October 2004 - cypherpunks-legacy

Certicom sees lift from entertainment industry
by R.A. Hettinga 14 Oct '04

14 Oct '04

<http://www.thestar.com/NASApp/cs/ContentServer?pagename=thestar/Layout/Arti…> TheStar.com Oct. 14, 2004. 01:00 AM Certicom sees lift from entertainment industry Certicom Corp. sees growing demand for its data encryption technology in both government and the private sector, its CEO told the annual meeting yesterday. The explosion of digital music, movies and books that are easily copied is causing companies such as The Walt Disney Co. and Time Warner Inc. to demand electronic devices and distribution networks be fully secure, Ian McKinnon said. "DVD players, set-top boxes and digital cable carry vast amounts of valuable content, all of which is very easy to copy," McKinnon said. "Very soon, every consumer device needs to have security embedded in its hardware to protect content. That's obviously a vast market." The technology at the core of Certicom's products - elliptic-curve cryptography, or ECC - is well suited to such purposes since it can work faster and requires less computing power and storage than conventional forms of cryptography, he said. Certicom got a lift from a $25 million (U.S.) contract to supply software to the U.S. National Security Agency, giving the Mississauga-based company its first profitable year and endorsing ECC as its new encryption standard, McKinnon said. The security agency's purchase provided most of Certicom's revenue of $34.5 million in its financial year ended April 30. The year's profit was $16.8 million, or 47 cents per share. The contract was followed by a deal with Research In Motion Ltd., which is embedding Certicom's technology in its BlackBerry wireless e-mail products and paying royalties over a number of quarters. In the first quarter of its current fiscal year, Certicom's revenue was up by $700,000, or nearly 32 per cent, from $2.2 million a year earlier. But the company fell back into the red in the May-July quarter, albeit with a $1.2 million loss that was 25 per cent smaller than the $1.6 million reported a year earlier. Asked by a shareholder when Certicom would achieve sustainable profitability, McKinnon said he is "extremely upbeat about the company's future" but is not prepared to provide guidance on revenue or profitability. "As goes ECC adoption will go the growth of the company." CANADIAN PRESS -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

New Technique Could Trace Documents By Printer (fwd from brian-slashdotnews@hyperreal.org)
by Eugen Leitl 14 Oct '04

14 Oct '04

----- Forwarded message from brian-slashdotnews(a)hyperreal.org -----

1 0

Tor 0.0.9pre3 is out (fwd from arma@mit.edu)
by Eugen Leitl 14 Oct '04

14 Oct '04

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> -----

1 0

FDA approves use of implantable chip in patients to pass medical information to doctors
by R.A. Hettinga 13 Oct '04

13 Oct '04

<http://sfgate.com/cgi-bin/article.cgi?file=/news/a/2004/10/13/national0948E…> www.sfgate.com FDA approves use of implantable chip in patients to pass medical information to doctors - DIEDTRA HENDERSON, AP Science Writer Wednesday, October 13, 2004 (10-13) 10:05 PDT WASHINGTON (AP) -- The Food and Drug Administration on Wednesday approved an implantable computer chip that can pass a patient's medical details to doctors, speeding care. VeriChips, radio frequency microchips the size of a grain of rice, have already been used to identify wayward pets and livestock. And nearly 200 people working in Mexico's attorney general's office have been implanted with chips to access secure areas containing sensitive documents. Delray Beach, Fla.-based Applied Digital Solutions said it would give away $650 scanners to roughly 200 trauma centers around the nation to help speed its entry into the health care market. A company spokesman would not say how much implanting chips would cost for humans, even though chips have been implanted in some, including Scott R. Silverman, the company's chief executive officer. The company is targeting patients with diabetes, chronic cardiac conditions, Alzheimer's disease and those who undergo complex treatments like chemotherapy, said Dr. Richard Seelig, Applied Digital Solutions' vice president of medical applications. It's the first time the FDA has approved medical use of the device, though in Mexico, more than 1,000 scannable chips have been implanted in patients. The chip's serial number pulls up the patients' blood type and other medical information. With the pinch of a syringe, the microchip is inserted under the skin in a procedure that takes less than 20 minutes and leaves no stitches. Silently and invisibly, the dormant chip stores a code -- similar to the identifying UPC code on products sold in retail stores -- that releases patient-specific information when a scanner passes over the chip. At the doctor's office those codes stamped onto chips, once scanned, would reveal such information as a patient's allergies and prior treatments. The FDA in October 2002 said that the agency would regulate health care applications possible through VeriChip. Meanwhile, the chip has been used for a number of security-related tasks as well as for pure whimsy: Club hoppers in Barcelona, Spain, now use the microchip much like a smartcard to speed drink orders and payment. On the Net: VeriChip: www.4verichip.com/index.htm -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

