Computer underground Digest Sun July 20, 1997 Volume 9 : Issue 57 ISSN 1004-042X Editor: Jim Thomas (cudigest@sun.soci.niu.edu) News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu) Archivist: Brendan Kehoe Shadow Master: Stanton McCandlish Shadow-Archivists: Dan Carosone / Paul Southworth Ralph Sims / Jyrki Kuoppala Ian Dickinson Field Agent Extraordinaire: David Smith Cu Digest Homepage: http://www.soci.niu.edu/~cudigest CONTENTS, #9.57 (Sun, July 20, 1997) File 1--USACM & IEEE-USA Letter on S. 909 (fwd) File 2--CFP '98 Request for Proposals File 3--Some Legal Advice for beyondHOPE Conferees File 4--Some humor on media hacks and hackers File 5--Cu Digest Header Info (unchanged since 7 May, 1997) CuD ADMINISTRATIVE, EDITORIAL, AND SUBSCRIPTION INFORMATION APPEARS IN THE CONCLUDING FILE AT THE END OF EACH ISSUE. --------------------------------------------------------------------- Date: Sat, 19 Jul 97 14:27 CDT From: Cu Digest Subject: File 1--USACM & IEEE-USA Letter on S. 909 (fwd) ============ Date--Tue, 08 Jul 1997 06:17:52 -0400 From--ACM US Public Policy Office ************************************** The Institute of Electrical and Electronics Engineers- United States Activities 1828 L Street, NW, Suite 1202 Washington, DC 20036 T: (202) 785-0017; F: (202) 785-0835 The Association for Computing U.S. Public Policy Office 666 Pennsylvania Ave., SE Suite 302 B Washington, DC 20003 T: (202) 544-4859 F: (202) 547-5482 July 3, 1997 The Honorable John McCain Chairman Senate Commerce, Science & Transportation Committee 241 Russell Senate Office Bldg. Washington, DC 20510 Dear Mr. Chairman: The U.S. Public Policy Office for the Association for Computing (USACM) and The Institute of Electrical and Electronics Engineers-United States Activities (IEEE-USA) note with considerable dismay the Senate Commerce, Science and Transportation Committee's recent approval of S. 909, the "Secure Public Networks Act." We share many of the concerns of the Committee members regarding problems of national security and law enforcement. However, we believe that the "Secure Public Networks Act," as approved by the Committee, leads U.S. encryption policy in the wrong direction. The proposed bill stands in opposition to the scientific and professional opinions of many experts who believe that national security and public safety will be weakened by the mandated introduction of constrained or recoverable-key encryption. We also believe that such action will hinder U.S. competitiveness in international markets, establish a dangerous precedent for the future, and endanger cherished civil liberties in the U.S. and elsewhere in the world. Since no hearings were held on the bill, the Committee may not have had full information on its implications. We believe the bill will have a serious, negative and long-term impact on society in general and on our organizations and their members. We are keenly interested in supporting significant consideration of the important issues involved, and we would very much like to provide technical and scientific input on this issue. Many of our members are internationally-recognized experts in the area of information security and encryption, and several have significant experience with law enforcement and national security issues. We would be happy to put you in contact with some of these experts should you desire more information on the points we outline in this letter. In what follows, we briefly outline some of the reasons why so many experts believe such a bill is harmful if it became law. - 2 - First, the bill is economically harmful. Voting to restrict strong cryptography would damage America's dominance in information technologies. Secure software and hardware is available overseas. Mathematical acumen exists around the world; the U.S. can neither control nor contain it. Software companies will continue to be forced to seek talent elsewhere. The widely-used, strong cryptographic algorithm IDEA, for example, was developed in Europe. U.S. software and hardware suppliers can incorporate IDEA into their products, but only if those products are confined to use in the U.S. Export controls have obviously not hindered the worldwide spread of encryption products based on IDEA and produced outside the U.S. These controls have merely prevented U.S. providers from participating in that global market. Customers throughout the world have the sophistication to understand the need for strong cryptographic products and they will continue to seek to buy them wherever they are sold. The result will be an increasing loss of jobs and revenues in an area where the U.S. once held the dominant position. It is conceivable that our own industry and civilian sector might eventually become dependent on foreign cryptography products should U.S. firms continue to be prohibited from open competition in this arena. Second, this bill threatens cherished civil freedoms. Information technologies make data surveillance possible and increasingly affordable. The best technical protections available to the individual depend upon cryptography. There is also an unfortunate history of a few law enforcement agents and government officials using their positions and access to violate the law and the rights of citizens. Strong encryption is the only practical means available to law-abiding citizens