Civil Disobediance

"All that matters is how we die: shall we offer our bodies helplessly,
like cattle, to the knife, or, refusing passively to await the end
shall we turn the strength of our anger to one last battle, til,
daring and doing, we fall, drenched with their blood, amongst the
heaped bodies and weapons of our dying enemies?"  -- Livy Book XXV

We've seen many sentiments like this one on the list lately.  Such
sentiments are understandable and have a certain visceral appeal.  And
it is good that people who are thinking along these lines are also
telling their friends on the list instead of censoring themselves.

But, these strategies are not the best we can choose to achieve our
true goals.  Few of us wish to be martyrs.

The years long discussion of "crypto policy" has had the unfortunate
and intended effect that it has caused us to become accustomed to
restrictions on sharing ideas.  That doesn't mean we like it, but it
does mean that we consider the control of mathematical ideas to be
expected and somewhat inevitable.  (The same mechanisms we use to
train animals are at work here.)

Many of us have, perhaps, lost our youthful rage at the complete
absurdity of a law which makes it highly illegal to invent some math,
express it in code, and distribute it for free to the world.

Perhaps there is a way to turn the training on the trainers?  Civil
disobediance is the best way to do this.  Were a relatively small
number of people, a thousand for instance, to post the "RSA in 3
lines" code to the world, it would be highly unlikely that anybody at
all would be prosecuted, particularly if a sizeable number of these
people were professors, graduate students, professionals at well known
companies, journalists, politicians?, or otherwise prominent people.
The whole situation would be so absurd they would never dare take it
to court.

If no response results from the first release of code, more people
will feel comfortable jumping in when it becomes clear that they have
a chance to change the world.  The longer somebody waits, the less
opportunity they have to tell their grandkids "I was the 500th person
to publically export RSA back in the late 20th century.  The
government was actually trying to make math illegal!"  Best of all,
anybody "fortunate" enough to be a U.S. citizen can participate, even
if they don't write code themselves.

Having established beyond any doubt that the export of RSA was
possible without repercussions, the lesson will be driven home by
group releases of successively longer mathematical works expressed in
source code.  The first release will be the most challenging.  In no
time at all everybody - including everybody in the government - will
find themselves accustomed to the idea that laws against mathematics
are absurd.  (Even Senators will be able to grasp this unchallenging
concept.)

It is not hard for the government and the newspapers to discredit
militia type activities involving large weapons collections and
chemistry experiments.  But, no matter how much spin is put on it, it
is extremely hard to persuade the public that sending a few lines of
source code is terrorism, especially when they can download it off the
web and see for themselves that it is just, well, source code, and
maybe export it themselves.

The way to get started is for people to pledge to post "RSA in 3
lines" if certain conditions are met.  For instance, "I will post 'RSA
in 3 lines' if 500 people promise to do it as well, among them being
Michel Foucault, Jacob Bernoulli, and Blaise Pascal."  No risk need be
taken without allies!

Dr. Roberts

Dr Roberts writes:
> Perhaps there is a way to turn the training on the trainers?  Civil
> disobediance is the best way to do this.  Were a relatively small
> number of people, a thousand for instance, to post the "RSA in 3
> lines" code to the world, it would be highly unlikely that anybody at
> all would be prosecuted, 

Many 1000s of people have exported it.  See also Vince Cate's arms
trafficker page.

	http://online.offshore.com.ai/arms-trafficker/

Around 3000 T-shirts were sold also.  Guess there are a fair number of
people practicing civil disobedience in the US as a result.  They're
still selling, see:

	http://www.dcs.ex.ac.uk/~aba/uk-shirt.html

for order info.

While it's probably technically illegal to export, it clearly doesn't
get you in trouble to export it.  Raph Levien sent off a Commodity
Jurisdiction Request together with a sample T-shirt to ask permission
to export the T-shirt under the ITAR regulations.  They did not answer
his request.  I presume that they viewed either a "yes" or a "no" as a
loose for them.  If they say no, they open themselves for mockery in
the press, if they say yes, we progress the situation.  Export on
paper?  Floppy?  Internet?  Bigger programs.

