- cypherpunks-legacy - lists.cpunks.org

Re: Security flaws introduced by "other readers" in CMR
by Anonymous 17 Dec '03

17 Dec '03

Let's look a little closer at the kinds of access and notice available in the PGP system compared to alternatives. As several people have pointed out, no encryption system can provide protection against what is done with the message after it is decrypted. The receiver could share it with whoever he wants to, or whoever he is forced to. Consider the following scenarios: - An encrypted message is sent to someone at his workplace using current systems like PGP 2.6. - An encrypted message is sent to someone at his workplace, who is using the message access features of PGP 5.5. The corporation key is marked as "optional", and the message is not encrypted to that extra key. - An encrypted message is sent as before, but this time the message is encrypted to the corporate key. - An encrypted message is sent to someone at his workplace, who is using a different form of corporate access which relies on key escrow or automatic acquisition of cleartext. We agree that none of these systems can provide complete protection against third party access. In any of them, the receiver could be forced to turn over the encrypted message. But there is still a difference. In the first two scenarios, the expectation of privacy is the same. You are encrypting to a personal key at a business address, but you expect that you would know about it if the data were being provided to a third party. There is no widespread installed base of software which provides secret access after the message is decrypted. In fact, the second scenario arguably provides slightly more privacy than the first, which is what we have now. The reason is that in the second scenario, the company provides an optional mechanism for business mail to be recoverable, but also provides an explicit, sender-controlled escape clause. The company is granting an explicit expectation of privacy by allowing the corporate key recipient to be removed. With usage of older versions of PGP, there was really no way for the company to even inform the sender about whether it was going to be reading the mail. In the third scenario, where you encrypt to the corporate key, there is no expectation of privacy. All parties, the sender, the receiver, and the company, know that the data is being made available to the business. There is not much privacy here; what you have is business security. This mode would be used for business documents and business communications. In the fourth scenario, which some people are offering as a superior approach, the expectation of privacy is much less clear. Unlike in the current PGP approach, where the design of the corporate access system is oriented around notifying the sender and receiver, a key escrow or plaintext recovery system inherently provides no such notice. This is different from the status quo. We are talking about a commercial product which provides automatic corporate access to communications. Widespread installation and use of this alternate version of PGP inherently changes the assumptions and expectations that you will have when you encrypt to someone at work. Given the company's desire for message access, this approach implies that you must conservatively assume that most encryption to a business address will be read. The PGP system is designed to avoid this. It provides another method for corporate access, a visible and explicit method. It is intended as an alternative to key escrow and other systems which recovery data after the recipient gets it. PGP's third party recipient feature is designed to prevent the creation of an installed base of escrowed keys and after the fact third party access software. Even if the encryption system provides a way for the user to mark his keys as being escrowed or otherwise providing third party access, the system is not self-correcting in the way the PGP system is. It would be much easier for a business owner to pervert a secretive access system than one like PGP. The company could install the access features but not tell its employees that their keys were being escrowed, or that their mail client was secretly storing a copy of all plaintexts. This kind of change would be easy to make with the after-the-fact access systems some people are proposing. Yes, theoretically this can be done with any encryption system (as all agree) but the point is to avoid the widespread distribution of software which invites this kind of abuse. The PGP system is designed to satisfy business needs without leading us into this dangerous situation. A world in which third party encryption by the sender is the normal and widespread method for corporate access is one with increased privacy and more visibility of access. The alternatives which have been proposed are prone to abuse and provide less visibility. They lead us towards a world in which there is no expectation of privacy even for encrypted messages, by providing an installed base of snooping software. The PGP approach is explicitly designed to keep us out of that world, by removing the need for that kind of software.

