Subject: [Raven] IP: Russia spies on its own people

From: "David Oran" <[email-masked]>
Date: Mon, 17 Jan 2000 09:44:42 -0500

>Delivered-To: [email-masked]
>Delivered-To: [email-masked]
>From: "David Farber" <[email-masked]>
>To: "ip" <[email-masked]>
>Subject: IP: Russia spies on its own people
>Date: Sun, 16 Jan 2000 14:35:51 -0500
>X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
>Importance: Normal
>Sender: [email-masked]
>Reply-To: [email-masked]
>X-SMTP-HELO: admin.listbox.com
>X-SMTP-MAIL-FROM: [email-masked]
>X-SMAP-Received-From: outside
>X-SMTP-PEER-INFO: admin.listbox.com [208.210.124.36]
>
>
>St. Petersburg Times
>January 14, 2000
>Russia's Electronic Police Get Carte Blanche
>By Jen Tracy
>STAFF WRITER
>
>Under an obscure bit of legislation quietly approved by acting President
>Vladimir Putin, the nation's major law enforcement and security bodies -
>from the tax police to the Border Guards - are to be technically equipped
>to enjoy instant real-time access to e-mail and other electronic traffic.
>
>Seven law enforcement bodies named in the new law are now to join the
>Federal Security Service - the main KGB successor agency and acting
>President Putin's alma mater - in being hard-wired to Russia's Internet
>service providers.
>
>These authorities are still required by the Russian Constitution to obtain
>a court warrant before tapping phones, opening e-mails or accessing other
>private correspondence between citizens or organizations. But for all of
>them, e-mails, e-commerce transactions and other Internet traffic will be a
>mere mouse-click away - easily perused without anyone ever knowing,
>regardless of what the courts or the Constitution may say.
>
>"This means Russia has officially become a police state," Yelena Bonner,
>the human rights activist and wife of the late Soviet dissident Andrei
>Sakharov, said in a telephone interview on Wednesday from Boston, where she
>has been visiting for the past few months. "And this wartime police state
>came about unnoticed when Putin rose to power on Dec. 31."
>
>Putin signed the legislation - an amendment to the 1995 Law on Operational
>Investigations that passed the State Duma on Dec. 1 - on Jan. 5. It took
>force Jan. 6 upon publication in Rossiiskaya Gazeta, the official
>government newspaper.
>
>The original 1995 law gave the security services the right to monitor all
>sorts of correspondence, from postal deliveries to cell phone
>conversations, provided they first obtained a warrant.
>
>With the growth of the Internet, the FSB and the State Communications
>Committee have issued new regulations - based on their interpretation of
>the 1995 law - that force Internet service providers to link their
>computers to those at FSB headquarters.
>
>Internet service providers do not like to talk about the FSB's so-called
>SORM project - the acronym stands for Sistema Operativno-Rozysknykh
>Meropriyatii, or System for Operational-Investigative Activities. But many
>of them have already quietly complied.
>
>The costs to the Internet service provider of installing the equipment are
>estimated from $10,000 to $30,000, not including any future upgrades.
>That's enough to shut down some smaller providers, and some SORM-watchers
>argue that the big Internet players actually welcome SORM as it helps them
>consolidate their market share.
>
>The new amendment doesn't mention SORM by name or detail the new technical
>requirements for Internet service providers. But it does extend the FSB's
>hard-wired access to electronic traffic to seven other agencies: the tax
>police, the Interior Ministry, the Border Guards, the Customs Committee,
>the Kremlin security service, the presidential security service, the
>parliamentary security services and the Foreign Intelligence Service, or
>SVR.
>
>Internet experts interviewed on Wednesday said they expected the additional
>security organs could simply piggy-back on the FSB's SORM technology, which
>has already been installed at the expense - and expertise - of the
>providers.
>
>Human rights activists worry that the FSB - and now the seven other
>security organs - will not bother getting a court order when they can see
>private information at a whim. And if once they placed some faint hopes on
>the FSB simply not having the manpower to systematically track mass
>quantities of e-mail and other traffic, the situation has drastically
>changed now that eight security organs can in theory be working at once,
>perhaps even in cooperation.
>
>"It was bad enough that the FSB had unlimited control over confidential
>correspondence, and now it is multiplied eight times," said Boris
>Pustintsev, chairman of St. Petersburg-based Citizens' Watch rights group.
>
>"The FSB alone had some problems implementing SORM as NGOs
>[non-governmental organizations] were fighting it. Now, it will be routine
>[to get SORM set up and functioning], as you can't fight a monster with
>eight heads."
>
>The FSB says SORM will help law enforcement track and capture criminals
>ranging from tax evaders to pedophiles, because such people may conduct or
>discuss their business electronically.
>
>Human rights groups counter that the Russian security services are cannot
>be trusted with such power. They argue that agents will abuse SORM to
>assemble political dossiers and to steal and sell commercial secrets -
>something that could line the pockets of agents and organizations who have
>not fared well under post-Soviet budgets.
>
>In the nationally televised New Year's Eve address in which he acknowledged
>Boris Yeltsin's resignation and took on the duties of the presidency, Putin
>promised he would be a generous patron to Russia's security services.
>
>"The potential of the special services will not just be maintained but
>increased," Putin pledged then.
>
>The FSB and the tax police did not reply to questions faxed by The St.
>Petersburg Times.
>
>
>Esther Dyson			Always make new mistakes!
>

