December 2004 - cypherpunks-legacy

Quantum key distribution
by R.A. Hettinga 01 Dec '04

01 Dec '04

<http://www.aip.org/tip/INPHFA/vol-10/iss-6/p22.html> - The Industrial Physicist ?Quantum key distribution Data carrying photons may be transmitted by laser and detected in such a way that any interference will be noted by Jennifer Ouellette pdf version of this article Computing's exponential increase in power requires setting the bar always higher to secure electronicdata transmissions from would-be hackers. The ideal solution would transmit data in quantum bits, but truly quantum information processing may lie decades away. Therefore, several companies have focused on bringing one aspect of quantum communications to market- quantum key distribution (QKD), used to exchange secret keys that protect data during transmission. Two companies, MagiQ Technologies (New York, NY) and ID Quantique (Geneva, Switzerland), have released commercial QKD systems, and several others plan to enter the marketplace within two years. Figure 1. When blue light is pumped into a nonlinear crystal, entangled photon pairs (imaged here as a red beam with the aid of a diode laser) emerge at an angle of 30 to the blue beam, and the beams are sent into single-mode fibers to be detected. Because the entangled photons "know" each other, any interference will result in a mismatch when the two beams are compared. (University of Vienna/Volker Steger) "There is a continuous war between code makers and code breakers," says Alexei Trifonov, chief scientist with MagiQ. Cryptologists devise more difficult coding schemes, only to have them broken. Quantum cryptography has the potential to end that cycle. This is important to national security and modern electronic business transactions, which transmit credit card numbers and other sensitive information in encrypted form. The Department of Defense (DoD) currently funds several quantum-cryptography projects as part of a $20.6 million initiative in quantum information. Globally, public and private sources will fund about $50 million in quantum-cryptography work over the next several years. Andrew Hammond, a vice president of MagiQ, estimates that the market for QKD systems will reach $200 million within a few years, and one day could hit $1 billion annually. Key types QKD was proposed roughly 20 years ago, but its premise rests on the formulation of Heisenberg's uncertainty principle in 1927. The very act of observing or measuring a particle-such as a photon in a data stream-changes its behavior (Figure 1). Any moving photon can have one of four orientations: vertical, horizontal, or diagonal in either direction. A standard laser can be modified to emit single photons, each with a particular orientation. Would-be hackers (eavesdroppers in cryptography parlance) can record the orientations with photon detectors, but doing so changes the orientation of some photons-and, thus, alerts the sender and receiver of a compromised transmission. An encryption key-the code needed to encrypt or decipher a message-consists of a string of random bits. Such a key is useless unless it is completely random, known only to the communicating parties, and changed regularly. In the one-time-pad approach, the key length must equal the message length, and it should be used only once. In theory, this makes the encrypted message secure, but problems arise in practice. In the real world, keys must be exchanged by a CD-ROM or some other physical means, which makes keys susceptible to interception. Reusing a key gives code breakers the opportunity to find patterns in the encrypted data that might reveal the key. Historically, the Soviet Union's accidental duplication of one-time-pad pages allowed U.S. cryptanalysts to unmask the spy Klaus Fuchs in 1949. Rather than one-time-pad keys, many data-transmission security systems today use public-key cryptography, which relies on very long prime numbers to transmit keys. A typical public-key encryption scheme uses two keys. The first is a public key, available to anyone with access to the global registry of public keys, and the message is encrypted with it. The second is private, accessible only to the receiver. Both keys are needed to unscramble a message. The system's primary weakness is that a powerful computer could use the public key to learn the private key (see The Industrial Physicist, August 2000, pp. 29-33). Quantum key distribution A key distributed using quantum cryptography would be almost impossible to steal because QKD systems continually and randomly generate new private keys that both parties share automatically. A compromised key in a QKD system can only decrypt a small amount of encoded information because the private key may be changed every second or even continuously. To build up a secret key from a stream of single photons, each photon is encoded with a bit value of 0 or 1, typically by a photon in some superposition state, such as polarization. These photons are emitted by a conventional laser as pulses of light so dim that most pulses do not emit a photon. This approach ensures that few pulses contain more than one photon. Additional losses occur as photons travel through the fiber-optic line. In the end, only a small fraction of the received pulses actually contain a photon. However, this low yield is not problematic for QKD because only photons that reach the receiver are used. The key is generally encoded in either the polarization or the relative phase of the photon (see "Keeping Alice and Bob secure", below). The most common standard protocol for QKD is called BB84, after its inventors, IBM's Charles Bennett and Gilles Brassard. Invented in 1984, it uses a stream of single photons to transfer a cryptographic key between two parties, who can use it to encode and decode data transmitted using standard high-speed techniques. Right now, single photons allow real-time data transmissions only at low speed, typically 100 bits/s-a hundred millionth the speed of today's fastest fiber-optic transmission systems. That explains why most companies have focused on commercializing QKD and not on data encryption. Polarization-based encoding works best for free-space communication systems rather than fiber-optic lines. Data are transmitted faster in free-space systems, but they cannot traverse the longer distances of fiber-optic links. In July 2004, a team at the National Institute of Standards and Technology (NIST), working with Acadia Optronics (Rockville, MD), demonstrated the world's fastest quantum- cryptography system by sending a quantum key over a 730-m free-space link at rates of up to 1 megabit/s- 1,000 times as fast as previously reported results. The NIST system uses an infrared laser to generate the photons and reflecting telescopes with 8-in. mirrors to send and receive the photons through air. NIST's system differs from other existing QKD systems in how it identifies a photon from the sender, as opposed to photons from another source, such as the sun. The scientists record the exact time of each emission and look for a photon only when one is expected. The window of observation time must be very short, but NIST physicist Joshua Bienfang says that making frequent brief observations enables the team to generate new keys more often. Fiber-optic links Randomly generated keys are changed up to 1,000 times/s in MagiQ's OPN Security Gateway, which uses a secure fiber-optic link to transmit the changing key sequence up to 120 km as a stream of polarized photons. The company claims that linking its systems together can transmit a QKD several hundred kilometers (Figures 2 and 