IRS intimidation of Cypherpunks
On Sun, 14 Dec 1997 at 08:12:31 -0600 Human Gus-Peter wrote:
We should not let distaste/disgust for Jim's ideas and tactics blind us to the important legal and constitutional questions lurking beneath the surface of this investigation and prosecution - there's some possibility that the IRS used its investigation of Jim as a threat to other prolific authors on the Internet.
The government's armed assault on Ma and Pa Bell's residence took place within hours of an email being sent to him containing a rough draft of a chapter of an InterNet published manuscript describing and lauding Bell's AP system.
For example, copies of the press release announcing the raid on Jim's home were mailed, apparently from computer systems inside the IRS, to individuals active on the Cypherpunks list. The IRS has never before (or since) bothered to notify those individuals about criminal investigations which might otherwise be of interest.
It is interesting to note that the emails from treasury.gov constituted the same type of 'threat' that Bell was roundly accused of by government officials and the press.
I've seen brief mention of this before, but have never seen any details on the list. Aside from Jim Choate questioning my arithmetic or attention span, would anyone be kind enough to provide pointers to information about incidents of c-p list members having received unsolicited email from .gov? Declan, did you catch a whiff of this when it happened? I would think everyone's alarm bells would have gone off and people would have been intensely interested in the messages themselves, particularly the headers. StringPullMongerII
bureau42 Anonymous Remailer <nobody@bureau42.ml.org> writes:
On Sun, 14 Dec 1997 at 08:12:31 -0600 Human Gus-Peter wrote:
It is interesting to note that the emails from treasury.gov constituted the same type of 'threat' that Bell was roundly accused of by government officials and the press.
I've seen brief mention of this before, but have never seen any details on the list. Aside from Jim Choate questioning my arithmetic or attention span, would anyone be kind enough to provide pointers to information about incidents of c-p list members having received unsolicited email from .gov?
Check the archives. There was plenty of discussion when it happened. I'm convinced they used names pulled out of Bell's computer, not a cypherpunks subscriber list as they sent my copy of the SPAM to an email address that had long been retired at the time of the mailing, but had been used to exchange email with Jim. Far more active list members than I didn't get a copy.
Declan, did you catch a whiff of this when it happened? I would think everyone's alarm bells would have gone off and people would have been intensely interested in the messages themselves, particularly the headers.
They did, and we were. Here's a copy of one message I saved: To: cypherpunks@algebra.com Subject: gotcha (was Re: DEATH TO THE TYRANTS) References: <1.5.4.32.19970723233941.006d1374@pop.pipeline.com> <v03102800affc86bdca7e@[207.167.93.63]> From: SL Baur <steve@xemacs.org> In-Reply-To: Tim May's message of "Wed, 23 Jul 1997 21:21:48 -0700" Date: 23 Jul 1997 22:18:12 -0700 Message-ID: <m2lo2xauzv.fsf_-_@altair.xemacs.org> Tim May <tcmay@got.net> writes:
Namely, who is "irsnwpr@net.insp.irs.gov" and what does he or she think of the "DEATH TO TYRANTS" subject header, sent to me (and maybe others). ... The headers in the first of the messages I received were:
