output audio and a version > called the Scout that controls a scanner. These could have outboard > devices hung on to them to decode digital signals, record the > conversation ... all for less than $1000. > > > > Floyd D. Barber > floyddb(a)alpha.c2.org > Key fingerprint: > 8A 98 1F 6B 70 7A FE 24 > 35 D4 48 CF 9D F6 B0 91 The problem with the Interceptor is that I think it can only receive one freqency at a time, and it is adjustable by a thumb wheel, not digitally. This would tend to make changing frequencies at high rates VERY hard. :) Also it has no frequancy readout, so this means that if you know what freq. you should be at it is hard to tune in that freq. without searching a little. Dr0id ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

1 0

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

PGP timeline FAQ... comments requested
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

There seems to be much confusion amongst some of the newer users of PGP who frequent alt.security.pgp, and recently whilst delving in to give my version of how it happened my post got longer and longer, until it grew on the spur of the moment into a sort of FAQ. I got a few comments, and corrections from that post, but I thought there are likely to be people who know more annecdotes and were around at the time that RSA was being published in the face of NSA opposition, etc. Let me have your comments on the accuracy, plus any annecdotes which you think really should go in to give the correct feel for the historical timeline. Thanks, Adam ====================================================================== PGP timeline and brief history ====================================================================== contents: 0 Definitions of acronyms 1 History of crypto as it applies to PGP 2 Birth of PGP 3 USG decides they don't like PRZ 4 PRZ, MIT and RSA sort out earlier patent issues 5 Current legal status 6 ITARs viewed from inside the US 7 ITARs viewed from outside the US ====================================================================== 0 definitions of acronyms ====================================================================== PGP = Pretty Good Privacy PRZ = Phil R Zimmermann, internet folk hero, author of PGP RSA = The RSA public key algorithm as used in PGP RSADSI = rsa.com, RSA Data Security Inc, patent holders of some public key stuff, which they claim means that no one can use RSA without getting a license from them. PKP = public key partners RSADSI plus Cylink (plus others?) (now disbanded) ITAR = International Traffic in Arms Regulations controls export of controlled munitions from the US, things like military aircraft components, biological and chemical weapons, and also (very strangely) cryptographic software. PK = public key (crypto) NSA = US National Security Agency, US govt's largest spook agency. whimsically known as No Such Agency, because until recently the US govt tried to deny they even existed. OTDC = Office of Defense Trade Controls, USG group charged with enforcing ITAR. They consult with the NSA, the NSA has the last word on what gets export approval. ====================================================================== 1 History of crypto as it applies to PGP ====================================================================== 1.1 The year is 1976 a cryptographer, and privacy advocate named Whitfield Diffie, together with mathematician named Martin Hellman discovers public key cryptography. (DH key exchange is still a commonly used key exchange protocol -- DH = Diffie-Hellman). 1.2 1977 Ron Rivest, Adi Shamir, and Len Adleman discover another more general public key system called RSA (after surnames Rivest, Shamir, and Adleman). R, S & A were researchers at MIT (significant later, because MIT had part ownership of patents.) 1.3 NSA tells MIT and R, S & A that they'd better not publish this or else. 1.4 Amusingly Adi Shamir (A from RSA) isn't even a US citizen, he's an Israeli national, and is now back in Israel at the Technicon (is he, anyone know his current affiliation?) Who knows what the NSA would have done about him if they had succeeded in supressing RSA - not allowed him out of the US? 1.5 MIT and R, S & A ignore NSA and publish anyway in SciAm July 1977. Comms ACM (feb 1978, vol 21, no 2, pp 120-126 in case you want to see if it's in your library - it's in Exeter Univ (UK) library). 