3 2

(fwd) Re: KRAP is at it in the IETF
by Adam Back 17 Dec '03

17 Dec '03

A GAKker breaks cover on dbs list as a result of William Geigers heads up on the issue... The GAK apologists are very thin on the ground in public discussion forums generally, so it is nice to see the odd one speak up. Seems like they are too busy taking government handouts to implement KRAP to actually own up to their misdeeds in public, generally. Adam ====================================================================== From: "Todd S. Glassey" <TSGman(a)earthlink.net> To: "William H. Geiger III" <whgiii(a)invweb.net>, <dbs(a)philodox.com> Cc: <tom_markham(a)securecomputing.com>, "JeffreySchiller" <jis(a)mit.edu>, "MarcusLeech" <mlecch(a)nortel.ca>, "Robert G. Moskowitz" <rgm(a)icsa.net>, <tytso(a)mit.edu> Subject: RE: KRAP is at it in the IETF Date: Mon, 7 Sep 1998 13:38:50 -0700 William, Let me start with the disclaimer since I am going to vehemently disagree with you - These are my own opinions and in no way reflect my companies or our clients Opinions, etc. etc. etc. - So William - IMHO, you are missing the point totally. The IETF is an A-Political Organization investing in the development of technical standards to accomplish various networking services. As to the issue of Politic vs. Technology, by its actions alone, KRAP's demonstrated agenda with the IETF is purely technical and whether it is in furtherance of its external political agenda is really irrelevant to the IETF as and its established process as a whole. >From my vantage point, the real issue herein is your personal/moral standing with the dissolving of anonymity through Key Recovery and Government's ability to look at data that flows over a network. Remember also that it was the Government that was the primary subsidizer of said same network and everything that evolved the old 56k ARPANET into what the Public Internet is today. As another side issue, the other potentially-viable argument is that ISAKMP/IKE is so far along in its process of becoming a standard, that adding a late draft impedes the value of the work already done - Essentially that these folks (KRAP) have essentially slipped a whammy onto the stack. Is it your view that this implies that because of this later posting that the material will be exempt from the general scrutiny that the previous components of ISAKMP/IKE have been through - I don't think so... This crowd loves to do the Pit-Bull thang and shred the submitted concepts to glean the technical truth therein. If this is the issue then the answer is to work within the existing framework and to submit a public motion to the WG to freeze the ISAKMP last call efforts so that they exclude the new draft until such time as it (the GAK extensions) can undergo further scrutiny. As to the issue of the addition itself being out of line because of its late entrance into the standards arena relative to the last call and all that- Again, I disagree as to what and how - There are numerous "standard processes" in place that allow for this as well and that here in the real world, use of this ability is a very common practice. Look for instance at what happened to the last TAX REFORM effort with the addition of Senator Moyniham's SS1706 Rider, or as another example look at what congress as a whole did with the HIPAA legislation (http://www.hcfa.gov/regs/hipaacer.htm) and its embedded "legal penalties" for unauthorized disclosure of health data. Since this case is specific to the bulk distribution of data, it really applies directly to IT Directors and their staff. heck, imagine that your insurance Co.'s or hospital's IT folks could actually go to jail by the statute set here. Again here we are at the bottom line and if this is the thing you are objecting too then you need to object to the process not the event itself. As to the perversion commentary specifically... perversion is a moral issue and is not addressed by the IETF rules (RFC2026 in particular). My suggestion is that if you feel this is a problem that you address it at the POISSON WG level rather than in IPSEC or PKIX since it is a process problem, and that under the currently in-place operating rules, this thing, the filing of a new proposed component of the ISAKMP protocol is OK to do. - --- Don't get me wrong, as it happens I too believe that Key Recovery is futile effort for the government, not because it doesn't have a need for this type of capability, but because they didn't act fast enough and the "cat is already out of the bag". So any efforts to pull this one off will most likely be futile and will definitely not be cost effective for normal ECommerce operations let alone personal communications. BTW - The reality in the Intelligence Community World is that for the surveillance of the big-league terrorists, dope dealers, and the like, key recovery is useless since because they are so well funded and their access to technologies is such that they (the bad guys) can and will employ advanced technologies to get around whatever the NSA/DSIA/DoC/DoJ put in place to thwart them. As an example of this the Leopard's (sort of the Bolivian Govt.'s DEA Field Agents, et al.) found that when they attacked the labs of the Median Cartel they were out gunned and technologically overpowered to the point that without the US Military intervention they would have no possibility of thwarting these activities. Draw your own conclusions. As a point of social commentary, I understand and hear your point, but if this kind of process "invasion" as you have put it was such an issue then how come there was so little push back was done against the "Communications Assistance for Law Enforcement Act" (CALEA). I think that as a whole the people against the KRAP initiatives are there because of the cost and overhead issues, not the personal freedom ones. Thus it becomes a business issue and not a human one. The world is changing into a global society and the rules about personal freedom are evolving with it... Not everyone is going to like them but the facts are what they are and IMHO - personally I wonder more how some local constituency would respond to the invasion of their personal privacy when some "pervert terrorist" parks a recently acquired nuke or Bio-toxic Weapon from the now defunct Russian Arsenal in their backyard and pushes the #$%^&* button. If losing absolute anonymity is the cost of better safeguarding oneself and family from threats like these, what the heck. Its a very small cost to pay. My personal feeling is that since I have made the decision to live in and work with modern society as a whole, that I must follow the edicts that evolving technologies and social values/morals put in place by and for us as a whole. Otherwise our choice is real simple - If you don't like the rules, then don't play the game. Move out to the backwoods and stay out of society as a whole. I don't mean to be a putz by this, but come on... "a perversion". This isn't the place for that kind of morality issue!. Todd > -----Original Message----- > From: dbs(a)philodox.com [mailto:dbs@philodox.com]On Behalf Of William H. > Geiger III > Sent: Monday, September 07, 1998 1:24 AM > To: dbs(a)philodox.com > Subject: KRAP is at it in the IETF > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hello, > > It has come to my attention that the KRAP (key recovery alliance program) > has submitted an I-D (internet draft) to the IETF for adding GAK > (government access to keys) to the IPSEC protocols: > > ftp://ftp.ietf.org/internet-drafts/draft-rfced-exp-markham-00.txt > > ISAKMP Key Recovery Extensions > <draft-rfced-exp-markham-00.txt> > > 7. AUTHOR INFORMATION > > Tom Markham > Secure Computing Corp > 2675 Long Lake Road > Roseville, MN 55113 USA > > Phone: 651.628.2754, Fax: 651.628.2701 > EMail: tom_markham(a)securecomputing.com > > > I consider this a perversion of the standards process of the IETF to > advance a political agenda which must be stopped at all cost. > > Below are the e-mail addresses of some people that you should write > (politely) expressing your objections to any such additions to the > protocols: > > IPSEC Chairs: > > Theodore Ts'o <tytso(a)mit.edu> > Robert Moskowitz <rgm(a)icsa.net> > > Security Area Directors: > > Jeffrey Schiller <jis(a)mit.edu> > Marcus Leech <mlecch(a)nortel.ca> > > As I mentioned before, be polite. These people are not the ones proposing > GAK be added to the IPSEC protocols. They have put a lot of time and > effort in forwarding the cause for strong encryption. They should be made > aware of the communities objections to these attempts by KRAP. > > Thanks, > > - -- > - --------------------------------------------------------------- > William H. Geiger III http://www.openpgp.net > Geiger Consulting Cooking With Warp 4.0 > > Author of E-Secure - PGP Front End for MR/2 Ice > PGP & MR/2 the only way for secure e-mail. > OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html > - --------------------------------------------------------------- > > Tag-O-Matic: It's OS/2, Jim, but not OS/2 as we know it. > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.3a-sha1 > Charset: cp850 > Comment: Registered_User_E-Secure_v1.1b1_ES000000 > > iQCVAwUBNfOVk49Co1n+aLhhAQFJwwP+O4vrZVKFpOG8vCHFwbDuPIv/99AhBnKF > RK/Ikc5y2gGKq9hfxkTb4o77YUrDaEGkYUPHk+ZC57Oag0Lu1v6W1EAbQ5T4RpzH > JWYXOonQmbqw5rH0h6brzqrH3ep9Ej9DR0gv4mGgIfSNlJSUu6TWO5ZHXKWiE4yy > 5flH0Ngg/TI= > =EzNL > -----END PGP SIGNATURE----- > > Tag-O-Matic: Speed Kills - Use Windows! > > > ------- End of forwarded message -------