Received: from tcs_gateway1.treas.gov (tcs-gateway1.treas.gov [204.151.245.2]) by you.got.net (8.8.5/8.8.3) with SMTP id PAA28395 for <tcmay@got.net>; Fri, 18 Jul 1997 15:29:59 -0700 ... Received: from tcs_gateway1.treas.gov (tcs-gateway1.treas.gov [204.151.245.2]) by you.got.net (8.8.5/8.8.3) with SMTP id PAA28954 for <tcmay@got.net>; Fri, 18 Jul 1997 15:39:39 -0700
If those headers are forged, it is an expert forgery. The MX hosts for the net.insp.irs.gov domain are fun: net.insp.irs.gov preference = 10, mail exchanger = tcs-gateway2.treas.gov net.insp.irs.gov preference = 20, mail exchanger = tcs-gateway1.treas.gov net.insp.irs.gov preference = 30, mail exchanger = gotcha.treas.gov irs.gov nameserver = gotcha.treas.gov irs.gov nameserver = nis.ans.net irs.gov nameserver = ns.ans.net tcs-gateway2.treas.gov internet address = 204.151.246.2 tcs-gateway1.treas.gov internet address = 204.151.245.2 gotcha.treas.gov internet address = 204.151.246.80 `gotcha.treas.gov'? It's a real host connected through ans.net ... 12 h10-1.t32-0.New-York.t3.ans.net (140.223.57.30) 139.839 ms 126.702 ms 125.82 ms 13 h11-1.t56-1.Washington-DC.t3.ans.net (140.223.57.21) 147.248 ms 124.774 ms 118.815 ms 14 f0-0.cnss60.Washington-DC.t3.ans.net (140.222.56.196) 192.54 ms 125.939 ms 166.529 ms 15 enss3080.t3.ans.net (192.103.66.18) 130.917 ms 131.057 ms 145.377 ms 16 gotcha.treas.gov (204.151.246.80) 133.065 ms 134.345 ms 131.596 ms Except for hop 16, this is the same traceroute as to tcs-gateway2.treas.gov. For what it's worth, the traceroute to tcs-gateway1 is slightly different: 8 h13-1.t16-0.Los-Angeles.t3.ans.net (140.223.9.14) 44.997 ms 51.526 ms 51.875 ms 9 h14-1.t112-0.Albuquerque.t3.ans.net (140.223.17.10) 60.895 ms 60.426 ms 57.762 ms 10 h14-1.t64-0.Houston.t3.ans.net (140.223.65.9) 81.131 ms * 85.067 ms 11 h14-1.t80-1.St-Louis.t3.ans.net (140.223.65.14) 117.62 ms 100.623 ms 104.878 ms 12 h10-1.t60-0.Reston.t3.ans.net (140.223.61.13) 126.368 ms 136.017 ms 123.367 ms 13 f2-0.c60-10.Reston.t3.ans.net (140.223.60.220) 129.505 ms 128.214 ms 128.52 ms 14 enss3079.t3.ans.net (204.148.66.66) 134.707 ms 162.912 ms 160.774 ms 15 tcs-gateway1.treas.gov (204.151.245.2) 154.268 ms * 155.898 ms
At 10:22 AM -0700 12/15/97, Anonymous wrote:
bureau42 Anonymous Remailer <nobody@bureau42.ml.org> writes:
I've seen brief mention of this before, but have never seen any details on the list. Aside from Jim Choate questioning my arithmetic or attention span, would anyone be kind enough to provide pointers to information about incidents of c-p list members having received unsolicited email from .gov?
Check the archives. There was plenty of discussion when it happened.
I'm convinced they used names pulled out of Bell's computer, not a cypherpunks subscriber list as they sent my copy of the SPAM to an email address that had long been retired at the time of the mailing, but had been used to exchange email with Jim. Far more active list members than I didn't get a copy.
I got _two_ of the apparent "warnings," received by me before there was even any public announcement of the Jim Bell raid. As Anonymous notes in his message (snipped here), one of them was titled "Death to Tyrants!." The headers show no signs of standard forgery, and point back to government computers. I took this as warning that Big Brother is planning more raids and is trying to intimidate outspoken critics. Some country we live in, eh? The Land of the Freeh. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."
any details on the list. Aside from Jim Choate questioning my arithmetic or attention span, would anyone be kind enough to provide pointers to information about incidents of c-p list members having received unsolicited email from .gov?
Sigh, answering a question about a possible forgery asked by TruthMonger?, I must be losing it.
