- cypherpunks-legacy - lists.cpunks.org

New GAK Bill
by John Young 17 Dec '03

17 Dec '03

5 September 1997, MSNBC: FBI Director Louis Freeh floats a new proposal at a congressional hearing to outlaw non-breakable crypto products. A radical shift in crypto debate Proposed bill outlaws non-crackable crypto products, restrict imports By Brock N. Meeks, MSNBC WASHINGTON -- The White House would likely be very sympathetic to a controversial new bill that would outlaw all encryption software that doesn't allow law enforcement agencies to immediately decode scrambled messages, an administration official told MSNBC. The new bill, still in draft form, is quietly circulating among members of the House and Senate. Although the administration hasn't formally endorsed any provisions of the bill, MSNBC has learned that the White House has been providing what is called technical drafting assistance to members of Congress writing the bill. William Reinsch, the Commerce Department undersecretary for export administration, confirmed the White House involvement for MSNBC on Thursday night. The draft bill was already in the hands of some members of the Senate's Subcommittee on Technology, Terrorism and Government Regulation when FBI Director Louis Freeh outlined its basic provisions while testifying before the panel Wednesday. Freeh said "we would recommend" that legislation be written requiring all encryption software or services made in or imported to the United States to have a feature "which would allow for the immediate, lawful decryption" of any scrambled messages used for illegal purposes or in a national security matter. NATION AT RISK? The White House, FBI and intelligence agencies claim that the proliferation of unbreakable encryption products puts the nation at risk. Criminals and terrorists are increasingly using unbreakable encryption products, Freeh testified Wednesday. U.S. makers of encryption software claim that any government-mandated decoding features would make their products unacceptable to clients in the global marketplace. The new proposals outlined by Freeh also drew the ire of civil liberties groups, which fear that any government controls on encryption products raise serious First Amendment and privacy concerns. Placing such government-mandated controls on the domestic use and manufacture of encryption software, as well as on the import of encryption products, stands in marked contrast to current White House crypto policies. Currently, the United States places strict regulations on the export of any encryption products that do make decoding keys available to law enforcement agencies. However, the administration has steadfastly maintained throughout the often contentious public debate over encryption policies that it would not place any restrictions on the domestic use of encryption software, nor would it restrict the import of encryption products. Despite Freeh's testimony and the draft legislation written with White House assistance, Reinsch said the administration's policy on encryption hasn't changed. "I want to emphasize that [in providing drafting assistance] we are responding to committee requests," he said. "And those requests have been fairly directive, such as: 'Give us some examples of how we can better accommodate law enforcement needs.' " Currently, the White House is backing an encryption bill in the Senate called the Secure Public Networks Act, also known as S. 909. This bill would encourage the use of and set up guidelines for encryption software products with decoding keys. Under this plan, all coded messages would spin off a decoding key that would be stored with a government-approved third party. Law enforcement agencies, foreign or domestic, would be allowed access to those keys if they obtained a court-ordered warrant. The bill would not restrict or require any encryption software used in the United States, or restrict the import of any foreign crypto products. However, MSNBC has learned that the draft bill now circulating among members of the House and Senate specifically outlaws the "manufacture, distribution or import" of any encryption software product or communication device that does not "allow the immediate decryption" of all scrambled messages or communications "if used for illegal purposes." The bill also targets "network services," such as Internet Service Providers, that provide encryption capabilities to their clients. BAN WOULD GO INTO EFFECT IN 1999 Under this proposed bill, if such encryption services are offered by a company like ISP, the service provider must build in a provision to allow for immediate decryption of any scrambled messages, according to several sources that have seen the draft language. The software ban would go into effect in January 1999. Reinsch told MSNBC he wasn't sure that Freeh's testimony "accurately reflected" the language the White House offered in its technica drafting for congressional committees. However, he indicated the administration was interested in Freeh's proposal. "I'll be blunt about it," Reinsch said. If such a bill were approved by a congressional committee, the administration "would look very seriously at it and I imagine we would be very sympathetic to it," he said. Opponents of proposals to require key for all encryption software blanched at Freeh's statements. "This proposal crosses a line that hasn't been crossed before in the area of domestic controls on crypto," said Alan Davidson, policy analyst for the Center for Democracy and Technology. Davidson said a government mandate to provide immediate decryption capabilities would be like "forcing everyone to live in a glass house." It also "trashes the Fourth Amendment," which guarantees a right to be protected from unlawful search and seizure, Davidson said. Freeh told the Senate panel Wednesday that he isn't looking to expand law enforcement's investigative powers. Rather, he said, he is only looking for a "Fourth Amendment that works in the Information Age." ------

