Re: National Emergency?
On Thursday, August 21, 2003, at 07:33 AM, Eric Murray wrote: On Thu, Aug 21, 2003 at 08:17:35AM -0500, Harmon Seaver wrote: So how much of the Constitution gets shredded by Bush's declaration of a national emergency right after 9/11, and how long can he maintain that. I mean, I realize the the Constitution/bill of rights is pretty much gone anyway, Hasn't there been a perpetual National Emergency, signed by every president since WWII or therebouts? Is Bush's a double plus National Emergency? Yes, some National Emergencies are more equal than others. Seriously, I recollect some studies done of just which National Emergencies, National Decision Directives, and Executive Orders were declared when, and for how long. My recollection is that the ones Lincoln declared remained in force for decades, until the next crop...and possibly were never rescinded. Some of the ones in the 1970s and 80s give the guy in the White House the power to seize all radio and television stations, all newspapers, and to take control of all factories. Pretty much the whole ball of wax, more than any of the fascists like Mussolini, Roosevelt, Tojo, or Hitler ever got. --Tim May They played all kinds of games, kept the House in session all night, and it was a very complicated bill. Maybe a handful of staffers actually read it, but the bill definitely was not available to members before the vote. --Rep. Ron Paul, TX, on how few Congresscritters saw the USA-PATRIOT Bill before voting overwhelmingly to impose a police state
Re: National Emergency?
At 07:33 AM 8/21/03 -0700, Eric Murray wrote: On Thu, Aug 21, 2003 at 08:17:35AM -0500, Harmon Seaver wrote: So how much of the Constitution gets shredded by Bush's declaration of a national emergency right after 9/11, and how long can he maintain that. I mean, I realize the the Constitution/bill of rights is pretty much gone anyway, Hasn't there been a perpetual National Emergency, signed by every president since WWII or therebouts? Is Bush's a double plus National Emergency? It has come to our attention that you citizens are being unsoc. Please turn on your telescreen (eg Fox News) and wait for the next minute of hate. Then call your local Fatherland Security Agency and wait for instructions. Repeat after me: We have always been at war with Oceania bin Laden War is peace. -- In no part of the constitution is more wisdom to be found, than in the clause which confides the question of war or peace to the legislature, and not to the executive department. -James Madison (congress has not declared war since 1941)
Popular Net anonymity service back-doored (fwd)
The good thing on the bad thing is that Java is relatively easy to decompile and audit. The bad thing on this good thing is that next to nobody will bother. The good thing on this bad thing is that at least someone will do, as it turned out in this case. Wondering how difficult it would be to make a rogue version of JAP with the logging functions removed or damaged. -- Forwarded message -- Date: Wed, 20 Aug 2003 21:56:22 -0700 Subject: Popular Net anonymity service back-doored From: Thomas C. Greene [EMAIL PROTECTED] Organization: The Register To: [EMAIL PROTECTED] Popular Net anonymity service back-doored Fed-up Feds get court order http://theregister.co.uk/content/55/32450.html The popular Java Anonymous Proxy (JAP), used to anonymise one's comings and goings across the Internet, has been back-doored by court order. The service is currently logging access attempts to a particular, and unnamed, Web site and reporting the IP addys of those who attempt to contact it to the German police. We know this because the JAP operators immediately warned users that their IP traffic might be going straight to Big Brother, right? Wrong. After taking the service down for a few days with the explanation that the interruption was due to a hardware failure, the operators then required users to install an upgraded version (ie. a back-doored version) of the app to continue using the service. As soon as our service works again, an obligatory update (version 00.02.001) [will be] needed by all users, the public was told. Not a word about Feds or back doors. Fortunately, a nosey troublemaker had a look at the 'upgrade' and noticed some unusual business in it, such as: CAMsg::printMsg(LOG_INFO,Loading Crime Detection Data\n); CAMsg::printMsg(LOG_CRIT,Crime detected - ID: %u - Content: \n%s\n,id,crimeBuff,payLen); and posted it to alt.2600. Soon the JAP team replied to the thread, admitting that there is now a crime detection function in the system mandated by the courts. But they defended their decision: What was the alternative? Shutting down the service? The security apparatchiks would have appreciated that - anonymity in the Internet and especially AN.ON are a thorn in their side anyway. Sorry, the Feds undoubtedly appreciated the JAP team's willingness to back-door the app while saying nothing about it a lot more than they would have appreciated seeing the service shut down with a warning that JAP can no longer fulfill its stated obligation to protect anonymity due to police interference. Admittedly, the JAP team makes some good points in its apology. For one, they say they're fighting the court order but that they must comply with it until a decision is reached on their appeal. Jap is a collaborative effort of Dresden University of Technology, Free University Berlin and the Independent Centre for Privacy Protection Schleswig-Holstein, Germany (ICPP). A press release from ICPP assures users that JAP is safe to use because access to only one Web site is currently being disclosed, and only under court-ordered monitoring. But that's not the point. Disclosure is the point. The JAP Web site still claims that anonymity is sacrosanct: No one, not anyone from outside, not any of the other users, not even the provider of the intermediary service can determine which connection belongs to which user. This is obviously no longer true, if it ever was. And that's a serious problem, that element of doubt. Anonymity services can flourish only if users trust providers to be straight with them at all times. This in turn means that providers must be absolutely punctilious and obsessive about disclosing