From: jet@nas.nasa.gov (J. Eric Townsend)
Date: Mon, 14 Jun 93 09:00:18 PDT
To: cypherpunks@toad.com
Subject: forward: Cu Digest, #5.43 -- 2600 & CPSR House Subcommittee Testimony
Message-ID: <9306141559.AA01370@boxer.nas.nasa.gov>
MIME-Version: 1.0
Content-Type: text/plain



Emmanuel's comments are somewhat disturbing...

 >
 > 
 > Computer underground Digest    Sun June 13 1993   Volume 5 : Issue 43
 >                            ISSN  1004-043X
 > 
 >        Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
 >        Archivist: Brendan Kehoe
 >        Shadow-Archivists: Dan Carosone / Paul Southworth
 >                           Ralph Sims / Jyrki Kuoppala
 >                           Ian Dickinson
 >        Copy Editor: Etaoin Shrdlu, Seniur
 > 
 > CONTENTS, #5.43 (June 13 1993)
 > File 1--Hacker testimony to House subcommittee largely unheard
 > File 2--CPSR Clipper Testimony (6-9-93) in House Subcommittee
 > 
 > Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
 > available at no cost electronically from tk0jut2@mvs.cso.niu.edu. The
 > editors may be contacted by voice (815-753-6430), fax (815-753-6302)
 > or U.S. mail at:  Jim Thomas, Department of Sociology, NIU, DeKalb, IL
 > 60115.
 > 
 > Issues of CuD can also be found in the Usenet comp.society.cu-digest
 > news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
 > LAWSIG, and DL0 and DL12 of TELECOM; on GEnie in the PF*NPC RT
 > libraries and in the VIRUS/SECURITY library; from America Online in
 > the PC Telecom forum under "computing newsletters;"
 > On Delphi in the General Discussion database of the Internet SIG;
 > on the PC-EXEC BBS at (414) 789-4210; and on: Rune Stone BBS (IIRG
 > WHQ) 203-832-8441 NUP:Conspiracy
 > CuD is also available via Fidonet File Request from 1:11/70; unlisted
 > nodes and points welcome.
 > EUROPE:   from the ComNet in LUXEMBOURG BBS (++352) 466893;
 >           In ITALY: Bits against the Empire BBS: +39-461-980493
 > 
 > ANONYMOUS FTP SITES:
 >   UNITED STATES:  ftp.eff.org (192.88.144.4) in /pub/cud
 >                   uglymouse.css.itd.umich.edu (141.211.182.53) in /pub/CuD/cud
 >                   halcyon.com( 202.135.191.2) in /pub/mirror/cud
 >   AUSTRALIA:      ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD.
 >   EUROPE:         nic.funet.fi in pub/doc/cud. (Finland)
 >                   ftp.warwick.ac.uk in pub/cud (United Kingdom)
 > 
 > COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
 > information among computerists and to the presentation and debate of
 > diverse views.  CuD material may  be reprinted for non-profit as long
 > as the source is cited. Authors hold a presumptive copyright, and
 > they should be contacted for reprint permission.  It is assumed that
 > non-personal mail to the moderators may be reprinted unless otherwise
 > specified.  Readers are encouraged to submit reasoned articles
 > relating to computer culture and communication.  Articles are
 > preferred to short responses.  Please avoid quoting previous posts
 > unless absolutely necessary.
 > 
 > DISCLAIMER: The views represented herein do not necessarily represent
 >             the views of the moderators. Digest contributors assume all
 >             responsibility for ensuring that articles submitted do not
 >             violate copyright protections.
 > 
 > ----------------------------------------------------------------------
 > 
 > Date:   Thu, 10 Jun 1993 16:53:48 -0700
 > From: Emmanuel Goldstein <emmanuel@WELL.SF.CA.US>
 > Subject: File 1--Hacker testimony to House subcommittee largely unheard
 > 
 > What follows is a copy of my written testimony before the House
 > Subcommittee on Telecommunications and Finance. The June 9th hearing
 > was supposed to have been on the topic of network security, toll
 > fraud, and the social implications of the rapidly emerging
 > technologies. I was asked to speak for those who had no voice, which
 > translates to hackers and consumers. Instead I found myself barraged
 > with accusations from the two representatives in attendance (Rep. Ed
 > Markey D-MA and Rep. Jack Fields R-TX) who considered 2600 Magazine
 > (of which I'm the editor) nothing more than a manual for computer
 > crime. One article in particular that Markey latched upon was one in
 > our Spring issue that explained how a cable descrambler worked.
 > According to Markey, there was no use for this information outside of
 > a criminal context. Fields claimed we were printing cellular "codes"
 > that allowed people to listen in on cellular calls. In actuality, we
 > printed frequencies. The difference didn't seem to matter - after
 > explaining it to him, he still said he was very disturbed by the fact
 > that I was allowed to keep publishing. It soon became apparent to me
 > that neither one had read my testimony as there seemed to be no
 > inclination to discuss any of the issues I had brought up. In a way,
 > it was very much like being on the Geraldo show. Somehow I thought
 > elected representatives would be less sensationalist and more
 > interested in learning but this was not the case here. We got
 > absolutely nowhere. Markey in particular was rude, patronizing, and
 > not at all interested in entertaining any thought outside his narrow
 > perception. It's too bad this opportunity was lost. There is a real
 > danger in elected officials who don't listen to all relevant opinions
 > and who persist in sticking to old-fashioned, outdated notions that
 > just don't apply to high technology. You can look forward to more
 > restrictive regulations and higher penalties for violating them if
 > this mentality continues to dominate.
 > 
 > +++++++++++++++++++
 > WRITTEN TESTIMONY FOLLOWS:
 > 
 >      Mr. Chairman, members of the Committee, thank you for the
 > opportunity to speak on the issue of the rapid growth and changes in
 > the telecommunications industry.
 > 
 >      My name is Emmanuel Goldstein and I am the publisher of 2600
 > Magazine, which is a journal for computer hackers as well as anyone
 > else who happens to be interested in the direction that technology is
 > taking us. We tend to be brutally honest in our assessments and, as a
 > result, we do get some corporations quite angry at us. But we've also
 > managed to educate a large number of people as to how their telephone
 > system works, what kinds of computers may be watching them, and how
 > they can shape technology to meet their needs, rather than be forced
 > to tailor their existence to meet technology's needs.
 > 
 >      I am also the host of a weekly radio program called Off The Hook
 > which airs over WBAI in New York. Through that forum we have
 > discovered the eagerness and curiosity that many "ordinary people on
 > the street" possess for technology. At the same time we have seen
 > fears and suspicions expressed that would be unwise to ignore.
