HaCKeRz Kr0nlcKLeZ 1/HaCKeRz Kr0nlcKLeZ.iso/chibacity/cud616.arj/CUD616.TXT

Text File | 1994-02-18 | 42.9 KB | 846 lines

Computer underground Digest    Wed  Feb 16, 1994   Volume 6 : Issue 16
                           ISSN  1004-042X

       Editors: Jim Thomas and Gordon Meyer ([e-mail])
       Archivist: Brendan Kehoe (Improving each day)
       Acting Archivist: Stanton McCandlish
       Shadow-Archivists: Dan Carosone / Paul Southworth
                          Ralph Sims / Jyrki Kuoppala
                          Ian Dickinson
       Cowpie Editor:     Buffy A. Lowe

CONTENTS, #6.16 (Feb 16, 1994)
File 1--Japanese Magazine Solicits "non-Nerds" for Cover
File 2--FAQs about Clipper (From CPSR)
File 3--Response to Gore's Key Escrow Comments
File 4--Big Brother Inside Logo
File 5--Rep. Cantwell's Remarks on HR 3627 (From EFF ftp archives)
File 6--Amateur Action BBS and Clipper
File 7--Wireless Messaging

Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost electronically.
To subscribe, send a one-line message:  SUB CUDIGEST  your name
Send it to [e-mail] or [e-mail]
The editors may be contacted by voice (815-753-0303), fax [phone])
or U.S. mail at:  Jim Thomas, Department of Sociology, NIU, DeKalb, IL
60115.

Issues of CuD can also be found in the Usenet comp.society.cu-digest
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT
libraries and in the VIRUS/SECURITY library; from America Online in
the PC Telecom forum under "computing newsletters;"
On Delphi in the General Discussion database of the Internet SIG;
on RIPCO BBS [phone] (and via Ripco on  internet);
and on Rune Stone BBS (IIRGWHQ) [phone].
CuD is also available via Fidonet File Request from
1:11/70; unlisted nodes and points welcome.
EUROPE:   from the ComNet in LUXEMBOURG BBS (++352) 466893;
          In ITALY: Bits against the Empire BBS: [phone]

ANONYMOUS FTP SITES:
  AUSTRALIA:      ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD.
  EUROPE:         ftp.funet.fi in pub/doc/cud. (Finland)
  UNITED STATES:
                  aql.gatech.edu (128.61.10.53) in /pub/eff/cud
                  etext.archive.umich.edu (141.211.164.18)  in /pub/CuD/cud
                  ftp.eff.org (192.88.144.4) in /pub/Publications/CuD
                  halcyon.com( 202.135.191.2) in mirror2/cud
                  ftp.warwick.ac.uk in pub/cud (United Kingdom)
  KOREA:          ftp: cair.kaist.ac.kr in /doc/eff/cud

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted for non-profit as long
as the source is cited. Authors hold a presumptive copyright, and
they should be contacted for reprint permission.  It is assumed that
non-personal mail to the moderators may be reprinted unless otherwise
specified.  Readers are encouraged to submit reasoned articles
relating to computer culture and communication.  Articles are
preferred to short responses.  Please avoid quoting previous posts
unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
            responsibility for ensuring that articles submitted do not
            violate copyright protections.

----------------------------------------------------------------------

Date: Wed, 16 Feb 1994 17:52:43 CST
From: Jim Thomas <[e-mail]>
Subject: File 1--Japanese Magazine Solicits "non-Nerds" for Cover

((MODERATORS' NOTE: The following solicitation for "freaks" for
the cover of a large Japanese computer magazine appeared in the
"hackers" conference on The Well. We were sufficiently troubled
by the dangers of continued negative media stereotyping that we
include our response to the poster as well. Those wanting more
information about the photo-op can contact [e-mail]))

 "ASAhI Personal Computing", a personal computing magazine published
 in Japan, is about to publish a special issue of "computer culture in
 the US", which reports from adult CD-ROMs, tele-comuting, Internet,
 to HoHoCon (yeah, that was a COOL experience, thanks to Drunkfux).

 As the finale, we need people to be in the COVER picture.  if you:
 1)can bring your ANY equipment with you.  More original is better.
 2)have at least one of following -- nose ring or eyebrow pirce, long
 or no hair, hip-hop or grunge outfits, pink or green haircolor....
 well, not necessary, but please BE ORIGINAL.  Don't be an ordinary
 nerd.  3)can torelate the humiliation of being bumped out.  In case
 too many people show up, we need to do "audition".  4)can spent about
 2 hours without payment!  5)don't complain when you recieve the
 magazine to find yourself on the cover picture but can't read it.  It
 is in Japanese.

