Subject: RE: [Raven] IP: China spies on its own people

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 11:30:26 +0100

On 31 Jan 00, at 21:00, Ed Stone wrote:

> 
> If they are criminals, arrest them. No need to bug folks who are already 
> arrestable and convictable. Just arrest them if they are committing crimes.
> 

Typical? Total ignorance of organized crime and thus the 
underlying problem of this list?

+++chefren

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: [email-masked]
Date: Tue, 1 Feb 2000 11:42:12 -0000

> Typical? Total ignorance of organized crime and thus the underlying
problem of this list?

not really.

"I talked with ... a human rights worker ... who documents atrocities from
death squads. His documents are interviews with witnesses. If government
troops were to capture these documents, they would find his witnesses and
kill them. So he encrypts them ..."

 - Phil Zimmerman, USENIX Summer '94

'organised crime' is not limited to secret networks and shady italians in
1920's suits.

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 13:11:47 +0100

> 'organised crime' is not limited to secret networks and shady italians in

In this case regulated encryption probably means:

They can get a licence!

+++chefren

---

From: Johnny Eriksson <[email-masked]>
Date: Tue, 1 Feb 2000 13:28:21 +0100 (MET)

> In this case regulated encryption probably means:

I have to admit that this is one of the funniest messages so far.

A human rights worker, on unfriendly turf, that wants to keep secrets from
this or that government, actually applying for a *licence* to use encryption
from that same government, ...  Why not throw in the concept of key escrow at
the same time?

Are you really that, eh, shortsighted or did you take lessons?

> +++chefren

--Johnny

---

From: Ed Stone <[email-masked]>
Date: Tue, 01 Feb 2000 08:42:13 -0500

>underlying problem of this list?

Do you have a lot of experience with organized crime in Holland? I note 
that your incarceration rate is around 1/10th of that in the US. Shouldn't 
you lock up more people to deal with your rampant crime problem? You are 
not letting crime find a hiding place, are you?   ;-)

If you'd rather tap persons who can be, without tapping, proved guilty of a 
crime (i.e., they are "criminals" as you referred to them), then what you 
are interested in is wiretapping, not crime control.

And the "underlying problem of this list" is not organized crime, rather it 
is privacy.

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Ed Stone <[email-masked]>
Date: Tue, 01 Feb 2000 09:04:35 -0500

>underlying problem of this list?

"Anybody using encryption technology, which protects electronic 
communcation from eavesdropping, should have delivered by hand a 
registration form to a tiny government office in a Beijing alleyway by 
Monday afternoon.

All of China's estimated nine million Internet users were supposed to have 
turned up in person to comply -- if the letter of the new law had been 
followed. "

Those who didn't turn up in person are criminals, right chefren? If not, 
why not? The Chinese govt is doing this to combat the rampant organized 
crime problem, right chefren?   ;-)

see 
http://www.cnn.com/2000/TECH/computing/01/31/china.encryption.reut/index.html

---

From: "Ge' Weijers" <[email-masked]>
Date: Tue, 1 Feb 2000 08:41:11 -0700

On Tue, Feb 01, 2000 at 01:32:12AM +0100, chefren wrote:
> If YOU were with law enforcement and the criminals were 
> using encryption, wouldn't you ask for laws that allow you 
> to place bugs in their keyboards?

I would just bug the places where they operate, assuming they have
given LE a good cause to be suspicious. That's an expensive operation.
What we're talking about here is making it _easy_ for LE to snoop on
people by accommodating electronic surveilance in protocols, which
makes it economically feasible to monitor lots and lots of people. I'm
sure 'proper' cause can be manufactured by lazy police, and a judge
can be found to authorize it so it's all legal and proper. If there's
a warrant it must be OK then.

