On Tue, Aug 21, 2001 at 11:31:15PM -0700, Black Unicorn wrote:

Yep. The most interesting lawyers I know are either professors, took high level positions in government, or do something OTHER than practice law.

I've found this to be true. Every few months I'm on a panel with general counsel/corporate lawyers. They're some of the most bland people imaginable. They're even worse when you're interviewing them. -Declan

At 10:30 PM 08/22/2001 +0100, r.duke@freedom.net wrote:

You mean it wasn't like in "The Firm" where all the firms chase after you, offering you wads of cash? That's a bit disappointing.

The movie ending was an annoying wimpout compared to the book, but there were some scenes that they did well, particularly the one where Hackman and the other lawyers are telling Cruz the importance of "Billing". Directly applicable in parts of the computer consulting biz....

At 09:48 PM 8/23/2001 +0100, r.duke@freedom.net wrote:

Mind you, most of the lawyers I've spoken to seem feel that the Internet is nothing new, legally. This leads me to think that lawyers on the whole, are not particularly imaginative or attentive people.

An alternate explanation might be that our legal tradition goes back, in some cases, to Roman times, and has already proven flexible and adaptable enough to encompass whatever flavor-of-the-week technologists are excited about now. It's not like technological change, in itself, is unheard of. What exactly is it that you think is new about the Internet, legally speaking?

...

They also have a newsletter, "The Filter," which is sometimes interesting. This year they started running a 5-day "Internet Law Program of Instruction," if you happen to have a spare $2500.

Oh hurrah. A bargain.

That's not bad, as things go, for a week of classes, if they're giving MCLE credits and have a nice continental breakfast. It's not like the attendees are expected to pay for this out of their own pockets. -- Greg Broiles gbroiles@well.com "We have found and closed the thing you watch us with." -- New Delhi street kids

On Thu, Aug 23, 2001 at 04:14:04PM -0700, Tim May wrote:

Meanwhile, don't expect to see me at the next CFP conference! Plenty of comped scribblers, though.

CFP is in SF next year, so you may want to stop by. As for "comped scribblers," I am one. But look at it from a journalist's perspective: We may attend two conferences a week, say at $1,500/per. Rough estimates, then, would be over $150,000 a year, more than most journalists make. Paying that much in conference fees is not feasible, and conference organizers generally understand this and let us in free (we may pay for meals) in exchange for publicity. -Declan

On Sat, Aug 25, 2001 at 09:02:06AM -0700, Tim May wrote:

First, $1500 per conference sounds way too high, even by today's inflated standards.

Tim, you haven't been to that many commercial conferences recently. I spoke at Internet World last month, and that's exactly how much it is. Even given the economic downturn, they haven't dropped the price. It's still $1,500 for the fall IW: http://www.internetworld.com/events/fall2001/conf_reg.php

Second, I can't believe there are 100 such conferences a year! If you are going to 2 conferences per week for most of a year, you're going to way too many conferences!

Maybe. But here in DC, there are scores of such conferences each year, and I could easily go to one or two a week. Some of my colleagues at other news organizations, like National Journal Tech Daily, do that. Even "nonprofit" conferences are still pricey: http://www.abanet.org/annual/2001/registration.html $650.00 http://www.cfp2001.org/php/control/main.php?l1=2 $685

Third, even scaling back the prices and numbers, I wasn't suggesting that no journalist be comped. Just that comping nearly a third or more of all attendees says something is out of whack.

Probably. Usually there are only a few (~20) journalists who are actually going to cover the event. -Declan

On Sat, Aug 25, 2001 at 03:19:49PM -0400, dmolnar wrote:

This year, there's a workshop on Privacy Enhancing Technologies being held immediately prior to CFP in the same building. Maybe this will lead to more interaction.

I'm looking forward to that. Wish I had made the first one.

Well, come a few days earlier and sit in comfy chairs for PET, while you're at it...

Tim, if you don't want to pay the admission fee, why don't you go as a journalist/columnist/commentator? It'll help you get started down the pundit circuit. :) -Declan

On Sat, Aug 25, 2001 at 01:32:31PM -0700, Tim May wrote:

I'll contact the CFP organizers and ask for one of their hundreds of free passes to the panels, talks, and banquets.

Let me know if you're turned down. BTW reporters have to pay for banquets and lunch/dinners at CFP. Some are $50. -Declan

On Saturday, August 25, 2001, at 12:19 PM, dmolnar wrote:

By the way, in case anyone knows Neal Stephenson, I know a science fiction conference which would love to invite him. (Yes, I've read his web page, yes, it's a lost cause, but writing of luminaries...)