1 0

Re: KRAP is at it in the IETF
by Adam Back 17 Dec '03

17 Dec '03

Todd S. Glassey writes on dbs(a)philodox.com (digital bearer settlement) list: > Let me start with the disclaimer since I am going to vehemently disagree > with you - These are my own opinions and in no way reflect my companies or > our clients Opinions, etc. etc. etc. - [What company do you work for? You disclaim about your "company" and "clients" without mention of who they are? (I like to know who the GAKkers are, are you with securecomptuing.com also?)] > So William - IMHO, you are missing the point totally. The IETF is an > A-Political Organization investing in the development of technical standards > to accomplish various networking services. As to the issue of Politic vs. > Technology, by its actions alone, KRAP's demonstrated agenda with the IETF > is purely technical and whether it is in furtherance of its external > political agenda is really irrelevant to the IETF as and its established > process as a whole. I understood it this way: that IETF policy is not allow political considerations to weaken or otherwise damage security functions in IETF standards. eg. No weak key lengths for to satisfy local government politics etc. Read RFC 1984. I quote: : KEYS SHOULD NOT BE REVEALABLE : : The security of a modern cryptosystem rests entirely on the secrecy : of the keys. Accordingly, it is a major principle of system design : that to the extent possible, secret keys should never leave their : user's secure environment. Key escrow implies that keys must be : disclosed in some fashion, a flat-out contradiction of this : principle. Any such disclosure weakens the total security of the : system. : : DATA RECOVERY : : Sometimes escrow systems are touted as being good for the customer : because they allow data recovery in the case of lost keys. However, : it should be up to the customer to decide whether they would prefer : the more secure system in which lost keys mean lost data, or one in : which keys are escrowed to be recovered when necessary. Similarly, : keys used only for conversations (as opposed to file storage) need : never be escrowed. And a system in which the secret key is stored by : a government and not by the data owner is certainly not practical for : data recovery. This quoted point is kind of relevant here: "keys used only for conversations (as opposed to file storage) need never be escrowed" Now we move on to your GAK apologist arguments... > Remember also that it was the Government that was the primary > subsidizer of said same network and everything that evolved the old > 56k ARPANET into what the Public Internet is today. "Government" is composed of public servants. This citizen-unit doesn't want to fund spooks to spy on himself. > The world is changing into a global society and the rules about > personal freedom are evolving with it... Not everyone is going to > like them but the facts are what they are and IMHO - personally I > wonder more how some local constituency would respond to the > invasion of their personal privacy when some "pervert terrorist" > parks a recently acquired nuke or Bio-toxic Weapon from the now Oh give us a break! You already admitted that terrorists are going to use whatever crypto they want whether or not governments succeed in ramming GAK down our throats. > defunct Russian Arsenal in their backyard and pushes the #$%^&* > button. If losing absolute anonymity is the cost of better > safeguarding oneself and family from threats like these, what the > heck. Its a very small cost to pay. Perhaps you would think that video cams in all the rooms in your house (with feeds back to NSA) would be a good idea also,... well you install them, at your cost, and leave us out of your eavesdropping plans, ta very much. Adam

1 0

h
by CRBREW9802＠aol.com 17 Dec '03

17 Dec '03

how did u do it

2 1

No Subject
by Mix 17 Dec '03

17 Dec '03

Timothy C[ocksucker] Mayhem's reheated, refurbished, and regurgitated cud is completely inappropriate for the mailing lists into which it is cross-ruminated. _ O Timothy C[ocksucker] Mayhem (_ | -'_/ X-

1 0

[MilCom] MRE's, KCMO, VA Hospitals
by Jaggedrock＠aol.com 17 Dec '03

17 Dec '03

Fellow radio enthusiasts of all the above nets, In the past week I have learned of MRE stackpiling in a natural limestone cave in the Kansas City Missouri area. A 4 month government (don't know the specific agency) contract it would appear, that will result in excess of 35,000,000 MRE's having been stored in the cave. That's enough to feed 500,000 for 22 days roughly. Further, I have learned that, apparently, 23 VA hospitals that are closed (don't know where and don't know the names) are being converted into food storage facilities with all of the equipment having been removed and a special coating being applied to the interior surfaces to enhance storage life. Having said that, any fecom, milcom activity that would shed light on this activity? Any KCMO monitors hearing anything? Anyone in KCMO area that would like to try to find out more and advise the rest of us accordingly? Thanks, jaggedrock(a)aol.com (Sangean ATS803A, Uniden 100XLT, Uniden Bearcat 895XLT Trunktracker, 48 foot roof mount dipole, roof mount Scantenna 25 feet aloft, all low loss cable feeds - plus good human eyes and ears). --- Submissions milcom(a)qth.net

1 0

cryptographically secure mailing list software
by Matthew James Gering 17 Dec '03

17 Dec '03

I've been curious as to whether anyone has developed and/or whether it is technically feasible to develop a cryptographically secure listserver. e.g. User would submit their PGP public key to the listserver upon subscription, submitted messages would be encrypted with the listserver's public key, the listserver would decrypt the message and re-encrypt it with the key of all members and distribute it. This way the users don't need to manage all the keys or even know the list membership. Most listservers already have the ability to moderate subscription messages, the list would not be snoopable. What sort of overhead would exist on a list of a few hundred members? If there is not something existing that will do this, what is the best mailing list codebase to start from? Majodomo I imagine might not be up to the task being written in Perl, LSoft ListSERV I love but it is commercial (no sourcecode). Matt

2 1

A question about gas warfare in San Fran in '66...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Here in Austin we have a local radio dj who does a public access show on various issue localy and nationaly, Alex Jones, who has put a piece on some sort of bio-weapon test that occurred in '66 in San Francisco. He is claiming that deaths resulted. Anyone have a clue what he's talking about? ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

