-----BEGIN PGP SIGNED MESSAGE----- At 09:59 AM 5/31/97 -0400, Marc Rotenberg wrote:

Btw - Declan's summary of our views on privacy below are just silly. Many of the greatest defenders of First Amendment freedoms have also felt most strongly about the right of privacy. The question is always how you protect rights. Perhaps libertarians would do away with all laws that protect personal freedoms. Bad call.

Of course the beloved Eurocratic method of protecting privacy in the computer age is to require registration of all computers and databases which store discrete information about individuals. Register Communists Not Computers!* DCF *Just kidding. Commies shouldn't have to register either. -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQCVAwUBM5BAHoVO4r4sgSPhAQFJYgP/bnVFsw+gSdbblQ0QEjkcZOV+H1FOUIoZ TJ+hM+3CjtfjBuKqZ3+Y8Y5fb2Bqt06BgYmwhUx60HLhRFFwUPuwDqqaYE+6LGAr qyHkJBQjsbmvatTYAY6LWhijAVsDuHvJXHjWiyTKIwwTk71h+wSl1EGrPMYjr5jk c1yLnYQ6i9U= =zUYB -----END PGP SIGNATURE-----

I'm now more awake than I was before, and a little less flippant, so let me try to respond to Marc's statement saying my summary of his "views on privacy below are just silly." The initial question has to be not how you protect rights, but how you define them. For example, we have a right to speak freely; there should be strict limits on government controls on free expression or the press. The state has unique powers of coercion. Similarly, there should be strict limits on government collection of personal data about its citizens. But transactional privacy is a different matter. Sure, we may generally agree that privacy is the famous "right to be left alone," but how does that extend to what happens when I make an affirmative choice to connect to a web site that might record some info about my visit -- as an alternative to charging me? Nobody's forcing me to visit that site. That's why I'm starting to come around to the idea that privacy is not a universal right but a preference. We need a market in privacy, not inflexible FTC rulemaking. Oh, and the much-touted European Privacy Directive has made it near-impossible to exchange employee information between branches of the same firm that are physically in different countries. Bad move, Eurocrats. -Declan On Sat, 31 May 1997, Marc Rotenberg wrote:

People who are interested in why I am pro-individual freedom but not anti-government should take a look a my piece in Wired "Eurocrats Do Good Privacy." [4.05]

I spent a year working for a good crypto policy at the OECD. During that time I watched European government officials argue for constitutional freedoms and against key escrow, while business representatives quietly backed the US GAK plan. Welcome to the real world.

Marc.

Btw - Declan's summary of our views on privacy below are just silly. Many of the greatest defenders of First Amendment freedoms have also felt most strongly about the right of privacy. The question is always how you protect rights. Perhaps libertarians would do away with all laws that protect personal freedoms. Bad call.

At 3:21 AM -0400 5/31/97, Declan McCullagh wrote:

...

Unfortunately, Tim is letting a rant get in the way of reality. A shame, really, for he's capable of better. Let me respond. I may not be very cordial. We lost tonight's soccer game (goddamn wimpy libertarians) and went to some cheezy Crystal City sports bar afterwards. I just got back home, and it's 3:20 am...

Anyway, Rotenberg and EPIC are not the Uber Enemy. Rather, they disagree with cypherpunk and libertarian positions on some issues. So we have issue-by-issue alliances with them. Let's break it down:

------------------------------ CRYPTO: EPIC takes a purist civil liberties approach to crypto. They've been the ones criticizing the SAFE "crypto in crime" provisions. Did the latest VTW alert sent out today even mention that portion of the bill, let alone criticize it?

ANONYMITY: No other group in DC is such a staunch supporter of online anonymity publicly, though look for something from Cato soon. In fact, I linked to EPIC's copy of the McIntyre decision for my Friday Netly piece. Many business groups don't like anonymity online -- hurts the marketeers.

FREE SPEECH: EPIC is co-counsel in ACLU lawsuit against CDA. I believe they've said some of the anti-spam legislation is unconstitutional.

FOIA: David Sobel does fabulous work snagging government documents the spooks don't want released.

PRIVACY: EPIC wants more Federal involvement to protect privacy and a Federal Privacy Commission (or something similar). Lots of laws, bureaucracies. Though EPIC does realize there's a First Amendment; other privacy groups are even more aggressive. EPIC is of course on the side of libertarians when it comes to government violations of privacy. ------------------------------

From a libertarian perspective, EPIC is good on everything but privacy. On that they want Big Government solutions.

But that doesn't mean we reject and condemn what they do on other issues. Do we reject Eagle Forum's anti-Clipper endorsement because they're a bunch of ultraconservative wackos? Do we reject the National Organization for Women's position on the CDA as bad because they're a bunch of ultraliberal wackos? How about the National Association of Broadcaster's amicus brief against the CDA? The Christian Coalition rejecting a national ID cards and numbers? Ralph Nader wanting open access to government databases?

No. We don't. Instead, we address this issue by issue. EPIC and Rotenberg are not always, but are often, our allies.

-Declan

On Fri, 30 May 1997, Tim May wrote:

...

I suppose I am developing a reputation amongst the Inside the Beltway Cyber Rights Groups (tm) as a pain in the ass, but nearly everytime I see one of their chief spokeswonks giving a policy statement I realize they are "not on my side."

The latest quote is from Marc Rotenberg, on a CNN piece on spam and anti-spam legislation, saying that what the legislators in Congress really need to look into is how the spammers develop their data bases.....

Incredible. Does he propose investigations of private data gathering? Perhaps search warrants served on those who take public postings and construct data bases?

Look, I'm annoyed by getting 5-10 "unwanted" spam messages a day. But I realize the "spammers" are merely taking publicly available (= legally available, as 99.99% of all such information is) information and using legal channels to contact me. I may not "like" it, but their behavior is as legal as someone calling me on the phone.

(And ny nearly any measure of hassle factor, dashing to get to the phone only to find it's a salesman selling something I don't want is worse than any 20 unwanted e-mail messages.)

So, Marc Rotenberg wants Congress to "look into" (= interfere with) compilation and use of public information.

These people are NOT our allies.

--Tim May

There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

================================================================== Marc Rotenberg, director * +1 202 544 9240 (tel) Electronic Privacy Information Center * +1 202 547 5482 (fax) 666 Pennsylvania Ave., SE Suite 301 * rotenberg@epic.org Washington, DC 20003 USA + http://www.epic.org ==================================================================

At 2:33 PM -0700 5/31/97, Marc Rotenberg wrote:

It's an interesting argument. I don't agree, though you can certaintly try it. But more to the point of

Oh, I don't intend to "try it." The Supreme Court is far past ever restoring basic constitutional rights. Instead of "trying it," better to monkeywrench it.

your original post, is the information that TransUnion sold to Lexis/Nexis for P-TRAK "public information"? If yes, what is private information?

It all depends on what was agreed to, tacitly or explicitly, in the process of applying for and accepting a credit card. I seem to recall "agreeing to" multiple pages of fine print about how and to whom information could be disclosed. That most of us ignore such fine print is our problem....I don't think there's been any allegation, even by you, Marc, that what Equifax is doing with credit information is breaking either the contract or any existing laws. You just want a new set of laws to do what contracts are perfectly capable of doing. Those who want protection of information disclosed to others should, of course, make such arrangements. (And such arrangements are made all the time. Examples abound.) That such arrangements for a "privacy card" are not easy to make is not an issue for the law to meddle with. In fact, many of us think there's a market for just such a "privacy card," and, absent meddling by government, expect such a card to appear

I agree that there are real threats to cyber freedom in Europe. I'm not saying otherwise. But my point is that anonymous remailers and the like will have a better future in countries that recognize a right of anonymity as opposed to those that don't.

Despite my dislike of most of what passes for the American system, I'll take the protections of the First, augmented with the 1956 "anonymous leafletting" Supreme case, over the "ad hoc" protections nearly all Europeans have (or don't have).

The question is what are you going to do with companies that won't let you buy a product unless you provide your True Name?

The answer to this is both simple and profound. You have heard the answer many times, but you probably dismiss it as just libertarian rhetoric. In any mutually uncoerced transaction, say between Alice and Bob, whether Alice and Bob are individuals, groups, corporations, or whatever, each may "ask for" various things. You can imagine some things to be asked for. Either is free to decline the terms of the other and call off the transaction. (I'm not a lawyer, but I believe this is covered in Contracts. Not meaning to be snide, but it's essential that people realize _contracts_ are what we are talking about here.) So, were a company to refuse to sell me a product unless I provided my True Name, I would decide just how important this issue is to me. If it were of compelling interest to me, I would walk away from the transaction. (There is no "right" to buy something from someone.) In reality, I cannot remember the last time a store demanded a True Name, except when: a) credit (check or credit card or loan) was involved, or b) the government demanded such a True Name. The first situation is avoided by paying cash, using a deposit, etc. The second situation is not so easily avoided. But I submit that the hypo of a company refusing to sell a product unless a True Name is given is unlikely in the extreme, and is not any kind of justification for a new set of so-called privacy laws which actually interfere with other basic rights.

One of the consequences of legal obligations on companies that collect personal information might be to encourage more payment anonymous, psuedo-anonymous payment schemes. Wouldn't that be a good result?

If privacy is important to an agent, make it part of the contractual arrangement. Again, this is already done in a huge array of cases. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

At 7:27 PM -0700 5/31/97, Marc Rotenberg wrote:

One of the biggest problems with libertarian theories is that they are descriptively flawed as applied in the real world. In practice, perfect markets rarely exist, laws do protect rights, and there are a lot of efficiencies -- economic, technological, and otherwise -- in promoting the highest level of safeguards across similar activities, e.g. you get into a car, you expect that the brakes will work. You don't express a negotiated preference for how much you want your brakes to work.