Both Neal S. and Vernor Vinge have been attendees at this conference I was mentioning. (I won't be coy, but I'll evade the search engines: the HHaacckkeerrss Conference, held each year.) Both Neal and Vernor are far more interesting than Esther, John, and Mitch. (I had some dealings with Esther back when she was still mainly doing RELease 1.0, and I used to see her around town in Palo Alto, and she was reasonable to talk to. After she became a Globetrotting Pundit, she became too harried and scheduled and "important" to waste time just talking.) The hard part is getting beyond the canned speeches. For one thing, these people (the SF writers especially!) are used to people running up to them at SF conferences babbling to them about some story idea, so they "put their shields up." A few of us spent a Saturday evening and long Sunday with Vernor Vinge some years ago. It was only when we could talk and talk about all sorts of ideas that we got beyond the usual b.s. and defensive shields. Some of what we talked about made it into Vernor's last SF novel, which wouldn't have happened had I just been another SF con attendee who buttonholed him for a few minutes. (Doug Barnes, formerly active on this list, had similar contacts with Neal. I've met Neal a few times, but never got beyond the buttonholing stage...until he contacted me by e-mail after he realized the name of his novel, "Cryptonomicon," was awfully close to the name of my "Cyphernomicon." It turned out, much to my surprise, that Neal had not realized there was a tradition of "Necronomicon" uses, starting of course with Lovecraft. Neal had seen mention of "The Necronomicon" in a late night movie about "fighting skeletons" (I'm presuming it was "Army of Darkness" or "Evil Dead" he happened to see) and he thought the book title sounded cool. He was chagrinned, he told me, to find an entire range of such uses, including my own. He asked me if I objected to his book title, and I told him I of course did not. I had a similar experience with Steven Levy, author of "Hackers" and the recent book "Crypto." I'd met him briefly at various conferences (including the H.C.), but never got beyond the buttonholing stage. Until, that is, he took an interest in crypto and list themes and sought some of us out for longer talks. This is one of the main reasons I favor "relaxicons." In SF circles, these are, as you probably know, small cons with very few scheduled events. Cypherpunks meetings used to be like this, ironically. (The trend recently, for whatever reasons, has been to schedule several speakers. So we end up, for example, with lawyerbabblers from EFF coming in to give a pro forma speech while people try to "buttonhole" the speaker to somehow get a point across. See above.)

...

CFP could have been a conference where tech types mingled with policy types. Alas, very few of the Cypherpunks meeting folks ever go to the CFPs, even when they're held locally to the Bay Area. Mostly lawyers and spooks.

There was that workshop on "Privacy by Design" at the 99 or 00 CFP, wasn't there? The one report I had from that was not favorable, but it's not a *bad* idea.

This year, there's a workshop on Privacy Enhancing Technologies being held immediately prior to CFP in the same building. Maybe this will lead to more interaction.

http://www.pet2002.org/

(Disclaimer: one of the co-chairs is a co-author of mine. So yeah, this is thinly disguised plugging for the workshop. No, I don't know how much it will cost.)

I'm skeptical. I haven't looked in detail at this one, but the one Choate forwarded twice to the list was filled with corporate folks on the committees. (Some of whom used to be list subscribers. Fine folks, I'm sure, but now it's a corporate task for them to on committees.) I have another rant in mind, a rant about "affiliations." I'll just play the script and you can figure out what the rant is about: Alice: "What's your affiliation?" Tim: "I'm just a person, Tim May." Alice: "Yes, but what's your _affiliation_? What organization do you represent?" Tim: "Like I said, I'm just who I am. I don't represent anybody but myself." Alice: "Uh...OK...Uh....Say, do you know anyone else who would be willing to speak on this issue?" Our society seems obsessed with affiliations. Nearly everyone quoted in articles is "John Davis, V.P. of Interstitial Affairs at the Datawhack Corporation" or "Mindy Mannheim, Director, Global Progress Alliance." A friend of mine was a space enthusiast (asteroid mining, single stage to orbit, all the usual b.s.). He could never just be "Joe Blow." He was always having new business cards printed up showing his latest project. Always either a V.P. or a Director, except when he was a Program Manager, President, Chairman, or Founder. Never mind that his organizations were either private corporations (usually not even incorporated officially) or 'foundations." It seemed that the way for him to be quoted was to be "Joe Blow, Director of Operations, Solar Satellite Corporation." Being a misanthropic sort, it's great to get journalists out of my hair at conferences by just telling them I don't represent anyone, that I'm just at the conference for myself. If they had t.v. cameras and lights, I'm sure that's the point at which they'd yell "Kill the lights." Instead, they just nod politely and move on, hoping to get a sound bite from a Director or a Program Manager or a Professor. --Tim May

On Saturday, August 25, 2001, at 06:52 PM, dmolnar wrote:

[on the PET 2002 workshop]

...

I'm skeptical. I haven't looked in detail at this one, but the one Choate forwarded twice to the list was filled with corporate folks on the committees. (Some of whom used to be list subscribers. Fine folks, I'm sure, but now it's a corporate task for them to on committees.)

I think that all three refer to the same workshop.

I'm not sure I understand this comment, though. Do you think that the committee members are doing it solely because it's a "corporate task" which they have been ordered to do? or that they've lost interest in the research now that it is a "corporate task" to be on the program committee? What exactly is the problem with "corporate folks"?

