Computer underground Digest Wed Feb 16, 1994 Volume 6 : Issue 16 ISSN 1004-042X Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET) Archivist: Brendan Kehoe (Improving each day) Acting Archivist: Stanton McCandlish Shadow-Archivists: Dan Carosone / Paul Southworth Ralph Sims / Jyrki Kuoppala Ian Dickinson Cowpie Editor: Buffy A. Lowe CONTENTS, #6.16 (Feb 16, 1994) File 1--Japanese Magazine Solicits "non-Nerds" for Cover File 2--FAQs about Clipper (From CPSR) File 3--Response to Gore's Key Escrow Comments File 4--Big Brother Inside Logo File 5--Rep. Cantwell's Remarks on HR 3627 (From EFF ftp archives) File 6--Amateur Action BBS and Clipper File 7--Wireless Messaging Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are available at no cost electronically. To subscribe, send a one-line message: SUB CUDIGEST your name Send it to LISTSERV@UIUCVMD.BITNET or LISTSERV@VMD.CSO.UIUC.EDU The editors may be contacted by voice (815-753-0303), fax (815-753-6302) or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL 60115. Issues of CuD can also be found in the Usenet comp.society.cu-digest news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT libraries and in the VIRUS/SECURITY library; from America Online in the PC Telecom forum under "computing newsletters;" On Delphi in the General Discussion database of the Internet SIG; on RIPCO BBS (312) 528-5020 (and via Ripco on internet); and on Rune Stone BBS (IIRGWHQ) (203) 832-8441. CuD is also available via Fidonet File Request from 1:11/70; unlisted nodes and points welcome. EUROPE: from the ComNet in LUXEMBOURG BBS (++352) 466893; In ITALY: Bits against the Empire BBS: +39-461-980493 ANONYMOUS FTP SITES: AUSTRALIA: ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD. EUROPE: ftp.funet.fi in pub/doc/cud. (Finland) UNITED STATES: aql.gatech.edu (128.61.10.53) in /pub/eff/cud etext.archive.umich.edu (141.211.164.18) in /pub/CuD/cud ftp.eff.org (192.88.144.4) in /pub/Publications/CuD halcyon.com( 202.135.191.2) in mirror2/cud ftp.warwick.ac.uk in pub/cud (United Kingdom) KOREA: ftp: cair.kaist.ac.kr in /doc/eff/cud COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. CuD material may be reprinted for non-profit as long as the source is cited. Authors hold a presumptive copyright, and they should be contacted for reprint permission. It is assumed that non-personal mail to the moderators may be reprinted unless otherwise specified. Readers are encouraged to submit reasoned articles relating to computer culture and communication. Articles are preferred to short responses. Please avoid quoting previous posts unless absolutely necessary. DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Digest contributors assume all responsibility for ensuring that articles submitted do not violate copyright protections. ---------------------------------------------------------------------- Date: Wed, 16 Feb 1994 17:52:43 CST From: Jim Thomas Subject: File 1--Japanese Magazine Solicits "non-Nerds" for Cover ((MODERATORS' NOTE: The following solicitation for "freaks" for the cover of a large Japanese computer magazine appeared in the "hackers" conference on The Well. We were sufficiently troubled by the dangers of continued negative media stereotyping that we include our response to the poster as well. Those wanting more information about the photo-op can contact rika@well.sf.ca.us)) "ASAhI Personal Computing", a personal computing magazine published in Japan, is about to publish a special issue of "computer culture in the US", which reports from adult CD-ROMs, tele-comuting, Internet, to HoHoCon (yeah, that was a COOL experience, thanks to Drunkfux). As the finale, we need people to be in the COVER picture. if you: 1)can bring your ANY equipment with you. More original is better. 2)have at least one of following -- nose ring or eyebrow pirce, long or no hair, hip-hop or grunge outfits, pink or green haircolor.... well, not necessary, but please BE ORIGINAL. Don't be an ordinary nerd. 3)can torelate the humiliation of being bumped out. In case too many people show up, we need to do "audition". 4)can spent about 2 hours without payment! 5)don't complain when you recieve the magazine to find yourself on the cover picture but can't read it. It is in Japanese. The shooting will be held on Feb 19, Sat, from 1PM in Buena Vist Park at Vista Ave. West @ Hight. Please respond and tell me how many friends you can bring. We wish we can have ar least 20 people. Sorry, again, we can't pay you for the modeling fee but one copy of that issue per person is garanteed. Also, the place and time is subject to change. So, please check it before you leave your place on Sat with any further notice. Oh, by the way, I'm a correspondent to that magazine based in SF. I signed on the WELL last week feding up with my Compuserve account loosing mails from Internet addresses. I am enjoying this conference VERY much. Thank You! Rika =========================================================== Date: Wed, 16 Feb 94 16:51 CST To--Rika Kasahara From--TK0JUT2 Subject--Re: Request permission to reprint your Well post Conference Rika-- Thanks for your permission to reprint