Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2464 Thanks!
[Music]
is so welcome to the next talk um a
little behind like a minute um so I make
it very short um the next speaker is
named pyro and the talk is about the 90
cyber war and he grew up in the middle
of
it I am that old
[Applause]
yes
there we are okay so I am pyro welcome
to a brief history of the 9s crypto Wars
because we only have 20 minutes this
will be a very Abridged uh conversation
about the crypto Wars and I apologize
I'm probably going to be speaking pretty
quickly because as you can see from the
agenda there are a few things we're
going to talk about uh some front matter
we're going to talk about pgp and Phil
Zimmerman we're going to talk about the
Clipper chip and skipjack we're going to
talk about Kalia Kevin mitnik the
communications decency act and enhanced
911 as well as a wrap-up
summary so for those of you who don't
know where you are or why you're here
the 9s were an interesting time with
George Herbert Walker Bush and Bill
Clinton in office there were time that
seem replete with parallels to to today
from for various reasons that we'll talk
about um Phil zerman and the
communications decency act um you know
they have parallels to legislation
around the world that is happening today
and we as a group and a society need to
remember these lessons that were hard
fought and hard learned at the time in
order to keep our Communications and our
privacy with us today and going into the
future
so a brief timeline about what we're
talking about in ' 91 Phil Zimmerman
released pgp in '93 the Department of
Justice um had a complaint and pursued
prosecution of him for the same thing
and at the same time uh the Clipper chip
and skipjack algorithm were
released excuse me in 1994 the
communications assistance for Law
Enforcement Act also known as Kalia was
put into law in '95 MN mitnik was
arrested and a 96 enhan enhanced 911 and
the communications decency act were
passed and put into law into the United
States so who am I I am pyro I'm from
Dallas I've been a participant in Dallas
hackers Association in dc24 besides DFW
I work in infosec I've been a CIS admin
I've also been a paint sniffer um I
enjoy dangerous Hobbies you know things
like riding motorcycles doing
professional pirate Technic scuba diving
and walking around Bon Hof's fetal at
night I'm generally grumpy because well
I was a CIS admin so take that as you
will for those of you who thought you
weren't getting a Ula today well you are
I alone am responsible for the content
of my talk my employer wasn't uh a part
of the conversation and while I work in
the Telecom industry I've never been
involved with e911 or Kalia
deployments um it's not a sales pitch
we're not talking about vendors
generally speaking and because
of is which states whoever defiles the
memory of deceased person incurs a
penalty of imprisonment or a uh not to
exceed 2 years or a
fine yes we will be talking about a
couple of people in the middle of these
conversations and they will be safe at
last and this talk is B entirely from
the point of you of me somebody who
lived uh contemporaneously through it in
America
so couple of quotes we cannot allow a
situation where law enforcement's
ability to tackle abor criminal acts and
protect victims is severely hampered
sadly at a time when we need to be
taking more action this company is still
pursuing plans that place the good work
and progress that have already been made
in Jeopardy my view is this simply
cannot be
accepted the other quote while
encryption technology can help Americans
protect business secrets and the
unauthorized release of personal
information it can also be used by
terrorists drug dealers and other
criminals so raise your hand if you
think the quote on the left is
contemporaneous to the time was actually
stated in the
9s okay and those who who think the
quote on the right was made in the 9s
raise your
hand okay um the majority are
correct so the quote on the left is
referring to uh Facebook and that was
made by pretty Patel in
2021 the quote on the right was made in
a White House Press release in
1993 when they were talking about the
Clipper
chip pretty good privacy uh great
program at the time uh still pretty good
it was released in 91 as free and open
source software and it was meant to
allow users to access good encryption
because encryption is hard it was hard
and it was meant to bridge that divide a
little bit and make it easier for folks
the stated goal of Phil Zimmerman was
for victims of oppressive governments
and those in need of privacy to have
access to good encryption so um you know
people who are informants whistleblowers
people like that um people who are
talking to reporters and reporters in D
ous areas it was meant for those kinds
of people um at the time strong
encryption strong encryption was heavily
regulated in the United States it was
treated as arms similar similar to