 The shooting will be held on Feb 19, Sat, from 1PM in Buena Vist Park
 at Vista Ave. West @ Hight.

 Please respond and tell me how many friends you can bring.  We wish
 we can have ar least 20 people.  Sorry, again, we can't pay you for
 the modeling fee but one copy of that issue per person is garanteed.

 Also, the place and time is subject to change.  So, please check it
 before you leave your place on Sat with any further notice.

 Oh, by the way, I'm a correspondent to that magazine based in SF.  I
 signed on the WELL last week feding up with my Compuserve account
 loosing mails from Internet addresses.  I am enjoying this conference
 VERY much.  Thank You!

 Rika

===========================================================

Date:    Wed, 16 Feb 94 16:51 CST
To--Rika Kasahara <[e-mail]>
From--TK0JUT2
Subject--Re:  Request permission to reprint your Well post
         Conference

Rika--

Thanks for your permission to reprint the ASAhI solicitation for the
cover photo of your special issue on computer culture in the U.S.

As you've read in my posts on The Well in "hackers," I'm quite
uncomfortable with such over-dramatization of our computer culture as
as your proposed cover suggests.  By bringing in "freaks" for the
cover, it only increases cultural misunderstanding by playing on
extreme and generally negative stereotypes. In the U.S., some of us
have worked hard for many years to reduce the stereotypes that you
suggest will appear on the cover, because they reinforce media and
public images of the wild and dangerous "hacker." This, in turn, has
led to poorly written laws, bad policies, and to events like the
"hacker crackdown" of 1990 and other incidents. Visual images are far
more powerful than words, and a single stereotypical picture, as the
one you describe in your post, can do more to demonize and stigmatize
a group than a hundred cogent and thoughtful articles. We, and as I'm
sure you know by now, and others hope you can avoid a picture that
contributes to dangerous misconceptions of our culture.  For some of
us, the inaccurate stereotyping that you suggest in the proposed cover
would be similar to doing a story on the African-American civil rights
struggle and then soliciting the meanest looking "gangsta rap" fans
and requesting that they bring Uzis and watermelon. Or, to run a story
on Japanese business executives covered by a picture of old World War
II U.S. propaganda stereotypes. Such negatively inaccurate images
reinforce, rather than reduce, cultural barriers.  Wouldn't a montage
that depicts a broader and more accurate insight be both better art
and more incisive journalism?


Cordially,

Jim Thomas
Editor, Cu Digest

------------------------------

Date: 13 Feb 94 19:18:17 CST
From: CuD moderators <[e-mail]>
Subject: File 2--FAQs about Clipper (From CPSR)

          The Clipper Chip: Frequently Asked Questions (FAQ)
                       (From CPSR Alert, #3.03)

WHAT IS THE CLIPPER CHIP?

        It is a cryptographic device purportedly intended to protect private
communications while at the same time permitting government agents to
obtain the "keys" upon presentation of what has been vaguely
characterized as "legal authorization."  The "keys" would be held by
two government "escrow agents" and would enable the government to
access the encrypted private communication.  While Clipper would be
used to encrypt voice transmissions, a similar device known as
Capstone would be used to encrypt data.

WHO DEVELOPED THE UNDERLYING TECHNOLOGY?

        The cryptographic algorithm, known as Skipjack, was developed by the
National Security Agency (NSA), a super-secret military intelligence
agency responsible for intercepting foreign government communications
and breaking the codes that protect such transmissions.  In 1987,
Congress passed the Computer Security Act, a law intended to limit
NSA's role in developing standards for the civilian communications
system.  In spite of that legislation, the agency has played a leading
role in the Clipper initiative and other civilian security proposals.
NSA has classified the Skipjack algorithm on national security
grounds, thus precluding independent evaluation of the system's
strength.  CPSR has filed suit under the Freedom of Information Act
seeking the disclosure of the secret algorithm and other information
concerning the Clipper plan.

WHAT IS THE GOVERNMENT'S RATIONALE FOR CLIPPER?

