Net anonymity service un-backdoored
<http://www.theregister.co.uk/content/6/32533.html> The Register 28 August 2003 Updated: 17:42 GMT Net anonymity service un-backdoored By Thomas C Greene in Washington Posted: 28/08/2003 at 13:31 GMT The Java Anonymous Proxy (JAP) service, a collaborative effort of Dresden University of Technology, Free University Berlin and the Independent Centre for Privacy Protection Schleswig-Holstein, Germany (ICPP), has been allowed to suspend its monitoring of users' IP traffic pending a decision on the legality of back-dooring it. Collectively known as the AN.ON Project, the operators appealed a lower court's decision allowing the German Feds to obtain reports on users' access to a particular IP address (no doubt having to do with KP or bomb-making, etc). The appeals court has allowed the operators to discontinue logging until their appeal has been answered. When a decision has been reached, the JAP team says they will document the whole affair, but cannot do so until the court issues its ruling. A single record of access to the forbidden IP address has been logged but not yet disclosed to the Feds pending the higher court's decision, the JAP team says . In a previous article The Register criticised the way the JAP team handled its initial confrontation with the Feds, ie., by waiting quietly until a user discovered the back door before acknowledging the situation. We believe there were better ways of dealing with the court order, either by posting a prominent warning that the service might be subject to monitoring by the authorities, by leaking the information to the press outside Germany, or by disabling the affected proxies temporarily in protest. We hope that if the JAP team should lose its appeal and be ordered to resume monitoring, particularly under a gag order, it will find a way of giving the public a proper heads up. Their previous performance hardly inspires confidence, but there is always opportunity for redemption. -- ----------------- R. A. Hettinga <mailto: rah@ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The Java Anonymous Proxy (JAP) service, your local library, and you, among others need to develop a response should you be served with an order (court or otherwise) to produce information which includes the requirement that you keep the order secret. There are a large number of responses one could use. Some of them might be: * Cooperate. * Take the service down. * Publicly refuse to cooperate. * Publicly announce that you are being monitored. * Stop saying that the service is not monitored. * Appear to cooperate, but provide false information. * etc. Please keep in mind when reading the following analysis that I am not a lawyer. Cooperation seems to be the safest from a short term legal standpoint. However, to the extent it encourages the police state, it is dangerous in the long term. Taking the service down is an obvious response. It is a difficult response for your public library to implement. In addition, a strict enough secrecy order could require you to keep the service up. Publicly refusing to cooperate is the most honorable response, and will probably end you up in jail for an indefinite term on contempt charges. This is the path of civil disobedience, followed by a number of heros in past encounters with totalitarianism. Publicly announcing that you are being monitored will probably end up with the same contempt charges as a public refusal to cooperate, coupled with the possibility of the dishonorable act of breaking your word (depending on your terms of service). Stopping your notification that the service is not monitored can be forbidden by a strict enough secrecy order. It may be the least legally risky of the options. The fact that you will stop notification should be included in your terms of service. Providing false information is an interesting option, but I think you are legal toast if you are caught doing it. One can get a lot of amusement from considering who to implicate in place of the real anonymous user. Cheers - Bill ------------------------------------------------------------------------- Bill Frantz | "A Jobless Recovery is | Periwinkle -- Consulting (408)356-8506 | like a Breadless Sand- | 16345 Englewood Ave. frantz@pwpconsult.com | wich." -- Steve Schear | Los Gatos, CA 95032, USA
At 01:54 PM 8/29/2003 -0700, you wrote:
Stopping your notification that the service is not monitored can be forbidden by a strict enough secrecy order. It may be the least legally risky of the options. The fact that you will stop notification should be included in your terms of service.
All covered in my previous postings. This approach should be particularly applicable to ISPs as they generally have billing arrangement and can add this on as an extra service fee for each inquiry. Instead of court orders being a cost they become a revenue source. steve "The fetters imposed on liberty at home have ever been forged out of the weapons provided for defence against real, pretended, or imaginary dangers from abroad." --President James Madison (1751-1836)
On Friday, August 29, 2003, at 03:28 PM, Steve Schear wrote:
At 01:54 PM 8/29/2003 -0700, you wrote:
Stopping your notification that the service is not monitored can be forbidden by a strict enough secrecy order. It may be the least legally risky of the options. The fact that you will stop notification should be included in your terms of service.