to defend themselves against these infrequent, but all-too-real abuses. The wording in the proposed bill for organizations with Federal funding to rely on a mandated form of encryption will be burdensome and may lead to severe invasions of privacy. For instance, if a library or university were forced to implement such encryption, how could the organization ensure that its users were actually employing the system? The only sure method would be to "snoop" on the messages to see if they were breakable under the mandated scheme. Otherwise, users would be able to substitute their own encryption instead of, or in addition to, the mandated form, thus rendering this bill meaningless but still costly to implement. This raises serious questions about privacy -- and more importantly -- First Amendment considerations. Third, the criminal element will not be hindered by any legislation similar to the one proposed. The referenced bill provides no provisions that would actually deter criminals from employing strong encryption obtained from other sources. Drug cartels, terrorists, pornographers and others who might use encryption in criminal enterprises are already violating laws with penalties much more severe than any that might be imposed for using unauthorized encryption technologies. Meanwhile, law-abiding citizens would be forced to rely on technologies that might not protect their private information against "crackers" and potential blackmailers. As in the physical world, the best public safety results from crime prevented through good practices, rather than crimes solved. Without strong cryptography Americans cannot lock their electronic doors, but must instead remain vulnerable. Thus, constraining cryptography might help law enforcement solve a small number of crimes, but it will do nothing to prevent opportunities for even more crimes, thereby reducing overall public safety. Fourth, constraints on strong cryptography will jeopardize national security. Requiring or encouraging weakened technology leaves the United States vulnerable to information warfare from other nation-states, techno-anarchists and terrorists, and from organized criminal elements. It is vital that telephone systems, medical health care systems, utility systems, and other control mechanisms affecting every sector of the economy be made more secure and not restrained from using improved security. Our national security depends on the reliability of our - 3 - national infrastructures and critical systems, particularly those based on computer and communications technology. To legislate the use of untested mechanisms that present weakened protection, or that have a single point of failure and attack, will unnecessarily endanger those critical institutions and the people who depend on them. Those same forces arrayed against our national interests will be freely able to obtain stronger cryptography technology from the many other countries that do not place restrictions on its development and sale. Fifth, information technologies change quickly. We don't want to require enabling legislation whenever advances in technology increase the vulnerability of current key lengths. The recent cracking of 56-bit DES in the RSA challenge shows that distributed computing power is now available to break this key length, thus identifying a need for larger keys. A breakthrough in mathematics, such as increasing the speed of factoring numbers, would require a prompt response, such as increasing key lengths or changing algorithms. The proposed legislation would severely discourage such changes. Additionally, by preventing the initial acquisition of strong encryption technology, the need for near-term upgrades to defeat improved cracking techniques is almost assured, as are the extra financial burdens. As a last point, consider the implicit message sent by passage of this act or any like it. The U.S. has long been a vocal proponent of freedom of speech and other civil rights for citizens around the world. Why should any other nation's leaders heed further such rhetoric if the U.S. adopts the proposed bill? If some foreign nation with a history of oppression were to pass the same legislation so as to eavesdrop on their citizens' communications for purposes of identifying human rights activities, we would register strong disapproval. With passage of legislation such as the "Secure Public Networks Act" the U.S. loses the moral high ground in any future such scenario. In summary, our professional position is that passage of the "Secure Public Networks Act" or similar legislation is ill-advised; we urge you to defeat this bill. Instead, we encourage passage of legislation such as Senator Conrad Burns' Pro-CODE bill, or Representative Bob Goodlatte's SAFE bill as a better, more effective aid to national security, law enforcement and civil rights. IEEE is the world's largest technical professional association with 320,000 members worldwide. IEEE-USA promotes the career and technology policy interests of the more than 220,000 electrical, electronics and computer engineers who are U.S. members of the Institute. The Association for Computing (ACM) is an international non-profit educational and scientific society with 76,000 members worldwide, 60,000 of whom reside in the U.S. USACM strives to promote dialog on technology policy issues