        The key-escrow system was developed at the urging of the FBI and
other law enforcement agencies, which claim that the increasing
availability of strong encryption programs will interfere with their
ability to conduct wiretapping.  No evidence in support of these
claims has been released -- in fact, FBI documents obtained through
litigation by CPSR indicate that no such difficulties have been
reported by FBI field offices or other federal law enforcement
agencies.

How important is wiretapping to law enforcement agencies?

        Electronic surveillance is just one of many investigative techniques
available to law enforcement.  In fact, it is not a widely used
technique -- in 1992, fewer than 900 wiretap warrants were issued to
state and federal law enforcement agencies.  It is to protect the
viability of that small number of wiretaps from an unsubstantiated
risk that the FBI and NSA have proposed to compromise the security of
billions of electronic transactions.

WHAT IS THE CURRENT STATUS OF THE CLIPPER PLAN?

        On February 4, the Administration announced the formal adoption of
the "Escrowed Encryption Standard," which is the technical
specification for the Clipper system.  This action means that Clipper
will become the encryption standard within the government -- all
cryptographic products for government use must comply with the
standard (i.e., contain the key-escrow mechanism) and all individuals
and businesses wishing to transmit secure communications to government
agencies will eventually be obliged to use the NSA-developed
technology.

WILL THE CLIPPER STANDARD BECOME MANDATORY?

        The Administration maintains that Clipper will be a "voluntary"
standard outside of the government, but many industry observers
question the reality of this claim.  The government exerts enormous
pressure in the marketplace, and it is unlikely that alternative means
of encryption will remain viable.  Further, the possibility of Clipper
becoming mandatory at some time in the future is quite real given the
underlying rationale for the system.  If criminals do, indeed, intend
to use encryption to evade electronic surveillance, they are unlikely
to voluntarily use the Clipper technology.

WHAT CAN I DO TO OPPOSE CLIPPER?

        Sign the electronic petition against the Clipper plan that is being
organized by CPSR.  Stay informed of relevant developments by reading
the CPSR Alert and other periodic announcements.  And consider lending
your financial support to CPSR's campaign to protect the privacy of
electronic communications.

------------------------------

Date: Tue, 15 Feb 1994 12:31:32 EST
From: David Sobel <[e-mail]>
Subject: File 3--Response to Gore's Key Escrow Comments

Re:Vice President Gore Questions Current Key Escrow Policy!

Stanton McCandlish writes:

>National Information Infrastructure Advisory Committee met today in
>Washington at the Old Executive Office Building.  In comments made
>after a question and answer period,  Vice President Al Gore said that
>key escrow policy announced last Friday (2/4/94) had serious flaws and
>that he hope the issue of who holds the keys and under what terms
>would be given more serious, careful consideration.
>
>Gore made it clear that some amount of control of cryptography
>technology was necessary for national security.  However, the key
>escrow policies announced by the Departments of Justice, Commerce &
>State, and the NSA, were "low level decisions" that got out before
>thorough analysis.

"Low level decisions"?  Announced "before thorough analysis"?  For
those of you who haven't been following this saga closely, a bit of
background.  The White House announced the Clipper initiative on April
16 of last year.  At that time, the President "directed government
agencies to develop a comprehensive policy on encryption."  The
results of that policy process, including the identities of the escrow
agents, were announced at a briefing on February 4.  The Vice
President's aide, Mike Nelson, participated in the announcement and
the following statement from the Vice President was released:

      Today's announcements on encryption represent important steps
      in the implementation of the Administration's policy on this
      critical issue. Our policy is designed to provide better
      encryption to individuals and businesses while ensuring that
      the needs of law enforcement and national security are met.

      Encryption is a law and order issue since it can be used by
      criminals to thwart wiretaps and avoid detection and
      prosecution. It also has huge strategic value. Encryption
      technology and cryptoanalysis turned the tide in the Pacific
      and elsewhere during World War II.

The likely identities of the escrow agents -- NIST and the Treasury
Department -- have been known for months.  On September 27, CPSR
submitted comments to NIST on the Clipper proposal and noted that

     In a recent briefing for Congressional staffers ... Justice
     Department representatives indicated that NIST and a "non-law
     enforcement" component of the Treasury Department will be
     designated as the escrow agents.

If the Vice President was unaware of the proposed identities of the
escrow agents, he may be as "out of the loop" as a recent predecessor.
I suspect he's been well-briefed on these issues.