I can't claim to speak for the committee members. From what I know of the co-chairs, however, they are not doing this simply because it is a "corporate task." Both of them have been interested in this area for as long as I've known them. As far as I can tell, their interest is genuine.

My point maybe didn't come across as clearly as it could (hey, even typing fast, it's a lot of work to make all points come out clearly, and the more I write, the more chance for unclear sections). The core technologies for "P.E.T." are basically what we've talking about, coding, and using for close to the past 10 years. Little is coming out of corporations. Even less from academia. More I started to write on this, but have deleted. If people want to hear the German academics talk about privacy technology, fine. Frankly, having been at my share of all-day Cypherpunks meetings, I doubt a 1.5-day workshop on what are essentially Cypherpunks tools is going to accomplish much. (What might? Putting several of the main architects of competing systems like Freedom, Mojo, Morpheus, Mixmaster, etc. together in a room with plenty of blackboards, a lot of beer, and some folks like Lucky, Wei Dai, Hal Finney, and others to hash out some of the tough issues and maybe catalyze some breakthroughs. Looking at the topics, I see the likely paper contributors will be academics and corporate ladder-climbers.)

Now, it *is* being run as a straight-up academic workshop, with Springer-Verlag proceedings, refereed papers, and that whole nine yards. This has certain disadvantages. Long lead times between genesis of an idea and publication (not to *mention* implementation), for one. Arguably too much emphasis on theory and citations rather than just "cypherpunks write code," for another. You can go after it on those grounds (and we can argue about that for another four or five messages if you want), but that seems to be distinct from talking about "corporate folks" on the program committee -- have I missed something?

This point you raise fits in closely with the names on the program list. As with Financial Cryptography and Information-Hiding, the field has become sort of "respectable." So now we have the Dutch Data Protection Authority and the Independent Centre for Privacy Protection and some universities represented so well. (It's actually just part of the sham of these conferences. These are not conferences where innovative _research_ is discussed. These are places where somebody's particular twist on other ideas, ideas which would barely rate a thread here on these mailing lists, is puffed out into an academic-looking paper.)

It's my hope that workshops like this will help attract smart people to work on the problems in remailers, implementing digital cash, and other fun Cypherpunkish topics. People who've never even heard of "Cypherpunks," and who would otherwise go off and do number theory or something else.

Look, people not already involved in this area won't spend $$$ going early to SF and paying for this workshop. You'll likely get some drones from Motorola and Intel who convince their bosses that this sounds important, and you'll get some Feds and other spooks who go to get up to speed on what to look for. If you think this is "outreach" for Cypherpunks, where are the Cypherpunks on the program committee. I count one, maybe 1.5 if Lance is still doing this stuff (last I heard, he wasn't, and he hasn't posted here in a very, very long time). The rest are academics and staid corporate types. I'll bet they'll quash any papers dealing with using crypto to undermine governments. It sounds pretty creepy to me. No doubt a lot of journalists will cover it. Most of them comped, no doubt. --Tim May

On Saturday, August 25, 2001, at 11:51 PM, dmolnar wrote:

On Sat, 25 Aug 2001, Tim May wrote:

...

(What might? Putting several of the main architects of competing systems like Freedom, Mojo, Morpheus, Mixmaster, etc. together in a room with plenty of blackboards, a lot of beer, and some folks like Lucky, Wei Dai, Hal Finney, and others to hash out some of the tough issues and maybe catalyze some breakthroughs. Looking at the topics, I see the likely paper contributors will be academics and corporate ladder-climbers.)

That's what targeted publicity is for -- making sure the right people see the message and show up (and maybe publish something). While I didn't make it to the 2001 Berkeley workshop, I know that some of the Freenet developers were there. ZKS was well-represented. I think the Mojo people were there, though I could be wrong. That's a start.

No, you're missing the point. The idea is not to just get _bodies_ paying their $600 or $1000 or whatever. That's just business as usual, with suits with Powerpoint on their laptops displaying pretty charts. When I said get the main architects together in a room, with lots of beer, I meant that literally. I didn't mean a presentation at the Airport Hilton or wherever. I meant an intense brain-storming session. The beer to lubricate the "bullshits!" and "here's a better way"s. Instead, you're just describing a "that's a start" scenario which is actually just a snooze-a-thon.

Then once everyone's there, the rest is a matter of (non)scheduling and beer ordering. (well, and Kahlua maybe).

So what I should do now, I guess, is contact the Morpheus team and convince them to come. maybe submit something if they feel like it.

Little point in them just presenting a set of dry slides on what Morpheus is intended to do, blah blah blah. This is what is missing from so many conferences: pizazz! Controversy, yelling, bullshit claims being denounced. (I'm not saying the Morpheus or Freenet or Mojo people are making bullshit claims, but it's clear that _some_ of the P2P/crypto players JUST DON'T GET IT.) Rooms filled with comped (and bored) journalists, suits giving summaries of product plans, spooks from Washington outlining policy initiatives. Fuck that noise. --Tim May

On Sun, 26 Aug 2001, Tim May wrote:

I don't know if you speak for the P.E.T. Workshop or not, Dave, but the mistake with this and similar recent conferences is to think that you can just issue a "cattle call" for papers and have interesting papers come in.

