12 February 1998: Add call from Graff

29 January 1998: Add message on Graff calls

28 January 1998: Add message on Jon Graff's version
28 January 1998: Add responses
28 January 1998: Add messages on Cylink employees

27 January 1998: Link to news, "Online Stock Talk Fuels Lawsuit"
27 January 1998: Link to informative online Cylink investor thread
27 January 1998: Add Steve Schear messages
26 January 1998: Add other Cylink messages from William Payne

26 January 1998

Date: Mon, 26 Jan 1998 07:35:54 -0800
From: bill payne <billp@nmol.com>
To: kalliste@aci.net, jy@jya.com
CC: George.Breznay@hq.doe.gov, Ann.Augustyn@hq.doe.gov,
Subject: Jon Graff

Monday 1/26/98 7:19 AM

John Young
J Orlin Grabbe

I spoke with Jon Graff on Sunday night.

Graff is concerned that someone might get sued by
Cylink for release on Internet of the information linking Cylink
to organized crime through Ademco.

When I bought about six  CY 1024 crytpo chips for over 
$1,000 each for Sandia, I though there was something

Graff later supplied me the information about Lew Morris 
and the ties of Cylink to Ademco and organized crime.[See note]

Graff told me last night that most of Morris’ cronies had
been removed from Cylink.

Cylink, Graff told me, has gone public.

Graff is concerned that information I relayed on the net
might hurt Cylink stock.

I commented to Graff that it might be a good idea to get
this matter settled.  Bet the word speads