3). Quantum properties other than polarization can encode the value of a bit for the quantum key, says Gregoire Ribordy, CEO of Swiss start-up ID Quantique. His company introduced the first commercial quantum-cryptography products in 2002: single-photon detectors and random-number generators, two essential components for quantum-cryptography systems. In 2003, the company partnered with two electronic-security firms to develop a commercial system. Figure 3. A more detailed network shows routers for concentrating and directing Internet traffic, Sonet telecommunications protocol, wave division multiplexers, optical amplifiers, and repeaters. ID Quantique's system encodes data in the phase of the photon instead of its polarization state. An interferometer splits beams of light and then recombines them at the output end, and it can do the same with a single photon. Although a photon cannot split in two, its dual wave-particle nature allows it to travel through both arms of the interferometer as a wave, only becoming a particle again when it recombines and is detected at the output end. It takes but a slight change in the length of one interferometer arm to randomly alter a photon's phase. Figure 4. Henry Yeh, director of programs, and Chip Elliot, principal engineer, in the Quantum Laboratory at BBN Technologies, which operates the DARPA-funded world's first quantum key distribution network. (BBN Technologies) In 2002, scientists at Northwestern University developed a quantum-cryptography method capable of sending encr ypted data over a fiber- optic line at 250 megabits/s, almost 1,000 times as fast as prior quantum technology. The team used standard lasers and existing optical technology to transmit large bundles of photons; other techniques used in quantum cryptography rely on single photons, which are harder to detect. BBN Technologies (Cambridge, MA) operates the world's first quantum cryptographic network, which links several different kinds of QKD systems (Figure 4). Some use off-the-shelf optical lasers and detectors to emit and detect single photons; others use entangled pairs of photons. This DARPA-funded network runs between BBN, Harvard, and Boston University, a citysized schematic designed to test the robustness of such systems in real-world applications (Figure 5). It allows multiple users at each organization to tap into a fiberoptic loop secured by a quantum-cryptography system. BBN will soon add a free-space QKD link and an entangled- photon QKD system. Other companies are also investing in quantum-cryptography systems. IBM's Almaden Research Center, the NEC Research Institute, Toshiba, and Hewlett-Packard are on the brink of introducing products. In March 2004, NEC scientists in Japan sent a single photon over a 150-km fiber-optic link, breaking the transmissiondistance record for quantum cryptography. Figure 5. This network allows users at BBN Technologies, Harvard University, and Boston University to tap into a fiber-optic loop secured by a quantum-cryptography system. (BBN Technologies/Funding by the Defense Advanced Research Projects Agency) To date, most commercially viable QKD systems rely on fiber-optic links limited to 100 to 120 km. At longer distances, random noise degrades the photon stream. Quantum keys cannot travel far over fiberoptic lines, and, thus, they can work only between computers directly connected to each other. The only way to achieve such a system with total security in a networking environment and at greater distances is to add quantum repeaters-rudimentary quantum computers- to regenerate the bits. NEC and Hewlett- Packard are developing components needed to make quantum repeaters a reality. Entangled photons To date, physicists have not developed an ideal single-photon source. In a small number of instances, more than one photon is emitted, making the system vulnerable. A hacker could tap the system and measure one of the photons to discover what polarization the sender is using, and then send the other onto the receiver-all without revealing his or her presence. That explains why entangled photons present an attractive future option. When two photons become entangled, if one is vertically polarized, the other is always polarized horizontally. The polarization of a single photon cannot be known until it is measured, and the measurement will automatically determine the polarization of the other photon, even if it is several hundred meters away. Albert Einstein dubbed this "spooky action at a distance." A QKD system using entangled photons would have a critical advantage: the key comes into existence simultaneously at both sender and receiver nodes, eliminating the possibility of interception. Entangled-state quantum cryptography works by generating entangled-photon pairs and distributing them through fibers or free space so that each arrives at the receiver's detectors simultaneously. Once measured, the photons assume one of four polarization states at random. Entanglement works over fiberoptic lines, but there are inevitable losses, which limits transmission distance. Free-space techniques extend the entanglement to distances in the range of 24 km. Last April, a team from the University of Vienna, Austria's ARC Seibersdorf Research (Seibersdorf), and Ludwig- Maximilians University (Munich, Germany) performed the first quantum-secured transfer of money using entangled photons. The scientists installed a 1.45-km fiber-optic line under Vienna's streets to link a transmitter at city hall to a receiver at the headquarters of an Austrian bank. They used a crystal with nonlinear optical properties to split photons with wavelengths of 405 nm into entangled pairs of photons with wavelengths of 810 nm. Using the key, the team safely transferred funds from city hall to the bank. In April 2004, the European Union launched the SECOQC project, which involves 41 participants from 12 countries: Austria, Belgium, Canada, the Czech Republic, Denmark, France, Germany, Italy, Russia, Sweden, Switzerland, and the United Kingdom. Participants have pledged 11.4 million euro ($14.8 million U.S.) in funding over the next four years to create a secure quantum network globally. One of the project's eight goals is to develop a suitable QKD system. The techniques under consideration are the University of Vienna's entangledphoton scheme, ID Quantique's attenuated pulsed-laser source of single photons, and free-space links. The last would also enable key distribution using modulated coherent states rather than photon counting. Faster detectors Future developments will focus on faster photon detectors, a major factor limiting the development of practical systems for widespread commercial use. Chip Elliott, BBN's principal engineer, says the company is working with the University of Rochester and NIST's Boulder Laboratories in Colorado to develop practical superconducting photon detectors based on niobium nitride, which would operate at 4 K and 10 GHz. Laboratory models can already detect billions of photons per second-several hundred orders of magnitude faster than today's commercial photon detectors. The ultimate goal is to make QKD more reliable, integrate it with today's telecommunications infrastructure, and increase the transmission distance and rate of key generation. "It's one thing to achieve quantum cryptography in the laboratory on a multimillion dollar government- funded project," says MagiQ's Trifonov. "It's quite another to make it reasonably cost-effective for commercial applications." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Conversational Engagement Tracked
by R.A. Hettinga 01 Dec '04