military hardware 128bit encryption was
restricted 40 bit was allowed for export
raise your hand if you use a 128bit key
for your SSH
key okay most of us don't
anymore um
the uh these restrictions on encryption
that was called the arms cont uh arms
excuse me arms control export act the a
aeca for whatever
reason um pgp was originally posted to
uset at the time and the source code was
made accessible to those who wanted it
shortly thereafter it was published in a
hardback book by MIT press anybody
remember dcss
parallels um we're going to see a lot of
those and it's really hard to enforce
destination country restrictions when
you have no control over who downloads
something when you post something to
uset you know I can't just say I'm sorry
you can't access that because you're not
from
here and because of it the United States
Department of Justice investigated Phil
Zimmerman until 96 for violations of the
Arms Control Act um spoiler warning they
ultimately declined prosecution of
him um as I said because people outside
the US were able to download it he was
thought to have been or alleged to have
been
Distributing um strong encryption to
foreign Nationals which was a violation
the doj ultimately declined prosecution
and at the time in their press release
stated they would not go into detail as
to why to my knowledge they still
haven't in 1994 MIT released uh MIT had
taken the source code and they released
pgp
2.62 which was amongst the community and
amongst um the more hardcore elements of
our group viewed as a compromised
version a lot of people thought that MIT
had sold out that they had hooked up
with the NSA and they had backdoored it
some somehow um those allegations were
never proven out but that taint had
always been there whether or not people
started using it more and more in '97 um
pgp was bought by Network Associates if
you love Network Associates well you
love Network Associates and in 2002 it
was bought by S semantic um broadcom and
uh these days it is an independent
company again
moving on my second favorite topic today
the Clipper chip so it was announced in
1993 there was a full court press by the
United States government they wanted
everybody to have a Clipper chip in
their house they wanted everybody using
this technology the National Security
Administration of the US you know the
people listening to your phone calls uh
they designed this chipset in a bid to
make public key cryptography more
accessible that quote at the beginning
talking about pardon me the quote at the
beginning that was talking about the
encryption and the accessibility for
businesses and people was because of
this they wanted everybody to adopt this
and why did they want it uh why did they
want both business and consumers to
adopt it so they could backdoor your
[ __ ] it's the NSA why else would they
want
it um it used the classified skipjack Al
algorithm for encryption and really when
has a closed
algorithm that you cannot see the source
code for ever backfired for anyone in
the world it hasn't I defy you to tell
me that it
has um and the way that it was back
doored was through the use of Ky Escrow
Services the United States government
was keeping a copy of the private key
for all of these uh skipjack uh devices
in order to decrypt those Communications
when they need to because you know
terrorists and drug dealers and you and
I obviously um there were lots of
opinions about this and the Clipper chip
met with massive opposition from The
Tech Community there there were barrels
of ink printed about this there were
barrels of ink used to talk about just
how bad an idea this was
moving on we have communications
assistance for law enforcement agencies
also known as lawful intercept for those
who are in the community it was supposed
to allow for pointand click wiretapping
instead of having to go into a switch
room and manually connect wires and
things like that you fax over a warrant
to the Telecom provider the Telecom
provider looks at it they tap a few keys
on their keyboard and boom you have a
wir tap and that information is being
transmitted to your agency or
agencies um the fun thing about Kalia is
that the United States government
doesn't mandate how you implement Kalia
they Implement that you do Implement
Kalia so long as you have a uh uh method
that meets their minimal requirements
you are in compliance with
Kalia shockingly enough and it obligates
telecoms and Telecom equipment providers
to design or modify their equipment
facilities and services to ensure that
they have the necessary surveillance C
uh capabilities as uh Communications
evolve that is to say because of things
like Voiceover IP becoming more and more
prevalent because of uh the recent thing
that happened with video conferencing
becoming huge IA comes into play with
some of that most of it and ostensively
if you believe the government when they
tell you things it protects out of scope
information from being gathered when you
