November 2003 - cypherpunks-legacy

Biometric ID cards to be "backdoored" in the UK
by Dave Howe 11 Nov '03

11 Nov '03

Students of UK politics should be aware that the british prime minister considered it a sign of "moral courage" to press ahead with an attack on iraq despite protests in the streets and massed opposition by politicians of all parties, and that forging evidence is fully justified by the results. That being given, it should come as no surprise that, despite public opposition by the people, other politicans and the prime minister himself, and repeated proofs that ID cards have no effect at all on terrorism (for instance, the 9/11 attackers all had ID) the Home Secretary is pressing forward with a road map to compulsory ID cards for all UK citizens by 2012. The "results summary" from a consultation process that was more than 70% opposed to introduction of ID Cards is here: http://www.official-documents.co.uk/document/cm60/6020/6020.htm Note that the preferred path is now to update passport and driving licence documents (at the citizen's expense) to include digital ID and biometric information; once 80% of citizens have been forced to accept ID cards by this backdoor process (no parlimentary debate required) it will seem only a small step to force the remaining 20% to purchase such a card. There will apparently not be any compulsion to *carry* the card (at this stage) but it will be required to be produced to obtain access to government controlled services such as healthcare....

1 0

Re: Disguising the Key length (Was...Has a change taken place in factoring RSA keys)
by Major Variola (ret) 10 Nov '03

10 Nov '03

At 02:09 PM 11/10/03 -0500, Tyler Durden wrote: >My first question is, how easy is it for them to estimate the key size of an >encrypted message? Its not secret. But lets look at twiddling what the message header encodes. Suppose you relabel a 2Kbit key as a 1Kbit. Then what are the extra bits for, Eve will wonder. Suppose you claim a 1Kbit RSA key is 2Kbits. Now, the math works if you treat a 1Kbit key as 2Kbit. But the decrypt won't work unless the recipient modifies the header to specify 1Kbit to ignore the fake extra key bits. Which requires a secure OOB channel, see below. >Can they do this without actually "chewing" on the message for a while? (ie, >if it doesn't crack in x minutes then there's a 99% probability of the key >being Y in length...) "How can you have any pudding if you don't eat your meat? " Lets think about DES, which also has a publicly-visible keylength. If you've run through *all* the 56 bit keys, and found no solution, you know that either DES wasn't the algorithm (perhaps 3DES was, perhaps DES-X, perhaps Blowfish, AES, Skipjack, etc. You need to reconfigure your FPGAs for each algorithm.) And if you haven't run through all the keys, it could always be the *last* key you try. So although given *large sets of messages* you can say that 99% would have been cracked "by now", this kind of stats isn't really useful. "Close" is for hand grenades, horseshoes, and proximity fuzes; there is no "close" in crypto. >Second question: Is it possible to make a message appear to have been >encrypted with a shorter key than was actually used? That would cause the decrypting code to truncate significant digits which would not permit decryption. Suppose you did this and the recipient fixed the length so it would work. This wouldn't matter: Eve would wonder what all those extra random bits are for. A better approach *might* be to lie about the symmetric encryption you've used. Encrypt with AES-256, use RSA on that 256 bit key, but modify the message to claim you've used AES-128 or 3DES. However, this requires a secure out of band channel to communicate this to your recipient. And if you have such a channel, you may as well give them a nonstandard S-box initialization (eg "e times your SSN number" vs. "pi" in Blowfish) or a OTP. --- A SAM a day keeps the invaders away.

1 0

Re: Gestapo harasses John Young, appeals to patriotism, told to fuck off
by John Young 10 Nov '03

10 Nov '03

SA Renner did most of the talking and carried a manila folder with a file name on it beginning with "SP," I think. Couldn't see the remainder. He didn't open it during the session and it may have been a prop. They showed up without warning, no call ahead, got past our Doberman doorman (we're on the 6th floor) who usually calls us about visitors but didn't this time, and hasn't said a peep since the visit. (In contrast, when I got subpoenas for the Bell grand jury and trial, the doorman called up about the Treasury agents and I met them in the street level lobby.) Renner showed ID, asked to come in and talk. They were here about half an hour. I tried to get them to sit together but they carefully bracketed me. They asked who works with me on Cryptome, who funds it. Me and me alone, I said. The FBI agents asked about nobody except me. Renner asked for ID and I showed him Duncan's, or maybe it was Declan's. I sent an account to cpunks right after the visit but LNE never processed it, nor three more later. Hence this algebra late comer.