Date: Wed, 14 Jan 1998 07:33:55 -0700 From: bill payne <billp@nmol.com> To: jy@jya.com, j orlin grabbe <kalliste@aci.net> CC: miles.smid@nist.gov, edward.roback@nist.gov Subject: Miles Smid, Jon Graff and Cylink Wednesday 1/14/98 7:03 AM John Young J Orlin Grabbe Jon Graff WORKED for Cylink. Graff is a buddy of Miles Smid and Elaine Barker of NIST. Graff is responsible for sending me a copy of my paper on RSA cryptography which is posted at jya.com. The paper I DID NOT SEND to Fushimi at U Tokyo. Graff got fired from Cylink with urging from NSA. Graff told me about the Cylink - mob link. Cylink is owned by Ademco, who also owns Pitway - First Alert, the smoke detector people. John Foster, the director of research at Ademco in New York, visited, along with two of his subordinates, me at Sandia. Foster gave me several motion detectors Ademco manufactured. Lew Morris at Cylink, I was told by Graff, was the New York mob representative which watched over Cylink. I had breakfast with Jim Omura, President of Cylink [who also got a copy of my SAND report now seen at jya.com], and Morris in Sunnyvale. I was impressed how careful Omura was about what Omura said during our breakfast conversation. Morris had a stroke and is no longer at Cylink, Graff told me. I read yesterday that Cylink got approval from the government to export crypto gear. I wonder if it is spiked? Let’s all hope for settlement of the unfortunate matter before it gets WORSE. bil
Date: Monday, 26 January 1998 To: Gene Carozza <carozza@cylink.com> From: John Young <jya@pipeline.com> Subject: Cylink and organized Crime? cc: billp@nmol.com,kalliste@aci.net, George.Breznay@hq.doe.gov,Ann.Augustyn@hq.doe.gov, Federico.F.Pena@hq.doe.gov,cypherpunks@toad.com Mr. Gene Carozza Security Public Relations Cylink Corporation Dear Mr. Carozza, We have received two recent e-mail messages concerning Cylink's alleged links to organized crime. The messages may be seen on the Web at: http://jya.com/cylinked.htm This is a serious charge. Could you provide information to answer it? Sincerely, John Young
Date: Mon, 26 Jan 1998 09:52:06 -0800 To: John Young <jya@pipeline.com> From: Gene Carozza <carozza@cylink.com> Subject: Re: Cylink and Organized Crime? Cc: billp@nmol.com, kalliste@aci.net, George.Breznay@hq.doe.gov, Ann.Augustyn@hq.doe.gov, Federico.F.Pena@hq.doe.gov, cypherpunks@toad.com Dear John, Thanks for your inquiry. These "serious charges" are completely inaccurate. Regards, Gene C.
Added 26 January 1998 after receipt of Mr. Carozza's message. Other Cylink messages from William Payne: Tuesday May 13, 1997 06:45 John Young, On Sunday I got a call from a fellow in California. The guy worked for Cylink. Cylink builds crypto units - and has also been in litigation with RSA. Jim Omura, president of Cylink, also received a copy of my whistleblowing SAND report. Omura kindly sent back to me copies of the DRAFT I sent to Fusimi and the RSA paper I wrote, but didn't sent to Japan. The fellow told me that Cylink's 'financial' head, Lew Morris, had a stroke and is no longer involved with Cylink. There is some stuff I would like to tell some reporters about Cylink, its ties to Pittway, parent company Ademco [in NY] and organized crime. The smoke and CO detector, I understand, business is largely penetrated by the mob. And, naturally, the crypto business is also appealing to organized crime. Later, bill
Wednesday May 14, 1997 12:17 John, I sent by snail mail a copy of RSA Encryption. RSA Encryption is the 'senstive' paper Sandia accused me of sending to Japan. I DID NOT. RSA Encryption was written in about 1986 at the request of my Sandia supervisor, John Holovka [a phd chemist] and my project leader Jim Durham [a ee ms] to explain public key to them. Sandia cryptographer, Gus Simmons, was trying to sell management on the idea of using public key for treaty verification. This paper had an intent to discourage Simmons' idea. NSA employees Mark Unkenholtz and Ed Georgio were also against public key. Sandia had a horrible experience with public key. Simmons, Ernie Brickell, and Mike Norris [now dead] pushed Sandia to build hardware public key chips. Two of them. I enclose a copy of an article written by Whitfield Diffie about the Sandia slow speed chip. The Sandia high speed chip has a very nice byte parallel interface. The Cylink cy1024 has a terrible synchronous serial interface. The horror story is that Sandia's Center for Radiation Microelectronics had vast problems building any kind of chips. Sandia's chips were placed in the nuclear arsenal. They had a 100% failure rate over several years. It cost $300,000 each to bring the nukes back to Pantex to repair Sandia's failing chips, weapons component supervisor Jerry Allen told me. Sandia/NSA, I learned from Ron Kulju, who was doing bomb work using the cy1024, [we cooperated - Kulju designed the cy 1024 oscillator, I did the test software], was busy removing ALL public key from the weapons systems. The cy1024, which I used for a Bureau of Printing and Engraving and tagging project, cost more than $1,000 each! Only the government had the bucks to buy the chips. Ademco, Pittway, Cylink, I have been told, are tied to organized crime. Later, bill
John, I just read, 28 May 1997, Business Wire: Cylink Corporation elects former Secretary of Defense William J. Perry to board of directors Sunnyvale, Calif. -- Cylink Corporation, a leading provider of comprehensive information security solutions for the enterprise and Internet markets, today announced that it has elected William J. Perry, Ph.D. to its Board of Directors. Dr. Jon Graff who worked for Cylink and who I sent the envelope containg the ieee reviews of RSA Encryption told me about the Cylink organized crime link. The Cy1024 cost over $1,000 each to just compute a+b, a*b, and a^b mod m. Sounded suspicious to me. But I did buy about 6-8 Cy1024 chips to use in a bureau of printing and engraving and electronic tagging projects when I was at Sandia. best regards, bill