4 3

IP: Wired: "The Y2K Solution: Run for Your Life!!"
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Tue, 08 Sep 1998 18:38:07 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: Wired: "The Y2K Solution: Run for Your Life!!" Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: Wired http://www.wired.com/wired/6.08/y2k.html F E A T U R E|Issue 6.08 - August 1998 The Y2K Solution: Run for Your Life!! By Kevin Poulsen Scott Olmsted is dressed to do some serious debugging: comfortable khaki shorts, a T-shirt from a Visual Basic conference, and a visor from one of his Silicon Valley employers. But we're a long way from the land of cubicles and industrial parks. In fact, we're a long way from just about everything. Scott is debugging with a hammer, trying to remove a stubborn two-by-four from the wall of a mobile home plunked down in the high desert of Southern California. After banging away for a few minutes, he finally yanks the stud off the wall in a flurry of sawdust and splintered wood. It's a small victory, but it brings him one step closer to his own solution to the greatest computer glitch in history - the Year 2000 Bug. With more than 20 years of computer programming experience under his belt, Scott has decided that the only real fix for the Y2K problem may be to pack up and move to this patch of land 75 miles from his San Diego home. "In the next year or so," he predicts, "the most common cocktail party chatter will be, 'What are you doing to prepare for Y2K?' But by then, it will be too late." This is sagebrush country, the kind of place where you can hear your footsteps crunching in the gravel. But even here, 30 miles from the nearest interstate, a line of telephone poles runs along the dirt road and PacBell terminal boxes sprout from the ground alongside the cacti. While carpet installers work in the next room, Scott is planning for the day when it may all be useless. The property came with a freshwater well, and he'll soon have a solar panel for power. For protection against looters, he's about to purchase his first gun. "I've seen how fragile so many software systems are - how one bug can bring them down," he worries. The idea of hundreds, thousands, millions of bugs cascading all at once keeps him awake at night. His Y2K retreat is easy to spot. In an area where high security means a few strands of barbed wire clinging to a rusty pole, Scott's chain-link fence is shiny and new. The alarm-company sign that hangs from the fence would be more at home in Brentwood, and on the roof there's a DirecTV satellite dish pointed toward the sky. The shed outside his back door will hold nonperishable food. But with a programmer's methodical logic, Scott didn't rush out to buy a year's worth of dehydrated grub. First he sampled the fare from several distributors. One company sold a textured vegetable protein that was a bit more expensive, but it came in a variety of flavors: chicken, beef, and taco. "It was pretty good," Scott says, in the halting measured tones of someone who doesn't want come across as a wacko. "We were pleasantly surprised." So he splurged. What the hell, doomsday comes along only once in a lifetime. Throughout history, prophets and visionaries have spent their lives preparing for the end of the world. But this time veteran software programmers are blazing the millennial trail. The geeks have read the future, not in the Book of Revelation, but in a few million lines of computer code. By now, the source of their anxiety is well known. In the 1950s and 1960s, when the computer world was young and memory was expensive, programmers developed a convention for marking the passage of time. It's the same system most people use to date their checks: two digits for the day, two for the month, and two for the year. Dropping the "19" from the year was convenient, and it saved two bytes of precious RAM every time it was used. Those were days of innocence and optimism. Everyone knew what would happen if this little shortcut was still in use in AD 2000 - the two-digit year would roll over like the odometer on an old Chevy, and the computers would think they'd jumped 100 years into the past. Programmers knew it, and they warned their managers. Not to worry, was the usual reply. When the millennium finally rolls around, all this code will be ancient history. But the code stuck around. The old software worked fine in the postmainframe world, so nobody felt compelled to replace it. Instead, like Roman architects, they just built on top of it. The two-digit year became a standard, wired right into the heart of Cobol - the Common Business Oriented Language that still serves as the digital workhorse of commerce and industry. It also crept into the embedded microchips found in everything from VCRs to nuclear power plants. For years the Y2K bug sat quietly, remembered largely as an amusing textbook example of poor software design. But as 2000 drew near, the screwup became less amusing. In November 1996, the comp.software.year-2000 newsgroup was launched, creating a forum that would soon become ground zero for the Y2K survivalist movement. But at first, the charter was clear: Discussions would be limited to Y2K bug fixes, remediation strategies, and reports. Over the course of the next year, information poured into the newsgroup, and most of it was bad: The FAA was hopelessly behind schedule in patching air-traffic-control systems; Edward Yardeni, chief economist for Deutsche Morgan Grenfell Bank, laid odds that Y2K upheaval would trigger a recession; Ed Yourdon, a respected software guru and author of 25 computer books, predicted the collapse of the US government - not long after he packed up and moved to New Mexico. Optimism became a scarce commodity. Philosophical questions were raised: Do programmers have a moral duty to remain at their keyboards until the last moments of 1999, like captains on a sinking ship? Debates raged over social Darwinism and the ownership of wheat in grain elevators. The conversation moved on to the viability of dry dog food as emergency rations. Plans were made to begin converting equities into gold and buying land in remote parts of California, Arizona, and Oklahoma. January 1998 saw 250 cross-posts to misc.survivalism - up from an average of 30 a month in late 1997. Gradually, a new acronym entered the Internet lexicon: TEOTWAWKI, pronounced "tee-OH-tawa-kee." The End of the World as We Know It. The Internet's very own survival movement was born. Scott Olmsted has known about the Y2K bug since the 1980s, but he never gave it much thought until early 1997, when he received a snail-mail flyer from Gary North, a historian and early leader in the Y2K preparedness movement. After reading it, Scott remembers feeling a vague sense of dread. But as a rational guy and student of decision analysis - the science of logical decision making in the face of chronic uncertainty - he didn't jump to any conclusions. Instead, he went online to do some research. As he pored over Web sites and news clippings, Scott felt himself moving through the same psychological stages endured by people confronted with fatal illness: denial, fading into anger, leading to a deep depression that culminates in a sense of acceptance. "I'm still not 100 percent sure that the world's coming to an end," he admits. "But the idea that I may want to get out of town for a while is not such a long shot. It's enough to make me want to prepare." With the exception of his wife, most of the non-geeks closest to Scott think he's a little nuts. His half-brother, Clark Freeman, thought he was going overboard. But since then, Clark has come around a bit - he, too, is planning to stockpile some food in case things get rough. If his brother is taking Y2K so seriously, he figures there might well be something to it. "Scott has always been the level-headed one," Clark remembers. "The classic straightlaced nerd." "I've spoken with friends and relatives about this, and I've gotten nowhere," Scott sighs. Worse, some of the more intense Y2K survivalists also think he's crazy - or at least a bit naïve. After all, Scott plans to