 This meeting was held in exciting Las Vegas, Nevada from July 9th through the 11th, 1999. This is video tape number 47, Crypto Tales. Okay, so... That's a bit loud, I think. Okay, so... I'm Simeo. I've been doing crypto stuff for a few years now. So I'm going to tell a bunch of stories about stuff in the crypto industry, stuff that I've done with my company in the past, stuff that other people have done in the crypto industry, some amazing stories you might not have heard before. But if anyone has a specific story they'd like to hear it that I might know, feel free to request a story, because I might know the story and I could tell it, and so that could be fun. And so, I mean, to start off, does anyone have any specific requests to begin with, or should I just come up with my own list of stories to start with? Requests? Okay, so let me come up with a story. Oh, you do? Okay. Okay, I don't know that story very well, because I wasn't there, but I can tell that story. So... I can make it up, too. So apparently, the story of this... It's not a very long story, because I wasn't there. So Jim Dude's eyes is a bit like talking to some NSA people. So this was actually a long time ago. This was probably in 92 or 93 or something like that, long time ago, on the grand scale of things, of course. And of course, RSA has had an interesting relationship with the NSA, because of course, they always get expert license. They've already made up... for the couple's cryptography and stuff. So they have to maintain a good relationship with the NSA. But of course, they also have to maintain a good relationship with the crypto community and claim and have a very antagonistic attitude with the NSA in the public eye. So it creates an interesting perspective, because RSA has to kiss the NSA ass on one side, and they also have to kick their ass on the other side. So I'm not sure if this was actually the case back when this happened, but apparently Jim Dude's eyes likes to tell the story of how when at one point he was talking to some NSA guys and they were being assholes to him and he was being an asshole to them. And then they just said rather casually that they could just fix this out in the parking lot with a car running over him. And so he didn't appreciate that very much. And so he started telling lots of people and people were kind of amused by that. And it was kind of hard to say whether or not that was an actual death threat from the NSA or whether or not Jim Dude's ass just invented that story for his own personal amusement or for his own personal advantage or if they were just joking and just like whatever, we're really not going to kill you. You're just a dumbass if you think we're going to kill you kind of thing. So that was the Jim Dude's ass story. So okay, let's see. So I started my company C2NAT in 1994 as an internet service provider, internet privacy company. So what I was doing then was I started the company in 1994 because I was living in California. I had been living in California for about a year and I was going to all the cypherpunks meetings and all of these people were saying, oh, we're going to implement anonymous technology and the government's going to be relevant and we're all going to have a lovely anarchy and life will be great and everything will be hunky-dory and we won't have to pay taxes and it will all be good. But all of these people were like, okay, this is all going to happen and they said, oh, all this cryptography technology is going to make all of this stuff happen. But they thought that angels from the sky were going to come down and just tap the magic wand and then all this technology would exist and it would be deployed and people would use it and people would make money and they wouldn't have to pay taxes and it would be all good. But of course, I knew that that was never going to happen and there were angels who were going to come down from the sky to solve all our problems for us. So I started my company in 94 to solve those problems, hopefully. And so I started out in 94 and it was kind of fun. We did anonymous web hosting, anonymous site, anonymous mail, anonymous web hosting, anonymous pseudonyms. We did a lot of, the pseudonym stuff is very similar in design to the mail services done by Zia Knowledge today. They're actually doing a company which will make some money at it as opposed to my company which didn't. But the basic idea is that your mail gets forwarded to a bunch of different hops so that it can't be traced. Now, I built this system because the traditional anonymous servers such as AnandbatPnet.fi were built with a very similar point of failure in them. If you had an accountant in AnandbatPnet.fi and say someone like the Scientologists wanted to find out who you were, all they had to do was go to Finland, spend lots of money, and buy me the Finnish government or whatever you have to do in Finland to get your way. And then what they end up doing is getting access to your real identity because they use this, all of the actual sensitive information is actually stored in one place and all you have to do is break into the computer or subpoena the computer or whatever and you get all the sensitive information and that's not very safe. So I set up the system so that even if my server was subpoenaed I wouldn't actually be revealing the real identities of the anonymous users. So I set up the system and people started using it and it was all good. And people were using the AnandbatPnet.fi system because a lot easier to use. So