among U.S. policy makers, the general public, and the technology community. If you need additional information, please contact Deborah Rudolph in the IEEE-USA Washington office at (202) 785-0017 or Lauren Gelman in the USACM Public Policy office at (202) 544-4859 or (202) 298-0842. Sincerely, Barbara Simons, Ph.D. Paul J. Kostek Chair, U.S. Public Policy Vice Chair Committee of ACM United States Activities Board ------------------------------ Date: Wed, 16 Jul 1997 15:47:28 -0500 From: ecavazos Subject: File 2--CFP '98 Request for Proposals REQUEST FOR PROPOSALS: CFP98 (proposals must be received by August 15,1997 to be considered) COMPUTERS, FREEDOM, AND PRIVACY CONFERENCE February 18-20, 1998 * Hyatt Regency Austin at Town Lake * Austin, TX The Eighth Annual Conference on Computers, Freedom, and Privacy (CFP98) is scheduled for Wednesday February 18 to Friday February 20, 1998 in Austin, Texas, at the Hyatt Regency Austin Hotel on Town Lake. The Computers, Freedom, and Privacy Conferences serve as an internationally recognized forum and gathering place for the key members of the technical, government, hacker, legal, security and journalistic communities to address cutting edge technical, business, legal and cultural issues. Topics and speakers from prior years' CFP conferences can be found at the CFP web site, http://www.cfp.org. For the 1998 CFP conference, The 1998 Program Committee (members listed below) is particularly interested in receiving proposals that deal with: 1) emerging issues relating to privacy and data ownership, such as the use of infrared tracking of supermarket shopping carts to monitor search and purchasing patterns of customers; developments with medical databases, library filtering, GPS tracking systems, etc. 2) controversial issues; 3) conflict, e.g., debates where presenters have sharply defined and differing points of view, technolibertarian vs. anti-tech "humanist; " or have different training/disciplines, e.g., cyberactivists on virtual communities vs. sociologist/philosopher/writer discussing nature of the "physical world." 4) innovative and alterantive formats such as moot courts, case studies, reverse role playing, etc., to enliven some of CFP's recurring topics that are increasingly found at other conferences. The 1998 Program Committee strongly encourages proposals that involve one or two speakers, as well as panel presentations. A single or two person presentation is often better focused than a panel and it is the goal of The 1998 Program Committee to provide a mix of panels and single/dual speaker presentations during the General Session. Ideally, panels will be limited to no more than four persons whose views are not duplicative of each other. In addition to the two and one-half days of General Session, which starts the afternoon of Wednesday February 18, CFP98 will offer tutorials. Five or six three hour tutorial sessions will be offered on the morning of Wednesday February 18. CFP98 will also continue the practice of breakout topic presentations during the Thursday and Friday luncheons. The Program Committee is seeing proposals for both tutorials and the luncheon sessions. It is the goal of the CFP98 Program Committee to be able to offer some travel money to speakers; however the amount or allocation of travel funds depends heavily on success in obtaining sponsors, which will not be known until early September. The CFP98 Program Committee will meet the week of August 18 to finalize selection of proposals; consequently all proposals must be received * by August 15, 1997 * to assure consideration by the Program Committee. Please follow the submission guidelines below. * CFP98 PROPOSAL SUBMISSION GUIDELINES * CFP98 is being organized and hosted this February under the auspices of The University of Texas School of Law. Mark Lemley, Professor at The Law School, serves as Chair of the Program Committee. He may be reached by e-mail at: mlemley@mail.law.utexas.edu Proposals should include the following information. 1) Presentation Topic Title: 2) Presentation Type: [ ] General Session [ ] Luncheon [ ] Tutorial 3) Proposed Length of Presentation* * Presentations during the General Session can range from .5 to 1.5 hours. Breakout luncheon presentations are 1.0 hr. Tutorial presentations run 3.0 hrs. 4) Name(s) of Speaker(s), plus BRIEF background description about each speaker. For presentations with more than one speaker, please indicate and provide contact information for the primary panel coordinator/moderator/chair. 5) A one to two paragraph description of the Topic and Format, suitable for conference brochure and press release. 