4 5

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:08 AM 2/22/96 -0500, SINCLAIR DOUGLAS N <sinclai(a)ecf.toronto.edu> wrote: >What they have gained is the knowledge that their random number source >isn't broken. If your RNG started spewing 0 bits by the thousand would >you say "This stream is just as likely as any other stream that I can >imagine so there is no problem", or "My RNG is broken". Of course, >in nice mathematical abstractions your RNG never breaks, but we live in >a nasty world of thermal failiures and cold solder joints. They _haven't_ gained that knowledge, only the knowledge that it isn't _totally_ broken and spewing zeros. For example, the output of while(1) printf("%8c", des(i++, key)); // Pretend syntax is correct would probably pass the randomness tests just fine, in spite of being entirely predictable and having only 56 bits of key plus log(i) bits of state, and is vulnerable to most cryptanalysis attacks on DES systems as well. But it's not a One Time Pad, it's just counter-mode DES. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: House National Security committee guts SAFE, worse than no b
by Lizard 17 Dec '03

17 Dec '03

At 11:00 PM 9/9/97 -0400, Declan McCullagh wrote: >Michael, you once again fail to note the important political issues here. >Sometimes civil liberties, freedom, and constitutional rights must be >ignored in favor of pragmatism. It is important at all costs to remain a >player in the game. > No, it isn't. You end up being more concerned with being in the game than with achieving your goals. Sometimes, you have to kick the board over. I think it is more important to make the laws unenforceable (and make such workarounds useful to the average netizen), than it is to try to keep the government from passing laws. The work of people like Jim Ray and Phillip Baker is crucial here. The government is unlikely to pass laws to limit its own authority, on any issue -- even those who might not want to use a particular power would still want to keep it around 'just in case'. We cannot count on government to protect our freedoms. Therefore, we must make it irrelevant to the exercise of those freedoms. >Instead of opposing bad crypto legislation, we should instead work inside >the process, to gain a seat at the table. That is why it is highly >significant that both Commerce and FBI want to rid us of our freedom but >would do it in subtly different ways. Not really, know. It's unlikely that a "Let's you and him fight" strategy would prove effective, since this isn't just an interdepartmental turf squabble. They will strip our freedoms first, and argue over who gets the thumbscrews second.

2 1

New WWW Page
by Computer Virus Help Desk 17 Dec '03

17 Dec '03

I'm pleased to announce the opening of a new Anti-Virus oriented Web Page. http://www.a1.com/cvhd This page allows the download of the latest versions of ALL the popular DOS, WINDOWS and WIN95 Anti-Virus Software as well as links to EVERY major Anti-Virus software developer or distributor in the world. On Line Virus Encylopedia, Anti-Virus Tutorials and other utilities are available as well. The page also contains VERY extensive links to Encryption, Privacy, Military, Intelligence, Government and Law Enforcement Web Pages. Look for the addition of a new "On Line" real-time Anonymous Pre-mailer with remailer chaining capabilities to be added in the very near future. Allen Taylor, Moderator, VIRUS_INFO SysOp, CVRC BBS, (317) 887-9568, Indianapolis, Indiana, USA http://www.a1.com/cvhd

1 0

Re: Internet Protest!
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:13 AM 2/23/96 -0600, m5(a)dev.tivoli.com (Mike McNally) wrote: > Is anybody so seriously delusional >that they imagine poor Bill Clinton having to work his way through all >the mail with elm? It's really not that tough - g/Bill Of Rights/d They're already about half done ..... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Thank you, MoJo Wire beta-testers
by Mother Jones Electronic Subscription 17 Dec '03