celebrate New Year's Eve at his home in the suburbs; the place in the desert will be there just in case things get rough. Then there's his fence - it has no perimeter alarms, and he isn't even trying to camouflage his location. But worst of all, his hideaway is only a half tank of gas away from Los Angeles - close enough to the big city that he could wake up one postapocalyptic morning to find hordes of Los Angelinos parked outside his desert redoubt. The hardcores believe it will happen like this: On January 1 (or shortly thereafter), the electricity grid will go dead. Groceries in America's refrigerators will go bad. Food distribution systems will crash and store shelves will go bare within days. Businesses will fail, either because they aren't Y2K compliant or because they are dependent on noncompliant customers and suppliers. As losses mount and companies go under, the stock market will plummet. Banks will calculate interest for negative 100 years. The government will stop issuing entitlement checks to gray-haired senior citizens when their age suddenly clicks back to -35. Panic will set in. Police dispatch systems will be crippled, and the only law will be the law of the jungle. Desperate citizens will abandon the cities to hunt for resources in rural areas. They'll come looking for the mad prophets - the Y2K survivalists - ready to plunder their food, their heat, and their communications links. They'll zero in on Scott and his conspicuous retreat like a pack of wolves on the scent of a kill. But they'd better stay away from Steve Watson's place. Steve Watson, a 45-year-old systems analyst, is still kicking himself for not preparing sooner. He didn't get going until early this year, and he worries that he still has a lot of adjusting to do. As he puts it, "I didn't even know how to tan a hide until a couple of months ago." If all goes according to plan, Steve will ring in the new year at a secure compound somewhere in southern Oklahoma. While the Pollyannas of the world watch Times Square on the tube, he'll be listening to the radio for early news of Y2K disaster. When the power goes black - perhaps at the stroke of midnight - he'll be ready with a small arsenal of guns. A generator will power his bunker indefinitely, but no light will escape to the outside - none of Steve's neighbors will even know that there is a survivalist in their midst. Eight months ago, if you'd told Steve that Y2K survivalism would become his obsession, he would have laughed in your face. Last year, he was a happy-go-lucky Y2K project analysis manager for DMR Consulting, a Canada-based computer consulting firm, just finishing up a big remediation project for a major American phone company. The effort was grueling - 10 writers, programmers, and analysts cleaning up 10 million of lines of Cobol code. But in the end it all worked out, and the phone company's billing system was declared ready for 2000. In that heady moment of self-congratulation, Bill Finch, one of Steve's coworkers, approached him with a thought. "Steve," he said, "don't you realize that everything stops if the power grid goes down?" Anxiety set in. The telephone company had poured substantial resources into its Y2K effort. Even then, Steve's project had been an odyssey plagued with countless unexpected glitches and snags. If the power utilities - with their Byzantine grid of thousands of generators and substations around the continent - weren't already well along in their efforts, then all the systems he'd dragged into Y2K compliance would be dead as doornails when the lights went out. That afternoon, Steve hit the Net, where he learned that the situation is far worse than he had imagined. The power grid relies on a sophisticated feedback mechanism: Remote terminal units report their power needs up the communications chain that controls the output of electricity generators. The entire network is riddled with embedded chips. Nuclear plants supply nearly 20 percent of the power in the grid, and none of them have been certified as Y2K compliant. Charles Siebenthal, head of the Year 2000 embedded systems project at the Electric Power Research Institute, says the industry is just beginning to look for potential Y2K failure points. Anecdotes from industry consultants suggest that if the year 2000 came today, every utility in the country would crash. "No electric plant or facility of any kind has been Y2K tested without some kind of impact," says David Hall, a senior consultant with the Cara Corporation. "There isn't enough time to fix everything. There will be some disruption. How long? How deep? We just don't know." Then there are ripple effects to consider. "There's not a single railroad switch in the country that's manual anymore," Steve says. "They're all computer controlled, and railroads deliver coal and fuel to power plants." Exit Steve Watson, bright-eyed optimist; enter the new Steve Watson, Y2K survivalist, rugged pioneer, and Renaissance man in training. Steve began spending six hours a day on the Internet, studying alternative power, construction techniques, and emergency medical procedures. Anything he couldn't find online, he ordered from local bookstores or Amazon.com. He'd never kept a gun in the house, but soon he had three: a 30-30 for deer hunting, a .22 for small game, and a 9-mm handgun for personal protection. Of course, the 9-mm is practically a popgun against looting mobs, so four M-16 assault rifles are also on the way. Finally, he pooled his money with Bill Finch, his DMR coworker, to buy 500 remote acres in Oklahoma. (Bill holds the public deed to the property, so his name has been changed in this article to keep the location secret.) In choosing the hideaway site and its size, Steve overengineered to account for family and friends - few of whom subscribe to his Y2K scenario. "Most people think I'm nuts. Even my kids think, Dad's going off the deep end." Steve's wife, Teresa, has been more supportive. She's no computer expert, but her Baptist faith tells her that the Four Horsemen of the Apocalypse could ride in with a global computer crash. Meanwhile, Steve is making plans for everyone else: close friends, family members, sisters-in-law, brothers-in-law - and their children, mothers, and fathers. Forty people in all. In 2000, they'll work together to till the soil and patrol the fence line. Steve's doomsday vision is the same as that of most Y2K radicals, but radicals can pop up in some pretty mainstream places - like the US Central Intelligence Agency, which is advising its agents abroad to keep cash on hand and stockpile extra blankets in preparation for New Year's Day 2000. The agency worries that bugs in the power networks and communications backbones of developing nations could cause outages that would jeopardize the safety and well-being of its agents. Millions of Americans have already gotten a small taste of critical system failure. When the onboard control system of the Galaxy IV communications satellite failed on Tuesday, May 19, 1998, the outage temporarily crippled US pager networks, several broadcast news operations, and even credit card verifications systems. Most of the disruptions were brief - technicians were able to switch to backup communications paths - but doctors who use pagers as a lifeline with patients and colleagues were forced to set up camp in hospitals and offices. The failure of one satellite threw a wrench into the mechanisms of modern life, perhaps providing a peek at what life may be like at the dawn of the new millennium. Or sooner. While the full brunt of the Y2K bug is reserved for AD 2000, some early problems are already developing. In 1996, Visa and MasterCard temporarily stopped issuing credit cards with an expiration date of 2000 after credit card verification terminals began choking on the "00." The gaffe led to customer complaints and a lawsuit filed by a suburban Detroit grocery store against its computer supplier, TEC America Inc. Since then, most verification systems have been upgraded, but Y2K is making its presence known in other areas. The Information Technology Association of America released