the ASAhI solicitation for the cover photo of your special issue on computer culture in the U.S. As you've read in my posts on The Well in "hackers," I'm quite uncomfortable with such over-dramatization of our computer culture as as your proposed cover suggests. By bringing in "freaks" for the cover, it only increases cultural misunderstanding by playing on extreme and generally negatie stereotypes. In the U.S., some of us have worked hard for many years to reduce the stereotypes that you suggest will appear on the cover, because they reinforce media and public images of the wild and dangerous "hacker." This, in turn, has led to poorly written laws, bad policies, and to events like the "hacker crackdown" of 1990 and other incidents. Visual images are far more powerful than words, and a single stereotypical picture, as the one you describe in your post, can do more to demonize and stigmatize a group than a hundred cogent and thoughtful articles. We, and as I'm sure you know by now, and others hope you can avoid a picture that contributes to dangerous misconceptions of our culture. For some of us, the inaccurate stereotyping that you suggest in the proposed cover would be similar to doing a story on the African-American civil rights struggle and then soliciting the meanest looking "gangsta rap" fans and requesting that they bring Uzis and watermelon. Or, to run a story on Japanese business executives covered by a picture of old World War II U.S. propaganda stereotypes. Such negatively inaccurate images reinforce, rather than reduce, cultural barriers. Wouldn't a montage that depicts a broader and more accurate insight be both better art and more incisive journalism? Cordially, Jim Thomas Editor, Cu Digest ------------------------------ Date: 13 Feb 94 19:18:17 CST From: CuD moderators Subject: File 2--FAQs about Clipper (From CPSR) The Clipper Chip: Frequently Asked Questions (FAQ) (From CPSR Alert, #3.03) WHAT IS THE CLIPPER CHIP? It is a cryptographic device purportedly intended to protect private communications while at the same time permitting government agents to obtain the "keys" upon presentation of what has been vaguely characterized as "legal authorization." The "keys" would be held by two government "escrow agents" and would enable the government to access the encrypted private communication. While Clipper would be used to encrypt voice transmissions, a similar device known as Capstone would be used to encrypt data. WHO DEVELOPED THE UNDERLYING TECHNOLOGY? The cryptographic algorithm, known as Skipjack, was developed by the National Security Agency (NSA), a super-secret military intelligence agency responsible for intercepting foreign government communications and breaking the codes that protect such transmissions. In 1987, Congress passed the Computer Security Act, a law intended to limit NSA's role in developing standards for the civilian communications system. In spite of that legislation, the agency has played a leading role in the Clipper initiative and other civilian security proposals. NSA has classified the Skipjack algorithm on national security grounds, thus precluding independent evaluation of the system's strength. CPSR has filed suit under the Freedom of Information Act seeking the disclosure of the secret algorithm and other information concerning the Clipper plan. WHAT IS THE GOVERNMENT'S RATIONALE FOR CLIPPER? The key-escrow system was developed at the urging of the FBI and other law enforcement agencies, which claim that the increasing availability of strong encryption programs will interfere with their ability to conduct wiretapping. No evidence in support of these claims has been released -- in fact, FBI documents obtained through litigation by CPSR indicate that no such difficulties have been reported by FBI field offices or other federal law enforcement agencies. How important is wiretapping to law enforcement agencies? Electronic surveillance is just one of many investigative techniques available to law enforcement. In fact, it is not a widely used technique -- in 1992, fewer than 900 wiretap warrants were issued to state and federal law enforcement agencies. It is to protect the viability of that small number of wiretaps from an unsubstantiated risk that the FBI and NSA have proposed to compromise the security of billions of electronic transactions. WHAT IS THE CURRENT STATUS OF THE CLIPPER PLAN? On February 4, the Administration announced the formal adoption of the "Escrowed Encryption Standard," which is the technical specification for the Clipper system. This action means that Clipper will become the encryption standard within the government -- all cryptographic products for government use must comply with the standard (i.e., contain the key-escrow mechanism) and all individuals and businesses wishing to transmit secure communications to government agencies will eventually be obliged to use the NSA-developed technology. WILL THE CLIPPER STANDARD BECOME MANDATORY? The Administration maintains that Clipper will be a "voluntary" standard outside of the government, but many industry observers question the reality of this claim. The government