1 0

Review of Film: Uncovered: The Whole Truth About the Iraq War
by Steve Schear 10 Nov '03

10 Nov '03

Case For War Confected, Say Top U.S. Officials By Andrew Gumbel Independent UK <http://news.independent.co.uk/world/americas/story.jsp?story=461953> Sunday 09 November 2003 An unprecedented array of US intelligence professionals, diplomats and former Pentagon officials have gone on record to lambast the Bush administration for its distortion of the case for war against Iraq. In their view, the very foundations of intelligence-gathering have been damaged in ways that could take years, even decades, to repair. A new documentary film beginning to circulate in the United States features one powerful condemnation after another, from the sort of people who usually stay discreetly in the shadows - a former director of the CIA, two former assistant secretaries of defence, a former ambassador to Saudi Arabia and even the man who served as President Bush's Secretary of the Army until just a few months ago. Between them, the two dozen interviewees reveal how the pre-war intelligence record on Iraq showed virtually the opposite of the picture the administration painted to Congress, to US voters and to the world. They also reconstruct the way senior White House officials - notably Vice-President Dick Cheney - leaned on the CIA to find evidence that would fit a preordained set of conclusions. "There was never a clear and present danger. There was never an imminent threat. Iraq - and we have very good intelligence on this - was never part of the picture of terrorism," says Mel Goodman, a veteran CIA analyst who now teaches at the National War College. The case for accusing Saddam Hussein of concealing weapons of mass destruction was, in the words of the veteran CIA operative Robert Baer, largely achieved through "data mining" - going back over old information and trying to wrest new conclusions from it. The agenda, according to George Bush Senior's ambassador to Saudi Arabia, Chas Freeman, was both highly political and profoundly misguided. "The theory that you can bludgeon political grievances out of existence doesn't have much of a track record," he says, "so essentially we have been neo-conned into applying a school of thought about foreign affairs that has failed everywhere it has been tried." The hour-long film - entitled Uncovered: The Whole Truth About the Iraq War - was put together by Robert Greenwald, a veteran TV producer in the forefront of Hollywood's anti-war movement who never suspected, when he started out, that so many establishment figures would stand up and be counted. "My attitude was, wow, CIA people, I thought these were the bad guys," Mr Greenwald said. "Not everyone agreed on everything. Not everyone was against the war itself. But there was a universally shared opinion that we had been misled about the reasons for the war." Although many elements in the film are not necessarily new - the forged document on uranium sales from Niger to Iraq, the aluminium tubes falsely assumed to be parts for nuclear weapons, the satellite images of "mobile biolabs" that turned out to be hydrogen compression facilities, the "decontamination vehicles" that were in fact fire engines - what emerges is a striking sense of professional betrayal in the intelligence community. As the former CIA analyst Ray McGovern argues with particular force, the traditional role of the CIA has been to act as a scrupulously accurate source of information and analysis for presidents pondering grave international decisions. That role, he said, had now been "prostituted" and the CIA may never be the same. "Where is Bush going to turn to now? Where is his reliable source of information now Iraq is spinning out of control? He's frittered that away," Mr McGovern said. "And the profound indignity is that he probably doesn't even realise it." The starting point for the tarnishing of the CIA was a speech by Vice-President Cheney on 26 August 2002, in which he told the Veterans of Foreign Wars in Nashville that Saddam was reconstituting his nuclear weapons programme and was thus threatening to inflict "death on a massive scale - in his own region or beyond". According to numerous sources, Mr Cheney followed up his speech with a series of highly unorthodox visits to CIA headquarters in Langley, Virginia, in which he badgered low-level analysts to come up with information to substantiate the extremely alarming - but entirely bogus - contents of his speech. By early September, intelligence experts in Congress were clamouring for a so-called National Intelligence Estimate, a full rundown of everything known about Iraq's weapons programmes. Usually NIEs take months to produce, but George Tenet, the CIA director, came up with a 100-page document in just three weeks. The man he picked to write it, the weapons expert Robert Walpole, had a track record of going back over old intelligence assessments and reworking them in accordance with the wishes of a specific political interest group. In 1998, he had come up with an estimate of the missile capabilities of various rogue states that managed to sound considerably more alarming than a previous CIA estimate issued three years earlier. On that occasion, he was acting at the behest of a congressional commission anxious to make the case for a missile defence system; the commission chairman was none other than Donald Rumsfeld, now Secretary of Defence and a key architect of the Iraq war. Mr Walpole's NIE on Iraq threw together all the elements that have now been discredited - Niger, the alumin- ium tubes, and so on. It also gave the misleading impression that intelligence analysts were in broad agreement about the Iraqi threat, relegating most of the doubts and misgivings to footnotes and appendices. By the time parts of the NIE were made public, even those few qualifications were excised. When President Bush's speechwriters got to work - starting with the address to Congress on 7 October that led to a resolution authorising the use of force against Iraq - the language became even stronger. Mr Tenet fact-checked the 7 October speech, and seems to have played a major role in every subsequent policy address, including Colin Powell's powerful presentation to the United Nations Security Council on 5 February. Of that pivotal speech, Mr McGovern says in the film: "It was a masterful performance, but none of it was true." More info on the Film: http://www.truthuncovered.com/ "[I]t is the leaders of the country who determine the policy and it is always a simple matter to drag the people along, whether it is a democracy, or a fascist dictatorship, or a parliament, or a communist dictatorship. Voice or no voice, the people can always be brought to the bidding of the leaders. That is easy. All you have to do is tell them they are being attacked, and denounce the peacemakers for lack of patriotism and exposing the country to danger. It works the same in any country." --Reichsmarschall Hermann Goering