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Mon, 17 Jan 2000 16:55:24 +0100

On 17 Jan 00, at 9:44, David Oran wrote:

..

> >to enjoy instant real-time access to e-mail and other electronic traffic.

"Nice guy" Mr Putin, fortunately the Internet is a good 
medium to distribute this kind of knowledge about him.  

..

> >regardless of what the courts or the Constitution may say.

I still think it cannot be said enough, the only way to 
encounter misuse is putting up standards that make it 
nearly impossible to do this with one mouseclick without 
traces.

An auditable tapping standard is definitely needed.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Mon, 17 Jan 2000 22:49:08 +0100

On 17 Jan 00, at 16:06, Ed Stone wrote:

> Chefren wrote:
> And the fact that Russians know that their communications on the net have 
> no protection from the renamed KGB is sure to encourge Russian people to 
> carry out a dialog in support of democracy!   ;-)
> 
> But not to fear. Chefren has an idea about tapping that ties the hands of 
> the Russian government. The box would be sealed. If misdeeds are done, 
> someone would know. Who would know? The Russian government would know that 
> the Russian government had done wrong. THEN they'd be in big trouble!
> ..

Of course you can make fun of it and I have no problem 
laughing about it myself.

However.

Fact is taps will be there, taps will be used in courts and 
unfortunately taps can be misused.

If the IETF for example starts a simple office that suppies 
big random numbers (keys) that have to be used by all 
individual internet taps, it could form a basic part of an  
administration that, if figuered out well, is probably 
pretty hard to crack. Judges and lawyers can reject taps 
that aren't registered well and the world becomes a is a 
little more honest.

+++chefren

p.s. It will never keep Mr Putin and the likes of doing 
things we hopefully all consider to be =very= wrong. I have 
seen this guy a few weeks only and I'm so disgusted that I 
don't even wan't to know what disaster it takes to get him 
away.

---

From: Ed Stone <[email-masked]>
Date: Mon, 17 Jan 2000 18:29:18 -0500

>laughing about it myself.

That is a very positive sign that you see the silliness of suggesting that 
an "auditable tap" is any protection from a government that chooses, from 
moment to moment, from administration to administration, not to extend that 
protection from the government to its subjects.

>unfortunately taps can be misused.

Fact is anthrax will be there, anthrax will be used in laboratories, and 
unfortunately, anthrax can be misused. You have no problem with the world's 
governments having anthrax, do you? Just because some may use it to 
ethnically cleanse a few thousand square miles, shouldn't cause us to 
hesitate to provide anthrax to all governments, should it?  ;-)

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "chefren" <[email-masked]>
Date: Tue, 18 Jan 2000 01:56:05 +0100

On 17 Jan 00, at 18:29, Ed Stone wrote:

> governments having anthrax, do you?

Yes I and other citizens in this world do have problems 
with that and that's why this kind of weapons are banned.

> Just because some may use it to 

Eh Ed, can you tell us of any misuse of anthrax the last 20 
years? If the world community thinks it's a bad idea to use 
such things even the most evil idiots hesitate to use it.

If there were no free press, no camera's and no internet, 
mister Putin had used gas or antrax some months ago.

Our society needs transparancy to keep checks and balances 
in good order.

The IETF should design a wise tapping protocol with good 
checks and balances.

+++chefren

---

From: Ray Yang <[email-masked]>
Date: Mon, 17 Jan 2000 20:51:11 -0500 (EST)

> The IETF should design a wise tapping protocol with good 

	"checks and balances." Ahh, the beautiful ring of words 
claiming legitimacy by borrowing phrases. Who will check and who
will balance? Who will be checked and who will be balanced? Who
will audit and who will tap? Who will be hurt and who will gain?
	The answers that have come up here are that: those who
wish to install a police state will gain. Those with little regard
for liberty will gain. Those who wish for checks and balances and 
rights to mean whatever is convenient for them to mean will gain. 
They will check themselves when they choose to do so. The security
services of countries will decide when they want to tap, they will
audit themselves (or set up a 'separate' department to do so), and
they will tap as well. The ordinary citizen would not benefit from
an intrusive tapping protocol -- at this stage, the potential (and 
real) cons to such a proposal far outweigh the alleged benefits. 
We've been over this a few thousand times before ... 

