October 2004 - cypherpunks-legacy

cryptome.org down?
by Sunder 12 Oct '04

12 Oct '04

DNS seems to resolve, but never get to the web server. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

2 1

Congress Close to Establishing Rules for Driver's Licenses
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://nytimes.com/2004/10/11/politics/11identity.html?pagewanted=print&pos…> The New York Times October 11, 2004 Congress Close to Establishing Rules for Driver's Licenses By MATTHEW L. WALD ASHINGTON, Oct. 10 - Following a recommendation of the Sept. 11 commission, the House and Senate are moving toward setting rules for the states that would standardize the documentation required to obtain a driver's license, and the data the license would have to contain. Critics say the plan would create a national identification card. But advocates say it would make it harder for terrorists to operate, as well as reduce the highway death toll by helping states identify applicants whose licenses had been revoked in other states. The Senate version of the intelligence bill includes an amendment, passed by unanimous consent on Oct. 1, that would let the secretary of homeland security decide what documents a state would have to require before issuing a driver's license, and would also specify the data that the license would have to include for it to meet federal standards. The secretary could require the license to include fingerprints or eye prints. The provision would allow the Homeland Security Department to require use of the license, or an equivalent card issued by motor vehicle bureaus to nondrivers for identification purposes, for access to planes, trains and other modes of transportation. The bill does not give the department the authority to force the states to meet the federal standards, but it would create enormous pressure on them to do so. After a transition period, the department could decide to accept only licenses issued under the rules as identification at airports. The House's version of the intelligence bill, passed Friday, would require the states to keep all driver's license information in a linked database, for quick access. It also calls for "an integrated network of screening points that includes the nation's border security system, transportation system and critical infrastructure facilities that the secretary determines need to be protected against terrorist attack." The two versions will go to a House-Senate conference committee. Some civil liberties advocates say they are horrified by the proposal. "I think it means we're going to end up with a police state, essentially, by allowing the secretary of homeland security to designate the sensitive areas and allowing this integrating screening system," said Marv Johnson, the legislative counsel for the American Civil Liberties Union. If the requirement to show the identification card can be applied to any mode of transportation, he said, that could eventually include subways or highways, and the result would be "to require you to have some national ID card, essentially, in order to go from point A to point B." James C. Plummer Jr., a policy analyst at Consumer Alert, a nonprofit organization based here, said, "You're looking at a system of internal passports, basically." But a Senate aide who was involved in drafting the bipartisan language of the amendment said that in choosing where to establish a checkpoint, the provision "does not give the secretary of homeland security any new authority." The aide, who asked not to be identified because of his involvement in drafting the measure, said it would not create a national identification card but would standardize a form of identification routinely issued by states. Representative Candice S. Miller, the Michigan Republican who drafted the license section of the House measure, said, "I don't think this is anything that should cause anyone concern." Of the 50 states, 48 are members of interstate compacts that exchange information on moving violations, so that a driver from, say, Maryland, who picks up a speeding ticket in Florida will accumulate points in his home state. But Michigan and Wisconsin are not members of a compact. Ms. Miller said one purpose of the provision she wrote was to fix that problem. A spokesman for the American Association of Motor Vehicle Administrations, which represents the state officials who issue driver's licenses, said linking the databases and strengthening control over who could get a license was long overdue. "The American public should be outraged to know that departments of motor vehicles nationwide lack the capability to do the jobs we've asked them to do," said the spokesman, Jason King. In both houses, the legislation is geared to respond to numerous recommendations made by the Sept. 11 commission. For years before the terrorist attacks of Sept. 11, 2001, law enforcement officials, especially those concerned with identity theft, argued that the states should have more rigorous standards for issuing driver's licenses. But the commission pointed out that "fraud in identification documents is no longer just a problem of theft." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

6 7

[osint] Al-Qa'ida 'Survival Kit' Instructs Workers on Individual Conduct
by R.A. Hettinga 12 Oct '04