I'd guess the request is now outdated by the token change in export
regulations (in reality mostly a name change) to EAR regulations which
transferred jurisdiction to the commerce department.  It might be
interesting to ask them for permission to export it.  If anyone wants
to do this, I'll supply a sample T-shirt :-)

Looks like the laws may make another token name change again, but
remain the same again, with a SAFE, doubtless with key-escrow bolted
on during the compromise with NSA and LE interests stage of
negotiations.

> particularly if a sizeable number of these people were professors,
> graduate students, professionals at well known companies,
> journalists, politicians?, or otherwise prominent people.  The whole
> situation would be so absurd they would never dare take it to court.

I'd always hoped that someone could make a good PR job of ridiculing
the export regulations with this.  So far it never really got much
further than the NSA/ODTC ignoring the CJR request of Raphs.  Also,
Duncan Frissell caused a bit of a stir at CFP a few years back with
the program on labels which he handed to attenders.  Vince Cate had a
bit of success also.  The shirts have been on French TV, which is
significant also due to French crypto regulations which are worse than
the US regulations.

> The longer somebody waits, the less opportunity they have to tell
> their grandkids "I was the 500th person to publically export RSA
> back in the late 20th century.  The government was actually trying
> to make math illegal!"  Best of all, anybody "fortunate" enough to
> be a U.S. citizen can participate, even if they don't write code
> themselves.

A while back I did a cgi binary which exported the PGP.EXE out of
pgp262i in uuencoded parts, 3 lines at a time.  Came out at 713 parts.
Maybe that would be more symbolic.  People weren't so keen to export
that as they were to export the perl rsa sig.

When I announced the url, people posted "I got no 7, who got the 1st
part?" etc.  See:

	http://www.dcs.ex.ac.uk/~aba/export/

Of course this wasn't my idea, it had been discussed on the list
several times before, I just took advantage of my position outside the
crypto curtain to actually do it.

It's a bit out of date - it's talking about ITAR, that should be EAR
now.

> Having established beyond any doubt that the export of RSA was
> possible without repercussions, the lesson will be driven home by
> group releases of successively longer mathematical works expressed in
> source code.  

I think this has been established.  Vince Cate's exporters page sends
president@whitehouse.gov a protest letter together with the rsa sig.
There is a log of exporters.  Lots of names on it.

> The first release will be the most challenging.  In no time at all
> everybody - including everybody in the government - will find
> themselves accustomed to the idea that laws against mathematics are
> absurd.  (Even Senators will be able to grasp this unchallenging
> concept.)

I think Vince says on his pages that he got a mention on CNN of his
arms trafficker page.  I'd encourage anyone to use the sig, or
t-shirts, mailing labels or the guy with the tattoo of the .sig to
cause all the embarrasment they can for the US government.

> The way to get started is for people to pledge to post "RSA in 3
> lines" if certain conditions are met.  For instance, "I will post 'RSA
> in 3 lines' if 500 people promise to do it as well, among them being
> Michel Foucault, Jacob Bernoulli, and Blaise Pascal."  No risk need be
> taken without allies!

Well, it does seem to me at times that people in the US are being too
timid about the whole situation.  I mean if everyone just openly
ignored the stupid laws, you might think they would go away by
default, just to catch up with reality.  

Much hand-wringing is spent putting no-export warnings on code,
obfuscating the download process to discourage non-US people, and
warning others not to export.

Clearly for the individual there are few ill-effects from exporting
the 3 lines of perl.  (Actually 2 lines now see below).  Probably
nothing much would happen if you personally just uuencoded PGP and
spammed USENET with it.  I mean it would make not one iota of
difference as it's already universally available on ftp sites and web
pages.

Phil Zimmermann and Kelly Goen were hassled over their export, but
it's too late to worry about PGP now.