One of the biggest problems with critics of libertarian theories is that they falsely claim libertarians believe that each and every action during each and every day by each and every agent involves complex contracts. What we are talking about here is whether there's a need for new laws to, using your specific example, stop companies from asking for personal information. What libertarians, and hopefully other freedom-seeking people, would argue is that government should not be interjected into mutual negotiations if at all possible. This applies to Alice and Bob negotiating some transaction, and it applies to Alice and Safeway, and to Safeway and Apple. Citing the straw man that libertarians believe every driver must negotiate a contract about how his brakes are to work has nothing to do with this basic point.

I don't mind the criticism if you think we're saying or doing something that really is bad for privacy, but a bunch of political rhetoric isn't worth much. And if you don't think we're not busting our butt to protect the rights of people to use strong crypto, you have no idea what's going on.

"A bunch of political rhetoric." This has been a waste of everyone's time. As for the "rights of the people to use strong crypto," there are currently no restrictions *whatsoever* on crypto use. SAFE will, of course, add a criminalization angle to crypto use, which is a step in the wrong direction. Once the Legislature gets its hands on crypto use at all, the way is made easier for later extensions and clarifications of the rules. Imagine the equivalent situation with free speech or religion: "No American may be denied access to the religious beliefs of his choosing, but the practice of non-Christian religious acts in connection with another crime will expose the pagan to a mandatory 5-year increase in imprisonment." This is what SAFE's "crypto in a crime" provisions are equivalent to...like making the speaking of Spanish a factor in criminal sentencing. "Congress shall make no law" means just that. A better tack is to take a rejectionist, no compromise stance toward any proposed legislation which would in any way limit or criminalize crypto use. Rely on the First Amendment. This would leave EPIC, VTW, CPSR, EFF, etc. with very little to do, of course, but that is as it should be. But, then, I quit the NRA because they were too namby pamby about the Second Amendment. I place more faith in my assault rifles than I do in the criminals in D.C. McVeigh may have killed too many innocents, looking back on OKC, but he generally had the right idea about hitting the power centers of the police state. (Shocking sentiments to most of the sheeple, but Thomas Jefferson said as much when he said the tree of liberty had to be watered with the blood of tyrants and/or patriots every 20 or so years. It's been about 190 years too long since we had a good watering.) But this will be my last message to you, Marc, as I see no point in continuing any dialog. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE----- In <v03102800afb7ba21be7b@[207.167.93.63]>, on 06/01/97 at 04:54 PM, Tim May <tcmay@got.net> said:

I have no idea why they want a SS number, except perhaps that they see every government office demanding it and so they think it is part of the ID process. I of course would not give it. One is always free to turn down their offer of a 40 cent discount on eggs. Sounds fair to me.

IMHO the request for SS numbers are usally done out of convieniance more than anything else. This is not to justify it just an explanation why so many palces request SS numbers. Anyone that has written database software where unique information is stored on individules a SS number is quite convienat as everyone has a unique one. Most employee, payroll, medical, insurance, credit, databases use SS numbers rather than create individule id #'s. One's SS number has 2 unique qualities that make it perfect for this use: 1 every person has a unique #, and 2 it never changes. This can not be said for any other identifiers one may use, names, addresses, DL #'s, ...ect all have the possiablity to change over time while your SS # is forever. By using SS # as id #'s makes communication of data between diffrent database all that much simpler. From personal experiance I can testify that the entier Medical Insurance system is based on using SS # as identification. I shudder to think trying to track medical records of patients over a period of years between different doctors, hospitals, insurance companies without using them. I will not go into the privacy issues involved in using SS #'s for id #'s as I am sure the members of the list are quite familiar with them. I just wanted to point out that in some industries there is a technical advantage to having 1 universal id #. Now with that being said I personally would not shead any tears seeing SS and SS #'s gone and to never return. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM5IYe49Co1n+aLhhAQGsbgP+IyHuNAupRENc/wxZy8Btq8ufLlncdhwN CfVOmYMzcIPN2WX2psttCNKKHxxxMLtw7ZRtlBWDOV+P06JyictVWr3hae031mDR 7VvZqkS1GY6wik6j/5aABhjH07BVzHFCIM2uYyPX0HAo46JTWqGabcxs6+kSGFoU tlAsPO6J4cs= =l6A4 -----END PGP SIGNATURE-----

On Sun, 1 Jun 1997, Tim May wrote:

At 5:25 PM -0700 6/1/97, William H. Geiger III wrote:

...

stored on individules a SS number is quite convienat as everyone has a unique one. Most employee, payroll, medical, insurance, credit, databases

Somebody here is forgetting that the Social Security Adminstration, back in the mid-eighties claimed that at least 10 percent of the numbers in use, were improperly issued. The same number was issued to _two or *more*_ people. The worst case was a number that several thousand people used, thinking it was issued to them, exclusively, when it was in fact never issued. A further complication is that the same individual could have been issued two or _more_ different numbers, either by design, or accident.

...

unique qualities that make it perfect for this use: 1 every person has a unique #, and 2 it never changes. This can not be said for any other

Both premises are false, and the SSA has said so on several different occasions.

without entry of any allegedly random numbers, and without any hashing of personal data. It's not necessarily a real short number, certainly not as short as an SS number.

One proposal I'm familiar with was: date of birth << year month day >> time of birth << hours, minutes, seconds >> longitude of birth << degrees, minutes, seconds >> lattitude of birth << degrees, minutes, seconds >> sex << one letter >> mother's initials << first, middle, last >> father's initials << first, middle, last >> so you'd end up with something like 19970601185500-0300000.00-300000.00mxyzwvz << A number which would be issued to a male born today somewhere slightly north of Port Shepstone, and slightly west of Pietermaritzburg, RSA. >> However, there are several problems with it, the two most notable being the lack of accurate birth times, and that most people have a very hard time remembering 42 digit numbers. I don't know how solvable those, and other not so apparant problems are, but I suspect that it has been intensively studied by more than a few governments and organizations, since it was first proposed, fifty something years ago. xan jonathon grafolog@netcom.com Monolingualism is a curable disease

On Sun, 1 Jun 1997, William H. Geiger III wrote:

In <Pine.SUN.3.95.970602014607.25651C-100000@netcom2>, on 06/02/97 at 02:24 AM, jonathon <grafolog@netcom.com> said:

Really much to complex to be of use not to mention the lack of reliable data to form the id #.

For person's currently living, maybe the data is lacking. However, tagging an ID at birth, for future citizen units, is perfectly feasable. << And do note in passing that hospitals do have SSNs issued to new-borns, regardless of the wishes/request/knowledge/authorization/permission of parent(s). >>

The use of DOB + Geographic Identifier + Unique Code would work quite

Err, the code I listed was of that format --- just a lot more more specific than the following.

19970601 - DOB. 0123 - Sample Geographic Identifier (say NY City). 0142 - Unique Code added to handle collisions of the above two.

I believe that this is very simmilar to what the SSA uses though I believe that they only encode the year of birth when calculating SS #'s.

SSN consists of xxx-yy-zzzz xxx is state of issue. yy _can_ correspond to year(s) of issue, and locale with the state. << Usually just a range of years that it was issued in. >> zzzz is the sequence number. Each issued number just goes up one more. Though certain numbers are deliberatly skipped. There are certain checks that can be done, to figure out if a number _could_ have been issued to an individual.

of digits required. I would imagine that the SSA will have to go to a Hex or complete Alphanumeric codings system as the population increases.

They currently recycle old numbers, though there are still a number of unused sequences that are available. << Roughly the current population of the usa. >> xan jonathon grafolog@netcom.com Monolingualism is a curable disease

Our Fearless Leader Writes:

This reminds me of a hack I heard about some years back.

There's a way to generate a number for any person which is unique. It is not shared by anyone else on the planet.

Best of all, this number can be generated without use of a computer, without entry of any allegedly random numbers, and without any hashing of personal data. It's not necessarily a real short number, certainly not as short as an SS number.

And best of all, the cost is low. Just a dollar, in fact.

I'll explain later.

Hmmmmm. How about taking a dollar, appropriating its serial number for your personal number, and then burning the dollar to prevent reuse. Cost, one dollar. Is burning a dollar a felony? -- Mike Duvos $ PGP 2.6 Public Key available $ mpd@netcom.com $ via Finger. $

-----BEGIN PGP SIGNED MESSAGE----- At 08:47 PM 6/1/97 -0700, Declan McCullagh wrote:

On Sun, 1 Jun 1997, Tim May wrote in response to Robert:

...

...

Yes, I would support a law that forbids private companies to ask for

social

...

...

security numbers except for tax purposes.

No wonder the EFF is so fucked up.

To the best of my knowledge, EF-Georgia does not speak for the EFF. I don't know if the EFF would support such a law as Robert describes. Perhaps Stanton can help out here.

Yes. Declan is correct. For anyone else who is confused, I'm not a beltway person, and I have no association with EFF. I'm not a policy analyst. I'm a software developer. I work for a living and pay my own way. I do have opinions. Beliefs in privacy, free speech, and core belief that technology and the internet is good. I pursue this as a hobby to the best of my ability. I take advice from others, and try to get them to help educate me in matters I do not understand. Once I act on my opinions and beliefs, I tend to win. -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQBVAwUBM5JLcEGpGhRXg5NZAQFvuAH9FxwHRAUukQ0+3iyDX1cOgFmTxRT+0Q8q yTLiHhVI7BJ2Uco/YUmnlwoqsGngkzd2joVTUVAA/wJvztvvgBq3BA== =D8D4 -----END PGP SIGNATURE----- -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh@efga.org http://www.efga.org/ run PGP 5.0 for my public key

At 06:03 PM 6/1/97 -0400, Robert A. Costner wrote:

A new grocery store opened down the street from me. They have lots of special prices, but only available to "club members". Club cards are free, but you have to fill out a form. The form asks for 1.Name >2. Address >3. Phone Number >4. Spouse name 5. Social Security number In exchange for giving this information, the store will give me a 35 cent discount on each package of soft drinks I purchase. This is not a check cashing card, that is a separate form. Why does the store need my social security number ....

