From: Black Unicorn <unicorn@schloss.li>
Date: Sun, 10 Nov 1996 16:39:35 -0800 (PST)
To: Adam Back <aba@dcs.ex.ac.uk>
Subject: Secrecy: My life as a nym. (Was: nym blown?)
In-Reply-To: <199611092052.UAA00391@server.test.net>
Message-ID: <Pine.SUN.3.94.961110173517.12339E-100000@polaris>
MIME-Version: 1.0
Content-Type: text/plain


On Sat, 9 Nov 1996, Adam Back wrote:

> S L von Bernhardt == Black Unicorn, or do you "have that covered" too uni?
> 
> (I noticed you said you "had it covered" when you reported to the list
> on a meeting you attended which had a published list of attenders, and
> someone pointed this out).

I'm not sure which meeting this would be.  If I was on any published list
it would be under a pseudonym or a large and diverse enough list where I
didn't feel threatened by it being public.  Generally these are meetings I
attend only for personal or academic interest.  (i.e. I'm not attending in
an official capacity or participating in a way which would make my
presence obvious or a matter of record).

I suppose you could be referring to the ABA Committee on Law and National
Security Conference on Intelligence and Law Enforcement in September.
That's the most recent meeting I can recall which might fit your
description.

If my attendence to that event was published by anyone other than myself I
am unaware of it.  Even if it were I doubt it would be of value in linking
me to a "true name."

But this brings up some interesting points, and, with your patience, I
think I will take this time to blather on.


Secrecy - A few words (or more).

Secrecy is all about vigilance.  If you never put your name on something,
your name is unlikely to come up.  I fail to understand why this is, it
would seem, such a difficult concept for some cypherpunks to grasp.  If
everyone treated true names like PGP passwords and added in a touch of
disinformation here and there where required, true names would be nearly
impossible to determine.  To my knowledge few have bothered on this list.
I find this unfortunate.  In my personal experience it is quite easy to
conceal one's identity, particularly so where personal and professional
circles differ significantly, as they do in my case.

I admit that I am advantaged in that I was born outside the United States
and come from a family jealous of its privacy to begin with, but I submit
that secrecy of the kind I have (it would seem) preserved is not that
difficult to estlablish, and maintain.

I originally adopted a nym because I was concerned that my public
statements on the list and elsewhere in cyberspace, (which have nothing
to do with my professional conduct, my ability to represent clients or
wear my fiducuary hat) might be taken out of context and prejudice clients
or shareholders in one fashion or another.  Cypherpunks, and my politics
generally, are not always conducive to the traditional conservative
dispositions my clients and my family often had.  I was tangentially
concerned about some pre-publication review issues, which have since
evaporated.  As time went on it became clear that a nym was useful in
other ways.

For one, because I chose a depiction "Black Unicorn," rather than a name
"John Smith," I found that those who eventually contacted me by e-mail had
first to overcome the "silliness" reaction.  Seems rather moronic to write
an adolescent sounding "handle" about financial advice and so forth.  A
pre-screener of sorts.  The inquries I received were from individuals
interested or driven enough to ignore the cartoonish pen name as a result.
A decided advantage in my view.

A disadvantage: When I adopted the nym, I had not planned it to last quite
so long.  The image was perhaps a bit too personal to deter close and
determined investigations from revealing my identity, or at least come
close. (As one cypherpunk- I think you know who you are, though I'm not
sure- did).

Secondly, the potential for malicious reputation destruction was reduced
dramatically.  Its hard to call my clients and anonymously reveal my
"heroin problem" or some such.  Given the heated flames I am alarmingly
prone to participate in, this was something of a comfort.  I don't think I
ever abused my secrecy to avoid accountability for any real nastiness on
my part, though perhaps the list would be a better judge of that.

Thirdly, it became clear that given the amount and degree of archiving
which developed on the net, I was protected from the notorious "sleeper
blooper" attack.  "Do you recognize this, a posting from 1897, in which
you said that abortion should be legalized?"  This affords nice protection
from the sudden change in conventional wisdom on all the topics I
discussed.  (The flip side is that if banking secrecy ever comes back in
vogue, I need only reveal myself by signing my key to something with my
name on it and take credit for being a maverick in my time, or whatever).
This is a point that bears exploration.  The ability to pull up a literal
rap sheet on a person is no longer confined to law enforcement (as
our KOTM profiler so aptly demonstrated only days ago).  It is now an
easy endeavor which private investigation services once charged $65.00/hr
or more to accomplish.  Your's for only the cost of a local call.

Yet at the same time few seem to have bothered to pursue research on my
nym.  I paid for early accounts in cash or with a cutout credit
card, eventually using a provider I had substantial control over instead.  
I monitored things as simple as calls to my access provider, whois
commands (try whois.ripe.net), finger requests, etc.  To my surprise,
these were few in number.  I think people generally were uninterested, and
those who were either got bored or distracted.

Fourthly, the nym lent some protection from the baseless law suit.  No
longer is it in the power of just anyone to cost me time and money simply
because they wish to.  If I really engage in some conduct which causes
serious harm, and the potential for returns are high enough, resources
will doubtlessly be allocated to identify me and name me in a suit.  If
this cost is high enough, however, nuisance suits become hard to initiate
effectively.  An important point given all the discussion on the list
about the wisdom of legal threats for libel.

I think that the usual cypherpunk solution, if such a thing exists, would
be to use technical means to deter law suits, yet many in here resort to
attacks on those who would use the system instead.  Hasn't this been the
cypherpunk experience, that prosecutorial discression is no protection?
Why is libel any different?  Given that civil suits put the private party 
in the place of prosecutor, and that party has less of an incentive to
practice discression in initiating suit (no political checks, no
supervisory authoirty or chain of command) it would seem that civil suits 
bear a HIGHER risk of abuse.  Yet government, which like it or not has
several checks built in that the civil system does not, gets the most
attention in this regard.  A point to consider anyhow.