How key Microsoft legal emails 'autodestruct'
by R.A. Hettinga 13 Oct '04

13 Oct '04

<http://www.theregister.co.uk/2004/10/11/ms_legal_mail_autodestruct/print.ht…> The Register Biting the hand that feeds IT The Register ; Software ; Original URL: http://www.theregister.co.uk/2004/10/11/ms_legal_mail_autodestruct/ How key Microsoft legal emails 'autodestruct' By John Lettice (john.lettice at theregister.co.uk) Published Monday 11th October 2004 07:23 GMT The latest court documents to be unsealed by Judge Frederick Motz in Burst.com's suit against Microsoft paint a picture of Microsoft document handling procedures which destroyed the very emails that were likely to be most relevant to several antitrust actions, Burst's included. According to Burst's lawyers Microsoft's status as "a defendant in major antitrust cases since at least 1995" means that it has a duty to preserve potentially relevant evidence. But "Microsoft adopted policies that, to put it mildly, encouraged document destruction from 1995 forward." Microsoft is still resisting Burst's attempts to have it hand over documents defining its retention policies, but a Burst brief of 27th September puts forward a forensic examination of the net effect of whatever these policies might be, accompanied by a certain amount of rolling of eyes. We, and the technology press in general, are indebted to PBS columnist Robert X Cringely for his dogged and single-handed pursuit of Burst v Microsoft. You can read his take on the latest developments here, (http://www.pbs.org/cringely/pulpit/pulpit20041007.html) and links to the court documents here. (http://www.pbs.org/cringely/links/links20041007.html) As Microsoft's retention policies remain for the moment a closely-guarded secret it would be absolutely wrong of us to draw any inference as to what they might be solely from what happens. What happens, though, is pretty damn peculiar. The system as a whole defaults to swift destruction of employees' emails, while there is clear evidence that Microsoft takes a very narrow view of whose documents may be relevant to a particular case. In some cases its choice of 'relevant' employees to be subject to retention seems perverse and misleading. So in the normal course of events documents would be destroyed swiftly, documents would be saved only by a document retention notice, and if document retention notices were not sent to the right people (the Burst brief argues that they were not), then by the time those people were properly identified the documents would almost certainly have been destroyed. Microsoft exec Jim Allchin, who seems to be shaping up as a star exhibit, instructed Windows division employees in January 2000 to delete emails from their hard drives after 30 days. "Do not be foolish," he said, "do not archive your e-mail." In response to emails about this instruction Allchin sends another which confirms the existence of an "official policy" on document retention sent company-wide in the summer of 1996, and says that this is the only written policy. Allchin however reiterates his 30 day instruction, adding an exception only for those who "have received specific instructions from Legal to retain certain documents or email that may be related to pending litigation. These instructions override the general policy." Microsoft has not yet yielded the 1996 policy, but Allchin's reference to it plus his insistence on 30 days suggests that the general policy was 30 days, from 1996 onwards. The retention of legally-relevant documents is therefore clearly dependent on Legal sending retention notices to the right people at the right time. Burst's brief at this point notes that Microsoft has confirmed it did not produce any of the Allchin email string in 12 prior cases, including DoJ v Microsoft, on the basis that, it claims, nobody asked for them. But in Sun v Microsoft, Microsoft undertook to "produce documents concerning Microsoft business policies, procedures or guidelines for document