12 Oct '04

--- begin forwarded text To: "Bruce Tefft" <btefft(a)community-research.com> Thread-Index: AcSwgCBCG86YBOQdR3ixx7GwrZekMQAC8ROg From: "Bruce Tefft" <btefft(a)community-research.com> Mailing-List: list osint(a)yahoogroups.com; contact osint-owner(a)yahoogroups.com Delivered-To: mailing list osint(a)yahoogroups.com Date: Tue, 12 Oct 2004 14:47:48 -0400 Subject: [osint] Al-Qa'ida 'Survival Kit' Instructs Workers on Individual Conduct Reply-To: osint(a)yahoogroups.com Al-Qa'ida 'Survival Kit' Instructs Workers on Individual Conduct An Al Qaeda survival kit, available to the media in the United States and obtained also by Dawn, reveals how Osama bin Laden's network and its supporters among the Taliban and other similar groups are preparing to survive the US-led "war against terrorism". The kit has been printed in several languages and is being distributed secretly among Al Qaeda followers in Afghanistan and Pakistan. The instructions aim to prepare the Taliban and Al Qaeda workers and their sympathizers to survive on their own and also on how to communicate with their central leaders without exposing them. The contents show the groups are well aware of the changes brought about by the "war on terrorism" and realise they can no longer work openly. That's why they seem to be preparing for a long, clandestine war with the United States and its allies. Decentralization and secrecy are the two key elements of their new strategy, which they hope to prolong also by exploiting religious sentiments of the people they live with. The point the survival kit emphasizes repeatedly is the need for the Taliban and Al Qaeda workers to "merge with the masses" and thus "become indistinguishable" from the rest of the people. The copy obtained by Dawn comes complete with the pictures of 18 Al Qaeda leaders who are on the FBI's most-wanted list. The first picture is that of the network's leader Osama bin Laden, followed by his deputy Aiman al Zawahiri and other top operatives. A caption above the pictures declares: "These are Mujahideen, not dangerous religious terrorists". "Every member will take all necessary precautions in his personal and social life to protect the group and its leadership ... in his personal life, each member shall merge completely with the society he lives in so that he is indistinguishable from other members of the society." Some of the instructions in the kit for Al Qaeda and Taliban units are: "If you live in an area where people wear Western dresses, you also dress like them ... if the majority in that area has a secular mindset, do not express your religious sentiments." "Look closely at the ethnic complexion of your neighbourhood ... if the area has a large number of people from ethnic groups that support the government, stay away from them because they often spy for intelligence agencies." "Don't visit the local mosque regularly. Instead say your prayers at your residence, even the weekly Friday prayer ... while looking for a residence, have a credible, cover story that you will tell the landlord. Always stick to that story." "Don't roam around with beard and Islamic dress in fashionable neighbourhoods. Always take out the chip of the mobile [phone] while sleeping to avoid being caught. Use mobile [phone] from a crowded place so police don't locate the position. Don't write the original numbers of Mujahideen in a notebook; try to memorize the last three digits. "If you live in an area where people do not have cars, avoid using vehicles ... if you have to stay inside your residence when other people go to work, be quiet. Do not draw attention." The kit also contains tips on the use of a cellphone: "Use a cellphone only when you must and an alternative means of communication is not available ... it is better not to use cell phones at all ... if you must use a cell phone, use the one obtained under fake name and address ... never use a phone provided by your 'nazm' [management] for calling a friend or a relative ... if you ask your friends to call you, give them a specific time and keep your phone open only when you are expecting a call." "Do not receive a phone at your residence, do so at a bazaar or at an open space and shut off the phone and disconnect the battery as soon as you finish the conversation." How Al Qaeda members must use the Internet: "For using the Internet, you must go to an internet cafe ... never visit a site that can reveal your identity, such as those belonging to FBI, Al Qaeda or the Mujahideen ... when opening an e-mail account, go to an internet cafe, never do it at home ... never use the same internet cafe again and again ... before leaving the cafe, remove all evidence, never leave any trace ... while sending an e-mail, never use the language that could reveal your ideological commitment." "Write your message in a word processor, compose, cut, paste and send. And then disconnect. Never let your e-mail open to write a message." police interrogation: How to deal with police interrogation: "If unfortunately, a friend is arrested, he should remember two things: do not assume that the police know everything because they do not and always try to protect your friends and colleagues." "The police may try to make you believe that they already know everything and that if you lie or try to hide information from them, you will unnecessarily expose yourself to torture." "The place you are arrested from is important. If you are arrested from home, you will face a different set of questions than those arrested from a place of operation or from a Mujahideen hideout." "While being interrogated, try to guess if the interrogator suspects that you are a Mujahid or he knows you are one and vary your responses accordingly ... the investigators are humans like you, so do not let them bully you or enjoy unnecessary influence over you." "The key point is: you are not guilty unless proven, so do not let your answers (be used) as evidence against you. Do not let your answers lead the interrogators to other friends." [Description of Source: Karachi Dawn in English -- Internet version of most widely read English-language daily] FBIS Source-Date: 10/12/2004 [Non-text portions of this message have been removed] ------------------------ Yahoo! Groups Sponsor --------------------~--> Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar. Now with Pop-Up Blocker. Get it for free! http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

