- cypherpunks-legacy@lists.ogf.org

Legal Net Monthly Newsletter
by fergp＠sytex.com 23 Mar '93

23 Mar '93

Opinion, editorial and news worthy submissions are currently being (sought and) accepted for a new start-up electronic news journal. This monthly compilation will be called 'The Legal Net Monthly Newsletter' and will focus on the legal and ethical aspects of computer networking. Legal Net Monthly will be a non-biased, open forum electronic newsletter keeping in step with the networking environment of the '90's and will be availble by E-Mail subscription. Legal Net Monthly is aiming to release it's first issue on May 1st, 1993. Articles on the following topics are especially welcome: o Defining "Criminal Mischief" on the Nets o Authoring/Distributing Computer Viruses: Legal Implications o Legislative news around the world Send all sumissions, subscription requests and correspondence to: fergp(a)sytex.com Paul Ferguson | "Sincerity is fine, but it's no Network Integration Consultant | excuse for stupidity." Centreville, Virginia USA | -- Anonymous fergp(a)sytex.com (Internet) | sytex.com!fergp (UUNet) | 1:109/229 (FidoNet) | PGP 2.2 public encryption key available upon request.

1 0

Re: HIDE: embedded msgs in grphics & snd
by Duncan Frissell 23 Mar '93

23 Mar '93

>>>For exactly this reason, I don't think that this is a very good >>>idea. The discussion here started as a search for a way to make >>>encrypted data not look like encrypted data. (Once it becomes illegal). I tell you three times, I tell you three times, I tell you three times... The Feds are *not* going to outlaw encryption. They believe in encryption. They even have official bodies designed to encourage encryption. They are not even going to outlaw encryption they can't break. They are internally split on the issue. By the time they got around to actually *doing* anything, we will have been online with a fully encrypted communications system for years. They can't move fast enough. They lack the overall control of the networks to implement such a proposal. There would be First Amendment challenges. In order for such regulation to be enacted, there would have to be a collective appreciation of the risk that encryption poses to the world's States (it risks their destruction but we won't tell them that). This is too much of a high order abstraction for a collective decision making process to handle. We've had powerful encryption techniques for a while in any case. One-time pads are more than 100 years old, aren't they. "Publication" in the international realm is not subject to local laws in any case. International publications routinely carry ads for goods or services that would be illegal to sell in the individual countries reached. Sometimes a country like Singapore will censor a publication like the Asian Wall Street Journal. Ridiculous since it can be read online. Outlawing encryption is a form of censorship and censorship will prove increasingly difficult as time goes on. If they can't keep crack cocaine out of Sing Sing, how can they keep PGP out of my computer (or computers under my control somewhere in the world). The enforcement problems are staggering. What about sentencing. What is the social damage involved in my sending my wife a 2.5K encrypted file. Pretty petty offense. Even if encryption was generally outlawed, anyone involved a privileged communication (spouses, attorney-client, physician-patient, priest-penitent, etc.) could continue to use the technology since assuring privacy is one of the technical requirements of exercising such a privilege. Say, what if I as an attorney operate an anonymous remailer. <G> I know that privilege probably wouldn't attach because I wasn't a party to the communications but it would make for some entertaining litigation. No one has yet answered my legal question of several months ago. If you have an unbroken coded message, how does the prosecutor prove beyond a reasonable doubt and to a moral certainty that it is a coded message. Even if it has identifying headers and footers, that say "PGP 2.2" you can claim that you just put them on to random noise for fun in order to tweak the noses of the authorities. Duncan Frissell