a survey last March showing 44 percent of the US companies they polled have already experienced Y2K failures. Ninety-four percent of the respondents termed Y2K a "crisis." The GartnerGroup estimates that 180 billion lines of code need to be examined and that 20 to 30 percent of all firms worldwide have not yet started preparing for Y2K. Many of these are expected to suffer significant failures. In a series of studies issued over the last year, Gartner surveyed 15,000 companies in 87 countries to assess their Y2K readiness. The results weren't encouraging. Small companies rated lowest - for most, winning over new customers has taken priority over the Y2K problem. But midsize and large companies are lagging, too. Gartner then rated the overall Y2K efforts of industrialized nations on a scale of zero to five, where five is total compliance on all systems. The highest scorers on the scale, including the US, Canada, and Australia, rated somewhere between two and three - a score that suggests they have completed an inventory of Y2K vulnerabilities, but not yet developed a comprehensive remediation plan. The US may be at the front of the pack in the Y2K race, but that's small comfort to some legislators. Last March, the House Subcommittee on Government Management, Information, and Technology warned that 37 percent of the critical systems used by federal agencies will not be ready in time. Then in June, California Republican Stephen Horn, who heads the subcommittee, issued a scathing report card on the Clinton administration's Y2K progress. He gave the government an F. John Koskinen, head of the president's Year 2000 Conversion Council, complains that Horn is just a tough grader. "As a government, we're in a C+ to B range," he argues. Koskinen keeps a digital desktop clock that runs backward - on the day we spoke, the clock showed 609 days, 8 hours, 39 minutes, 16 seconds, and counting - but he generally refrains from calling the situation a crisis. Instead, he describes it as a "critical management challenge." He fully expects the federal government's critical systems to be ready on time, or even early. "Many companies, financial institutions, and federal agencies are still working on the problem," he says. "But most major organizations plan to have their solutions in place by the first quarter of next year." If the council is successful, Koskinen believes, Americans will confront little more than a few minor inconveniences when the year 2000 finally rolls around. "There's not enough information right now to indicate that stocking up on Coleman stoves and Sterno is an appropriate response," he says. And in the end, he predicts, "a lot of people won't notice." Koskinen has earned the respect of some Y2Kers by emphasizing the need for high-level planning in the event that some systems fail. But Y2K survivalists feel more comfortable with their own personal contingency plans, and a commercial infrastructure is already forming to support them. Walton Feed, an Idaho food distributor that sells products over the Net, is doing a brisk business in long-term supplies; the company attributes this to Y2K. And in Sully County, South Dakota, developer Russ Voorhees has attracted national publicity and hundreds of potential clients for his "Heritage Farms 2000" project - a Y2K survival community that's been on hold since June, when a local planning commission refused to grant the necessary building permits. For those who want to go it alone, there's a sense of adventurous fun in their preparations - the pride of self-sufficiency and an excuse to get away from the keyboard to earn some merit badges. But Y2K preparedness is not just a Boy Scout fetish, and it isn't always about getting away from it all. "If everybody moves to rural areas, they'll just take their problems with them," explains Paloma O'Riley, a red-haired, forty-something mother, wife, and computer expert. Paloma lives in the small town of Louisville, Colorado, just east of Boulder, and when she looks around her community she doesn't see potential looters - she sees neighbors. Her suburban hamlet has become a major landmark on the Y2K map as the world headquarters of The Cassandra Project, a grassroots Y2K preparedness organization that can perhaps best be described as a kind of Millennial Neighborhood Watch. Until last year, Paloma was a Y2K project manager at the Rover Group, a UK-based auto manufacturer, where her first responsibility was to identify all of the company's vulnerable systems and target them for patching. But her search didn't end with a couple of corporate mainframes. Inadvertently, Paloma opened up the Pandora's Box of Y2K: embedded systems. Embedded systems draw the Y2K bug-fixing task out of cyberspace and into the real world. There are lots of pea-brained microchips out there, nestled in everything from microwave ovens and automobiles, to power plants and oil refineries. Most don't care what the date is, but a small percentage of them do, and that made Paloma nervous. "I became concerned about just how prevalent embedded systems are," she recalls. "Several members of my family have medical problems, so when I started investigating I became very concerned about medical devices like defibrillators, physiological monitoring equipment, and the entire medical services infrastructure." When her contract came up for renewal in 1997, Rover asked Paloma to stay on in London to 2000. She declined - the thought of family and friends surrounded by noncompliant systems that might leave them cold, hungry, and without medical services was too much to ignore. Back in the States she began networking with other people who shared her concerns, and that's when she realized "we needed to put together an organization to address the issues and get information out to the public." Thus The Cassandra Project was born. In Greek mythology, Cassandra was a mortal woman courted by the god Apollo. To win her affections, Apollo gave her the gift of prophecy. Still, Cassandra rejected him, so the frustrated deity decreed that no one would ever believe her predictions. Paloma O'Riley gave a nod to Cassandra's fate when she chose the name for her Y2K preparedness group, but she is precisely the kind of mortal woman you'd want at your next PTA meeting - a firm believer in the notion that some good, old-fashioned community-building may keep the Y2K nightmare at bay. The Cassandra Project has helped spawn a dozen Y2K community preparedness groups around the country. It has a board of directors that includes several computer professionals and a Web site at millennia-bcs.com that lists a menu of articles discussing possible Y2K scenarios, ranging from minor annoyances to outright Y2Kaos. The site attracts more than 100,000 visitors a month. Between speaking engagements, Paloma spends her days organizing biweekly meetings with neighbors to discuss contingency plans, and lobbying the state government. "We've been working with the Cassandra group on a lot of their initiatives," says Steve McNally, staff director of the Colorado Information Management Commission. "They've talked to several legislators and the governor's office and brought some awareness of the issues to the table." For her part, Paloma and her family plan to stockpile a six-month supply of food. Her worst-case scenarios look much the same as those of the most hardcore, self-sufficient Y2K survivalists, but the bomb-shelter aspect is conspicuously missing. Paloma believes that people will pull together in times of turmoil. If calamity strikes and she is forced to draw the line, she's determined to do so in her own backyard. Even if Paloma's neighborly pragmatism sets her apart from the militia types and fundamentalist Christians who regularly contact The Cassandra Project, her efforts have brought her in contact with a thriving premillennial subculture. "People in other millennial movements, including Christian fundamentalism, point to Y2K as a sign of the times," says Philip Lamy, a professor of sociology and anthropology at Castleton College in Vermont. Lamy specializes in the study of secular millennialism, and