- NANOG - lists.nanog.org

FBI calls for mandatory key escrow; Denning on export ctrls
by Declan McCullagh 05 Sep '97

05 Sep '97

I don't usually send crypto-stuff to nanog, but folks here might want to check out the second graf. --Declan ---------- Forwarded message ---------- Date: Wed, 3 Sep 1997 14:13:10 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: cypherpunks(a)toad.com Subject: FBI calls for mandatory key escrow; Denning on export ctrls WASHINGTON, DC -- All encryption products sold or distributed in the U.S. must have a key escrow backdoor "like an airbag in a car," law enforcement agents advised a Senate panel this afternoon. FBI Director Louis Freeh also told a Senate Judiciary subcommittee that "network service providers should be required to have some immediate decryption ability available" permitting agents to readily descramble encrypted messages that pass through their system. This marks the most aggressive push to date for mandatory domestic key escrow (or "key recovery"), which means someone else other than the recipient can decipher messages you send out. Now, the easiest way to win such a political tussle in Washington is to control the terms of the debate. And nobody understands that rule better than Sen. Jon Kyl (R-Arizona), chair of the Judiciary subcommittee on technology, terrorism, and government information. Kyl opened today's hearing not by saying its purpose was to discuss crypto in a balanced manner, but that he wanted "to explore how encryption is affecting the way we deal with criminals, terrorists, and the security needs of business." Then he talked at length about "criminals and terrorists" using crypto, and child pornographers "using encryption to hide pornographic images of children that they transmit across the Internet." Kyl also stacked the three panels. Out of seven witnesses, five were current or former law enforcement agents. No privacy or civil liberties advocates testified. Some companies including FedEx apparently dropped out when told they'd have to pay lip service to key escrow if they wanted to speak. Dorothy Denning, a Georgetown University professor of computer science, did testify. Kyl made a point of asking her if she still supported key escrow systems (two recent articles by Will Rodger and Simson Garfinkel said she was changing her mind). "I think key recovery offers a very attractive approach," Denning said. What about export controls? "In the absence of any controls, the problem for law enforcement would get worse," she replied. But when Sen. Dianne Feinstein (D-Calif) asked if Denning would support a *mandatory* key escrow system, the computer scientist said she wouldn't. "No, because we don't have a lot of experience we key recovery systems... a lot of people are legitimately nervous." (Keep in mind that although Feinstein supposedly represents Silicon Valley, she's no friend of high tech firms. She opposes lifting export controls; in fact, she says that "nothing other than some form of mandatory key recovery really does the job" of preventing crime. Of course, Feinstein doesn't have a clue. She talks about whether businesses would want "a hard key or digital key or a key infrastructure." Yes, folks, this is in fact meaningless blather.) Marc Rotenberg, director of the Electronic Privacy Information Center in Washington, DC, says, "Simply stated, the Senate train is headed in the wrong direction. But of course this doesn't answer the question of what will ultimately be resolved by Congress? There's a very popular measure in the House right now that's heading in a different direction." Rotenberg is talking about Rep. Bob Goodlatte's SAFE bill, which is much more pro-business than S.909, the McCain-Kerrey Senate bill that Kyl supports. Now, S.909 doesn't mandate key recovery; it only strongly encourages it by wielding the federal government's purchasing power to jumpstart a key recovery infrastructure. But Kyl would go further. At a recent Heritage Foundation roundtable on encryption, I asked him, "Why not make key recovery technology mandatory -- after all, terrorists, drug kingpins and other criminals won't use it otherwise." Kyl's response? Not that it would be a violation of the Constitution's due process and search and seizure protections. Instead, he told me he simply didn't have enough votes... -Declan (Email me for info on the DC cypherpunks party this Saturday!)