1 0

Panther's FileVault can damage data
by Eugen Leitl 10 Nov '03

10 Nov '03

In case you've been using Apple OS X 10.3 (Panther)'s FileVault (Rijndael128 on ~/) there's a yet unfixed bug. Answer no if requested to regain lost disk space in encrypted directory[1] Notice that while the screen lock buffer overrun has been fixed, there are still unresolved issues with it[2] [1]http://www.theregister.co.uk/content/39/33769.html [2]http://www.securityfocus.com/bid/8912 -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

5 4

Cypherpunks List Info
by cpunk＠lne.com 09 Nov '03

09 Nov '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Stanford security conference
by Anonymous Sender 09 Nov '03

09 Nov '03

This looks interesting: --- Stanford Law School Media Release For Immediate Release: Thursday, October 30, 2003 CALIFORNIA ATTORNEY GENERAL BILL LOCKYER TO ADDRESS CYBERSECURITY AND VULNERABILITY DISCLOSURE AT STANFORD LAW SCHOOL Conference at Stanford Law School, Saturday November 22, 2003, 8:00 a.m. to 6:00 p.m. Early registration deadline is Nov 1, 2003. http://cyberlaw.stanford.edu/security/ --- Reported computer security breaches have almost doubled since last year, and the vast majority go unreported. In two high profile incidents earlier this year, hackers downloaded U.S. Navy credit card numbers and a worm paralyzed Bank of America's ATM network. In July, California became the first state to require businesses to notify consumers if hackers illegally obtain their personal information from company databases. California Attorney General Bill Lockyer will talk about enforcing this measure and other initiatives to achieve Internet security in the face of increasingly severe breaches of computer systems. His talk is part of a day-long conference hosted by the Stanford Law School Center for Internet and Society. Lockyer will join twenty top high-tech executives, encryption experts, and law professors, who will propose ways that technology vendors, their customers, government officials, researchers, and consumers can accelerate vulnerability research, computer security, and consumer privacy protection. The conference discussion will occur against the backdrop of a national debate as to how to respond to growing threats to cyberspace, and how to balance security needs against heightened exposure and the disclosure of proprietary information. On the one side are those who seek a federal measure like the one in California that mandates disclosure of security vulnerabilities. On the other are those who believe that non-disclosure ("security through obscurity") better protects privacy while continuing to enable research and development. The conference brings people from both camps together with technical experts to hammer out solutions and recommend policy for both industry and government. Other speakers include: Matt Blaze, AT&T Mary Ann Davidson, Oracle David L. Dill, Professor of Computer Science, Stanford University James Duncan, Cisco Gerhard Eschelbeck, Qualys Stephanie Fohn, Consultant Tiina Havana, Oulu University Secure Programming Group (OUSPG), Finland Shawn Hernan, CERT Steven B. Lipner, Microsoft David Litchfield, NGSSoftware Simple Nomad, NMRC, Bindview Len Sassaman, Anonymizer Bruce Schneier, Counterpane Peter P. Swire, Professor of Law at Ohio State University Hal Varian, Professor, University of California, Berkeley Vincent Weafer, Symantec Stephen Wu, InfoSec Law Group Chris Wysopal, @stake About Stanford Law School Center for Internet and Society (CIS): CIS is a public interest technology law and policy program within the umbrella Law, Science and Technology Program at Stanford Law School. CIS convenes scholars, legislators, programmers, security researchers, scientists and students to study the interaction between new technologies and the law, and determine how the synergy between the two can either promote or harm the public good. CIS works to advance technology and shape the direction of the law to protect free speech, privacy, public commons, diversity, and scientific inquiry. Center for Internet and Society Contact Information: Jennifer Granick, Executive Director, CIS, 650/724-0014, jennifer(a)law.stanford.edu Lauren Gelman, Assistant Director, CIS, 650/724-3358, gelman(a)stanford.edu Bill Lockyer's keynote address is scheduled from 12:15 p.m to 1:45 p.m. For a complete schedule of sessions, and to register for this event online, go to: http://cyberlaw.stanford.edu/security/. This event is free to the media. To obtain a press pass and reserve press seating, please contact: Judith Romero, Assistant Director of Communication for Stanford Law School, 650/723-2232 or judith.romero(a)stanford.edu About Stanford CIS: The Center for Internet and Society (CIS) is a public interest technology law and policy program at Stanford Law School and a part of Law, Science and Technology Program at Stanford Law School. The CIS brings together scholars, academics, legislators, students, programmers, security researchers, and scientists to study the interaction of new technologies and the law and to examine how the synergy between the two can either promote or harm public goods like free speech, privacy, public commons, diversity, and scientific inquiry. The CIS strives as well to improve both technology and law, encouraging decision makers to design both as a means to further democratic values. -end-

