January 2014 - cypherpunks - lists.cpunks.org

"Blackphone" said to be "a super-secure nsa-proof"
by Jim Bell 20 Jan '14

20 Jan '14

http://www.yahoo.com/tech/startup-launching-a-super-secure-nsa-proof-735110… Fears over NSA spying have prompted people around the world to think about security differently, whether it be petitioning for companies to better secure their data or changing the information they share online. In particular, security around smartphones has been of great concern, as people increasingly surf the Web, make calls and send messages from their mobile devices. An international group of privacy enthusiasts has come together to create Blackphone, a smartphone that claims it will help to better protect your information. Mashable writes that Blackphone is the brainchild of Silent Circle and Geekosphere, with participation from big players in the fight for information privacy and computer security. Phil Zimmermann, creator of data encryption protocol PGP (Pretty Good Privacy), is one of the minds behind the device. “Blackphone provides users with everything they need to ensure privacy and control of their communications, along with all the other high-end smartphone features they have come to expect,” Zimmerman said, according to Mashable. [ Right Click: Kiwi lifestyle tracker to free people from their smartphones ] The operating system is a custom build of Android OS called PrivatOS, designed for improved security. Silent Circle’s CEO Mike Janke says the project will be open source, as will the PrivatOS operating system. The phone likely won’t have the most outstanding specs, but the team says that’s because privacy is the top concern. No specific details have been given about the phone yet (although some of the code has been posted to GitHub). The companies say they’ll be unveiling it properly at Mobile World Congress in Barcelona beginning Feb. 24. Even with very little information about the device currently available, some media outlets are suggesting that the phone could be “NSA-proof.” That’s a tall order, especially in light of a story from The New York Times claiming that the NSA has implanted software in nearly 100,000 computers to create backdoor radio access. For more information on Blackphone, visit its website at https://www.blackphone.ch.

9 12

Cari Machet
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

I've been watching this shit throwing match between Troy and Cari for the last few days and, let me just say, both of you need to GROW THE FUCK UP. I don't give a rats ass if Cari is a 'real Indian' or just some crazy bitch pretending to be one and I don't give a fuck if Troy is offended by her pretending. This list is NOT the place for this bullshit. Get a room and fuck it out or just take it off-list but keep us the hell out of it.

14 28

bespoke boot and runtime configuration [was Re: Debian System and /dev/random]
by coderman 20 Jan '14