 > 
 > HOW TO HANDLE RAPIDLY CHANGING TECHNOLOGY
 > 
 >      The next few years will almost certainly go down in history as
 > those in which the most change took place in the least amount of time.
 > The computer and telecommunications revolution that we are now in the
 > midst of is moving full speed ahead into unknown territory. The
 > potential for amazing advances in individual thought and creativity is
 > very real. But so is the potential for oppression and mistrust the
 > likes of which we have never before seen. One way or the other, we
 > will be making history.
 > 
 >      I think we can imagine it best if we think of ourselves speeding
 > down a potentially dangerous highway. Perhaps the road will become
 > slick with ice or fraught with sharp curves. It's a road that nobody
 > has gone down before. And the question we have to ask ourselves is
 > what kind of a vehicle would we prefer to be in if things should start
 > getting out of control: our own automobile where we would have at
 > least some chance of controlling the vehicle and bringing it down to a
 > safe speed or a bus where we, along with many others, must put all of
 > our trust behind a total stranger to prevent a disaster. The answer is
 > obviously different depending on the circumstances. There are those of
 > us who do not want the responsibility of driving and others who have
 > proven themselves unworthy of it. What's important is that we all have
 > the opportunity at some point to choose which way we want to go.
 > 
 >      Rapidly changing technology can also be very dangerous if we
 > don't look where we're going or if too many of us close our eyes and
 > let someone else do the driving. This is a ride we all must stay awake
 > for.
 > 
 >      I am not saying we should be overly suspicious of every form of
 > technology. I believe we are on the verge of something very positive.
 > But the members of this committee should be aware of the dangers of an
 > uninformed populace. These dangers will manifest themselves in the
 > form of suspicion towards authority, overall fear of technology, and
 > an unhealthy feeling of helplessness.
 > 
 > HOW NEW TECHNOLOGY CAN HURT US
 > 
 >      The recent FBI proposal to have wiretap capabilities built into
 > digital telephone systems got most of its publicity because American
 > taxpayers were expected to foot the bill. But to many of the
 > non-technical people I talked to, it was just another example of Big
 > Brother edging one step closer. It is commonly believed that the
 > National Security Agency monitors all traffic on the Internet, not to
 > mention all international telephone calls.  Between Caller ID, TRW
 > credit reports, video cameras, room monitors, and computer
 > categorizations of our personalities, the average American feels as if
 > life no longer has many private moments. Our Social Security numbers,
 > which once were for Social Security, are now used for everything from
 > video rentals to driver's licenses. These numbers can easily be used
 > to track a person's location, expenses, and habits - all without any
 > consent. If you know a person's name, you can get their telephone
 > number. If you have their phone number, you can get their address.
 > Getting their Social Security number is not even a challenge anymore.
 > With this information, you can not only get every bit of information
 > about this person that exists on any computer from Blockbuster Video
 > to the local library to the phone company to the FBI, but you can
 > begin to do things in this poor person's name. It's possible we may
 > want a society like this, where we will be accountable for our every
 > movement and where only criminals will pursue privacy. The American
 > public needs to be asked. But first, they need to understand.
 > 
 >      In Germany, there is a fairly new computerized system of identity
 > cards. Every citizen must carry one of these cards. The information
 > includes their name, address, date of birth, and nationality - in
 > other words, the country they were originally born in. Such a system
 > of national identity can be quite useful, but in the wrong hands it
 > can be extremely scary. For example, if a neo-Nazi group were to
 > somehow get their hands on the database, they could instantly find out
 > where everyone of Turkish nationality lived. A malevolent government
 > could do the same and, since not carrying the card would be a crime,
 > it would be very hard to avoid its wrath.
 > 
 >      Before introducing a new technology that is all-encompassing, all
 > of its potential side-effects and disadvantages should be discussed
 > and addressed. Opportunities must exist for everyone to ask questions.
 > In our own country, nobody was ever asked if they wanted a credit file
 > opened on them, if they wanted to have their phone numbers given to
 > the people and companies they called through the use of Caller ID and
 > ANI, or if they wanted to be categorized in any manner on numerous
 > lists and databases. Yet all of this has now become standard practice.
 > 
 >      This implementation of new rules has resulted in a degree of
 > cynicism in many of us, as well as a sense of foreboding and dread. We
 > all know that these new inventions will be abused and used to
 > somebody's advantage at some point. There are those who would have us
 > believe that the only people capable of such misdeeds are computer
 > hackers and their ilk. But it just isn't that simple.
 > 
 > UNDERSTANDING COMPUTER HACKERS
 > 
 >      To understand computer hackers, it helps to think of an alien
 > culture. We have such cultures constantly around us - those with
 > teenage children ought to know what this means. There are alien
 > cultures of unlimited varieties throughout the globe, sometimes in the
 > most unexpected places. I'm convinced that this is a good thing.
 > Unfortunately, all too often our default setting on whatever it is we
 > don't understand is "bad". Suspicion and hostility follow and are soon
 > met with similar feelings from the other side. This has been going on
 > between and within our cultures for as long as we've existed. While we
 > can't stop it entirely, we can learn to recognize the danger signs.
 > The best way that I've found to deal with an alien culture, whether
 > it's in a foreign country or right here at home, is to try and
 > appreciate it while giving it a little leeway. There is not a single
 > alien culture I've encountered that has not been decidedly friendly.
 > That includes deadheads, skateboarders, Rastafarians, and hackers.
 > 
 >      When we talk about computer hackers, different images spring to
 > mind. Most of these images have come about because of perceptions
 > voiced by the media. Too often, as I'm sure the members of this
 > committee already suspect, the media just doesn't get it. This is not
 > necessarily due to malice on their part but rather a general lack of
 > understanding and an overwhelming pressure to produce a good story.
 > Hence we get an abundance of sensationalism and, when the dust clears,
 > hackers are being compared with bank robbers, mobsters, terrorists,
 > and the like.  It's gotten to the point that the word hacker is almost
 > analogous to the word criminal.
 > 
 >      Fortunately, the media is learning. Reporters now approach
 > hackers with a degree of technological savvy. For the most part, they
 > have stopped asking us to commit crimes so they can write a story
 > about it. As the technology envelops us, journalists are developing
 > the same appreciation and curiosity for it that hackers have always
 > had. Any good reporter is at least part hacker because what a hacker
 > does primarily is relentlessly pursue an answer. Computers naturally
 > lend themselves to this sort of pursuit, since they tend to be very
 > patient when asked a lot of questions.