They're trading a discount on purchases for marketing information. If you us an obvious pseudonym, they'll know that Johnny Cash always buys Brand X pretzels with Brand Y beer, but the SSN lets them check with TRW/Equifax/Etc. and find that You, William J. Clinton, a married homeowner making $200K/year, also have an American Express card and rent N hotel rooms/year, and already subscribe to Soldier of Fortune and Rent-A-Politician, but don't yet get the Nukes-R-Us or Victoria's Secret catalogs, which is more valuable marketing information than just the groceries. Some places might still be willing to give you a discount for the pseudonym, but others combine their discount card with a check-cashing card so they're probably not only not interested, but won't accept it because [bounced-check-tracking credit bureau] doesn't consider SSN#000-00-0000 unique and doesn't have a record for 999-65-4321.

Yes, I would support a law that forbids private companies to ask for social security numbers except for tax purposes.

I'd categorize you as well-meaning-but-needing-to-think-longer rather than an evil "Uber-Enemy :-) Private companies asking for information are engaged in free speech - you don't have to give them the answer they're hoping for, and you don't have to do business with them if you don't want. Radio Shack keeps asking for my phone number, I keep not giving it, and the only thing that's changed about our business relationship for many years is that they no longer sell real electronic components and don't seem to have their free-battery club scam any more. On the other hand, when the government _requires_ private companies to collect Nationalized TaxPayer ID Numbers to be allowed to deal with you, it's a problem - for instance, requiring SSNs for bank accounts, requiring SSNs for employers to verify with La Migra that you're a Real Tax-payin' American instead of some Job-Stealin' foreigner, requiring documentation on cash transactions over $750, requiring car dealers to collect your SSN for car registration, etc., then there's clearly a privacy problem. Sometimes you can avoid it, by using non-US banks, contracting firms, etc., but it's a hassle. One of the big effects of this is that the SSN _is_ a widely available mostly-unique ID number that's useful for correlating information. An alternative, if the government wanted to promote privacy, would be to replace the Single SSN with a bunch of tax numbers (either on a smartcard or just giving you a list on paper) which would let you give everybody who needs a TaxId a different number. They could still correlate all your tax information, but nobody else would have the information to know that John Smith, bank-user, is John Smith, home-owner, or John Smith, car-buyer. Of course, this number would need to be more than 9 digits, so it would break lots of old software, you wanted that stuff broken anyway, and hey, the year 2000's coming as well :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

At 10:05 pm -0400 on 6/1/97, Tim May wrote:

If you want Marc R. to read your message, you really should cc: him on it.

Actually, I don't give a squalling fuck whether he reads it or not. :-). Anything said to Piglet won't matter much. That which is said to cypherpunks, on the other hand, is a different matter entirely. Cheers, Bob ----------------- Robert Hettinga (rah@shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

...

so often suggested, analogous to "use of a gun" in a crime, nor to "use of the public mails." It is much closer to the examples I cite, language and religion, than to use of a publicly-regulated monopoly like the telephones or the mail. The gun situation is presumably related to the threat of bodily harm...I'm not saying I agree with "use a gun, go to prison" sentencing enhancements, but a stronger case can be made than for "use a cipher, go to prison.

I don't need the lecture. I've made the argument better than you have and I've made it longer than you have.

Here we go, you have now given up on even attempting rational argument (not that you ever managed to achieve it in the first place) and turned to throwing insults and derogatory statements. I think more than anything else your comment yesterday about SSNs and private retailers indicates your need for lectures.

I don't recall you protesting the Computer Fraud and Abuse Act (1984), working on the RTM case (a CFAA prosecution in 1988). You weren't involved in the FOIA case for 2600.

Don`t parade your experience of contesting cases within the system to me, I`m not remotely impressed. You, along with EPIC, along with all the other alphabet groups, have sold out to compromise, not because you intended to, but because that is the natural state to which such lobbying groups "evolve" when working with people who do not understand the nature of individual rights. Playing the game with the jackbooted motherfuckers and their masters in DC is the worst possible way to go about protecting our rights.

...

a. denouncing any "return address" requirements and refusing to cooperate with any Congressthing who espouses such wrong-headed ideas

Great plan. I'll watch TV and let Congress pass a bill requiring mandatory identification for Internet users. Really clever.

This really isn`t the point, if you compromise, as you probably will, and we end up with a SAFE like "crypto in commision of a crime" provision we have gone up one step and down two. There can be no dealing with Washington nor any of the other cancers that have taken over the USA, removal is the only solution.

I'm probably in a much better position to criticize the failure of Tim May et al to stand up for crypto freedom than the other way around.

I don`t think so somehow, the cypherpunks, of whom Tim May was one of the founding memebers, have had effects in the past, not normally in legislative circles but in terms of getting the technology out there and available. The only solution is technical bypassing of the law, this along with other cypherpunkish ideas such as fully anonymous digital cash, chaumian mixes, uncensorable information sources, pseudonymity, DC-Nets etc.. will result in citizens being able to bypass state restrictions and disobey laws, in time it may even result in the downfall of the state.

...

Being a rejectionist, I don't see the point of dealing with Congress. The usual view is that "If you don't get involved, things will be even worse." I'm not convinced of this. It's often better to not lend them any support, not lend them any technical expertise, and devote all energies to undermining and challenging their actions later.

And the existence proof of this proposition is . . .

You simply cannot reason with criminal poloticians, circumventing their restrictions and undermining the state is the way to go.

...

And helping them draft legislation only feeds the process.

I think it was George Carlin who said, "If you think you're part of the solution, you're part of the problem."

Good high school humor for a good high school philosophy.

Keep trying.

I am underwhelmed.

I am unsuprised. Datacomms Technologies data security Paul Bradley, Paul@fatmans.demon.co.uk Paul@crypto.uk.eu.org, Paul@cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

Dr. Froomkin, who I admire and respect very much, may call remarks like those cannibalism (nice Carib indian word, cannibal), but for myself, I prefer to think of it as Texas barbeque. :-).

Here, Micheal, have some of those baby back ribs over there. I just made them myself. Just a touch of habanero in the sauce (and Pearl beer, of course) makes all the difference in the world.

Your semi-flippant comment has actually given me a really good idea: I had thought guns were our best defence against the evil empire, I now realise a log fire and a spit are more appropriate, I look forward to eating Tony Blairs liver with a nice Chianti <draws air through teeth in a silence of lambs type manner>... Datacomms Technologies data security Paul Bradley, Paul@fatmans.demon.co.uk Paul@crypto.uk.eu.org, Paul@cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

"William H. Geiger III" <whgiii@amaranth.com> writes:

We have right now in Europe the universal embracement of Socialism/Communisim/Statism at the same time that Eastern Europe & the

Yep.

former Soviet Empire are struggling towards Democracy & Freedom.

Nope. More free market in the economies, but very bad record on political freedoms in most eastern european countries + former soviet republics --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

To be more clear, I should have mentioned in my last missive that I'm thinking of a "liberty" right (to protect transactional confidentiality) as opposed to a "privacy" or, to some extent, "property" right. MacN On Sat, 31 May 1997, Declan McCullagh wrote:

I'm now more awake than I was before, and a little less flippant, so let me try to respond to Marc's statement saying my summary of his "views on privacy below are just silly."

The initial question has to be not how you protect rights, but how you define them. For example, we have a right to speak freely; there should be strict limits on government controls on free expression or the press. The state has unique powers of coercion. Similarly, there should be strict limits on government collection of personal data about its citizens.

But transactional privacy is a different matter. Sure, we may generally agree that privacy is the famous "right to be left alone," but how does that extend to what happens when I make an affirmative choice to connect to a web site that might record some info about my visit -- as an alternative to charging me? Nobody's forcing me to visit that site. That's why I'm starting to come around to the idea that privacy is not a universal right but a preference. We need a market in privacy, not inflexible FTC rulemaking.

Oh, and the much-touted European Privacy Directive has made it near-impossible to exchange employee information between branches of the same firm that are physically in different countries. Bad move, Eurocrats.

-Declan

On Sat, 31 May 1997, Marc Rotenberg wrote:

...

People who are interested in why I am pro-individual freedom but not anti-government should take a look a my piece in Wired "Eurocrats Do Good Privacy." [4.05]

I spent a year working for a good crypto policy at the OECD. During that time I watched European government officials argue for constitutional freedoms and against key escrow, while business representatives quietly backed the US GAK plan. Welcome to the real world.

Marc.

Btw - Declan's summary of our views on privacy below are just silly. Many of the greatest defenders of First Amendment freedoms have also felt most strongly about the right of privacy. The question is always how you protect rights. Perhaps libertarians would do away with all laws that protect personal freedoms. Bad call.

At 3:21 AM -0400 5/31/97, Declan McCullagh wrote:

...

Unfortunately, Tim is letting a rant get in the way of reality. A shame, really, for he's capable of better. Let me respond. I may not be very cordial. We lost tonight's soccer game (goddamn wimpy libertarians) and went to some cheezy Crystal City sports bar afterwards. I just got back home, and it's 3:20 am...

Anyway, Rotenberg and EPIC are not the Uber Enemy. Rather, they disagree with cypherpunk and libertarian positions on some issues. So we have issue-by-issue alliances with them. Let's break it down:

------------------------------ CRYPTO: EPIC takes a purist civil liberties approach to crypto. They've been the ones criticizing the SAFE "crypto in crime" provisions. Did the latest VTW alert sent out today even mention that portion of the bill, let alone criticize it?

ANONYMITY: No other group in DC is such a staunch supporter of online anonymity publicly, though look for something from Cato soon. In fact, I linked to EPIC's copy of the McIntyre decision for my Friday Netly piece. Many business groups don't like anonymity online -- hurts the marketeers.

FREE SPEECH: EPIC is co-counsel in ACLU lawsuit against CDA. I believe they've said some of the anti-spam legislation is unconstitutional.

FOIA: David Sobel does fabulous work snagging government documents the spooks don't want released.

PRIVACY: EPIC wants more Federal involvement to protect privacy and a Federal Privacy Commission (or something similar). Lots of laws, bureaucracies. Though EPIC does realize there's a First Amendment; other privacy groups are even more aggressive. EPIC is of course on the side of libertarians when it comes to government violations of privacy. ------------------------------

From a libertarian perspective, EPIC is good on everything but privacy. On that they want Big Government solutions.