1 0

Re: Panther's FileVault can damage data
by Major Variola (ret) 07 Nov '03

07 Nov '03

At 06:37 PM 11/7/03 -0600, Harmon Seaver wrote: > Apple is both a software *and* a hardware company, however, and they've >pretty much always been negligent about making sure that other vendor's hardware >worked with theirs and/or their OS. I thought that was half the point of Apple ---you play only with us, and we make sure it all runs smoothly. (The other half being a once-superior UI). But you pay. If you want cheaper hardware that you have to wrestle with, you get a PC. Isn't that why Fry's has a return policy? A policy is a set of tradeoffs. Free people choose what they want.

1 0

Blacknet - SF Chron: Credit agencies sending our files abroad
by Bill Stewart 07 Nov '03

07 Nov '03

More of Tim's Blacknet predictions coming true. (And they didn't mention that the Jamaican call center's comment on whether information might be used in ways that US laws didn't control was "No problem, mon"...) ---------------- Credit agencies sending our files abroad David Lazarus Friday, November 7, 2003 )2003 San Francisco Chronicle |Feedback URL: sfgate.com/article.cgi?file=/c/a/2003/11/07/MNG4Q2SEAM1.DTL Two of the three major credit-reporting agencies, each holding detailed files on about 220 million U.S. consumers, are in the process of outsourcing sensitive operations abroad, and a third may follow suit shortly, industry officials acknowledge for the first time. Privacy advocates say the outsourcing of files that include Social Security numbers and complete credit histories could lead to a surge in identity theft because U.S. laws cannot be enforced overseas. For their part, the credit agencies say the trend is a necessary cost- cutting move in light of new legislation that would allow all consumers to obtain free copies of their credit reports. The top credit agencies -- Equifax, Experian and Trans Union -- have refused in the past to comment on their outsourcing plans. No longer. "A hundred percent of our mail regarding customer disputes is going to go to India at some point," said David Emery, executive vice president and chief financial officer of TransUnion in Chicago. "We are now testing the system and negotiating a contract with an outside vendor. We expect to sign that contract by the end of the year." Emery said in an interview that the decision to have an Indian firm handle thousands of written requests for changes to credit files each year was necessitated in part by the amended Fair Credit Reporting Act, which was approved by the U.S. Senate on Wednesday. The act would require credit agencies to provide copies of personal credit files to anyone who asks -- an expense that TransUnion, for one, estimates could cost the company as much as $350 million a year. A credit file serves as a snapshot of one's legal identity and financial status. It contains a person's name, address, date of birth, Social Security number and details of relationships with all credit-card issuers and other lenders. Emery also said the decision to "offshore'' a key customer service was necessitated by "the competition placed on us by Equifax and Experian." Equifax, he said, was the first major credit agency to move operations abroad, establishing a facility in the Caribbean. Experian, meanwhile, is "actively testing" work with an overseas affiliate, Emery said. "We had to get into this process for defensive reasons," he said. An Equifax spokesman's first response when asked about the Atlanta company's outsourcing was to insist that all customer service was handled at North American facilities. Confronted with TransUnion's remarks, though, a senior Equifax official later offered a different answer. "We have a vendor in Jamaica," said Rob Hogan, senior vice president of customer services. "The Jamaican workers handle data entry at the very beginning of the reinvestigation process (for disputed credit reports)." He said the overseas workers had "limited access" to consumers' credit files but were "closely supervised by our Atlanta office." Hogan acknowledged that Equifax had had "problems from time to time" with consumers' privacy being compromised. But he said each problem had led to improvements in security. He also said there had been no known security breaches in the four years that Equifax has outsourced to Jamaica. "We take great care of our data," Hogan stressed. "It's our livelihood." An Experian spokesman, Addrian