If _I_ was a LE officer I would still recognize that I have to work
within certain limitations, and that LE risks being perceived as the
enemy if it does not respect civil liberties. In the OJ Simpson case
we saw a jury that could not trust the police because of the history
of racial prejudice in the Los Angeles Police Dept. Recent news shows
that this is not as farfetched as it may seem, 99 cases are reported
to have been tainted by fabricated evidence.

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220

---

From: Matthew Saroff <[email-masked]>
Date: Tue, 01 Feb 2000 10:37:27 -0600

> to have been tainted by fabricated evidence.
	The crisis is spreading, and is now not limited to Rampart division.
 Estimates range to more than as TEN THOUSAND cases.  The 99 are just those
most compelling cases currently under review.

-- 
Matthew Saroff
Do not reply directly to this message.  Reply to
[email-masked]

---

From: Declan McCullagh <[email-masked]>
Date: Tue, 01 Feb 2000 08:50:27 -0500

The LA public defenders office (do a web search) has all the relevant info 
on their web site. Last I checked in the fall, tens of thousands of 
conversations were illegally monitored; 99 cases underrepresents the 
breadth of police lawlessness.

-Declan

---

From: Christian Price <[email-masked]>
Date: Tue, 01 Feb 2000 10:41:22 -0700

for tapping of encrypted data at the backbone to be effective, one would
have to outlaw products which provide end-to-end encryption.  since
criminals by nature ignore laws, what will prevent them from ignoring
the law banning end-to-end encryption?  my guess is that this will only
put the law abiding citizens at a disadvantage, while the criminals use
as much encryption as they want, and the key recovery systems and taps
at the backbone will be no use.

another point, has anyone here read Ron Rivest's paper:
"Chaffing and Winnowing: Confidentiality without Encryption"
http://theory.lcs.mit.edu/~rivest/chaffing.txt  ??

I think it makes the whole issue of staving off strong encryption moot. 
Creative people will always find new alternatives that the law does not
address. 

chefren wrote:
> 
> Hm... As argued in another thread and before: The stronger
> the encryption the stronger encountering laws for law
> enforcement.
> 
> Inevitable and pretty dumb weapon race.
> 
> +++chefren
> 

-- 
--------.--------------------------------------.
 ------/     Christian Price                   /
  ----/     Assistant Technical Analyst       /
  ---/     Four Corners Area ITOT/OSA        /
  --/     SprintParanet, Phoenix Office     /
  -/     602-266-9242                      /
   '--------------------------------------'

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 19:46:30 +0100

> Are you really that, eh, shortsighted or did you take lessons?

Studied somewhat more on the problems than others?

I recognize most ideas here from quite some time ago.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 19:44:38 +0100

On 1 Feb 00, at 8:50, Declan McCullagh wrote:

> Date sent:      	Tue, 01 Feb 2000 08:50:27 -0500
> To:             	[email-masked], [email-masked]
> From:           	Declan McCullagh <[email-masked]>
> Subject:        	Re: [Raven] IP: China spies on its own people
> 

I understand most of you out there hate it but there is 
only ONE way to get rid of this: Better procedures.

Technically speaking: Better standards.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 19:51:51 +0100

> not letting crime find a hiding place, are you?   ;-)

As said here, the Netherlands has the most -official- taps 
in the world. The taps are mostly used for organized crime 
and some for murder.

> are interested in is wiretapping, not crime control.

Pretty impossible, with tapping it's possible to get a view 
on the organization. Hierarchy, spread, and all kind of 
details.
 
> And the "underlying problem of this list" is not organized crime, rather it 

That's what the people who are little interested in society 
think?

In serious countries tapping has definitely arrived in laws 
because of crime not because it breaks privacy.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 19:55:12 +0100

On 1 Feb 00, at 8:41, Ge' Weijers wrote:

> I would just bug the places where they operate,

How do you know without being able to follow the 
communication?

(We live in a world were someone in Australia can keep a 
drug gang going on in Amsterdam without physical contact.)