exerts enormous pressure in the marketplace, and it is unlikely that alternative means of encryption will remain viable. Further, the possibility of Clipper becoming mandatory at some time in the future is quite real given the underlying rationale for the system. If criminals do, indeed, intend to use encryption to evade electronic surveillance, they are unlikely to voluntarily use the Clipper technology. WHAT CAN I DO TO OPPOSE CLIPPER? Sign the electronic petition against the Clipper plan that is being organized by CPSR. Stay informed of relevant developments by reading the CPSR Alert and other periodic announcements. And consider lending your financial support to CPSR's campaign to protect the privacy of electronic communications. ------------------------------ Date: Tue, 15 Feb 1994 12:31:32 EST From: David Sobel Subject: File 3--Response to Gore's Key Escrow Comments Re:Vice President Gore Questions Current Key Escrow Policy! Stanton McCandlish writes: >National Information Infrastructure Advisory Committee met today in >Washington at the Old Executive Office Building. In comments made >after a question and answer period, Vice President Al Gore said that >key escrow policy announced last Friday (2/4/94) had serious flaws and >that he hope the issue of who holds the keys and under what terms >would be given more serious, careful consideration. > >Gore made it clear that some amount of control of cryptography >technology was necessary for national security. However, the key >escrow policies announced by the Departments of Justice, Commerce & >State, and the NSA, were "low level decisions" that got out before >thorough analysis. "Low level decisions"? Announced "before thorough analysis"? For those of you who haven't been following this saga closely, a bit of background. The White House announced the Clipper initiative on April 16 of last year. At that time, the President "directed government agencies to develop a comprehensive policy on encryption." The results of that policy process, including the identities of the escrow agents, were announced at a briefing on February 4. The Vice President's aide, Mike Nelson, participated in the announcement and the following statement from the Vice President was released: Today's announcements on encryption represent important steps in the implementation of the Administration's policy on this critical issue. Our policy is designed to provide better encryption to individuals and businesses while ensuring that the needs of law enforcement and national security are met. Encryption is a law and order issue since it can be used by criminals to thwart wiretaps and avoid detection and prosecution. It also has huge strategic value. Encryption technology and cryptoanalysis turned the tide in the Pacific and elsewhere during World War II. The likely identities of the escrow agents -- NIST and the Treasury Department -- have been known for months. On September 27, CPSR submitted comments to NIST on the Clipper proposal and noted that In a recent briefing for Congressional staffers ... Justice Department representatives indicated that NIST and a "non-law enforcement" component of the Treasury Department will be designated as the escrow agents. If the Vice President was unaware of the proposed identities of the escrow agents, he may be as "out of the loop" as a recent predecessor. I suspect he's been well-briefed on these issues. I have to disagree with Stanton's statement that the Vice President's remarks "suggest that the key escrow policies to date do not have full support of the White House." I think they suggest that the Administration is attempting to look "reasonable" and "open-minded" when, in fact, they have already bought into the FBI/NSA mindset on encryption. As far as I'm concerned, the identity of the escrow agents is a non-issue. Debating that question is like death penalty opponents debating the relative merits of lethal injections and electrocution. For those of us opposed to key escrow *in principle*, it makes no difference who holds the keys. The decision to embrace key escrow must be reversed. CPSR is organizing an Internet petition drive to oppose the Clipper proposal. We will deliver the signed petition to the White House. In little more than a week, he petition has already generated more than 10,000 responses. Say "No" to key escrow! To sign on to the petition, send e-mail to: Clipper.petition@cpsr.org with the message "I oppose Clipper" (no quotes) ------------------------------ Date: Wed, 16 Feb 1994 10:24:49 EST From: Dave Banisar Subject: File 4--Big Brother Inside Logo BIG BROTHER INSIDE LOGO A parody of the Intel's Logo modified for the Clipper Chip is now available for use for stickers, posters, brochures etc. The Big Brother Inside graphic files are now available at the CPSR Internet Archive - ftp/gopher cpsr.org /cpsr/privacy/crypto/clipper big_brother_inside_sticker.ps (postscript-scale to fit your project) big_brother_inside_logo.gif (Color GIF - good startup/background screen) big_brother_inside_picts_info.txt (Info on the files) The files have also been uploaded to America Online in the Mac Telecom