20 Jan '14

On Sun, Jan 19, 2014 at 4:57 PM, coderman <coderman(a)gmail.com> wrote: > .... > since 2004 building my own rngd, my own FDE bootloader, my own > mandatory entropy health watchdog service, VIA Padlock enabled processors only. FDE was loop-aes. init enforces mtrngd[0] at boot in conservative configuration. if in key mode without networking, failure of XSTORE at any time causes mtrngd to exit non zero then halt. for normal operation defaults to sync, shutdown -h in 60 seconds. cypherpunks may write code, but sharing with anyone and everyone never the bargain ;) 0. mtrngd - high performance entropy daemon for XSTORE https://peertech.org/dist/mtrngd-0.7-2007.tgz see also https://peertech.org/archives/viarng/ --- custom kernel, initramfs, initrd, install.tgz builds produced bootable ISO mastered with per-image unique entropy mixed at boot using custom pre-boot auth that launches desired OS once encrypted root volume is mounted. the FDE boot process at the time (~2005) worked like this: # first some settings / defaults export keydir=/janus/keys export addir=/janus/active-domain export logfile=/var/log/start.log export klogfile=/janus/active-domain/system.log export tmpmntdir=/mnt/tmp export aes_mode="AES256" # note that message and log calls assume console; e.g. dialog --msgbox # define some common tasks; note that we're single user here (no race) gen_tmpname () { uuid=`cat /proc/sys/kernel/random/uuid` echo "/tmp/.${uuid}.tmp" } LBL_LENGTH=53 get_idlabel () { dev="$1" part=`echo $dev | sed 's/.*\///'` num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` tmpf=$(gen_tmpname) dd if=$dev of=$tmpf bs=1 count=$LBL_LENGTH grep IDLABEL $tmpf 1>/dev/null 2>/dev/null if (( $? != 0 )); then rm -f $tmpf return 1 fi rm -f $tmpf cat $tmpf | sed 's/^IDLABEL=//' } list_usb_storage_devs () { l "begin list_usb_storage_devs" done=0 timeout=4 while (( $done == 0 )); do if [ -f /dev/makedevs.sh ]; then l "invoking makedevs.sh" /dev/makedevs.sh 1>/dev/null 2>/dev/null fi sleep 1 ccount=0 devs=$(ls /dev/sd* | grep '[0-9]') for dname in $devs; do l "testing device $dname for readable" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "$dname is readable" ccount=`expr $ccount + 1` fi done if (( $ccount > 0 )); then done=1 fi timeout=`expr $timeout - 1` if (( $timeout == 0 )); then done=1 fi done devs=$(ls /dev/sd* | grep '[0-9]') for dname in $devs; do l "testing device $dname for readable" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "$dname is readable" echo $dname fi done } get_usb_dev_fstype () { l "begin get_usb_dev_fstype" if [ -z "$1" ]; then return 1 fi dname="$1" l "verifying readability for $dname" dd if=$dname of=/dev/null count=1 1>/dev/null 2>/dev/null if (( $? != 0 )); then l "$dname is not readable" return 2 fi if [ ! -d $tmpmntdir ]; then l "creating non existant temp dir $tmpmntdir" mkdir $tmpmntdir 1>/dev/null 2>/dev/null fi umount $tmpmntdir 1>/dev/null 2>/dev/null ismnted=0 mount $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? != 0 )); then sleep 3 mount $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? != 0 )); then fstypes="xfs ext2 ext3 reiserfs vfat ntfs msdos iso9660 romfs usbfs" for fst in $fstypes; do if (( $ismnted == 0 )); then l "attempting mount -t $fst $dname $tmpmntdir" mount -t $fst $dname $tmpmntdir 1>/dev/null 2>/dev/null if (( $? == 0 )); then l "mounted $dname" ismnted=1 fi fi done if (( $ismnted == 0 )); then l "unable to mount $dname at $tmpmntdir" return 3 fi fi fi fstype=$(mount -l | grep $dname | sed 's/.