Right, I should make this crystal clear. I do *not* speak for this workshop. I am *not* one of the organizers, and I'm not on the program committee. I happen to know (some of) the organizers, but that's about it. -David

On Saturday, August 25, 2001, at 07:59 AM, Declan McCullagh wrote:

As for "comped scribblers," I am one. But look at it from a journalist's perspective: We may attend two conferences a week, say at $1,500/per. Rough estimates, then, would be over $150,000 a year, more than most journalists make.

Paying that much in conference fees is not feasible, and conference organizers generally understand this and let us in free (we may pay for meals) in exchange for publicity.

A couple of more words on this issue: Granted, the conference gets publicity. But, presumably, the magazine or other outlet gets readers and viewers. A two-way street, right? "Wired" and "Wired News" are businesses. If covering CFP is good business, paying their costs to attend sounds like a sound business decision. Honestly speaking, I see a lot more economic justification for Terra-Lycos to pay $600 (or whatever) for Declan's registration fees, and then count these as business costs, than I see economic justification for Tim May, say, to pay $600 to attend (and not be able to deduct it in any way). Which is why conferences like CFP mostly end up with a predictable mix of lawyers, government officials (probably comped to attend, though I don't know this), and journalists. And which is why the panels end up with a lot of journalists pontificating to each other. (Based on the two CFPs I attended...) Frankly, I don't understand why CFP doesn't just accept the inevitable and move the conference to Washington, D.C. permanently. --Tim May

At 12:57 PM 08/25/2001 -0400, Declan McCullagh wrote:

On Sat, Aug 25, 2001 at 09:38:34AM -0700, Tim May wrote:

...

Granted, the conference gets publicity. But, presumably, the magazine or other outlet gets readers and viewers. A two-way street, right?

Maybe. But so far, market forces have prompted few conferences to try to push journalists around and try to make this argument. I covered PFF's Aspen conference this week. If I had to pay $800, I probably wouldn't have gone.

But PFF is also a Pundit-Con - it gets its value not only from the speakers and attendees but also from the reporters who attend, and they're as important a part of the business expenses of the conference as booze and rubber chicken, and there'd probably be fewer paying attendees without them. Similarly, at PR-oriented computer conferences (Comdex et al.) that's the case, while at academic conferences (Crypto in Santa Barbara, for instance), they're not, and obviously at journalism-oriented conferences they're the target paying audience so they're not comped. I suspect Tim's objection to paying high rates for conferences where journalists are comped is partly due to the content and style of the conference...

On Sat, Aug 25, 2001 at 05:44:39PM -0700, Tim May wrote:

I won't pay these rates for _any_ conference. Greg Broiles hit the nail on the head: the only ones worth paying for are the ones with short-term economic payoff. For CFP, this probably means law firms hoping to get some business, or hoping to recruit some lawyers.

CFP is still worth attending, but more as a social event nowadays. It's started to become a corporate-privacy-officer conference. I was chatting two weeks ago with a friend who's a CPO at one of the valley's largest firms and my friend was talking about suggesting a panel on "how firms can comply with european data directive stuff." Not unimportant in a practical sense, but hardly interesting, or cypherpunkish. -Declan

I'm writing a lot today. These last several days, actually. Maybe I got enough sleep, maybe the debate about how CFP has been taken over by the droids is inspiring me, maybe it's because I can't wait until I can get these drawings (talked about later) up on my soon-to-appear "virtual whiteboard" Web site. Whatever, what follows here (I'm writing this intro last) is probably one of the most important essays I've written in recent months. If most of you disgree, I'll know I'm truly out of touch. On Saturday, August 25, 2001, at 08:25 PM, Declan McCullagh wrote:

On Sat, Aug 25, 2001 at 05:44:39PM -0700, Tim May wrote:

...

I won't pay these rates for _any_ conference. Greg Broiles hit the nail on the head: the only ones worth paying for are the ones with short-term economic payoff. For CFP, this probably means law firms hoping to get some business, or hoping to recruit some lawyers.

CFP is still worth attending, but more as a social event nowadays. It's started to become a corporate-privacy-officer conference. I was chatting two weeks ago with a friend who's a CPO at one of the valley's largest firms and my friend was talking about suggesting a panel on "how firms can comply with european data directive stuff." Not unimportant in a practical sense, but hardly interesting, or cypherpunkish.