and Graphic Arts folders. big_brother_inside_sticker.ps is a generic postscript file, created in CorelDraw. The postscript image lies landscape on the page, and consists of the intel-logo's ``swoosh'' and crayon-like lettering on the inside. This design was originally created for the sticker project: the image was screened onto transparent stickers 1" square for the purpose of applying them to future clipper-chip products. (cdodhner@indirect.com was in charge of that project; as far as I know he's still distributing them for a small donation to cover printing & mailing costs). The design was created by Matt Thomlinson ------------------------------ Date: Fri, 11 Feb 1994 14:21:35 -0600 From: CuD Moderators Subject: File 5--Rep. Cantwell's Remarks on HR 3627 (From EFF ftp archives) Following are Representative Maria Cantwell's remarks to the House of Representatives when she introduced H.R. 3627, Legislation to Amend the Export Administration Act of 1979. Her synopsis of the bill appears at the end. These remarks appeared in the Congressional Record on November 24, 1993, at Volume 139, Page 3110. Please write to Rep. Cantwell today at cantwell@eff.org letting her know you support her bill. In the Subject header of your message, type "I support HR 3627." In the body of your message, express your reasons for supporting the bill. EFF will deliver printouts of all letters to Rep. Cantwell. With a strong showing of support from the Net community, Rep. Cantwell can tell her colleagues on Capitol Hill that encryption is not only an industry concern, but also a grassroots issue. *Again: remember to put "I support HR 3627" in your Subject header.* The text of the Cantwell bill can be found with the any of the following URLs (Universal Resource Locaters): ftp://ftp.eff.org/pub/EFF/Policy/Legislation/cantwell.bill http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill As of Feb. 9, 1994, co-sponsors of this bill were: Wyden (OR), Orton (UT), Manzulo (IL), Edwards (CA). Contact shabbir@panix.com to find out if the list is growing. ********************************************************************** Mr. Speaker, I am today introducing legislation to amend the Export Administration Act of 1979 to liberalize export controls on software with encryption capabilities. A vital American industry is directly threatened by unilateral U.S. Government export controls which prevent our companies from meeting worldwide user demand for software that includes encryption capabilities to protect computer data against unauthorized disclosure, theft, or alteration. The legislation I am introducing today is needed to ensure that American companies do not lose critical international markets to foreign competitors that operate without significant export restrictions. Without this legislation, American software companies, some of America's star economic performers, have estimated they stand to lose between $6 and $9 billion in revenue each year. American hardware companies are already losing hundreds of millions of dollars in lost computer system sales because increasingly sales are dependent on the ability of a U.S. firm to offer encryption as a feature of an integrated customer solution involving hardware, software, and services. The United States' export control system is broken. It was designed as a tool of the cold-war, to help fight against enemies that no longer exist. The myriad of Federal agencies responsible for controlling the flow of exports from our country must have a new charter, recognizing today's realities. Next year, the House Foreign Affairs Subcommittee of Economic Policy, Trade and the Environment, of which I am a member, will be marking up legislation to overhaul the Export Administration Act. It is my hope that the legislation I introduce today will be included in the final Export Administration Act rewrite. This legislation takes some important steps to resolve a serious problem facing some of our most dynamic industries. It would give the Secretary of Commerce exclusive authority over dual use information security programs and products, eliminates the requirement for export licenses for generally available software with encryption capabilities, and requires the Secretary to grant such validated licenses for exports of other software with encryption capabilities to any country to which we already approve exports for foreign financial institutions. The importance of this legislation cannot be overstated. America's computer software and hardware companies, including such well-known companies as Apple, DEC, Hewlett-Packard, IBM, Lotus, Microsoft, Novell, and WordPerfect, have been among the country's most internationally competitive firms earning more than one-half of their revenues from exports. The success of American software and hardware companies overseas is particularly dramatic and the importance of foreign markets is growing. Currently, American software companies hold a 75 percent worldwide market share and many derive over 50 percent of their revenues from foreign sales. American computer hardware manufacturers earn more than 60 percent of their revenues from exports. As