my system was being used by the ultra paranoid and the AnandbatPnet.fi system was being used by the less paranoid. And so it was all good. There was a nice marketplace for everybody in the community but then the Scientologists actually did spend a lot of money and they went to AnandbatPnet.fi and they convinced the Finnish government to, at first they wanted to get the entire database of all the anonymous identities mapped to real identities. And the Finnish government has much stronger protections for privacy than the US government has so they actually, it was actually very difficult for the Scientologists to get that information. They had to go to court many times and spend lots of money on legal bills. I'm sure the Scientologists were happy with that situation because they made lots of money off the deal. But so there was a lot of work and in the end the Finnish government did end up caving but they didn't want to give up the entire database. They said, well, you're only looking for two guys so we're just going to force Pnet.fi to reveal the two guys. So the Finnish government eventually caved in and Johan, who was running Pnet.fi was pretty much devastated by this. He had previously thought that his security model was going to work because the Finnish government was on his side. He later learned, of course, the Finnish government wasn't on his side. They only had these laws because there was one level of protection against the attack but of course the Scientologists managed to breach that level of protection to the Finnish laws he was relying upon. So because he was so upset over this he shut down the Pnet.fi server and now no one can use the Pnet.fi server because he didn't want to give people a false sense of security. What I was saying, what I was doing when I tried to market my product was of course saying that he was giving people a false sense of security but in fact as long as it's marketed right it's not a false sense of security you just know how much security you're getting and you can either go to Pnet.fi if you want something that's easy to use or you go to my server and alpha.cg.org if you want actual security that can withstand the Scientology attack. So so when we shut down, everybody was upset there was all sorts of clamoring oh no, it's being shut down, the Scientologists suck we should kick their asses, you know whatever. You know, eventually we got an EFF Pioneer award which was all good we were all very proud of him for that and then things eventually slowly died down my company changed focus which I'll get to later and but after about three years or so according to Finnish law after three years the records for an investigation need to be opened up so the Finnish government released the records for the investigation and the records included the real identities of the people the Scientologists spent a lot of money trying to get and it turns out that the so called real identity is hidden by the Pnet.fi service we're actually pointing at my pseudonymous server which there would have been no way the Scientologists would have gotten with that and they could have tried to sue me they never actually contacted me so I figured they knew that they would have had no hope if they tried contacting me because I actually probably wouldn't even need to disappear at that point I would have just given them some ciphertext which they couldn't decrypt I probably would have asked for a subpoena because it would have cost them more money and it's always good to make the Scientologists pay it's pretty cool because we knew that the Scientologists spent huge amounts of money trying to get that information and then they couldn't get it so I saw another Scientologist or this one's kind of amusing it's not really crypto related but it's still kind of cool a friend of mine was working as like a network engineer at it was an internet family's coast and they had a customer the Scientologists didn't like so they called them up they called him up and he was just the guy who answered the phone at the time because it's a small company they didn't have huge banks of tech support people answering the phone or anything like that back then so anyway he answers the phone he says they say to the Scientologists like oh well you have to talk to a legal department and then they go to the legal department the Scientologists eventually sue us and they of course name my friend as one of the plaintiffs in the lawsuit because he picked up the phone and so anyway whatever they sue us the case gets dropped and so they settle on it but then a few years later my friend stops working for us and he's working for a company in San Francisco he's walking around San Francisco one day and he sees a Scientologist and he's like cool we're going to go to the Scientology store and see what let's see what I can do like buy a Dianetics or something similar like that so he goes into the Scientology store and this guy, this person at the counter she looks at him and she's like hey aren't you that ISP guy he gets very scared and turns around and ends away okay so so let's see so I was running an internet service and so people would get accounts and all of this sort of thing and in 1996 I came out with a product called Stronghold which is a web server based on Apache which adds SSL capabilities at the time the only value is that it added SSL capabilities now there's like lots of marketing literature about what other value it adds but at the time all we did was add SSL to Apache and and so