 > 
 > WHAT CONSTITUTES A HI-TECH CRIME?
 > 
 >      So where is the boundary between the hacker world and the
 > criminal world? To me, it has always been in the same place. We know
 > that it's wrong to steal tangible objects. We know that it's wrong to
 > vandalize. We know that it's wrong to invade somebody's privacy. Not
 > one of these elements is part of the hacker world.
 > 
 >      A hacker can certainly turn into a criminal and take advantage of
 > the weaknesses in our telephone and computer systems. But this is
 > rare. What is more likely is that a hacker will share knowledge with
 > people, one of whom will decide to use that knowledge for criminal
 > purposes. This does not make the hacker a criminal for figuring it
 > out. And it certainly doesn't make the criminal into a hacker.
 > 
 >      It is easy to see this when we are talking about crimes that we
 > understand as crimes. But then there are the more nebulous crimes; the
 > ones where we have to ask ourselves: "Is this really a crime?" Copying
 > software is one example. We all know that copying a computer program
 > and then selling it is a crime. It's stealing, plain and simple. But
 > copying a program from a friend to try it out on your home computer --
 > is this the same kind of crime? It seems obvious to me that it is not,
 > the reason being that you must make a leap of logic to turn such an
 > action into a crime. Imagine if we were to charge a licensing fee
 > every time somebody browsed through a magazine at the local bookshop,
 > every time material was borrowed from a library, or every time a phone
 > number was jotted down from the yellow pages. Yet, organizations like
 > the Software Publishers Association have gone on record as saying that
 > it is illegal to use the same computer program on more than one
 > computer in your house. They claim that you must purchase it again or
 > face the threat of federal marshalls kicking in your door. That is a
 > leap of logic.
 > 
 >      It is a leap of logic to assume that because a word processor
 > costs $500, a college student will not try to make a free copy in
 > order to write and become a little more computer literate. Do we
 > punish this student for breaking a rule? Do we charge him with
 > stealing $500? To the hacker culture on whose behalf I am speaking
 > today, the only sensible answer is to make it as easy as possible for
 > that college student to use the software he needs. And while we're at
 > it, we should be happy that he's interested in the first place.
 > 
 >      Of course, this represents a fundamental change in our society's
 > outlook. Technology as a way of life, not just another way to make
 > money. After all, we encourage people to read books even if they can't
 > pay for them because to our society literacy is a very important goal.
 > I believe technological literacy is becoming increasingly important.
 > But you cannot have literacy of any kind without having access.
 > 
 >      If we continue to make access to technology difficult,
 > bureaucratic, and illogical, then there will also be more computer
 > crime. The reason being that if you treat someone like a criminal,
 > they will begin to act like one. If we succeed in convincing people
 > that copying a file is the same as physically stealing something, we
 > can hardly be surprised when the broad-based definition results in
 > more overall crime. Blurring the distinction between a virtual
 > infraction and a real-life crime is a mistake.
 > 
 > LEGISLATION FOR COMPUTER AGE CRIME
 > 
 >      New laws are not needed because there is not a single crime that
 > can be committed with a computer that is not already defined as a
 > crime without a computer. But let us not be loose with that
 > definition. Is mere unauthorized access to a computer worthy of
 > federal indictments, lengthy court battles, confiscation of equipment,
 > huge fines, and years of prison time? Or is it closer to a case of
 > trespassing, which in the real world is usually punished by a simple
 > warning? "Of course not," some will say, "since accessing a computer
 > is far more sensitive than walking into an unlocked office building."
 > If that is the case, why is it still so easy to do? If it's possible
 > for somebody to easily gain unauthorized access to a computer that has
 > information about me, I would like to know about it. But somehow I
 > don't think the company or agency running the system would tell me
 > that they have gaping security holes. Hackers, on the other hand, are
 > very open about what they discover which is why large corporations
 > hate them so much. Through legislation, we can turn what the hackers
 > do into a crime and there just might be a slim chance that we can stop
 > them. But that won't fix poorly designed systems whose very existence
 > is a violation of our privacy.
 > 
 > THE DANGERS OF UNINFORMED CONSUMERS
 > 
 >      The concept of privacy is something that is very important to a
 > hacker. This is so because hackers know how fragile privacy is in
 > today's world. Wherever possible we encourage people to protect their
 > directories, encrypt their electronic mail, not use cellular phones,
 > and whatever else it takes to keep their lives to themselves. In 1984
 > hackers were instrumental in showing the world how TRW kept credit
 > files on millions of Americans. Most people had never even heard of a
 > credit file until this happened.  Passwords were very poorly guarded -
 > in fact, credit reports had the password printed on the credit report
 > itself. More recently, hackers found that MCI's Friends and Family
 > program allowed anybody to call an 800 number and find out the numbers
 > of everyone in a customer's "calling circle". As a bonus, you could
 > also find out how these numbers were related to the customer:  friend,
 > brother, daughter-in-law, business partner, etc. Many times these
 > numbers were unlisted yet all that was needed to "verify" the
 > customer's identity was the correct zip code. In both the TRW and MCI
 > cases, hackers were ironically accused of being the ones to invade
 > privacy. What they really did was help to educate the American
 > consumer.
 > 
 >      Nowhere is this more apparent than in the telephone industry.
 > Throughout the country, telephone companies take advantage of
 > consumers. They do this primarily because the consumer does not
 > understand the technology. When we don't understand something
 > complicated, we tend to believe those who do understand. The same is
 > true for auto mechanics, plumbers, doctors, and lawyers. They all
 > speak some strange language that the majority of us will never
 > understand. So we tend to believe them. The difference with the phone
 > companies, and here I am referring to the local companies, is that you
 > cannot deal with somebody else if you happen to disagree with them or
 > find them untrustworthy. The phone companies have us in a situation
 > where we must believe what they say. If we don't believe them, we
 > cannot go elsewhere.
 > 
 >      This is the frustration that the hacker community constantly
 > faces. We face it especially because we are able to understand when
 > the local phone companies take advantage of consumers. Here are a few
 > examples:
 > 
 >      Charging a fee for touch tone service. This is a misnomer.  It
 > actually takes extra effort to tell the computer to ignore the tones
 > that you produce. Everybody already has touch tone capability but we
 > are forced to pay the phone company not to block it. While $1.50 a
 > month may not seem like much, when added together the local companies
 > that still engage in this practice are making millions of dollars a
 > year for absolutely nothing. Why do they get away with it? Because too
 > many of us don't understand how the phone system works. I try to draw
 > an analogy in this particular case - imagine if the phone company
 > decided that a fee would be charged to those customers who wanted to
 > use the number five when dialing. They could argue that the five takes
 > more energy than the four but most of us would see through this flimsy
 > logic. We must seek out other such dubious practices and not blindly
 > accept what we are told.