But that doesn't mean we reject and condemn what they do on other issues. Do we reject Eagle Forum's anti-Clipper endorsement because they're a bunch of ultraconservative wackos? Do we reject the National Organization for Women's position on the CDA as bad because they're a bunch of ultraliberal wackos? How about the National Association of Broadcaster's amicus brief against the CDA? The Christian Coalition rejecting a national ID cards and numbers? Ralph Nader wanting open access to government databases?

No. We don't. Instead, we address this issue by issue. EPIC and Rotenberg are not always, but are often, our allies.

-Declan

On Fri, 30 May 1997, Tim May wrote:

...

I suppose I am developing a reputation amongst the Inside the Beltway Cyber Rights Groups (tm) as a pain in the ass, but nearly everytime I see one of their chief spokeswonks giving a policy statement I realize they are "not on my side."

The latest quote is from Marc Rotenberg, on a CNN piece on spam and anti-spam legislation, saying that what the legislators in Congress really need to look into is how the spammers develop their data bases.....

Incredible. Does he propose investigations of private data gathering? Perhaps search warrants served on those who take public postings and construct data bases?

Look, I'm annoyed by getting 5-10 "unwanted" spam messages a day. But I realize the "spammers" are merely taking publicly available (= legally available, as 99.99% of all such information is) information and using legal channels to contact me. I may not "like" it, but their behavior is as legal as someone calling me on the phone.

(And ny nearly any measure of hassle factor, dashing to get to the phone only to find it's a salesman selling something I don't want is worse than any 20 unwanted e-mail messages.)

So, Marc Rotenberg wants Congress to "look into" (= interfere with) compilation and use of public information.

These people are NOT our allies.

--Tim May

There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

================================================================== Marc Rotenberg, director * +1 202 544 9240 (tel) Electronic Privacy Information Center * +1 202 547 5482 (fax) 666 Pennsylvania Ave., SE Suite 301 * rotenberg@epic.org Washington, DC 20003 USA + http://www.epic.org ==================================================================

Tim May <tcmay@got.net> writes:

Like speaking in French amongst other people who don't understand French, or using hand signals, or using a code book. Or whispering.

It amuses me to hear this from the ignoramus who preaches that there's no need for Americans to learn foreign languages. It also reminds of a recent case when Spanish-speaking nurses were disciplined for speaking Spanish in the presense of their supervisor who didn't understand it. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

Back to Tim's original point, I wonder if he knows that the P-TRAK data that Lexis/Nexis said was "public information" was actually taken from credit reports collected and sold by TransUnion. TU was able to sell the data because of a loophole in the Fair Credit Reporting Act. Sure, you post to the net that's public, but a lot of data collection is much more sleazy. I'd also appreciate some comment/criticism on the piece I did for Wired. My point was that in countries where there are legal rights to privacy it will be easier for technologies of privacy to flourish. I gave as examples the fact that PRZ was nearly indicted in the US while David Chaum was being applauded by the European Commission for building anonymous payment schemes. The OECD crypto policy drafting experience confirmed my suspicion. Let me also try to explain how the simple-minded First Amendment-privacy rights trade-off often misses the point about privacy claims. Consider the article about Judge Bork's video viewing habits back in 1987. Should Congress/the Courts prevent City Paper from publishing the article? Of course not. Could Congress/the Courts require video record stores not to disclose customer records without explict consent? You decide. For the hardcore free market types, take a look at Posner's *Economics of Justice.* There are good economic reasons for privacy laws, e.g. do you really want to negotiate with the telcos on a case-by-case basis whether they can sell the contents of your phonecalls? To be clear, I do believe that there should be laws to protect the right of privacy and that there should be an office within the federal government to advocate on behalf of privacy interests. I also believe that if such an agency had been established in 1991 when it was proposed, it would have been much harder for the government to push subsequently for digital telephony, Clipper, GAK, etc. Marc. At 12:12 PM -0400 5/31/97, Declan McCullagh wrote:

I'm now more awake than I was before, and a little less flippant, so let me try to respond to Marc's statement saying my summary of his "views on privacy below are just silly."

The initial question has to be not how you protect rights, but how you define them. For example, we have a right to speak freely; there should be strict limits on government controls on free expression or the press. The state has unique powers of coercion. Similarly, there should be strict limits on government collection of personal data about its citizens.

But transactional privacy is a different matter. Sure, we may generally agree that privacy is the famous "right to be left alone," but how does that extend to what happens when I make an affirmative choice to connect to a web site that might record some info about my visit -- as an alternative to charging me? Nobody's forcing me to visit that site. That's why I'm starting to come around to the idea that privacy is not a universal right but a preference. We need a market in privacy, not inflexible FTC rulemaking.

Oh, and the much-touted European Privacy Directive has made it near-impossible to exchange employee information between branches of the same firm that are physically in different countries. Bad move, Eurocrats.

-Declan

On Sat, 31 May 1997, Marc Rotenberg wrote:

...

People who are interested in why I am pro-individual freedom but not anti-government should take a look a my piece in Wired "Eurocrats Do Good Privacy." [4.05]

I spent a year working for a good crypto policy at the OECD. During that time I watched European government officials argue for constitutional freedoms and against key escrow, while business representatives quietly backed the US GAK plan. Welcome to the real world.

Marc.

Btw - Declan's summary of our views on privacy below are just silly. Many of the greatest defenders of First Amendment freedoms have also felt most strongly about the right of privacy. The question is always how you protect rights. Perhaps libertarians would do away with all laws that protect personal freedoms. Bad call.

At 3:21 AM -0400 5/31/97, Declan McCullagh wrote:

...

Unfortunately, Tim is letting a rant get in the way of reality. A shame, really, for he's capable of better. Let me respond. I may not be very cordial. We lost tonight's soccer game (goddamn wimpy libertarians) and went to some cheezy Crystal City sports bar afterwards. I just got back home, and it's 3:20 am...

Anyway, Rotenberg and EPIC are not the Uber Enemy. Rather, they disagree with cypherpunk and libertarian positions on some issues. So we have issue-by-issue alliances with them. Let's break it down:

------------------------------ CRYPTO: EPIC takes a purist civil liberties approach to crypto. They've been the ones criticizing the SAFE "crypto in crime" provisions. Did the latest VTW alert sent out today even mention that portion of the bill, let alone criticize it?

ANONYMITY: No other group in DC is such a staunch supporter of online anonymity publicly, though look for something from Cato soon. In fact, I linked to EPIC's copy of the McIntyre decision for my Friday Netly piece. Many business groups don't like anonymity online -- hurts the marketeers.

FREE SPEECH: EPIC is co-counsel in ACLU lawsuit against CDA. I believe they've said some of the anti-spam legislation is unconstitutional.

FOIA: David Sobel does fabulous work snagging government documents the spooks don't want released.

PRIVACY: EPIC wants more Federal involvement to protect privacy and a Federal Privacy Commission (or something similar). Lots of laws, bureaucracies. Though EPIC does realize there's a First Amendment; other privacy groups are even more aggressive. EPIC is of course on the side of libertarians when it comes to government violations of privacy. ------------------------------

From a libertarian perspective, EPIC is good on everything but privacy. On that they want Big Government solutions.

But that doesn't mean we reject and condemn what they do on other issues. Do we reject Eagle Forum's anti-Clipper endorsement because they're a bunch of ultraconservative wackos? Do we reject the National Organization for Women's position on the CDA as bad because they're a bunch of ultraliberal wackos? How about the National Association of Broadcaster's amicus brief against the CDA? The Christian Coalition rejecting a national ID cards and numbers? Ralph Nader wanting open access to government databases?

No. We don't. Instead, we address this issue by issue. EPIC and Rotenberg are not always, but are often, our allies.

-Declan

On Fri, 30 May 1997, Tim May wrote:

...

I suppose I am developing a reputation amongst the Inside the Beltway

Cyber

...

Rights Groups (tm) as a pain in the ass, but nearly everytime I see one of their chief spokeswonks giving a policy statement I realize they are "not on my side."

The latest quote is from Marc Rotenberg, on a CNN piece on spam and anti-spam legislation, saying that what the legislators in Congress really need to look into is how the spammers develop their data bases.....

Incredible. Does he propose investigations of private data gathering? Perhaps search warrants served on those who take public postings and construct data bases?

Look, I'm annoyed by getting 5-10 "unwanted" spam messages a day. But I realize the "spammers" are merely taking publicly available (= legally available, as 99.99% of all such information is) information and using legal channels to contact me. I may not "like" it, but their behavior is as legal as someone calling me on the phone.

(And ny nearly any measure of hassle factor, dashing to get to the phone only to find it's a salesman selling something I don't want is worse than any 20 unwanted e-mail messages.)

So, Marc Rotenberg wants Congress to "look into" (= interfere with) compilation and use of public information.

These people are NOT our allies.

--Tim May

There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!"

---------:---------:---------:---------:---------:---------:---------:----

...

Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

================================================================== Marc Rotenberg, director * +1 202 544 9240 (tel) Electronic Privacy Information Center * +1 202 547 5482 (fax) 666 Pennsylvania Ave., SE Suite 301 * rotenberg@epic.org Washington, DC 20003 USA + http://www.epic.org ==================================================================

"William H. Geiger III" <whgiii@amaranth.com> writes: |It's an intresting side note that the reason why the Cell Phones in this |country do not use strong crypto is because of the intervention of the FCC |and associated Federal LEA's. Not that it would have mattered except to scanner owners with too much time on their hands. The LEAs can intercept at the cellular base station where the air segment traffic is decrypted. This is true for GSM, TDMA, and CDMA. True security requires end-to-end encryption. While slightly possible for mobile-to-mobile calls where each phone has the encryption engine, it all breaks down if the base station doesn't preserve a digital pathway all the way through. Most base stations do tandem vocoding for mobile-to-mobile connections as it's the easiest engineering solution. For mobile-to-landline, the landline options are decidely minimal. If you go with STU-III you have the problem of a fixed-rate 4800 baud modulation sucking up bandwidth. That could be put in the base station but then the path is no longer end-to-end. /pbp

On Sat, 31 May 1997, Marc Rotenberg wrote:

Let me also try to explain how the simple-minded First Amendment-privacy rights trade-off often misses the point about privacy claims. Consider the article about Judge Bork's video viewing habits back in 1987. Should Congress/the Courts prevent City Paper from publishing the article? Of course not. Could Congress/the Courts require video record stores not to disclose customer records without explict consent? You decide.

