On Sun, Mar 08, 1998 at 01:59:53PM -0800, Ernest Hua wrote:

today. I am not aware of what cellular spectrum chip sets are available via Wyle or some other distributor, but I wouldn't be surprised if the cost of a digital intercept equivalent gear would be much more than $300 in parts plus a 300MHz PC (to decode the intercepted stream).

I don't think I'll bother the list with this, but a big problem with cellphones is that people have cellphones. And cellphones are generally not designed to be tamperproof (in many cases little or no effort in this cost competitive market has gone into this) so making a real cellphone serve as the front end to a snooping system has and will be done and in fact be the easiest hack engineering solution.

The question is, what is worth the potential interceptor's time and money to do this? It's obvious that politics is enough for the Florida couple (in the Gingrich case). For a college-age hacker, "because I can do it" plus "I work in a well-stocked University lab" is probably enough reason. I won't venture to guess what is worth a criminal's time and money, but surely existing models for analog piracy behavior is enough to characterize the trade-offs.

There are lots and lots of people who like to be spectators and are keenly interested in other people's affairs. All of us are to some degree - witness the feeding frenzy over the Monica affair - and some guestimates have estimated that perhaps as much as 40% of analog cell calls near large cities are being eavesdropped on by at least one other person.

In short, we violently agree on the technical plus behavioral front. But we are preaching to the choir. The real audience for a easy-to-understand summary is Congress. They need to understand that the assumptions 30 years ago do not apply today. And that market demand for more and more technically-literate engineering professionals along with the phenomenal downward price spiral in PC's and consumer electronics gear will simply make those assumptions even less applicable in the future.

That problem is getting worse rather than better. The media depiction of the mysterious "hacker" long haired mad kid intent on evil invasion of the worlds computers is helping create the illusion that there is a separate techno criminal class. But the reality is that more and more people are crossing the barriers that the older lawyers in congress never tried to cross and learning something about technology and software. And these people are the guy next door with the cute kids, not fringe crazies. And the evil net allows information to become available much more widely than before.

Regarding my moral or ethical argument, I am using the fuzzy standard set by what society will accept or not accept.

From my perspective, there are deep divisions and ambivalences in what the US people will tolerate. They hate the idea of being spied open but buy nanny cams and gobble up spy novels and TV shows. They purchase millions of police scanners and react in horror when Linda Tripp tapes a conversation to protect her ass. And they expect the US government to be on top of events around the world and have inside knowlage of other governments and react in horror when their spies are unmasked within our walls, and their eavesdropping gets shown on the nightly news. And cities install more and more cameras and bosses read more email and listen to more calls on business phones every year.

I don't think I need to argue that most American citizens will be really really pissed if they found out that the NSA is spying here via their British counterparts, or that the FBI has conducted far more intercepts than they officially report.

Yes, its definately sausage but it tastes good...

I am definitely not arguing that the FBI or the NSA has any obligation to inform the public of what weaknesses they use to gain an intercept advantage. What concerns most people is that they see (correctly) that the NSA's advantage was not based on technical superiority, but on the ignorance of everyone else.

That is true, and it is also sadly true that a lot of their effort has gone into frank deception, and active determined efforts to block those of us who have been fighting for incorperating at least minimal crypto communications security into the infrastructure. The Internet is ending this era, however, because it is no longer possible to control the flow of information and news about communications security and crypto, and slowly the holes will get plugged. People do get more

intelligent over time, and the rapid public gain in the cryptography area has pretty much wiped out the gains the NSA has depended on over the last 50 years. If the average person understands that what the FBI and the NSA REALLY want is for you to be stupid (at least in the area of communications security), then there would be an uproar.

This is happening, and that is why Louie is grabbing desperately for the last chance... and why congress is busily passing anti scanner bills to solve the cellphone privacy problem that don't mention a thing about cryptography. Their desparate hope is if they say it solomnly enough and with enough ceremony the public will see the emporer's clothes -- Dave Emery N1PRE, die@die.com DIE Consulting, Weston, Mass. PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18