I have to disagree with Stanton's statement that the Vice President's
remarks "suggest that the key escrow policies to date do not have full
support of the White House."  I think they suggest that the
Administration is attempting to look "reasonable" and "open-minded"
when, in fact, they have already bought into the FBI/NSA mindset on
encryption.  As far as I'm concerned, the identity of the escrow
agents is a non-issue.  Debating that question is like death penalty
opponents debating the relative merits of lethal injections and
electrocution.  For those of us opposed to key escrow *in principle*,
it makes no difference who holds the keys.  The decision to embrace
key escrow must be reversed.

CPSR is organizing an Internet petition drive to oppose the Clipper
proposal.  We will deliver the signed petition to the White House.  In
little more than a week, he petition has already generated more than
10,000 responses.  Say "No" to key escrow!

To sign on to the petition, send e-mail to:

     [e-mail]

with the message "I oppose Clipper" (no quotes)

------------------------------

Date: Wed, 16 Feb 1994 10:24:49 EST
From: Dave Banisar <[e-mail]>
Subject: File 4--Big Brother Inside Logo

BIG BROTHER INSIDE LOGO
A parody of the Intel's Logo modified for the Clipper Chip is now available
for use for stickers, posters, brochures etc.

The Big Brother Inside graphic files are now available at the CPSR
Internet Archive - ftp/gopher cpsr.org /cpsr/privacy/crypto/clipper

big_brother_inside_sticker.ps (postscript-scale to fit your project)
big_brother_inside_logo.gif (Color GIF - good startup/background screen)
big_brother_inside_picts_info.txt (Info on the files)

The files have also been uploaded to America Online in the Mac Telecom and
Graphic Arts folders.

big_brother_inside_sticker.ps is a generic postscript file, created in
CorelDraw. The postscript image lies landscape on the page, and consists
of the intel-logo's ``swoosh'' and crayon-like lettering on the inside.

This design was originally created for the sticker project: the image was
screened onto transparent stickers 1" square for the purpose of applying
them to future clipper-chip products. ([e-mail] was in charge
of that project; as far as I know he's still distributing them for a small
donation to cover printing & mailing costs).

The design was created by Matt Thomlinson <[e-mail]>

------------------------------

Date: Fri, 11 Feb 1994 14:21:35 -0600
From: CuD Moderators <[e-mail]>
Subject: File 5--Rep. Cantwell's Remarks on HR 3627 (From EFF ftp archives)

Following are Representative Maria Cantwell's remarks to the House of
Representatives when she introduced H.R. 3627, Legislation to Amend the
Export Administration Act of 1979.  Her synopsis of the bill appears at the
end.  These remarks appeared in the Congressional Record on November 24,
1993, at Volume 139, Page 3110.

Please write to Rep. Cantwell today at [e-mail] letting her know
you support her bill. In the Subject header of your message, type "I
support HR 3627." In the body of your message, express your reasons for
supporting the bill. EFF will deliver printouts of all letters to Rep.
Cantwell. With a strong showing of support from the Net community, Rep.
Cantwell can tell her colleagues on Capitol Hill that encryption is not
only an industry concern, but also a grassroots issue. *Again: remember to
put "I support HR 3627" in your Subject header.*

The text of the Cantwell bill can be found with the any of the following
URLs (Universal Resource Locaters):

ftp://ftp.eff.org/pub/EFF/Policy/Legislation/cantwell.bill
http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill
gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill

As of Feb. 9, 1994, co-sponsors of this bill were: Wyden (OR), Orton (UT),
Manzulo (IL), Edwards (CA).  Contact [e-mail] to find out if the
list is growing.

**********************************************************************

        Mr. Speaker, I am today introducing legislation to amend the Export
Administration Act of 1979 to liberalize export controls on software with
encryption capabilities.

        A vital American industry is directly threatened by unilateral U.S.
Government export controls which prevent our companies from meeting
worldwide user demand for software that includes encryption capabilities to
protect computer data against unauthorized disclosure, theft, or
alteration.

        The legislation I am introducing today is needed to ensure that
American companies do not lose critical international markets to foreign
competitors that operate without significant export restrictions. Without
this legislation, American software companies, some of America's star
economic performers, have estimated they stand to lose between $6 and $9
billion in revenue each year. American hardware companies are already
losing hundreds of millions of dollars in lost computer system sales
because increasingly sales are dependent on the ability of a U.S. firm to
offer encryption as a feature of an integrated customer solution involving
hardware, software, and services.