1.6 Because the publication was a rush job due to the NSA, R,S & A and the later formed PKP and RSADSI lose patent rights to RSA crypto outside the US. This is because most places outside the US, you have to obtain a patent *before* publication, where as in the US, you have one year from the publication date to file for patents. This also had implications for PGP later 1.7 IDEA was developed by Xuejia Lai and James Massey at ETH in Zurich. (Relevant to PGP because IDEA is the symmetric key cipher used together with RSA in PGP). Also crypto politics relevance in that it is another (of many) examples of the fact that crypto knowledge and expertise is worldwide, ie why export restrict something which is available both sides of the ITAR fence, or even originated *outside* it? (Strangely, ITAR applies to importing and then re-exporting a crypto system, even if no modifications are made). There are lots of other symmetric key ciphers, IDEA is one with a good reputation (no known practical attacks better than brute-force to date, and a good key size), and is just referenced here because of its use in PGP. (some years pass...) ====================================================================== 2 Birth of PGP ====================================================================== 2.1 PRZ wrote PGP 2.2 PRZ gave PGP to some friends 2.3 some friends up loaded onto a few bulletin boards (US only) One friend (allegedly Kelly Goen) went around pay-phones with a portable, an acoustic coupler, and a list of BBS phone numbers uploading and then driving on to another area. This cloak and dagger stuff was because at the time the USG had some draconian sounding proposed law on the books which sounded like it was going to outlaw crypto. The intention was to ensure that PGP was available before this law came into effect, and to avoid being stopped if the USG took interest. 2.4 somehow PGP leaked outside the US via the internet. Information wants to be free, as someone said: `trying to control the free flow of information on the internet is like trying to plug a sieve with a hole in it'. Also Tim May's quote 'National borders are just speedbumps on the information superhighway' expresses the point very nicely. 2.5 people all over the world (yeah outside the US too) start using PGP 2.6 RSA complains to PRZ that PGP violates their PK patents 2.7 PRZ tells RSA to get stuffed, says its the users problem to get a license 2.8 PGP is considered potentially patent infringing because of 2.6 2.9 Illegality taint increases the spread of PGP, generates news, more people get a copy to see what the fuss is about (some time passes, PGP gets real popular...) ====================================================================== 3 USG decides they don't like PRZ ====================================================================== 3.1 US govt decides that they don't like PRZ because the NSA can't tap all those internet mail messages anymore. (the NSA part is speculation, but in my opinion likely true). 3.2 US govt begins investigating PRZ for alleged aiding with ITAR violation. 3.3 Phil Zimmermann legal defense fund set up to cover his legal expenses 3.4 still on going... (concurrently...) ====================================================================== 4 PRZ, MIT and RSA sort out earlier patent issues ====================================================================== 4.1 MIT and PRZ work with RSA to sort out patent issue. 4.2 A solution is obtained in that RSA agree that PGP can use RSA provided that their RSAREF library is used. 4.3 PGP2.5 is written which uses RSAREF in place of MPILIB (also has backwards compatibility with older versions impaired to discourage use of older allegedly patent infringing versions - to keep RSA happy) 4.4 RSAREF may be slower, but at least with some negotiating by PRZ and MIT, PGP is now 100% legal in the US 4.5 MIT begins acting as official US distributor of PGP 4.6 As usual, a few milli-seconds (well okay, minutes) after the official release of a new version of PGP, it gets exported from the US. 4.7 The deal with RSA over RSAREF has fixed the patent related problems in the US, but it has created a copyright related problem outside the US, (recall 0.6). RSAREF is a software package copyrighted by RSA, and RSA is not allowed to export it because of ITAR, and their license agreement says as much (ie it says that you must not export it, and if you do export, you, and the subsequent users of it, are in breach of license). It is therefore supposed that RSA could if they wanted complain about this (who knows that they would want to, or what conceivable benefit it would give them if they did). This isn't enough to bother most people, but commercial users, and big organisations have lawyers, and are wary of such things. 