the company at that point the company wasn't really making any money off the web hosting and the anonymous mail services and that sort of thing I still had a day job I was contracting an SGI and all sorts of things so I knew that the software business was going to make lots of money and the services business wasn't making lots of money I would have had to invest heavily into that the margins were low all sorts of things like that so I was migrating off of that and then November 1996 was around and I grew to this conference in Florida whatever it was a pretty boring conference but by the time I'm done with the conference I'd gotten all these business leads I was really hyped I was really psyched about doing business I had set up by that point offshore development centers all over the world and I was thinking well what could the NSA do to shut me down and I realized that since I was still doing web hosting they could just plant some child porn on my site and you know go after me for child porn and that would suck so I'm thinking okay I really need to finish that whole migration away from web hosting because that's sort of a liability and then I get home I'm in the office on Monday and we just moved into a new office and so the office is all still in shambles and I'm still putting together my desk and all of this and some guy walks in he has me a sheet of papers and he says you are served I'm like hmm what's this and it turns out that we had been sued for a contributory copyright infringement by Adobe Traveling Software and one other company whose name escapes me but anyway they sued me and me and my company for contributory copyright infringement which is not child porn but it was based on the fact that we had some customers hosting web pages on our site that had allegedly material which the SPA the Software Publishers Association considered to be contributory copyright infringement so these three things were serial numbers for us information about how to crack copy protection and links to sites which host wearers they didn't actually claim that we had any wearers on our site they only claimed that we had links and information and of course the reason they sued me which I later learned is that a few months prior to this they sent out a email to a large number of internet providers who apparently they knew had some sort of wearers links to wearers or whatever on their site and the email basically said please give us a call and we will sue you so I never got that email apparently my mail server was flaky or whatever I didn't know what was going on but anyway all the ISPs who did get that email they all called up the SPA and the SPA's response was sign this code of conduct and we won't sue you and this code of conduct the SPA wanted people to sign was pretty heinous it would have required that the internet providers monitor everything every one of their users did and at that point the various lawsuits had been resolved which showed that an ISP is not liable as long as they don't monitor and moderate their traffic so by monitoring traffic and agreeing to this code of conduct ISPs were actually signing up for more liability than they had in the first place so most of the providers who received that comment from the SPA please sign this code of conduct and we won't sue you did decide to sign the code of conduct because they were afraid of the SPA two providers, GeoCities and Tripod didn't sign they were like this is bogus we're not going to sign this and so they didn't sign and I of course didn't sign because I had no clue that they wanted me to sign this code of conduct so GeoCities, Tripod and C2Net all received this lawsuit and it was very clear from their announcements from their tactics that the lawsuit was not meant in any way to actually go to court or actually be concerned with the fact that we allegedly had contributory copyright material on our sites they just sued because they wanted us to settle sign the code of conduct and then they would drop the lawsuit and so they dropped the lawsuit and GeoCities and Tripod and GeoCities and Tripod both decided to settle they were in the course of negotiating with investors and things along those lines and they didn't want the investors to be afraid of the lawsuit and all that sort of thing and so they negotiated with the SPA and settled by signing a code of conduct which actually wasn't heinous so they did settle which I think was kind of lame but they didn't actually sign a code of conduct which actually restricted them in any way the code of conduct basically said we were a bit of a law so it wasn't anything new but I was kind of frustrated that they did settle because of course the SPA could then claim the victory I of course didn't settle the SPA I called up my friend and I got on the FF and he was like help, what do I do and so he referred me to a very good attorney in San Francisco and we told the SPA that they were smoking crack at first they wouldn't even tell us which ones of our customers had the allegedly contributory copyright material so well the first thing is that what they claimed was contributory copyright was in fact protected speech so if they wanted to take this to court and if we did in fact have what they claimed was on the site we would have taken it to court and we would have won but and they probably knew this but of course they were interested in going to court they were just interested in getting some press and having a bunch of people sign those stupid little code of conduct