All covered in my previous postings. This approach should be particularly applicable to ISPs as they generally have billing arrangement and can add this on as an extra service fee for each inquiry. Instead of court orders being a cost they become a revenue source.
This has been proposed for, but it fails for the usual reasons. An ISP is free to say "anyone requesting a tap is required to pay a fee," just as any ISP is free to say that it will handle installation of special Carnivore equipment for a certain fee. But when Big Brother commands that his Carnivore boxes be added, ISPs are afraid to shoot his agents who trespass. And so the work is done for free. And so, too, will the fees you talk about be waived. I think my solution may be best: take a few ISPs who have bent over for Big Brother and kill their owners and staff. A few ISP owners found necklaced and smoking may send a message to others. It works for the Mob in a way none of the more civilized approaches can possibly work. "You narc us out, we douse your children with gasoline and light them off. Your choice." Sometimes freedom demands harshness. --Tim May
On Fri, 29 Aug 2003, Tim May wrote:
But when Big Brother commands that his Carnivore boxes be added, ISPs are afraid to shoot his agents who trespass.
Just for the record, as someone who is in a position to have first-hand personal knowledge of this... When the various plastic-id carrying critters came around asking to let ISPs install Carnivores just after 9/11, they were almost all turned away. The notable exceptions were from companies that are (not surprisingly) based outside of the US. I was *stunned* at how many ISPs told them to fuck off (including, I am happy to say, the one I work at).. When a court order is present - that is a whole new ball game: nobody will refuse that.
And so the work is done for free. And so, too, will the fees you talk about be waived.
Free under the duress of a court order is AFAIK virgin territory here. There is no question that installing a DCS1000 is no small task when you're dealing with modern high speed circuits (OC12s and up), and will require significant planning and engineering support to accomplish without devastating interruptions in service - this is a significant expense to the business being ordered to comply. I would be surprised if this went on without compensation, even if at a reduced rate. And the sheer expense may in and of itself be a controlling factor in such orders. I know that they are rare enough to cause ripples of whispers in the NSP/ISP community.
I think my solution may be best: take a few ISPs who have bent over for Big Brother and kill their owners and staff. A few ISP owners found necklaced and smoking may send a message to others. It works for the Mob in a way none of the more civilized approaches can possibly work.
"You narc us out, we douse your children with gasoline and light them off. Your choice."
Sometimes freedom demands harshness.
Make them move to Texas. Force them to listen to recordings of Shrub all day, while sitting in the hot Texas sun.
--Tim May
-- Yours, J.A. Terranson sysadmin@mfn.org "Every living thing dies alone." Donnie Darko
At 11:00 PM -0500 8/29/03, J.A. Terranson wrote:
And the sheer expense may in and of itself be a controlling factor in such orders.
Bingo. You can't make a hierarchical network out of a geodesic one again. To mangle Gilmore's words a bit, a geodesic network sees centralization as damage and routes around it. One node cannot switch all traffic, and, at it's heart, that's what they're trying to do with this stuff. They may not care, but I doubt, even these days when unpriced "common" resources are being wasted to such a degree by viruses and spam, that the market's going to let them kill off the internet just so they can watch everybody. Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah@ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
J.A. Terranson wrote:
On Fri, 29 Aug 2003, Tim May wrote:
But when Big Brother commands that his Carnivore boxes be added, ISPs are afraid to shoot his agents who trespass.
Just for the record, as someone who is in a position to have first-hand personal knowledge of this...
When the various plastic-id carrying critters came around asking to let ISPs install Carnivores just after 9/11, they were almost all turned away. The notable exceptions were from companies that are (not surprisingly) based outside of the US.
I was *stunned* at how many ISPs told them to fuck off (including, I am happy to say, the one I work at)..