So I guess my candidate submission for the P.E.T. workshop might not be well-received: "BlackNet; Case History of a Practically Untraceable System for Buying and Selling Corporate and National Secrets." The whole notion of "Chief Privacy Officers" shows how ridiculous things have become. For several obvious reasons we've talked about many times. (And the notion that companies like ZKS will survive by reinventing themselve as privacy consultants to comply with privacy laws is equally silly. Hint: Whatever companies need to meet privacy "laws" in Europe, Asia, and North America doesn't have much to do with PipeNets and extremely robust systems for high-bandwidth communication.) But I guess the vanished occupations of "Web Master" and "Web Mistress" had to morph into something equally silly. PLOTTING THE COSTS AND BENEFITS OF UNTRACEABILITY Look, this is all part of something I talked about at the June physical meeting in Berkeley: by failing to acknowledge the "high-value" markets for untraceability, characterized by such things as Swiss bank accounts and income-hiding, porn-trading rings, and information markets, the whole technology of privacy/untraceability gets ghettoized into low-value markets like "untraceable subway tokens" (wow, gee!), weak versions of proxy surfing tools, and boring attempts to get people to use digital money for things they don't mind using Visa and PayPal for. At the June meeting I drew a graph which makes the point clearly. A pity I can't draw it here. (Yeah, there are ways. My new Web page should have some drawings soon. But this list is about ASCII.) Plot "Value of Being Untraceable in a Transaction" on the X-axis. This is the perceived _value_ of being untraceable or private. Start with "little or nothing," proceed to "about a dollar" then to "hundreds of dollars" then to "thousands" then to "tens of thousands and more." (The value of being untraceable is also the cost of getting caught: getting caught plotting the overthrow of the Crown Prince of Abu Fukyou, being outed by a corporation in a lawsuit, being audited by the IRS and them finding evaded taxes, having the cops find a cache of snuff films on your hard disk, and so on.) Some examples: People will demonstrably get on planes and fly to the Cayman Islands to open bank accounts offering them untraceability (of a certain kind). It is demonstrably worth it to them to pay thousands, even tens of thousands, of dollars to set up shell accounts, dummy corporations, Swiss bank accounts, etc. For whatever various and sundry reasons. (They may be Panamanian dictators, they may be Get Rich Quick scamsters, they may be spies within the FBI or CIA.) They expect a "value of untraceability" to be high, in the tens or hundreds of thousands...or even much higher. Even their lives. Call this the "Over $100K" regime. I cite this because it disputes directly the popular slogans: "People won't pay anything for privacy or untraceability." (In fact, people pay quite large sums for privacy and untraceability. Ask Hollywood or corporate bigshots what they pay not to be traced.) People will also pay money not to be traceable in gambling situations. They gamble with bookies, they fly to offshore gambling havens, and so on. The _value_ to them is high, but not at the level above. If they're caught, they face tax evasion charges, maybe. Call this the "$1K-10K" regime. (The spread is wide, from low-rent bookie bets which even the IRS probably doesn't care much about to schemes to avoid large amounts of tax.) At lesser levels, some choose to pay cash for their video tape rentals (with deposits arranged) just to avoid leaving a paper trail. (Bet Justice Thomas wishes he had.) And then at very low levels there are the cases where the benefits of untraceability are worth little or nothing to most people. I call this the "millicent ghetto." Actually, the ghetto begins down at around a dollar or less. Sadly, a huge number of the proposed "untraceable digital cash" systems are targetted at uses deep down in this ghetto. (Perhaps because they have no hint of illegality?) On the Y-axis. Plot here the _costs_ of achieving untraceability for these levels of achieved. This is the cost of tools, of using the tools, of delays caused by the tools, etc. For example, flying to the Cayman Islands to personally open a bank account may cost a couple of days in time, the airfare, and (more nebulously) the possible cost of having one's photograph taken for future use upon boarding that plan for Switzerland or the Caymans. Lesser costs, but still costs, would be the costs of using Freedom (much frustration, say most of my friends who have tried to use it), the costs of getting a Mark Twain Bank digital cash account and actually having it work the way it should, and just the overhead/costs of using PGP. Now on this X-Y graph plot the "blobs" where benefit/cost clouds of points are found. The 45-degree line is where the "costs" equal the "benefits." (These values change somewhat in time, of course, but the general point is still clear I expect.) Anything _below_ this 45-degree line is "cost effective": benefits > costs. Anything _above_ this line is NOT cost-effective: costs > benefits. (In the economics of black markets, or illegal activities, we can expand these terms a bit. For example, "costs = costs of being caught x chance of being caught." An illegal action which will result in a $100K fine but which is only expected to be caught 1% of the time has a resultant cost of $1K. This is the "expected cost." Obviously, the idea of crypto and untracebility tools is to alter the equation by reducing the chance of being caught.) RATIONAL ACTORS The obvious point is that rational actors never pay more for untraceability than they get back in perceived benefits. Someone will not pay $1000 for privacy/untraceability technology or tools that only nets them $500 in perceived benefits. They won't spend $1.00 in tools to net them 10 cents in perceived benefits. THE SWEET SPOT The "sweet spot" for privacy/untraceability tools is out of the "millicent ghetto" so much of the focus has beenon, and is even out of the "private Web surfing to avoid company tracing" ghetto, roughly at the tens of dollars levels. (It is hard to imagine how the "cost" of having Pillsbury know your baked good preferences is more than some trivial amount. This is the "ghetto" of low value transactions. However, not having the FBI know your are interested in "Lolita" images can be worth many hundreds of thousands of dollars in terms of avoided jail time, fines, loss of employability, etc. (Do I think many pedophiles will, accordingly, pay hundreds of thousands for technologies to make them untraceable? Of course not, for reason psychologists are familiar with. But they'll pay some amount, and that amount may dwarf the aggregate value of what all of the "millicent ghetto" dwellers will pay. Interestingly, ZKS Freedom as ORIGINALLY SPECCED would have provide this "pedophile-grade untraceabilty" (to coin a phrase). Does it now? I don't think so, from what I hear from Wei Dai, Lucky Green, and from words coming out of ZKS. Apparently they are not planning to focus on these "high value" areas.) Things start to get "interesting" at the thousands of dollars for tools for tens or hundreds of thousands of dollars in benefits. (By the way, the same applies to crypto per se. The military has "crypto specialists" and "crypto shacks" on board ships. But these cost a lot of money in training, procedures, and equipment. Millions of dollars a year for a ship, for example. Do the math. Real crypto is more than just strength of algorithms and keys: it's this economic trade-off. Too much of "why don't people use crypto more?" whines fails to see this basic point.) The "sweet spot" often, practically by definition, involves putatively illegal activities: child porn, plotting revolution in Saudi Arabia, selling corporate secrets, distributing banned materials, etc. Only in these situations are the "costs of failure to be untraceable" high enough to make spending money and time learning to be untraceable worthwhile. It is not surprising that "those with nothing to hide" tend to put their money into their local bank branches under their own names while "those with something to hide" tend to open Swiss bank accounts. Again, draw this region as a blob far to the right on the X-axis and, we hope, not very high up on the Y-axis. Meaning, advances in crypto, remailers, digital money, etc. will make this "sweet spot" truly sweet. CORPORATIONS AND ACADEMICS FOCUS ON THE "GHETTO" NEAR THE ORIGIN Still, corporations and academics focus on the "near the origin" blobs: millicent payment schemes, slight Web surfing untraceability tricks, subway tokens, etc. Because to focus on the real sweet spot is to admit to working on crypto anarchy, untraceable revolutionary cells, child porn rings, all that good happy stuff. The stuff people want to be untraceable for--and are willing to pay for. This is the failure of nerve that all corporations and "reputable" academics face. CONCLUSION: To really do something about untraceability you need to be untraceable. Draw this graph I outlined. Think about where the markets are for tools for privacy and untraceability. Realize that many of the "far out' sweet spot applications are not necessarily immoral: think of freedom fighters in communist-controlled regimes, think of distribution of birth control information in Islamic countries, think of Jews hiding their assets in Swiss bank accounts, think of revolutionaries overthrowing bad governments, think of people avoiding unfair or confiscatory taxes, think of people selling their expertise when some guild says they are forbidden to. Most of all, think about why so many efforts to sort of deploy digital cash or untraceability tools have essentially failed due to a failure of nerve, a failure to go for the brass ring. --Tim May