every exception to their assurances of anonymity. One doesn't build confidence by letting the Feds plug in to the network, legally or otherwise, and saying nothing about it. Justifying it after the fact, as the JAP team did, simply isn't good enough. Telling us that they only did it to help catch criminals isn't good enough either. Sure, no normal person is against catching criminals - the more the merrier, I say. But what's criminal is highly relative, always subject to popular perception and state doctrine. If we accept Germany's definition of criminal activity that trumps the natural right to anonymity and privacy, then we must accept North Korea's, China's and Saudi Arabia's. They have laws too, after all. The entire purpose of anonymity services is to sidestep state regulation of what's said and what's read on the basis of natural law. The JAP Web site has a motto: Anonymity is not a crime. It's a fine one, even a profound one. But it's also a palpably political one. The JAP project inserted itself, uncalled, into the turbulent confluence between natural law and state regulation, and signaled its allegiance to the former. It's tragic to see it bowing to the latter. .
Re: Popular Net anonymity service back-doored (fwd)
At 06:44 PM 8/21/03 +0200, Thomas Shaddack wrote: Popular Net anonymity service back-doored Fed-up Feds get court order http://theregister.co.uk/content/55/32450.html The popular Java Anonymous Proxy (JAP), used to anonymise one's comings and goings across the Internet, has been back-doored by court order. The service is currently logging access attempts to a particular, and unnamed, Web site and reporting the IP addys of those who attempt to contact it to the German police. What was the alternative? Shutting down the service? The security apparatchiks would have appreciated that - anonymity in the Internet and especially AN.ON are a thorn in their side anyway. The way the Zealots dealt with Roman collaborators is becoming increasingly attractive... Sorry, the Feds undoubtedly appreciated the JAP team's willingness to back-door the app while saying nothing about it a lot more than they would In the US, their claims about anonymity would be *fraudulent* and subject to legal action. Perhaps some extra-German folks should use the proxy and hit a lot of National Socialist sites... don't want Grosser Bruder to get bored...
Major German Anonymity Service compromised
A number of cypherpunks have asked me about the current JAP situation. Here's the scoop, as I know it. (I've sent mail to some of the Dresden folks, but haven't heard back yet.) This thread on Usenet contains the pertinent information: http://groups.google.com/groups?selm=f938f87a44e64d6776c635b979aa1c48%40remailer.frell.eu.orgoe=UTF-8output=gplain The Java Anonymous Proxy is a real-time web mix system, (originally) designed to provide web browsing anonymity that couldn't be undermined by any one proxy operator. Well, no more. The JAP authors silently introduced a back-channel intended to compromise anonymity of users accessing certain sites, under the guise of an obligatory update. They claim 30,000 total users. That's a large amount of people who are being lied to about their anonymity. (The JAP website, as of this morning, was still stating: Since many users use these intermediaries at the same time, the internet connection of any one single user is hidden among the connections of all the other users. No one, not anyone from outside, not any of the other users, not even the provider of the intermediary service can determine which connection belongs to which user. Which would be true if not for the backchannel.) JAP's webpage: http://anon.inf.tu-dresden.de/index_en.html The JAP operators justify their actions (which were taken to comply with German law) by stating that their alternative was to shut the system down. There are a number of problems with this, the first being that anonymity systems which are contingent upon selective government approval for anonymity are ill-suited to a global Internet environment: What makes a court order from Germany, or England, or the US any more valid than a court order from another net-connected UN member, like China, or France? If we believe privacy and anonymity to be human rights, then we cannot build these sort of backdoors into the system and expect them not to be abused. Compare the JAP operator's actions with those of Julf Helsingius, operator of anon.penet.fi (the famous anonymous remailer/pseudonym server): http://www.penet.fi/press-english.html Julf closed down his system, which was inherently vulnerable to subpoena attacks since it stored nym to user mapping information, when he realized he could be forced to reveal any user's identity by almost any entity willing to abuse the global legal systems. Time has shown that was the right choice. Cypherpunk and Mixmaster remailers, already developed and deployed by this time, rose up in penet's place, and at this point it would be impossible for anyone to effectively compromise a user's identity via court order. (There are Mixmaster nodes operating in almost a dozen countries, and the system is truly designed to defeat rogue operators.) With the next-generation of remailers on the horizon (Mixminion and Mixmaster 4.0), ease of use should near that of Penet. Unfortunately, these are email solutions, and don't address the web browsing issue that JAP attempted to solve. Bad anonymity systems are worse than no anonymity systems. JAP has become a bad anonymity system -- mainly because it represents itself as being far stronger and more secure than it is. I am unclear on the JAP source code license. Perhaps it is possible to restore the code to the uncompromised version, and erect a parallel, trusted JAP network -- though the damage to its reputation is certainly severe. This goes to demonstrate again that crypto isn't the only consideration in an anonymity system: Anonymizer, for instance, is still a better choice for web anonymity than JAP, even though JAP offered mixing and independent operators. An anonymity provider should never represent itself as offering a greater level of protection than is actually offered -- which is the worst thing that the JAP team did (and is still doing.) --Len.