[June, 1997] Andrew Veturbi is one of the principles in QUALCOMM. Verturbi was educated at MIT. Here is the connection of Veturbi and the stuff you posted. Jim Omura, president of Cylink [Ademco - and the MOB!] and Veturbi co-authored a book on coding. Omura is a prolific book writer. Omura sent me the RSA encryption paper and RSA is Easy to Break since Sandia confiscated my copies. Omura also received a copy of the SAND report you posted. Scott Shane of the Baltimore Sun asked me for a name of someone I though might talk about NSA spiking crypto units in the USA. I gave Shane only one name and phone number. Jim Omura. Later, bill
Monday August 18, 1997 07:02 3umoelle@informatik.uni-hamburg and John Young, Dr. Jon Graff [408-262-9577] is a chemist by education. Graff worked for Cylink on cryptographic protocols. Jim Omura, president of Cylink, gave Graff a copy of the RSA Encryption paper posted at jya.com. I sent Graff the unopened envelope containing ieee reviews Ted Lewis sent me. Graff also told me about Cylink's link to US organized crime. I must admit that I was somewhat suspicious of Cylink's more than $1,000 per chip CY1024 public key crypto chips great cost. Lewis submitted the RSA encryption paper to one of the ieee journals. Graff sent me the copy of the RSA Encryption paper which John Young posted. Sandia confiscated all of my crypto papers. I spoke with Graff on Wednesday August 13 at 21:43. I explained the problem with algorithmic cryptography to Graff. I asked Graff if he had seen any similar criticisms of algorithmic cryptography. Graff responded that he may have. Graff gave me the reference, The Handbook of Applied Cryptography and referenced an article by Peter Wayner. Later, bill
Return-Path: <billp@nmol.com> Date: Wed, 14 Jan 1998 08:54:20 -0700 From: bill payne <billp@nmol.com> To: jy@jya.com, j orlin grabbe <kalliste@aci.net> Subject: Cylink Wednesday 1/14/98 8:15 AM John Young J Orlin Grabbe INFOWORLD January 5, 1998 page 48 Cylink gets permission to export Triple DES standard Company to sell bank consortium By Rebecca Sykes CYLINK HAS WON permission from the U.S. government to export hardware that works at the Triple DES level, or three times that of the 56-bit Data Encryption Standard. ... Sykes’ article does not appear to have been posted at inforworld.com yet. Note the word HARDWARE. After the NSA spy sting bust, we all must assume that if a crypto key is going into a chip, it is coming out of that chip. My two public key crypto projects at Sandia were 1 electronic tagging for treaty verification 2 bureau of engraving and printing bill anti-counterfeiting. I hooked the Cylink 1024 chip up to an 8031 micrcontroller using Mode 0 synchronous serial communications. I only bought about 6 CY 1024 chips since I was prototyping. The CY 1024 cost MORE THAN $1,000 each. It did not take a rocket scientist to figure out what was going on. A scam. The US government was buying, and probably was the only one who could afford, CY 1024 chips. Note at cylink.com that William Crowell, recently retired from NSA, and referenced in Morales and my lawsuit with NSA, is now working at Cylink! Let’s hope this unfortunate matter get settled before it gets FAR WORSE - for the US government, of course. Later bill
Date: Mon, 26 Jan 1998 18:04:30 -0800 To: John Young <jya@pipeline.com>, cypherpunks@cyberpass.net From: Steve Schear <schear@lvdi.net> Subject: Re: Cylink and Organized Crime? I worked at Cylink as Manager of Business Development from April 1992 - April 1994. I reported directly to both Lew Morris (CEO) and Jim Omura (CTO) and know Jim socially, as well. I know of no instance in which I suspected Cylink had criminal ties (other than our own govenment ;-) I heard that NSA people from the Fort (Meade) did request that Cylink supply 'special' crypto devices to drug cartele clients. I don't believe they were accomodated (probably not enough lead time or Cylink was offered too little money). Ademco is a major stockholder, as are Jim and Lew (~20% combined) and Renaissance Capital. --Steve
Date: Mon, 26 Jan 1998 18:28:24 -0800 To: John Young <jya@pipeline.com> From: Steve Schear <schear@lvdi.net> Subject: Re: Cylink and Organized Crime? John Young wrote: >Steve, > >Bill Payne's been sending me notes about Cylink since May 1997 >after getting a call from Jon Graff who made the allegations. I've >just added several of them to the URL posted today, one of which >included Graff's phone number. I've left a message this evening >for Graff to call me. Do you know him? No. He must have joined after I left. --Steve
Date: Tue, 27 Jan 1998 07:18:53 -0800 From: bill payne <billp@nmol.com> To: armoral@sandia.gov CC: jy@jya.com, George.Breznay@hq.doe.gov, Federico.F.Pena@hq.doe.gov Subject: cylink Art I am almost afraid to click on cylinked.htm Cylinked to Organized Crime? I bought about six CY 1024 publick key crypto chips for a bit over $1,000 each for SANDIA NATIONAL LABORATORIES for a Bureau of Engraving and Printing and treaty verification electronic tagging project. Let's hope this mess gets settled! bill