my colleagues are well-aware, we are participants in a new information age that is quickly transforming local and national marketplaces and creating new international marketplaces where none previously existed. President Clinton and Vice President Gore have both spent considerable time explaining their vision of the National Information Infrastructure that is essential to our continued economic growth. Part of that infrastructure is already in place. International business transactions that just a few years ago took days or weeks or months to complete can now be accomplished in minutes. Driving this marketplace transformation is the personal computer. And, at the heart of every personal computer is computer software. Even the most computer illiterate of us recognize that during the past decade, computer prices have dropped dramatically while computer capabilities have increased exponentially. That comination has made it possible to exchange information and conduct business at a scale that was considered science fiction only a few years ago. Indeed, we all now rely on computer networks to conduct business and exchange information. Whether it be the electronic mail or "e-mail" system that we all now use in our congressional offices or the automated teller system relied on to conduct our personal financial affairs, we rely on computer networks of information. In the future, individuals will use information technologies to conduct virtually any of the routine transactions that they do today in person, over the telephone, and through paper files. From personal computers at home, in schools, and in public libraries, they will access books, magazine articles, videos, and multimedia resources on any topic they want. People will use computer networks to locate and access information about virtually any subject imaginable, such as background on the candidates in local political races, information on job opportunities in distant cities, the weather in the city or country they will be visiting on their vacation, and the highlights of specific sports events. Consumers will use their computers and smart televisions to shop and pay for everything from clothing and household goods to airline tickets, insurance, and all types of on-line services. Electronic records of the items they purchase and their credit histories will be easy to compile and maintain. Individuals will access home health programs from their personal computers for instant advice on medical questions, including mental health problems, information about the symptoms of AIDS, and a variety of personal concerns that they would not want other family members, or their neighbors and employers to know about. They will renew their prescriptions and obtain copies of their lab results electronically. The U.S. economy is becoming increasingly reliant on this information network. While we may not often think about these networks, they now affect every facet of our professional, business, and personal lives. They are present when we make an airline reservation; when we use a credit card to make a purchase; or when we visit a doctor who relies on a computer network to store our medical information or to assist in making a diagnosis. These networks contain information concerning every facet of our lives. For businesses, the reliance on information security is even greater. While businesses rely on the same commercial use networks that individual consumers use, in addition, businesses are now transmitting information across national and international borders with the same ease that the information was once transmitted between floors of the same office building. While all of this information exchange brings with it increased efficiencies and lower operating costs, it has also brought with it the need to protect the information from improper use and tampering. Information security is quickly becoming a top priority for businesses that rely on computer networks to conduct business. According to a recent survey of Fortune 500 companies conucted for the Business Software Alliance, 90 percent of the participants said that information security was important to their operations. Indeed, almost half of the Fortune 500 companies surveyed recently stated that data encryption was important to protect their information. One third of those companies said they look for encryption capabilities when buying software. The challenge for information security can be met by America's computer companies. American companies are deeply involved in efforts to ensure that the information transmitted on computer networks is secure. Numerous companies have developed and are developing software products with encryption capabilities that can ensure that transmitted information is received only by the intended user and that it is received in an unaltered form. Those encryption capabilities are based on mathematical formulas or logarithms of such a size that makes it almost impossible to corrupt data sources or intercept information being transmitted. I wish I could stand here today and tell my colleagues that U.S. export control laws were working and encryption