retention, to the extent such documents exist, for the period January 1, 1998 to November 30, 2002." This period covers the Allchin string, but the string was not produced, so when Microsoft confirmed that it had completed the production of documents, it was not telling the truth. The general policy, if it is the policy, of 30 days covers local storage. Email could also be saved on the Exchange servers. Microsoft however enforces rigorous limits on employee storage on these servers, and on average there appears to be space for about a month's emails per employee. No storage allocation left, no email until you delete some. In addition, emails could be saved on servers maintained by the Operations Technology Group. But as made clear previously in this case (reported here (http://www.theregister.co.uk/2004/05/24/allchin_destroy_email_claim/)) company policy is that emails should not be archived on these servers. This policy was strengthened by the addition of the words "Due to legal reasons..." in 1997, but weirdly, Microsoft claims that this bit was made up by information technology employee Candy Stark, purely to add weight to her campaign to save on storage costs. In fairness, therefore, we should consider the possibility that many other apparently incriminating things in surviving emails have been made up too. Is there a company policy on when to believe what an exec is telling you? And if there is, has it been made up? Frightening, isn't it? But the Burst brief declines to believe Stark made it up, and suggests the "legal reasons" may track back to the elusive 1996 policy, which again is cited by Stark. Archive location number four at Microsoft is provided by the servers maintained by the IT person for each individual business group. The servers most relevant to the Burst case were maintained by a Mr Ochs, who did not receive a retention notice, and who testified to routinely destroying documents on the servers. These are the very servers Microsoft has previously said it cannot reasonably search for documents, because it does not know who uses which servers. The brief puts forward several examples of cases where Microsoft failed to identify relevant employees and send them retention notices. In response to a DoJ request in 1997 it failed to identify Chris Phillips and his boss Eric Engstrom, although Phillips had led negotiations with RealNetworks and the ensuing deal was sometimes referred to internally as "the Chris Phillips deal." Microsoft did identify the in-house lawyer brought in to draft the contracts, but not Phillips or Engstrom, so both destroyed their emails. Neatly, as a Microsoft attorney the lawyer's emails were protected by attorney-client privilege, so Microsoft doesn't have to release them. Similarly Engstrom emails relevant to Intel's decision to drop development of its JMF Java Media Player have been destroyed. The Burst brief only asks for Microsoft's retention policies to be produced in camera, so even if Redmond does cough up there's no certainty we'll ever know if they explain the apparent weirdness of Microsoft document and archiving policies. But if Microsoft does have a policy to diligently retain relevant documents, well, it clearly needs to write a new policy that works instead. We at The Register have a humble suggestion. Seeing Rick Rashid of MS Labs is in the habit of touring the world telling people that storage is now pretty well cheap enough for you to just record your whole life in a lifeblog, couldn't everybody at Microsoft just... Related links Allchin named, as proof of MS email destruction policy is sought (http://www.theregister.co.uk/2004/05/24/allchin_destroy_email_claim/) Cringely PBS column (http://www.pbs.org/cringely/pulpit/pulpit20041007.html) Links to court documents (http://www.pbs.org/cringely/links/links20041007.html) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: Financial identity is *dangerous*? (was re: Fake companies, real money)
by John Kelsey 13 Oct '04