6) Additional information regarding topic, format (including special presentation or A/V needs), possible but not yet confirmed speakers, or speaker substitutes -- or any other information that you think would be useful to The Program Committee in evaluating your proposal. For more information on the Computers, Freedom, and Privacy Conferences, please visit our Web page at: http://www.cfp.org. Proposals should be sent as soon as possible to CFP98 Program Chair Mark Lemley at: mlemley@mail.law.utexas.edu or by mail to: Mark Lemley The University of Texas School of Law 727 East 26th Street Austin, TX 78705 *Proposals must be received no later than August 15, 1997 * ------------------------------------------------------------- CFP98 PROGRAM COMMITTEE Mark A. Lemley, CHAIR Assistant Professor of Law The University of Texas School of Law Matt Blaze Senior Research Scientist AT&T Bell Research Edward A. Cavazos Senior Vice President, General Counsel Interliant, Inc. Gary B. Chapman Director, The 21st Century Project LBJ School of Public Affairs The University of Texas at Austin David Chaum DigiCash bv Amsterdam, The Netherlands Dave Del Torto Pretty Good Privacy, Inc. Michael Esposito The University of Texas School of Law A. Michael Froomkin Associate Professor of Law University of Miami School of Law Katie Hafner Newsweek Technology Correspondent Newsweek Magazine Donna L. Hoffman Owen Graduate School of Management Vanderbilt University Deborah Hurley Director, Information Infrastructure Project John F. Kennedy School of Government Harvard University Bruce R. Koball Technical Consultant Jon Lebkowsky President, EFF-Austin Teresa Peters Organisation for Economic Co-Operation and Development Paris, France Ned Ramage The Freedom Forum First Amendment Center Shabbir J. Safdar The Voters Telecommunications Watch Jonah Seiger Communications Director Center for Democracy and Technology Sharon Strover Director, Texas Telecommunications Policy Institute The University of Texas at Austin Peter Toren United States Department of Justice ------------------------------ Date: Fri, 18 Jul 1997 22:55:19 -0400 From: Paul Kneisel Subject: File 3--Some Legal Advice for beyondHOPE Conferees Introduction The article below was prepared by the attorneys from the Mass Defense Committee of the National Lawyers Guild after conferring with security representatives for the upcoming beyondHOPE hackers conference. The conference will be held in New York City on August 8, 9, and 10. People who plan on attending the conference may wish to decide what to bring to the con and what to leave home based on information below. -- tallpaul (Paul Kneisel) Some Legal Advice for beyondHOPE Conferees Welcome to the conference. Enjoy yourself but keep in mind that there will be law enforcement persons present. Here are some basic police-encounter rules of law and procedure that you should remember: 1. A police officer is entitled to briefly ask you questions for almost any reason. However, you are not required to answer the questions and the police cannot stop you without evidence of wrongdoing (see below). 2. A police officer is entitled to briefly stop you if he or she has a "reasonable suspicion" that you are involved in criminal activity. You may be frisked for a weapon if there is a reasonable suspicion (such as the bulge of a gun) that you are carrying one. You are not required to answer questions. You are free to leave (after the frisk, if there is one) unless the officer has more evidence of a crime than "reasonable suspicion" (see below). The officer may not legally conduct a more extensive search on the basis of "reasonable suspicion". 3. A police officer may arrest and search you (and any bags or other containers you may be carrying) if he or she has probable cause to believe you have committed a crime (or an "offense", such as disorderly conduct). Probable cause means facts that make it more probable than not that you are committing a crime or offense. 4. If you are arrested the police will take you to a police precinct. If the arrest was for a minor offense such as disorderly conduct or possession of alcohol, you will probably receive a summons and be released in several hours. (You will need reliable identification to be released.) If you do not have reliable identification and the police do not believe you will come to court, they will not release you and will take you to court, a process that takes between 24-48 hours. If you are arrested for a serious offense, you will certainly not be released. 5. If you are under 16 and are arrested, the police will attempt to contact your parents while you are at the precinct. If your parents cannot be located, the police may transport you to a juvenile detention facility and/or Family Court (depending on the time of day) where your release will be decided. In short, if a police officer has sufficient evidence that you are committing a crime he may legally stop and search you and any containers you may be carrying. Even if a police officer does not have sufficient evidence that you are committing a crime he might well stop and search you anyway. If the officer finds drugs, alcohol, illegal weapons or devices or any other illegal property, he will usually arrest you and confiscate the property. If the search was illegal you will have a basis to challenge it in court but you will not get any illegal property back. Therefore, you would be wise to not carry anything illegal at this conference. If you have any questions about your rights contact: The Mass Defense Committee of the National Lawyers Guild, (212) 255-4181 ------------------------------ Date: Fri, 18 Jul 1997 12:08:12 -0500 (CDT) From: Crypt Newsletter Subject: File 4--Some humor on media hacks and hackers In as fine a collection of stereotypes as can be found, the Associated Press furnished a story on July 14 covering the annual DefCon hacker get together in Las Vegas. It compressed at least one hoary cliche into each paragraph. Here is a summary of them. The lead sentence: "They're self-described