17 Dec '03

Thanks for being a MoJo Wire beta-tester. We appreciate all your comments and suggestions for our site. We've created a new mailing list to keep people up-to-date on the happenings at the MoJo Wire: http://www.motherjones.com/ Look for updates on: *Our Election 96 Area: Regular RealAudio and text field reports from our "smarty-pants political writers." *Mother Jones Magazine: We put every issue of Mother Jones magazine on-line. And we aren't just dumping in the text files either. Each issue is optimized for online viewing, with searchable databases, clickable imagemaps and more. *Special MoJo Wire Investigative features: Here's where we bring you what no print magazine can. We combine the flexibilty of the Internet with in-depth reporting to give you a whole new form of investigative journalism. To unsubscribe from our newsletter, please send an e-mail to majordomo(a)motherjones.com. In the body of the message (not the subject header) type: unsubscribe motherjones-list [your e-mail address] for example: unsubscribe motherjones-list umansky(a)motherjones.com Again, thanks for your help and we hope to see and chat with you on our web site and Live Wire (the interactive chat area of The MoJo Wire). Questions, comments? E-mail mailinglist(a)motherjones.com

1 0

Re: DNS-related problem, and, motherhood 'n apple pie, etc
by mrm＠netcom.com 17 Dec '03

17 Dec '03

I hope people evaluate Java (and all software) based on technical issues, and not based on whether or not you think I'm clueless, brain damanged or a liar. We take the DNS-related problem very seriously; we do understand how DNS works (I did say "apologies for the oversimplifiation"); we never have put our heads in the sand. I do think it's a bit unfair to the Java team to say we put our heads in the sand, since we are deliberately trying to be as open and honest and forthcoming as we can. I mean, we are publishing full source code, which I'm not sure is the case for lots of software that people place a lot of trust in, implicitly or explicitly. As I've said every time I've said anything, every time security awareness on the net is raised, I think it's good for the net. I personally don't regard the internet as secure, and any information I care about I have encrypted on disk. Any information I really, really care about I don't even have on the internet. I do regular backups. I'm not saying this is what everyone has to do. But it's not that hard or time-consuming, and it wouldn't hurt. But people who are in charge of corporate security for their company, or people who have very sensitive or very valuable information on their disks, should consider the many ways that the internt is insecure, not just how some applet could be exploited. Having said that, does that imply that I think it's OK for a Java application to have security holes? Of course not! I hope we can use Java-the-language to build more secure systems than we've gotten used to surviving in the past. Does that mean I'm downplaying the importance or seriousness of any applet-related hole? Of course not! I think it's possible simultaneously to understand the seriousness of a security hole, AND still to say it's a good idea for people to practice safe internet. Marianne Mueller I work for Sun, on the Java team. mrm(a)netcom.com mrm(a)eng.sun.com http://java.sun.com/people/mrm/

1 0

How to digitally watermark
by Dave.Birch＠eworld.com 17 Dec '03

17 Dec '03

>Adam Shostack <adam(a)homeport.org> wrote.. >Creating watermarks that can't be removed without degrading >image quality is not especially difficult. The two tricky bits are >durability and collusion protection. I don't know how the scheme in question works, but the general way in which these kind of watermarks work is the use of spread spectrum coding. So long as you choose a long enough spreading code, you can survive most of the information being destroyed in a transform and still recover the information. If a particular transformation (e.g. JPEG coding) stops you from doing this, then you pick multiple orthogonal codes (interested readers who want to hit the text books could try the key words "Gold Codes") and encode after each transform. So, you encode your original TIFF then covert it to a JPEG and encode again with an orthogonal code from the same family. Since the two codes don't interfere with each other, you can recover the watermark however you are viewing the picture. One particular transformation that a long enough code can withstand is scanning a magazine picture. So, you could watermark your picture of the Eiffel Tower before selling it to a magazine. Then, when it pops up on the Net because someone's scanned it in you can prove that it was your picture. What use this is I don't know, since I can't see how you can prove who scanned it! Incidentally, spread spectrum means that you can put several signals into the same bandwidth and recover each of them (if you have all of the codes). Short codes are used to protect against interference (the NCR wireless LAN range uses an 11 bit code, for example) while very long codes are used to recover data in situations where the signal falls below the noise level (I think I remember reading that the Voyager spacecraft used 252,000 bit codes). I hope someone, somewhere finds this interesting... ----------------------------------------------------------------- David G.W. Birch 8 Frederick Sanger Road Director, Hyperion Surrey Research Park Tel: +44 (0)1483 301793 Guildford Fax: +44 (0)1483 561657 Surrey GU2 5YD, UK Where people, networks and money intersect.......Consult Hyperion http://www.hyperion.co.uk daveb(a)hyperion.co.uk