        The United States' export control system is broken. It was designed
as a tool of the cold-war, to help fight against enemies that no longer
exist. The myriad of Federal agencies responsible for controlling the flow
of exports from our country must have a new charter, recognizing today's
realities.

        Next year, the House Foreign Affairs Subcommittee of Economic
Policy, Trade and the Environment, of which I am a member, will be marking
up legislation to overhaul the Export Administration Act. It is my hope
that the legislation I introduce today will be included in the final Export
Administration Act rewrite.

        This legislation takes some important steps to resolve a serious
problem facing some of our most dynamic industries. It would give the
Secretary of Commerce exclusive authority over dual use information
security programs and products, eliminates the requirement for export
licenses for generally available software with encryption capabilities, and
requires the Secretary to grant such validated licenses for exports of
other software with encryption capabilities to any country to which we
already approve exports for foreign financial institutions.

        The importance of this legislation cannot be overstated. America's
computer software and hardware companies, including such well-known
companies as Apple, DEC, Hewlett-Packard, IBM, Lotus, Microsoft, Novell,
and WordPerfect, have been among the country's most internationally
competitive firms earning more than one-half of their revenues from
exports.

        The success of American software and hardware companies overseas is
particularly dramatic and the importance of foreign markets is growing.
Currently, American software companies hold a 75 percent worldwide market
share and many derive over 50 percent of their revenues from foreign sales.
American computer hardware manufacturers earn more than 60 percent of their
revenues from exports.

        As my colleagues are well-aware, we are participants in a new
information age that is quickly transforming local and national
marketplaces and creating new international marketplaces where none
previously existed. President Clinton and Vice President Gore have both
spent considerable time explaining their vision of the National Information
Infrastructure that is essential to our continued economic growth.

        Part of that infrastructure is already in place. International
business transactions that just a few years ago took days or weeks or
months to complete can now be accomplished in minutes.

        Driving this marketplace transformation is the personal computer.
And, at the heart of every personal computer is computer software. Even the
most computer illiterate of us recognize that during the past decade,
computer prices have dropped dramatically while computer capabilities have
increased exponentially. That combination has made it possible to exchange
information and conduct business at a scale that was considered science
fiction only a few years ago.

        Indeed, we all now rely on computer networks to conduct business
and exchange information. Whether it be the electronic mail or "e-mail"
system that we all now use in our congressional offices or the automated
teller system relied on to conduct our personal financial affairs, we rely
on computer networks of information.

        In the future, individuals will use information technologies to
conduct virtually any of the routine transactions that they do today in
person, over the telephone, and through paper files. From personal
computers at home, in schools, and in public libraries, they will access
books, magazine articles, videos, and multimedia resources on any topic
they want. People will use computer networks to locate and access
information about virtually any subject imaginable, such as background on
the candidates in local political races, information on job opportunities
in distant cities, the weather in the city or country they will be visiting
on their vacation, and the highlights of specific sports events.

        Consumers will use their computers and smart televisions to shop
and pay for everything from clothing and household goods to airline
tickets, insurance, and all types of on-line services. Electronic records
of the items they purchase and their credit histories will be easy to
compile and maintain.

        Individuals will access home health programs from their personal
computers for instant advice on medical questions, including mental health
problems, information about the symptoms of AIDS, and a variety of personal
concerns that they would not want other family members, or their neighbors
and employers to know about. They will renew their prescriptions and obtain
copies of their lab results electronically.

        The U.S. economy is becoming increasingly reliant on this
information network. While we may not often think about these networks,
they now affect every facet of our professional, business, and personal
lives. They are present when we make an airline reservation; when we use a
credit card to make a purchase; or when we visit a doctor who relies on a
computer network to store our medical information or to assist in making a
diagnosis. These networks contain information concerning every facet of our
lives.

        For businesses, the reliance on information security is even
greater. While businesses rely on the same commercial use networks that
individual consumers use, in addition, businesses are now transmitting
information across national and international borders with the same ease
that the information was once transmitted between floors of the same office
building.

        While all of this information exchange brings with it increased
efficiencies and lower operating costs, it has also brought with it the
need to protect the information from improper use and tampering.

Information security is quickly becoming a top priority for businesses that
rely on computer networks to conduct business. According to a recent survey
of Fortune 500 companies conducted for the Business Software Alliance, 90
percent of the participants said that information security was important to
their operations. Indeed, almost half of the Fortune 500 companies surveyed
recently stated that data encryption was important to protect their
information. One third of those companies said they look for encryption
capabilities when buying software.

