Slashdot Mirror

Recent [in 1999] remarks to CIA veterans by the head of staff of the US House of Representatives Permanent Select Committee on Intelligence, ex CIA officer John Millis illustrate how NSA views the same issues:

"Signals intelligence is in a crisis. ... Over the last fifty years ... In the past, technology has been the friend of NSA, but in the last four or five years technology has moved from being the friend to being the enemy of Sigint.

The media of telecommunications is no longer Sigint-friendly. It used to be. When you were doing RF signals, anybody within range of that RF signal could receive it just as clearly as the intended recipient. We moved from that to microwaves, and people figured out a great way to harness that as well. Well, we're moving to media that are very difficult to get to.

Encryption is here and it's going to grow very rapidly. That is bad news for Sigint ... It is going to take a huge amount of money invested in new technologies to get access and to be able to break out the information that we still need to get from Sigint".

http://www.cyber-rights.org/interception/stoa/ic2kreport.htm#_Toc448565560

They got their budgets *and* general approval from the public, who would rather fantasize about "justice" as portrayed in superhero and spy fiction.

This is like a rerun of the old Pentium III Serial Number Feature to help prohibit copyright violations in software.

That worked well for Intel then too.. LOL

http://www.cyber-rights.org/reports/intel-rep.pdf

Whilst the non-RTFAers above have failed to read that no-one is banning open Wifi (instead they're imposing some new responsibilities on ISPs and different responsibilities on subscribers), this is in addition to existing responsibilities that could already be construed as making it "impossible for small businesses and the like to offer Wi-Fi access".

ISPs in the UK don't have US-style "common carrier" status. See "Godfrey vs Demon" for one example of this - e.g. read the "analysis" section in here:
http://www.cyber-rights.org/reports/demon.htm

It was R v. Bowden:

http://www.iwf.org.uk/police/page.99.209.htm
http://www.cyber-rights.org/documents/rvbowden.htm

If it's only a court ruling, rather than what's written in the statute, surely there is a possibility of it being overturned?

I've no idea if this could be taken to a higher court, but I wouldn't expect it to be overturned myself. And there's no chance of the Government amending the law.

Common sense would seem to suggest that this is not to be what was intended by the lawmakers, however muddled/dunk they may have been.

Indeed, though sadly common sense goes out of the window when it comes to children.

I was wondering about the 'Right to Silence' regarding this particular law, and came across this website.

Briefly, it states that under sections 34-37 of the Criminal Justice and Public Order Act 1994, you would, by not disclosing information to unlock encrypted files, risk adverse inferences being drawn from that silence.

I guess you can have your cake, and eat it, but don't expect it to taste great or not poison you.

Regarding the parent, you ask about automatic regeneration of keys. IANAL, but I would have thought that the reason why you can't supply the key is irrelevant; That seems to be the way these laws are written these days.

In order to make a child porno film, you have to sexually abuse a child.

Au Contraire.Abuse is not always present. I agree that the act of abusing a child should be severely punished, but I don't think that what counts in court as child pornography == child abuse.

The USA federal criminal statute had been amended to include computer generated CP (18 USC 2256, 2258). http://www.cyber-rights.org/reports/uscases.htm

My UK ISP Demon has had a clause like this for ages

http://www.demon.net/helpdesk/producthelp/aup/thusaup/
Demon cannot tolerate any behaviour by customers which negatively impacts upon its own equipment or network, or upon the use by other customers of the Internet, or which damages Demon's standing in the wider Internet community.

It's a bit broad, like most consumer contracts - essentially they can stop you being a customer if you piss them off. But as far as I know they use it to get read of spammers, scammers and so on, not to get rid of people who criticize them.

I'm very happy wirh Demon. But I think Laurence Godfrey is a nutter

Some semi-relevant links for UK residents:

http://www.cfoi.org.uk/
http://www.liberty-human-rights.org.uk/
http://www.cyber-rights.org/
http://www.justice.org.uk/

In the baltimore sun version of this article at http://www.baltimoresun.com/news/nationworld/bal-t e.nsa18may18,0,2392814.story they mention that Thinthread was rejected in favor of another program called TrailBlazer around 1999 or 2000, quote:

"Despite its success in tests, ThinThread's information-sorting system was viewed by some in the agency as a competitor to Trailblazer, a $1.2 billion program that was being developed with similar goals. The NSA was committed to Trailblazer, which later ran into trouble and has been essentially abandoned."