So in other words, Tim May doesn't know what the hell he's talking about (again)!
I think my solution may be best: take a few ISPs who have bent over for Big Brother and kill their owners and staff. A few ISP owners found necklaced and smoking may send a message to others. It works for the Mob in a way none of the more civilized approaches can possibly work.
"You narc us out, we douse your children with gasoline and light them off. Your choice."
Sometimes freedom demands harshness.
Tim May is the perfect example why vigilante justice is generally considered to be a bad thing -- stupid assholes like Tim May spout off & take action based on paranoia instead of facts & principles of anarchy instead of justice and innocent parties get hurt.
--Tim May
On Saturday, August 30, 2003, at 01:02 AM, Tim wrote:
J.A. Terranson wrote:
On Fri, 29 Aug 2003, Tim May wrote:
But when Big Brother commands that his Carnivore boxes be added, ISPs are afraid to shoot his agents who trespass.
Just for the record, as someone who is in a position to have first-hand personal knowledge of this...
When the various plastic-id carrying critters came around asking to let ISPs install Carnivores just after 9/11, they were almost all turned away. The notable exceptions were from companies that are (not surprisingly) based outside of the US.
I was *stunned* at how many ISPs told them to fuck off (including, I am happy to say, the one I work at)..
So in other words, Tim May doesn't know what the hell he's talking about (again)!
A silly bit of logic on your part. The ISPs which have NOT narced out their customers, who may be in the majority, have nothing to fear. It's the ISPs which HAVE we are talking about. You confuse existence with magnitude. Logic eludes you. --Tim May
--
Tim May is the perfect example why vigilante justice is generally considered to be a bad thing -- stupid assholes like Tim May spout off & take action based on paranoia instead of facts & principles of anarchy instead of justice and innocent parties get hurt.
Talk is cheap. Actions are done more carefully. Tim implied he would kill stoolies that shopped him to the police, not that stoolies had shopped him to the police. Indeed, the one may be connected to the other -- the absence of stoolies may well be connected to the presence of hot talk. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG pXsE+dTMchTRGLEth/KG4Jybjex3fXnxmX/kW5ib 4kdDio/+p4tSHV+rTtDmhuzBJzAy9O9sadnf10+fR
On Sunday, August 31, 2003, at 04:20 PM, James A. Donald wrote:
--
Tim May is the perfect example why vigilante justice is generally considered to be a bad thing -- stupid assholes like Tim May spout off & take action based on paranoia instead of facts & principles of anarchy instead of justice and innocent parties get hurt.
Talk is cheap. Actions are done more carefully. Tim implied he would kill stoolies that shopped him to the police, not that stoolies had shopped him to the police. Indeed, the one may be connected to the other -- the absence of stoolies may well be connected to the presence of hot talk.
And there is nothing immoral in discussing the fact that actions may have consequences. Take the work camps described in Solzhenitsyn's "One Day in the Life of Ivan Denisovitch." (Or, of course, the Nazi extermination camps. Or the U.S. concentration camps in Gitmo.) The camp management clearly sought a docile, "policeman inside," stoolie-oriented system where informers and "capos" (those who cooperate and act as de facto guards) see no reason NOT to be stoolies and capos. But merely the threat that stoolies and capos will be found with their throats slit is often enough to deter such behaviors. My point is that if librarians even think there is some small chance that someone they narc out to Big Brother will kill them or their families, such stoolie behavior may drop precipitously. --Tim May "A human being should be able to change a diaper, plan an invasion, butcher a hog, conn a ship, design a building, write a sonnet, balance accounts, build a wall, set a bone, comfort the dying, take orders, give orders, cooperate, act alone, solve equations, analyze a new problem, pitch manure, program a computer, cook a tasty meal, fight efficiently, die gallantly. Specialization is for insects." --Robert A. Heinlein
What Tim is (correctly) observing here is that a working challenge to the force monopoly is a very effective way to modify behaviour. Where Tim is wrong, though, is that he may have anything resembling a working challenge. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com
On Sunday 31 August 2003 19:20, James A. Donald wrote:
Talk is cheap. ... Indeed, the one may be connected to the other -- the absence of stoolies may well be connected to the presence of hot talk.