Well, this may merely point up the fact that next to government--or perhaps more than gov't--the greatest threat to privacy is the existence of a free press. That trade-off may be simple, but "simple-minded" seems a little strongly put. As for Posner, who's often good for a laugh, particularly when taken out of context, his point so often reduces to a simple one itself: Which is easier (cheaper, more efficient, etc.), law or the market? Given that perfection in markets, as in golf and most other things, is unattainable, sometimes we shall have to resort to law, as in the "negotiating with the telephone company" example. But I think these are exceptions to Tim's points, not necessarily invaliations of them. MacN

At 12:02 PM -0700 5/31/97, Marc Rotenberg wrote:

...

Back to Tim's original point, I wonder if he knows that the P-TRAK data that Lexis/Nexis said was "public information" was actually taken from credit reports collected and sold by TransUnion. TU was able to sell the data because of a loophole in the Fair Credit Reporting Act. Sure, you post to the net that's public, but a lot of data collection is much more sleazy.

In my view, the Fair Credit Reporting Act is an unconstitutional restriction on my right to compile records as I see fit.

Under the FCRA, if I take newspaper reports and public filings, for example, of someone's bankruptcy in 1985 and make this part of "Tim's Credit Evaluation" of that person, I have violated the FCRA.

(I believe the current "limit" for such "rememberances" is 8 years. Why should the government have any ability to tell me I must "forget" records older than 8 years? In fact, what part of "Congress shall make no law..." do they not understand?)

It's an interesting argument. I don't agree, though you can certaintly try it. But more to the point of your original post, is the information that TransUnion sold to Lexis/Nexis for P-TRAK "public information"? If yes, what is private information?

More to the point of the Cypherpunks list--and this is something we talked about at the very first physical meeting, almost 5 years ago--it will become increasingly easy for the FCRA to be bypassed with offshore data havens. . . .

I know all these arguments. Some people said not to worry about passage of the CDA since it couldn't be enforced. Nice thought. Fortunately, ACLU, EPIC, et al challenged it in court.

...

I'd also appreciate some comment/criticism on the piece I did for Wired. My point was that in countries where there are legal rights to privacy it will be easier for technologies of privacy to flourish. I gave as examples the fact that PRZ was nearly indicted in the US while David Chaum was being applauded by the European Commission for building anonymous payment schemes. The OECD crypto policy drafting experience confirmed my suspicion.

I seldom read "Wired," so I didn't see this one. But the issues of Europe vs. the U.S. are notoriously complex. For every "Europe is better" point, such as not applying pressure to PRZ, there are the obvious counterpoints, such as Compuserve being prosecuted in Germany, the nearly full ban on crypto in France, the extradition of an American neo-Nazi publisher from Belgium to Germany, and so on.

I agree that there are real threats to cyber freedom in Europe. I'm not saying otherwise. But my point is that anonymous remailers and the like will have a better future in countries that recognize a right of anonymity as opposed to those that don't.

And as for Chaum and Digicash, Digicash is now in Silicon Valley. No firm conclusions can be drawn one way or another.

Yeah, right. And the Euro countries are pushing just as hard for key escrow as the US govt.

Oh, and as for privacy in Europe, I'll remember how much they cherish privacy the next time I'm required to leave my passport with the hotel front desk (Europeans confirm that the police compile lists each night from said deposited passports). They were still doing this in 1983 when I spent 6 weeks travelling through Europe; and it wasn't to ensure I'd pay my bill, as they had my credit card stuff for that.

Fine. And I almost got arrested two weeks ago (May 1997) walking out of the Library of Congress cause I didn't want to fill out a form with my name and the serial number of my computer.

...

Let me also try to explain how the simple-minded First Amendment-privacy rights trade-off often misses the point about privacy claims. Consider the article about Judge Bork's video viewing habits back in 1987. Should Congress/the Courts prevent City Paper from publishing the article? Of course not. Could Congress/the Courts require video record stores not to disclose customer records without explict consent? You decide.

The best solution is neither of these options: Video rental stores don't need True Names except to collect on unreturned tapes. (They might _like_ True Names, or at least mailing addresses, for advertising reasons, but they don't _need_ them, and, like Radio Shack, will not make it a requirement for a transaction.)

As with other such items, deposits work well here. My localvideo store does not require true names, so long as a sufficient deposit is left for each tape. Most persons use credit cards as the "return guaranty." Note also that credit cards need not be in the true name of anyone, via various options, much discussed on various lists.

I agree completely with this. I/EPIC have a strong preference for anonymous transactions. And we've been fighting this one in DC practically alone for a long time. The question is what are you going to do with companies that won't let you buy a product unless you provide your True Name? One of the consequences of legal obligations on companies that collect personal information might be to encourage more payment anonymous, psuedo-anonymous payment schemes. Wouldn't that be a good result?

...

To be clear, I do believe that there should be laws to protect the right of privacy and that there should be an office within the federal government to advocate on behalf of privacy interests. I also believe that if such an agency had been established in 1991 when it was proposed, it would have been much harder for the government to push subsequently for digital telephony, Clipper, GAK, etc.

I don't believe there should be such laws, obviously.

And more importantly, strong crypto provides numerous monkeywrenchings of such laws.

Pass a law requiring return addresses on all messages....the effect will be to move the spam sites offshore. Then what do you do?

I think I've answered this above. Yeah, you can always break a law, and you don't have to move offshore to do it, but laws still matter.

(When EPIC and ACLU figure out the real implications of strong crypto, look for them to talk about "compromises" on access to strong crypto....hey, maybe SAFE is an indication they've started to realize what is coming.)

I'm not quite sure what this means, but if Tim knows any group in DC that has fought harder for strong crypto, I'd like to know who it is. Marc.

At 5:01 PM -0700 6/1/97, Robert Hettinga wrote:

At 9:05 pm -0400 on 5/31/97, Marc Rotenberg wrote:

...

Keep me posted. If legislation is threatening a good technical solution, I'll be the first to blow the whistle.

Bunk.

If you want Marc R. to read your message, you really should cc: him on it. I don't think he's subscribed to the Cypherpunks list (though I could be wrong). I am adding him back on as a cc: to this message (I would've cc:ed him on my original "Rotenberg as the Uber Enemy" message a few days ago, had I known he would join in the discussion later).

The actual contribution of Mr. Rotenberg and his organization to the cause of freedom on the net, in this country, and around the world, can be found precisely in a competant analysis of above bit of semantic nonsense. That is, it is nil, if not negative.

Actually, I plan to take Marc at his word if such a situation comes up and EPIC is still involved in such lobbying. For starters, the "all e-mail must have a valid return address" legislation already being proposed (I know of bills by Barbara Murkowski of Alaska, and Denny Smith of Oregon; there may be others) is not only "anti-liberty," in the libertarian sense, and in the Supreme Court sense (McIntyre), it is also a *disincentive* to various digital technologies. It would put remailers in the U.S. out of business (we think, though it depends on the precise language of what a "return address" really means...employment for entire floors of lawyers at the Internet Regulatory Commission, no doubt). Likewise, EPIC can and should announce that it will not support SAFE if any form of criminalization language remains. We would not find it acceptable to have a law which encouraged the placement of microphones and cameras in private homes, "voluntarily," but which then said "Anyone who does not participate in the Voluntary Safe Surveillance Program and who is found to have committed a crime furthered by the failure to volunteer shall be subjected to additional imprisonment of at least 5 years." This is what the criminalization of crypto is all about. It is not, as is so often suggested, analogous to "use of a gun" in a crime, nor to "use of the public mails." It is much closer to the examples I cite, language and religion, than to use of a publicly-regulated monopoly like the telephones or the mail. The gun situation is presumably related to the threat of bodily harm...I'm not saying I agree with "use a gun, go to prison" sentencing enhancements, but a stronger case can be made than for "use a cipher, go to prison. So, Marc can immediately prove the honesty of his point by: a. denouncing any "return address" requirements and refusing to cooperate with any Congressthing who espouses such wrong-headed ideas b. denounce SAFE if it has any hint whatsoever of criminalization of crypto (Or of any of the (apparent) language about technical review panels deciding on exports...this is, to many of us, a code phrase indicating that SAFE will by no means make export of arbitrarily unbreakable ciphers an automatic process.) As I've said in other essays on SAFE, all that is needed to accomplish the goals of SAFE--the PR goals of SAFE, not the current language!--is this statement: "Computer software shall have the same status as any other written material: it shall not be subject to any laws regarding possession, sale, or export." Come to think of it, the First Amendment already states that Congress shall make no law. As for exports, the First has been applied to show that Congress cannot decide which books, magazines, movies, etc., may be exported. (And the Bernstein and Junger cases may soon consolidate the status of this interpretation for software.) So what do we even need SAFE for? Why give them any hooks, any "use of crypto in furtherance of a crime" language?

Given his past outrageous failures, and his persistant attempts to waste whatever reputation he now has left, remarks like the above finally prove the trust people had for him and the organizations he has run was completely misplaced. A reputation, I might add, literally *donated* to him by thousands of people and companies, who all believed in and trusted him *personally* to keep the Uncle Sam the Inquisitor out of their lives on the net. He has now squandered all of it with the demonstrable cluelessness found in the above bit of self-serving emeticism.