technology was only available to American software companies. However, this is not the case. Sophisticated encryption technology has been available as a published public standard for over a decade and many private sources, both domestic and foreign, have developed encryption technology that they are marketing to customers today. It is an industry where commercial competition is fierce and success will go to the swift. Software is being developed and manufactured with encryption capabilities for the simple reason that software customers are demanding it. Computer users recognize the vulnerability of our information systems to corruption and improper use and are insisting on protection. That protection will be purchased or obtained from American companies or from foreign software companies. The choice is not whether the protection will be obtained, but from which company. Incredible as it may seem to most of my colleagues, the Executive Branch has seen fit to regulate exports of American computer software with encryption capabilities -- that is, the same software that is available across the counter at your local Egghead or Computerland software store -- as munitions and thereby substantially prohibit its export to foreign customers. This policy, which has all the practical effect of shutting the barn door after the horses have left in preventing access to software with encryption capabilities, does have the actual detrimental effect of seriously endangering sales of both generally available American software and American computer systems. This is because increasingly sales are dependent on the ability of a U.S. firm to offer encryption as a feature of an integrated customer solution involving hardware, software and services. Indeed, software can be exported abroad by the simplest measures and our intelligence gathering agencies have no hope of ever preventing it. Unlike most munitions that are on the prohibited export list, generally available software with encryption capabilities can be purchased without any record by anyone from thousands of commercial retail outlets, or ordered from hundreds of commercial mail order houses, or obtained for free from computer bulletin boards or networks. Once obtained, it can be exported on a single indistinguishable floppy disk in the coat pocket of any traveler or in any business envelope mailed abroad. Moreover, both generally available and customized software can be exported without anyone ever actually leaving the United States. All that is necessary are two computers with modems, one located in the United States and one located abroad. A simple international phone call and a few minutes is all that it takes to export any software program. Once a software program with encryption capabilities is in a foreign country, any computer can act as a duplicating machine, producing as many perfect copies of the software as needed. The end result is that the software is widely available to foreign users. All this was demonstrated at a hearing held on October 12 by Chairman Gejdenson's Economic Policy Trade and Environment Subcommittee of the Foreign Affairs Committee. Furthermore, while current Executive Branch policy regulates the export of American manufactured software with encryption capabilities, it is obviously powerless to prevent the development and manufacture of such software by foreign competitors. Not surprisingly, that is exactly what is happening. We heard testimony at the subcommittee's hearing that over 200 foreign hardware, software and combination products for text, file, and data encryption are available from 20 foreign countries. As a result, foreign customers, that have, in the past, spent their software dollars on American-made software, are now being forced, by American polic, to buy foreign software -- and in some cases, entire foreign computer systems. The real impact of these policies is that customers and revenue are being lost with little hope of regaining them, once lost. All precipitated by a well-intentioned, but completely misguided and inappropriate policy. There were efforts, in the last Congress to correct this policy. In response, the Bush Administration did, in fact, marginally improve its export licensing process with regard to mass market software with limited encryption capabilities. However, those changes are simply insufficient to eliminate the damage being done to American software companies. My legislation is strongly supported by the Business Software Alliance. The Business Software Alliance represents the leading American software businesses, including Aldus, Apple Computer, Autodesk, Borland International, Computer Associates, GO Corp., Lotus Development, Microsoft, Novell, and WordPerfect. In addition, Adobe Systems, Central Point, Santa Cruz Operation, and Symantec are members of BSA's European operation. Together, BSA members represent 70 percent of PC software sales. The legislation is also supported by the Industry Coalition on Technology Transfer, an umbrella group representing 10 industry groups including the Aerospace Industries Association, American Electronic Association, Electronics