> assuming they have given LE a good cause to be
> suspicious. That's an expensive operation. 

Yes, too expensive in practice.

> a warrant it must be OK then.

And the authentication part must give lawyers a chance to 
get out of the courts again so it's useless.

..

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Tue, 01 Feb 2000 14:34:10 -0500

>Technically speaking: Better standards.

You mean that when Illinois turns free 13 death row convicts after finding 
out they were not guilty, during a time in which 12 were actually executed, 
the cure is to make a better electric chair?

---

From: Ed Stone <[email-masked]>
Date: Tue, 01 Feb 2000 14:40:25 -0500

>because of crime not because it breaks privacy.

You state well what has been called "the creed of slaves":

"Necessity is the plea for every infringement of human freedom. It is the
argument of tyrants; it is the creed of slaves. "
William Pitt to the House of Commons, November 18, 1783

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 21:24:30 +0100

> most compelling cases currently under review.

Estimates...

I thought there were computers these days.

US definitely needs auditable taps...

+++chefren

---

From: Matthew Saroff <[email-masked]>
Date: Tue, 01 Feb 2000 15:10:09 -0600

On May 12,  0:47, chefren wrote:
> Subject: RE: [Raven] IP: China spies on its own people
	He manufactures tapping equipment.  He's bought and paid for.  It's his
livelyhood.

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 22:19:31 +0100

> the cure is to make a better electric chair?

No, the cure is better procedures to prevent them getting 
unnecessarilly in the death row.

This is were standards are needed, education standards for 
the people who study the case. If still too many not guilty 
people arrive in death row, the standards have to be 
adjusted. Also very simple standards like "after conviction 
no electric chair within xxx day's" can help.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 22:23:05 +0100

> 	He manufactures tapping equipment.  He's bought and paid for.  It's his

Even if it would be true, would it matter?

I can still be right...

+++chefren

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 22:14:38 +0100

> Creative people will always find new alternatives that the law does not

When encryption is regulated also having the programs will 
be regulated don't you think?

So if you are caught having encryption, chaffing&winnowing 
and or steganography programs without permit, your are a... 
criminal!

Not necessarily an organized one of course.

+++chefren

---

From: Christian Price <[email-masked]>
Date: Tue, 01 Feb 2000 14:52:37 -0700

> be regulated don't you think?

How will this stop the criminals from using it?  Criminals have access
to lots of illegal things _because_ they operate outside the law.

So the question is:  If the criminals still use end-to-end encryption
how will your system of taps help you track and arrest them?
 
> and or steganography programs without permit, your are a...

by definition if it is illegal.

I notice that we are using the term criminal rather loosely here.  a
criminal is someone who breaks the law, not necessarily a bad person. 
law != morality.  (!= is not equal).  when blacks in the south chose to
ride busses in the white only sections they were breaking the law to
make th epoint that the law was wrong.  they were in that sense
criminals.  yet we hold them in high moral regard.

<christian steps off his soapbox>

---

From: "chefren" <[email-masked]>
Date: Wed, 2 Feb 2000 00:55:33 +0100

> to lots of illegal things _because_ they operate outside the law.

True but that makes them detectable and punishable. The 
punishments are ajusted so everything is in balance with 
democratic will of the people.

> how will your system of taps help you track and arrest them?

I still claim encrypted files will be more or less 
detectable with very advaced virus-scan like programs. So 
if a tap is made by law enforcement the officers will get 
some grip on the data just like with telephone taps. If 
they don't get enough grip and still think something is 
wrong they can go further. Regarding "chaffing", that's 
more or less their job.

> criminals.  yet we hold them in high moral regard.

OK, and a criminal is only a criminal if convicted.

..

+++chefren

---

From: Matthew Saroff <[email-masked]>
Date: Tue, 01 Feb 2000 18:17:05 -0600

> OK, and a criminal is only a criminal if convicted.
	THEY WERE CONVICTED.  Dr. King spent months in Jail, as did Ghandi,
Mandela, etc.
	Of course, they convicted, so by your definitions, they were criminals.
	Pray that you never find the equivlanet of an all white jury.