Date: Tue, 27 Jan 1998 14:11:27 -0500 To: John Young <jya@pipeline.com> From: Subject: Re: Cylink and Organized Crime? (Personal) (Personal) John, jya stand for certain values, with your impassioned data gathering. I'm proud to be an addicted reader. I'm no fan of Cylink, nor it's past execs -- but this sort of malovelent rumor-mongering doesn't belong on your site. Not unless Bill Payne could offer some much more substantive than he has so far. This is embarassing. Please consider removing it. Regards, --------
Excerpt source: http://www3.techstocks.com/~wsapi/investor/reply-486113 November 26, 1996 Yes, and it appears that he is not 'tainted' by former affiliation
with the NSA. I was reading the recent and very popular book
"Applied Cryptography" by Bruce Schneier, and in a section describing
an algorithm developed by Cylink, he advised approaching it with
caution because Cylink is 'tainted' by affiliation with NSA. One
must wonder whether this type of commentary by experts in the field
scares off potential customers. Unfortunately, the author may not
be worth suing for this kind of baseless claim. Excerpt source: http://www3.techstocks.com/~wsapi/investor/reply-780436 February 7, 1997 As a result of Cylink's reorganization the company received a demand letter from attorneys representing seven of Cylink's former employees alleging wrongful termination and related damages stated to be approximately $34 million. Cylink firmly believes that the termination of these employees was in the best interest of the company, the manner of their termination was lawful and their claims are without merit. Excerpt source: http://www3.techstocks.com/~wsapi/investor/reply-1109978 April 1, 1997 You are right about turnaround, and maybe Sarrat is just what this company needs. They were run extemely poorly by some Stanford scientists, who knew encryption (recently settled with RSA as you know) but not business. When Morris suffered his stroke last year, the appalling lack of coherent business plan sunk the stock. Morris's son was no help (he may be one of the pending lawsuits). ---------- Note: See recent investor comments on Cylink: http://www.techstocks.com/~wsapi/investor/Subject-2944
Applied Cryptography, Bruce Schneier, 2nd Edition, pp. 215-16: Algorithms for Export Algorithms for export out of the United States must be approved by the U.S. government (actually, by the NSA--see Section 25.1) It is widely believed that these export-approved algorithms can be broken by the NSA. Although no one has admitted this on the record, these are some of the things the NSA is rumored to privately suggest to companies wishing to export their cryptographic products: - Leak a key bit once in a while, embedded in the ciphertext. - "Dumb down" the effective key to something in the 30-bit range. For example, while the algorithm might accept a 100-bit key, most of those keys might be equivalent. - Use a fixed IV, or encrypt a fixed header at the beginning of each encrypted message. This facilitates a known-plaintext attack. - Generate a few random bytes, encrypt them with the key, and then put both the plaintext and the ciphertext of those random bytes at the beginning of the encrypted message. This also facilitates a known-plaintext attack. NSA gets a copy of the source code, but the algorithm's details remain secret from everyone else. Certainly no one advertises any of these deliberate weaknesses, but beware if you buy a U.S. encryption product that has been approved for export. ----- For more on Applied Cryptography see Bruce Schneier's Web site: http://www.counterpane.com
From: "Rich Ankney" <rankney@erols.com> To: <jy@jya.com> Subject: Jon Graff vs. Cylinked Date: Wed, 28 Jan 1998 15:06:27 -0500 John, I've been exchanging Email with Jon for the past few days, following up on some topics we discussed at the ANSI X9F meeting last week. I mentioned the "Cylinked" posting on Cryptome (incidentally my new favorite site), and he's a bit concerned that the context isn't quite complete (i.e. the rumor is hearsay and he has no knowledge of its veracity. His version of the facts: "Jon Graff related in a private conversation to Bill Payne a rumor that was widely circulated among the long term employees at Cylink that alleged association of the Mafia with Cylink. During that conversation, Jon emphasized that this rumor was hear-say and he had no knowledge to evaluate the veracity of the rumor." Incidentally, Jon was with Cylink back in the early '90's. I had suggested that he post this, but he would prefer not to spread his Email address around given the current flurry of activity. Perhaps you could just add this message to the Cylinked "thread" on Cryptome. Best regards, Rich Ankney
JYA Note: We appreciate this clarification from Rich Ankney and Jon Graff, both of whom are distinguished cryptographers. See, in addition to their participation in ANSI X9F, Mr. Ankney's paper "Introduction to Cryptographic Standards," and Mr. Graff's participation in NISSC 97 where he was a panelist on Debate Track D, "Technology Around The Next Corner: The Future of INFOSEC" Chair: Hilary Hosmer, Data Security Inc. Panelists: Emmet Paige, OAO Kathy Kincaid, IBM Jon Graff, KPMG, Peat, Marwick, LLP Ruth Nelson, Information Systems Security
Date: Thu, 29 Jan 1998 11:10:35 -0800 From: bill payne <billp@nmol.com> To: kalliste@aci.net CC: jy@jya.com Subject: Postcard Graff phoned. Graff is getting NASTY phone calls. Latest: Cylinked to Organized Crime? But you know about hints such as the horse head in the bed. I read your stuff. I haven't yet mustered the courage to read about Cylink. Later bill
February 4, 1998 Jon Graff returned JY call. Confirmed e-mail message sent via Rich Ankney. Has not received threats for remarks posted here. Will let JY know if there are any.