01 Dec '04

<http://www.technologyreview.com/articles/04/12/rnb_120104.asp?trk=nl> Technology Review Conversational Engagement Tracked December 1, 2004 It would be useful if a computer could sense ebbs and flows in conversation in order to automatically adjust remote communications systems. It would be useful, for instance, if a system automatically switched from a walkie-talkie-type push-to-talk system to a telephone-like full duplex audio connection when the participants become highly engaged in a conversation. Language is often fairly cryptic, however. The phrase "I am interested in this conversation", for instance, can signal enjoyment or polite boredom. Researchers from the University of Rochester and Palo Alto Research Center are aiming to allow computers to automatically assess peoples' engagement in a conversation by analyzing the way they speak rather than what they say. The researchers' system analyzes tone of voice and prosodic style, which includes changes in strength, pitch and rhythm. As voice communication shifts from traditional telephone networks to the more flexible Internet it is becoming easier to seamlessly shift between different communication channels. The system could automatically adapt voice channels on-the-fly. It could also help a user who is engaged in conversation avoid distractions by deferring loud and new email announcements and changing instant messaging status to busy. The researchers' system adds the ability to sense characteristics of conversational engagement to previous methods of recognizing speech emotion, taking into consideration changes in emotion over time and the influence of participants on each other. The system measures five levels of engagement. The researchers' used recorded phone conversations to test the system. The system sensed users' engagement accurately 63 percent of the time, more than triple the 20 percent accuracy that would result from random choices. The method could be used in practical applications in three to six years, according to the researchers. The work appeared in the proceedings of the 8th International Conference on Spoken Language Processing (ICSLP) held October 4 to 8, 2004 on Jeju Island in Korea. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Universities struggling with SSL-busting spyware
by InfoSec News 01 Dec '04