13 Oct '04

>From: "R. A. Hettinga" <rah(a)shipwright.com> >Sent: Oct 8, 2004 7:14 PM >To: cryptography(a)metzdowd.com, cypherpunks(a)al-qaeda.net >Subject: Financial identity is *dangerous*? (was re: Fake companies, real money) >Okay. So I'm coming to the conclusion that book-entry settlement, with its >absolute requirement for both "identity" and float between transactions, is >becoming more and more *un*-safe to use as internet ubiquity increases. Hmmm. I guess I don't see why this story supports that argument all that well. Clearly, book entry systems where I can do transactions in your name and you are held liable for them are bad, but that's like looking at Windows 98's security flaws and deciding that x86 processors can't support good OS security. The aspect of this that's generally spooky is not the existence of book entry payment systems, it's the ease with which someone can get credit (in one form or another) in your name, based on information they got from public records and maybe a bit of dumpster diving, some spyware installed on your machine, or a phishing expedition. How the payment systems are cleared isn't going to change that, right? (I know you've thought about this stuff a lot more than I have, so maybe I'm missing something....) >Anyone want to pick up the other side of this and tell me why not? >No bugbears or horsemen need apply... >Cheers, >RAH --John Kelsey

3 2

Re: Poor privacy protection in the states
by Tyler Durden 13 Oct '04

13 Oct '04

JAT wrote... >Basically, we're a bunch of closet fascists. and >Um, I'm sorry - maybe you hadn't heard yet: that old piece of paper was >superceded on 11 Sep 01, when "everything changed". I think that's the day we came out of the closet. Read, "Radio Free Albemuth" by P.K. Dick and you'll get the picture of where we're headed. -TD _________________________________________________________________ Get ready for school! Find articles, homework help and more in the Back to School Guide! http://special.msn.com/network/04backtoschool.armx

1 0

Poor privacy protection in the states
by Nomen Nescio 13 Oct '04

13 Oct '04

Why don't Americans honour security and privacy higher? Look at this page http://www.ci.stpaul.mn.us/depts/police/prostitution_photos_current.ht ml Which is from a police department! http://www.ci.stpaul.mn.us/depts/police/ If we look at the spirit of this quote I don't see how it is ok to behave in this abusive manner by the authorities. "The right of the people to be secure in their persons, houses, papers and effects, against unreasonable searches and seizures, shall not be violated..." (from the fourth amendment, US constitution) It is one thing if we're talking about very dangerous individuals who are being sought after by the police and who the public needs to be aware of but here we have a completely different situation. Why is the integrity and security of the simple man on the street not honoured in the US society today? It's a big difference between the protection of personal privacy in Europe and in the US and all Americans should really ask themselves why this has to be.

2 1

(un)intended anonymity feature of gmail
by Morlock Elloi 13 Oct '04

13 Oct '04

Unless I'm missing something obvious, it seems impossible to divine the origination IP address from gmail-sourced e-mail headers. The first IP (the last header) has 10.*.*.* form and is of course internal to google. This is not the case with any other e-mail service I know of (mixmaster excluded), the real originating IP is always included. So the recipient of gmail message has no way of determining what the sender's real IP is. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com