Dunno. I'm not sure that mere talk of killing a librarian would dissuade the potential stoolies. As you say, talk is cheap. Actions, reported widely in the mass media, will grab people's attention. On a related note, does anyone have a recommendation for a nice chianti? -- Steve Furlong Computer Condottiere Have GNU, Will Travel "If someone is so fearful that, that they're going to start using their weapons to protect their rights, makes me very nervous that these people have these weapons at all!" -- Rep. Henry Waxman
On Sunday, August 31, 2003, at 06:16 PM, Steve Furlong wrote:
On Sunday 31 August 2003 19:20, James A. Donald wrote:
Talk is cheap. ... Indeed, the one may be connected to the other -- the absence of stoolies may well be connected to the presence of hot talk.
Dunno. I'm not sure that mere talk of killing a librarian would dissuade the potential stoolies. As you say, talk is cheap. Actions, reported widely in the mass media, will grab people's attention.
You're being way too unimaginative, or literal, or something. This is at the discussion stage, and probably will be followed-through by others (if at all). The too literal part comes from thinking that discussions here mean someone here is going to kill some librarians. The too unimaginative part comes from thinking that publicity about the idea will not itself have an effect. The Mob doesn't actually have to kill too many stoolies for it to be widely known that ratting can be a very dangerous business. Maybe Big Brother will create a Witness Relocation Program especially for librarians who turn state's evidence. (But we will still find their families...bawaaahaaahaaa!) --Tim May
At 11:00 PM 8/29/2003 -0500, J.A. Terranson wrote:
I was *stunned* at how many ISPs told them to fuck off (including, I am happy to say, the one I work at)..
When a court order is present - that is a whole new ball game: nobody will refuse that.
Well maybe. What if a US ISP is incorporated with all foreign residents and no local employees (only trusted local contractors). No one to serve legal notice upon. ISP is housed in a standalone building which is owned outright (no landlord to serve). Site is monitored 24/7 via Internet and satellite links with remote controlled self-destruct devices (which to be effective must be capable of destroying the entire building). steve A foolish Constitutional inconsistency is the hobgoblin of freedom, adored by judges and demagogue statesmen. - Steve Schear
In that case, I would suspect the ISP itself would have incoming/outgoing feeds from other ISP's. If that single moral objector ISP refuses to allow carnivores, the other, not quite as moral ISP's might be persuaded to allow it, in which case the fedZ get what they want, just one traceroute hop further up the chain. Perhaps not all of them, but perhaps enough of them... Duh! That's the thing about the internet - your packets must travel through other ISP's (unless you're communicating with other nodes hosted by that single ISP which is unlikely). From the fedZ point of view, you need not tap each and every single ISP. You can tap upstream, and still get the data without tipping off the target, or his moral objector friends at her ISP. At some point every ISP goes through MCI, Sprint, and AT&T, and don't forget the local (phone company) loops. Assuming that such a moral objector ISP would exist, it would be foolish to assume that it would provide much of a measure of protection against tapping cleartext transmissions. Hence, encryption is important. Want privacy and security? It's up to you to provide it: encrypt. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :25Kliters anthrax, 38K liters botulinum toxin, 500 tons of /|\ \|/ :sarin, mustard and VX gas, mobile bio-weapons labs, nukular /\|/\ <--*-->:weapons.. Reasons for war on Iraq - GWB 2003-01-28 speech. \/|\/ /|\ :Found to date: 0. Cost of war: $800,000,000,000 USD. \|/ + v + : The look on Sadam's face - priceless! --------_sunder_@_sunder_._net_------- http://www.sunder.net ------------ On Sun, 31 Aug 2003, Steve Schear wrote:
Well maybe. What if a US ISP is incorporated with all foreign residents and no local employees (only trusted local contractors). No one to serve legal notice upon. ISP is housed in a standalone building which is owned outright (no landlord to serve). Site is monitored 24/7 via Internet and satellite links with remote controlled self-destruct devices (which to be effective must be capable of destroying the entire building).