 > 
 >      Other examples abound: being charged extra not to have your name
 > listed in the telephone directory, a monthly maintenance charge if you
 > select your own telephone number, the fact that calling information to
 > get a number now costs more than calling the number itself.
 > 
 >      More recently, we have become acquainted with a new standard
 > called Signalling System Seven or SS7. Through this system it is
 > possible for telephones to have all kinds of new features: Caller ID,
 > Return Call, Repeat Calling to get through a busy signal, and more.
 > But again, we are having the wool pulled over our eyes. For instance,
 > if you take advantage of Call Return in New York (which will call the
 > last person who dialed your number), you are charged 75 cents on top
 > of the cost of the call itself.  Obviously, there is a cost involved
 > when new technologies are introduced. But there is no additional
 > equipment, manpower, or time consumed when you dial *69 to return a
 > call. It's a permanent part of the system. As a comparison, we could
 > say that it also costs money to install a hold button. Imagine how we
 > would feel if we were charged a fee every time we used it.
 > 
 >      The local companies are not the only offenders but it is
 > particularly bad in their case because, for the vast majority of
 > Americans, there is no competition on this level. The same complaints
 > are being voiced concerning cable television companies.
 > 
 >      Long distance telephone companies are also guilty. AT&T, MCI, and
 > Sprint all encourage the use of calling cards. Yet each imposes a
 > formidable surcharge each and every time they're used.  AT&T, for
 > example, charges 13 cents for the first minute of a nighttime call
 > from Washington DC to New York plus an 80 cent surcharge. Since a
 > calling card can only be used to make telephone calls, why are
 > consumers expected to pay an extra fee as if they were doing something
 > above and beyond the normal capability of the card? Again, there is no
 > extra work necessary to complete a calling card call - at least not on
 > the phone company's part. The consumer, on the other hand, must enter
 > up to 25 additional digits. But billing is accomplished merely by
 > computers sending data to each other. Gone are the days of tickets
 > being written up by hand and verified by human beings.  Everything is
 > accomplished quickly, efficiently, and cheaply by computer. Therefore,
 > these extra charges are outdated.
 > 
 > SOCIAL INJUSTICES OF TECHNOLOGY
 > 
 >      The way in which we have allowed public telephones to be operated
 > is particularly unfair to those who are economically disadvantaged. A
 > one minute call to Washington DC can cost as little as 12 cents from
 > the comfort of your own home. However, if you don't happen to have a
 > phone, or if you don't happen to have a home, that same one minute
 > call will cost you $2.20. That figure is the cheapest rate there is
 > from a Bell operated payphone. With whatever kind of logic was used to
 > set these prices, the results are clear. We have made it harder and
 > more expensive for the poor among us to gain access to the telephone
 > network. Surely this is not something we can be proud of.
 > 
 >      A direct result of this inequity is the prevalence of red boxes.
 > Red boxes are nothing more than tone generators that transmit a quick
 > burst of five tones which convince the central office that a quarter
 > has been deposited. It's very easy and almost totally undetectable.
 > It's also been going on for decades.  Neither the local nor long
 > distance companies have expended much effort towards stopping red
 > boxes, which gives the impression that the payphone profits are still
 > lucrative, even with this abuse. But even more troubling is the
 > message this is sending.  Think of it. For a poor and homeless person
 > to gain access to something that would cost the rest of us 12 cents,
 > they must commit a crime and steal $2.20. This is not equal access.
 > 
 > CORPORATE RULES
 > 
 >      Hackers and phone phreaks, as some of us are called, are very
 > aware of these facts. We learn by asking lots of questions.  We learn
 > by going to libraries and doing research. We learn by diving into
 > phone company trash dumpsters, reading discarded material, and doing
 > more research. But who will listen to people like us who have been
 > frequently characterized as criminals? I am particularly grateful that
 > this committee has chosen to hear us.  What is very important to us is
 > open communications. Freedom of information. An educated public.
 > 
 >      This puts us at direct odds with many organizations, who believe
 > that everything they do is "proprietary" and that the public has no
 > right to know how the public networks work. In July of 1992 we were
 > threatened with legal action by Bellcore (the research arm of the
 > Regional Bell Operating Companies) for revealing security weaknesses
 > inherent in Busy Line Verification (BLV) trunks. The information had
 > been leaked to us and we did not feel compelled to join Bellcore's
 > conspiracy of silence. In April of this year, we were threatened with
 > legal action by AT&T for printing proprietary information of theirs.
 > The information in question was a partial list of the addresses of
 > AT&T offices.  It's very hard for us to imagine how such information
 > could be considered secret. But these actions are not surprising. They
 > only serve to illustrate the wide disparities between the corporate
 > mindset and that of the individual. It is essential that the hundreds
 > of millions of Americans who will be affected by today's
 > all-encompassing inventions not be forced to play by corporate rules.
 > 
 >      In 1990 a magazine similar to 2600 was closed down by the United
 > States government because Bell South said they printed proprietary
 > information. Most people never found out about this because Phrack
 > Magazine was electronic, i.e., only available on computer bulletin
 > boards and networks. This in itself is wrong; a publication must have
 > the same First Amendment rights regardless of whether it is printed
 > electronically or on paper. As more online journals appear, this basic
 > tenet will become increasingly critical to our nation's future as a
 > democracy. Apart from this matter, we must look at what Bell South
 > claimed - that a document discussing the Enhanced 911 system which was
 > worth $79,449 had been "stolen" and printed by Phrack. (Some newspaper
 > accounts even managed to change it into an E911 program which gave the
 > appearance that hackers were actually interfering with the operation
 > of an E911 system and putting lives at risk. In reality there has
 > never been a report of a hacker gaining access to such a system.) It
 > was not until after the publisher of Phrack was forced to go to trial
 > that the real value of the document was revealed. Anyone could get a
 > copy for around $14. The government promptly dropped its case against
 > the publisher who, to this day, is still paying back $100,000 in legal
 > fees. As further evidence of the inquity between individual justice
 > and corporate justice, Bell South was never charged with fraud for its
 > claim that a $14 document was worth nearly $80,000. Their logic, as
 > explained in a memo to then Assistant U.S. Attorney Bill Cook, was
 > that the full salaries of everyone who helped write the document, as
 > well as the full cost of all hardware and software used in the
 > endeavor ($31,000 for a Vaxstation II, $6,000 for a printer), was
 > perfectly acceptable. It is very disturbing that the United States
 > government agreed with this assessment and moved to put a pre-law
 > student behind bars for violating corporate rules.