        The challenge for information security can be met by America's
computer companies. American companies are deeply involved in efforts to
ensure that the information transmitted on computer networks is secure.
Numerous companies have developed and are developing software products with
encryption capabilities that can ensure that transmitted information is
received only by the intended user and that it is received in an unaltered
form. Those encryption capabilities are based on mathematical formulas or
logarithms of such a size that makes it almost impossible to corrupt data
sources or intercept information being transmitted.

        I wish I could stand here today and tell my colleagues that U.S.
export control laws were working and encryption technology was only
available to American software companies.

        However, this is not the case. Sophisticated encryption technology
has been available as a published public standard for over a decade and
many private sources, both domestic and foreign, have developed encryption
technology that they are marketing to customers today. It is an industry
where commercial competition is fierce and success will go to the swift.

        Software is being developed and manufactured with encryption
capabilities for the simple reason that software customers are demanding
it. Computer users recognize the vulnerability of our information systems
to corruption and improper use and are insisting on protection. That
protection will be purchased or obtained from American companies or from
foreign software companies. The choice is not whether the protection will
be obtained, but from which company.

        Incredible as it may seem to most of my colleagues, the Executive
Branch has seen fit to regulate exports of American computer software with
encryption capabilities -- that is, the same software that is available
across the counter at your local Egghead or Computerland software store --
as munitions and thereby substantially prohibit its export to foreign
customers. This policy, which has all the practical effect of shutting the
barn door after the horses have left in preventing access to software with
encryption capabilities, does have the actual detrimental effect of
seriously endangering sales of both generally available American software
and American computer systems.

        This is because increasingly sales are dependent on the ability of
a U.S. firm to offer encryption as a feature of an integrated customer
solution involving hardware, software and services.

        Indeed, software can be exported abroad by the simplest measures
and our intelligence gathering agencies have no hope of ever preventing it.
Unlike most munitions that are on the prohibited export list, generally
available software with encryption capabilities can be purchased without
any record by anyone from thousands of commercial retail outlets, or
ordered from hundreds of commercial mail order houses, or obtained for free
from computer bulletin boards or networks. Once obtained, it can be
exported on a single indistinguishable floppy disk in the coat pocket of
any traveler or in any business envelope mailed abroad.

        Moreover, both generally available and customized software can be
exported without anyone ever actually leaving the United States. All that
is necessary are two computers with modems, one located in the United
States and one located abroad. A simple international phone call and a few
minutes is all that it takes to export any software program.

        Once a software program with encryption capabilities is in a
foreign country, any computer can act as a duplicating machine, producing
as many perfect copies of the software as needed. The end result is that
the software is widely available to foreign users.

        All this was demonstrated at a hearing held on October 12 by
Chairman Gejdenson's Economic Policy Trade and Environment Subcommittee of
the Foreign Affairs Committee.

        Furthermore, while current Executive Branch policy regulates the
export of American manufactured software with encryption capabilities, it
is obviously powerless to prevent the development and manufacture of such
software by foreign competitors. Not surprisingly, that is exactly what is
happening. We heard testimony at the subcommittee's hearing that over 200
foreign hardware, software and combination products for text, file, and
data encryption are available from 20 foreign countries. As a result,
foreign customers, that have, in the past, spent their software dollars on
American-made software, are now being forced, by American policy, to buy
foreign software -- and in some cases, entire foreign computer systems. The
real impact of these policies is that customers and revenue are being lost
with little hope of regaining them, once lost. All precipitated by a
well-intentioned, but completely misguided and inappropriate policy.

        There were efforts, in the last Congress to correct this policy. In
response, the Bush Administration did, in fact, marginally improve its
export licensing process with regard to mass market software with limited
encryption capabilities. However, those changes are simply insufficient to
eliminate the damage being done to American software companies.

        My legislation is strongly supported by the Business Software
Alliance. The Business Software Alliance represents the leading American
software businesses, including Aldus, Apple Computer, Autodesk, Borland
International, Computer Associates, GO Corp., Lotus Development, Microsoft,
Novell, and WordPerfect. In addition, Adobe Systems, Central Point, Santa
Cruz Operation, and Symantec are members of BSA's European operation.
Together, BSA members represent 70 percent of PC software sales.