Industry Association, and Computer and Business Equipment Manufacturing Association. All these companies are at the forefront of the software revolution. Their software, developed for commercial markets, s available throughout the world and is at the core of the information revolution. They represent the finest of America's future in the international marketplace, and the industry has repeatedly been recognized as crucial to America's technological leadership in the 21st century. My legislation is straightforward. It would allow American companies to sell the commercial software they develop in the United States to their overseas customers including our European allies -- something that is very difficult if not impossible under present policies. I urge my colleagues to support this legislation and ask unanimous consent that the text of the bill and a section-by-section explanation be printed at this point. ************************************************************************ Section-By-Section Analysis of Report Control Liberalization for Information Security Programs and Products Section 1 Section 1 amends the Export Administration Act by adding a new subsection that specifically addresses exports of computer hardware, software and technology for information security including encryption. The new subsection has three basic provisions. First, it gives the Secretary of Commerce exclusive authority over the export of such programs and products except those which are specifically designed for military use, including command, control and intelligence applications or for deciphering encrypted information. Second, the government is generally prohibited from requiring a validated export license for the export of generally available software (e.g., mass market commercial or public domain software) or computer hardware simply because it incorporates such software. Importantly, however, the Secretary will be able to continue controls on countries of terrorists concern (like Libya, Syria, and Iran) or other embargoed countries (like Cuba and North Korea) pursuant to the Trading With The Enemy Act or the International Emergency Economic Powers Act (except for instances where IEEPA is employed to extend EAA-based controls when the EAA is not in force). Third, the Secretary is required to grant validated licenses for exports of software to commercial users in any country to which exports of such software has been approved for use by foreign financial institutions. Importantly, the Secretary is not required to grant such export approvals if there is substantial evidence that the software will be diverted or modified for military or terrorists' end-use or re-exported without requisite U.S. authorization. Section 2 Section 2 provides definitions necessary for the proper implementation of the substantive provisions. For example, generally available software is offered for sale or licensed to the public without restriction and available through standard commercial channels of distribution, is sold as is without further customization, and is designed so as to be installed by the purchaser without additional assistance from the publisher. Computer hardware and computing devices are also defined. ------------------------------ Date: Sat, 12 Feb 94 18:00:11 PST From: hkhenson@CUP.PORTAL.COM Subject: File 6--Amateur Action BBS and Clipper [There has been a *lot* of traffic on the Clipper debate recently about how key escrow would work in practice. This was written in reply to an entire issue of comp.risks] If I may boil down one side of the Clipper/Capstone debate, it is certain members of the government saying: "We need to implement this encryption method so as to avoid problems we think may be coming. Trust us! We promise not to abuse your privacy." [except for the following--expandable--list of reasons.] Unlike some in this debate, I do not doubt the sincerity of Dorothy Denning or others like her. And I would have a lot fewer problems with Clipper/Capstone proposal if the people who will be granting access to the keys and those with legal access to the keys were of Dorothy's caliber. However, people of good will are not likely to be the ones who apply for these keys to your privacy in the future. I am right in the middle of a case which has remarkable similarities to a Clipper "request for keys." Full details have been posted to comp.eff.talk and misc.legal, but in brief summery, a Postal Inspector from Tennessee is attempting (for political reasons) to impose the obscenity standards of that region on an adult BBS run from Milpitas (just North of San Jose). To this end, he obtained a warrant to take the BBS hardware. Because of contained email and First Amendment activities of a BBS, subpoenas, not warrants, are required under two sections of federal law. The laws are Title 42, Section 2000aa, and Title 18 Section 2701, the same ones which were applied in the well-known Steve Jackson Games case. Pointers to these federal laws were *posted* on the BBS. The postal inspector downloaded this file (most of which *I* originally wrote), and *included* it in his affidavit for a search warrant