 > 
 > MISGUIDED AUTHORITY
 > 
 >      I wish I could stand before this committee and say that we have
 > been successful in stopping all such miscarriages of justice. While
 > the Phrack case may have been the most bizarre, there are many more
 > instances of individuals being victimized in similar manners. A
 > teenager in Chicago was jailed for a year for copying a file that was
 > worth millions, according to AT&T, but was utterly worthless and
 > unusable to a kid. A bulletin board operator in California, along with
 > his entire family, was held at gunpoint for hours while authorities
 > seized his equipment in an unsuccessful attempt to find child
 > pornography. Three hackers in Atlanta, after being imprisoned up to a
 > year for dialing into a Bell South computer system that had no
 > password, were forced to pay $233,000 in restitution so the company
 > could install a password system. More recently, a student at the
 > University of Texas at Houston was suspended from school for a year
 > because he accessed a file that merely listed the users of the system
 > (a file which the system allows all users to access). In increasing
 > numbers, young people are being sent to jail, not necessarily for
 > something they did, but rather for something they could have done in a
 > worst-case scenario. Again this indicates fear and misunderstanding of
 > technology and its applications. But this time those feelings emanate
 > from those in authority.
 > 
 >      Locally, an ominous happening occurred at a 2600 monthly meeting
 > last November. (These meetings occur in public areas in cities
 > throughout the nation on the first Friday of every month.) Shortly
 > after it began, the Washington meeting was broken up by Pentagon City
 > Mall security guards. Without any provocation, people were forced to
 > submit to searches and everybody's name was taken down. One of the
 > attendees who was writing down an officer's name had the paper ripped
 > from his hand, another had his film taken from his camera as he tried
 > to document what was going on. Upon questioning by a reporter from
 > Communications Daily, the mall security chief claimed that he was
 > acting under orders from the United States Secret Service. Subsequent
 > Freedom of Information Act requests by Computer Professionals for
 > Social Responsibility have yielded more evidence implicating the
 > Secret Service in this illegal and unwarranted action. Nothing of a
 > criminal nature was ever found in any of the bags that were searched.
 > But a full list of the attendees wound up in the possession of the
 > Secret Service. It seems ironic that while hackers are conducting an
 > open gathering in the middle of a shopping mall in order to share
 > knowledge and welcome new people, agents of the Secret Service are
 > lurking in the shadows trying to figure out ways to stop them.
 > 
 >      How can we move forward and talk about exciting new applications
 > of technology when we're off to such a bad start?  The people that are
 > being arrested, harassed, and intimidated are the people who will be
 > designing and running these new systems. They are the ones who will
 > appreciate their capabilities and understand their weaknesses. Through
 > our short-sightedness and eagerness to listen to the loudest voices,
 > we are alienating the promises of the future. How many here, who grew
 > up in decades past, remember hearing teenagers talk of how the
 > government is after them, watching their every move, listening to
 > their phone calls, doing everything one might expect in a totalitarian
 > regime. Such feelings are the sure sign of an ailing society. It does
 > not matter if these things are not actually occurring - their mere
 > perception is enough to cause lasting harm and mistrust.
 > 
 > PROMISE OF THE INTERNET
 > 
 >      The future holds such enormous potential. It is vital that we not
 > succumb to our fears and allow our democratic ideals and privacy
 > values to be shattered. In many ways, the world of cyberspace is more
 > real than the real world itself. I say this because it is only within
 > the virtual world that people are really free to be themselves - to
 > speak without fear of reprisal, to be anonymous if they so choose, to
 > participate in a dialogue where one is judged by the merits of their
 > words, not the color of their skin or the timbre of their voice.
 > Contrast this to our existing "real" world where we often have people
 > sized up before they even utter a word. The Internet has evolved, on
 > its own volition, to become a true bastion of worldwide democracy. It
 > is the obligation of this committee, and of governments throughout the
 > world, not to stand in its way.
 > 
 >      This does not mean we should stand back and do nothing.  Quite
 > the contrary, there is much we have to do if accessibility and
 > equality are our goals. Over-regulation and commercialization are two
 > ways to quickly kill these goals. A way to realize them is to have a
 > network access point in every house. Currently, network access is
 > restricted to students or professors at participating schools,
 > scientists, commercial establishments, and those who have access to,
 > and can afford, local services that link into the Internet. Yes, a lot
 > of people have access today.  But a far greater number do not and it
 > is to these people that we must speak. The bigger the Internet gets,
 > the better it gets. As it exists today, cultures from around the globe
 > are represented; information of all kinds is exchanged. People are
 > writing, reading, thinking. It's potentially the greatest educational
 > tool we have. Therefore, it is essential that we not allow it to
 > become a commodity that only certain people in society will be able to
 > afford. With today's technology, we face the danger of widening the
 > gap between the haves and the have-nots to a monumental level. Or we
 > can open the door and discover that people really do have a lot to
 > learn from each other, given the opportunity.
 > 
 >      It is my hope that this committee will recognize the importance
 > of dialogue with the American public, in order to answer the questions
 > so many are asking and to address the concerns that have been
 > overlooked. I thank you for this opportunity to express those issues
 > that I feel relevant to this hearing.
 > 
 > ------------------------------
 > 
 > Date:         Sat, 12 Jun 1993 12:30:38 EST
 > From:         Dave Banisar <banisar@WASHOFC.CPSR.ORG>
 > Subject: File 2--CPSR Clipper Testimony (6-9-93) in House Subcommittee
 > 
 >   CPSR Clipper Testimony 6/9
 > 
 >         On June 9, 1993, Congressman Edward Markey, Chairman of the
 > House  Subcommittee on Telecommunications and Finance held an
 > oversight hearing on Rencryption and telecommunications network
 > security. Panelists were Whitfield Diffie of Sun Microsystems, Dr.
 > Dorothy Denning,  Steven Bryen of Secure Communications, Marc
 > Rotenberg of the CPSR Washington Office and E.R. Kerkeslager of AT&T.
 > 
 >         Congressman Markey, after hearing the testimony presented,
 > noted that the Clipper proposal had raised an arched eyebrow among
 > the whole committeeS and that the committee viewed the proposal
 > skeptically. This statement was the latest indication that the Clipper
 > proposal has not been well received by policy makers.  Last Friday,
 > the Computer Systems Security and Privacy Advisory Board of NIST
 > issued two resolutions critical of the encryption plan, suggesting
 > that further study was required and that implementation of the plan
 > should be delayed until the review is completed.