U.S. Funds Chat-Room Surveillance Study
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://www.washingtonpost.com/ac2/wp-dyn/A25272-2004Oct11?language=printer> The Washington Post washingtonpost.com U.S. Funds Chat-Room Surveillance Study By Michael Hill The Associated Press Monday, October 11, 2004; 8:31 PM TROY, N.Y. -- Amid the torrent of jabber in Internet chat rooms - flirting by QTpie and BoogieBoy, arguments about politics and horror flicks - are terrorists plotting their next move? The government certainly isn't discounting the possibility. It's taking the idea seriously enough to fund a yearlong study on chat room surveillance under an anti-terrorism program. A Rensselaer Polytechnic Institute computer science professor hopes to develop mathematical models that can uncover structure within the scattershot traffic of online public forums. Chat rooms are the highly popular and freewheeling areas on the Internet where people with self-created nicknames discuss just about anything: teachers, Kafka, cute boys, politics, love, root canal. They are also places where malicious hackers have been known to trade software tools, stolen passwords and credit card numbers. The Pew Internet & American Life Project estimates that 28 million Americans have visited Internet chat rooms. Trying to monitor the sea of traffic on all the chat channels would be like assigning a police officer to listen in on every conversation on the sidewalk - virtually impossible. Instead of rummaging through megabytes of messages, RPI professor Bulent Yener will use mathematical models in search of patterns in the chatter. Downloading data from selected chat rooms, Yener will track the times that messages were sent, creating a statistical profile of the traffic. If, for instance, RatBoi and bowler1 consistently send messages within seconds of each other in a crowded chat room, you could infer that they were speaking to one another amid the "noise" of the chat room. "For us, the challenge is to be able to determine, without reading the messages, who is talking to whom," Yener said. In search of "hidden communities," Yener also wants to check messages for certain keywords that could reveal something about what's being discussed in groups. The $157,673 grant comes from the National Science Foundation's Approaches to Combat Terrorism program. It was selected in coordination with the nation's intelligence agencies. The NSF's Leland Jameson said the foundation judged the proposal strictly on its broader scientific merit, leaving it to the intelligence community to determine its national security value. Neither the CIA nor the FBI would comment on the grant, with a CIA spokeswoman citing the confidentiality of sources and methods. Security officials know al-Qaida and other terrorist groups use the Internet for everything from propaganda to offering tips on kidnapping. But it's not clear if terrorists rely much on chat rooms for planning and coordination. Michael Vatis, founding director of the National Infrastructure Protection Center and now a consultant, said he had heard of terrorists using chat rooms, which he said offer some security as long as code phrases are used. Other cybersecurity experts doubted chat rooms' usefulness to terrorists given the other current options, from Web mail to hiding messages on designated Web pages that can only be seen by those who know where to look. "In a world in which you can embed your message in a pixel on a picture on a home page about tea cozies, I don't know whether if you're any better if you think chat would be any particular magnet," Jonathan Zittrain, an Internet scholar at Harvard Law School. Since they are focusing on public chat rooms, authorities are not violating constitutional rights to privacy when they keep an eye on the traffic, experts said. Law enforcement agents have trolled chat rooms for years in search of pedophiles, sometimes adopting profiles making it look like they are young teens. But the idea of the government reviewing massive amounts of public communications still raises some concerns. Mark Rasch, a former head of the Justice Department's computer crimes unit, said such a system would bring the country one step closer to the Pentagon's much-maligned Terrorism Information Awareness program. Research on that massive data-mining project was halted after an uproar over its impact on privacy. "It's the ability to gather and analyze massive amounts of data that creates the privacy problem," Rasch said, "even though no individual bit of data is particularly private." ) 2004 The Asso -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Airline ID requirement faces legal challenge
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://www.usatoday.com/tech/news/surveillance/2004-10-10-privacy_x.htm> USA Today Airline ID requirement faces legal challenge By Richard Willing, USA TODAY At a time when Americans have come to expect tight security for air travel, it might seem to be an odd question: Does requiring airline passengers to show identification before they board domestic flights amount to an "unreasonable search" under the Constitution? John Gilmore is challenging the federal domestic airline ID requirement, saying it violates his right to travel in the USA anonymously. File photo Yes, says John Gilmore, a computer whiz who made a fortune as an early employee of Sun Microsystems. His challenge of the federal ID requirement, which soon could get a hearing before a U.S. appeals court in San Francisco, is one of the latest court battles to test the balance between security concerns and civil liberties. At issue is Gilmore's claim that checking the IDs of passengers on domestic flights violates his right to travel throughout the USA anonymously, without the government monitoring him. Lawyers involved in the case say it apparently is the first such challenge to the federal rules that require airline passengers to provide identification. In a similar case, two peace activists are suing the U.S. government to determine how their names came to be placed on a federal "no-fly list." Rebecca Gordon and Janet Adams were not allowed to board a San Francisco to Boston flight in August 2002 after they were told that their names were on a "secret FBI" list of potential security threats, their court filing says. "I believe I have a right to travel in my own country without presenting what amounts to an internal passport," Gilmore, 49, said in an interview. "I have a right to be anonymous, (to not) be tracked by my government for no good reason." Gilmore said he has no problem with security checks that focus on passengers' luggage. He says he also does not object to having to present a passport to board flights to other countries. Some privacy groups say Gilmore has a point. But others who support the ID requirement have cast the San Francisco resident as being out of touch with the realities of air travel since the Sept. 11 attacks. Kent Scheidegger, counsel for the Criminal Justice Legal Foundation, a conservative group in Sacramento, says the ID requirement is good policy and "eminently constitutional." "The Fourth Amendment forbids not searches that you don't like, it forbids unreasonable searches," he says. "Nothing could be more reasonable at this time than to know who you're flying with." The Justice Department is fighting Gilmore's claim. Acting on the department's motion, a U.S. district court judge in San Francisco dismissed the suit last March. Gilmore has appealed; a hearing before the 9th Circuit Court of Appeals is likely to be scheduled after briefs are filed next month. In court papers, the Justice Department has not defended the ID policy, or even acknowledged it exists. It has said national security law requires that this aspect of the case be argued in a courtroom closed to the public, including Gilmore. The appeals court denied the government's secrecy request Sept. 20, and the government has asked the court to reconsider. Rules on the Transportation Security Administration's Web site say passengers 18 and older need one form of government-issued photo identification or two forms of non-photo identification to board domestic flights. Airlines adopted such a policy on their own after terrorists bombed an international flight over Lockerbie, Scotland, in December 1988. The bomb that killed all 270 passengers on the jet was said to have been placed in a passenger's luggage by a terrorist who got into a restricted area. The airlines say checking IDs against luggage and passenger information is a way to deny terrorists access to flights. The TSA, formed two years ago in the wake of the Sept. 11 attacks, checks IDs to verify passenger identities and to check them against "watch lists" of known or suspected terrorists. Gilmore's suit says the requirement amounts to an unreasonable search, a "burden" on the right to travel and a form of self-incrimination because it singles out "anonymous travelers" for searching. Gilmore said the ID requirement does little to ensure security. "Ordinary citizens may show correct identification, but do we really think that someone who is willing to commit a terrorist act won't also be willing to present false identification?" Gilmore's suit was filed in 2002, after he was denied seats on two flights at the airport in Oakland. It was his first domestic flight since the 9/11 attacks. Before then, Gilmore said, he was permitted to board flights after presenting a Federal Aviation Administration document that said showing IDs was optional. In 1982, Gilmore, a computer programmer, was the first person hired by the founders of what became Sun Microsystems. He retired eight years ago with what his publicist, Bill Scannell, calls "multiples" of millions of dollars. Since then, Gilmore said, he has worked to promote "individual rights," in part by sponsoring a foundation that is critical of travel restrictions and what he considers violations of speech and privacy rights. Last year, before taking off on a British Airways flight from San Francisco to London, Gilmore angered fellow travelers by refusing to remove a blue button on his lapel that had the words "suspected terrorist" imposed over the picture of an airliner. After a delay, the pilot went back to the gate and ordered Gilmore off the jet. While his case moves through court, Gilmore has remained grounded when it comes to domestic travel. He hired friends to drive him to San Diego and across the country to attend board meetings of corporate and non-profit groups. He took a driving vacation to Oregon. Invited to a family reunion in Massachusetts, he thought of chartering a private plane but balked at the $33,000 price. "Yes, it can be inconvenient at times," Gilmore said of his fight against the ID requirement. "But I believe I'm right." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