Re: JAP back doored
This is a terrible day for privacy advocates that used the once (perhaps This is the great day for *true* privacy advocates worldwide. In face of huge difficulties and dangers in providing real anonymity, some human rights/wrongs organisations capitalised (in several ways) on the need for anonymity by providing non-solutions with cosmetic appearance of anonymity. They captured the gullible public with this service and dealt another blow to the real anonymity. Who needs complicated mixmaster when there are cool cretin-friendly java/web/whatever solutions ? One would hope that users of other centralised anonymity services will learn from this, if one is incurable optimist, that is. = end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: __ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com
ADMIN: List returning
--- begin forwarded text Status: U Delivered-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: ADMIN: List returning From: Perry E. Metzger [EMAIL PROTECTED] Date: 21 Aug 2003 15:10:02 -0400 Lines: 9 Sender: [EMAIL PROTECTED] The list should be coming back on the air of the next few days. I'll be approving a large batch of recent posts in a few hours, and then most of the rest next Tuesday. (Don't expect new posts to be approved over the weekend, though I'll do it if I can get to it.) Perry PS I'd say We apologize for the inconvenience. but I don't want to sound overly Sirius Cybernetics about it... - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED] --- end forwarded text -- - R. A. Hettinga mailto: [EMAIL PROTECTED] The Internet Bearer Underwriting Corporation http://www.ibuc.com/ 44 Farquhar Street, Boston, MA 02131 USA ... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
Re: [Full-Disclosure] JAP back doored
RIP The userbase of any anonymity service stays, and dissappears, with the trust. - Original Message - From: error [EMAIL PROTECTED] To: [EMAIL PROTECTED] X-Orig-To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Thursday, August 21, 2003 7:20 PM Subject: [Full-Disclosure] JAP back doored
Re: Popular Net anonymity service back-doored (fwd)
More informations. -- Forwarded message -- Date: Thu, 21 Aug 2003 20:38:46 +0200 Subject: Re: Popular Net anonymity service back-doored From: Florian Weimer [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED] Cc: Thomas C. Greene [EMAIL PROTECTED] -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thomas C. Greene [EMAIL PROTECTED] writes: traffic might be going straight to Big Brother, right? Wrong. After taking the service down for a few days with the explanation that the interruption was due to a hardware failure, the operators then required users to install an upgraded version (ie. a back-doored version) of the app to continue using the service. This is technically incorrect. As far as I know, the client update is completely unrelated. The logging functionality has been implemented in the mixes themselves, otherwise you would be able to circumvent it by using a different client. The CVS commit occured on 2003-06-27. Logging is implemented this way: if the last mix in the cascade (which sees the request in the clear) detects a suspicious request, it is logged together with an ID. The ID is transmitted (through the cascade) to the first mix, which logs the ID and the IP address. Combining the two log files, it is possible to collapse the cascade and backtrack the requests. This exploits that TU Dresden operates both the first and last mix in the Dresden--Dresden cascade (which is the only that works reliably, AFAIK). An employee of TU Dresden described this scheme in an interview with Heise Online, a German online news site, back in October 2001. He announced an implementation within the next six months, but I don't know at the moment if he was speaking for the JAP project as a whole, or if he was just expressing his own ideas. According to the news sources I have read, the court requested surveillance based on the target IP address. However, the source code does not contain code to monitor specific (target) IP addresses, but an elaborate URL screening facility, based on regular expressions. Just by specifying .*, it should be possible to log all requests (and the corresponding IP addresses). I don't know why the source code doesn't implement the surveillance based on IP addresses, as the court allegedly requested. What was the alternative? Shutting down the service? The security apparatchiks would have appreciated that - anonymity in the Internet and especially AN.ON are a thorn in their side anyway. Note that this kind of target-based monitoring would be much harder on the plain Internet unless the remote site is willing to cooperate. A broken anonymizer makes this type of surveillance quite easy. But that's not the point. Disclosure is the point. The JAP Web site still claims that anonymity is sacrosanct: No one, not anyone from outside, not any of the other users, not even