01 Dec '04

http://www.nwfusion.com/news/2004/1130univestrug.html By Paul Roberts IDG News Service 11/30/04 U.S. universities are struggling with a flare-up of dangerous spyware that can snoop on information encrypted using SSL. Experts are warning that the stealthy software, called Marketscore, could be used to intercept a wide range of sensitive information, including passwords and health and financial data. In recent weeks, information technology departments at a number of universities issued warnings about problems caused by the Marketscore software, which promises to speed up Web browsing. The program, which routes all user traffic through its own network of servers, poses a real threat to user privacy, security experts agree. Columbia University, Cornell University, Indiana University, The State University of New York (SUNY) at Albany, and The Pennsylvania State University are among those noting an increase in the number of systems running Marketscore software in recent weeks. Each institution warned their users about Marketscore and posted instructions for removing the software. The software is bundled with iMesh peer-to-peer software, and may have made it onto university networks that way, said David Escalante, director of computer security at Boston College. The company that makes the software, Marketscore, has headquarters in Reston, Va., at the same mailing address as online behavior tracking company comScore Networks. ComScore Networks did not respond to repeated requests for comment. Reports of infected systems on campuses ranged from a handful up to about 200 on one large campus network, Escalante said. Marketscore is just the latest incarnation of a spyware program called Netsetter, which first appeared in January, said Sam Curry, vice president of eTrust Security Management at Computer Associates. "Basically it takes all your Web traffic and forces it through its own proxy servers," he said. Ostensibly, the redirection speeds up Web surfing, because pages cached on Marketscore's servers load faster than they would if they were served directly from the actual Web servers for sites such as Google.com or Yahoo.com. However, those performance benefits have been elusive. "People who have installed the software complain to us that they're not getting any improvement," Curry said. Richard Smith, an independent software consultant in Boston, is also skeptical of performance improvement claims made by Marketscore and others, especially since many Internet service providers already offer Web caching for their dial-up customers, he said in an e-mail message. At Cornell, the university IT Security Office blocked connections between Cornell's network and the Marketscore servers, according to a message posted on the university's Web site. Administrators at SUNY Albany took similar steps, according to a message posted on that university's Web site. While other legal software programs make similar claims about improving Web browsing speed as Marketscore, Internet security experts are troubled that the software creates its own trusted certificate authority on computers. That certificate authority intercepts Web communications secured using SSL, decrypting that traffic, then sending it to the Marketscore servers before encrypting the traffic and passing it along to its final destination. That traffic could include sensitive information, including passwords, credit card and Social Security numbers, Curry said. Marketscore should be a big concern for companies -- especially those like banks with employees who handle sensitive data, Escalante said. "I don't know how good it is for parties on either end of a transaction to have a third party listening in," he said. If nothing else, all the extra decrypting and encrypting slows down SSL traffic, casting doubt on Marketscore's claims to be an Internet accelerator, Smith said. CA's eTrust anti-virus software labeled Marketscore "spyware" up until June of this year, but stopped doing so after Marketscore appealed that designation using an established vendor appeal process, he said. CA is currently re-evaluating the "spyware" designation using a complicated, multifactor scoring system. The software is less repugnant than its predecessor, Netsetter, which did not clearly disclose to users what it did when installed and made itself difficult to remove. Marketscore is better on both those counts, clearly stating both in the end user license agreement and during the installation process what the product does, and providing users with an easy uninstall program. CA considers Marketscore an example of a new breed of software that lies in the gray area between spyware and legitimate software, Curry said. "Under the old definition, (Marketscore) clearly qualified as spyware. But there are new categories emerging," he said. While Marketscore clearly tracks user behavior, it doesn't hijack Web browser home pages, spew pop-up advertisements or conceal its presence, like earlier generations of spyware did, Curry said. "There's more granularity. Companies have responded and ... are adding benefits and value to these programs. We're looking at ways to more accurately identify this," he said. Perhaps trying to increase its appeal, Marketscore is now advertising itself as an e-mail protection service, in addition to an Internet accelerator. According to the Marketscore.com Web site, members will receive Symantec's CarrierScan Server anti-virus technology at no cost. However, that promise doesn't sit well with Symantec, which said it has no relationship with Marketscore and, in fact, considers the software "spyware," said Genevieve Haldeman, a company spokeswoman. "We don't have relationships with companies that make software we consider malicious," she said. Symantec is considering legal action to force Marketscore to stop using its name and logo on the Marketscore.com Web site, she said. Spyware or not, the lesson of Marketscore is that "if it sounds too good to be true, it probably is," Curry said. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Universities struggling with SSL-busting spyware
by InfoSec News 01 Dec '04