UK ID cards to be issued with first biometric passports
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://www.theregister.co.uk/2004/10/11/new_passport_equals_new_id_card/pri…> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2004/10/11/new_passport_equals_new_id_card/ UK ID cards to be issued with first biometric passports By John Lettice (john.lettice at theregister.co.uk) Published Monday 11th October 2004 07:35 GMT What's left of the 'voluntary' figleaf to the UK's ID scheme will erode in the next few months, when Home Secretary David Blunkett introduces legislation that will allow implementation of the scheme and include provision for a rolling programme to issue ID cards along with passport renewals. The new model passports are closely linked to the scheme anyway, so even without the ID card, being issued one would mean you were added to the national identity register, but the arrival of an actual card along with the new passport will make its presence far more visible, far earlier, to the general public. Previously the Home Office had said it would designate passports and driving licences as ID documents, but hadn't mentioned issuing actual ID cards with them. Blunkett announced the move some considerable way into his speech to the Labour Party Conference ten days ago. Reporting of the speech at the time concentrated on anti-crime measures and more funding for counter-terrorism, and the full text of the speech was mysteriously unavailable until a few days ago. According to this text: "... we will legislate this winter to upgrade our secure passport system, to create a new, clean database on which we will understand and know who is in or country, who is entitled to work, to services, to the something for something society which we value. As people renew their passports, they will receive their new identity card. The cost of biometrics and the card will be added to the total of passports." The increased cost of the new model passport has previously been justified on the basis that the biometrics will be needed in order for the passport to conform to new international standards. Adding the cost of the "voluntary" ID card to the passport is therefore a novel innovation. A similar approach could be adopted as the ID system rolls out to driving licences, with the licence-renewing public having no choice but to accept the ID card if they want a licence, and no choice then but to pay for it. Blunkett did not cover this in his speech, but it may be covered in the forthcoming legislation, and once these two key ID document areas are covered, the rest of the population can be slowly mopped up. The David Blunkett who announced this effectively compulsory ID regime is, strange but true, the very same David Blunkett who, in his introduction to "Legislation on Identity Cards - A Consultation" (CM6178, presented to Parliament in April 2004) said: "...we would proceed by incremental steps, building first on existing, widely held voluntary identity documents, and only taking a final decision later to move to compulsion. Eventually everyone lawfully resident in the UK would be required to register for a card - but there would be no compulsion to carry the card or to produce it without good reason. This move to compulsion would only happen once the initial stage of the scheme had proved to be successful and following a further debate and the approval of both Houses of Parliament." This is actually a pretty useful way to put it, because it allows MPs to kid themselves that we have here an incremental scheme that Parliament will have the final say-so on while giving Blunkett the freedom to crash along as fast as he likes without having actually told a flat-out lie. In this picture compulsion comes in two flavours, compulsion to register for a card and compulsion to carry one. It will not - at least in the current rounds of legislation - be compulsory to carry a card, so Parliament's approval of the move towards compulsion covers compulsion to register. The fact that people who want passports, then probably driving licences (then benefits and healthcare, as indicated in the "consultation") will have no choice but to be registered need not be viewed as tripping the compulsion switch, because within a steadily shrinking service-free pen it will be possible for people to exist without being registered. The draft bill does however include powers "to set a date when it would become compulsory to register and be issued with a card" and "This provision could only be brought in once the initial stage of the identity cards scheme was in place and following a vote in both Houses of Parliament on a detailed report which sets out all the reasons for the proposed move to compulsion." We think we can save the Home Office some money here. The report should say: "We might as well because nearly everyone has a card already." And, Blunkett hopes, because it's loved. In his speech he went on to say: "We will have, for the first time, an opportunity to use the card not simply in terms of protection, but to promote our citizenship, to value the fact that being a citizen, taking on citizenship is a tremendous step as part of our mutuality, as communities and a nation." So once we've all been compelled to register for it and pay for it, we'll rejoice over it, and the ID card will become a symbol of national pride, social cohesion and unity. Nice hive you've got there, David... Blunkett's speech also mentioned Tony Blair's electronic border surveillance announcement, made the previous day with considerably more fanfare. This meant, he said: "In two years time we will have up and running the most sophisticated system in the world." Which, as we pointed out here, (http://www.theregister.co.uk/2004/09/29/uk_intros_semaphore_capps_uk/) is tripe. It checks the lists of passengers bound for the UK against "databases of individuals who pose a security risk," and if this counts as sophistication round at the Home Office we're in just as bad a mess as we think we're in. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Cash, Credit -- or Prints?
by Tyler Durden 12 Oct '04