the provider of the intermediary service can determine which connection belongs to which user. The official declaration (Selbstverpflichtung) of the mixes, which promises that neither logging will be enabled nor backdoors will be implemented, hasn't been updated either. However, perhaps the JAP team at TU Dresden hadn't much choice. I haven't seen the court order, but I could imagine that they weren't allowed to inform the users because it would have harmed the criminal investigation. Following the order while fighting it within the legal system is perhaps a wiser choice than just resisting it (and thus breaking the law yourself). But I agree that it takes them awfully long to update their web site, now that some information is public. Finally, they could have avoided all the hassle if they hadn't published the source code. Why did they publish? I don't believe it's an accident. For BUGTRAQ readers: Symantec strips message headers. The original To: and Cc: are: To: [EMAIL PROTECTED], [EMAIL PROTECTED] Cc: Thomas C. Greene [EMAIL PROTECTED] -BEGIN PGP SIGNATURE- Version: GnuPG v1.3.2-cvs (GNU/Linux) iQEVAwUBP0URumOpx4pWo0FrAQLTXQf/aJLMGYtvLpzbB8BtYNFqdoHEQlu/QUmv gzouWH76cIL6zVJLK7eAM6nNI29itfOm/mJRfAJvU5B7FVAbFfPyhwEuBr4bUCYj wkIwdM0tQihu+SBdIEIKdrSlfpNbstGJiKkQkPPpa2EREqqVYLadGk95KughJ1AG f9HJzUG5jbPS/FEXrEYSqudJeVQPVPGUdmXbl0ayq8y2+AtZnk9NCJIFbXlBXf9P /zK+AoORdDl6t8fzKfUwi/qTu4qads/+eHklAbaKo2EyghjquKubTQdWpQodpt17 2CB/D25ULum2e8LWN6el2AW+PjkyaxeVBenKQV8Rw9Zv2JLenZsWrQ== =sN0C -END PGP SIGNATURE-
Is it time to kill the JAP backdoor cretins and their families?
On Thursday, August 21, 2003, at 01:38 PM, Vincent Penquerc'h wrote: CAMsg::printMsg(LOG_INFO,Loading Crime Detection Data\n); CAMsg::printMsg(LOG_CRIT,Crime detected - ID: %u - Content: \n%s\n,id,crimeBuff,payLen); Well, people say the JAP team hid it, but with that (assuming the strings appeared verbatim in the binary), they made sure someone would spot it. They essentially made sure the users would be warned about it while keeping plausible deniability. It would be easy for me to say that all of the operators connected with JAP should be killed, either necklaced and left to burn in their driveways, with perhaps their families (children, siblings, parents) also tortured to death, or at least that the offices of JAP should be firebombed, but I will not do this. I don't know what pressures they were placed under to do this dastardly act. However, it is for sure clear that: * no one connected with JAP should be hired or used as a consultant in any way by anyone of our persuasion. If this means the JAPsters are unemployable except by Big Brother, so be it. * we should look for other evidence of other crimes against liberty. If other crimes are found, then of course I retract my comment about their necklacing deaths not being justified. But of course those who placed any faith in trust us, we won't narc you out! software are the real fools. --Tim May According to the FBI, there's a new wrinkle in prostitution: suburban teenage girls are now selling their white asses at the mall to make money to spend at the mall. .. Now, you see, the joke here, of course, is on White America, which always felt superior to blacks, and showed that with their feet, moving out of urban areas. White flight, they called it. Whites feared blacks. They feared if they raised their kids around blacks, the blacks would turn their daughters and prostitutes. And now, through the miracle of MTV, damned if it didn't work out that way! --Bill Maher, Real Time with Bill Maher, HBO, 15 August 2003
JAP back doored
This is a terrible day for privacy advocates that used the once (perhaps never true) anonymous Java Anonymous Proxy. According to a story ( http://theregister.co.uk/content/55/32450.html) by The Register (It was also posted to (http://securityfocus.com/archive/1/334382/2003-08-18/2003-08-24/0) BugTraq) JAP was back doored by court order. It was a forced upgrade (after a service interruption) to monitor one site that continues to be unnamed. How sad it is when a group have a motto of Anonymity is not a crime. and then hand logs to the police without a word? Clearly if they are able to defend themselves on alt.2600 (http://groups.google.com/groups?dq=hl=enlr=ie=UTF-8frame=rightth=f4ef43 f695ca29e8seekm=3f3d3740%241_1%40news.vic.com#link10), they aren't under a gag. Read it and weep. -- error [EMAIL PROTECTED] [demime 0.97c removed an attachment of type application/pgp-signature which had a name of signature.asc]
RE: JAP back doored
CAMsg::printMsg(LOG_INFO,Loading Crime Detection Data\n); CAMsg::printMsg(LOG_CRIT,Crime detected - ID: %u - Content: \n%s\n,id,crimeBuff,payLen); Well, people say the JAP team hid it, but with that (assuming the strings appeared verbatim in the binary), they made sure someone would spot it. They essentially made sure the users would be warned about it while keeping plausible deniability. -- Vincent Penquerc'h
National Emergency?