Ray

---

From: Ed Stone <[email-masked]>
Date: Thu, 27 Jan 2000 11:42:12 -0500

Should IETF work with the Chinese government to create or modify protocols 
or standards to assist Chinese law enforcement in enforcing Chinese 
internet and encryption laws? Or should IETF collaborate only with some 
governments, but not with others? To facilitate wiretapping laws only, or 
other laws as well? For example, would the IETF create or modify protocols 
or standards to assist the Taliban insuring that women cannot access the 
internet? With which governments and laws would IETF collaborate?

"BEIJING, CHINA (NB) -- By Martin Stone, Newsbytes.
China has sent ripples of distress through the Internet community with a 
variety of new rules concerning state secrets and encryption, but is 
seeking today to reassure foreign investors that the regulaitons will not 
limit the free exchange of online information.

According to a news reports today and Wednesday, sweeping new regulations 
on encryption technology could restrict sales of everything from imported 
software to mobile phones in China.

Foreign Ministry spokesman Zhu Bangzao said, however, "This will not affect 
the pace of foreign companies entering China." Under regulations due to 
take effect on Monday, all foreign and Chinese companies or individuals 
using encryption technology to protect e-communication from eavesdropping 
must register with the government.

The registration is seen as the first step in forcing foreign companies to 
reveal their encryption secrets, and possibly the first step toward a ban 
on foreign encryption sales in China.

US Ambassador to China Joseph Prueher said the problem was of "high 
interest" to the US government and that two issues are at stake, according 
to Reuters. The first is the free flow of information, and the second is 
the apparent effort by China to force foreign companies to reveal their 
encryption methods, the report said. He added that the situations 
complicate China's efforts to join the World Trade Organization (WTO).

Foreign Web operators in China have called the new rules vague and 
complicated, and said they risk sales in China and face the threat of 
commercial espionage or competition from state-owned Chinese firms with 
potential access to foreign encryption secrets, Reuters reported.

On Wednesday, China created online angst with the introduction of rules 
that penalize Websites for "leaking state secrets," prompting speculation 
on the curbing of news content.

Under rules published in the People's Daily newspaper, Websites are 
required to undergo security checks, Reuters said, adding the regulations 
appear to give authorities control over the Internet in the name of 
protecting sensitive government information. China's definition of state 
secrets is so broad it can encompass virtually any information not 
specifically approved for publication, the report alleged.

Reuters interpreted the new edict as declaring, "All organizations and 
individuals are forbidden from releasing, discussing or transferring state 
secret information on bulletin boards, chat rooms or in Internet news 
groups." The report added that the security rules could affect so-called 
"cyber-reporters", who write news specifically for online distribution.

Reported by Newsbytes.com, http://www.newsbytes.com ."

---

From: "chefren" <[email-masked]>
Date: Thu, 27 Jan 2000 18:12:41 +0100

> internet? With which governments and laws would IETF collaborate?

The IETF should think for itself. Of course the 
organization should look to requirements in the field but 
that has nothing to do with "collaboration".

Basic question: Is tapping unavoidable requirement for 
networks?

Since untappable networks stand for places where criminal 
organization can hide, laws in a quite a few countries 
demand it.

IETF can decide what's a reasonable way to tap. Since there 
is a lot of privacy involved the needed standards should be 
designed very carefully.

+++chefren

=Signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.

Everything should countrywise be organized by
a central "tapping office". This office should
provide keys for strong encryption to both
communication provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.

---

From: Ed Stone <[email-masked]>
Date: Thu, 27 Jan 2000 12:56:26 -0500

>Basic question: Is tapping unavoidable requirement for

No, it is not an unavoidable requirement for networks. I avoid it all the 
time. Most people do.

>organization can hide, laws in a quite a few countries

So you mean that IETF must honor laws, such as those in China, and those 
that the Taliban may establish to keep women off the internet, or that 
Saudi Arabia may establish to stop communication of birth control 
information? Or just some laws from some countries? Which is it?

Chefren, I am concerned that a criminal organization can hide in your home 
or in your office. What am I to do to be sure that no criminals are hiding 
there? This is a frightful concern. Something must be done. We must not 
allow criminal organizations to hide in homes or businesses. We must look 
into this and get help from the IETF. This is so frightening!!  ;-)

>is a lot of privacy involved the needed standards should be

No, they can, and have, by consensus, learned that their assistance to 
government wiretapping is not wanted those to whom it would be applied, nor 
required by law. But nice try, anyway.