From irsnwpr@net.insp.irs.gov Date: Thu, 17 Jul 1997 12:29:08 -0400 From: IRS Inspection <irsnwpr@net.insp.irs.gov> To: Interested-Parties@net.insp.irs.gov Subject: Something of Interest
United States Attorney Western District of Washington FOR IMMEDIATE RELEASE July 18, 1997 JAMES D. BELL PLEADS GUILTY TO OBSTRUCTING THE IRS AND USING FALSE SOCIAL SECURITY NUMBERS United States Attorney Kate Pflaumer announced that JAMES DALTON BELL, 39, pleaded guilty today in the federal court in Tacoma to two felony charges. BELL, a resident of Vancouver, Washington, pleaded guilty to obstructing and impeding the Internal Revenue Service (IRS), and to falsely using a social security number with the intent to deceive. United States District Court Judge Franklin D. Burgess presided over today's proceedings. The charges stem from an investigation initiated in October, 1996 by IRS Internal Security Inspectors into reports that BELL was gathering the names and home addresses of IRS employees. In previous court hearings, IRS Inspectors testified that BELL had obtained the names and home addresses of 70 IRS employees as part of "Operation LocatIRS." In the eight page plea agreement signed by BELL, he acknowledged that he had gathered the names and addresses of the IRS employees in order to intimidate them in the performance of their official duties. During the course of their investigation, IRS Inspectors discovered that BELL was advocating a scheme called "Assassination Politics", whereby persons would be rewarded with "digital cash" for killing certain undesirable people. BELL identified these undesirables as government employees, such as IRS employees, who would be intimidated from enforcing internal revenue laws for fear of being assassinated. In the plea agreement, BELL admitted that he suggested using "Assassination Politics" as an enforcement mechanism for the "Multnomah County Common Law Court", and that this was part of his effort to obstruct and impede the enforcement of internal revenue laws. In affidavits previously filed in this case, IRS investigators identified BELL as a participant in the "Multnomah County Common Law Court", which was described as a self-appointed anti-government extremist group which purports to hold "trials" of IRS and other Government employees for the performance of their official duties. The affidavits indicated that in January, 1997 the "Multnomah County Common Law Court" held a "trial" of IRS and other Government officials. In the plea agreement, BELL also admitted that on March 16, 1997, he conducted a chemical "stink bomb" attack on the IRS office in Vancouver, Washington, using the noxious chemical mercaptan. In affidavits filed with the Court, IRS Inspectors tied BELL to two previous mercaptan attacks against non-government targets: one being a lawyer's office in 1984, and the other a vehicle in 1989. The IRS investigators also linked BELL to two purchase orders for noxious chemicals, one in 1994 and one in 1996. According to the plea agreement, the attack on the IRS office resulted in a cost to the government of $1,359, and caused a number of IRS employees to have to leave work. In an affidavit previously filed in this case, IRS Inspectors indicated that the mercaptan attack may have been linked to the February 20, 1997 seizure of BELL's vehicle by the IRS for unpaid taxes. As part of the plea agreement, BELL also admitted that he used several different social security numbers in order to hide assets from the IRS and thus to impede the IRS's ability to collect taxes he owed and to prevent the IRS from levying his wages. Federal agents had previously executed two search warrants on BELL's residence. On April 1, 1997, IRS agents seized computers, documents, and firearms during a search. In a follow-up search, the Environmental Protection Agency seized a variety of dangerous chemicals which had been discovered during the execution of the IRS warrant. BELL was arrested by IRS Inspectors on May 16, 1997. BELL continues to be held in custody based on a May 23, 1997 ruling by Magistrate Judge J. Kelley Arnold that BELL posed a danger to the community and was a flight risk. BELL faces a maximum sentence of three years in prison and a $250,000 fine for the obstruction charge, and five years and a $250,000 fine for using a phony social security number. The IRS received assistance in the investigation of BELL from the Portland Police Bureau, Oregon Department of Justice, Oregon State Police, Federal Bureau of Investigation, and the Vancouver, Washington Police Department. --end Datacomms Technologies data security Paul Bradley, Paul@fatmans.demon.co.uk Paul@crypto.uk.eu.org, Paul@cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"
participants (4)
-
bureau42 Anonymous Remailer -
nobody＠REPLAY.COM -
Paul Bradley -
Tim May