Brooks, denied Trans Union's assertion that the Costa Mesa company is now "actively testing" an overseas operation. "We are confident that Trans Union doesn't know what our plans are because we don't know what their plans are," he said. However, Brooks repeatedly emphasized that Experian could outsource work abroad at any time. "We definitely are evaluating every option on the table, and offshoring is one of them," he said. "I don't want to be quoted as saying we'll never do it." Privacy advocates say the outsourcing of credit agencies' work abroad -- and hence access to U.S. consumers' credit files -- dramatically increases the chance that confidential information will get into the wrong hands. "Consumers should be worried," said Beth Givens, director of the Privacy Rights Clearing House in San Diego. "The infrastructure to protect information just isn't there in a lot of these places." Credit industry officials bristle at such talk. "Are we saying that Hindus are more criminal?" asked Stuart Pratt, president of the Consumer Data Industry Association, a trade group for credit- reporting agencies. "Are we saying that workers in India are less safe? That strikes me as xenophobic, and I don't want to go there." But privacy advocates say that this isn't a question of people's being more or less trustworthy in one place or another. It's a question of enforcement of strict U.S. laws. "The problem is not that they're in India," said Chris Hoofnagle, associate director of the Electronic Privacy Information Center in Washington. "The problem is that American laws are not going to be enforced in India." In fact, the Indian government, largely at the urging of privacy- conscious European officials, is working on new legislation aimed at better controlling the country's rapidly growing data-processing industry. But privacy advocates note that India passed a similar cyber-crime law several years ago making it illegal to steal information from computers. Since then, only 11 people have been charged with violating the law and, of that number, only two cases are being prosecuted. "If you're an international crime ring, and you want Social Security numbers for identity theft, you're going to look at the weakest link," said Givens at the Privacy Rights Clearinghouse. "And that's quite possibly these overseas companies." The credit-rating agencies say that privacy and security are their most important considerations and that they hold overseas affiliates to the same high standards that they hold their domestic offices. However, California's two Democratic senators expressed alarm that the agencies are outsourcing work. "The application of American law in a foreign country is difficult, if not impossible," said Sen. Dianne Feinstein. "Therefore, the more companies move overseas, the less American law can control the uses for which personal data is put. And this can only represent an increasing threat to the privacy of our citizens." Sen. Barbara Boxer said she would ensure that the matter was raised as senators and House members completed changes to the Fair Credit Reporting Act. "This information is very significant, and I intend to make sure that the conferees who are finalizing the bill are aware of The Chronicle's investigation in hopes that they will protect Americans from such outrageous invasions of privacy," Boxer said. David Lazarus' column appears Wednesdays, Fridays and Sundays. He also can be seen regularly on KTVU's "Mornings on 2." Send tips or feedback to dlazarus(a)sfchronicle.com . )2003 San Francisco Chronicle |Feedback ------------------------------------- You are subscribed as billstewart(a)att.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/

1 0

Deniable data storage
by James A. Donald 07 Nov '03

07 Nov '03

-- I want fully deniable information storage -- information theoretic deniable, not merely steganographic deniable, for stenography can never be wholly secure. So I would have a fixed sized block of data containing a variable number of smaller secret chunks of data. A random key would extract a random length of gibberish, a valid key would extract a stream of valid data, and revealing one secret key to the adversary would not give the adversary any evidene that more secrety keys were present or absent. Any good known algorithms for this? --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG E/45zLbSQGo9twu/KUBNIOlEXbRyhzQ7Y3BaLVsF 41igtTR/jdGIfGHEe9yPuW0cL6FbO81L4da208BC1

2 1