From: alzheimer@juno.com (Ronald Raygun Remailer)
Date: Thu, 2 Jan 1997 08:08:58 -0800 (PST)
To: cypherpunks@toad.com
Subject: Copyright violations
Message-ID: <19970102.100832.12295.0.alzheimer@juno.com>
MIME-Version: 1.0
Content-Type: text/plain


Happy New Year.


Associated Press: Monday, December 23, 1996
 
Three Credit Card Firms Seek To Promote Internet Shopping 
 
Three credit card companies on Monday announced an agreement on chip card

standards in an
effort to promote shopping on the Internet. 
 
Europay International, MasterCard International and Visa International
said in 
a statement that they'll
integrate in chip bank cards a technology developed for safe electronic 
payments. 
 
The agreement is based on the Europay-MasterCard-Visa specification,
which 
established the
financial industry's first global chip card payment infrastructure, and
on 
MasterCard and Visa's
Secure Electronic Transactions specification for magnetic stripe-based
card 
transactions. 
 
Guido Heyns, director of 'smart card' development at Europay
International, 
said in the statement
that the Belgium-based company believes chip cards are the most secure
and 
consumer-friendly
solution for making payments on the Internet. 
 
Steve Mott, senior vice president of MasterCard International, agreed. 
'Consumers and merchants
want to conduct transactions over the Internet in a safe manner. By
integrating 
chip and electronic
commerce technologies, we are offering them the opportunity to do so as
quickly 
and practically as
possible.' 
 
An open comment period on the new standard will begin in the third
quarter of 
1997, according to
the statement. 
 

 
American Banker: Monday, December 23, 1996
 
As the Technology Advances, Security Debate Still Rages
 
By JEFFREY KUTLER
 
In one of the more startling public statements by a banker in 1996,
Citicorp 
chairman John Reed
said it would take two generations -- 50 to 70 years -- for on-line
electronic 
banking to gain full
public acceptance. 
 
Taken out of context, his remarks to a Treasury Department conference on 
electronic money
sounded like an invitation to complacency, or a dose of disinformation
from one 
of the world's more
aggressive purveyors of electronic financial services.
 
But Mr. Reed chose his words carefully, citing a lesson learned from his 
30-plus years at Citicorp:
Banking markets, and society generally, take time to change. He seemed to

suggest that
high-technology advocates can become so enthralled with the elegance of
their 
systems and
convinced of their viability that they overlook the most common of all 
constraints: consumer
behavior.
 
"Privacy and security are at the top of the list" of consumers' concerns,
the 
Citicorp chief executive
said. "They won't deal with anyone who doesn't give them assurance."
While 
"some early innovators
will be your electronic banking customers," he said, "the average
consumer is 
not there yet and isn't

going to be there" for some time. "This is not a question of economics or

efficiency. It is a question of
trust. The consumer will have to trust you. The Internet is fundamentally

flawed in that regard."
 
Essentially alone among the major U.S. banking organizations, Citicorp
has been 
openly wary of
Internet security and refrained from joining the rush to interactive
banking 
and monetary transactions
via the World Wide Web. Mr. Reed and his senior technology officer, Colin
Crook,
 have publicly
expressed interest in and enthusiasm for the Web but not yet for
transactional 
purposes.
 
When Mr. Reed was asked during the Treasury conference in September when
Citi 
would offer
Internet banking, he replied, "Not until it's secure." "There is no
absolute 
security," said Mr. Crook,
perhaps the only banker raising concerns about an "information warfare"
attack 
on the banking
system. "It is a risk management issue."
 
The Citibankers contend the risks of cyberspace are fundamentally
different 
from those in other
payment systems, and have yet to be addressed.
 
"Security will be more demanding than even the government itself is used
to," 
Mr. Crook said at the
Treasury meeting
 serves more customers via personal computer than any other, through 
conventional dial-up
connections and with software it developed more than a decade ago. 
 
Citibank also has placed a bet on a digital currency for on-line
transactions, 
the invention of one of
its own vice presidents, Sholom Rosen. The bank claims it will be more
secure 
than competing
alternatives like Cybercash Inc.'s Cybercoins, Digicash Inc.'s Ecash, and
the 
Mondex
smart-card-based system.
 
Putting considerable prestige and intellectual firepower behind its
cautionary 
principles, and behind
the notion that the issuing of electronic currency should be reserved for

regulated financial
institutions, Citicorp has kept alive a debate that is likely to resound
for 
months if not years in public
policy circles, with effects not just on the battle for technical and 
competitive superiority but on the
very consumer behavior Mr. Reed is trying to gauge.
 
Consider some recent twists and turns: The U.S. government continues to 
struggle toward a policy
on data encryption, the technology crucial to on-line transaction
security, 
that would be agreeable to
the high-tech community while addressing national security and law
enforcement 
concerns.
 
A May 1996 report by the National Research Council of the National
Academy of 
Sciences --
Citicorp participated in and vocally endorsed the study -- criticized the

government for being
backward with its restrictions on encryption, particularly regarding its
export.
 (See related article on
page 14A.)
 
Hewlett-Packard Co. in November announced its International Cryptography 
Framework, the first
"strong encryption" method to get U.S. export clearance. While the
framework is 
adaptable to
various and changing government policies, it did not fully resolve the 
controversial issue of access to
encryption keys. 
 