he sees Y2K survivalism as a prime example of the genre. "Generally, millennial movements appear when a society or culture is going through a period of rapid cultural, economic, or technological change," he says. "The explosion of the Internet and the World Wide Web is fueling a lot of this now." Still, there are a few things that set the Y2Kers apart from the crowd. For one, the Y2K bug is not simply a matter of myth, superstition, or prophesy - it is a tangible problem hardwired into the fabric of our industrial society. In addition, the people who are taking Y2K most seriously are not laypeople or neophytes - they are specialized technicians who approach the situation with a sophisticated understanding of society's hidden machinery. But if heightened technical awareness alone could explain the apocalyptic conclusions drawn by the Y2K survivalists, then every well-informed computer geek would be moving to the desert - and that clearly isn't happening. With so many intertwined variables to consider, logic inevitably takes a back seat to subjective intuition - a personal sense of security that extends from the microcosm of a single computer program to the macrocosm of modern society. Ultimately it all comes down to faith. But this, too, sets the Y2K survivalists apart. True millennialism is rooted in faith - fundamentalist Christians may anticipate an apocalypse, but they optimistically expect it to be followed by 1,000 years of celestial rule. Y2K survivalism, on the other hand, doesn't concern itself with redemption. It is antimillennial - the polar opposite of techno-millennial movements like the Extropians who see technology as the stairway to a higher plane. (See "Meet the Extropians," Wired 2.10, page 102.) "All this suggests that you don't have to be a religious fanatic, a Christian fundamentalist, or a ufologist to believe that our world may be in trouble - that there's something serious afoot in our nation and our world," Lamy adds. "The Y2K problem is overlapping with other survivalist movements, and like them it shares a kind of a fatalistic vision of the future." Three weeks have passed since Scott Olmsted put the carpet installers to work in his retreat. The carpet is in now, and he's turned his attention to other details, like night-vision equipment - his property is on high ground, and with the right hardware he could scan most of the valley from his backyard. He's also thinking of getting laser eye surgery so that he won't be dependent on contact lenses after 2000. It never seems to end. "Once you take the first steps to prepare, you basically admit that this is big enough to do something about. And then you realize you should be doing more." Scott has turned his back on denial - the blind faith that allows people to live normal lives in the face of staggering complexity, risk, and uncertainty. Instead, he's chosen to acknowledge his own vulnerability. As he describes it, "I've always known that the economy is complex and that we live on the end of a long chain of ships, planes, and 18-wheelers." Scott sees how the Y2K bug could disrupt that chain, and like other resolute souls - environmental activists, antiabortion protesters, and corporate whistle-blowers to name a few - he, too, has been driven to act by the clarity and intensity of his vision. The rest of us may be content without quite so much awareness, but embracing the Bug has actually made Scott feel better. "I know one guy who started taking Prozac when his denial fell away," he says. "Taking action - doing something - really gets you out of that." Scott admits there isn't enough evidence to prove he's right. But, he insists, that's not the way to look at it. "There's not nearly enough evidence pointing the other way to make me abandon my preparations," he says. In a way, he's managed to optimize the Y2K problem - even if the new millennium dawns without incident, his efforts will have yielded a supply of inexpensive food, a new collection of practical skills, and a nice vacation home in the country. It's an eminently logical win-win, and Scott has taken comfort in that. "I'm not waiting until the ground is shaking to prepare for the Y2K earthquake," he muses. "I'm going to be ready for an 8.5. I may look foolish if it turns out to be minor, but that's OK. That's the nature of decisionmaking under uncertainty." Kevin Poulsen is a columnist for ZDTV.com . America Offline ( Inside the Great Blackout of '00 ) "Most of the nation's power systems must be compliant, or they all go down, region by region, in one gigantic, rolling blackout," warns Gary North, keeper of the oldest, most notorious Y2K doomsday site on the Web. If the lights go out at the dawn of the 21st century, North believes the failure will be permanent, because the computers that control the grid will be unfixable if there isn't power to run them. Thereafter, he argues, the blackout will trigger the collapse of civilization. The North American grid is vulnerable to simultaneous failures. Generating facilities in the US, Canada, and Mexico jointly move power through high-tension lines that distribute electricity through four regional interconnections. Within each region, if one facility goes offline, the others compensate to pick up the slack. But there's not much spare capacity built into the system; the North American Electric Reliability Council, a group that is drawing up a timetable of Y2K fixes for the Department of Energy, admits that if multiple generating facilities fail in one region, this "may result in stressing the electric system to the point of a cascading outage over a large area." This is how it could happen: A power station is equipped with safety systems that deactivate steam boilers if they aren't maintained frequently. Suppose maintenance was last performed in 1999, which an embedded chip recorded as "99." Now it's the year 2000, so the chip subtracts the old year, 99, from the new year, 00, and finds, amazingly, that maintenance was last performed -99 years ago. Clearly this is an error, so the chip shuts down all the boilers, just to be safe. Meanwhile, at another power station, a temperature sensor attached to a transformer averages its readings over time. On January 1, 2000, the sensor divides temperature by the year - which is expressed as "00" - and comes up with an infinite value, triggering another shutdown signal. If small faults like these knock out a half dozen facilities, the rest will go offline to protect generators from burning out in a hopeless effort to meet the growing demand. The distribution grid also has weak points. "We have at least 800 different types of embedded controls on the wires," explains Gary Steeves, director of a Y2K project at TransAlta Utilities, the largest investor-owned power company in Canada. "Some of the protective devices log dates of faults in activity and can automatically take a component out of service." If the same controller has been installed in thousands of remote locations, and the chips share the same Y2K bug, they'll all fail simultaneously. Most US power utilities refuse to comment on the likelihood of these disasters, fearing litigation if they offer reassurances that turn out to be wrong. Tim Wilson, publisher of Y2k News, worries about the nearly 9,000 small regional companies that pull power off the grid at the local level. "They're clueless as to what to do about Y2K," says Wilson. "They know they have embedded chips, but they don't know where they are. If there's a power shortage, rural areas may not be allowed to take power off the grid, because cities could have a higher priority." This suggests an ironic scenario: Remote areas may remain dark for weeks or months after January 1, 2000, leaving Y2K survivalists waiting in their isolated cabins for the lights to come back on - while complacent urban dwellers enjoy uninterrupted service. - Charles Platt Copyright © 1993-98 The Condé Nast Publications Inc. All rights reserved. Compilation Copyright © 1994-98 Wired Digital Inc. All rights reserved. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Info.
by pooppido＠fffff.net 17 Dec '03