 > 
 >         At the Third CPSR Cryptography and Privacy Conference on
 > Monday, June 7, the Acting Director of NIST, Raymond Kammer, announced
 > that the implementation of the proposal will be delayed and that a
 > more comprehensive review will be undertaken.  The review is due in
 > the fall.  Kammer told the Washington Post that Rmaybe we wonUt
 > continue in the direction we started ous.
 > 
 > +-------------------------------------------------
 > 
 >                           Prepared Testimony
 >                                  and
 >                        Statement for the Record
 >                                   of
 >                         Marc Rotenberg, director
 >                          CPSR Washington Office
 >                                   on
 >                    Encryption Technology and Policy
 >                                 Before
 >             The Subcommittee on Telecommunications and Finance.
 >                    Committee on Energy and Commerce
 > 
 >                         U.S. House of Representatives
 >                                June 9, 1993
 > 
 > SUMMARY
 > 
 >         The cryptography issue is of particular concern to CPSR.
 > During the past several years CPSR has pursued an extensive study of
 > cryptography policy in the United States.  CPSR has organized public
 > conferences, conducted litigation under the Freedom of Information Act,
 > and has emphasized the importance of cryptography for privacy
 > protection and the need to scrutinize carefully government proposals
 > designed to limit the use of this technology.
 >         To evaluate the Clipper proposal it is necessary to look at a
 > 1987 law, the Computer Security Act, which made clear that in the area
 > of unclassified computing systems, the National Institute of Standards
 > and Technology (NIST) and not the National Security Agency (NSA), would
 > be responsible for the development of technical standards.  The Act
 > emphasized public accountability and stressed open decision-making.
 >         In the spirit of the Act, in 1989 NIST set out to develop a
 > public key cryptography standard.  According to documents obtained by
 > CPSR through the Freedom of Information Act, NIST recommended that the
 > algorithm be "public, unclassified, implementable in both hardware or
 > software, usable by federal Agencies and U.S. based multi-national
 > corporation." However, the Clipper proposal and the full-blown Capstone
 > configuration that resulted is very different: the Clipper algorithm,
 > Skipjack, is classified; public access to the reasons underlying the
 > proposal is restricted; Skipjack can be implemented only in
 > tamper-proof hardware; it is unlikely to be used by multi-national
 > corporations, and the security of Clipper remains unproven.
 >         The Clipper proposal undermines the central purpose of the
 > Computer Security Act.  Although intended for broad use in commercial
 > networks, it was not developed at the request of either U.S. business
 > or the general public.  It does not reflect public goals.
 >         The premise of the Clipper key escrow arrangement is that the
 > government must have the ability to intercept electronic
 > communications.  However, there is no legal basis to support this
 > premise. In law there is nothing inherently illegal or suspect about
 > the use of a telephone.  The federal wiretap statute says only that
 > communication service providers must assist law enforcement execute a
 > lawful warrant.
 >         CPSR supports the review of cryptography policy currently
 > underway at the Department of Commerce.  CPSR also supports the efforts
 > undertaken by the Subcommittee on Telecommunications and Finance to
 > study the full ramifications of the Clipper proposal.  However, we are
 > not pleased about the review now being undertaken at the White House.
 > That effort has led to a series of secret meetings, has asked that
 > scientists sign non-disclosure agreements and accept restrictions on
 > publication, and has attempted to resolve public concerns through
 > private channels.  This is not a good process for the evaluation of a
 > technology that is proposed for the public switched network.
 >         Even if the issues regarding Clipper are resolved favorably,
 > privacy concerns will not go away. Rules still need to be developed
 > about the collection and use of transactional data generated by
 > computer communications.  Several specific steps should be taken.
 > First, the FCC should be given a broad mandate to pursue privacy
 > concerns.  Second, current gaps in the communications law should be
 > filled.  The protection of transactional records is particularly
 > important.  Third, telecommunications companies should be encouraged to
 > explore innovative ways to protect privacy.  "Telephone cards", widely
 > available in other countries, are an ideal way to protect privacy.
 > 
 > 
 > TESTIMONY
 > 
 >         Mr. Chairman, members of the Subcommittee, thank you for the
 > opportunity to testify today on encryption policy and the Clipper
 > proposal.  I especially wish to thank you Congressman Markey, on behalf
 > of CPSR, for your ongoing efforts on the privacy front as well as your
 > work to promote public access to electronic information.
 >         The cryptography issue is of particular concern to CPSR.
 > During the past several years we have pursued an extensive study of
 > cryptography policy in the United States.  We have organized several
 > public conferences, conducted litigation under the Freedom of
 > Information Act, and appeared on a number of panels to discuss the
 > importance of cryptography for privacy protection and the need to
 > scrutinize carefully government proposals designed to limit the use of
 > this technology.
 >         While we do not represent any particular computer company or
 > trade association we do speak for a great many people in the computer
 > profession who value privacy and are concerned about the government's
 > Clipper initiative.
 >         Today I will briefly summarize our assessment of the Clipper
 > proposal.  Then I would like to say a few words about the current
 > status of privacy protection.
 > 
 > CLIPPER
 >         To put the Clipper proposal in a policy context, I will need to
 > briefly to describe a law passed in 1987 intended to address the roles
 > of the Department of Commerce and the Department of Defense in the
 > development of technical standards.  The Computer Security Act of 1987
 > was enacted to improve computer security in the federal government, to
 > clarify the responsibilities of the National Institute of Standards and
 > Technology (NIST) and the National Security Agency, and to ensure that
 > technical standards would serve civilian and commercial needs.
 >         The law made clear that in the area of unclassified computing
 > systems, NIST and not NSA, would be responsible for the development of
 > technical standards.  It emphasized public accountability and stressed
 > open decision-making.  The Computer Security Act also established the
 > Computer System Security and Privacy Advisory Board (CSSPAB), charged
 > with reviewing the activities of NIST and ensuring that the mandate of
 > the law was enforced.
 >         The Computer Security Act grew out of a concern that classified
 > standards and secret meetings would not serve the interests of the
 > general public.  As the practical applications for cryptography have
 > moved from the military and intelligence arenas to the commercial
 > sphere, this point has become clear.  There is also clearly a conflict
 > of interest when an agency tasked with signal interception is also
 > given authority to develop standards for network security.