*type //' | sed 's/ .*//') if [[ "$fstype" == "" ]]; then l "unable to get fstype for $dname" return 4 fi echo $fstype l "got $fstype for mounted volume $dname" umount $tmpmntdir 1>/dev/null 2>/dev/null return 0 } ## keystore management ## a "keystore" stored on USB or microSD carried always on person ## id.txt is an ascii nickname, keys.dat loop-aes encrypted file backed volume ## and finally keys.gpg the disk encryption key wrapped with passphrase. list_keystores () { l "begin list_keystores" if [ -z "$1" ]; then return 1 fi basekeydir="$1" domains="" ddirs=`ls -1dF $basekeydir/* 2>/dev/null | grep '/$'` for dir in $ddirs; do dname=`basename $dir` domains="$domains $dname" done echo $domains return 0 } select_keystore () { l "begin select_keystore" if [ -z "$1" ]; then return 1 fi basekeydir="$1" domains="" ddirs=`ls -1F $basekeydir/` for dir in $ddirs; do if [ -d $dir ]; then dname=`basename $dir` domains="$domains $dname" fi done # MRP NOT IMPLEMENTED YET... return 0 } mount_keystore () { l "begin mount_keystore" if [ -z "$1" ]; then return 1 fi if [ -z "$2" ]; then return 1 fi domkeydir="$1" mntpoint="$2" name=`basename $domkeydir` ld=$(locate_free_loopdev) if [ -z "$ld" ]; then return 2 fi idfile="${domkeydir}/id.txt" if [ -f "${domkeydir}/keys.dat" ]; then keyfile="${domkeydir}/keys.dat" open=1 else if [ -f "${domkeydir}/keys.gpg" ]; then keyfile="${domkeydir}/keys.gpg" open=0 else d "Invalid key store" return 3 fi fi fsfile="${domkeydir}/fs.enc" if [ ! -f $fsfile ]; then d "Invalid key store" return 4 fi if (( $open == 1 )); then cat $keyfile | losetup -p 0 -e $aes_mode $ld $fsfile if (( $? != 0 )); then d "Could not configure keys for loop device." return 1 fi else gpgerrf=/tmp/.gpg_err done=0 while (( $done == 0 )); do d "Loading keystore $name" gpg --decrypt $keyfile 2>$gpgerrf | losetup -p 0 -e $aes_mode $ld $fsfile if (( $? != 0 )); then sleep 2 else done=1 fi done fi mount -t ext2 $ld $mntpoint 1>/dev/null 2>/dev/null if (( $? != 0 )); then losetup -d $ld 1>/dev/null 2>/dev/null return 1 fi echo "$ld" >&2 return 0 } ### the main initialization sequence main () { l "begin main" # args? d "Initializing ..." doinit # set run mode janusmode="default" grep JANUS_TARGET /proc/cmdline >/dev/null 2>&1 if (( $? == 0 )); then janusmode=`cat /proc/cmdline | sed 's/.* JANUS_TARGET=//' | sed 's/ .*//'` fi export janusmode grep VERBOSE /proc/cmdline >/dev/null 2>&1 if (( $? == 0 )); then export VERBOSE=true fi done=0 while (( $done == 0 )); do udevs=$(list_usb_storage_devs) if [ -z "$udevs" ]; then d "No USB storage devices found. Please insert one and press enter:" read sleep 5 else done=1 fi done if [ ! -d $keydir ]; then mkdir -p $keydir 1>/dev/null 2>/dev/null else umount $keydir 1>/dev/null 2>/dev/null fi chmod 700 $keydir 1>/dev/null 2>/dev/null unset xfsdevs unset odevs xfscount=0 for udev in $udevs; do fstype=$(get_usb_dev_fstype $udev) if [ -z "$fstype" ]; then odevs="$odevs ${udev}=none" else if [[ "$fstype" == "xfs" ]]; then xfsdevs="$xfsdevs $udev" xfscount=`expr $xfscount + 1` else odevs="$odevs ${udev}=${fstype}" fi fi done prompt_mkxfs=0 if (( $xfscount == 0 )); then e "No secure key storage domains found on USB devices!" return 2 fi if (( $xfscount > 1 )); then d "Currently only one USB device is supported." d "Please