[Noisebridge-discuss] Deep Crack

[Kelly]

Jeffrey, (and list)

I can acknowledge your insistence that this isn't a threat and that
you appreciate the value of Deep Crack in the space, but it sounds
like your missive is primarily re-addressing the debate from
yesterdays meeting, and it sounds like you aren't totally satisfied
with the outcome?  That's understandable too of course--it was a
pretty classic unresolved noisebridge debate.  But I did think that
some of the issues you bring up were addressed reasonably well at the
meeting.

> However, I object to it being at Noisebridge, as it violates our
> current policies

I think that several members made a point to stress that there's no
policing involved with this, and that the point is to be excellent to
each other.  Given this maxim, I'm going to proceed with the
understanding that many members of noisebridge are pissing themselves
with excitement over this machine that really means very little to me
personally, so I'm going to try to respect their geeky joy.

> We explicitly do not allow donations with strings attached.

And we explicitly discussed allowing loans of super fancy exciting
things, especially when (I appreciated Michael's point on this) they
are for a specific project, and it sounds like this will be a
contained project.

> For a machine with this much value, I would NEVER accept a verbal
> agreement stating that we would not have liability.

I feel like actually, I probably would accept a verbal agreement with
John Gillmore.  I have immense respect for him.  Although if a written
agreement is all it would take to make you more comfortable, that's a
possible productive solution you could put forward.  I think that you
don't mean for this to be disrespectful and critical, but it sort of
sounds that way.

> I was told it's $300/key to crack.  I've also been told that you and
> others have offered to pay for the power to run this so that
> Noisebridge doesn't get the burden.  But, due to two factors it's
> sadly not that simple.

I think that the cost is a reasonable concern, and I would be
concerned about that myself.  However, I think that the people
involved in this project sound totally willing to be accountable for
the costs, and I'm willing to assume good faith that they will attempt
to genuinely cover them.  And if Noisebridge subsidizes the cost
somewhat, I really don't think that's a big deal.  If it turns out
that people are using Deep Crack round the clock for months on end,
cracking the many DES cyphers out there in the wild, we would
certainly revisit the cost issue.

> This is obviously the #1 concern.  Whether or not it is legal for a
> non-US citizen to be next to our touching the machine is a huge
> concern.  Even the hint of doubt that it may be a problem should keep
> this out of the space.

I disagree with your "hint of doubt" logic, but I think that this is
also a reasonable concern.  I would like to see Jake commit to posting
more thorough details about the legal situation once he's talked to
the EFF.  If however, the situation sounds reasonable (which so far it
does), I don't think this is a dealbreaker.  As far as I understood
it, the issue is not with touching or being next to the machine, but
operating it.  Luckily, I don't think you can trip and fall and run a
DES cracker.  So it sounds like a sign would be sufficient to prevent
mishaps.  I think that this could be a dealbreaker for any permanent
installation in noisebridge though, so I'm not sure if I would support
noisebridge taking Deep Crack permanently.  But for a limited
excursion into the world of DES cracking, it seems not too bad.

> We could never guarantee that only citizens would operate the machine.

I don't think we would have to.  But Jake can clarify the EFF's
recommendations on that.

So, those are my thoughts.  I hope that we can have an excellent
discussion about your concerns, Jeffrey.