So how much of the Constitution gets shredded by Bush's declaration of a national emergency right after 9/11, and how long can he maintain that. I mean, I realize the the Constitution/bill of rights is pretty much gone anyway, but ... -- Harmon Seaver CyberShamanix http://www.cybershamanix.com
Re: US soldiers in Iraq held against their will
On Wed, Aug 20, 2003 at 02:14:29PM -0400, Paul Hart wrote: On Wednesday, August 20, 2003, at 09:09 AM, Harmon Seaver wrote: It seems that the military is claiming that we are in a national emergency and they can do whatever they want, despite laws to the contrary. You are in a national emergency. http://www.whitehouse.gov/news/releases/2001/09/20010914-5.html Yes, of course, we will always be in a national emergency. Very convenient, eh? Using that logic, we didn't even need the unpatriot act enacted, they can simply evade any and all laws/bill of rights on the basis that we are in a national emergency just on the scumbag prez's say so. Isn't this essentially what every dictator does? -- Harmon Seaver CyberShamanix http://www.cybershamanix.com
RE: National Emergency?
So how much of the Constitution gets shredded by Bush's declaration of a national emergency right after 9/11, and how long can he maintain that. I mean, I realize the the Constitution/bill of rights is pretty much gone anyway, but ... http://www4.law.cornell.edu/uscode/50/1622.html -- Vincent Penquerc'h
Re: National Emergency?
Nothing much new. The answer is forever. http://www.cato.org/pubs/pas/pa-358es.html Executive Orders and National Emergencies: How Presidents Have Come to Run the Country by Usurping Legislative Power DCF On Thu, 21 Aug 2003, Harmon Seaver wrote: So how much of the Constitution gets shredded by Bush's declaration of a national emergency right after 9/11, and how long can he maintain that. I mean, I realize the the Constitution/bill of rights is pretty much gone anyway, but ... -- Harmon Seaver CyberShamanix http://www.cybershamanix.com
RE: National Emergency?
Funny, I've never heard or read anything about them doing this. An interesting bit in http://www4.law.cornell.edu/uscode/50/1541.html is that the US president can perform an introduction of United States Armed Forces into hostilities without Congress declaring war, if a national emergency is in effect. So the war in Iraq would seem to be essentially legal from a POV of US law. I previously thought that only Congress could do this. National emergency is a very interesting bit of the code to have if you have either a friendly majority in both houses, or if opposing you would be seen as political suicide, as was the case in late 2001... I wonder if the powers conferred include anything like law enacting with Congress bypass (for speed, you know, we don't want Congress delaying this very important new bit of anti terrorist press quashing law...) -- Vincent Penquerc'h
Re: National Emergency?
On Thu, Aug 21, 2003 at 04:02:19PM +0100, Vincent Penquerc'h wrote: So how much of the Constitution gets shredded by Bush's declaration of a national emergency right after 9/11, and how long can he maintain that. I mean, I realize the the Constitution/bill of rights is pretty much gone anyway, but ... http://www4.law.cornell.edu/uscode/50/1622.html Part of which says: (b) Termination review of national emergencies by Congress Not later than six months after a national emergency is declared, and not later than the end of each six-month period thereafter that such emergency continues, each House of Congress shall meet to consider a vote on a joint resolution to determine whether that emergency shall be terminated. Funny, I've never heard or read anything about them doing this. -- Harmon Seaver CyberShamanix http://www.cybershamanix.com