---

From: "Ge' Weijers" <[email-masked]>
Date: Thu, 27 Jan 2000 12:27:47 -0700

> is a lot of privacy involved the needed standards should be 

No technical solutions exist for this kind of political problem,
unless you envision equipment that is capable of ethical and moral
reasoning. A tap box cannot distinguish between a warrant issued by an
NL judge and one issued by a modern-day Roland Freisler. Careful
protocol design is not going to help here.

The choice is simple: we can achieve (almost) no crime by abolishing
all civil liberties and consider everyone guilty until proven
innocent, or we live with a certain level of crime as the consequence
of having certain of those liberties. This is a political choice, and
no amount of technology will 'fix' things. 

You are proposing that an _unelected_ IETF should decide where to draw
the line between legitimate tapping and excessive governement
surveilance, and develop its standards accordingly. This seems to be a
strange proposal for someone who uses the word 'democratic' a lot.

Ge'

---

From: "Lyal Collins" <[email-masked]>
Date: Fri, 28 Jan 2000 08:57:12 +1100

> Basic question: Is tapping unavoidable requirement for

It would appear so, given recent UK and US moves in this direction.
There does appear to be some difference in the definition  of "tapping".  In
some cases, it means assess to message keys, in others it seems to parallel
the Australian case of authorising B&E to systems.

We've lost control of our own systems, people.  Live with it.

Lyal

---

From: Christian Price <[email-masked]>
Date: Thu, 27 Jan 2000 15:06:27 -0700

I still live in a democratically run country and if We (the collective
we of the people of the USA) decide that we do not want to lose control
of these systems then we can put political pressure on our government to
get our way.

We most certainly do not have to live with it.

-- 
--------.--------------------------------------.
 ------/     Christian Price                   /
  ----/     Assistant Technical Analyst       /
  ---/     Four Corners Area ITOT/OSA        /
  --/     SprintParanet, Phoenix Office     /
  -/     602-266-9242                      /
   '--------------------------------------'

---

From: "chefren" <[email-masked]>
Date: Fri, 28 Jan 2000 01:31:50 +0100

> > We've lost control of our own systems, people.  Live with it.

As far as I see it the sentence should be read as:

The techies have lost control over the Internet to 
democracy, live with it.

And that's no shame! To the contrary.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Fri, 28 Jan 2000 01:43:57 +0100

..

> No, it is not an unavoidable requirement for networks. I avoid it all the 

You cannot sell communication in The Netherlands, Australia 
and more and more other countries...

As far as I see it: Most people don't care if government 
taps their communication lines.

> So you mean that IETF must honor laws,

No it should honor technical requirements in standards, the 
people who buy equipment have to honor laws.

> such as those in China, and those that the Taliban may
> establish to keep women off the internet, or that Saudi
> Arabia may establish to stop communication of birth
> control information? Or just some laws from some
> countries? Which is it? 

Just wait, in Saudi Arabia most Internetting people are 
women. As a matter of fact they start businesses and it's 
an extra push to allow them to drive cars themselves.

China has to go a long way but if you would have shown a 
film of today's china to the leaders 7-10 year ago they 
would have killed you.

Taliban have shown more basic respects too lately.

We should just keep communicating.

But this has little to do with tappability. Tappability is 
about misuse of communication.

> required by law. But nice try, anyway.

consensus?

As far as I see it here in The Netherlands and elsewhere 
Internet tapping has started and it will definitely never 
go away.

IETF is missing a chance to direct an inevitable need in 
the market.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Fri, 28 Jan 2000 02:27:39 +0100

On 27 Jan 00, at 12:27, Ge' Weijers wrote:

> reasoning.

???

> A tap box cannot distinguish between a warrant issued by
> an NL judge and one issued by a modern-day Roland
> Freisler. Careful protocol design is not going to help
> here. 

If enough dependencies are added it will be at least very 
difficult to produce an illegal tap that will be usefull in 
court.

> no amount of technology will 'fix' things. 

You simply say "certain level of crime" and seem to forget 
that if it's =simple= to hide criminal organization with 
strong encryption and untappable networks it will 
definitely rise to a level that's absolutely unacceptable 
for any democracy.
 
> strange proposal for someone who uses the word 'democratic' a lot.

So you didn't understood me at all on this point.

IETF can definitely design a technically sound standard for 
an auditable tap and this has nothing to do with legitimate 
or excessive.

IETF cannot prevent misuse of tapping, not even with strong 
encryption protocols, tcpdump exists, tapping or at least 
traffic analysis is no problem. However IETF do can supply 
a way to make people an organizations accountable.

+++chefren

---

From: "Lyal Collins" <[email-masked]>
Date: Fri, 28 Jan 2000 19:25:47 +1100

I was being slightly sarcastic.

While the majority on this list and those in similar discussions forums keep
insisting "we" don't have to do anything, governments ARE taking pre-emptive
actions.