01 Dec '04

http://www.nwfusion.com/news/2004/1130univestrug.html By Paul Roberts IDG News Service 11/30/04 U.S. universities are struggling with a flare-up of dangerous spyware that can snoop on information encrypted using SSL. Experts are warning that the stealthy software, called Marketscore, could be used to intercept a wide range of sensitive information, including passwords and health and financial data. In recent weeks, information technology departments at a number of universities issued warnings about problems caused by the Marketscore software, which promises to speed up Web browsing. The program, which routes all user traffic through its own network of servers, poses a real threat to user privacy, security experts agree. Columbia University, Cornell University, Indiana University, The State University of New York (SUNY) at Albany, and The Pennsylvania State University are among those noting an increase in the number of systems running Marketscore software in recent weeks. Each institution warned their users about Marketscore and posted instructions for removing the software. The software is bundled with iMesh peer-to-peer software, and may have made it onto university networks that way, said David Escalante, director of computer security at Boston College. The company that makes the software, Marketscore, has headquarters in Reston, Va., at the same mailing address as online behavior tracking company comScore Networks. ComScore Networks did not respond to repeated requests for comment. Reports of infected systems on campuses ranged from a handful up to about 200 on one large campus network, Escalante said. Marketscore is just the latest incarnation of a spyware program called Netsetter, which first appeared in January, said Sam Curry, vice president of eTrust Security Management at Computer Associates. "Basically it takes all your Web traffic and forces it through its own proxy servers," he said. Ostensibly, the redirection speeds up Web surfing, because pages cached on Marketscore's servers load faster than they would if they were served directly from the actual Web servers for sites such as Google.com or Yahoo.com. However, those performance benefits have been elusive. "People who have installed the software complain to us that they're not getting any improvement," Curry said. Richard Smith, an independent software consultant in Boston, is also skeptical of performance improvement claims made by Marketscore and others, especially since many Internet service providers already offer Web caching for their dial-up customers, he said in an e-mail message. At Cornell, the university IT Security Office blocked connections between Cornell's network and the Marketscore servers, according to a message posted on the university's Web site. Administrators at SUNY Albany took similar steps, according to a message posted on that university's Web site. While other legal software programs make similar claims about improving Web browsing speed as Marketscore, Internet security experts are troubled that the software creates its own trusted certificate authority on computers. That certificate authority intercepts Web communications secured using SSL, decrypting that traffic, then sending it to the Marketscore servers before encrypting the traffic and passing it along to its final destination. That traffic could include sensitive information, including passwords, credit card and Social Security numbers, Curry said. Marketscore should be a big concern for companies -- especially those like banks with employees who handle sensitive data, Escalante said. "I don't know how good it is for parties on either end of a transaction to have a third party listening in," he said. If nothing else, all the extra decrypting and encrypting slows down SSL traffic, casting doubt on Marketscore's claims to be an Internet accelerator, Smith said. CA's eTrust anti-virus software labeled Marketscore "spyware" up until June of this year, but stopped doing so after Marketscore appealed that designation using an established vendor appeal process, he said. CA is currently re-evaluating the "spyware" designation using a complicated, multifactor scoring system. The software is less repugnant than its predecessor, Netsetter, which did not clearly disclose to users what it did when installed and made itself difficult to remove. Marketscore is better on both those counts, clearly stating both in the end user license agreement and during the installation process what the product does, and providing users with an easy uninstall program. CA considers Marketscore an example of a new breed of software that lies in the gray area between spyware and legitimate software, Curry said. "Under the old definition, (Marketscore) clearly qualified as spyware. But there are new categories emerging," he said. While Marketscore clearly tracks user behavior, it doesn't hijack Web browser home pages, spew pop-up advertisements or conceal its presence, like earlier generations of spyware did, Curry said. "There's more granularity. Companies have responded and ... are adding benefits and value to these programs. We're looking at ways to more accurately identify this," he said. Perhaps trying to increase its appeal, Marketscore is now advertising itself as an e-mail protection service, in addition to an Internet accelerator. According to the Marketscore.com Web site, members will receive Symantec's CarrierScan Server anti-virus technology at no cost. However, that promise doesn't sit well with Symantec, which said it has no relationship with Marketscore and, in fact, considers the software "spyware," said Genevieve Haldeman, a company spokeswoman. "We don't have relationships with companies that make software we consider malicious," she said. Symantec is considering legal action to force Marketscore to stop using its name and logo on the Marketscore.com Web site, she said. Spyware or not, the lesson of Marketscore is that "if it sounds too good to be true, it probably is," Curry said. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[osint] Arabs launch money laundering, terror financing watchdog
by R.A. Hettinga 01 Dec '04