so so we so it wasn't actually the SPA that sued us of course because the SPA itself is just a trade organization that has no standing what the SPA does is they have a bunch of member organizations and many of their member organizations sign over power of attorney to the SPA so that the SPA can sue other people on their behalf so the fact was adobe and traveling software didn't even know that they had sued me so we called up adobe and we were like why are you suing us this is so anti internet and adobe was all into this web publishing thing so like we're not anti internet we didn't know about this lawsuit we vow all knowledge of this lawsuit the SPA sucks you know but and we didn't actually get significant contacts at traveling software or the third company which name I don't recall actually the misspelled traveling software's name in the lawsuit which I thought was pretty funny um so so we didn't even know which one of our customers had the allegedly contributory copyright material on the site so my attorney calls them up and is like well you know you claim that they got contributory infringement material on the site why don't you tell us which customers at first they alleged that I and my company were actually engaged in contributory copyright infringement because that's actually what the lawsuit said it didn't say that I was liable for the acts of my customers which they implied but which they meant to say but they actually said I was doing contributory copyright infringement so anyway um they called and said well which one of these customers are doing the contributory copyright infringement and the person the attorney who actually sued me on this case was like um I don't know let me get back to you on that so after much harassment they eventually told us who was these two random customers of those and um and so then I went and took a look at their website and all I found on those websites was the Alt Biner as well as FAQ and so that was clearly protected speech so we told them you guys are on crack this is all protected speech um you guys need to drop the lawsuit and then it was about the they filed for the lawsuit and served notice to me on one day and I believe we had 21 days to file a response and of course filing a response would have been pretty expensive and I didn't want to spend the money so I didn't actually tell our attorney to actually start writing the response so it was about 5 days before we had to file the response and our attorney was just telling them you guys really need to drop the lawsuit because if I start working on filing a response and then we counter sue you guys are going to be liable for my legal fees and it's not going to be cheap so they dropped the lawsuit um but they dropped the lawsuit without prejudice which basically means that they reserve the right to file it again and I believe that they dropped the lawsuit because there was confusion over whether or not I had received that initial email not because they had no case and they were total dumbasses but they claimed that okay we're dropping this lawsuit is a good faith measure but we still want you to sign the code of conduct and if you don't sign the code of conduct we might file the lawsuit again and I told them that they needed to apologize and recover my legal fees before I would even answer their telephone calls and they didn't apologize they didn't give me my legal fees back and of course they didn't sue me again because they had no case so it turned out after this lovely adventure I learned that all of the SPA members the only three SPA members that had given me SPA power of attorney were those three companies that had sued me so I'm not into the details of the SPA but they didn't apologize and they didn't give me any money I would have preferred if I had to pick one or the other the apology or the money I would have picked the apology because it wasn't a whole lot of money and I got a lot of press out of it so I thought it was cool but I really thought that because they didn't apologize that other internet providers were at risk of them doing the same thing to them and that was just clearly a bad situation so if they apologized and acknowledged the fact that what they did was wrong they sued me just because they wanted me to sign a code of conduct and it was just a total bullying tactic but I thought okay these people maybe we'll see you in the light of day and we'll talk to them on a reasonable basis as a human to a human as opposed to treating them like the scum they are so anyway that was the so I learned that the only three companies that now at that point within the SPA power of attorney to sue were those three companies so I guess they are sort of losing respectability within their customer base which is a good thing because of course software piracy isn't such a good thing I've made a significant amount of money selling software and I don't like my software pirates so the SPA not being the organization to protect against piracy is a good thing it was kind of losing because I was a privacy company so I always say piracy but I say privacy by mistake and it would be all very confusing so that's the SPA story let's see more stories 4th of July what's the 4th of July story oh yeah okay after that story that's kind of fun so anyway so I'm this is 1997 and I'll tell you this is I'll tell you the earlier 97 media story first because it's kind of funny so in May 96 in early 97 I had a bunch of friends and a bunch of people from C2 and we would always go to