On Sat, 25 Aug 2001, Tim May wrote:

RATIONAL ACTORS

The obvious point is that rational actors never pay more for untraceability than they get back in perceived benefits. Someone will not pay $1000 for privacy/untraceability technology or tools that only nets them $500 in perceived benefits.

They won't spend $1.00 in tools to net them 10 cents in perceived benefits.

If it's restricted to a single opportunity, yes. If one adds the boundary condition of repeatability your thesis comes apart. Consider the cost of using an anonymizing layer which is for almost all players equal. The point to be gained here is there are different anonymizing layers. Each with their own specific characteristics. A mouse doesn't look like an elephant for a reason. Now if the anonymizing layer is digital, for example, the cost is about the same across the board, irrespective of other source/sink magnitudes. In those cases for example, assuming a higher resourced player was involved would mean the cost of enforcement would go up. They would have resources to spend on additional, and distinct, anonymizing layers that lower layered players wouldn't have available. Most rational actors, instead of measuring 'perceived benefits', will only pay a certain percentage of their gains to reap those gains. One can then break the various layers (eg 10%, 20%, 30%, ...) into characteristic behaviours. It's also worth noting that a specific relation between the selection of that percentage and how much the player already has is present. A Markov Chain of behaviours would be a more apt model. Not everyone faced with the same numbers will make the same choice. There is a limit to 'rationality'. -- ____________________________________________________________________ natsugusa ya...tsuwamonodomo ga...yume no ato summer grass...those mighty warriors'...dream-tracks Matsuo Basho The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage@ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

On Monday, August 27, 2001, at 02:00 PM, Aimee Farr wrote:

Tim May:

...

So I guess my candidate submission for the P.E.T. workshop might not be well-received: "BlackNet; Case History of a Practically Untraceable System for Buying and Selling Corporate and National Secrets.

No, you want E.E.T. -- "Espionage-enhancing Technologies."