Well, anyone remember another report that came out around 2000 - interception capabilities 2000, the report to the Director General for Research of the European Parliament on "the development of surveillance technology and risk of abuse of economic information." http://www.cyber-rights.org/interception/stoa/inte rception_capabilities_2000.htm

A very informative report on the state of USA COMINT surveillance capabilities and operations around 2000. It briefly touches on the potential for the unlawful use of this calibre of surveillance information in an economic context to give unfair competitive advantage to US corporate interests.

It also mentions an piece of NSA comint surveillance software called Trailmapper, including screenshots of it and another program... (Actually the report has many pretty pictures...)

I always thought COMINT and the NSA in general were only supposed to direct these surveillance capabilities at communications where at least one of the parties is located internationally. In theory anyway. I could be wrong. If it did exist that limitation does certainly seem to have been removed since this reports publication.

Perhaps Trailblazer and Trailmapper are the same program, and that the name was ever so slightly redacted in one version.

Yes, I believe that. Cryptanalysis is an international science - take the recent SHA-1 collision attack, for example. I'm sure the NSA would love a backdoor into the world's encryption systems, but luckily the NSA realises that there are plenty of talented cryptographers in other countries who would be able to find and exploit any such backdoor, damaging the business and military interests of America and its allies.

As long as a significant fraction of the world's cryptanalysts are located outside of Fort Meade, the NSA's best bet is to recommend the strongest cryptosystems it knows about.

I'd say your last three paragraphs here display a rather jaundiced and inaccurate view of life in the US, so, in the spirit of Jeane Kirkpatrick's witticism that it is important for Americans to `face the truth about themselves, no matter how pleasant it is', I'd like to address a few of the points you make there before speaking to the questions you raise earlier in your post.

You begin by saying:

Where is the liberty in our proportionally huge prison population bloated with nonviolent victims of prohibition? Too many people who go down the path Rush Limbaugh has end up in jail with manditory minimum sentences measured in decades. Is that more liberty than exists in England, the Netherlands, Denmark, etc., where prohibition is an afterthought and treatment for abuse comes first?

which is certainly an improvement in tone from a few posts back, when you were suggesting that any who disagreed with Dean's plan for tax hikes were themselves abusing prescription drugs, but still falls short of being a really weighty point. :-)

First off, we can probably both agree that some prohibition, particularly of marijuana is a bad idea -- no, don't bug your eyes out when I say that: remember that National Review and the Wall Street Journal are just about the only mainstream venues calling for decriminilization of marijuana -- but this is true not because of the number of people in jail for marijuana use, but because the criminalization of such a substance (whether or not it's use is a good idea -- it's not) is a bad idea, and one which, in the case of lesser drugs such as marijuana, almost certainly does more harm than good to the state of the rule of law in the US.

But smoking a joint is hardly the most dangerous and damaging activity for the government to prohibit, so let's look at the state of civil liberties in the countries which you claim are `more free' than the US:

• England:

  Now don't get me wrong, I like England -- I value them as an ally, and I've lived and worked in London at several points. But if you think that England is somehow `more free' than the US, you're mistaken.

  We are, after all, talking about a country which has:

  • prior restraint and other restrictions on the press
  • extensive censorship of ISPs
  • the Official Secrets Act (compare the criminal penalties placed on newspapers publishing such information in the UK with the upholding of the free press in the `pentagon papers' case),
  • and is working on mandatory biometrics files for most of the population.

  England is also facing legislation which would eliminate the right to a jury trial for most or all offenses,

  conclusion: friendlier to drugs, perhaps -- but certainly not `more free'.

• Netherlands:

  While Amsterdam is certainly pot-friendly, the Netherlands are not otherwise a particularly civil rights utopia. To start with, the Dutch have extensive laws providing for punishment of unpopular positions in the name of preventing `hate speech' (one preacher, for example, was recently fined a substantial amount of money for advocating caps on immigration). And that's not even asking why the Dutch police refused to provide protection to a popular but controversial politician who had received death threats, and who was murdered shortly thereafter.

  Conclusion: drug-friendly for sure, but `more free'? Only if your opinions are popular.

• Denmark:

  Her

This directive was first published in the middle of last year, I don't know why it's suddenly become newsworthy. The anti-spam campaigners have done well, though. As far as EU companies go, email will be opt-in for the whole European Economic Area (which includes the European Union). I'd like to thank the people who have put in so much effort to bring about this result.

Another interesting legal change comes with the Electronic Commerce Directive, which removes ISP's liability when they are acting as a "mere conduit" for illegal information. This is already in force, and marks the end of Godrey v Demon.

A. if you post something defamatory on the web, and it affects someone somewhere in the world, don't be surprised if they try to sue you in whatever country that person has a reputation to protect.