4.8 Staale Schaumaker put together pgp26i to avoid this problem. Main difference between pgp26x and pgp26xi is that pgp26xi uses PRZs original big integer library MPILIB, which is any case faster than RSADSI's RSAREF, and the lack of the legal kludge noted in 3.3. ====================================================================== 5 Current legal status ====================================================================== 5.1 PGP is legal both inside and outside the US. You just need to use pgp26 versions inside the US, and pgp26xi versions outside the US. 5.2 In the US if you are using PGP in a commercial setting, and care about patents, you should purchase a copy of ViaCrypt pgp2.7 5.3 Commercial use outside the US: RSA is free, in the PGP docs (pgp262i & pgp262) Ascom-Tech are quoted as saying that currently no license is required for commercial use of PGP outside the US as far as they are concerned. Ascom-Tech are the patent holders of IDEA (see 1.7), the symmetric crypto system used by PGP. ====================================================================== 6 ITARs viewed from inside the US ====================================================================== 6.1 ITAR means that if you are in the US you should not export PGP. (Yeah it's already available on a few thousand ftp sites around the free world, so another export isn't going to make any difference, but the NSA and the ODTC might not see it in that light). 6.2 Even though controlling the export of freeware software available worldwide might seem incredibly stupid (not to mention pointless), you should bear in mind that the penalties for getting successfully prosecuted for violating ITAR are rather steep. Up to $1,000,000 (US$) fine, and and up to10 years imprisonment per count of export. 6.3 They'd probably never do anything to you, PRZ is just a scape goat (someone they can symbolically persecute to discourage others). I have personally seen several people from US sites post crypto source and binaries (nautilus, PGP itself even). Plus of course this: #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length$n&~1)/2) has probably been exported a few hundred thousand times by now. (It's an implementation of RSA encrypt and decrypt in perl and dc - a real crypto system, which has every right to claim ITAR status if anyting does, and yet benefits from being more convienient to use as a .sig than a uuencoded PGP binary) ====================================================================== 7 ITARs viewed from outside the US ====================================================================== 7.3 If you are outside the US, ITAR probably doesn't apply to you. You could, if you could be bothered, down load PGP from a US site, and short of attempting an extradition for violating a regulation which only applies in the US, there would be nothing the NSA, or USG could do about it. Most extradition treaties tend to rely on the action being prosecuted being illegal in both countries. 7.4 Yeah, I know `tell that to Manuel Noriega' (a Panama citizen who was kidnapped by a USG undercover agents and brought to the US to face trial for importing/exporting drugs from Panama into the US. He broke no Panamanian laws, he is a citizen of Panama, and was in Panama when he committed his crime, and he is now languishing in a US jail). However, he was kidnapped for a number of reasons: 1. the USG thought they could get away with it (Panama owed them a few favours) 2. politically easy to pass of acts of aggression (kidnap by civilised countries in this day and age?) in the name of the `War on Drugs' 3. they thought it was worth it. Some of these criteria are likely to be missing if there was an attempt to extradite a non-US citizen outside the US for breaking ITAR. One big problem is that crypto is not controlled as much in most of the free world. Also the fact that the USG haven't bothered other people within the US who have similarly exported crypto software (examples cited in 6.3) would make the whole situation look rather silly. 7.5 A more important consideration is that although a non-US downloader of PGP from a US site would be effectively immune to the ITAR nonsense, the owner of the (US based) ftp/www site may not be. You might get the site owner in trouble for not taking adequate precautions. So politeness demands that you don't do it. 7.6 Indeed why bother anyway, because PGP is available from literally thousands of ftp sites, there is bound to be a closer (and hence likely faster download) copy, without any hoops to jump though. ====================================================================== Long live the Pretty Good revolution, Adam Back <aba(a)dcs.ex.ac.uk>

3 2

Re: Massey, CEO of Compuserve, on Internet
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:20 12/31/95, Mark Neely wrote: >I assume that C$ is only filtering the newsfeed as it hits German shores? >Please tell me >they aren't denying access to these "banned" newsgroups for all users >worldwide! I am afraid they are. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Navy hacked by Air Force?
by vin＠shore.net 17 Dec '03

17 Dec '03

Drescher/Cohen/Drescher/Drescher/Cohen/Cohen.... I'm new to C'punks, so I don't yet have a grip on the context in which you consider privacy, property, and other ultimate values. I do wonder, though: Do you spend a lot of time pissin' on each other's shoes like this?

2 1