12 Oct '04

Very interesting question. I'd bet almost any amount of money that it's fairly trivial to simply alligator-clip-out the fingerprint's file from almost any of the cheaper devices. Hell, I'd bet that's true even of more expensive "secure" devices as well. -TD >From: Frank Siebenlist <franks(a)mcs.anl.gov> >To: "R.A. Hettinga" <rah(a)shipwright.com> >CC: cryptography(a)metzdowd.com, cypherpunks(a)al-qaeda.net >Subject: Re: Cash, Credit -- or Prints? >Date: Mon, 11 Oct 2004 17:34:19 -0700 > >Can anyone explain how sophisticated those fingerprint readers are? > >Are there readers out there that by themselves are secure devices and >essentially are able to talk with their servers thru the PCs/workstations >over a protocol such that any man-in-the-middle, like a driver, can not >learn anything from the traffic? >(...and all that for less than $40, of course...) > >If not, would a trojan then be able to capture your fingerprint's >digital-fingerprint, and impersonate you from any other node on the >network? > >-Frank. > > > >R.A. Hettinga wrote: > >><http://online.wsj.com/article_print/0,,SB109744462285841431,00.html> >> >>The Wall Street Journal >> >> >>October 11, 2004 >> >> >>Cash, Credit -- or Prints? >>Fingerprints May Replace >>Money, Passwords and Keys; >>One Downside: Gummi Fakes >> >>By WILLIAM M. BULKELEY >>Staff Reporter of THE WALL STREET JOURNAL >>October 11, 2004; Page B1 >> >> >>Fingerprints aren't just for criminals anymore. Increasingly, they are for >>customers. >> >>Fingerprint identification is being used to speed up checkouts at Piggly >>Wiggly supermarkets in South Carolina, and to open storage lockers at the >>Statue of Liberty. Fingerprints are also being used as password >>substitutes >>in cellphones and laptop computers, and in place of combinations to open >>up >>safes. >> >>But these aren't the fingerprints of yore, in which the person placed his >>hand on an ink pad, then on paper. Instead, the user sets his hand on a >>computerized device topped with a plate of glass, and an optical reader >>and >>special software and chips identify the ridges and valleys of the >>fingertips. >> >>Fingerprint technology seems to be reaching critical mass and is spreading >>faster than other widely promoted "biometric" identification methods, such >>as eyeball scanning, handprint-geometry reading and facial recognition. >>Interest in these and other new security systems was heightened by the >>September 2001 terror attacks. >> >>"Fingerprints will be dominant for the foreseeable future," says Don >>McKeon, the product manager for biometric security at International >>Business Machines Corp. >> >>One reason fingerprint-security is spreading is that technological >>advances >>are bringing the cost down. Microsoft Corp. recently introduced a >>stand-alone fingerprint reader for $54, and a keyboard and a mouse with >>fingerprint readers. Last week, IBM said it would start selling laptop >>computers with fingerprint readers built in. These products reduce the >>need >>for personal-computer users to remember passwords. >> >>A customer uses a fingerprint reader to pay at a Piggly Wiggly store, >>cutting his checkout time. >> >> >> >>Earlier this year, American Power Conversion Corp., a Rhode Island company >>that makes backup computer batteries, started selling a fingerprint reader >>for PCs with a street price of $45 -- less than half the price of >>competitors at the time. American Power says it has sold tens of thousands >>of the devices since. >> >>Korea's LG Electronics Inc. has introduced a cellphone with a silicon chip >>at its base that requires the owner's finger to be swiped across its >>surface before the phone can be used. This summer, NTT DoCoMo Inc. started >>selling a similar phone reader that is being used on Japanese trains as an >>electronic wallet to pay fares or to activate withdrawals from on-board >>cash machines. >> >>Proponents have never had trouble explaining the benefits of fingerprints >>as payment-and-password alternatives: Each person has a unique set, and >>their use is established in the legal system as an authoritative means of >>identification. But some people are uneasy about registering their >>fingerprints because of the association with criminality and the potential >>that such a universal identifier linked to all personal information would >>reduce privacy. >> >>Moreover, numerous businesses and governments have tested fingerprint >>systems in the past only to rip them out when the hype failed to match >>reality. That's partly because the optical readers have had problems with >>certain people's fingers. Elderly people with dry skin, children who >>pressed down too hard, even women with smaller fingers -- including many >>Asians -- were often rejected as unreadable. >> >>Security experts also have successfully fooled some systems by making >>plaster molds of fingers and then creating fake fingers by filling the >>molds with Silly-Putty-type plasticizers or gelatin similar to that used >>in >>candy Gummi Bears. >> >>But advocates say the rate of false rejections of legitimate users has >>been >>greatly reduced by improved software. "I'd say 99% of people can register" >>their fingers, says Brad Hill, who installed fingerprint-controlled >>lockers >>at his souvenir