01 Dec '04

--- begin forwarded text To: "Bruce Tefft" <btefft(a)community-research.com> Thread-Index: AcTXnb2VTpnLxWr1TYWTH/A76UVXkw== From: "Bruce Tefft" <btefft(a)community-research.com> Mailing-List: list osint(a)yahoogroups.com; contact osint-owner(a)yahoogroups.com Delivered-To: mailing list osint(a)yahoogroups.com Date: Wed, 1 Dec 2004 08:00:49 -0500 Subject: [osint] Arabs launch money laundering, terror financing watchdog Reply-To: osint(a)yahoogroups.com http://www.dailytimes.com.pk/default.asp?page=story_1-12-2004_pg4_1 Arabs launch money laundering, terror financing watchdog * US hails Middle East-North Africa Financial Action Task Force MANAMA: Arab states agreed on Tuesday to work together to try to keep money out of the hands of terrorists. Tuesday's creation of the 14-member Middle East-North Africa Financial Action Task Force was hailed by the US Treasury Department official responsible for fighting terrorist financing, Juan Carlos Zarate, who attended the inaugural meeting in Bahrain. The task force was "a testament to the fact that Gulf countries and countries in the region have taken very seriously ... the threat of terrorist financing," Zarate told reporters. "I think we need to do more. There are still those who are providing support to Al Qaeda and to like-minded terrorist groups ... who want to hide money in the international financial system." The task force is the first of its kind in the region, which has come under increased scrutiny following the Sept. 11, 2001, terror attacks in the United States. The United Arab Emirates, which joined the new task force and is known for its freewheeling financial sector, has been identified by US investigators as a major money transfer center for Al Qaeda, the terror network responsible for Sept. 11. The Emirates has tightened reporting and other regulations since September 11. Bahrain earlier this year signed the 1999 UN international convention for the suppression of financing of terrorism. Saudi Arabia has cracked down on charities suspected of funneling money to terrorists. Emirates Central Bank Governor Sultan bin Nasser al-Suwaidi told reporters at the Bahrain meeting that now countries in the region must ensure their words are translated into action. "We need to strengthen our regulations and enforce the right laws and regulations," al-Suwaidi said. The watchdog bringing together Bahrain, Saudi Arabia, Syria, Lebanon, Qatar, Kuwait, Tunisia, Jordan, Algeria, Morocco, Egypt, Oman, the United Arab Emirates and Yemen will be a regional version of the Paris-based Financial Action Task Force. The 33-member FATF was set up in 1987 to monitor and fight money laundering, and in 2001 expanded its role to combatting the financing of terror. Iraqi officials attended the Bahrain meeting as observers, as did officials from the International Monetary Fund, World Bank, United States, Britain and France. Bahraini Finance Minister Abdulla Saif said the task force showed officials in his region were serious about ensuring their banking and financial systems were transparent and could not be exploited by criminals. Bahrain was to host the task force, which was to be headed initially by a Lebanese president, an Egyptian vice president and a Saudi executive director, according to the founding documents delegates signed Tuesday. The presidency and vice-presidency will rotate annually among the member countries. ap ------------------------ Yahoo! Groups Sponsor --------------------~--> $9.95 domain names from Yahoo!. Register anything. http://us.click.yahoo.com/J8kdrA/y20IAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Perle: Rumsfeld Opposed, Powell Wanted Occupation
by R.A. Hettinga 01 Dec '04