leave only a single secret USB key storage device and try again." noclear sleep 2 return 3 fi mount -t xfs $xfsdevs $keydir 1>/dev/null 2>/dev/null if (( $? != 0 )); then d "Unable to mount key storage" sleep 2 return 3 fi if [ ! -d $addir ]; then mkdir -p $addir 1>/dev/null 2>/dev/null fi chmod 700 $addir 1>/dev/null 2>/dev/null domains=$(list_keystores $keydir) if [ -z "$domains" ]; then e "No secure key storage domains found!" else l "selecting domain from set :${domains}:" dc=0 for domain in $domains; do dc=`expr $dc + 1` done if (( $dc > 1 )); then select_keystore $keydir 2>/tmp/.res if (( $? != 0 )); then d "Error selecting domain." sleep 2 return 5 fi adomain=$(cat /tmp/.res) else adomain=$domains fi mount_keystore $keydir/$adomain $addir 2>/tmp/.res if (( $? != 0 )); then d "Error selecting domain." sleep 2 return 5 fi cldev=`cat /tmp/.res` fi touch $klogfile do_disks_boot l "completed boot menu, assuming restart" if [[ "$VERBOSE" == "true" ]]; then sleep 5 fi return 0 } # execute main then exit l "entering main" doinit exec /sbin/init ### last but not least, modern linux makes this much easier (yay GUID!) ### otherwise shitty hacks required... get_part_keyfile () { l "begin get_part_keyfile" part=$1 num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` pdi="/proc/ide/${drv}/identify" if [ ! -f $pdi ]; then case $drv in 'sda') busno="001" ;; 'sdb') busno="002" ;; 'sdc') busno="003" ;; 'sdd') busno="004" ;; 'sde') busno="005" ;; 'sdf') busno="006" ;; *) busno="NOT_FOUND" esac uname=`lsusb | grep "Bus $busno" | grep "Device 002" | sed 's/ .*Device 002: ID ....:.... //' | sed 's/[^a-zA-Z0-9]/_/g' | head -1` pdi=/tmp/.tmp_pdi echo "$uname" > $pdi if [[ "$uname" == "" ]]; then l "No disk identifier found for partition $part at expected $pdi" return 1 fi fi did=`gpg --print-md sha512 $pdi 2>/dev/null | sed 's/.*://' | sed 's/ //g'` did=`echo $did | sed 's/ //g'` kf="${addir}/${did}.${num}" l "associated $kf to device $part" echo $kf return 0 } get_label_keyfile () { l "begin get_label_keyfile" part=$1 num=`echo $part | sed 's/[a-z]*//g'` drv=`echo $part | sed 's/[0-9]*//g'` lid=$(get_idlabel $drv) if (( $? != 0 )); then l "unable to locate label for $drv" return 1 fi kf="${addir}/${lid}.${num}" l "matched $kf to device $part" echo $kf return 0 } ## last but not least, the specifics of how the loop-aes mount and pivot done do_boot_enc_part () { l "begin do_boot_env_part" part=$1 kf=$(get_part_keyfile $part) lkf=$(get_label_keyfile $part) if [ -f $lkf ]; then kf="$lkf" fi ld=$(locate_free_loopdev) if [ -z "$ld" ]; then l "Unable to locate free loop device." return 1 fi pdev="/dev/${part}" cat $kf | losetup -p 0 -e $aes_mode $ld $pdev if (( $? != 0 )); then l "Unable to setup loop $ld for $pdev with keyfile $kf" return 1 fi mpoint="/mnt/${part}" if [ ! -d $mpoint ]; then mkdir -p $mpoint fi l "attempting to mount $part at $mpoint using loop device $ld" mount -t xfs -w $ld $mpoint if (( $? != 0 )); then l "Unable to mount XFS partition at $mpoint" losetup -d $ld return 1 fi # actual umount and pivot root l "cd $mpoint" cd $mpoint cdir=`pwd` l "unmounting filesystems before pivot_root in $cdir" l "umount $addir" umount $addir l "losetup -d $cldev" losetup -d $cldev l "umount $keydir" umount $keydir if [ ! -d initrd ]; then l "mkdir initrd" mkdir initrd fi l "umount /proc/bus/usb" umount /proc/bus/usb l "umount /proc" umount /proc #if [ ! -f