Adam
-- 
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

Adam Back writes:

: 
: Dr Roberts writes:
: > Perhaps there is a way to turn the training on the trainers?  Civil
: > disobediance is the best way to do this.  Were a relatively small
: > number of people, a thousand for instance, to post the "RSA in 3
: > lines" code to the world, it would be highly unlikely that anybody at
: > all would be prosecuted, 
: 
: Many 1000s of people have exported it.  See also Vince Cate's arms
: trafficker page.
: 
: 	http://online.offshore.com.ai/arms-trafficker/
: 
: Around 3000 T-shirts were sold also.  Guess there are a fair number of
: people practicing civil disobedience in the US as a result.  They're
: still selling, see:
: 
: 	http://www.dcs.ex.ac.uk/~aba/uk-shirt.html
: 
: for order info.
: 
: While it's probably technically illegal to export, it clearly doesn't
: get you in trouble to export it.  Raph Levien sent off a Commodity
: Jurisdiction Request together with a sample T-shirt to ask permission
: to export the T-shirt under the ITAR regulations.  They did not answer
: his request.  I presume that they viewed either a "yes" or a "no" as a
: loose for them.  If they say no, they open themselves for mockery in
: the press, if they say yes, we progress the situation.  Export on
: paper?  Floppy?  Internet?  Bigger programs.

Under the new Commerce Department export regulations it appears that
encryption software printed as hard copy---and I think that T-shirts
are hard enough for this purpose---can be freely exported.  But
the same material in electronic form may not be exported or placed on
a web site without a license.  So the T-shirts are now OK, but under
the EAR it is still an offense to send the code in a sigfile to an
international e-mail list.

It is possible that the application for permission to export the
T-shirt may have influenced this result.

(What is Raph Levien's e-mail address?  I would like to ask him the
details about his application for a Commodity Jurisdictionb Request.
It should be an amusing footnote in my casebook for my course in
computers and the law.)

--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
 EMAIL: junger@samsara.law.cwru.edu    URL:  http://samsara.law.cwru.edu   
     NOTE: junger@pdj2-ra.f-remote.cwru.edu no longer exists

Peter Junger <junger@upaya.multiverse.com> writes:
> Adam Back writes:
> : [rsa sig/t-shirt]
> : 
> : While it's probably technically illegal to export, it clearly doesn't
> : get you in trouble to export it.  Raph Levien sent off a Commodity
> : Jurisdiction Request together with a sample T-shirt to ask permission
> : to export the T-shirt under the ITAR regulations.  They did not answer
> : his request.  I presume that they viewed either a "yes" or a "no" as a
> : loose for them.  If they say no, they open themselves for mockery in
> : the press, if they say yes, we progress the situation.  Export on
> : paper?  Floppy?  Internet?  Bigger programs.
> 
> Under the new Commerce Department export regulations it appears that
> encryption software printed as hard copy---and I think that T-shirts
> are hard enough for this purpose---can be freely exported.  But
> the same material in electronic form may not be exported or placed on
> a web site without a license.  So the T-shirts are now OK, but under
> the EAR it is still an offense to send the code in a sigfile to an
> international e-mail list.

This is interesting.

It seems that this set up provides a potential test case similar to
Phil Karn's one with the source code disks for Applied Cryptography,
only much smaller, and much more silly looking, which I think would be
a boon because the US government would have more difficulty defending
the ban on export of something which would take 30 seconds to type in.

The response to Phil's request to export the disks detailed that there
was significant value added in the text having been OCRed/typed in and
neatly arranged in files on a floppy.

The .sig is also a few seconds to scan with a bar code reader.  Bar
codes are also interesting in this context, they are machine readable,
and the 2D bar codes allow reasonable information density on a sheet
of A4.  Vince has a 2D barcode gif of the .sig on his Arms Trafficker
page.

If the perl rsa .sig were to be given permission to be exported in
electronic form, over the years since the original RSA sig I have
accumulated a collection of programs some donated by others, and a
couple more myself.  There is a good selection: IDEA, OTP, RC4, RC5,
DES, Diffie-Hellman.  Someone did an RSA keygen a while back.  These
vary in size and usefullness.  It would be relatively easy to create
something sufficiently functional and yet dangerous in a reasonably
few lines.  Full PGP compatible encrypt, signature check, and decrypt
looks doable in under 2000 chars or so, easily 1 A4 page of text, or
2D barcode.

> It is possible that the application for permission to export the
> T-shirt may have influenced this result.