        The legislation is also supported by the Industry Coalition on
Technology Transfer, an umbrella group representing 10 industry groups
including the Aerospace Industries Association, American Electronic
Association, Electronics Industry Association, and Computer and Business
Equipment Manufacturing Association.

        All these companies are at the forefront of the software
revolution. Their software, developed for commercial markets, is available
throughout the world and is at the core of the information revolution. They
represent the finest of America's future in the international marketplace,
and the industry has repeatedly been recognized as crucial to America's
technological leadership in the 21st century.

        My legislation is straightforward. It would allow American
companies to sell the commercial software they develop in the United States
to their overseas customers including our European allies -- something that
is very difficult if not impossible under present policies.

        I urge my colleagues to support this legislation and ask unanimous
consent that the text of the bill and a section-by-section explanation be
printed at this point.

************************************************************************

Section-By-Section Analysis of Report Control Liberalization for
Information Security Programs and Products

Section 1

        Section 1 amends the Export Administration Act by adding a new
subsection that specifically addresses exports of computer hardware,
software and technology for information security including encryption. The
new subsection has three basic provisions.

        First, it gives the Secretary of Commerce exclusive authority over
the export of such programs and products except those which are
specifically designed for military use, including command, control and
intelligence applications or for deciphering encrypted information.

        Second, the government is generally prohibited from requiring a
validated export license for the export of generally available software
(e.g., mass market commercial or public domain software) or computer
hardware simply because it incorporates such software.

        Importantly, however, the Secretary will be able to continue
controls on countries of terrorists concern (like Libya, Syria, and Iran)
or other embargoed countries (like Cuba and North Korea) pursuant to the
Trading With The Enemy Act or the International Emergency Economic Powers
Act (except for instances where IEEPA is employed to extend EAA-based
controls when the EAA is not in force).

        Third, the Secretary is required to grant validated licenses for
exports of software to commercial users in any country to which exports of
such software has been approved for use by foreign financial institutions.
Importantly, the Secretary is not required to grant such export approvals
if there is substantial evidence that the software will be diverted or
modified for military or terrorists' end-use or re-exported without
requisite U.S. authorization.

Section 2

        Section 2 provides definitions necessary for the proper
implementation of the substantive provisions. For example, generally
available software is offered for sale or licensed to the public without
restriction and available through standard commercial channels of
distribution, is sold as is without further customization, and is designed
so as to be installed by the purchaser without additional assistance from
the publisher. Computer hardware and computing devices are also defined.

------------------------------

Date: Sat, 12 Feb 94 18:00:11 PST
From: [e-mail]
Subject: File 6--Amateur Action BBS and Clipper

[There has been a *lot* of traffic on the Clipper debate recently
about how key escrow would work in practice.  This was written in
reply to an entire issue of comp.risks]

    If I may boil down one side of the Clipper/Capstone debate, it is
certain members of the government saying:

    "We need to implement this encryption method so as to avoid
problems we think may be coming.  Trust us!  We promise not to abuse
your privacy."  [except for the following--expandable--list of
reasons.]

    Unlike some in this debate, I do not doubt the sincerity of
Dorothy Denning or others like her.  And I would have a lot fewer
problems with Clipper/Capstone proposal if the people who will be
granting access to the keys and those with legal access to the keys
were of Dorothy's caliber.

    However, people of good will are not likely to be the ones who
apply for these keys to your privacy in the future.  I am right in the
middle of a case which has remarkable similarities to a Clipper
"request for keys."

    Full details have been posted to comp.eff.talk and misc.legal, but
in brief summery, a Postal Inspector from Tennessee is attempting (for
political reasons) to impose the obscenity standards of that region on
an adult BBS run from Milpitas (just North of San Jose).  To this end,
he obtained a warrant to take the BBS hardware.  Because of contained
email and First Amendment activities of a BBS, subpoenas, not
warrants, are required under two sections of federal law.  The laws
are Title 42, Section 2000aa, and Title 18 Section 2701, the same ones
which were applied in the well-known Steve Jackson Games case.

    Pointers to these federal laws were *posted* on the BBS.  The
postal inspector downloaded this file (most of which *I* originally
wrote), and *included* it in his affidavit for a search warrant to a
Magistrate-Judge in San Francisco, along with a remarkably weak theory
of how he could avoid application of these laws to himself.