 >         In the spirit of the Computer Security Act, NIST set out in
 > 1989 to develop a public key standard FIPS (Federal Information
 > Processing Standard).  In a memo dated May 5, 1989, obtained by CPSR
 > through the Freedom of Information Act, NIST said that it planned:
 > 
 > to develop the necessary public-key based security standards.  We
 > require a public-key algorithm for calculating digital signatures and
 > we also require a public-key algorithm for distributing secret keys.
 > 
 > NIST then went on to define the requirements of the standard:
 > 
 > The algorithms that we use must be public, unclassified, implementable
 > in both hardware or software, usable by federal Agencies and U.S. based
 > multi-national corporation, and must provide a level of security
 > sufficient for the protection of unclassified, sensitive information
 > and commercial propriety and/or valuable information.
 > 
 >         The Clipper proposal and the full-blown Capstone configuration,
 > which incorporates the key management function NIST set out to develop
 > in 1989, is very different from the one originally conceived by NIST.
 > 
 > %       The Clipper algorithm, Skipjack, is classified,
 > %       Public access to the reasons underlying the proposal is
 > restricted,
 > %       Skipjack can be implemented only in tamper-proof hardware,
 > %       It is Unlikely to be used by multi-national corporations, and
 > %       The security of Clipper remains unproven.
 > 
 >         The Clipper proposal undermines the central purpose of the
 > Computer Security Act.  Although intended for broad use in commercial
 > networks, it was not developed at the request of either U.S. business
 > or the general public.  It does not reflect public goals.  Rather it
 > reflects the interests of one secret agency with the authority to
 > conduct foreign signal intelligence and another government agency
 > responsible for law enforcement investigations.
 >         Documents obtained by CPSR through the Freedom of Information
 > Act indicate that the National Security Agency dominated the meetings
 > of the joint NIST/NSA Technical Working group which made
 > recommendations to NIST regarding public key cryptography, and that a
 > related technical standard for message authentication, the Digital
 > Signature Standard, clearly reflected the interests of the NSA.
 >         We are still trying to determine the precise role of the NSA in
 > the development of the Clipper proposal.  We would be pleased to
 > provide to the Subcommittee whatever materials we obtain.
 > 
 > LEGAL AND POLICY ISSUES
 >         There are also several legal and constitutional issues raised
 > by the government's key escrow proposal.  The premise of the Clipper
 > key escrow arrangement is that the government must have the ability to
 > intercept electronic communications, regardless of the economic or
 > societal costs.  The FBI's Digital Telephony proposal, and the earlier
 > Senate bill 266, were based on the same assumption.
 >         There are a number of arguments made in defense of this
 > position: that privacy rights and law enforcement needs must be
 > balanced, or that the government will be unable to conduct criminal
 > investigations without this capability.
 >         Regardless of how one views these various claims, there is one
 > point about the law that should be made very clear: currently there is
 > no legal basis -- in statute, the Constitution or anywhere else --
 > that supports the premise which underlies the Clipper proposal.  As the
 > law currently stands, surveillance is not a design goal.  General
 > Motors would have a stronger legal basis for building cars that could
 > go no faster than 65 miles per hour than AT&T does in marketing a
 > commercial telephone that has a built-in wiretap capability.  In law
 > there is simply nothing about the use of a telephone that is inherently
 > illegal or suspect.
 >         The federal wiretap statute says only that communication
 > service providers must assist law enforcement in the execution of a
 > lawful warrant.  It does not say that anyone is obligated to design
 > systems to facilitate future wire surveillance.  That distinction is
 > the difference between countries that restrict wire surveillance to
 > narrow circumstances defined in law and those that treat all users of
 > the telephone network as potential criminals.  U.S. law takes the first
 > approach.  Countries such as the former East Germany took the second
 > approach.  The use of the phone system by citizens was considered
 > inherently suspect and for that reason more than 10,000 people were
 > employed by the East German government to listen in on telephone calls.
 >         It is precisely because the wiretap statute does not contain
 > the obligation to incorporate surveillance capability -- the design
 > premise of the Clipper proposal -- that the Federal Bureau of
 > Investigation introduced the Digital Telephony legislation.  But that
 > legislation has not moved forward and the law has remained unchanged.
 > The Clipper proposal attempts to accomplish through the
 > standard-setting and procurement process what the Congress has been
 > unwilling to do through the legislative process.
 >         On legal grounds, adopting the Clipper would be a mistake.
 > There is an important policy goal underlying the wiretap law.  The
 > Fourth Amendment and the federal wiretap statute do not so much balance
 > competing interests as they erect barriers against government excess
 > and define the proper scope of criminal investigation.  The purpose of
 > the federal wiretap law is to restrict the government, it is not to
 > coerce the public.
 >         Therefore, if the government endorses the Clipper proposal, it
 > will undermine the basic philosophy of the federal wiretap law and the
 > fundamental values embodied in the Constitution.  It will establish a
 > technical mechanism for signal interception based on a premise that has
 > no legal foundation.  The assumption underlying the Clipper proposal is
 > more compatible with the practice of telephone surveillance in the
 > former East Germany than it is with the narrowly limited circumstances
 > that wire surveillance has been allowed in the United States.
 > 
 > UNANSWERED QUESTIONS
 >         There are a number of other legal issues that have not been
 > adequately considered by the proponents of the key escrow arrangement
 > that the Subcommittee should examine.  First, not all lawful wiretaps
 > follow a normal warrant process.  The proponents of Clipper should make
 > clear how emergency wiretaps will be conducted before the proposal goes
 > forward.  Second, there may be civil liability issues for the escrow
 > agents, if they are private parties, if there is abuse or compromise of
 > the keys.  Third, there is a Fifth Amendment dimension to the proposed
 > escrow key arrangement if a network user is compelled to disclose his
 > or her key to the government in order to access a communications
 > network. Each one of these issues should be examined carefully.
 > 
 > 
 > CPSR CONFERENCE
 >         At a conference organized by CPSR this week at the Carnegie
 > Endowment for International Peace we heard presentations from staff
 > members at NIST, FBI, NSA and the White House about the Clipper
 > proposal.  The participants at the meeting had the opportunity to ask
 > questions and to exchange views.
 >         Certain points now seem clear:
 > 
 > %       The Clipper proposal was not developed in response to any
 > perceived public or business need.  It was developed solely to address
 > a law enforcement concern.
 > %       Wire surveillance remains a small part of law enforcement
 > investigations.  The number of arrests resulting from wiretaps has
 > remained essentially unchanged since the federal wiretap law was enacted
 > in 1968.
 > %       The potential risks of the Clipper proposal have not been
 > assessed and many questions about the implementation remain unanswered.
 > %       Clipper does not appear to have the support of the business or
 > research community.