store at the Statue of Liberty this summer when the >>National Park Service forbade tourists from entering the statue while >>carrying packages. Mr. Hill was worried that tourists would lose locker >>keys when security screeners forced them to empty their pockets. >> >>Some makers of readers also say their technology can solve the fake-finger >>problem by taking readings from below the surface skin layer. Or they >>suggest combining four-digit ID codes with fingerprint scanning to >>virtually eliminate false readings. >> >>Makers of fingerprint readers acknowledge the privacy concerns. But they >>maintain that the threat of personal invasion is minimized because most >>systems don't store the actual print, but instead use it to generate a >>unique series of numbers that can't be reverse-engineered to re-create the >>print. And public willingness to submit to fingerprint readers has soared >>since the 2001 terrorist attacks, as the need for security overcomes >>worries about unwarranted intrusion. >> >>While the market for fingerprint readers is small, it is growing fast. >>International Biometric Group, a New York market-research firm, predicts >>that sales will rise 86% to $368 million this year from $198 million last >>year. AuthenTec Inc., of Melbourne, Fla., which makes the >>fingerprint-reading chips used in the LG cellphone, expects to ship more >>than three million of them this year, triple the level of 2003. Their >>price >>has fallen below $6 apiece, and Scott Moody, AuthenTec's chief executive, >>sees that dropping below $4 next year. >> >>Ubiquitous use of fingerprints could eliminate a huge consumer headache: >>remembering passwords for various Web sites. With American Power's >>fingerprint reader, users register all of their passwords online, along >>with the associated Web sites. Then they never have to type in a password >>again. >> >>"Our parents didn't deal with the problem of remembering 20 passwords, and >>our grandkids won't even know what they are," says IBM's Mr. McKeon. >> >>Potentially, fingerprint readers also could replace credit and debit >>cards. >>Pay by Touch Co., a closely held San Francisco company that is working >>with >>IBM, installs fingerprint readers in retail stores where customers can >>register their fingers by touching the pad five times. Then they can >>register supermarket loyalty cards and several credit card-numbers. They >>even can use the fingerprint reader to withdraw money from a checking >>account at the cash register. >> >>Another use: A consumer could register a driver's license and his or her >>age with the system, so clerks won't have to examine identification cards >>for purchases of beer or cigarettes. The next time the customer checks >>out, >>he or she just touches the pad, enters his or her phone number and selects >>from the list of payment options. Pay by Touch, which charges retailers 5 >>to 10 cents per transaction, claims the system reduces checkout time by >>30%. >> >>One early user of Pay by Touch are a handful of Piggly Wiggly >>supermarkets. >>After installing the system in four stores in July, "a good, strong >>percentage of our transactions are done by touch" already, says David >>Schools, senior vice president of Piggly Wiggly Carolina Inc., based in >>Charleston. He declined to be more specific. The chain hopes that >>customers >>will register checking accounts and make electronic withdrawals via >>fingerprint ID to pay for purchases, which would save the grocer steep >>credit-card or debit-card fees. >> >>IBM says that convenience stores are experimenting with fingerprints as an >>alternative to radio-frequency identification cards like Exxon Mobil >>Corp.'s Speedpass, to deal with the "sweaty jogger problem" -- cashless >>runners coming in for coffee or Gatorade. The problem with RFID cards is >>that anyone can use one that is lost or stolen. Not so with fingerprints. >> >>Jeff Baughan, vice president of information technology at Catholic Health >>Systems in Buffalo, N.Y., says he anticipates some day installing wireless >>readers on the carts used by nursers that would read patients' fingers, to >>double-check that the right patient gets the right medicine. Currently, >>the >>health-care system is installing Ultra-Scan Corp. devices that read >>fingers >>to register incoming patients and make sure that different people aren't >>using the same insurance card. >> >>Fingerprint-scanner authorization also is being used by business owners as >>a replacement for lock combinations on safes. "Traditionally, two people >>are given the same combination, and if there's a loss, how can you figure >>out who took it?" says Edward McGunn, president of Corporate Safe >>Specialists Inc., of Posen, Ill. He predicts that within two years, 80% of >>his sales will be fingerprint safes, partly because it's much simpler to >>train an unskilled manager to open one. "This is the most exciting time to >>be in the safe business in my lifetime," says Mr. McGunn, a >>third-generation safe maker. >> >> > >-- >Frank Siebenlist franks(a)mcs.anl.gov >The Globus Alliance - Argonne National Laboratory > >--------------------------------------------------------------------- >The Cryptography Mailing List >Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement

1 0

Re: Congress Close to Establishing Rules for Driver's Licenses
by Tyler Durden 12 Oct '04

12 Oct '04

Can't specifically confirm that, but this last summer I traveled to several countries (and back into the US) using an expired passport as ID (and no, they didn't just forget to read the date, the expired passport was officially acceptable). -TD >From: "Riad S. Wahby" <rsw(a)jfet.org> >To: Cypherpunks <cypherpunks(a)al-qaeda.net> >Subject: Re: Congress Close to Establishing Rules for Driver's Licenses >Date: Tue, 12 Oct 2004 10:09:26 -0500 > >Dave Howe <DaveHowe(a)gmx.co.uk> wrote: > > And how many americans have a passport,and carry one for identification > > purposes? > >Probably not all that many. > >Tangentially, I was once told that, at least in Massachusetts liquor >stores, even an _expired_ passport was useful identification. Can >anyone confirm that this is true other than at Sav-Mor Liquors? > >-- >Riad S. Wahby >rsw(a)jfet.org _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

1 0

Cash, Credit -- or Prints?
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://online.wsj.com/article_print/0,,SB109744462285841431,00.html> The Wall Street Journal October 11, 2004 Cash, Credit -- or Prints? Fingerprints May Replace Money, Passwords and Keys; One Downside: Gummi Fakes By WILLIAM M. BULKELEY Staff Reporter of THE WALL STREET JOURNAL October 11, 2004; Page B1 Fingerprints aren't just for criminals anymore. Increasingly, they are for customers. Fingerprint identification is being used to speed up checkouts at Piggly Wiggly supermarkets in South Carolina, and to open storage lockers at the Statue of Liberty. Fingerprints are also being used as password substitutes in cellphones and laptop computers, and in place of combinations to open up safes. But these aren't the fingerprints of yore, in which the person placed his hand on an ink pad, then on paper. Instead, the user sets his hand on a computerized device topped with a plate of glass, and an optical reader and special software and chips identify the ridges and valleys of the fingertips. Fingerprint technology seems to be reaching critical mass and is spreading faster than other widely promoted "biometric" identification methods, such as eyeball scanning, handprint-geometry reading and facial recognition. Interest in these and other new security systems was heightened by the September 2001 terror attacks. "Fingerprints will be dominant for the foreseeable future," says Don McKeon, the product manager for biometric security at International Business Machines Corp. One reason fingerprint-security is spreading is that technological advances are bringing the cost down. Microsoft Corp. recently introduced a stand-alone fingerprint reader for $54, and a keyboard and a mouse with fingerprint readers. Last week, IBM said it would start selling laptop computers with fingerprint readers built in. These products reduce the need for personal-computer users to remember passwords. A customer uses a fingerprint reader to pay at a Piggly Wiggly store, cutting his checkout time. Earlier this year, American Power Conversion Corp., a Rhode Island company that makes backup computer batteries, started selling a fingerprint reader for PCs with a street price of $45 -- less than half the price of competitors at the time. American Power says it has sold tens of thousands of the devices since. Korea's LG Electronics Inc. has introduced a cellphone with a silicon chip at its base that requires the owner's finger to be swiped across its surface before the phone can be used. This summer, NTT DoCoMo Inc. started selling a similar phone reader that is being used on Japanese trains as an electronic wallet to pay fares or to activate withdrawals from on-board cash machines. Proponents have never had trouble explaining the benefits of fingerprints as payment-and-password alternatives: Each person has a unique set, and their use is established in the legal system as an authoritative means of identification. But some people are uneasy about registering their fingerprints because of the association with criminality and the potential that such a universal identifier linked to all personal information would reduce privacy. Moreover, numerous businesses and governments have tested fingerprint systems in the past only to rip them out when the hype failed to match reality. That's partly because the optical readers have had problems with certain people's fingers. Elderly people with dry skin, children who pressed down too hard, even women with smaller fingers -- including many Asians -- were often rejected as unreadable. Security experts also have successfully fooled some systems by making plaster molds of fingers and then creating fake fingers by filling the molds with Silly-Putty-type plasticizers or gelatin similar to that used in candy Gummi Bears. But advocates say the rate of false rejections of legitimate users has been greatly reduced by improved software. "I'd say 99% of people can register" their fingers, says Brad Hill, who installed fingerprint-controlled lockers at his souvenir store at the Statue of Liberty this summer when the National Park Service forbade tourists from entering the statue while carrying packages. Mr. Hill was worried that tourists would lose locker keys when security screeners forced them to empty their pockets. Some makers of readers also say their technology can solve the fake-finger