Some of you need a lawyer on your shoulder. Like a little parrot. *squawk!* ECPA Section 2516(1)(p); FISA, if that includes being controlled by aliens from outer-space; USC Title 18 1831. Section 1831 Economic espionage (a) In General - Whoever, intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or foreign agent, knowingly - (1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains a trade secret; (2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret, (3) receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization, (4) attempts to commit any offense described in any of paragraphs (1) through (3), or (5) conspires with one or more other persons to commit any offense described in any of paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy, shall, except as provided in subsection (b), be fined not more than $500,000 or imprisoned not more than 15 years, or both.

Section 1837 Applicability to conduct outside the United States This chapter also applies to conduct occurring outside the United States if (1) the offender is a natural person who is a citizen or permanent resident alien of the United States, or an organization organized under the laws of the United States or a State or political subdivision thereof-, or (2) an act in furtherance of the offense was committed in the United States.

Your idea does seem to offer promise as a vehicle for treason, espionage, trade secrets, malicious mischief, piracy, bribery of public officials, concealment of assets, transmission of wagering information, murder for hire, threatening or retaliating against Federal officials, a transactional environment for nuclear and biologic weapons, narcotic and arms trafficking....sweet spots. *shakes head*

Despite frequently urging newcomers to "read the archives--or at least use some search engines!," nitwits like Aimee are only just now figuring out what was crystal clear in 1992-3. No wonder she's doing scut work for the SS outpost in Waco, near Bush's Crawford ranch. --Tim May

On Monday, August 27, 2001, at 07:53 PM, Aimee Farr wrote:

The EEA wasn't passed until 96. I failed to mention Title 18 United States Code, Section(s) 794(c).

"Agents kick crypto ass." http://www.fas.org/irp/ops/ci/regan_complaint.html'

....That wouldn't be what has your little mice running in their wheels, would it?

Your role as an agent provocateur here is noted. Not so bright, though. And you've outed yourself by not-so-subtle hints about the SS "prime rib." People like you deserve what you get. --Tim May

On Monday, August 27, 2001, at 09:22 PM, Aimee Farr wrote:

...

Your role as an agent provocateur here is noted.

Your role as a son-uv-a-bitch to me is noted.

Trying to keep people out of trouble is a "provocateur?" Gee, sorry to dampen your conspiracy.

I posted Regan because it was directly relevant to this discussion, and it makes a couple of points -- some of which run in your favor.

Considering the incredibly bad timing of this discussion in light of world events, I don't see how you could call ME a provocateur. My jibe was good-natured. You keep posting the equivalent of classified ads. I know who wants this shit now, and it's not "little bad men.

You complained a few weeks ago about the timing of the "help me make bombz" posts...as if we have any choice about when AOL-accounted narcs post such requests. And now, bizarrely, you think the "timing" of a reference to Blacknet, which was deployed in 1993, is "bad timing." Fuck off, twit. --Tim May

-- On 27 Aug 2001, at 23:22, Aimee Farr wrote:

Considering the incredibly bad timing of this discussion in light of world events, I don't see how you could call ME a provocateur. My jibe was good-natured. You keep posting the equivalent of classified ads. I know who wants this shit now, and it's not "little bad men."

The main world events that I have noticed is that President Bush has deballed the world gun control treaty, in part because it would hinder aid to revolutionary movements that have interests in common with the US, and that Bush is making unkind noises about the world treaty against tax havens and financial secrecy, in part because it would give the EEC too much control over international money flows. The state has always been repressive -- and different states have always disagreed strongly over what needs to be repressed. In 1376 the Holy Roman Church declared itself supreme in all matters of thought, and declared that any thinking not first approved and authorized in advanced by the church, and conducted in proper church channels, was heresy and/or witchcraft punishable by burning at the stake. However, under the original treaty between Pope and holy roman empire, any such burnings required both the Pope's judges and the King's goons (oversimplification, but that is essense of it). Since Pope and King were usually trying to kill each other, freedom survived, though not easily. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG ulrWnHbYmYLr1ALq5yaAlnuwr5SRSzH8gTSgtzmj 4dYLsf/2UwXTPBn4+ZQRxpjVyJJWsQWAYxEuZEWiN

At 21:53 8/27/2001 -0500, Aimee Farr wrote:

http://www.fas.org/irp/ops/ci/regan_complaint.html

"...On June 21, 2001, Regan sent an email from an account registered in his own name to an email account in the name of his wife."

Who was the provider? Was this a dedicated, ISP-provided account, or was it webmail? In either case, which one?

That wouldn't be what has your little mice running in their wheels, would it?

...

No wonder she's doing scut work for the SS outpost in Waco, near Bush's Crawford ranch.

--Tim May

Ah, Tim makes a funny.

~Aimee

-- On 27 Aug 2001, at 16:00, Aimee Farr wrote:

Your idea does seem to offer promise as a vehicle for treason, espionage, trade secrets, malicious mischief, piracy, bribery of public officials, concealment of assets, transmission of wagering information, murder for hire, threatening or retaliating against Federal officials, a transactional environment for nuclear and biologic weapons, narcotic and arms trafficking....sweet spots. *shakes head*

Sounds good to me. I am sure it will sound pretty good to President Bush if the primary targets are in Sudan or Borneo, rather than the target being Bush. And it will probably sound pretty good to some guy in Sudan if the primary target is Bush. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG cP6zSfn46m6Tcs5LHfHssOmejDBq3DjqNkpEEtbY 43ILLkFOVdn0istQ5ydYLv94EZa/2p9G2WsMUao2i

At 15:32 23/08/2001 -0700, you wrote:

At 09:48 PM 8/23/2001 +0100, r.duke@freedom.net wrote:

...