etc/save-fstab ]; then # cp etc/fstab etc/save-fstab #fi #cat etc/fstab | grep -v '^.dev.hd' | grep -v '^#' > /tmp/.sf #echo "$pdev / xfs defaults 0 1" > etc/fstab #cat /tmp/.sf >> etc/fstab l "privot root filesystem onto target volume" pivot_root . ./initrd l "executing init..." exec /sbin/init # will never hit here l "ERROR: init could not be executed?" sleep 5 l "aborting exec..." return 1 } do_boot_norm_part () { l "begin do_boot_norm_part" part=$1 mpoint="/mnt/${part}" if [ ! -d $mpoint ]; then mkdir -p $mpoint fi l "attempting to mount $part at $mpoint" mount -w /dev/$part $mpoint if (( $? != 0 )); then l "Unable to mount partition at $mpoint" return 1 fi # actual umount and pivot root l "cd $mpoint" cd $mpoint cdir=`pwd` l "unmounting filesystems before pivot_root in $cdir" l "umount $addir" umount $addir l "losetup -d $cldev" losetup -d $cldev l "umount $keydir" umount $keydir if [ ! -d initrd ]; then l "mkdir initrd" mkdir initrd fi l "umount /proc/bus/usb" umount /proc/bus/usb #MRP l "umount /proc" #umount /proc l "pivot root filesystem onto target volume" pivot_root . ./initrd l "executing init from $cdir ..." exec /sbin/init # will never hit here l "ERROR: init could not be executed?" sleep 5 l "aborting exec..." return 1 } do_disks_boot () { l "begin do_disks_boot" argf=/tmp/.args echo "--title \"Boot Encrypted Operating System\" " > $argf echo "--menu \"Select the OS to boot:\" " >> $argf echo "18 70 10" >> $argf /dev/makedevs.sh 1>/dev/null 2>/dev/null drives=`cat /proc/partitions | grep ' hd[a-z][0-9]' | sed 's/.* hd/hd/' | sort` sdrives=`cat /proc/partitions | grep ' sd[a-z][0-9]' | sed 's/.* sd/sd/' | grep -v sda1 | sort` count=0 for part in $drives $sdrives; do kf=$(get_part_keyfile $part) lkf=$(get_label_keyfile $part) if [ -f $lkf ]; then kf="$lkf" fi l "$part expects $kf" if [ -f $kf ]; then count=`expr $count + 1` allkfs="${allkfs} part${part}:${kf}" cnf="${kf}.alias" cname=`cat $cnf` if [[ "$cname" == "" ]]; then cname=$part fi psize=`fdisk -l /dev/$part 2>/dev/null | grep Disk | sed s'/.*: //' | sed 's/,.*//'` echo "\"Boot $cname\" \"Boot into encrypted $psize partition $part\" " >> $argf l "found encrypted bootable $cname on $part" else l "non encrypted $part , no $kf found" if [[ "$janusmode" == "adv" ]]; then psize=`fdisk -l /dev/$part 2>/dev/null | grep Disk | sed s'/.*: //' | sed 's/,.*//'` echo "\"Exec $part\" \"Boot into UNencrypted public partition\" " >> $argf fi fi done echo "Exit \"Reboot into a different target\" " >> $argf dodispmenu=0 if [[ "$janusmode" == "adv" ]]; then dodispmenu=1 fi if (( $count > 1 )); then dodispmenu=1 fi if (( $dodispmenu )); then dialog --file $argf --output-fd 2 2> /tmp/.res if (( $? != 0 )); then l "unable to launch dialog prompt" return 2 fi dispn=$(cat /tmp/.res) selection=`echo ${dispn}` else if (( $count == 0 )); then selection="Exit" dispmsg "No operating systems found..." else selection="Boot $cname" fi fi l "do_disks_mount selection: $selection" case $selection in Boot*) for ckf in $allkfs; do kf=`echo $ckf | sed 's/.*://'` part=`echo $ckf | sed 's/:.*//' | sed 's/part//'` cnf="${kf}.alias" cname=`cat $cnf` if [[ "$cname" == "" ]]; then cname=$part fi tn=`echo $selection | sed 's/Boot //'` if [[ "$tn" == "$cname" ]]; then ddev=$part fi done do_boot_enc_part $ddev return $? ;; Exec*) tn=`echo $selection | sed 's/Exec //'` do_boot_norm_part $tn ;; *) return 1 esac return 0 }