6 8

Re: [pointer] Senators Embrace Mandatory Data Keys
by Sean M. Doran 05 Sep '97

05 Sep '97

More shocking insights into how even people who should know better refer to members of the Senate of the United States of America as "your elected officials" on a North American newsfroup that used to be about current network issues... Of course Canada is the 51st state, Mexico is South America, and none of the Carribean, Bermuda, Greenland or St Pierre et Miquelon are entitled to be part of North America (and don't run networks anyway). Oh and besides, even if the country you are in doesn't have these problems, America's laws will override those in your tiny unimportant backwaters (like Germany or Japan) anyway, because only America upholds personal freedoms around the world. Oops, so I guess they ARE your officials (in that they can make you submit to their rules), and they are elected (by a surprisingly small number of U.S. citizens). My mistake. Sean. P.S.: If anyone other than Digex runs publically accessible looking glass software, would you mind dropping me a note? Several people in the 52nd state are thinking about doing the same and seek experience on access policies and overall usage figures. Sorry if this seems vaguely operational. I didn't mean it. Honest.

3 2

RE: Spammer Bust
by Rich Haddock 05 Sep '97

05 Sep '97

Congratulations on your bust. This is very encouraging. Now you folks at rust.net can start an anti-snail-mail spam (all those stupid coupons, furniture store and grocery store ads) service. I would pay money for that. It would be most gratifying to see some 40-year old Safeway manager walking off in handcuffs after the Feds raided his store, having confiscated several dumb terminals, samples of food matching the vicious adds he sent me, and quite possibly some actual cans of SPAM itself. Rich Haddock Any opinions expressed that cause enough grief for someone to bother looking for my employer will be treasured. PS: If anyone finds my employer, could you let me know, I'd really like to get paid this month. -----Original Message----- From: Mark E Larson [SMTP:markl@rust.net] Sent: Friday, September 05, 1997 7:34 AM To: Sean M. Doran; inet-access(a)earth.com; nanog(a)merit.edu Subject: Re: Spammer Bust Yes he was contacted and asked to stop and didn't. Plus he used a false email address, which put the blame on an innocent ISP, causing it to loose customers. Therefore the actions were necessary. Whether or not the kid was 15 is irrelevant. He caused monetary loss, sevice loss, company image damage, and did it knowingly. Would you be so sarcastic if he was 40 years old? How about if it was Cyberpromo? At 06:59 AM 9/5/97 -0700, Sean M. Doran wrote: >Cool. Internet stormtroopers. I don't suppose anybody tried >to call the kid or his parents or both before the "federal marshals >and Rustnet officials on an Aug. 29 surprise visit to the high school >student's home in Utica, MI. "? > >"The boy's parents apparently had no idea what their son was >doing with the computer, according to sources". No, I thought not... > >So, I'm curious: should this model be put forward as a BCP? >I mean we now have two independent implementations even >(cf. the federal marshals, the ISP and the Religious Technology >Center...). > > Sean. > > _____________________________________________________________________ Sent by RocketMail. Get your free e-mail at http://www.rocketmail.com

2 1

Re: Spammer Bust
by Sean M. Doran 05 Sep '97

05 Sep '97

| Would you be so sarcastic if he was 40 years old? How about if it was | Cyberpromo? Huh? I am never sarcastic. Sean.

1 0

Re: Spammer Bust
by Sean M. Doran 05 Sep '97

05 Sep '97

Cool. Internet stormtroopers. I don't suppose anybody tried to call the kid or his parents or both before the "federal marshals and Rustnet officials on an Aug. 29 surprise visit to the high school student's home in Utica, MI. "? "The boy's parents apparently had no idea what their son was doing with the computer, according to sources". No, I thought not... So, I'm curious: should this model be put forward as a BCP? I mean we now have two independent implementations even (cf. the federal marshals, the ISP and the Religious Technology Center...). Sean.