That would be cool if accurate :-)

Adam
-- 
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

On Thu, 15 May 1997, Huge Cajones Remailer wrote:

> "All that matters is how we die: shall we offer our bodies helplessly,
> like cattle, to the knife, or, refusing passively to await the end
> shall we turn the strength of our anger to one last battle, til,
> daring and doing, we fall, drenched with their blood, amongst the
> heaped bodies and weapons of our dying enemies?"  -- Livy Book XXV

They couldn't move with their wealth out of the way, so the alternatives
were limited.

> We've seen many sentiments like this one on the list lately.  Such
> sentiments are understandable and have a certain visceral appeal.  And
> it is good that people who are thinking along these lines are also
> telling their friends on the list instead of censoring themselves.
> 
> But, these strategies are not the best we can choose to achieve our
> true goals.  Few of us wish to be martyrs.

I worry about the government about the same as I worry about the people
who will be the barbarians when the government fails (or those who already
are ignoring government - There are some locations I have a risk of being
shot if I go).  If government has any purpose, it is to protect me from
barbarians, which is something they are failing at.  If they can't or
won't do so, why do I need government?

The internet causes data to flow like water - eventually going around any
obstacle.  If you close off a dam completely, it will eventually overflow.
And things like titles and money are more like data than physical objects.

In a few years, the government will be fighting against obsolecense and
irrelevancy.  This is only scary because they have weaponry.

Home Schooling is now easy since teaching materials can be had easily, and
you can contact thousands of people to form a support group.  Government
money will be replaced by digital commodity warehouse receipts - do you
trust lots of people who will go out of business if they cheat more than
the federal reserve and FDIC?  Email will replace most of the first class
mail business post office, and web sites most of the third.  SPAM is being
solved by the net itself (how long would it take congress to pass a bill,
then pass another one the next year to fix the problems in the first...).

Government as the Nanny that protects and provides for you will disappear
since everything that can be reduced to data will be routed out of their
hands, just as the current democracies replaced the monarchies when
education was spread from the elite who had time to study to the masses.

I don't know what will replace it, but I know I will have far more control
over and responsibility for my own life.  And this may include protecting
myself from the barbarians or government who only have and respect
violence.  If my wealth is not going to be accessible, it makes me a less
likely target for either, and if I can get anything I need without going
through their devices, they can't threaten to withold something.

At 10:24 AM -0800 5/16/97, tzeruch@ceddec.com wrote:

>I worry about the government about the same as I worry about the people
>who will be the barbarians when the government fails (or those who already
>are ignoring government - There are some locations I have a risk of being
>shot if I go).  If government has any purpose, it is to protect me from
>barbarians, which is something they are failing at.  If they can't or
>won't do so, why do I need government?

The barbarians are already inside the gate, at least here in the United
States. When rioters can burn down a major part of a major city, as in
L.A., and those defending their property are defined as "armed militia
members" and "Korean extremists," and when the Police Commission finally
admits that they hired a black as Police Chief to forestall further riots
by the "rioters of color," we know we've been invaded by the barbarians.

My solution: Take those who burned stores and looted supermarkets, give
them a quick and fair trial, and, if convicted, hang them at the nearest
major intersection. And give medals to the Koreans who shot "da niggaz"
(the name they choose to call themselves--something is might strange when
whites are castigated for even occasionally using the "N-word" while the
bruthas call each other niggaz and hoes and listen to "Niggaz with
Attitude" (NWA) on their boom boxes.).

I have no problems with blacks, greens, yellows, oranges, or violets who do
their own thing. But when they demand that I hire them when I don't want
to, or that I promote based on quotas of various racial sorts, or when they
rampage ad burn down neighborhoods, and when self-defense is outlawed, then
I react by reaching for my assault rifles.

(Next time you're asked to report your race on the Racial Klassification
Forms at the gun store, or your employer, or in the next census, report
that you are black. Under the Racial Purity Laws of 1968, anyone who is
more than 1/16th black is officially of the Negroid persuasion. And since I
have no idea what my ancestors back then were, or whom they were screwing,
who's to say I'm not Negroid? Let the Racial Police challenge me to prove
my Aryan bloodlines! We defeated the Germans so we could institute the same
racial laws they had.)