01 Dec '04

Remember what I said about the original estimate of only 50,000 men to take down Iraq, with the next stop being Damascus? :-) Cheers, RAH ------- <http://newsmax.com/scripts/printer_friendly.pl?page=http://newsmax.com/arch…> Reprinted from NewsMax.com Tuesday, Nov. 30, 2004 8:03 a.m. EST Perle: Rumsfeld Opposed, Powell Wanted Occupation Secretary Colin Powell, the State Department and the CIA - not Secretary of Defense Donald Rumsfeld - are responsible for the chaos that has grown out of the U.S. occupation of Iraq, says Richard Perle, the former chairman of Pentagon's Defense Policy Review Board. Appearing on Fox News' "O'Reilly Factor" Monday night, Perle said the U.S. made a most serious mistake after Iraq was liberated and the "keys" were not handed over immediately to Iraqis to run their own country. Thus, the U.S. military became an occupying force - and an increasingly unpopular one. "We didn't hand the keys over to the Iraqis. Instead we embarked on what became an extended occupation. That was fundamentally mistaken - it was politically driven," Perle said. Perle's remarks places significant distance between postwar policies and neo-conservatives like himself who have backed the war and have been championed in the Bush administration by Defense Secretary Rumsfeld, his deputy Paul Wolfowitz, and Vice President Cheney. Perle told O'Reilly the idea of a military occupation was not the Pentagon's original plan. "It was not Don Rumsfeld's decision," he said. Asked by O'Reilly if handing the keys over to the Iraqis after deposing Saddam would have sparked a civil war between the Sunnis, Kurds and Shiites, Perle said he didn't think so. He noted that there were already groups of anti-Saddam Iraqis in place when the dictator fell. "There was an umbrella group of opposition figures. It included Shia, Sunnis, Kurds and in the end, of course, we did turn to the Iraqis. We asked them to form a governing council, then an interim government, but we made the big mistake of not trusting the Iraqis. "I'm not saying that everything would have worked out, but everything certainly didn't work out the way we did it. My own view is we should have supported a government in exile even before going into Iraq." O'Reilly asked how much responsibility Rumsfeld bears for the current situation in Iraq. "I think the conduct of the war was brilliant," Perle observed. "The campaign will go down in history as one of the greatest military campaigns ever. Saddam was removed and his regime fell within three weeks. "The problems didn't start immediately after Saddam's removal. The problems started when the occupation began to wear on the people, and that was predictable." When O'Reilly cited Colin Powell as a dissenting voice who warned the president that if "you break it [Iraq], you'll own it," Perle said, "the irony is that it was Secretary Powell and some others who wanted the extended occupation. They are the ones who did not want to turn things over to the Iraqis, who feared and distrusted the Iraqis and blocked all efforts to do precisely that." Perle then revealed that even before the war Rumsfeld's Department of Defense had argued that we should train thousands of Iraqis "to go in with us so that we wouldn't be the aggressor, we wouldn't be the occupying power, and those proposals were blocked largely by the State Department and the CIA. Rumsfeld was never able to get approval for the political strategy that might well have saved us from much of the subsequent trouble." Responding to O'Reilly's remark that the we are now seen as the "bad guys," Perle said that the situation in Iraq can be cleaned up. "Remember, we were portrayed as the bad guys when the only policy for dealing with Saddam were sanctions and the argument was that Iraqi babies were dying as result of the sanctions. We're making real progress and the political evolution is critical. There is a desperate effort now to cope with the fact that after these elections the Iraqis will be fully invested in their own future, and I think we've already begun to turn the corner." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