On Fri, Aug 29, 2003 at 06:54:03PM -0700, Tim May wrote:
But when Big Brother commands that his Carnivore boxes be added, ISPs are afraid to shoot his agents who trespass.
I think my solution may be best: take a few ISPs who have bent over for Big Brother and kill their owners and staff. A few ISP owners found necklaced and smoking may send a message to others.
The message it sends is to accept the cops offer of on-site "protection" when the ISP is faced with allowing the tap or being put in jail. By upping the stakes you force the business owner to accept the cops as the lesser of two evils. The mafia's actions tended to make business owners clamor for more police and more intrusive police protection. Not less. This is a problem that's better solved with crypto. Eric
On Saturday, August 30, 2003, at 06:10 AM, Eric Murray wrote:
On Fri, Aug 29, 2003 at 06:54:03PM -0700, Tim May wrote:
But when Big Brother commands that his Carnivore boxes be added, ISPs are afraid to shoot his agents who trespass.
I think my solution may be best: take a few ISPs who have bent over for Big Brother and kill their owners and staff. A few ISP owners found necklaced and smoking may send a message to others.
The message it sends is to accept the cops offer of on-site "protection" when the ISP is faced with allowing the tap or being put in jail. By upping the stakes you force the business owner to accept the cops as the lesser of two evils.
The mafia's actions tended to make business owners clamor for more police and more intrusive police protection. Not less.
This is a problem that's better solved with crypto.
If cops ask local neighborhood members to report any suspicious activity, the folks know that any benefits they gain from acting as informants tend to be a lot smaller than the danger of being beat up or even killed by the Mafia. When the cost of acting as an informant is zero, no risk, more people act as informants. I think restoring some risk to being a rat is a good thing. --Tim May
Indeed. Despite all of Tim's rage, we're still just rats in a cage, and despite Tim's urging of necklacing ISP owners, or other foam at the mouth arm-chair solutions, Occam's razor still supplies the better, and cleaner solutions: If your MTA has it, turn on the START TLS option. If it doesn't, either compile it in, or get a new MTA for your server. Also add GPG/PGP, and hard drive encryption, to both your client and the server. (Since the discussion is about ISP's, we can assume that you own the server either hosted by or fed by your ISP - if you don't - i.e. you're on a dial-up PPP, you're at the ISP's mercy anyway, and the ISP can read/forge your mail unless you PGP every piece of email.) Don't have secure IMAP/POP capabilities? Use ssh as a secure tunnel to transport IMAP/POP/SMTP from the client into the server. Even when your client lives on the same network segment as the server. If you don't realize why this is useful, get clued in as quickly as you can. Of course, as usual, this discussion will next focus on physical security (hint for the above paragraph for those in need of a clue), then detecting black bag operations, with the usual "Read the Fucking Archives" coming from the usual source(s). And you know what? This indeed has already been dealt with, so yes, by all means, "Read the fucking archives" does apply. So go and read the fucking archives - all of you. That's your homework. Do it! There will be a quiz tomorrow! Be sure to bring your #2 pencils! :) ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :25Kliters anthrax, 38K liters botulinum toxin, 500 tons of /|\ \|/ :sarin, mustard and VX gas, mobile bio-weapons labs, nukular /\|/\ <--*-->:weapons.. Reasons for war on Iraq - GWB 2003-01-28 speech. \/|\/ /|\ :Found to date: 0. Cost of war: $800,000,000,000 USD. \|/ + v + : The look on Sadam's face - priceless! --------_sunder_@_sunder_._net_------- http://www.sunder.net ------------ On Sat, 30 Aug 2003, Eric Murray wrote:
This is a problem that's better solved with crypto.
participants (11)
-
Bill Frantz -
Eric Murray -
J.A. Terranson -
James A. Donald -
Morlock Elloi -
R. A. Hettinga -
Steve Furlong -
Steve Schear -
Sunder -
Tim -
Tim May