An information security team at the National Security Agency produced a 
monograph (excerpted at
left) critical of the degree of anonymity built into Digicash's Ecash.
The NSA, 
of course, is part of the
establishment attacked in the National Research Council report.
 
Digicash and Mondex, which is being taken over by MasterCard
International, 
continually trade
charges about their degrees of anonymity and security. Both sell
anonymity of 
payments as a
necessary analogue to cash. In that Digicash's anonymity appears more
absolute, 
it may raise more
governmental concerns. But Digicash, the brainchild of the renowned 
cryptologist David Chaum,

accuses Mondex of not being "true electronic cash." 
 
First Virtual Holdings Inc., an Internet payment pioneer, does not trust
Web 
security; its transaction
data flow instead over private E-mail. By contrast, Cybercash Inc.
chairman 
William Melton is so
confident of the available technology that he tells bankers: "Security is

essentially done. Just tell your
customers, 'Don't worry, we'll take care of it.' " (He is more worried
about 
privacy as a political
flashpoint.)
 
Enter the central banks of the Group of 10 industrialized countries, the 
constituents of the Bank for
International Settlements in Basel, Switzerland. This august global
regulatory 
body has signed off on
a moderate, largely laissez-faire approach to the electronic evolution of
money.
 
 
A task force empaneled by the G-10's payment and settlement systems
committee, 
which is headed
by Federal Reserve Bank of New York president William McDonough, spelled
out 
its conclusions
in a 64-page booklet, "Security of Electronic Money," dated August 1996. 
 
The task force was generally impressed by existing security capabilities,

particularly those
incorporating hardware components like smart cards. The report took the 
eight-member task force
less than a year to complete. 
 
Chairman Israel Sendrovic, the New York Fed's executive vice president of

automation and systems
services, asserts that this was no rush to judgment. He personally did
due 
diligence on all of what he
calls "the usual suspects" -- the electronic money schemes not mentioned
by 
name in his report (but
presumably in this article).
 
In a recent interview, Mr. Sendrovic stressed that there are no
absolutes. 
"There is no such thing as
one secure measure," he said. "It's a combination of measures, and the 
combination of measures
changes the risk management of an attack."
 
His measured response to a lot of questions - pertaining to money
laundering or 
the market potential
of electronic currency and how it is to be regulated -- was, "It
depends." He 
did say, in response to
the recent flurry of questions about smart card security emanating from 
Bellcore and other research
laboratories, that the cards were advertised as "tamper-resistant, not
tamper- 
proof." 
 
Mr. Sendrovic said his panel has disbanded, satisfied with its work and
having 
gotten positive
feedback. "Then again, it didn't break new ground," he said. "Remember,
it was 
designed not for the
cognoscenti but for the Group of 10 governors. 
 
"We stay in close touch and follow these things," he said of the task
force, 
adding that it may have
cause to renew its inquiry in a year or two. Though the task force
acknowledged 
"comprehensive
security risk assessments of the entire system" are still lacking, it
said they 
are within reach. 
 
And its words lacked the alarm or urgency of, say, the Citicorp
contingent. 
Sholom Rosen, inventor
of Citibank's Electronic Monetary System, characterized the risks as
"very 
high" and not yet fully analyzed. Digital cash gains legitimacy when it
is interchangeable with other  forms of money, he said, but its
interactions with those systems -- how an attack on one mechanism would 
affect others -- must be studied.
 
And he said he believes the answers do not lie in technology alone but in
the 
fundamentals of the "three pillars of security" -- prevention, detection,
and containment. Where Mr. Rosen sees enormous hazard, Mr. Sendrovic
retains faith in barriers to entry, as might be  expected of someone who
has worked with the dependable Fed Wire for many years.
 
To be legitimate, electronic money "has to be cleared," he said. "At some
point  it has to get into the payment system." Is "the payment system" at
risk of infection from the new  forms of money? Based on what we know so
far, it depends.
 

 ABA Banking Journal, 12/96

SMART CARDS POSE TAX PROBLEM FOR MERCHANTS  

A consensus is emerging that the success of smart cards hinges at least
as much on merchants accepting them as on consumer acceptance. Increased
tax liability is one reason for merchants' muted enthusiasm -- besides
the fact that merchants are the only ones so far being asked to pay for
using smart cards."There's a resistance to forms of payment besides
cash," said Bruce Brittain, whose firm Brittain Associates, Inc., polled
merchants that participated in the smart card test during the 1996 Summer
Olympics in Atlanta. Some merchants admitted to understating their cash
receipts so as to reduce their tax burden, he said. (Smart cards leave an
electronic audit trail by recording deductions in card value each time
merchandise is purchased.)  On the flip side, franchisors may push for
the adoption of smart cards in their stores, since some Atlanta operators
told Brittain, "We want to collect more fees from our franchisees." (The
franchisor's cut of the receipts will be reduced if the franchisee
understates his receipts.) Other sources said they heard the same thing.
The wish to under report receipts may pose a greater obstacle to smart
cards when they undergo their next major test in New York City next year,
because more "Mom and Pop" stores will be participating, Mr. Brittain
said.