1 0

FWEE! premature testing
by deltorto＠aol.com 23 Mar '93

23 Mar '93

Dewds, Just a thought on Tim May's anonymous baptism by Stealth-fire of the WB! project: Tim: though I appreciate your enthusiasm, could you *please* wait until there is something in place to actually _test_ before you test it? I know you really wanted to post that nifty F-117A thing you OCR'd _somewhere_ but that was not particularly helpful. It's not like I'm unaware of this issue. Remember, we're still in Phase One (design & data collection) now. Help with the design and data collection before you go off on your own and try to show where the holes are or have some fun with it. Later on, you can be very helpful if you want to play the Devil's Online Advocate. [Also, could you please spell my name correctly for the NSA's records? It's David Del Torto (not Deltorto). I promise not to spell your name "TiM aye" so they can come and get you too.] Someone suggested a set of WB guidelines should be posted. I began this process, and will continue next week after CFP. I ask your patience while I educate myself. CFP News: I had a *very* interesting/enlightening discussion with Nicholas Johnson, the former head of the FCC (under Johnson) last night about the WB! project - he loves the idea and is willing to help out "somehow." Also, Ralph Nader's organization is interested in what we're up to. Jim Settle (FBI Computer Crime Squad) is also surprisingly supportive of the idea. Also, believe it or not, a fellow from the CIA likes the idea and posits that, if done "correctly," the system can 'perhaps be somewhat protected' from posting by pranksters/attackers with bogus revelations - it might require someone to preview postings (I would like to DE-nominate myself and suggest that MAYBE a small review group be set up - let's discuss this, tell me what you think is a good idea). I believe that the implementation of a simple WB Key system can assist in this as well (refer to an earlier posting of mine). Of course, this would require widespread dissemination of encryption software for anyone needing that option. Dorothy Denning is there: does anyone have a question for her? A statement? I can post her email address after tonight if y'all like. More Later, Gotta Run... dave (Del Torto)

2 1

REMAIL: Anon.penet.fi no more
by jthomas＠coconut.mitre.org 23 Mar '93

23 Mar '93

You probably have seen this already, but it's certainly of relevance to cypherpunks: > Newsgroups: comp.org.eff.talk,news.admin.policy,alt.privacy,alt.sexual.abuse.reco very,alt.support,alt.transgendered,soc.motss > Path: linus.mitre.org!linus!agate!howland.reston.ans.net!usc!elroy.jpl.nasa .gov!decwrl!uunet!mcsun!fuug!penet!julf > From: julf(a)penet.fi (Ze Julf) > Subject: Anon.penet.fi no more > Organization: No! > Date: Tue, 23 Mar 1993 15:03:59 GMT > Message-ID: <1993Mar23.150359.16883(a)penet.fi> > Lines: 54 > > The anonymous service at anon.penet.fi has been closed down. Postings to > netnews and mail to arbitrary addresses has been blocked. To enable users > who know each other only by their anon ID's to arrange alternate > communication paths, mail to anonymous users will still be supported for > two weeks. After this period all database entries will be deleted. > > Due to the lawsuit-intensive climate in the US, many anonymous services have > been short-lived. By setting up anon.penet.fi in Finland, I hoped to create > a more stable service. Anon.penet.fi managed to stay in operation for almost > five months. The service was protected from most of the usual problems that > had forced other services to shut down. But there are always going to be > ways to stop something as controversial as an anon service. In this case, a > very well-known and extremely highly regarded net personality managed to > contact exactly the right people to create a situation where it is > politically impossible for me to continue running the service. > > But of course this political situation is mainly caused by the abuse of the > network that a very small minority of anon users engaged in. This small > group of immature and thoughtless individuals (mainly users from US > universities) caused much aggravation and negative feelings towards the > service. This is especially unfortunate considering these people really are > a minuscule minority of anon users. The latest statistics from the service > show 18203 registered users, 3500 messages per day on the average, and > postings to 576 newsgroups. Of these users, I have received complaints > involving postings from 57 anonymous users, and, of these, been forced to > block only 8 users who continued their abuse despite a warning from me. > > In retrospect I realize that I have been guilty to keeping a far too low > profile on the network, prefering to deal with the abuse cases privately > instead of making strong public statements. Unfortunately I realized this > only a couple of days before being forced to shut down the service, but the > results of a single posting to alt.binaries.pictures.erotica.d gave very > positive results. I take full blaim for my failure to realize the > psychological effects of a strongly stated, publicly visible display of > policy with regards to the abuse cases. For this I have to apologize to the > whole net community. > > On the other hand I am deeply concerned by the fact that the strongest > opposition to the service didn't come from users but from network > administrators. I don't think sysadmins have a god-given mandate to > dictate what's good for the users and what's not. A lot of users have > contacted me to thank me for the service, describing situations where > anonymity has been crucial, but I could never have imagined in my wildest > dreams. At the same time quite a few network administrators have made > comments like "I can't imagine any valid use for anonymity on the net" and > "The only use for anonymity is to harrass and terrorize the net". > > Nevertheless, I really want to apologize both to all the users on the > network who have suffered from the abusive misuse of the server, and to all > the users who have come to rely on the service. Again, I take full > responsibility for what has happened. > > Julf > Very sad, rather scary. Sorry to hear this, Julf. Joe