It's a lot harder to legislation repealed or diluted than it is to drive a
minimalist, democratically controlled initiative.

While the IETF may not be the best entity to act as "change agent", it has
to happen, or we all lose out.

Now, that's a call to action - I can't put it any simpler.

Act, or accept, that is the question.  Which is it to be, list participants?

Regards,
Lyal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Christian Price
> Sent: Friday, 28 January 2000 9:06
> Cc: Raven
> Subject: Re: [Raven] IP: China spies on its own people
>
>

---

From: Patrick May <[email-masked]>
Date: Fri, 28 Jan 2000 00:36:25 -0800 (PST)

> Act, or accept, that is the question.  Which is it to be, list participants?

     Act, of course.  Act to make certain that Internet protocols are
secure and untappable by anyone.

Regards,

Patrick May

---

From: Ed Stone <[email-masked]>
Date: Fri, 28 Jan 2000 13:40:52 -0500

>Act, or accept, that is the question.  Which is it to be, list participants?

You mean, if they are going to kill us, the least we can do is assist and 
neaten up the process by kindly committing suicide? Hooey. If something 
wrongheaded, dangerous, intrusive, destructive of civil liberties and 
stupid is going to be done, let it be done without the assistance of those 
to whom it is done.

What that accomplishes is depriving the government surveillance state of 
cover and any shred of legitimacy. If you think "going along" so you can 
make the policy better "from the inside" is a realistic strategy, read some 
history.

---

From: "chefren" <[email-masked]>
Date: Fri, 28 Jan 2000 20:32:39 +0100

> secure and untappable by anyone.

Yuck!!! (Please don't take it personally.)

This view is SO incredibly STUPID, it will definitely end 
up to legitimate governments to enter our houses and put 
bugs in our OWN equipment to encounter the problems that 
definitely will appear.

The idea of untappable networks undoubtly will lead to law-
approved razzia's in homes for information.

"Nuclear Sixties" are back again?

  "Stop Encryption Race NOW!"

Again: The communication of citizens can be protected 
enough by demanding telecom providers to encrypt the 
datastreams. The providers may use strong encryption and 
only have to take it off for individual taps after serious 
and proper warrants are given.

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Fri, 28 Jan 2000 17:01:49 -0500

>and proper warrants are given.

Do you mean warrants that are viewed as serious and proper by the 
government of China? The government of Iraq, Iran, Syria, Libya, North 
Korea? The Nixon administration? Newt/Hillary?... or just the serious and 
proper warrants of some shorter list of nations?  ;-)

Chefren's auditable tap, prevents government abuse of privacy: "This is the 
FBI. I'm under arrest. If I don't come out in five minutes with my hands 
up, I'm coming in after me."
--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Peter Greenwood <[email-masked]>
Date: Fri, 28 Jan 2000 21:34:48 +0000

[email-masked] said:
> we of the people of the USA) decide that we do not want to lose
> control of these systems then we can put political pressure on our
> government to get our way.

Later, [email-masked] said:
> The techies have lost control over the Internet to  democracy, live
> with it. 

Before the last election in Britain, the (then) Opposition party had a policy
of opposing the (then) Government's proposals to impose a legal requirement
to hand copies of all encryption keys to Government approved "trusted third
parties", who could in turn be ordered to hand them to the Government if
required.

At the election, there was a change of government.

Following the election, the (new) Government party came up with a proposal for
a legal requirement to hand copies of all encryption keys to Government
approved "trusted third parties", who could in turn be ordered to hand them to
the Government if required.

That could be a sudden change of mind on going from having no responsibility
to having a country to run, or it could be the Civil Service "providing
continuity". It certainly does not indicate a democratic mandate for 
decrypting people's data.

Democracy per se is no guarantee of good government. As they say, "live with
it".
-- 
	Peter Greenwood		[email-masked]

---

From: "Lyal Collins" <[email-masked]>
Date: Sat, 29 Jan 2000 11:52:50 +1100

Thanks for raising a great point to demonstrate a "middle of the road view".

The events in Europe of the last 60 years shows the consequences when "if
something wrongheaded, dangerous, intrusive, destructive of civil liberties
and stupid is going to be done, let it be done without the assistance of
those to whom it is done."

Sitting on our hands leads nowhere good in most environments.

Some actions to consider taking to counter the current groundswell against
personal controls over information flow might be:
- education in the public (possibly, but hopefully not the hysterical "Big
brother is coming" genre of messages)
- lobby groups.  They may be the existing EFA/EFF style group, or a fresh
group set up specifically on this issue.
- propose options that "meet in the middle" of the 2 extremes of the
discussion (at one end is the Hands-off brigade, while at the other is "must
know all your gossip to keep the boogey-man away" battalion)
- approach politicians directly, and show them the complexity and
difficulties of what they may be agree to, AND have at least one option to
contribute to the debate.