1 0

Proposed Legislation Regualting Expert Testimony
by Bullwinkle J. Moose 17 Dec '03

17 Dec '03

The following is an excerpt from a bill proposed to become law in the State of New Mexico. (It did not succeed.) I wonder if the same sort of thing should be enacted to apply to the testimony of economists? "A BILL REGULATING EXPERT TESTIMONY IN COURTS. BILL____. AN ACT RELATING TO EXPERT TESTIMONY IN COURTS; REGULATING THE TESTIMONY OF CRYPTOLOGISTS AND COMPUTER EXPERTS IN THE HEARINGS OF CRIMINAL DEFENDANTS IN COURTS; BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO; When a cryptologist or computer expert testifies during a criminal defendant's penalty hearing, the cryptologist or computer expert shall wear a cone-shaped hat no less than two feet in height for the duration of the hearing. The surface of the hat shall be imprinted with stars, moons and lightning bolts. Additionally, the cryptologist or computer expert shall be required to wear a white beard no less than eighteen inches in length for the duration of the hearing. The cryptologist or computer expert shall punctuate crucial elements of his testimony by stabbing at the air with a wand no less than one foot in length. Whenever a cryptologist or computer expert provides expert testimony regarding the defendant's methods, the bailiff of the court shall dim the lights of the court room and shall administer two strikes to a Chinese gong." __________________________________________________________________ Out the buffer, | PGP encrypted e-mail welcome! Through the com port, | Finger for Public Key. Over the POTS line, | Also available on a key server near you. Into the NT Box, | Up the fractional T1, | Key ID: 0x457AA6BD Onto the backbone, | Keyprint: 99 C7 17 3B 32 08 3F 17 Nothin' but Net. | F4 A9 42 A9 2F BC 39 B1 ------------------------------------------------------------------

1 0

Re: your mail
by Joel O'Connor 17 Dec '03

17 Dec '03

I traveled by train all the way to Florida from Rhode Island once. 24 hours straight it took man and I swore I would never do it again. 40-50 people per car and basically one bathroom per car. Come morning time man, the lines for the bathrooms stretched out of the cars. Screw that, I could have flown and made it in 3 hours. Plus it's easier for the gov't to stop trains and search them, I'd rather go with the flight. ---Chip Mefford <cmefford(a)video.avwashington.com> wrote: > > > > Where possible, > > fuk a bunch of airlines anyway. > > Travel by train is a lot more enjoyable, relaxing, fun. > Folks that travel by train could fly, but would > preferr to enjoy the ride, cause it ain't no cheaper, > > except, !! > > you can pay with cash and show no id and go > where you would like in the lower 48. > > anonymously. > > On Tue, 27 Oct 1998, Anonymous wrote: > > > At 02:43 PM 10/26/98 -0400, Robert A. Costner wrote: > > >At 01:15 PM 10/26/98 -0500, Duncan Frissell wrote: > > >>9. "I do not posses any government-issued photo ID and thus cannot travel > > >>to the location stated in the subpoena. > > > > > >ROTFLMAO... > > > > > >This last one is too funny to not use. I don't have a subpoena, but I can > > >just see myself writing back explaining this and requesting assistance with > > >a plane flight to solve this problem. > > > > Actually you don't need state id to fly, legally. But the airlines will > > hassle you and not put your bags aboard til you are. There > > are references on the net to flying without state id. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > == Ogre bounces like sonar. . .Peace. Ogre _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

4 3