1 0

RE: Airline ID requirement faces legal challenge
by Tyler Durden 12 Oct '04

12 Oct '04

Actually, this story is quite the media bellweather. This one treats the case purely as "Gilmore wants to fly anonymously", while even some other mainline media are reporting it as, "Gilmore is questioning the legality of hidden laws". I guess USA Today still feels it has an audience worth pandering to. -TD >From: "R.A. Hettinga" <rah(a)shipwright.com> >To: cypherpunks(a)al-qaeda.net, cryptography(a)metzdowd.com >Subject: Airline ID requirement faces legal challenge >Date: Tue, 12 Oct 2004 14:15:53 -0400 > ><http://www.usatoday.com/tech/news/surveillance/2004-10-10-privacy_x.htm> > >USA Today > > > >Airline ID requirement faces legal challenge >By Richard Willing, USA TODAY >At a time when Americans have come to expect tight security for air travel, >it might seem to be an odd question: Does requiring airline passengers to >show identification before they board domestic flights amount to an >"unreasonable search" under the Constitution? > >John Gilmore is challenging the federal domestic airline ID requirement, >saying it violates his right to travel in the USA anonymously. >File photo > >Yes, says John Gilmore, a computer whiz who made a fortune as an early >employee of Sun Microsystems. His challenge of the federal ID requirement, >which soon could get a hearing before a U.S. appeals court in San >Francisco, is one of the latest court battles to test the balance between >security concerns and civil liberties. > > At issue is Gilmore's claim that checking the IDs of passengers on >domestic flights violates his right to travel throughout the USA >anonymously, without the government monitoring him. > > Lawyers involved in the case say it apparently is the first such >challenge >to the federal rules that require airline passengers to provide >identification. In a similar case, two peace activists are suing the U.S. >government to determine how their names came to be placed on a federal >"no-fly list." Rebecca Gordon and Janet Adams were not allowed to board a >San Francisco to Boston flight in August 2002 after they were told that >their names were on a "secret FBI" list of potential security threats, >their court filing says. > >"I believe I have a right to travel in my own country without presenting >what amounts to an internal passport," Gilmore, 49, said in an interview. >"I have a right to be anonymous, (to not) be tracked by my government for >no good reason." > >Gilmore said he has no problem with security checks that focus on >passengers' luggage. He says he also does not object to having to present a >passport to board flights to other countries. > > Some privacy groups say Gilmore has a point. But others who support the >ID >requirement have cast the San Francisco resident as being out of touch with >the realities of air travel since the Sept. 11 attacks. > >Kent Scheidegger, counsel for the Criminal Justice Legal Foundation, a >conservative group in Sacramento, says the ID requirement is good policy >and "eminently constitutional." > >"The Fourth Amendment forbids not searches that you don't like, it forbids >unreasonable searches," he says. "Nothing could be more reasonable at this >time than to know who you're flying with." > > The Justice Department is fighting Gilmore's claim. Acting on the >department's motion, a U.S. district court judge in San Francisco dismissed >the suit last March. Gilmore has appealed; a hearing before the 9th Circuit >Court of Appeals is likely to be scheduled after briefs are filed next >month. > >In court papers, the Justice Department has not defended the ID policy, or >even acknowledged it exists. It has said national security law requires >that this aspect of the case be argued in a courtroom closed to the public, >including Gilmore. The appeals court denied the government's secrecy >request Sept. 20, and the government has asked the court to reconsider. > > Rules on the Transportation Security Administration's Web site say >passengers 18 and older need one form of government-issued photo >identification or two forms of non-photo identification to board domestic >flights. > > Airlines adopted such a policy on their own after terrorists bombed an >international flight over Lockerbie, Scotland, in December 1988. The bomb >that killed all 270 passengers on the jet was said to have been placed in a >passenger's luggage by a terrorist who got into a restricted area. The >airlines say checking IDs against luggage and passenger information is a >way to deny terrorists access to flights. > >The TSA, formed two years ago in the wake of the Sept. 11 attacks, checks >IDs to verify passenger identities and to check them against "watch lists" >of known or suspected terrorists. > >Gilmore's suit says the requirement amounts to an unreasonable search, a >"burden" on the right to travel and a form of self-incrimination because it >singles out "anonymous travelers" for searching. > >Gilmore said the ID requirement does little to ensure security. "Ordinary >citizens may show correct identification, but do we really think that >someone who is willing to commit a terrorist act won't also be willing to >present false identification?" > >Gilmore's suit was filed in 2002, after he was denied seats on two flights >at the airport in Oakland. It was his first domestic flight since the 9/11 >attacks. Before then, Gilmore said, he was permitted to board flights after >presenting a Federal Aviation Administration document that said showing IDs >was optional. > >In 1982, Gilmore, a computer programmer, was the first person hired by the >founders of what became Sun Microsystems. He retired eight years ago with >what his publicist, Bill Scannell, calls "multiples" of millions of >dollars. > >Since then, Gilmore said, he has worked to promote "individual rights," in >part by sponsoring a foundation that is critical of travel restrictions and >what he considers violations of speech and privacy rights. > >Last year, before taking off on a British Airways flight from San Francisco >to London, Gilmore angered fellow travelers by refusing to remove a blue >button on his lapel that had the words "suspected terrorist" imposed over >the picture of an airliner. After a delay, the pilot went back to the gate >and ordered Gilmore off the jet. > >While his case moves through court, Gilmore has remained grounded when it >comes to domestic travel. > >He hired friends to drive him to San Diego and across the country to attend >board meetings of corporate and non-profit groups. He took a driving >vacation to Oregon. Invited to a family reunion in Massachusetts, he >thought of chartering a private plane but balked at the $33,000 price. > >"Yes, it can be inconvenient at times," Gilmore said of his fight against >the ID requirement. "But I believe I'm right." > > >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! hthttp://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0