US netizens: white, wealthy and full of it - shock!
by R.A. Hettinga 01 Dec '04

01 Dec '04

<http://www.theregister.co.uk/2004/12/01/us_doc_internet_survey/print.html> The Register Biting the hand that feeds IT US netizens: white, wealthy and full of it - shock! By Andrew Orlowski in San Francisco (andrew.orlowski at theregister.co.uk) Published Wednesday 1st December 2004 00:34 GMT "The Internet is becoming more and more widespread and will increasingly represent a scientific random sample of the population," claims (http://joi.ito.com/archives/2004/11/21/poor_librarian_immerses_self_in_iron…) ICANN's newest board member, Joi Ito. Quite what scientific experiments he will wish to perform, once the desired sample size has been reached, remains a mystery. But like many people who spend too long in front of their computers, he's talking about a Platonic ideal rather than the real world. A survey by the US Department of Commerce's National Telecommunications and Information Administration shows that the internet has entrenched the divide between rich and poor, and the races. Statistics reveal an internet that's overwhelmingly white, wealthy and urban. And the net's best days may even be behind it. The pace of internet adoption has tapered off to a trickle, with a substantial part of the population not interested in the internet at any price. (http://www.theregister.co.uk/2004/12/01/rainbow_nation.jpg) Diversity in action: blogdom's Rainbow Nation Only 13.9 per cent of black households and 12.6 per cent of Hispanic households have an internet connection - and less than a quarter of rural households. The spurt of internet adoption that coincided with the Napster boom - which took penetration over the fifty per cent mark - is now a distant memory. Although 13.1 per cent of the US came online in the year to September 2001, only seven per cent have been added in the subsequent two years. The lack of availability is cited by less than ten per cent of non-wired households. Almost half, or 44.1 per cent, aren't interested at all. 38.9 per cent say it doesn't represent value for money. The boredom is apparent elsewhere in the survey: amazingly, 17.7pc of households have dial-up, but don't use it. Having arrived on the Information Superhighway, they've pulled over into the layby for a snooze. Clearly rural areas can benefit greatly from an information service of some kind. But it's becoming less apparent that the internet in its current shape is the way to deliver such services. Braving this toxic wasteland of spam, viruses and trolls requires a major investment for a low income household, and it isn't clear that the payback is worth it. (Berating them for "Not Getting It" is no longer an option, and illustrates why Professor Fisher's work (http://www.theregister.co.uk/2004/02/01/free_legal_downloads/) on a digital pool for music is so important: it would give everyone a good reason for having a computer connection). We may even be approaching the problem from the wrong direction. For a decade governments have tried to cajole the real world into jumping into cyberspace, with grants and promotions to adopt internet adoption. Perhaps what was needed instead was a drive to persuade techno utopian bloggers to join the real world. With a compassionate approach - involving patience, counseling and therapy - there's no reason they can't be fully integrated back into society. At which point we may begin to get computer networks that are really useful to all of us, and not just a technocratic elite. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: geographically removed? eHalal
by Major Variola (ret) 01 Dec '04

01 Dec '04

At 10:33 PM 11/28/04 -0500, Steve Furlong wrote: >I see that an irrevocable payment system, used by itself, is ripe for >fraud, more so if it's anonymous. But why wouldn't a mature system make >use of trusted intermediaries? The vendors register with the intermedi- >ary *, who takes some pains to verify their identity, trustworthiness, >and so on, and to keep the vendors' identities a secret, if appropriate. Halal was deemed a terrorist weapon, and contrary to the treasury's policies, game over.

3 2

Re: Fallujah: Marine Eye-Witness Report
by John Kelsey 01 Dec '04

01 Dec '04

>From: "R.A. Hettinga" <rah(a)shipwright.com> >Sent: Nov 22, 2004 11:35 AM >To: cypherpunks(a)al-qaeda.net >Subject: Re: Fallujah: Marine Eye-Witness Report ... >I'm pretty heretical about this. I think if we had decapitated Iraq, went >after our military objectives, like securing what was a threat to us, >including Iraq's senior military and political leadership and their weapons >stockpiles, and left political order to emerge there on its own, like we >did in Afghanistan, we could have done it with Rumsfeld's original 50,000 >troop estimate. It seems like there would have to have been someone to take over in a fairly clean way, or we'd have wound up setting off a civil war. Note that in the Kurdish parts of Iraq, there was someone to take over, and those parts are generally not a problem for us. (Once it's not our people getting shot at, we probably don't care that much if it's a pain for someone else to police.) But I think the parts of Iraq that Saddam was still ruling had few high-profile leaders with forces that could have taken over quickly--he wasn't especially fond of potential rivals. Maybe we could have cut a deal with some local strongmen and gotten something stable together with minimal US involvement if we'd done it early, I'm not sure. ... >Cheers, >RAH --John

7 12