problem by taking readings from below the surface skin layer. Or they suggest combining four-digit ID codes with fingerprint scanning to virtually eliminate false readings. Makers of fingerprint readers acknowledge the privacy concerns. But they maintain that the threat of personal invasion is minimized because most systems don't store the actual print, but instead use it to generate a unique series of numbers that can't be reverse-engineered to re-create the print. And public willingness to submit to fingerprint readers has soared since the 2001 terrorist attacks, as the need for security overcomes worries about unwarranted intrusion. While the market for fingerprint readers is small, it is growing fast. International Biometric Group, a New York market-research firm, predicts that sales will rise 86% to $368 million this year from $198 million last year. AuthenTec Inc., of Melbourne, Fla., which makes the fingerprint-reading chips used in the LG cellphone, expects to ship more than three million of them this year, triple the level of 2003. Their price has fallen below $6 apiece, and Scott Moody, AuthenTec's chief executive, sees that dropping below $4 next year. Ubiquitous use of fingerprints could eliminate a huge consumer headache: remembering passwords for various Web sites. With American Power's fingerprint reader, users register all of their passwords online, along with the associated Web sites. Then they never have to type in a password again. "Our parents didn't deal with the problem of remembering 20 passwords, and our grandkids won't even know what they are," says IBM's Mr. McKeon. Potentially, fingerprint readers also could replace credit and debit cards. Pay by Touch Co., a closely held San Francisco company that is working with IBM, installs fingerprint readers in retail stores where customers can register their fingers by touching the pad five times. Then they can register supermarket loyalty cards and several credit card-numbers. They even can use the fingerprint reader to withdraw money from a checking account at the cash register. Another use: A consumer could register a driver's license and his or her age with the system, so clerks won't have to examine identification cards for purchases of beer or cigarettes. The next time the customer checks out, he or she just touches the pad, enters his or her phone number and selects from the list of payment options. Pay by Touch, which charges retailers 5 to 10 cents per transaction, claims the system reduces checkout time by 30%. One early user of Pay by Touch are a handful of Piggly Wiggly supermarkets. After installing the system in four stores in July, "a good, strong percentage of our transactions are done by touch" already, says David Schools, senior vice president of Piggly Wiggly Carolina Inc., based in Charleston. He declined to be more specific. The chain hopes that customers will register checking accounts and make electronic withdrawals via fingerprint ID to pay for purchases, which would save the grocer steep credit-card or debit-card fees. IBM says that convenience stores are experimenting with fingerprints as an alternative to radio-frequency identification cards like Exxon Mobil Corp.'s Speedpass, to deal with the "sweaty jogger problem" -- cashless runners coming in for coffee or Gatorade. The problem with RFID cards is that anyone can use one that is lost or stolen. Not so with fingerprints. Jeff Baughan, vice president of information technology at Catholic Health Systems in Buffalo, N.Y., says he anticipates some day installing wireless readers on the carts used by nursers that would read patients' fingers, to double-check that the right patient gets the right medicine. Currently, the health-care system is installing Ultra-Scan Corp. devices that read fingers to register incoming patients and make sure that different people aren't using the same insurance card. Fingerprint-scanner authorization also is being used by business owners as a replacement for lock combinations on safes. "Traditionally, two people are given the same combination, and if there's a loss, how can you figure out who took it?" says Edward McGunn, president of Corporate Safe Specialists Inc., of Posen, Ill. He predicts that within two years, 80% of his sales will be fingerprint safes, partly because it's much simpler to train an unskilled manager to open one. "This is the most exciting time to be in the safe business in my lifetime," says Mr. McGunn, a third-generation safe maker. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: Implant replaces ID cards for access to restricted areas.
by John Kelsey 12 Oct '04

12 Oct '04

>From: Steve Furlong <sfurlong(a)acmenet.net> >Sent: Oct 9, 2004 7:44 AM >To: cypherpunks(a)al-qaeda.net >Subject: Re: Implant replaces ID cards for access to restricted areas. >On Thu, 2004-10-07 at 02:20, Nomen Nescio wrote: >> Mexican Attorney General, Staff Get Chip Implants >> >> Implant replaces ID cards for access to restricted areas. >I think I'd get the implant under my scalp somewhere. If the implant >gave access to a really critical place, I wouldn't want to risk losing >an arm or whatever. Also, I'd be able to block the implant's signals >with my nifty tinfoil hat. I've been waiting for a use for that thing. Actually, I think the protocol requires that it be placed on your forehead, right under the tattooed sixes. Or maybe I'm getting my protocols mixed up.... --John

1 0