--Tim May

There's something wrong when I'm a felon under an increasing number of laws.
Only one response to the key grabbers is warranted: "Death to Tyrants!"
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

On Fri, 16 May 1997, Tim May wrote, in his ever-growing .sig:

> Only one response to the key grabbers is warranted: "Death to Tyrants!"

Bah.  Here are two better ones:

1) "See you in court."

2) "You will get yours on election day.  Watch me write this check to your
opponent."


A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | "Cyberspace" is not a place.
U. Miami School of Law     | 
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's hot here.

-----BEGIN PGP SIGNED MESSAGE-----


In <199705170233.EAA19183@basement.replay.com>, on 05/16/97 at 08:33 PM,
   nobody@REPLAY.COM (Anonymous) said:


>On Fri, 16 May 1997, Tim May wrote, in his ever-growing .sig:

>> Only one response to the key grabbers is warranted: "Death to Tyrants!"

>Bah.  Here are two better ones:

>1) "See you in court."

Does little good when the courts hold the constitution with the same
disdain as do the rest of the polititions.

>2) "You will get yours on election day.  Watch me write this check to your
>opponent."

Not much point whe the "opponent" is just as much of a fasists.

Such "standard" methods only work if we have funtioning checks and balances
in our government. This we currently do not. All 3 branches hold the
constitution in utter contempt and the only debate is how best to abolish
what is left without disturbing the sheep.

- -- 
- -----------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
                          
Finger whgiii@amaranth.com for PGP Key and other info
- -----------------------------------------------------------
 
Tag-O-Matic: This marks Logical End-Of-Message. Physical EOM follows

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM30+0Y9Co1n+aLhhAQFwGgP/dsBHHSN8Y7DqrfhcqXR3ajIieCylQE8Q
Ur/gi13ohRJSUFLMDflUJAeRDmHUN3LMX80N6/4zAKqJj17V3Tzs+F3Pr2+Kouxg
yslA+Iaf2CwgWisW1s5F5o+3rvymUKXirhm2E8PKkf6qpicluwrIF8UQdtpsHGpI
cZ3g1Jd9HIc=
=V+qB
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

At 04:33 AM 5/17/97 +0200, A. Michael Froomkin wrote:
>On Fri, 16 May 1997, Tim May wrote, in his ever-growing .sig:
>
>> Only one response to the key grabbers is warranted: "Death to Tyrants!"
>
>Bah.  Here are two better ones:
>
>1) "See you in court."
>
>2) "You will get yours on election day.  Watch me write this check to your
>opponent."

You forgot the Jim Ray solution:

3) "Watch me run against you in the next election and make you look like a
fool."

or the amnesiac solution:

4) "Damn! I forgot my passphrase again!"

or the surealist solution:

5) "What colour do you think my keys should be?  Can I hang them around this
burning giraffe?"

-----BEGIN PGP SIGNATURE-----
Version: 4.5

iQEVAwUBM33HpuQCP3v30CeZAQExOgf9E6d6x986RizMjqNfF0sZ3vDxyorv5AQg
P0m7lX7BedelgHelLTSfSqzli9dgKQPJ/1bB/zqABVZ+MJkWLO8zTrGjtIc733Ok
z1cQ32p3yXf4B64RED4Pr2GFwqWXMgwWRiFNh2NV3SAjoOgxaED1jhkgNnI3hTWq
0ND3V1/n/YwW0THndXtvul0Y50Iq69VVfHAYXAx2+gw1sviqt/dkcEmxJmFc4OCA
YsmZXhmcVOCqRhQr++lWsj/0CY7XgL9kpY1Wj0UGMAraVpJTEO2Q6HoDC8Mcr6RU
Ken7+ANB6d5MnYTbitAscHAObdeRivum5se/BcZysn1AZ9vP7CDfYQ==
=lIHr
-----END PGP SIGNATURE-----

---
|     "Bill Clinton - Bringing back the sixties one Nixon at a time."    |
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano@teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.ctrl-alt-del.com/~alan/       |alan@ctrl-alt-del.com|