Bob actually makes me appear charitable toward Marc! I agree with Bob that EPIC, CDT, VTW, EFF, CPSR, and the other alphabet soup players are just plain old lobbyists, pure and simple. Who they are lobbying _for_ has never been clear to me, despite their public statements and charters. Being a rejectionist, I don't see the point of dealing with Congress. The usual view is that "If you don't get involved, things will be even worse." I'm not convinced of this. It's often better to not lend them any support, not lend them any technical expertise, and devote all energies to undermining and challenging their actions later. And helping them draft legislation only feeds the process. I think it was George Carlin who said, "If you think you're part of the solution, you're part of the problem."

Tim May has said it here before, but it bears repeating. The way a "lobbyist" stays in business is to threaten an otherwise innocent group of people with the power of real or imagined legislative coersion. The "constituents" then pay extortion to the legislature in the form of outright campaign contributions through a political action comittee, or by showing up at "voluntary" fundraisers on behalf of collusionary legislators, or through soft-dollar labor ("research", for instance) that ....

(good explanation of D.C. politics elided) Every one of the 535+ Congresscritters has a large staff (dozens? multiple dozens?), whose purpose is to feed the machine. As Bob notes, when funds gets low the legislators can threaten legislation. They may even convince themselves its a good idea. And they have various other contributors and pressure groups jockeying for laws and favors. It's all very nearly hopeless. And the cancer has spread nationwide. Just in my local community there are half a dozen jurisdictions, several "City Halls," multiple police forces (overlapping in territory covered), hundreds of new and byzantine rules every month, more fees, more inspectors, etc. As but one example, we're drilling a new well to replace our old well....the County wants $1000 to send a guy out to nod his head and initial our request--and with no guarantee they'll approve the well. More fees are needed for that. This is just plain robbery, though pro-government folks would likely say it is some kind of "pay as you go" reform (as in "We have a 6-story County Administration Building and 753 people on the payroll to pay for...so why shouldn't we extort a grand from you to help pay for it?"). There are so many laws it's impossible to know which laws I'm breaking. I carry a Benchmade AFCK folding knife clipped to my pants pocket. In Santa Cruz proper the law says that such a knife is considered "concealed" if clipped so that only the clip shows, whereas in Santa Cruz County, outside the city limits (though maybe the laws just cancel out inside?) the interpretation allows knives to be carried in pockets. And in some other local areas, the clip doesn't have to be visible. (And in some places, a knife worn "openly" is considered "brandishment.") Further, violations of these confusing and often contradictory knife laws are _felonies_, not misdemeanors (the felony status of knife law violations, where gun violations are often misdemeanors, is said by experts in rec.knives and in my gun magazines to come from the time when "niggers and spics" carried switchblades, concealed knives, dirks, buckle knives, etc., while "gentlemen" carried derringers and small revolvers for protection...so the law came down hard on the knife-carrying spics and niggers and the heritage is with us today. It's getting to where I need a CD-ROM and GPS mounted in my truck telling me: "You are about to cross into the jurisdiction of Burgville, California. The following items are illegal and must be disposed of or moved to a locked container: ..." This explosion of rules, statutes, licenses, laws, regulations, and limitations is being fed by the multiple City Councils, Boards of Supervisors, County Commissioners, City Managers, and hordes of burrowcrats (sic, and sick, too) infesting the multi-story "government" buildings in every small town and county. Not to mention entire cities devoted to lawmaking, like Sacramento, Albany, Washington, etc. The simple question to ask is this: Why do we need several thousand rule-generating and lobbyist-seeking governments? Why do we need governments at the neighborhood level, the township level, the city level, the county level, the state level, and the national level? (And the meta-national level, with the U.N, World Court, OECD, etc.) I could comment more on Bob's other points, but I think you all get the picture. Things are way out of control. Not because of any intrinsic evilness on the part of the bureaucrats, but just for purely systemic reasons. This has to change, and it can't be changed from within....the rules won't allow it. The change has to come from outside, probably from some severe jolts applied to the system. No, I don't mean blowing up Washington, or even a few buildings. Much as I might like to see D.C. vaporized, such jolts are not what I am thinking of. Undermining the institutions of government with strong crypto is one of the jolts. There are others. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

Lucky Green writes:

At 12:31 AM 6/2/97 -0400, Marc Rotenberg wrote:

...

Great plan. I'll watch TV and let Congress pass a bill requiring mandatory identification for Internet users. Really clever.

First of all, such a bill will be passed regardless of what you or anyone else does. The only question is when. You may be able to delay passing of this bill for a few years, perhaps even a few decades, but pass it will.

So let us turn to the more relevant question: is it better for such bill to pass now or ten years from now? It may seem obvious that the answer is "ten years from now", but I feel that it not nearly as obvious as it seems and in fact may even not be correct.

Ten years and a few Sarin attacks on American subways and other Reichstag Fires later, such a bill will pass with the full backing of Joe Sixpack and Jill Soccer Mom. The passing will be a formality.

If, however, Congress was to pass such a bill now or in the very near future, the population would recognize the law for what it is: yet another fascist powergrab. Which in turn might trigger the exercise of certain recall provisions available to the citizens of the US thanks to the Bill of Right.

It is up to each of us to decide which of these two possible futures is "better".

If those were the only two futures, you'd be right. However it's more likely that if an 'Internet drivers license' bill passed next week, Joe and Jill wouldn't care. They're not on the Net anyhow, and they already know (by reading _Time_ and watching TV) that the Net is full of hackers and porn. An Internet Drivers License would help authorities crack down on hackers, or so the tv would tell Jack and Jill (and they'd beleive it). In addition, few people care about anonymity. Jack and Jill certainly dont. Try explaining why net users should be allowed to be anonymous to someone who barely understands the net. Like your parents for example. If an 'Internet drivers license' bill passed next week, it'd take at least a year to get it repealed (probably much longer). During that time, if the government wished to do so, it could stage any number of provocative acts, blame them on 'Internet Terrorists', then get James Kallstron on tv to announce that the 'Terrorists' have been caught via their Internet Drivers Licenses. -- Eric Murray ericm@lne.com Privacy through technology! Network security and encryption consulting. PGP keyid:E03F65E5

Duncan Frissell writes:

...

If an 'Internet drivers license' bill passed next week, it'd take at least a year to get it repealed (probably much longer). During that time, if the government wished to do so, it could stage any number of provocative acts, blame them on 'Internet Terrorists', then get James Kallstron on tv to announce that the 'Terrorists' have been caught via their Internet Drivers Licenses.

[...]

Think about it. An Internet Driver's License could only license a connection not communication itself (1st Amendment) and a single Net connection can connect to a network that is big on the other side as the rest of the Net itself. Cheating is way too easy.

From a government standpoint it's ok if it's basically unenforceable, because it makes a nice "dual-use" tool: if someone the government doesn't

Oh, I'll agree with that. I think that governments will do it anyhow. like is using a forged IDL, they can be busted for that. Remember, wiretaps to gather evidence are now legal if they're "in good faith". All it takes is one mention of your forged IDL, or a slip in your code, and the secret's out. If they do use a valid IDL, then they're traceable and can be traffic-analyzed into revealing their "co-consiprators", then busted. Of course these techniques will only be used against terrorists, never against freedom fighters. -- Eric Murray ericm@lne.com Privacy through technology! Network security and encryption consulting. PGP keyid:E03F65E5

At 11:27 PM -0400 5/31/97, Tim May wrote:

At 7:27 PM -0700 5/31/97, Marc Rotenberg wrote: One of the biggest problems with critics of libertarian theories is that they falsely claim libertarians believe that each and every action during each and every day by each and every agent involves complex contracts.

What we are talking about here is whether there's a need for new laws to, using your specific example, stop companies from asking for personal information.

You argued that such safeguards were routiney found in freely negotiated contracts. I responded that such safeguards were more likely found in legal arrangements, industry standards, and professional obligations.

What libertarians, and hopefully other freedom-seeking people, would argue is that government should not be interjected into mutual negotiations if at all possible. This applies to Alice and Bob negotiating some transaction, and it applies to Alice and Safeway, and to Safeway and Apple.

Again, I don't disagree with the aspiration. We simply disagree on how well it works on practice.

Citing the straw man that libertarians believe every driver must negotiate a contract about how his brakes are to work has nothing to do with this basic point.

It has a lot to do with privacy standards on the net, the role of markets, and the way safeguards will develop.

As for the "rights of the people to use strong crypto," there are currently no restrictions *whatsoever* on crypto use. SAFE will, of course, add a criminalization angle to crypto use, which is a step in the wrong direction. Once the Legislature gets its hands on crypto use at all, the way is made easier for later extensions and clarifications of the rules. Imagine the equivalent situation with free speech or religion: "No American may be denied access to the religious beliefs of his choosing, but the practice of non-Christian religious acts in connection with another crime will expose the pagan to a mandatory 5-year increase in imprisonment."

That's a fair criticism. EPIC and ACLU are still prepared to oppose SAFE. For the record, EPIC was the group that opposed the criminaliation provision, and organized (with the ACLU) the effort to change it. We had a big problem with other DC groups who (a) didn't want to even publicize the issue and (b) discouraged companies and individuals from supporting our effort. But I'm not thrilled about it, and I won't bullshit you that it was some brilliant compromise. We did as much as we could. We'll try to do more.

A better tack is to take a rejectionist, no compromise stance toward any proposed legislation which would in any way limit or criminalize crypto use. Rely on the First Amendment.

We may still do this. And it's exactly what we did during the debate on Digital Telephony.

This would leave EPIC, VTW, CPSR, EFF, etc. with very little to do, of course, but that is as it should be.

IF NSA, FBI etc are going to being around, we'll be around. And who, btw, do you think is going to bring those First Amendment cases to protect Constitutional rights?

But, then, I quit the NRA because they were too namby pamby about the Second Amendment. I place more faith in my assault rifles than I do in the criminals in D.C. McVeigh may have killed too many innocents, looking back on OKC, but he generally had the right idea about hitting the power centers of the police state.

