From: Pubkeybreaker on
in which they were
* interested.


! FBI Director Louis J. Freeh, Senate Judiciary Committee, June 4, 1997
!
! NOT THAT LONG AGO, NO ONE PERCEIVED THAT TELEPHONE SYSTEMS COULD BECOME
! UNTAPPABLE, THE NECESSITY FOR STRONG PARTNERSHIPS BETWEEN LOCAL, STATE,
! FEDERAL AND INTERNATIONAL LAW ENFORCEMENT IS MORE URGENT.


* Electronic Privacy Information Center, http://www.epic.org
*
* "As a means of espionage, writs of assistance and general warrants
* are but puny instruments of tyranny and oppression when compared
* with wiretapping." ---Mr. Justice Brandeis, 277 U.S. 438 (6/4/1928)
*
*
* European Union and FBI launch a global surveillance system
* -------- ----- --- --- ------ - ------ ------------ ------
*
* The EU, in cooperation of the FBI of the USA, is launching a system of
* global surveillance of communications to combat "serious crime" and to
* protect "national security".
*
* But to do this they are creating a system which can monitor everyone
* and everything.
*
* At the first meeting of the new Council of Justice and Home Affairs
* Ministers in Brussels on 29-30 November 1993 they adopted the following
* Resolution on "the interception of telecommunications" which speaks for
* itself and reproduced here in full:
*
# CONFIDENTIAL MEMO
#
# "COUNCIL RESOLUTION ON THE INTERCEPTION OF TELECOMMUNICATIONS"
#
# The Council:
#
# 1) calls upon the expert group to compare the requirements of the Member
# States of the Union with those of the FBI;
#
# 2) agrees that the requirements of the Member States of the Unio


From: Risto Lankinen on
*******************************************************************************

There are plenty of alternatives to

a) sending our proprietary code over the unprotected Internet
b) disclosing our code to a third party

The answer to a) is: don't do it. Get MD/SOO permission to use a courier.

The answer to b) is:

o Isolated the bug(s) to the smallest amount necessary to reproduce
the error. According to the previous email traffic between these
two people, there were two compile-time bugs. The programmer can
be faulted for not using two orders of magnitude fewer lines for
demonstrating the error. A small fragment of code can be emailed.

o If the problem is compile-time, email the relevant C/C++
preprocessor output snippet. The comments by the programmer in the
email transfer state THE CODE DOESN'T COMPILE ANYWAY.

o Have the vendor deliver a "debug" version of their product. That
would be a good use for email. Sun Microsystems does that with a
C++ product for us, their customer. Email the results back.

o Have the vendor visit to troubleshoot.

o Requested a login via SecureID and Salomon's netblazer, supporting
28.8 PPP (TCP/IP for windowing connectivity) for the vendor. Let
them transfer in any tools they need to troubleshoot.
Short-term access.

o If it is truly necessary to transfer a large amount of code, such as
Informix working to convert a large Sybase app, then take the time
to write a shell script that (using say 'sed') scrambles the names
of environment variables, and be sure to hand-ruin any proprietary


From: Pubkeybreaker on
room
* was dimly lit, but with a bright fluorescent light coming at my
* face. They threw a picture down on the desk. It was a picture of
* me, my husband and a Palistinian friend of ours whom they had
* arrested. They slapped it and said 'Who is this man, identify
* him.' I refused and said what they were doing to me was illegal.
*
* One said, 'Honey, we ARE the law.'
*
* It was after midnight by now. They uncuffed my right hand, then
* cuffed my left hand to the metal pole. My left arm was stretched
* up to reach it.
*
* Then they left the house and left me hanging
* there like that for over three hours.
*
* They came back around 3:30 AM with a third man.
*
* I asked if I could use the bathroom.
*
* I was desperate to go.
*
* They would not let me.
*
* They told me that my husband was in custody, that they had just picked
* him up. [That was false.] They said we could work out a deal, I could
* be a witness for the prosecution of our friend.
*
* If I would do that, they would let my husband go.
*
* They also said they knew I only had $78 in my bank account, hinting
* that they could change that.
*
* A fourth man came into the house.
*
* I will never forget his eyes.
*
* He took out a small Palistinian flag and burned it.
*
* Then they took me out, back into the car. They stopped about two miles
* from my house. They said 'Listen Babe, when you least expect us, expect
* us. WE WILL ALWAYS BE AROUND.' I looked at my watch. It was 8:30 AM.
:
: Could that have happened in America? Readers will no doubt find it hard
: to believe, as I did.
:
: So did she.
:
: She was too frightened to talk at first. But now she is ready to testify,
: if her lawyers ask her to.
:
: Her friend was one of eight Palistinians arrested in Los Angelos who were
: taken at gunpoint in their home at 7 in the morning, then shackled in arm
: and leg ir


From: Gerry Myerson on
by a (MD5-like) password to
unlock access to it. That means the password can be as long
a thing as you'd like to type in, not merely a short password.
As long as you can remember it.

This is standard...MIT's Kerberos and Phil Zimmerman's PGP
use a password to unlock the cryptographic key.

So, how do you back up the key without GAK?

In other words, what do all companies do for this situation now?

A situation that applies to all company data whether or not it is encrypted.

A situation that has existed since the invention of the computer.

Simple.

You back it up.

Make backups of the key.

You can start by making your own key copy using off-site secure storage backup.

Several authorized people can have a copy of the key, and they
can each use their own password to get access to the key.

The key is backed up not only by being on several different
machines, it is also backed up in the off-line backups for
these machines. After JUST ONE WEEK, you'll have 24 total
copies of the key (3 + 3*7). After the first month: 214 copies.

The government somehow thinks you'll clamor for THEM to backup your key
by giving them a copy of the key, and if you lose all of yours...
contact the Federal Secretary of Lost Keys.

And for this great benefit, they want you to give them Key Recovery
access to your cryptographic key.

We know what Key Recovery means...

By the way, the Government is restricting *communications* products, which
use public key cryptography. BY DEFIN


From: Risto Lankinen on
to
: be its sole and exclusive territory. In fact the Europeans were not at all
: pleased with the US view points of controlling ALL crypto. Germany and
: France vigorously refused to work with the US on this issue.
:
: The Clipper initiative (at the time not readily developed) was completely
: banned, except for the Australian and UK views that felt some obligation
: from the 1947 UKUSA treaty (dealing with interchange of intelligence).
:
: With a vast majority the US was cornered completely, and had to accept
: the international views. And actually adopted those as well. EFF, EPIC and
: other US organizations were delighted to see the formal US views barred,
: but expressed their concern on the development of alternate political
: pressure that would cause the same effects.
:
: As time went by that was indeed what the US did, and up to now with minor
: success.
:
: Bertil Fortrie
: Internet Security Review
: ==


There it is yet again: "anytime, anywhere", and "UKUSA".

There is absolutely no doubt whatsoever that Netscape and other companies
--- the U.S. is a world leading producer of software technology --- are
having their products outlawed for world-wide distribution because of
ECHELON.

Ubiquitous full-strength crypto --- in all our email products and web
browsers --- would immediately begin to lessen ECHELON's ability to
spy in such a massive dragnet fashion.

There is an ugly implication to ECHELON being the reason Netscape and company
are being held hostage by the NSA.

"Only with a court authorized warrant..." --- Louis Freeh, FBI Director

Louis Freeh is lying.


******************************************************************************

Key Recovery Isn't Even Feasible
--- -------- ----- ---- --------

http://www.e