    To obtain a warrant to take email and 2000aa materials, a number
of judicial findings should have been made.  None were.  The postal
inspector got his warrant, mailed child pornography to the BBS, served
the warrant, and "found" the child porn.  To give you an idea of the
good will (and competence) of the particular agent involved, he had
not included the child porn in the warrant, and so had to fill out
another document at the time of the search.  On this form he
specifically described the material as "sent without his knowledge"
(referring to the sysop).  Of course this statement did not prevent
this child pornography (in the sysop's house for all of half an hour)
from being the basis of one count (of 12) of a grand jury indictment
the BBS sysop faces in Tennessee.

    This warrant example applies to the Clipper situation.

    The risk under Clipper is that your private communications will be
protected by the *weakest* link in the chain--one of the thousands of
low level Magistrate-Judges among whom law enforcement agents shop for
warrants and will shop for keys.  These judges tend to be busy, or
lazy or both, and they *trust* law enforcement agents.  Even if the
law is *directly quoted* in search warrant affidavits or key requests,
and these laws *expressly forbid* granting warrants or key requests
under the conditions cited, the judge may not even read a lengthy
supporting affidavit before approving it.  He is *very* unlikely to
consider the underlying laws when granting a request.  The key escrow
agents provide no protection whatsoever since they simply fill orders
from agents with approved applications.

    Judges ignore the law with impunity, and so do law enforcement
agents because one agency will almost never investigate another.

    As a practical matter, applications for search warrants are almost
never denied.  The same situation is certain to occur for Clipper key
applications, no mater how weak the justification happens to be, or
what laws are being violated by those seeking the keys.

------------------------------

Date: 13 Feb 94 04:34:13 GMT
From: [e-mail](David Batterson)
Subject: File 7--Wireless Messaging

               RAM Mobile Data Out To Win Wireless Race
                          by David Batterson

     RAM Mobile Data is gearing up to take on the cellular phone
Goliaths over the coming $billions in revenue from wireless messaging.
Its biggest competitor is probably McCaw (itself now in the process of
being taken over by AT&T.)

     The cellular companies are pushing CDPD (Cellular Digital Packet
Data), the digital packet-switched technology to be laid on top of the
existing analog cellular phone infrastructure.  RAM claims advantages
over CDPD, including free nationwide roaming, cheaper rates, fewer
packet retransmissions due to errors, and better data security.

     Although the CDPD specification allows for 19.2K-bps speed, vs.
8K-bps for RAM, both deliver an e-mail message in about the same time
(two to five seconds per packet).  RAM claims that's due to CDPD
granting voice messages priority over data, so "channel hopping" is
required for all message transfers.

     RAM offers a flat monthly rate that's cheaper than nationwide
alphanumeric paging: $25 for up to 100KB of messages.  "A leading
nationwide paging service charges $100 per month for sending only 2000
characters," said Martin S. Levetin, a senior vice president at RAM.
"The affordable low-end pricing will encourage individuals to try
wireless mail," Levetin added.

     RAM charges $75 a month for up to 400KB of messages, with
additional messages at $.20 per KB.  A "power user" plan offers
unlimited messaging for $135 a month.

     The major LAN e-mail programs--Lotus cc:Mail, Microsoft Mail,
WordPerfect Office, DaVinci EMAIL and CE Software--now support the RAM
wireless system.  "These top LAN-based products, as well as AT&T Mail
and RadioMail, give today's mobile professionals a range of
connectivity choices," Levetin said.

     RAM claims it now services more than 6,300 cities and towns, or
"over 90 percent of the U.S. urban population."  Their current
capacity can reportedly serve some one million users.  Due to its
modular design, the RAM net can expand easily to allow for rapid
growth.

     Two radio modems now make use of RAM: the Intel Wireless Modem
and the Mobidem AT wireless modem from Ericsson GE Mobile
Communications.  The RAM network uses the MOBITEX architecture, an
open, international standard for two-way wireless data communications,
originally developed by L.M. Ericsson in Sweden.

     RAM's hierarchical network consists of subscriber units, base
stations, local switches and long distance provider switches.  Like
CDPD, the RAM net uses TCP/IP (Transmission Control Protocol/Internet
Protocol).  It also works with the X.25 protocol (now used by
retailers for credit card processing), and SNA.

     RAM Mobile Data USA Limited Partnership is a joint venture of
BellSouth and RAM Broadcasting Corp.  BellSouth owns 49 percent of the
company.
                                   #

------------------------------

End of Computer Underground Digest #6.02
************************************