It seems to me that not only is democracy about choice by the people, but
personal and community accountability for actions and choices.

Technology may assist with the human burden of maintaining accountability,
but it won't be the only answer.  Why can't we move towards gving a little
ground, in a way that says "we compromised this far, but no further"

Which is really saying that encouraging auditability of actions by all
(especially LE/Regulatory) can be a good thing.

I'm sure there are other options to the "auditable taps" and the "hand-off"
options that have been discussed to boredom on this list
- but I haven't heard any.  Are there other options ??

(hint; I personally think that "head in the sand" is not adding value to the
dicsussion, but giving control to up to the "system")

Regards,
Lyal
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Ed
> Stone
> Sent: Saturday, 29 January 2000 5:41
> To: [email-masked]
> Subject: RE: [Raven] IP: China spies on its own people
>
>

---

From: Paul Ferguson <[email-masked]>
Date: Fri, 28 Jan 2000 21:36:43 -0500

>and proper warrants are given.

Wrong.

The private communications of private citizens will only
remain secure so long as strong encryption remains in the
hands of the ordinary citizen, and the keys remain private.

Period.

Any other arrangement is simply intolerable, unworkable,
and tyrannical.

Speaking only for myself,

- paul

---

From: Ed Stone <[email-masked]>
Date: Sat, 29 Jan 2000 10:47:49 -0500

>Thanks for raising a great point to demonstrate a "middle of the road view".

I hope it wasn't mistaken by others as middle of the road. Whether or not a 
middle of the road view is reasonable depends on the merits of the 
viewpoints, not on proximity to some central point on a continuum. See the 
biblical example of cutting the baby in half...

>those to whom it is done."

That would take us to 1940 Europe. Reread some history.

>Sitting on our hands leads nowhere good in most environments.

Again, whether "nowhere" is better than "point A" depends on the merits and 
specifics of the status quo, contrasted with "point A". If the status quo 
is more expensive, more difficult tapping; and "point A" is cheap, 
ubiquitous, instant, easy tapping, then most who have written here advocate 
the status quo.

>brother is coming" genre of messages)

The CESA proposal floated by the US DOJ seems to clearly announce where 
they'd like Big Brother to be.

>know all your gossip to keep the boogey-man away" battalion)

Silly. Just because a point is in the middle of two points does not give it 
any claim to support. It depends on the specifics and the merits. Ex: You 
want to sell your house for $250,000; I want to buy it for one cent. Why 
won't you be reasonable and meet me in the middle? The reason is the 
valuation of the house. Being in the middle is irrelevant.

>contribute to the debate.

The UK Labor party was against the intrusiveness of key escrow, key 
disclosure and the extensive wiretap proposals during the election. Post 
election, they changed their minds. Democracy. Chickens banding together to 
influence foxes has not been a very useful exercise.

>personal and community accountability for actions and choices.

Not about government accountability to its citizens? Like the pilot said to 
the air traffic controller who was rude and vectoring him all over the sky, 
" Sir, am I up here because you are down there, or are you down there 
because I'm up here?"

>ground, in a way that says "we compromised this far, but no further"

Because that doesn't work. Some one will look at that position, give it a 
few weeks, and then come up with yet further desires, and someone will say 
"Why can't we come to the middle ground?"  ;-)

>(especially LE/Regulatory) can be a good thing.

It's silly. You want LE to audit LE? Governments who transgress will catch 
themselves, confess and punish themselves?

>- but I haven't heard any.  Are there other options ??

A good one is supporting the idea that the communications between one party 
and another are none of the government's business. If a gov't has reason to 
believe that a crime is occuring and they can prove it, arrest and 
prosecute. If not, why are they interested in the communications? They 
don't know if a crime is being committed, but they must surveill to be 
sure? Then why not microphones in every room? What is the basis of fearing 
Internet communications as harboring crime, but not voice communications in 
the living room?

>dicsussion, but giving control to up to the "system")

Does that mean, "be reasonable, do it your way?"

---

From: "Lyal Collins" <[email-masked]>
Date: Sun, 30 Jan 2000 12:39:12 +1100

[snip]
> That would take us to 1940 Europe. Reread some history.

Here we go again, wanting specific details before the position is agreed to.

> ubiquitous, instant, easy tapping, then most who have written

Which is the latter, if have I understood the point?

> they'd like Big Brother to be.

What is the public awareness of that?
Can the message be put across succintly, defendable against (predictable)
claims of hysteria by proponents of these forms of legislation or
regulation?
Most of this agree with you about CES, FIDENT, the EU/Dutch/UK legislation.
What are we doing about it?  Wasting electrons, mostly.