B. most baseless suits (including those where the plaintiff has no reputation in the country where the suit is lodged) will be stayed in most jurisdictions--it's called forum non conveniens.

C. defamation is not a crime. This isn't about extraterritorial criminal laws.

D. Insulting a religion or king *may* be a crime -- eg lese majeste in Thailand. Problem: depending where the poster is, courts of that country may not have jurisdiction, and the crimes are unlikely to be extraditable (no dual criminality and all that). Solution: if you insult a country or its king, don't visit it. If you insult a religion, don't visit countries where that is an official or protected religion.

E. much free speech law in the US proceeds on a bogus premise anyway. The First Amendment (try reading it) is supposed to prevent the Government enacting laws which impose censorship ("Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press") and was intended to prevent laws stifling policical discourse. It is a restraint on Congress' ability to enact laws. It shouldn't apply to one private person slurring another without justification, any more than it applies to shouting fire in a crowded theatre. No Federal law == amendment not apply.

F. Even if a US company or person is sued overseas, unless they have assets in that jurisdiction, they are likely to be safe. No assets = nothing to enforce the judgment against locally, even if the plaintiff wins. Further, US courts will probably not enforce a foreign judgment obtained under libel laws which are incompatible with the ridiculously overbroad reading given to the First Amendment.

G. the issue in the Dow Jones case was interlocutory: could the case proceed to hearing in Victoria or not? There has been no trial. Whether the story was defamatory or not, and whether or not any defence applies, is only now to be considered.

H. the result of the judgment is to affirm responsibility -- if you have to power to say something nasty about someone, wherever they are located, you have the correlative responsibility for what you say. Being based overseas is no excuse. My spin: if you don't like that, use technological means to limit who sees the material; and/or check your facts about what you are saying; and/or don't make it a slur; and/or check the local laws of the places your target lives & has a reputation, and is accordingly likely to sue. (The judgment also politely observes that many US courts do not understand the single publication rule! :).

I. Godfrey v Demon was not about this issue. There, the defendant ISP which carried the objectionable posting was based in the UK, as was the plaintiff. See a good potted summary of the case.

J. Before anyone jumps to a conclusion and complains about US-centricity, I am not based in the US. Many web servers are.

K. I am a lawyer, but this post does not constitute legal advice, is not offered with any warranty, and I assume no responsibility for anyone acting upon it.

Unfortuantely you're wrong.

And so are you. This is the case of Lawrence Godfrey vs Demon Internet. The case was that somebody had posted a message that was forged to look like it came from Dr Godfrey, and was defamatory of him. This much all the parties agreed on.

Dr Godfrey faxed several ISPs and news providers in the UK and asked them to remove the posting form their newsspools (a mostly futile act it has to be said). Most complied but Demon, presumably thinking he was a usenet kook, didn't. Dr Godfrey followed up with several more faxes requesting action, but Demon refused to comply. So he sued demon for libel, as they were publishing the message in question. After much legal bickering (including the novel argument of "he was asking for it") Demon lost. A good account can be found at cyberrights.

Dr Godfrey is a University lecturer BTW.

After considering policies like the one below, it is not difficult to imagine that there may be a U.S. government agency that wants Microsoft software to be insecure.

Page obtained as a result of the Freedom of Information Act.

It says, "I am here as a special envoy appointed by the president and reporting to the special Deputies Committee of the NSC."

"Our goal is a world in which key recovery encryption systems are the dominant form of technology in the commercial market."

At the time, there was no public discussion that the U.S. government was doing this.

This seems a related idea to the case of Godfrey vs. Demon in the UK a while back?

That case raised a number of important questions in UK law for the first time, regarding an ISP's status as a publisher, and hence the extent of their responsibilty for content they carry. IIRC, the court found against Demon on the basis that Dr Godfrey had notified them of the offensive postings and they then still failed to remove them.

However, this immediately leads to the conclusion that an ISP must, for its own safety, immediately remove any posting about which it receives a similar complaint. This is obviously subject to abuse through false claims by parties upset by a genuine and legitimate post. If the original poster could then also sue, on the basis that an ISP removed their material without an appropriate reason (big question there), then an ISP is left in an untenable situation, where they have to decide immediately and without judicial support on the legality of any post about which they receive a complaint. Oops... :-(

Did a search on google, and found these three:

Comments on Part III of the Regulation of Investigatory ...

Letter to the House Of Lords on the Regulation of ...

Ways to Defeat the Snooping Provisions in the Regulation of ...

The last one covers (among other things) steganography and is quite interesting.