nerds . . . " Then, in the next sentence, "These mostly gawky, mostly male teen-agers . . . also are the country's smartest and slyest computer hackers." After another fifty words, "These are the guys that got beat up in high school and this is their chance to get back . . . " Add a sprinkling of the obvious: "This is a subculture of computer technology . . ." Stir in a paraphrased hacker slogan: "Hacking comes from an intellectual desire to figure out how things work . . ." A whiff of crime and the outlaw weirdo: "Few of these wizards will identify themselves because they fear criminal prosecution . . . a 25-year-old security analyst who sports a dog collar and nose ring, is cautious about personal information." Close with two bromides that reintroduce the stereotype: "Hackers are not evil people. Hackers are kids." As a simple satirical exercise, Crypt News rewrote the Associated Press story as media coverage of a convention of newspaper editors. It looked like this: LAS VEGAS -- They're self-described nerds, dressing in starched white shirts and ties. These mostly overweight, mostly male thirty, forty and fiftysomethings are the country's best known political pundits, gossip columnists and managing editors. On Friday, more than 1,500 of them gathered in a stuffy convention hall to swap news and network. "These are the guys who ate goldfish and dog biscuits at frat parties in college and this is their time to strut," said Drew Williams, whose company, Hill & Knowlton, wants to enlist the best editors and writers to do corporate p.r. "This is a subculture of corporate communicators," said Williams. Journalism comes from an intellectual desire to be the town crier and a desire to show off how much you know, convention-goers said. Circulation numbers and ad revenue count for more than elegant prose and an expose on the President's peccadillos gains more esteem from ones' peers than klutzy jeremiads about corporate welfare and white-collar crime. One group of paunchy editors and TV pundits were overheard joking about breaking into the lecture circuit, where one well-placed talk to a group of influential CEOs or military leaders could earn more than many Americans make in a year. Few of these editors would talk on the record for fear of professional retribution. Even E.J., a normally voluble 45-year-old Washington, D.C., editorial writer, was reticent. "Columnists aren't just people who write about the political scandal of the day," E.J. said cautiously. "I like to think of columnists as people who take something apart that, perhaps, didn't need taking apart." "We are not evil people. We're middle-aged, professional entertainers in gray flannel suits." Crypt Newsletter ------------------------------ Date: Thu, 7 May 1997 22:51:01 CST From: CuD Moderators Subject: File 5--Cu Digest Header Info (unchanged since 7 May, 1997) Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are available at no cost electronically. CuD is available as a Usenet newsgroup: comp.society.cu-digest Or, to subscribe, send post with this in the "Subject:: line: SUBSCRIBE CU-DIGEST Send the message to: cu-digest-request@weber.ucsd.edu DO NOT SEND SUBSCRIPTIONS TO THE MODERATORS. The editors may be contacted by voice (815-753-6436), fax (815-753-6302) or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL 60115, USA. To UNSUB, send a one-line message: UNSUB CU-DIGEST Send it to CU-DIGEST-REQUEST@WEBER.UCSD.EDU (NOTE: The address you unsub must correspond to your From: line) Issues of CuD can also be found in the Usenet comp.society.cu-digest news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT libraries and in the VIRUS/SECURITY library; from America Online in the PC Telecom forum under "computing newsletters;" On Delphi in the General Discussion database of the Internet SIG; on RIPCO BBS (312) 528-5020 (and via Ripco on internet); CuD is also available via Fidonet File Request from 1:11/70; unlisted nodes and points welcome. In ITALY: ZERO! BBS: +39-11-6507540 UNITED STATES: ftp.etext.org (206.252.8.100) in /pub/CuD/CuD Web-accessible from: http://www.etext.org/CuD/CuD/ ftp.eff.org (192.88.144.4) in /pub/Publications/CuD/ aql.gatech.edu (128.61.10.53) in /pub/eff/cud/ world.std.com in /src/wuarchive/doc/EFF/Publications/CuD/ wuarchive.wustl.edu in /doc/EFF/Publications/CuD/ EUROPE: nic.funet.fi in pub/doc/CuD/CuD/ (Finland) ftp.warwick.ac.uk in pub/cud/ (United Kingdom) The most recent issues of CuD can be obtained from the Cu Digest WWW site at: URL: http://www.soci.niu.edu/~cudigest/ COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. CuD material may be reprinted for non-profit as long as the source is cited. Authors hold a presumptive copyright, and they should be contacted for reprint permission. It is assumed that non-personal mail to the moderators may be reprinted unless otherwise specified. Readers are encouraged to submit reasoned articles relating to computer culture and communication. Articles are preferred to short responses. Please avoid quoting previous posts unless absolutely necessary. DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Digest contributors assume all responsibility for ensuring that articles submitted do not violate copyright protections. ------------------------------ End of Computer Underground Digest #9.57 ************************************