You lost me on that one. I've lived in one of the highest crime districts in the country. I've had handguns waved in my face. I've seen children lying dead in the street from gunfine. I have no sympathy at all for the turret-hole view of the world. But I accept your right to express your views and will defend that right against any government that seeks to limit your rights. That is my view of what the First Amendment is about. Marc Rotenberg. ================================================================== Marc Rotenberg, director * +1 202 544 9240 (tel) Electronic Privacy Information Center * +1 202 547 5482 (fax) 666 Pennsylvania Ave., SE Suite 301 * rotenberg@epic.org Washington, DC 20003 USA + http://www.epic.org ==================================================================

-----BEGIN PGP SIGNED MESSAGE----- In <v03007800afb68a25627d@[205.177.146.237]>, on 05/31/97 at 10:27 PM, Marc Rotenberg <rotenberg@epic.org> said:

...

At 6:05 PM -0700 5/31/97, Marc Rotenberg wrote:

...

What examples do you have where privacy is included in a contractual arrangement?

- a lender agrees to transfer the information provided only to specified parties, and not to the newspapers . . .

Good examples. Many are codified in statue, created by common law, industry practice, or professional obligation. Virtually none are tied to specific, negotiated contracts.

One of the biggest problems with libertarian theories is that they are descriptively flawed as applied in the real world. In practice, perfect markets rarely exist, laws do protect rights, and there are a lot of efficiencies -- economic, technological, and otherwise -- in promoting the highest level of safeguards across similar activities, e.g. you get into a car, you expect that the brakes will work. You don't express a negotiated preference for how much you want your brakes to work.

Marc you really need to pick better examples for making your point. :) Not only is government regulation unnecesary to insure passenger safty in automobiles I can site what happend with Tucker as a prime example of how government power was used to prevent the free market from bringing safty inovations to the general public. The biggest problem with libertarian ideals is that the never get implemented before some statest jumps in with their own power grab "solution" to the problem. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM5EDpI9Co1n+aLhhAQHJ/AQAlGXirFFE/Cp+ZrXh7dREGrKBz7ftROq1 4VKhATlNHxWSOhX9sgyd3+QazW1ojhG6He/xCjJ9JOuhuNaWA292/BOynkweDf4I ltdKNHyqV9fk2ZZpeAXCSvYyK1TSuMobL7MSvLcmfFz8DL1hNkFKBl0R546ZNJFq GopDQzlUmzE= =6+NB -----END PGP SIGNATURE-----

5. Social Security number

Why does the store need my social security number for me to purchase soft drinks and eggs? (40 cents off on eggs this week) I see no reason for it. If I provide a false number, I have probably committed some crime. Yes, I would support a law that forbids private companies to ask for social security numbers except for tax purposes.

The store is someones property. Whether it is part of a large Plc, a limited company, a sole trader etc. there is someone who owns that store. They decide what the fuck happens on their own property. If customers stop shopping there most stores, through the simple need for economic survival, will change their practices to attract customers. It is no business of yours if the store asks for your sexual orientation before they sell you a pack of butts, if you don`t like it, walk out. For fucks sake, do you understand nothing of basic theory? I have long been slandering and bemoaning the current state of the various EFFs/ACLU/PI/CSPR type organisations as they have clearly sold out, and, as is obvious from the post quoted above, most don`t even have a clue what they are talking about. Marc, you are doing more harm than good, go and read some basic books and get an understanding of the notion of private property and non-agression, then I will bother to respond properly to any well stated point. Datacomms Technologies data security Paul Bradley, Paul@fatmans.demon.co.uk Paul@crypto.uk.eu.org, Paul@cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

This is a crucial point. Rotenberg != Berman. As much as I like individuals at CDT, I disagree fairly often with the organization's position. CDT supported the so-called "compromise" that would have replaced the CDA's indecency provision with a ban on material that's "harmful to minors." They've done the wrong thing on Digital Telephony in many cases -- helping phone companies suck in $$$ to make their systems wiretappable more than helping civil liberties -- and continue to do so. They're now silent (read the latest CDT post) on the many problems with SAFE. Then again, CDT may not be good on individual rights in the examples above but they don't support Rotenbergesque privacy regulations either. Again: issue-by-issue alliances. -Declan On Sun, 1 Jun 1997, Lee Tien wrote:

Marc Rotenberg never led EFF; he led CPSR-Washington which became EPIC.

Bob may be thinking of Jerry Berman, who ran EFF for a few years, was involved in its actions re Digital Telephony, and then left to start up CDT.

-----BEGIN PGP SIGNED MESSAGE----- In <v03102803afba0104af92@[207.167.93.63]>, on 06/03/97 at 10:31 AM, Tim May <tcmay@got.net> said:

NRA is still a mostly member-driven organization (lots of dues flowing in), and yet it bends to industry wishes. I shudder to think what the NRA would be supporting if it were mainly _industry_-driven.

It would depend on how jucy of a govenment contract could be offered.

Which is what I'm sure CDT and EPIC are.

I wounder how much it cost the Feds to buy the support of IBM,DEC,HP,et al. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM5RxXI9Co1n+aLhhAQFEvQP+ORuU/orTBq7IqL7VT/CBC/bk/8diCZSZ iOcXCB0GXhn9bHWwKOn/sJd51LPpOHSZxObNKPkkEGZ+r6MvQYJXf/FN2KbYFaZo IWdmAmtQuMbxbGlsD/sJYb8BxpYKqtaXjxIDaEb6aDI199ZG0VqUohnKpzV0PeY4 B0cAbA4uUyA= =shrE -----END PGP SIGNATURE-----

At 12:02 PM -0700 5/31/97, Marc Rotenberg wrote:

...

To be clear, I do believe that there should be laws to protect the right of privacy and that there should be an office within the federal government to advocate on behalf of privacy interests. I also believe that if such an agency had been established in 1991 when it was proposed, it would have been much harder for the government to push subsequently for digital telephony, Clipper, GAK, etc.

I am somewhat surprised that you would make this claim, given that you must have researched the situation in Europe for your article. European style Privacy Commissioners solely limit the ability of _private_ entities to keep databases. They do not limit the ability of public entities to keep databases. Sure, when a European government wants to bring a new Big Brother database online, the Privacy Commissioner has to sign off on the plan. This is typically a rubber stamp approval. Even worse, the Privacy Commissioner rubber stamping the plan usually ends discussion, since the government now can claim that their database is harmless because the Privacy Commissioner has approved it. German "dragnet investigations" and "pattern investigations" come to mind. The German BKA (the equivalent of the FBI) keeps a giant database that correlates "suspicious" behavior. Paying your utilities bills in cash (unusual in GIRO-happy Germany) gets you points. If the person on the bill isn't registered with the police at the address on the bill you get more points. Paying your rent in cash gets you points. If they don't have a social security record for you, more points yet. There are many other criteria that will get you points. If you collect enough points, the feds come by to interrogate you. Yes, the Privacy Commissioner approved this "pattern investigation". In the interest of space, I will spare the list what "dragnet investigation" entails. It appears naive to claim that GAK could not happen under a Privacy Commissioner. It could and it will. --Lucky Green <shamrock@netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

At 12:52 AM 6/4/97 GMT+0200, Ulf Möller wrote:

This is a gross exaggeration. "Pattern investigation" can be used to investigate certain severe crimes that cannot be solved otherwise. It must be warranted by a judge, naming the patterns that the respective committer is believed to match. There have been three "pattern investigations" ever, since the law was passed in 1991 (none of them successful).

The German authorities conducted pattern investigations long before 1991. The early 80's kidnapping of the industrialist comes to mind. [The kidnapping that ultimately caused the suspected co-conspirators to be sucided in their solitary confinement maximum security cells. Cells that were under 24h audio surveilance. Unfortunatly, the tapes for that fateful night mysteriously disappeared...] But note the requirement you mention: "severe crimes...warranted by a judge". Where have we heard this one before? Right. The four horsemen of the infocalypse. --Lucky Green <shamrock@netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

Kent Crispin wrote:

On Sat, May 31, 1997 at 04:20:55PM -0500, Dr.Dimitri Vulis KOTM wrote:

...

This law is unenforceable. If you want to rent porn videos and you have some brains (the two may be mutually exclusive...) you'd pay cash and make the transaction totally anonymous.

Should there also be a law against grocers keeping track of who's buying what?

Brain fade, Dimitri. Anybody who allowed anonymous rental of videos would be out of business shortly as their stock would never be returned.

Kent, the rental shops may ask for a collateral that is returned when the renter brings the videos back. - Igor.

Kent Crispin <kent@songbird.com> writes:

On Sat, May 31, 1997 at 04:20:55PM -0500, Dr.Dimitri Vulis KOTM wrote:

...

This law is unenforceable. If you want to rent porn videos and you have some brains (the two may be mutually exclusive...) you'd pay cash and make the transaction totally anonymous.

Should there also be a law against grocers keeping track of who's buying wh

Brain fade, Dimitri. Anybody who allowed anonymous rental of videos would be out of business shortly as their stock would never be returned.

Kent, you're a lying asshole. It's been a while since I rented any videos (got better uses for my time), but one used to be able to plonk down $50 cash, rent a video, bring it back w/ bearer receipt, and get one's $50 back (minus the $1-2 for the rental) If someone decides keep the used video, the cash deposit more than covers the replacement. I believe this mode of operation is still very common in NYC, where lots of folks don't have credit cards, don't have permanent addresses, or don't want their viewing habits known. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

Marc Rotenberg wrote:

Similarly, Anitha Bondestam, director general of the Data Inspection Board of Sweden, writes in a recent report, "It is more important than ever to bring back anonymity and make more room for personal space." She urges her colleagues to sharply limit the collection of personal data.