1 1

request for transcript / presentation: "Random Number Generation, Revisited"
by coderman 20 Jan '14

20 Jan '14

RWC going on, and at http://realworldcrypto.wordpress.com/program/ Session 11: Crypto Applications II 2:00pm Yevgeniy Dodis | New York University Random Number Generation, Revisited

1 0

Re: hacker != cracker (Re: Swartz, Weev & radical libertarian lexicon)
by coderman 20 Jan '14

20 Jan '14

On Wed, Jan 8, 2014 at 6:04 PM, brian carroll <electromagnetize(a)gmail.com> wrote: > coderman wrote: >> i am exploring a gambit for disclosure post-statute-of-limitations, >> but even this protection seems meager and risky. > > (that is a beautiful idea) it may be a very bad idea, we'll find out together these months ahead ;) there are three tales to tell: the first: wifi security interests crossed paths with power institutions lacking tact. 2003 Synopsis scanned and vulnerable, Synopsis providing licensed IP to Intel, the Oregon behemoth, who then combined a PR ruse[0] with InfraGard pull for a FBI fishing expedition trying to catch dirt... the second: monitoring from convenient location unexpectedly colocated by covert crash pad for $TLA adventure leads to lessons on mutual authentication assurances. the third: a "research experiment" widely talked about yet so few know about. in 2007 a confluence of factors collided in the perfect storm: a Tor privacy appliance actively thwarted by VMWare, a Tor summer of code proposal rejected with prejudice, and a rash of mediocre Tor vulnerability papers garnering press and pomp for posturing poseurs. under this cloud of discontent we discovered and maximized a control port vulnerability to demonstrate both the inherent strength of a virtualized transparent proxy model, but also just how bad a truly a truly bad vulnerability can be in practice. (dialed to 11, and discovered the unbelievable without getting disappeared ;) in each a discussion of the security lessons learned, perhaps an insight here or there, much rambling implicitly entwined... that will do for now, until the future, best regards 0. called for lengthy discussion as background on article for wireless security, instead used as a scaryhacker caricature in FUD piece promoting Intel Centrino security features. never talked to media since; encourage all to never talk to media as well with rare exception. specific quote behind the interest: "Netstumbling is not against the law, says special agent Mary Kimura of the Federal Bureau of Investigation (FBI), but it comes awfully close. "It's not illegal to scan for open networks," Kimura says, "but once a theft of service, denial of service, or theft of information occurs, then it becomes a federal violation." Kimura is the Infragard coordinator in the FBI's San Francisco office."

1 1

cypherpunks and hackers who dont code?
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

to the inmates: its seems we have a number of the intellectually lazy among us who either dont/wont or in some way refuse to code.. yet they wish to call themselves cypherpunks and hackers. am I missing something here about these wannabe(s)

8 12

Fwd: Debian System and /dev/random
by coderman 20 Jan '14

20 Jan '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Sun, Jan 19, 2014 at 4:57 PM Subject: Re: Debian System and /dev/random On Sun, Jan 19, 2014 at 11:41 AM, Jeffrey Walton <noloader(a)gmail.com> wrote: > I'm working on a laptop with quad core i5 running Debian 7.3 x64 > (fully patched). > > You know this damn thing was running out of entropy in /dev/random > because no entropy daemon was installed out of the box.... since 2004 building my own rngd, my own FDE bootloader, my own mandatory entropy health watchdog service, in every distribution: none did FDE key management right (for loop-aes at the time), none did entropy right. in 2008 various "expert install" console only options began to support a suitable FDE solution with luks and boot by volume GUID (rather than device file). many years we've had full blown easy (for some degree of easy) FDE solutions in graphical installers out of the gate. progress! and yet entropy, the most critical component of any crypto system, is so horribly and woefully inadequate today. will no indications this will change soon... this is not an accident. :/ > And I was depleting it with a simple program that tried to read 32 > bytes to seed an OpenSSL generator. I could only get 9 or 16 or 19 > bytes out of it yup. for fun, check out how this setup seeds itself: https://github.com/catid/cymric/ """ Linux/Android: /dev/random (160 bits) /dev/urandom (96 bits) srand() and rand() from stdlib (64 bits) gettid() or pthread_self() (32 bits) getpid() (32 bits) Linux-type systems are a little strange in that /dev/random only keeps about 20 bytes of entropy in reserve. And it takes roughly 20 seconds for a VPS to collect 8 bytes of entropy, which means asking for 32 bytes of entropy takes an unreasonably long time. By asking for only 20 bytes, most of the requests by this library will complete immediately. And the remaining 12 bytes are satisfied by /dev/urandom... """ > Seriously... That's all it was on startup.... > > That's amazing in 2013........ amazingly effective! BULLRUN FTW [EDIT: to clarify, i am lamenting the lack of high rate, raw source physical entropy sources as native instructions in processors. this should be a baseline mandatory requirement! i am also lamenting the lack of user space entropy daemons and collectors being enabled by default in most distributions. i am also lamenting the lack of proper boot time / VM pass through entropy support in most distributions. i am lamenting the lack of any failure handling for entropy in any distribution, such that a failed RNG condition leads to service halt rather than blindly carrying on, perhaps for years, unaware that you're broken. i am also lamenting the lack of serious attention and thoroughness applied to entropy sources in nearly every computing system deployed across this planet. i could go on, but you get the point... *grin* ]