have a Kalia intercept on your
information I will leave that as an
exercise to the viewers on whether or
not that's
true so moving on to people let's talk
about Kevin mitnik a little bit um
regardless of how you feel about him and
his recent
passing uh he had been on the Run since
' 92 and at the time rather
hyperbolically the Department of Justice
claimed that he was arguably the Most
Wanted computer hacker in the world at
the time of his
arrest as you do when you have uh as you
do when you tend to have a large stack
of federal indictments coming at you he
plad guilty to some of the charges and
got other ones dropped he ended up
spending 5 years in prison uh 8 months
of that was in solitary confinement and
2 years on supervised release
afterwards allegedly he was not allowed
to use a phone while he was in prison
because Prison officials were worried
that he could start World War III by
whistling into the
handset hyperbolic
much
e911 um argu it's not actually the worst
thing that's happened um it came into
law in 99 it was it was being talked
about it was an um it was starting to be
worked on in 96 it mandated that 911 be
the single emergency number in the
United States phase one required that
the carrier provide um 911 with a phone
number of the caller when they called
911 that hadn't been a mandate
beforehand uh caller ID was still a pay
service too at the time Phase 2 required
location data that is latitude and
longitude to be transmitted to 911 at
that time uh when it came into Force
generally that was within 50 to 300 met
of accuracy depending on the technology
being used and in 2019 it was updated to
require further accuracy because again
things evolve technology
changes and arguably my favorite part of
this entire decade the communications
decency Act of 1996 because everybody
loves decency now Congress learned that
the internet is for porn and decided to
do something about it that never goes
wrong truly persons who are engaged in
indecent or patently offensive Acts were
subject to a
$250,000 fine and or two years of prison
time for doing something naughty on the
internet obviously this was challenging
to the United states that case was Reno
versus the American civil liberties
Union the ACLU sued on the grounds that
the that the CDA violated the first
amendment by abridging your speech um
spoilers it did the case went to the
Supreme Court who struck down the
indecency proposals uh Provisions excuse
me on their Merit I I can only imagine
the justices of the Supreme Court saying
let your porn be
free section 230 uh was introduced as uh
for Safe Harbor Pro Provisions for isps
and telecoms providers what section 230
said was that if you are my ISP and I
come onto your network and I say
something naughty or do something
naughty on the internet I'm the one who
gets charged you are not also an
accessory to that action of
mine um of late some politicians have
been very against this provision and
want it struck down now in the US if
you're a US citizen you really need to
be looking at the Children's online
privacy and protection act you also need
to be looking at sipa and similar
legislation that's being pushed in our
country in the UK for those of you who
live there you really need to be looking
at the Online safety or harms act
depending on how you call it and for
those of us who live in the rest of the
world not those two countries there are
uh know your customer Style laws being
proposed being passed and being put
forth by our governments we need to look
at them we need to find out what they
are and we need to oppose them and we
need to oppose them
loudly thank you everyone this has been
a very brief
[Applause]
talk thank you thank
you so we have a very brief moment of
time uh sorry we have time for two
questions
Max so any
questions over
there thank you for your talk um if you
could kindly say what was the toughest
lesson we should learn from all that
that you presented what would that be
the toughest lesson that we should learn
I think is uh honestly forgetting that
these things have happened um the this
talk came about because talking to to
others in our community I brought up
things like the Clipper chip and just
was met with dumb struck stairs like
what what are you talking about we have
to remember these things happened
because it's a cycle and these these
terrible proposals from the 9s are
coming back up and they keep coming back
up thank you and the second question we
have somebody in the back
yeah for thanks for the entertaining
talk what's the most positive thing that
happened in the '90s so besides all the
bad laws do you also have something good
that we could learn from
them I would think the most positive
thing was our community got uh a lot
closer a lot stronger uh things like
Camp things like CCC things like Defcon
all started and we we were able to
communicate a lot more effectively and a
lot easier at the time
thank you thank
you