-Kelly

On Wed, Oct 7, 2009 at 10:47 PM, Jeffrey Malone
<ieatlint at tehinterweb.com> wrote:
> I fully understand the historical significance of this machine, and
> the prestige that Noisebridge would have in hosting it.
>
> However, I object to it being at Noisebridge, as it violates our
> current policies which you yourself have vehemently defended, and
> leaves us open to a large amount of liability.
>
> On Wed, Oct 7, 2009 at 10:07 PM, Jacob Appelbaum <jacob at appelbaum.net> wrote:
>> I had a conversation with John Gilmore today about picking up Deep
>> Crack. During our discussion, I asked John about donating the machine
>> and about a receipt and so on. To my surprise, he isn't ready to
>> transfer ownership of the machine to Noisebridge at this time. This
>> outright solves any tax concerns, although such concerns would have been
>> John's burden anyway (it's up to him to value the item, not us -- we
>> just confirm that we received an item).
>>
>
> We explicitly do not allow donations with strings attached.  This is
> one of the two strings that come with this (the other I discuss below
> quoting your reference to it).  Loans have not been regarded as
> acceptable due to the ability for the owner to remove it, and due to
> the risk that people could damage or alter the item.  What if we
> damage it?  Either someone altering it, screwing with it,
> incidental/accidental damage, etc.  What kind of liability would we
> face?
> For a machine with this much value, I would NEVER accept a verbal
> agreement stating that we would not have liability.
>
>> I'm going to lead a time limited project involving Deep Crack. The goal
>> of this project will be to understand the history of the politics
>> surrounding DES, a study of the machine itself and we'll hopefully also
>> actually crack some DES keys at some point during this project. I hope
>> we can find something in the wild to crack (found ciphertext, is that
>> like found art?) but I'm also happy to attempt to crack a specially
>> crafted message just for the purposes of learning!
>>
>
> I was told it's $300/key to crack.  I've also been told that you and
> others have offered to pay for the power to run this so that
> Noisebridge doesn't get the burden.  But, due to two factors it's
> sadly not that simple.  The first is the actual power usage -- how
> many amps does this require, and how reasonably can we provide it
> without causing the rest of the space to be deficient?
> Secondly, PG&E bills electricity on a tiered system.  Thus, the more
> power you use, the more expensive it becomes per kWh.  This means that
> even if you pay the $300 for a key to be cracked, the power
> Noisebridge normally uses will cost more.  Attempting to calculate out
> how much that additional cost would end up being is going to be an
> overly complicated task.
>
>
>> From a legal perspective, I do not believe that being near the Deep
>> Crack machine is going to pose a problem for non-US citizens. Deep Crack
>> was famously run a number of times, it even won awards for these runs! I
>> might add that it was quite the spectacle, so it wasn't simply
>> unnoticed! I have stood next to a non-US citizen holding a part of the
>> machine. As I understand it this is not a violation of ITAR in spirit or
>> in the letter of the law. I'll talk with John about this tomorrow too.
>> He has spent a long time fighting ITAR and is probably the best person
>> on the planet to talk with about it.
>>
>> I do however believe that a non-US citizen should not attempt to run or
>> use the machine. This issue will not preclude any such persons from
>> _learning about the machine_ or its history.
>>
>> I will attempt to talk with the relevant legal minds at the EFF and
>> until then, I ask that people who have a concern about their respective
>> visa situation to not touch the machine. It seems clear to me that if
>> you're not sure if you should touch such a system, please be reasonable
>> and do not do so.
>>
>
> This is obviously the #1 concern.  Whether or not it is legal for a
> non-US citizen to be next to our touching the machine is a huge
> concern.  Even the hint of doubt that it may be a problem should keep
> this out of the space.  But Noisebridge has many members who are not
> citizens -- and I fully reject us having tools in Noisebridge that
> only a subset of our members can use.  It goes against our policies,
> and leaves us open to a huge legal liability that could result in
> Noisebridge being dissolved.
> We could never guarantee that only citizens would operate the machine.
>
>
> There are also many other issues with this, but I feel the ones I've
> put forth to be the most pressing.
> Until these questions are satisfactorily resolved, I do not feel that
> this should be in Noisebridge.
>
> Also, while this is not in ANY way a threat, I would remind you that
> our policy currently does not allow private property to be stored at
> Noisebridge with any guarantees that it will remain intact or unused.
> I can honestly state that I would not participate in anything, but I
> want to make it clear that our current policies explicitly say that
> the integrity of the machine is in no way guaranteed or even
> suggested.
>
> Jeffrey
> _______________________________________________
> Noisebridge-discuss mailing list
> Noisebridge-discuss at lists.noisebridge.net
> https://www.noisebridge.net/mailman/listinfo/noisebridge-discuss
>