to a Magistrate-Judge in San Francisco, along with a remarkably weak theory of how he could avoid application of these laws to himself. To obtain a warrant to take email and 2000aa materials, a number of judicial findings should have been made. None were. The postal inspector got his warrant, mailed child pornography to the BBS, served the warrant, and "found" the child porn. To give you an idea of the good will (and competence) of the particular agent involved, he had not included the child porn in the warrant, and so had to fill out another document at the time of the search. On this form he specifically described the material as "sent without his knowledge" (referring to the sysop). Of course this statement did not prevent this child pornography (in the sysop's house for all of half an hour) from being the basis of one count (of 12) of a grand jury indictment the BBS sysop faces in Tennessee. This warrant example applies to the Clipper situation. The risk under Clipper is that your private communications will be protected by the *weakest* link in the chain--one of the thousands of low level Magistrate-Judges among whom law enforcement agents shop for warrants and will shop for keys. These judgs tend to be busy, or lazy or both, and they *trust* law enforcement agents. Even if the law is *directly quoted* in search warrant affidavits or key requests, and these laws *expressly forbid* granting warrants or key requests under the conditions cited, the judge may not even read a lengthy supporting affidavit before approving it. He is *very* unlikely to consider the underlying laws when granting a request. The key escrow agents provide no protection whatsoever since they simply fill orders from agents with approved applications. Judges ignore the law with impunity, and so do law enforcement agents because one agency will almost never investigate another. As a practical matter, applications for search warrants are almost never denied. The same situation is certain to occur for Clipper key applications, no mater how weak the justification happens to be, or what laws are being violated by those seeking the keys. ------------------------------ Date: 13 Feb 94 04:34:13 GMT From: dbatterson@ATTMAIL.COM(David Batterson) Subject: File 7--Wireless Messaging RAM Mobile Data Out To Win Wireless Race by David Batterson RAM Mobile Data is gearing up to take on the cellular phone Goliaths over the coming $billions in revenue from wireless messaging. Its biggest competitor is probably McCaw (itself now in the process of being taken over by AT&T.) The cellular companies are pushing CDPD (Cellular Digital Packet Data), the digital packet-switched technology to be laid on top of the existing analog cellular phone infrastructure. RAM claims advantages over CDPD, including free nationwide roaming, cheaper rates, fewer packet retransmissions due to errors, and better data security. Although the CDPD specification allows for 19.2K-bps speed, vs. 8K-bps for RAM, both deliver an e-mail message in about the same time (two to five seconds per packet). RAM claims that's due to CDPD granting voice messages priority over data, so "channel hopping" is required for all message transfers. RAM offers a flat monthly rate that's cheaper than nationwide alphanumeric paging: $25 for up to 100KB of messages. "A leading nationwide paging service charges $100 per month for sending only 2000 characters," said Martin S. Levetin, a senior vice president at RAM. "The affordable low-end pricing will encourage individuals to try wireless mail," Levetin added. RAM charges $75 a month for up to 400KB of messages, with additional messages at $.20 per KB. A "power user" plan offers unlimited messaging for $135 a month. The major LAN e-mail programs--Lotus cc:Mail, Microsoft Mail, WordPerfect Office, DaVinci EMAIL and CE Software--now support the RAM wireless system. "These top LAN-based products, as well as AT&T Mail and RadioMail, give today's mobile professionals a range of connectivity choices," Levetin said. RAM claims it now services more than 6,300 cities and towns, or "over 90 percent of the U.S. urban population." Their current capacity can reportedly serve some one million users. Due to its modular design, the RAM net can expand easily to allow for rapid growth. Two radio modems now make use of RAM: the Intel Wireless Modem and the Mobidem AT wireless modem from Ericsson GE Mobile Communications. The RAM network uses the MOBITEX architecture, an open, international standard for two-way wireless data communications, originally developed by L.M. Ericsson in Sweden. RAM's hierarchical network consists of subscriber units, base stations, local switches and long distance provider switches. Like CDPD, the RAM net uses TCP/IP (Transmission Control Protocol/Internet Protocol). It also works with the X.25 protocol (now used by retailers for credit card processing), and SNA. RAM Mobile Data USA Limited Partnership is a joint venture of BellSouth and RAM Broadcasting Corp. BellSouth owns 49 percent of the company. # ------------------------------ End of Computer Underground Digest #6.02 ************************************