2 1

[pointer] Senators Embrace Mandatory Data Keys
by Paul Ferguson 05 Sep '97

05 Sep '97

-----BEGIN PGP SIGNED MESSAGE----- More shocking insights into how your elected officials are eroding your privacy rights. ref: http://www.wired.com/news/news/politics/story/6630.html - - paul -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNA/3M5RLcZSdHMBNAQGIjwP8CzDK6lM4A8zQrxG5DGIoS4/OU6XsH6La +Q4bc5TEWSzdgvs93w1qNrpC69qnbT6htOG0mTnq9iq3Xr+KKNRC4iZUGmqhGRQX doXNR1n2hd4WvfBJ1Hx17T5GnJpanJ80Pw0ioymRRHuKkb0k1R1jpUrel6E2HStv jDz+BMcePQw= =OKxq -----END PGP SIGNATURE-----

1 0

take me off this list
by Sonic1979X＠aol.com 05 Sep '97

05 Sep '97

ok ive tried to send unsubscibe messages to this list THAT I DONT KNOW WHY IM ON but could I please be removed thanks mikey

1 0

Re: are you an ISP thinking of spamming or condoning spammer customers?
by Eric Germann 05 Sep '97

05 Sep '97

For the truly sick, I got spammed by a guy promoting T-shirts saying DRINK+DRIVE = DI Candidate for number 1 slot on Pauls BGP fed blacklist for sicko capitalists making a buck on anything? At 12:49 PM 9/4/97 -0700, Paul A Vixie wrote: >Have a look at <URL:http://www.config.com/apology/public/spam/> first. > > ============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

1 0

Re: FYA
by Ronald F. Guilmette 05 Sep '97

05 Sep '97

In message <199709042044.NAA32211(a)wisdom.rc.vix.com>, you wrote: > >------- Forwarded Message > >Message-ID: <01BCB94B.EBBDC6E0.jordy(a)wserv.com> >From: Jordan Mendelson <jordy(a)wserv.com> >To: "nanog(a)merit.edu" <nanog(a)merit.edu> >Subject: RE: are you an ISP thinking of spamming or condoning spammer customer >s? >Date: Thu, 4 Sep 1997 16:02:15 -0400 >Organization: Web Services, Inc. >X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 >Sender: owner-nanog(a)merit.edu > >On Thursday, September 04, 1997 3:50 PM, Paul A Vixie [SMTP:paul@vix.com] >wrote: >> Have a look at <URL: http://www.config.com/apology/public/spam/> first. > >I think we should bring back castration/mastectomy as a means of punishment >for those who spam. Works for me! In Islamic countries, I believe that the standard punishment for stealing is to have your hands cut off. This is both a punishment _and_ a way of preventing repeat offenses. With regard to either goal, I believe it is most effective. My own feeling is that a similar sort of combination should be used in the case of spammers, i.e. they should be punished by being banned entirely from the net for a period of from 2 to 10 years, depending upon the severity of the offense. >Just an opinion after the 34th copy of this ARE YOU BEING INVESTIGATED spam >has hit my box. Yes. In that guy's case, I would make an exception and cut off his nuts (if he has any). I have gotten a bunch of his crap too. -- Ron Guilmette, Roseville, California ---------- E-Scrub Technologies, Inc. -- Deadbolt(tm) Personal E-Mail Filter demo: http://www.e-scrub.com/deadbolt/ -- Wpoison (web harvester poisoning) demo: http://monkeys.com/cgi-bin/wpoison

2 1

Re: Anyone Deployed Ascend's GRF IP Switch?
by Peter Lothberg 04 Sep '97

04 Sep '97

> > > GRF's also take about 5-10 minutes to reboot, which can be annoying. > > Nathan Stratton President, CTO, NetRail,Inc. > My 7206s reboot in well under a minute (the -p- builds fit right into > bootflash, so no need for a boot-then-think-then-load-flash-then-think > cycle). > > Once up, they transfer full routes bidirectionally with 7505s in > 10-15 seconds. > Avi Our BFR:s (cisco 12000) reboots in less than a minute and if it's a box reload the outage is short enough so that downstream IBGP speakers maintain their BGP sessions that are routed through the reloaded box. --Peter

1 0