17 Dec '03

THAT'S 5 cents per minute!!! SPECIAL PROMOTION - Limited Time Only! Between NOW and September 30th You Can Receive: 5¢ per minute state to state!! 9¢ per minute within the state!! 5¢ per minute to selected International Countries!! 5¢ per min to these selected international destinations: CANADA, BELGIUM, AUSTRALIA, GERMANY, FRANCE, NETHERLANDS, NEW ZEALAND, SWEDEN, THE UNITED KINGDOM THAT'S 5 cents per minute!!! PLUS A FREE PRE-PAID CALLING CARD AFTER YOU SIGN UP!!!! TO START SAVING IMMEDIATELY AND TAKE ADVANTAGE OF THIS LIMITED TIME PROMOTION RESPOND BY E-MAIL to : rha(a)s-tuff.com How do You ...SAVE! On your long distance phone bill!!! 11 year-old Telecommunications GIANT Can Help You Save UP TO 30% OVER AT&T & SPRINT! Permanently!!! In fact, NO ONE can beat our International Rates! And now we are taking domestic long distance by storm!! After September 30, 1998 rates are just... 7¢ per minute State-to-State* 9¢ per minute Within the state 24 hrs. a day 7 days a week. Unlimited calls! Guaranteed! No minimum usage requirements! No separate Phone Bills! (Charges will be included on the long distance portion of your local phone bill, so that you can pay with a single check. INCREDIBLY LOW INTERNATIONAL RATES! SAMPLE INTERNATIONAL RATES (Our rates are effective August 1, 1998 ) CAN YOU BELIEVE IT! **Only 7 cents per min to and from: Puerto Rico, Guam, Canada, Hawaii and Alaska!! OUR RATE AT&T ONE RATE COUNTRY PER MIN. INTERNATIONAL Brazil . .46 .55 China .63 .80 Cuba .64 .84 France . .14 .33 Germany .14 .33 Hong Kong .24 .61 Italy .23 .35 Japan .26 .35 Philippines .49 .77 South Korea .35 .39 Taiwan, Rep China .35 .46 India .67 .80 UK .09 .12 Mexico City .29 N/A and many, many more! OUR NETWORK Brought to you by a global long distance company with a high-tech fiber optic network that provides the high-quality crystal clear telecommunications you've come to expect. We operate a 35,000 mile fiber optic backbone in the U.S., which interconnects its switches and provides the company access to every LATA in the country. In Canada, We operate a fiber-optic network that interconnects its switches and provides the company access to the provinces of British Columbia, Ontario and Quebec. We maintain switching hubs in major cities throughout North America, including Atlanta, Chicago, Dallas, Honolulu, Los Angeles, Miami, Montreal,New York, Ottawa, San Francisco, Seattle, Toronto, Washington and Vancouver. Our global network uses fiber optics and 100% digital transmission for unsurpassed reliability and superior quality. We are continually extending the network backbone around the world. Our customers enjoy crystal clear connections to virtually every direct dial destination world-wide. OUR CUSTOMER SERVICE We provide multi-lingual customer service and support, including Spanish, French, Chinese (Mandarin & Cantonese), all available 24 hours a day, 7 days a week. SPECIAL PROMOTION - Limited Time Only! Between August 1st and September 30th You Can Receive: 5¢ per minute state to state!! 9¢ per minute within the state!! 5¢ per minute to selected International Countries!! 5¢ per min to these selected international destinations: CANADA, BELGIUM, AUSTRALIA, GERMANY, FRANCE, NETHERLANDS, NEW ZEALAND, SWEDEN, THE UNITED KINGDOM THAT'S 5 cents per minute!!! TO START SAVING IMMEDIATELY AND TAKE ADVANTAGE OF THIS LIMITED TIME PROMOTION RESPOND BY E-MAIL to : rha(a)s-tuff.com WE DARE YOU TO COMPARE US TO YOUR PRESENT CARRIER! Get the Facts Now! Contact Us Immediately for more information. email : rha(a)s-tuff.com Agents needed ...your commissions start at 10% and go as high as 19%. RESPOND BY E-MAIL to : cool5cents(a)yahoo.com PENBELL COMMUNICATIONS 6001 Skillman Suite 102 Dallas, TX. 75231 214-750-4738

1 0