> any claim to support. It depends on the specifics and the merits.

It MAY make it easier to achieve compromise on - a core aspect of democracy.
Very few get the perfect outcomme, but enough people can accept a position
over other positions - I think its called majority rule.

[snip]

> influence foxes has not been a very useful exercise.

Perhaps that's why some chickens decide to work for the farmer, who has dogs
and a gun.

> Not about government accountability to its citizens?

The government exist by "peoples choice", and is therefore accountable.

> "Why can't we come to the middle ground?"  ;-)

Yes.  Life moves on, situations change, and community needs will change.
So lets define a community "line in the sand".  Lets see if that is
acceptable to everyone (not only list participants).  If the line in the
sand needs to be re-drawn (in either direction), then lets embark on that
process if and when.

Staying tied to "views about ideas" that were defined before computer
tapping and crime became common place is akin to luddism.  In my terms, and
example of "views about ideas" would the viewpoint each of us has about the
idea of personal privacy.

> It's silly. You want LE to audit LE? Governments who transgress

The desire for specific before agreement on position, again.
I never said who would audit LE.  There are other options that may be
acceptable;
- most people on this list imply acceptance of the judiciary as reasonably
impartial.  Why not a panel of judges?
- EFF, EFA, etc?
- UN
- World Court?

This will need legislation on a national basis to be effective.
We aren't solving the needs of everyone on the planet by the process that
will arise from these efforts - that would need an effective world
government, somthing we are unlikely to see for a long time.
But some of us who put more credence on particular values may be able to
help ourselves.

> prosecute. If not, why are they interested in the communications? They

This aspect of the discussion leads nowhere.
We are in an age where technology has made it possible for crimes to be
conspired, arranged, and often implemented in bits, rather than atoms.
The non-electronic evidence discussion is valid IF we all pay enough taxes
to have :
- a police officer on every corner, with a right to stop and question or
detain anyone on an arbitrary basis
- every parcel opened and inspected by customs, imposing multi-week delays
in imports and exports
- every parcel opened and inspected by the postal service
- every air and sea passenger strip-searched at point of entry.

IF countries continue with the current taxation levels on their respect
populations OR
existing regulatory and policing efforts stay about the same AND either:
- all communications are capable of being monitored OR
- every computer is made capable of being monitored for the data it
processes (regardless of whether that data is communicated).  Thus, a
personal diary, medical records, tax files, electronic briefs for lawyers
etc would be open to LE scrutiny.

> Internet communications as harboring crime, but not voice

See the points I made above.  Why stop at the living room?
Restraunts, bars, bathrooms, streets - hell, why not even our clothes

"Surveill" means observe or close inspection, in my dictionary.  We are all
potentially under surveillance in every day life.  Anyone can watch us
shopping, working, driving, and most outdoors recreation.
Why should electronic surveillance be different.  Isn't the web servers and
data-links of the Internet the conceptual equivalent of shops, sportsgrounds
and roads?  Why should laws apply differently to elelctronic activities to
those applying to non-electronic activities?

Note I am not saying the laws need to be policed in exactly the same way.
The area of on-line policing is still new enough for us to have some
influence, if we want.
Do we want to have that influence?

> Does that mean, "be reasonable, do it your way?"

No.  It means waiting for someone else to be "nice" about this and see it
our way won't work, as history shows - see previous discussion on "something
wrongheaded, dangerous, intrusive, destructive of civil liberties and stupid
is going to be done".

Lets explore options or close down the list.  If list participants don't
move on something definitive, the list only serves as a discussion forums
for concepts that are trivialised by legislation, and hence mostly
meaningless in the bigger picture of our lives.

Lyal

---

From: Patrick May <[email-masked]>
Date: Mon, 31 Jan 2000 00:18:26 -0800 (PST)

> This view is SO incredibly STUPID, it will definitely end 

     Now why would you think that anyone would take such a lucid and
eloquent response personally?

 > approved razzia's in homes for information.

     This may happen in some countries, but not necessarily in those
with true freedom of speech and protection against arbitrary police
powers.  The U.S. government, for example, has been acting outside of
its constitutional boundaries for decades.  Nonetheless, the
U.S. courts have upheld the right to speak anonymously and have even
managed to resist the drug war hysteria to the degree that they
require law enforcement to at least get a judge to rubber stamp a
warrant before they search a private residence.

     Any definition of "legitimate government" that includes the
notion of placing bugs in the equipment of people not even accused of
a crime is so skewed as to be laughable.

 > and proper warrants are given.

     No, it cannot.  As you have noted yourself, tcpdump exists.  As
numerous others have pointed out, law enforcement in many countries,
including the U.S., has a long history of using such tools despite
laws intended to prevent such abuses.  The only way for individuals to
protect private communications is to use end-to-end strong encryption.