1 0

test 1a
by Anonymous Remailer (austria) 19 Jan '14

19 Jan '14

this is a test of remailer white listing

1 0

"the ability of the government to go back to taps collected years earlier to look for material with which to influence potential witnesses in the present"
by coderman 19 Jan '14

19 Jan '14

see also: http://www.reddit.com/user/ellsbergd from thread: http://www.reddit.com/r/IAmA/comments/1vahsi/i_am_pentagon_papers_leaker_da… --- PulvisEtUmbraSumus When did you first become aware that there had been an attempt to seize your medical files from Lewis Fielding's office, and what was your reaction to the administration going that far? In general, how aware were you of surveillance and character assassination attempts against your person, such as the attempts to tie you to communist groups in Minnesota as per this conversation between Nixon and John Mitchell? --- ellsbergd WOW! That link is absolutely fascinating! (Even though I don't have the time just now to go through it in detail, as I will shortly). Thank you for the link! I have to ask, where is it from, where did you get it (on the White House transcripts)? Well, in answer to your question, I just became aware of some surveillance on me (BEFORE the Pentagon papers came out) ten minutes ago, from your link. I was being surveilled because I was a witness in a criminal trial of draft resisters, some of the Minnesota Eight. Their very good lawyer has been accused, I don't know on what basis, of having been a Communist. And that allegation was not of particular significance to the DOJ UNTIL, months later, he was associated with me, after the Papers came out. Likewise, the president is heard discussing with Haldeman on these transcripts the need to go back over earlier (illegal, warrantless) wiretaps--of journalists and White House officials, on which I was overheard--to see what might look significant now, in light of the release of the Pentagon Papers. That's what I've been talking about in earlier answers: the ability of the government to go back to taps collected years earlier to look for material with which to influence potential witnesses in the present. (See their interest in the allegation that the wife of one journalist may have been accused of shoplifting in her past). So people who have "nothing to hide" should ask themselves if that is equally true of their spouses or children, or neighbors, who could possibly be turned into informants by threat of their private lives being revealed. (The Cuban CIA assets who burglarized my psychoanalyst's office were interested in my children and wife as much as me, a reporter who interviewed them was told; they had been told of the precedent of Alger Hiss' step-son who was crucially deterred, at Hiss' insistence, from testifying in his defense at his trial on a crucial point, because he would have been questioned about his alleged homosexuality). My analyst later apologized to me for not telling me about the break-in--which he was sure was aimed at me, by the White House--because his lawyer had advised him not to "get involved." So I didn't know about it until it came out in my courtroom, thanks to John Dean's revelation. All for the best. If he had told me and we had raised it in the court-room, the plumbers would not have been kept on the White House payroll (via CREEP) and would not have been ordered into the Watergate. Nixon would have stayed in office, and the war would have continued for years.

1 2

Updates on the Death Prediction Lottery.
by David - 19 Jan '14

19 Jan '14

Some updates to DPL. 1) I have added a lot of names, mainly FISA court members and people from intelligence agencies. 2) I have decided not to have multiple pools but to have every name in the same death pool. Most names qualify for 75% of the pool funds, a few for 100%. The list is not complete yet, and I would consider any suggestions that I might receive. D.

5 10