a breakfast brunch at the Thai temple in Berkeley every Sunday morning so I was there and one day a bunch of new people who I'd never met before from Japan were there and they were all chatting and they were apparently from the press and they were doing they were doing a what a documentary on cryptography so I was like okay cool I got the name and all this stuff and then they went back to Japan did some more research came back and then they decided they wanted to cover C2 and PGP so they allocated two weeks to cover PGP and two weeks to cover C2 and the first two weeks they allocated was the first two weeks of February and that was PGP so they covered PGP during that time and then the second two weeks was the was the recovery of C2 now but we told them well if you're covering us that's not going to work so well because the first week is fine because we're going to be in the office and you can film us and whatever we can take interviews and all this but the next week we're going to a conference in Anguilla and Anguilla is a small island three miles from St. Mary in the eastern Caribbean it takes 15 hours to get there you have to take a small airplane to get there there's only about 8,000 people who live there they have no taxes we're going to a conference there and so we told them we'll be gay if you film us and all but we're going to this conference so they called back to the home office like can we go to Anguilla? the home office is yes so they fly to Anguilla but I didn't notice I just thought okay they're back in the hotel they'll be in Anguilla, they'll be filming us so we're all good so we're getting off the plane in Anguilla it's a small island of planes we have to climb down the stairs under the term I look out at the terminal and there's this really bright light flashing in my face I'm like what's that? oh it's a camera oh it's the NHK guys so we're film blocking off the plane so that was a lot of fun and so then they were hanging out with us for over the course of the next week filming us in Anguilla and it was really cool, I was interviewed while sitting on a porch with St. Martin my back and my hair was blowing it was just a total rush crypto crypto interview and they showed that eventually on Japanese television on the national PBS equivalent in Japan and then we were on a mirror we were continuing to do public relations and big press and there was this guy from Forbes who at first was supposed to be doing an article on electronic commerce and visa and SET and all of this so he started talking to a bunch of people in the crypto community and he realized after talking to a bunch of people in the crypto community that SET and visa and electronic commerce were all really boring and the really interesting thing was tax evasion tax avoidance, sorry so he's like these cyber punks who are really interested in tax avoidance and by that point I had grown old and jaded and I wasn't really interested in tax avoidance I just wanted to make lots of money but he wanted to do an article on tax avoidance so of course I was still on that which is libertarian, I just realized there was no way I was ever going to win so anyway, he talked to a bunch of people in the crypto community and they were like, hey, you should talk to Sino so he was like, okay, he comes and talks to me on Friday, July 3rd at the office and we chat and we have a good time, we talk for like 2-3 hours or something like that and it's time to go home because I have a meeting or whatever and so he's like, oh, I still need to talk to you some more can we talk tomorrow? so we get together in a cafe in Berkeley and there's something else, July 4th of course, it's a holiday so anyway, so we meet in this cafe and we're sitting down and I'm like, oh, I like this holiday we get to celebrate everything in the government and he interviewed me and it was all good and then a few weeks later actually, a few weeks later a photographer came and he took my picture he took pictures of other cypherpunks it was all good and then I got an email from him sometime in early September or early August saying the final issues of the magazine, the first pressing was off the press or whatever I'm sending it to you by next day now I think you'll get a kick out of it so he sent it to me on Friday I was actually in the office on Saturday because I was working on some webpages or whatever and I showed up at the office one of my coworkers had already been there and he throws this magazine on my desk which has this picture of me on it and it says this guy wants to overthrow the government so wow, that's wild so I opened up the magazine and I was like oh this is really weird and I look at the article and it starts out saying I like this holiday you get to celebrate everything in the government and so that was pretty cool and the article was just an excellent article I talked about how tax avoidance was the patriotic thing to do and all sorts of things like that it had a really good page layout system because every spread on the left there'd be a picture of a cypherpunk who talked about how tax avoidance was a good thing and on the right there was a picture of some big big banker like the head of city bank talking about how tax avoidance was a good thing so it was a really balanced perspective you've got the radical whackers like us and then you've got the straight conservative people who are all into it as well so pretty good article, I had a lot of fun everyone made a lot of fun that looks like out of time so thank you