Crisis Overload (re Electronic Racketeering)

Folks, I'm not going to exhort you to fight this latest travesty, to send
angry letters to your senators and representatives.

Every couple of months there's been a new legislative attack on what were
once basic American freedoms. (Sorry to focus on America. I'm sure you
folks in the liberty-loving paradises of, say, Germany, are gloating over
our hand-wringing.)

We're losing the war. We can send in donations to the NRA and EFF, offer
our support to the ACLU and EPIC, but the tide just keeps rolling in,
washing away our efforts. The full-time lawmakers in D.C. can proliferate
new repressive laws much faster than we can fight them.

Our focus on this list has been on crypto, and crypto is finally coming
under the massive assault we knew would come from the earliest rumblings
several years ago about "key escrow." Clipper was the warning shot, the
current "War on the Internet" (fed by scare stories and hysteria) is part
of the propaganda war, and now this bipartisan bill to expand the RICO Act
to include any non-GAK implementation of crypto is the nail in the coffin.

No wonder Stu Baker and Ron Lee were so smug at the last CFP.

Ordinary lobbying is probably a lost cause. The EFF tried to "work with"
the government (Administration, Congress) on the Digital Telephony Bill,
and got rolled (in the opinion of many, even in the governing circles of
EFF).

This latest assault is probably unstoppable. The co-sponsorship by Sen.
Leahy, once seen as an ally of the EFF (recall the attempts to get the
Leahy alternative to Exon adopted), and the enthusiastic support of
Republicans, Democrats, and the intelligence community means that GAK is
coming.

Oh, and the use of RICO and "conspiracy" in such a central way fulfills
Whit Diffie's prediction of a few years ago that the main way crypto will
be controlled is through such laws, by spreading fear, uncertainty, and
doubt amongst users and corporations. Make the corporations so paranoid
that they'll crack down on employees, adopt GAK methods, and freeze out the
"street corner user" of crypto.

(If the only users of PGP and other non-GAK tools are fringe groups and
underground communities, then the main goals will have been achieved. The
public use of PGP will have been squelched, the public use of anonymous
cash will have been suppressed, and the social control goals will have been
achieved. )

I think it's time to abandon all lobbying efforts...they don't appear to be
working, and the government is proliferating new laws faster than we can
fight them.

The only hope is to more rapidly deploy crypto, to reach the "point of no
return." Optimistically, we may already be there (the views expressed by
many of us). Pessimistically, the application of RICO laws and civil
forfeiture could put any of us who advocate crypto use and evasion of the
new laws into a precarious position.

This is enough to say for now.

Suffice it to say I view the latest Grassley proposed legislation to be the
culmination of the past several years worth of anti-liberty legislation. A
much bigger threat than Clipper.

In fact, it's what many of us saw implicit in Clipper.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay@sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

On Thu, 13 Jul 1995, Timothy C. May wrote:

> I think it's time to abandon all lobbying efforts...they don't appear to be
> working, and the government is proliferating new laws faster than we can
> fight them.
> 
> The only hope is to more rapidly deploy crypto, to reach the "point of no
> return." Optimistically, we may already be there (the views expressed by
> many of us). Pessimistically, the application of RICO laws and civil
> forfeiture could put any of us who advocate crypto use and evasion of the
> new laws into a precarious position.

Unfortunately, a system of social engineering needs to be adopted to get 
massive use of cryptography started.  This means, and I advocated this 
from the day I entered this forum, that programs such as PGP need to be 
redesigned so that the a user friendly . . . so user friendly that any 
Joe Moron can figure out not only how to use them, but also how it helps 
them and how it is "good" for them.  This means that we need simplified 
key management easy enough for the point-and-click masses to utilize.  
This means that common mailing programs, From Elm and Pine to AOLs and 
Computer$erve's mailers need to have TRANSPARENT signing of mail messages 
and near-transparent encryption of messages.  This means that we need to 
stop lobbying the governemtn (they dont' listen) and start lobbying Big 
Business, like IBM, MicroSoft, Apple, etc, to start including encryption 
hooks in their software.  And if PGP is a problem, International PGP 
might be an option.  And if there are problems with patent infringements 
and that kind of crap, then we (the concerned people of the global 
network) need to develop a free encrytion scheme that can do everything 
PGP can do and still be legal.