Sincerely,

Patrick May

PS to the List Moderator:
     The clear and overwhelming consensus on this list and at the
physical meeting is that the IETF should not sanction the weakening of
new or existing protocols in order to facilitate wiretapping.  Is
there a procedure to summarize this result to the IETF board and to
close this list?

---

From: "chefren" <[email-masked]>
Date: Mon, 31 Jan 2000 22:13:38 +0100

On 30 Jan 00, at 12:39, Lyal Collins wrote:

..
 
> meaningless in the bigger picture of our lives.

I guess you are right, it's probably already a little too 
late...

Government here has come up with a little messy solution, 
doesn't work perfectly but "enough". Probably nobody here 
would have approved it but if the techies don't come up 
with better ideas the non-techies "develop" it.

As pointed out here by Maurice they will tap only at the 
larger backbone.

Might well be that they turn everything around and demand 
all access providers to route their data through a few 
pipes.

Money and stupidity are no problems for governments...

+++chefren

---

From: "chefren" <[email-masked]>
Date: Mon, 31 Jan 2000 22:05:53 +0100

> That would take us to 1940 Europe. Reread some history.

And start thinking?

With the current media that history would absolutely never 
repeat. =Even= if a Hitler would come in place she/he would 
never have come so far neighter with with his camps nor 
with his war to Russia. (Millosevic didn't came away with 
it and the Russians don't even come away with something far 
smaller now.)

I have no problem with giving in democracy is a belief...

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Mon, 31 Jan 2000 17:25:41 -0500

At 04:05 PM 1/31/2000 , you wrote:
>repeat.

Thank you for that guarantee.

Between 1917 and 1987 the Soviet Union murdered 62 million of its own 
subjects; China, between 1949 and 1987 murdered 35 million of it subjects; 
Nazis are a distant third at 21 million people murdered (does not include 
soldiers/war dead).

Turkey killed around 2 million between 1909 and 1918; Two million 
Cambodians to the Khmer Rouge; Pakistan murdered 1.5 million while Tito's 
Yugoslavia murdered one million; Mexico murdered about 1.5 million between 
1900 and 1920.

Around 170 million total murdered by governments this century, excluding 
international and civil wars. A few hundred thousand here or there are not 
counted.

Not every reduction in liberty or concentration of power in government 
results in good things. Quite the contrary.

Source": "Death By Government", Dr. R.J. Rummel

We now return to our program, already in progress..

---

From: "Lyal Collins" <[email-masked]>
Date: Tue, 1 Feb 2000 09:25:14 +1100

[snip]

> a crime is so skewed as to be laughable.

It it reasonable to presume that this article is actually a form of April
Fools joke?
http://www.wired.com/news/business/0,1367,33779,00.html

While Australia now has legislation that permits break and enter to
computers, the US seems to think the issue dooes not need clarifying.
[snip]

Should the focus of this (or another) list discussion be changed to one of
designing computer systems that are resistant to this form of intrusion?

Lyal

---

From: Matthew Saroff <[email-masked]>
Date: Mon, 31 Jan 2000 16:55:11 -0600

You have to look at the bright side as presented by the pro tapping
folks on this list:  All we have to do is to find out who is doing all the
chinese spam that is hitting everyone's mailbox, and then use it as a mirror to
send pro-democracy information to chinese users.
	Let the Chinese security apparatus do the rest,  %-)

-- 
Matthew Saroff
Do not reply directly to this message.  Reply to
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Tue, 1 Feb 2000 01:32:12 +0100

> Source": "Death By Government", Dr. R.J. Rummel

Pretty biased without the about 150 people My Lai eh?

Old news from before the modern media. Vietnam war with 
cruelties like My Lai, pictured naked people running for 
napalm and the officer executing a guy on the street in 
front of a camera were more or less a turn.

Even a very very isolated place like Grozny has regular 
real time satellite telephone contact with reporters in The 
Netherlands (and probably to tens of other countries).  

The Internet gives the media even better chances. 

> We now return to our program, already in progress..

Hm... As argued in another thread and before: The stronger 
the encryption the stronger encountering laws for law 
enforcement.

If YOU were with law enforcement and the criminals were 
using encryption, wouldn't you ask for laws that allow you 
to place bugs in their keyboards?

Inevitable and pretty dumb weapon race.

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Mon, 31 Jan 2000 21:00:41 -0500

>Pretty biased without the about 150 people My Lai eh?

Excluded from the count of dead from governments murdering their own 
people, due to the fact that My Lai was the murder of nationals of one 
nation by an army of another nation in an international "police action".

>to place bugs in their keyboards?

If they are criminals, arrest them. No need to bug folks who are already 
arrestable and convictable. Just arrest them if they are committing crimes.