 > 
 >         Many comments on the Clipper proposal, both positive and
 > negative as well the materials obtained by CPSR through the Freedom of
 > Information Act, are contained in the Source book compiled by CPSR for
 > the recent conference.  I am please to make a copy of this available to
 > the Subcommittee.
 > 
 > 
 > NETWORK PRIVACY PROTECTION
 >         Communications privacy remains a critical test for network
 > development.  Networks that do not provide a high degree of privacy are
 > clearly less useful to network users.  Given the choice between a
 > cryptography product without a key escrow and one with a key escrow, it
 > would be difficult to find a user who would prefer the key escrow
 > requirement.  If this proposal does go forward, it will not be because
 > network users or commercial service providers favored it.
 >         Even if the issues regarding the Clipper are resolved
 > favorably, privacy concerns will not go away.  Cryptography is a part
 > of communications privacy, but it is only a small part.  Rules still
 > need to be developed about the collection and use of transactional data
 > generated by computer communications.  While the federal wiretap law
 > generally does a very good job of protecting the content of
 > communications against interception by government agencies, large holes
 > still remain.  The extensive use of subpoenas by the government to
 > obtain toll records and the sale of telephone records by private
 > companies are just two examples of gaps in current law.
 >         The enforcement of privacy laws is also a particularly serious
 > concern in the United States.  Good laws without clear mechanisms for
 > enforcement raise over-arching questions about the adequacy of legal
 > protections in this country.  This problem is known to those who have
 > followed developments with the Privacy Act since passage in 1974 and
 > the more recent Video Privacy and Protection Act of 1988.  I make this
 > point because it has been the experience in other countries that
 > agencies charged with the responsibility for privacy protection can be
 > effective advocates for the public in the protection of personal
 > privacy.
 > 
 > RECOMMENDATIONS
 >         Regarding the Clipper proposal, we believe that the national
 > review currently underway by the Computer Security and Privacy Advisory
 > Board at the Department of Commerce will be extremely useful and we
 > look forward to the results of that effort.  The Panel has already
 > conducted a series of important open hearings and compiled useful
 > materials on Clipper and cryptography policy for public review.
 >         We are also pleased that the Subcommittee on Telecommunications
 > and Finance has undertaken this hearing.  This Subcommittee can play a
 > particularly important role in the resolution of these issues.  We also
 > appreciate the Chairman's efforts to ensure that the proper studies are
 > undertaken, that the General Accounting Office fully explores these
 > issues, and that the Secretary of Commerce carefully assesses the
 > potential impact of the Clipper proposal on export policy.
 >         We are, however, less pleased about the White House study
 > currently underway.  That effort, organized in large part by the
 > National Security Council, has led to a series of secret meetings, has
 > asked that scientists sign non-disclosure agreements and accept
 > restrictions on publication, and has attempted to resolve public
 > concerns through private channels.  This is not a good process for the
 > evaluation of a technology that is proposed for the public switched
 > network.  While we acknowledge that the White House has been reasonably
 > forthcoming in explaining the current state of affairs, we do not think
 > that this process is a good one.
 >         For these reasons, we believe that the White House should
 > properly defer to the recommendations of the Computer System Security
 > and Privacy Advisory Board and the Subcommittee on Telecommunications
 > and Finance.  We hope that no further steps in support of the Clipper
 > initiative will be taken.  We specifically recommend that no further
 > purchase of Clipper chips be approved.
 >         Speaking more generally, we believe that a number of steps
 > could be taken to ensure that future communications initiatives could
 > properly be viewed as a boost to privacy and not a set-back.
 > 
 > %       The FCC must be given a strong mandate to pursue privacy
 > concerns.  There should be an office specifically established to
 > examine privacy issues and to prepare reports.  Similar efforts in
 > other countries have been enormously successful.  The Japanese Ministry
 > of Post and Telecommunications developed a set of privacy principles to
 > ensure continued trade with Europe.  The Canada Ministry of
 > Communications developed a set of communications principles to address
 > public concerns about the privacy of cellular communications.  In
 > Europe, the EC put forward an important directive on privacy protection
 > for the development of new network services.
 > 
 > %       Current gaps in the communications law should be filled.  The
 > protection of transactional records is particularly important.
 > Legislation is needed to limit law enforcement access to toll record
 > information and to restrict the sale of data generated by the use of
 > telecommunication services.  As the network becomes digital, the
 > transaction records associated with a particular communication may
 > become more valuable than the content of the communication itself.
 > 
 > %       Telecommunications companies should be encouraged to explore
 > innovative ways to protect privacy.  Cryptography is a particular
 > method to seal electronic communications, but far more important for
 > routine communications could be anonymous telephone cards, similar to
 > the metro cards here in the District of Columbia, that allow consumers
 > to purchase services without establishing accounts, transferring
 > personal data, or recording personal activities.  Such cards are widely
 > available in Europe, Japan, and Australia.
 > 
 >         I thank you very much for the opportunity to appear before the
 > Subcommittee and would be pleased to answer your questions Computer
 > Professionals for Social Responsibility
 > 
 >         CPSR is a national membership organization, established in
 > 1982, to address the social impact of computer technology.  There are
 > 2,500 members in 20 chapters across the United States, and offices in
 > Palo Alto, California, Cambridge, Massachusetts, and Washington DC. The
 > organization is governed by a board of elected officers and meetings
 > are open to the public.  CPSR sponsors an annual meeting and the
 > biennial conference on Directions and Implications of Advanced
 > Computing.  CPSR sponsored the first conference on Computers, Freedom,
 > and Privacy in 1991.  CPSR also operates the Internet Library at
 > cpsr.org.  The library contains documents from the White House on
 > technology policy and a wide range of public laws covering privacy,
 > access to information, and communications law and is available free of
 > charge to all users of the Internet.
 > 
 >         Marc Rotenberg is the director of the CPSR Washington office
 > and an adjunct professor at Georgetown University Law Center.  He is
 > chairman of the ACM Committee on Scientific Freedom and Human Rights,
 > an editor for the Computer Law and Security Report (London), and the
 > secretary of Privacy International, an organization of human rights
 > advocates and privacy scholars in forty countries.  He received an A.B.
 > from Harvard College and a J.D. from Stanford Law School, and is a
 > member of the bar of the United States Supreme Court.  His forthcoming
 > article "Communications Privacy: Implications for Network Design" will
 > appear in the August 1993 issue of Communications o0f the ACM.
 > 
 > ------------------------------
 > 
 > End of Computer Underground Digest #5.43
 > ************************************