Did a search on google, and found these three:

Comments on Part III of the Regulation of Investigatory ...

Letter to the House Of Lords on the Regulation of ...

Ways to Defeat the Snooping Provisions in the Regulation of ...

The last one covers (among other things) steganography and is quite interesting.

Laurence (not Lawrence) Godfrey was a net legend years ago. Aside from flaming some of his more nasty comments I thought he was pretty harmless. Oh sure, he talked about suing everyone, but I didn't really believe it.

Now this?

Never underestimate the effect that a single nut with a lawyer. :-(

Welcome to the dark ages, Britain. Just as something was being done about access costs for being online, you have now been censored. I just wonder how long it will be until The Register is forced to relocate...

Ben

The Demon precedent is actually interesting, because it says that Demon had no case because they had been served formal notice about the allegedly defamatory messages. In other words, the post had been made-- demon had been notified that it was considered libelous-- the judge decided that once they received the formal notification they were required to act on it. This is quite different than prior restraint, which seems to be happening in this instance. No libel has taken place, there's simply the threat of action should libel take place-- that's what NetBenefit is responding to.

I've got a bunch of links on the Demon case and British libel law:

• The BBC article about the Demon case
• Cyber Rights and Cyber Liberties-- a UK based site with extensive coverage of the Demon case.
• McLibel-- The infamous McDonalds case which brought British libel law to everyone else's attention.

The BBC article is quite misleading in a few respects. Firstly, the article wasn't posted via Demon - Demon weren't even LG's ISP. Demon were also not the largest news provider - JANET (the academic system) was. Good background of some of the legalities can be found here

Another interesting point was that by the time LGs lawyer contacted Demon, the post had been expired anyway.

LG also has a history of libel actions. From the link above

It should be noted that this is not the first time the plaintiff brought a libel action against another Internet user or against another Internet Service Provider in England: 1997-G-No. 1036 against Toronto Star Newspapers Limited and Ken Campbell (in relation to a message alleged to have been posted to "soc.culture.canada" on 11 September 1994); 1997-G-1070 against Melbourne PC Users Group Inc and Donald Victor Adam Joiner (in relation to messages alleged to have been posted to "sct"); 1997-G-No.1071 against Telecom New Zealand and Suradej Panchavinin (in relation to a message alleged to have been posted to "sct"); 1997-G-No 1187 against the University of Minnesota, Starnet Communications Inc. and Kritchai Quancharut (in relation to a message alleged to have been posted to "sct"); 1997-G-No 1188 against Cornell University and Michael Dolenga (relating to messages alleged to have been posted to "soc.culture.canada"); and 1998-G- No 2819 against Phillip Hallam-Baker.

This matter was discussed extensively in the Demon news groups (demon.service in particular). During this serveral incidents occured

1. LG was discovered to have systematically removed every post that he had ever made from deja.com

2. Deja had a copy of the post that was libellous, although this was later removed.

3. People posted a link to the post, and Demon and the posters were subsequently threatened with libel suits.

4. Demon banned the posters of the "libellous" URL from posting via its servers without a written undertaking that they would no repeat the libel. This was so badly worded that a few people, some of the lawyers, refused to sign.

What is left after all this is basically a kooks charter - anybody complains about a posting and it is history. The nature of net news is that it is expensive to operate given the current volume, a minority interest (I'd reckon a majority of net users have no idea what it is now), and with this result means that ISP will have little option but to remove allegedly libellous postings - the risk reward equation is too unbalanced to permit any other option.

A very depressing day. Unfortunately, with the current law in the UK it was inevitable. The only possible defence in UK law (innocent dissemination) dies as soon as you are notified about it.

Bearing in mind the subject matter, I think that I'll post this anonymously: I don't believe I've said anything libellous, but I could still be threatened never-the-less.

On 13 January, 1997, a posting in the USA was made to an Internet newsgroup "soc.culture.thai" (3) which Demon Internet carries and stores through an unknown source. The message was traced back to a forged message which made it appear that it came from the Plaintiff in the case.

:-)
ms

Apologies,
A. Keiper
The Center for the Study of Technology and Society

Doesn't The Official Secrets Act require Blair to lie when necessary to hide secrets which he knows?

See also the "Interception Capabilities 2000" report at http://www.cyber-rights.org/interception/stoa/inte rception_capabilities_2000.htm and http://www.gn.apc.org/duncan/ic2kreport.htm.
--
Brad Knowles

The linked site appears to be slashdotted. I believe this is a valid mirrorof the report:

ht tp://www.cyber-rights.org/interception/stoa/interc eption_capabilities_2000.htm