A Swedish free-lance journalist and author of well researched books on the information society, Anders Olsson, have some interesting things to say on the likes of Anita Bondestam, from sort of a 'leftish' democratic viewpoint. He sees the achievements of the 'establishment privacy mafia' as mainly preventing 'the people' from keeping track of the wheelings and dealings of the nomenclatura for it's own benifit, and he doesn't think that this is unintentional. Data privacy laws are certainly an obstacle for sociologic research, among other things, and research results can be threatening to bureaucrats, plutocrats and monopolists. Laws against matching various 'public' registers for multiple entries are also making life easier for tax evaders (who might be libertarian heroes of course, but remember that for most salary-dependent people of lesser income it works like this: the more the entrepreneurs evade taxes, the more they have to pay to support the nomenclatura) but also for welfare cheaters and the like (not libertarian heroes!). Asgaard

-----BEGIN PGP SIGNED MESSAGE----- Myself, and EFGA supports no anti-spam law at this time, nor have we suggested the world needs one. Over the last year we have repeatedly said that existing laws may prove to be sufficent. What is clear is that there has been little attempt at using today's laws against spam and failing. If EFGA has a position, it is that first the current laws should be tested against spam. No new laws should be proposed until today's laws can be shown to be useless against the problem. To the contrary, Cyberpromotions has been to court five times, and has lost five times. These are not internet issues as much as they are fraud, consumer protection, and commerce issues. Education of applicability of existing laws may be more effective than new laws. New laws are being proposed. And I feel comfortable commenting on the faults of a law, or of it's languge. I can suggest what is wrong with a law, or what it lacks without supporting a flawed bill. DATA GATHERING The original issue is one of data collection. For many, this is the opt-in, opt-out argument. For others it is adherence to a convention such as the robots.txt file found on web pages. While there is nothing wrong with data harvesting in it's self, what one does with the info may be called into question. The currently proposed bills look at various areas. 1. Identification 2. Content 3. Data Collection procedures 4. Tonnage/automated processing Data Collection procedures may be less restrictive than identification requirements, or content bans. There is a law precedent in the Telephone Consumer Protection Act (TCPA) of 1991 to handle each of these issues. For data collection, the TCPA requires a removal database be maintained and an opt-out strategy be employed. One of the largest problems with "spam" is that the data collection strategies employed today are deceptive, fraudulent, and do not come close to fitting the model carefully considered in the TCPA. The reason the TCPA is carefully considered is that once the law allowed for the promulgation of rules, the FCC had a series of public comment periods and promoted rules that highly favored privacy while trying to balance the fair practices of telemarketers. Unfortunately, with spam, most spammers do not have "fair practices". If is highly likely that the spam question could be quickly addressed and more clearly defined without new laws simply by a comment period and the promulgation of new rules. Additional comments after Tim's quote.... At 09:28 AM 5/31/97 -0700, Tim May wrote:

If it is "ILLEGAL" (your emphasis) for someone to call me on the phone for spamming, why then do I get so many such calls? Why aren't the prisons full?

(Answer: Because it is NOT illegal for people to call me, or for me to call others, or for me to even call thousands of others. True, it is possible for me (I disagree with these laws, though, and cite the First again) for me to _ask_ that they not call me. Maybe even jump through hoops and get an injunction. )

There are laws on the books which prohibit fully automated calls with no humans in the loop, but these are easily bypassed. (E.g., the boiler-room minimum wage employees in Detroit and Chicago who pick up the phone several seconds after I have picked up and then start a barely understandable spiel...I've prettty much taken to hanging up if no human voice appears within the first couple of seconds, as I know I am being handed off to the next available "human.")

Well, prisons *are* full. Many of the inmates are telemarketers. But this is not because of telemarketing laws. You are confusing "illegal" with "criminal". The laws we refer to are civil law, not criminal law. 47 USC 227 is a federal civil law. It also allows for state Attorney Generals to file civil suits on behalf of it's citizens. This, if not taken to extreme, is a proper function of gov't. To protect citizens from that which they cannot protect themselves. Why do you get such calls? The existing laws not only apply to fully automatic calls, but predictive dialing systems such as you mention and pure manual voice calls. I cannot answer why you get the calls. Perhaps you have not requested to be in the national "don't call me database". Perhaps your callers just use illegal data collection procedures. I'll summarize some of the law to you. The Telephone Consumer Protection Act (TCPA) of 1991 made effective December 1992 the following: 1. Calls only allowed 8am to 9pm 2. Lists must be maintained of "do not want to be called" 3. Telemarketers must identify themselves - address & phone number 4. Employees must know rules & know how to use remove list. Additional info can be found at http://www.fcc.gov/Bureaus/Common_Carrier/Orders/1995/fcc95310.txt Quote from the Act: Because unrestricted telemarketing can be an invasion of consumer privacy, and even a risk to public safety, Congress found that a federal law is necessary to control telemarketing practices. SPAM vs TELEMARKETING A telemarketing operation has a high level of entry. Not that high, but phone lines, desks, office space, employees. etc must all be provisioned and paid for. The level of entry for being a spammer is much, much lower. For some it may be a dedicated connection, but millions of spams can still be sent with a dial-up account. Accordingly, EFGA sees that the number of spammers could grow to be far more than the number of telemarketers. Easily a figure could be reached that ten times more spammers could start a business than the number of telemarketers. In 1990, more than 30,000 telemarketing operations employed over 18 million Americans. Easily we could see over 300K spam operators in business, employing less than one million people. Each of these individual spammers could be sending out daily spams. Many of them would be able to reach a significant portion of the internet users on a daily basis. At 09:28 AM 5/31/97 -0700, Tim May wrote:

Your point being?

Any laws forbidding spam generation in the U.S. will simply (or already) move the spam-originating sites offshore. Then what happens?

As long as the companies who are advertising have US offices, the offshore factor will not matter. Existing fax precedent makes the advertiser the one ultimately responsible for the ad. -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQBVAwUBM5Ht90GpGhRXg5NZAQH4RQIAnm4mbPbsF3JVCK2mFwzZ0frOa6CJBcA3 CHv7lvhxndUT+wPlV40BjCohL9kknuOkLbeZeAoMCGlZkZ9ThIXVYQ== =srDk -----END PGP SIGNATURE----- -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh@efga.org http://www.efga.org/ run PGP 5.0 for my public key

Tim May <tcmay@got.net> writes:

Any laws forbidding spam generation in the U.S. will simply (or already) move the spam-originating sites offshore. Then what happens? Is my ISP supposed to screen international messages for me? Do we get the U.N./OECD/Interpol/Illuminati to "regularize" anti-spam laws in all 197 recognized nations?

Of course, the "anti-spamming" laws will also be used to suppress the "politically incorrect" speech. Recall that Jim Bell has already been accused of "spamming", in addition to other crimes. Those who follow the Usenet newsgroup alt.conspiracy may have observed a recent trend: someone posts an anti-Clinton rant. An unknown "rogue retromoderator" forges a cancel for it. (Given how quickly forged "spam" gets tracked down, it's amazing how no one ever catches these pesky "rogue cancellers".) The author reposts the original rant. This repeats a few times, after which Chris Lewis of BNA/Nortel kicks in and starts issuing cancels for the rant, and any articler quoting the rant, because it's been reposted too many times already, making it "spam". Compare this with the CBS 60 minutes story about a month ago, about how bad people are allowed to tell lies about the U.S. government on the Internet, and how there ought to be a law against it.

The "500 messages a day" problem will be solved through other means. It has to be. Laws are insufficient, and wrong-headed, solutions for speech issues.

A promiscous e-mail box that assumes that strangers have something interesting to say is quickly becoming obsolete. A possible solution is to set up a procmail recipet that would dump all incoming e-mail from unrecognized correspondents into a separate folder, which one could examine at leasure once a week. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

Declan McCullagh <declan@pathfinder.com> writes:

On Sat, 31 May 1997, Dr.Dimitri Vulis KOTM wrote:

...

Of course, the "anti-spamming" laws will also be used to suppress the "politically incorrect" speech. Recall that Jim Bell has already been accused of "spamming", in addition to other crimes.

Uh, no. Bell was charged with violating:

26 U.S.C. Section 7212(a) 42 U.S.C. Section 408(a)

Which are, generally, attempts to interfere with administration of internal revenue laws and fraudulent use of a false SSN.

Besides, spamming isn't a criminal offense, last time I checked.

In the interests of completeness, I should note that I just finished a rather long article about Bell's arrest and related events for Internet Underground magazine. The government hinted that they might have additional charges to file against Bell by the time the grand jury convenes in probably two weeks. He is currently being held without bail, a situation more common in Federal than state courts.

We're talking about different things, Declan. Learn to read. I reposted someone's Usenet article whose author accused Jim of "spamming the net" with his AP essay. That's separate from his criminal charges. If "spamming" were a crime, he'd probably be charged with that too. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

On Sat, 31 May 1997, Lucky Green wrote:

If that was the extend of the story, Bell wouldn't still be in jail. The USC violations above may be the official charge, but they hardly justify keeping somebody locked up without bail. Bell is still in jail because he

The government is trying to persuade the judge that Bell is about to blow up a Federal building, or poison water supplies, or something. So far the judge has agreed and refused to consent to even bail conditions like house arrest and radio bracelet. Bell could very well stay in jail for the entirety of his trial. -Declan

-----BEGIN PGP SIGNED MESSAGE----- At 10:20 AM 6/1/97 -0400, Declan McCullagh wrote:

The government is trying to persuade the judge that Bell is about to blow up a Federal building, or poison water supplies, or something. So far the judge has agreed and refused to consent to even bail conditions like house arrest and radio bracelet. Bell could very well stay in jail for the entirety of his trial.

But since the Feds won't be able to move to trial on those charges, they'll have to let him out on bail eventually. "General dangerousness" bullshit only works during the preliminary proceedings. Remember the Jake Baker case. Thirty days in stir and then dismissal. Probably no dismissal for Bell but no major charges either. DCF -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQCVAwUBM5IjLoVO4r4sgSPhAQFA1wQAs5aQScxXb38HOIvxycrC/ledhDWO4zKK SWozSb2Rv3YR/EF5AuabmPpSIBC/cKfhijQQhwBzD4rVVLZAU97xob/AGcGoaicX ue9fxJwkAWI4+TZyMP+JngwYYG6pEBWD8fkV9JjHxBIAWsSktvdIMD0qjzkyKnB3 H9v6Hb+vabI= =xxCl -----END PGP SIGNATURE-----