Unfortuately, all I can do is stand on the sidelines and cheer, because I 
am not a programmer; I'm a user and a teacher.

We've seen the enemy, that the are the 535 senators and representatives 
in D.C., and the staff in the White House.  It's time to shore up our 
allies and enter the battle witht he best weapons we have; information 
and popular use.

> In fact, it's what many of us saw implicit in Clipper.

Yup.  We all saw it with clipper.  We were all called paranoid.

Guess so...

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden@krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

"Robert A. Hayden" writes:
> We've seen the enemy, that the are the 535 senators and representatives 
> in D.C., and the staff in the White House.  It's time to shore up our 
> allies and enter the battle witht he best weapons we have; information 
> and popular use.

As unpleasant as the congress is, it isn't the enemy. The governmental
forces desiring control are not the same as the congress.

Congressmen are by and large harried and ignorant people. They have no
idea what any of this is about. We have the choice of letting Louis
Freeh do all the educating, or having a white shoe Washington PR firm
do some of the educating, too. I favor the latter approach.

This is not to say that we shouldn't be widely deploying crypto -- we
should. (Of course, offshore sites will always have crypto available,
but...) 

This is also not to say that Congress doesn't pass very bad laws.

However, I very, very strongly urge that we not assume that nothing
can be done. Just winning a couple years time could totally alter the
landscape.

Perry

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Thu, 13 Jul 1995, Perry E. Metzger wrote:

> As unpleasant as the congress is, it isn't the enemy. The governmental
> forces desiring control are not the same as the congress.

I'm not so sure.  Both politicos and bureaucrats go into their
respective lines of work for many reasons.  One of the main 
reasons--in my opinion--is a lust to control others.  Being the 
"others," we should resist this tendancy.  This begins with the
realization that most of them *are* the enemy and acting 
accordingly.

> This is not to say that we shouldn't be widely deploying crypto -- we
> should. (Of course, offshore sites will always have crypto available,
> but...) 

Yes, what we really need is easy, drop-in, point-and-click PGP
for the computer neophytes.  And we need to give it away to
all of them.  I wish I know how to accomplish all that.

My "wish list" also includes a fantasy in which someone 
(hopefully, a Cypherpunk) cracks some NSA developed, secret
algorithm, crypto system, preferably causing some sycophantic
company or organization to lose a bundle.  Ah, dreams.


 S a n d y

P.S.  My 84 year old mother went in to buy a refrigerator 
      from Sears or Monkey Wards or whomever.  She picked 
      out a top-of-the-line Tappan.  However, when she was 
      getting ready to pay, the salesperson began to ask
      her a series of questions which included her age and
      social security number.  My mom said, "Just stop
      right there.  If you want to ask all this personal 
      information, I'll just buy it somewhere else."  The
      stopped asking questions and took her check.  

      I think Nancy Reagan had a good idea there.  Just 
      say `NO'.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On Thu, 13 Jul 1995, Sandy Sandfort wrote:

> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>                           SANDY SANDFORT
>  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
> 
> C'punks,
> 
> On Thu, 13 Jul 1995, Perry E. Metzger wrote:
> 
> > As unpleasant as the congress is, it isn't the enemy. The governmental
> > forces desiring control are not the same as the congress.
> 
> I'm not so sure.  Both politicos and bureaucrats go into their
> respective lines of work for many reasons.  One of the main 
> reasons--in my opinion--is a lust to control others.  Being the 
> "others," we should resist this tendancy.  This begins with the
> realization that most of them *are* the enemy and acting 
> accordingly.
> 

Well, now, I wouldn't say THAT....

There are those of us intent enough of defending our rights as to go so 
far as to make an effort of getting to where we can do so more easily.  
While I know I was shouted down over NYET, the group does know where I 
stand on the issue of, for instance, free crypto or the Exon Hustler 
Protection Act.  I intend to run for JP in '98, and (assuming our 
electoral system, if not our Constition is still intact) higher office 
later.  If I win, you can bet your keyring passwords that _I_ will make 
sure that my juries are aware of FIJAs position papers.

There are others--including one John Tello, a member of the Texas State 
Republican Executive Committee, who almost single handedly got a unanimous 
resolution out of the TX SREC calling for an end of our 60-year emergency 
and a recision of various related acts.

