cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1997-06-06 - Re: Who “invented” remailers?

Header Data

From: Bill Stewart <stewarts@ix.netcom.com>
To: Tim May <tcmay@got.net>
Message Hash: e31498206953ddb3a241553031d95c207359a2b4b6119aebce80aea2118e9eb7
Message ID: <3.0.1.32.19970605181309.00767c08@popd.ix.netcom.com>
Reply To: <199706040344.XAA12280@muesli.ai.mit.edu>
UTC Datetime: 1997-06-06 01:25:05 UTC
Raw Date: Fri, 6 Jun 1997 09:25:05 +0800

Raw message

From: Bill Stewart <stewarts@ix.netcom.com>
Date: Fri, 6 Jun 1997 09:25:05 +0800
To: Tim May <tcmay@got.net>
Subject: Re: Who "invented" remailers?
In-Reply-To: <199706040344.XAA12280@muesli.ai.mit.edu>
Message-ID: <3.0.1.32.19970605181309.00767c08@popd.ix.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain



At 09:39 PM 6/3/97 -0700, Tim May wrote:
>At 8:44 PM -0700 6/3/97, Hallam-Baker wrote:
>>The point I was making was rather different, I think the total volume
>>of PGP mail of all types is probably not a large enough fraction of the
>>trafic on the net to be secure.  Taking any use of PGP as prima facie
>>evidence of subversive activity probably provides a reasonable cut.
>
>If you mean as prosecutable offense, I don't think you fully understand the
>laws of the United States. Much as we like to criticize the U.S., and bad
>laws, and whatnot, there is no such thing as "prima facie evidence of
>subversive activity," at least not since the House Unamerican Activities
>Committee and Joe McCarthy.

There's prosecution and there's investigation (and there's harassment.)
If the number of people using the remailers and PGP is small,
then it's easier to compile and expand the list of "usual suspects"
who can be checked out more carefully with other means.

For a real-world case, a friend of mine who lives in a Third World kleptocracy
has a copy of PGP, but doesn't want to risk using it except for
very critical mail, because his email and phones are routinely tapped
(it's the kind of place that when he got a new higher-speed modem the
phone company called him up and asked him what he was doing....)
The local thugs were considering stealing the computer that forwards his
email,
but were deterred by the argument that it's password-protected so 
they won't be able to use it if they steal it.  PGP would really stand out,
and could lead to them stealing it anyway - if they were the politically
murderous type rather than just thieves and thugs, it would be a serious risk.
("This is a job for Steganography, man!")

Suppose, for instance, that the Feds (whatever COINTELPRO calls themselves
these days) are watching Alice the Activist, and find that she's using
Bob's Remailer.  So they watch Bob's Remailer, and find it's sending 
traffic to Carol@foobar.com.  Maybe they haven't known about her before.
Or maybe they check with foobar.com and find she's probably Carol the Commie,
who they hadn't previously known used email.  No, they can't prove that
Alice sent mail to Carol - but she's still a lead, and since they're
both politically incorrect people, it's not a bad guess.
Even with multiple remailers, say 10, this still works.

On the other hand, if there are a lot of remailer users, from diverse
communities, with lots of recipients and lots of traffic sources,
this attack is less of a problem -- but it's still a problem.
For instance, if Spam Inc. is sending out 50,000 Spams/hour, 
and the Feds see Carol's name in the remailer's sendmail log,
there's no reason to bother checking up on her further.
However, if they're also snooping the outgoing mail,
and the mail to her was PGP-encrypted, and the 50,000 SPAMs weren't,
then the mail to her is still interesting, even though they can't read it.
You could hack the remailer to insist that all outgoing mail be
encrypted (or at least contain "BEGIN PGP ENCRYPTED MESSAGE"),
which would also cut down on Spamming, but it takes you back to the
case of too few users.

>> How many people in total do you have using the mixers? 
>> How many mixers are there?
>Raph Levien posts his report regularly to the list, plus he has a Web site.

The ghio2 remailer code I used to write my (former) remailer had a 
"remailer-stats" command, that would give you traffic levels.
I don't know how many of the other remailers support it.



#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
#   (If this is a mailing list or news, please Cc: me on replies.  Thanks.)

Thread