---

From: James Carlson <[email-masked]>
Date: 02 Feb 2000 07:10:17 -0500

[email-masked] ("chefren") writes:
> detectable with very advaced virus-scan like programs.

Bunk.  Good encryption is not distinguishable from good random number
generation.

> So 

"Mr. Chefren, you're under arrest for encyphering without a license.
We've captured packets on the Internet with your IP address on in
them.  We couldn't figure out how to decode the payload, so you must
be using illegal encryption."

Yeah, this sounds like a great plan.

-- 
James Carlson, System Architect                     <[email-masked]>
IronBridge Networks / 55 Hayden Avenue   71.246W   Vox:  +1 781 372 8132
Lexington MA  02421-7996 / USA           42.423N   Fax:  +1 781 372 8090
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp

---

From: Ed Stone <[email-masked]>
Date: Wed, 02 Feb 2000 09:22:09 -0500

>Yeah, this sounds like a great plan.

"There's no way to rule innocent men. The only power any government has is 
the power to crack down on criminals. Well, when there aren't enough 
criminals, one makes them. One declares so many things to be a crime that 
it becomes impossible for men to live without breaking laws."

Ayn Rand, Atlas Shrugged, Ch. III, "White Blackmail"

---

From: "Ge' Weijers" <[email-masked]>
Date: Wed, 2 Feb 2000 08:31:01 -0700

> drug gang going on in Amsterdam without physical contact.)

But the drug gang can be found because they have to move drugs
around. There are all kinds of ways to get at this drug gang:
infiltration, informants, bugging the gang members' homes, etc.

A crime that's completely undetectable outside cyberspace is a
questionable crime at best.

> Yes, too expensive in practice.

Yes, it's much cheaper to snoop. So if someone is killed in the
Vondelpark you just tap all the phone lines in a 30 km radius?
Technology and economies of scale will make this all possible. Where
do you stop?

---

From: Christian Price <[email-masked]>
Date: Wed, 02 Feb 2000 09:13:33 -0700

> wrong they can go further. Regarding "chaffing", that's

and I would dispute that claim

given that it is possible to use encryption strong enough to not be
broken within a useful time and it is possible to disguise the
identity/location of the sender (and the reciever too if I am not
mistaken), how can LE gain any useful information from your tap?  It
seems to me that they need to be able to learn one of three things from
the tap: the content of the message, the origin of the message or the
destination of the message.  without any of these items, there is
nothing to do except report that there is a problem - exactly the
situation we have now.

---

From: "chefren" <[email-masked]>
Date: Fri, 4 Feb 2000 12:44:01 +0100

> infiltration, informants, bugging the gang members' homes, etc.

Infiltration asks too much from people. Informants are 
often very difficult to enter in an organization. (Think of 
Russian, Chinese, or Columbian gangs, very difficult to 
find someon that fits "in".)

Impossible to bug members if you don't know who are the 
members. AND it's pretty costly and difficult to bug homes.

> questionable crime at best.

I understand you don't recognize white-collar crimes?

Cartels?

And mixes of course. Organizations will tend to use as much 
encrypted communication as possible because it bears far 
less risk than seeing each other in person.

..

> Vondelpark you just tap all the phone lines in a 30 km radius?

No they tap all known people who knew the killed person. 
Often only a few hours. Very effective way to find killers.

> Technology and economies of scale will make this all
> possible. Where do you stop? 

You still don't see that tapping done the way it is done in 
The Netherlands is too costly, besides that nobody will 
give you a warrant for such outragous way of trying to find 
facts...
 =everything= tapped should be reported, the tap should be 
usable for and against the tapped person. Rules are pretty 
strict, lots of checks and balances.

+++chefren

+++chefren