What were the biggest problems?  Family.

A pair of c'punks managed, by coincidence in one case, design in the
other, to collide with my sister on the net.  As she had a full and rather
open web page up and this had the potential to give out a plethora of
clues.  Nothing too personal, (thanks sis) but I was unaware the page
existed for quite awhile.  Again, I believe that it was a cultrual thing
which prevented her from spilling all her life's details and our family
name out onto the web like some kind of billboard.  (All it takes is a
quick look at something like "babes on the web" or whatever to find quite
well designed stalker's cliff notes happily authored by the stalkee.  One
page  I saw recently had a resume with social security number on it).

Cultural issues...

The problem with the United States is the complete integration of identity
publication into the development process.  Cub scout fingerprintings, year
book photographs, medical records, social security numbers at birth, the
list continues.  As numerous as these subtle and progressive degradations
of secrecy are, they are still not insurmountable for the United States
citizen.  No more than 4 or 5 absences on key dates would be required to
remove any individual from high school year books.  Complying with the
letter of the law, and no more, with regard to Social Security Number
disclosures is simple.  (Simply never write it down- or at least not
correctly- the people who need it, have it).  I have lived on and off in
the United States for quite some years, and I have never encountered a
situation where an actual social security number would have been required
of me.  I have shot myself in the foot by refusing to give on rather
than making one up, but this is a side issue.  Two associates of mine have
had similar experience. One (29) has no number at all and never bothered
to get one (last I heard, he was working in a high paying corporate type
job in a major city on the East Coast).  The other (38) has a number but
can no longer remember what it is.  (25+ years of disuse).  I assume that
whenever asked, they simply provide erronious or misleading information.
Both are U.S. citizens.

Unfortunately, in the United States most citizens only become interested
in privacy in their 20s or so.  By this time it is difficult to overcome
the mass of information which has been stored up.  (Pseudocide can be an
attractive option for some perhaps).

One marvels at the inability of Joe Sixpack to recognize the value of at
least a hint of caution with regard to identity.  (Especially so given all
the media hype about the dangers of social engineering, account number and
social security number publication and license plate information).

Given the cultural elements, I suppose it shouldn't be surprising to me
that any disclosure about a nym seems to bring with it a thousand clever
investigators who are sure that they have just managed to happen on a
"slip up."  (No less than four postings of this nature followed the DCSB
announcement).  For some reason, however, I still can't help but wonder
that secrecy seems so alien even to noted members of this list.  (Chrysler
kept its complete control over Norex N.A. a secret for 10 years, despite
the fact that millions flowed between the two companies regularly.  Crazy
Eddie, of New York fame, managed to keep his assets hidden, under the most
immense pressure, and his identity concealed for several years despite all
attempts by the United States to find him.  Saddam managed to avoid bombs
and cruise missles even in the face of satelite and directed intelligence
tasking.  Given these, keeping your name away from the Health Insurance
company should be quite obviously possible).

Apathy....

There are a few people out there who probably know who I am, but I'm not
sure that even they realize it exactly.  In terms of money I've not even
put much effort into it over the years, at least no more so than I do
protecting my personal privacy generally.  Part of the reason is that it
takes effort to research this kind of thing.  Even access to Lexis/Nexis
isn't always enough if you're given nothing to go on from the start.
Sure, there are schelling (?) points and so forth.  Certain lifestyle
habits come through.  (One list member who I spoke with by
telephone regularly derived a great deal simply from my phoning habits-
you know who you are- Kudos).  Even all this together, however, is not
always enough to narrow down the field too closely.

Keep in mind that I've attended cypherpunk meetings and met personally
with no less than 3 c'punks in the last several years.

My point?  That I'm immensely clever and trained in the shadowy world of
secret identities?  Hardly.  My point is that minimal effort can be
extremely effective.  In effect, anyone can do it.

I'm sure some clever participant at DCSB will do a pile of homework before
coming to my talk and put it all together.  So be it.  If he or she is
polite, they might chide me in private a bit, but not blather all over the
list just to show how very clever they were.  As long as they enjoy the
talk, I'm not overly concerned.

I do less work for private clients who's sensibilities I'm particularly
concerned about.  I spend more and more time out of the United States,
and, frankly, cypherpunks in general have received me warmly.  Most large
posts I made attracted at least a few "thank you's" or "could you tell me
more's."  In many ways this was much more rewarding than work for which
renumeration was forthcoming.  I hope I've given something back.

This brings up my final point.  Reputation.

After a while with the nym, the value of reputation became clear.  A
"cartoon" handle required more than the usual amount of reputation and I
found myself often taking more time with long posts and list research
projects than I might of had my real name been attached. (!)  Reputation
has value in more than one way it would seem.

Whatever comes of my visit to Boston, and snide remarks about my "teasers"
aside, I've enjoyed cypherpunks, even with the noise, and hope I can
continue to do so for as many years to come.  While less important,
today, privacy is still an issue for me.  Do be considerate and refrain
from taking photos and the like just for kicks.  I'm hardly going to be
obnoxious enough to have everyone frisked as the enter or the like, do me
a favor and make my guess that such measures are unnecessary among
cypherpunks the correct one.

--
Forward complaints to : European Association of Envelope Manufactures
Finger for Public Key   Gutenbergstrasse 21;Postfach;CH-3001;Bern
Vote Monarchist         Switzerland