1 0

your note on sci.crypt
by Phil Karn 23 Mar '93

23 Mar '93

Dr. Denning: Although you are correct that many of the responses to your proposal contained personal attacks (in which people called you naive, etc), you seem to believe that this invalidates the fundamental underlying point they were making. This is not so. This fundamental point can be summarized as follows: The US government has repeatedly shown by its past conduct that it simply cannot be trusted to obey its own laws regarding spying on private citizens, particularly those who are organized in lawful, peaceful opposition to government policies. And history has shown that it can take many years for unlawful monitoring to become public, if indeed they ever do (consider the current story I just sent you about the Army spying on Dr. Martin Luther King). In other words, the government has frequently ignored its own laws, because it knows it can do so with impunity. No credible case can be made that the problem has been "fixed" since the now-publicized abuses of the 1960s and 1970s, i.e., that new safeguards have somehow rendered the government incapable of violating the privacy rights of its citizens. Privacy violations may or may not still be occurring; we have no way to know. But I suspect it depends far more on the people in power than on any post-Watergate "safeguards" against the abuse of that power. The private use of strong cryptography provides, for the very first time, a truly effective safeguard against this sort of government abuse. And that's why it must continue to be free and unregulated. I should credit you for doing us all a very important service by raising this issue. Nothing could have lit a bigger fire under those of us who strongly believe in a citizens' right to use cryptography than your proposals to ban or regulate it. There are many of us out here who share this belief *and* have the technical skills to turn it into practice. And I promise you that we will fight for this belief to the bitter end, if necessary. Phil Karn

1 0

another remailer goes on line
by Eric Hollander 23 Mar '93

23 Mar '93

Three remailers was not enough for me. I set up a fourth: 00x(a)uclink.berkeley.edu. It uses Hal's scripts, and will soon be running pgp (I already have pgp comiled for it). I'll post keys as soon as they are available. e

1 0

Re: Idea
by Arthur Abraham 22 Mar '93

22 Mar '93

>>> preceeding postings not copied to increase the brevity of this message \ I like that last one too, but who will bell the cat? -a2.

2 1

Re: Encrypted computing questions
by fnerd＠smds.com 22 Mar '93

22 Mar '93

Timothy Newsham <newsham(a)wiliki.eng.hawaii.edu> asks a lot of questions about my "crypto goal" of encrypted computing. Rather than answer his questions one at a time, I'll try to clarify what I meant. Also, below I ask about a related crypto goal of "trans-cryption." The idea is that you have a program and maybe some initial state information. The program accepts data in some encrypted form. It does the equivalent of decrypting it and processing it. EXCEPT... o It never turns any part of it into plaintext (unless the output is plaintext, in which case it only shows up after the computing is done). o It's impossible by analyzing the code or watching it run to figure out what it did, or which bits went where. o In particular, you can't figure out the decrypting key by analyzing the program or watching it run. o If there's state information left over, it has to be in some encrypted form. Working backward from these goals, I figure that the program is somehow combined with its private key when it is turned into a crypto-program. How do you convince users that this is what you've done, that your program is actually a crypto program that never reveals its private key or plaintext of its inputs--that it doesn't just decrypt and then process the plaintext--and that you've thrown away the private key used to make it? When it runs, it has to process all its data in encrypted form! What sort of encryption could this be? The data has to be shuffled all around continuously, and it would seem you'd have to have lots of "if" statements to make sure it behaved very differently with small input changes, so that no one could tell what any input bit affected. If the program were an interpreter for a general-purpose language, you could send it encrypted programs to run. A related idea is trans-cryption. Is it possible to do the equivalent of two RSA encryption steps (e.g., decrypt with one key, then encrypt with another), without storing information that would let you deduce either of the keys or the data between the two steps? -fnerd fnerd(a)smds.com (FutureNerd Steve Witham)

1 0

Re: HIDE: embedded msgs in grphics & snd
by George A. Gleason 22 Mar '93

22 Mar '93

"once data encryption becomes illegal, searching for LSBs will become standard procedure for datacops." Aha, but if we can establish artistic protection for cyphertext, that will be one more brick in the wall that keeps the censors out. The point is to prevent it becoming illegal in the first place. Now so far we have one great strategy: making crypto ubiquitous, so there is no way to get the horses back into the barn. I think we can benefit from additional strategies, such as expanding into all the various areas of constitutional protection that might be available. -gg

1 0

Double messages
by crunch＠netcom.com 22 Mar '93

22 Mar '93

I'm getting double messages from people. Is there something wrong with the mailing list? JD

1 0