Mind you, most of the lawyers I've spoken to seem feel that the Internet is nothing new, legally. This leads me to think that lawyers on the whole, are not particularly imaginative or attentive people.

An alternate explanation might be that our legal tradition goes back, in some cases, to Roman times, and has already proven flexible and adaptable enough to encompass whatever flavor-of-the-week technologists are excited about now. It's not like technological change, in itself, is unheard of.

Often true, but new technologies can necessitate new interpretations of laws which were not written well enough to translate smoothly to the newest "flavour or the week" technology.

What exactly is it that you think is new about the Internet, legally speaking?

I would have thought that new interpretations of things like federal and state jurisdictions would be needed. Given the arguments over the recent decision on Yahoo from France, I'd say there are questions to be answered. Is a company under your jurisdiction as soon as you can see its servers? Are ISPs carriers, or providers? What about their webservers, which store and provide, as opposed to simply carrying? Tell me if I'm wildly off base - I don't mind, but it seems to me that at the moment, these issues are not obvious and written in stone.

...

...

They also have a newsletter, "The Filter," which is sometimes interesting. This year they started running a 5-day "Internet Law Program of Instruction," if you happen to have a spare $2500.

Oh hurrah. A bargain.

That's not bad, as things go, for a week of classes, if they're giving MCLE credits and have a nice continental breakfast. It's not like the attendees are expected to pay for this out of their own pockets.

Actually, I stand corrected - it's no more than your average technical training course (Sun, etc). Given that it's something I'd have to pay for, instead of my employer, it seemed expensive. Things always look more affordable when you can get your manager to sign them off. ++rd ________________________________________________________________________ Protect your privacy! - Get Freedom 2.0 at http://www.freedom.net

At 12:43 AM 8/24/2001 +0100, r.duke@freedom.net wrote:

...

What exactly is it that you think is new about the Internet, legally speaking?

I would have thought that new interpretations of things like federal and state jurisdictions would be needed. Given the arguments over the recent decision on Yahoo from France, I'd say there are questions to be answered. Is a company under your jurisdiction as soon as you can see its servers? Are ISPs carriers, or providers? What about their webservers, which store and provide, as opposed to simply carrying?

Tell me if I'm wildly off base - I don't mind, but it seems to me that at the moment, these issues are not obvious and written in stone.

I don't think the answers are obvious or unchanging - but the answers to questions like that about meatspace things related to (relatively) unchanging media or technology aren't obvious or unchanging, either. Really, there aren't a lot of hard-and-fast "answers", because every question's got two sides, and there's always someone who wants things to work differently, because the status quo hurts them and the difference would help them. I don't think the jurisdictional questions are especially different from those raised by postal mail, printed publications, telephones, or fax machines - the big difference I see is one of quantity, not quality, because communicating over great distances in a machine-comprehensible format (well, sort of) allows machines to speed up and automate the communicating process, allowing smaller organizations to piss off more people in more diverse jurisdictions more quickly. But the basic questions about the appropriateness of a court in one place exercising power over people or property some distance away haven't changed at all - and unless there's something really different about one form of communications, I don't see any reason to treat it differently from the rest. Many of the questions currently in the news - including the Napster/copyright and jurisdictional/regulatory arbitrage approaches - were in the news 200 years ago. (See, for example, "Dickens's 1842 Reading Tour: Launching the Copyright Question in Tempestuous Seas" at <http://landow.stg.brown.edu/victorian/dickens/pva/pva75.html> for a discussion of 200 years' worth of offshore piracy)

Actually, I stand corrected - it's no more than your average technical training course (Sun, etc). Given that it's something I'd have to pay for, instead of my employer, it seemed expensive. Things always look more affordable when you can get your manager to sign them off.

As Tim mentioned, they're not really priced for people who are self-educating - the dollar/learning ratio would be a lot better with basic books & periodicals, and the time would be as profitably (or more profitably) spent at low-cost or no-cost events like Cypherpunks meetings, BAWUG meetings, the Mac Crypto conference, and other efforts more focused on peer-to-peer interaction. I have found those high-ticket events to be valuable when I was able to immediately use the information gained in my work - either because the people speaking had a perspective unavailable to me (like one seminar I went to which featured a bunch of people from the Dept of Commmerce/BXA explaining how they interpreted crypto export control regs), or because they saved me many hours of work collecting and interpreting voluminous information into outline/presentation format. But I don't bother with those sorts of things unless I can see how they'll pay for themselves within 60 days or so, either by speeding up existing work or letting me start new projects previously unavailable. -- Greg Broiles gbroiles@well.com "We have found and closed the thing you watch us with." -- New Delhi street kids