Bluntly, if you are bellyaching but _not_ involved with an organized 
political structure that is capable of influencing legislation, then I 
blame YOU for this legislation.  I am, have, and/or shall have lobbied every 
Congressman with whom I can claim a minimal connection.  And I've done 
the work so that this is a non-trivial list.

Direct mail is useful.  But until you've worked to get someone elected, 
you are just one more voice in the roar.  The '96 campaigns are shaping 
up.  (I'm already putting the word out for '98...)  This is the time to 
find people who share our views, and work so that they win their 
primaries--or maybe don't even have to fight one.  Or maybe its time 
_you_ ran.


Nathan

Crypto-Christo-punk

> massive use of cryptography started.  This means, and I advocated this 
> from the day I entered this forum, that programs such as PGP need to be 
> redesigned so that the a user friendly . . . so user friendly that any 
> Joe Moron can figure out not only how to use them, but also how it helps 
> them and how it is "good" for them.  This means that we need simplified 
> key management easy enough for the point-and-click masses to utilize.  
> This means that common mailing programs, From Elm and Pine to AOLs and 
> Computer$erve's mailers need to have TRANSPARENT signing of mail messages 
> and near-transparent encryption of messages.  This means that we need to 

I agree.  If you forgive me for again taking the opportunity to
advertise SSH, one goal was to make it as simple to use as possible.
To get all the benefits of encryption and most benefits of improved
authentication, the users need to know absolutely nothing in addition
to what they need to know with rlogin.  Plus, there are many
convenient features, such as automatic X11 forwarding (encrypted;
DISPLAY is set to point to a fake display), command exit status is
returned properly, etc.

Of course, rlogin and rsh are much less important applications for the
general public than e-mail.  I think the currently the most critical
problem areas are exactly e-mail and interactive messaging programs
(like irc, rwrite etc).

Most mail (at least on the internet) is currently propagated
automatically from the sending host to the receiving host.  A fairly
simple, 90% of the benefit at 10% of the effort solution could be to
have sendmail (or equivalent) encrypt all communications that go
through the network.  This would make electronic mass surveillance and
scanning difficult.  It is much more expensive (and dangerous
publicity-wise) to read messages by breaking into a computer system.
This kind of system could be installed without the user even being
aware that something like that is in use.  It is not a perfect
solution - some sites will not support encryption, and some messages
might get sent without it.  Still, the bulk of the messages would be
encrypted, and any really sensitive data could be additionally PGP (or
similar) encrypted.  The procotol and implementation would have to be
well made and established as internet standards.

    Tatu Ylonen <ylo@cs.hut.fi>

For more information about SSH, see http://www.cs.hut.fi/ssh.

One motivation behind SSH is trying to make it a de-facto standard
replacement for rlogin and rsh.  That would make it very hard to
replace.  It provides important benefits in authentication and
protection against intruders - and as a side effect it provides hard
to break encryption for anyone.  Plus, it was created and is primarily
distributed *outside* the United States, in a country where none of
the algorithms are patented.  It can thus be openly available for
anyone, and is not limited by US export restrictions.  It currently
includes two algorithms that I know to be patented: RSA and IDEA.
IDEA can be eliminated from it without breaking compability if it
turns out necessary (and, several sources say that non-commercial use
of IDEA is permitted).  RSA is not patented anywhere but in the US,
and there it may be possible for most people to get away by using
RSAREF.

There is more information at http://www.cs.hut.fi/ssh.  The RFC
describes the protocol.

The current list of distribution sites includes:
   ftp.funet.fi:/pub/unix/security
   ftp.unit.no:/pub/unix/security 
   ftp.net.ohio-state.edu:/pub/security/ssh 
   ftp.kiae.su:/unix/crypto 
   ftp.cs.hut.fi/pub/ssh 

More sites are welcome.

    Tatu Ylonen <ylo@cs.hut.fi>

Date: Fri, 14 Jul 1995 01:15:04 +0300
   From: Tatu Ylonen <ylo@cs.hut.fi>
   to break encryption for anyone.  Plus, it was created and is primarily
   distributed *outside* the United States, in a country where none of
   the algorithms are patented.  It can thus be openly available for

Well, I think it's nice that people outside the U.S. will have access
to encryption; it appears, however, that those of us in the U.S. writing
such software may end up having to forego payment and credit, until
Blacknet is very strong...

Phil