December 2004 - cypherpunks-legacy

As Investigations Proliferate, Big Banks Feel Under the Gun
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://online.wsj.com/article_print/0,,SB110436575482112446,00.html> The Wall Street Journal December 30, 2004 PAGE ONE Checking Accounts As Investigations Proliferate, Big Banks Feel Under the Gun Links to Cash-Transfer Firms Raise Troubling Questions About Money Laundering A Probe of Bank of America By GLENN R. SIMPSON Staff Reporter of THE WALL STREET JOURNAL December 30, 2004; Page A1 NEW YORK -- Until last year, federal prosecutors say, a tiny Brooklyn ice-cream shop was a vital cog in al Qaeda's global fund-raising operation. Carnival French Ice Cream sold only the occasional cone from its ground-floor nook in a four-story walk-up in the Park Slope neighborhood. Its real function, according to the government, was to move money. The shop took in $22 million between 1997 and 2003, the Justice Department alleges in federal court filings in New York. Prosecutors believe that Carnival diverted much of that money to a radical sheik in Yemen working with Osama bin Laden. The funds departed New York via the most modern and efficient method the American financial-services industry has to offer: an account at J.P. Morgan Chase & Co. The Carnival case, according to prosecutors, illustrates how since the late 1990s, major U.S. banks doing business with suspect money-transfer outfits like the Brooklyn shop have wired billions of dollars into and out of New York for suspected terrorist and criminal organizations. One Yemeni-American man has been convicted of lying to the Federal Bureau of Investigation in the Carnival probe, and three others await trial on money-laundering and related charges. Prosecutors haven't accused J.P. Morgan Chase of wrongdoing related to Carnival. But the bank and some of its major rivals now find themselves in law enforcement's cross hairs, as regulators and prosecutors crack down on what they say is widespread abuse in the $50 billion international money-transfer industry. Bank executives say they are being asked to bear a heavy burden in seeking to root out criminals who use them to move money. The executives say they are avidly trying to comply, but the authorities counter that the industry must do even more. One unintended consequence of this friction is that banks are simply dropping many small money-transfer businesses as clients, a move that could hurt millions of poor immigrants who send cash to relatives overseas. All of this activity is taking place in the shadow of sensational revelations earlier this year about how Riggs National Corp., a storied institution in Washington, for years failed to make required reports to regulators about hundreds of millions of dollars in suspicious transactions. The Riggs affair involved transactions by foreign officials. But as with some cases involving storefront money-transmitters, Riggs was shown to have failed to sound an alarm over large and seemingly dubious money movements. Now, Robert Morgenthau, the local district attorney in Manhattan, has threatened to indict Bank of America Corp. on money-laundering charges related to a suspect Latin American firm, according to federal law-enforcement officials who have been briefed on the matter. Mr. Morgenthau, in an interview, acknowledges that he is talking with the bank over how to resolve allegations that it transferred hundreds of millions of dollars for a Uruguayan money-transmitting business linked to drug trafficking, tax fraud and other financial crimes. Bank of America spokeswoman Shirley Norton says it "does not comment on its relations with customers or communications with regulators and law enforcement." She adds that the bank takes its anti-money-laundering responsibilities "extremely seriously," and is "routinely cooperating and partnering with law enforcement to investigate and help prosecute any individuals who might attempt to misuse our banking operations." Shortly after the Sept. 11, 2001, terrorist attacks, Congress toughened requirements on banks to investigate their own customers and alert the government to fishy activity. But a spate of recent fines, criminal investigations and prosecutions is raising questions about how effectively banks are fulfilling their role as front-line cops in the offensive against financial impropriety. In May, regulators imposed a $25 million fine on Riggs for its lapses; a federal criminal investigation is pending. In October, AmSouth Bancorp. of Birmingham, Ala., agreed to a pay $50 million in penalties for what federal banking regulators and prosecutors say was a breakdown in its money-laundering controls. And in November, The Wall Street Journal reported that Bank of New York Co. is negotiating with federal prosecutors to pay a fine of perhaps $24 million to avert a potential criminal indictment on charges that it failed to report suspicious activity at one of its branches. Bank of New York escaped criminal penalty in 2000 when a former executive and her husband pleaded guilty to laundering as much as $5 billion in suspect funds from Russia in the 1990s. Some banking executives say that the government underestimated the challenges of outsourcing to the industry so much of an expensive and unpopular task. Simultaneously executing and scrutinizing trillions of dollars in daily transactions, the executives argue, is a profound logistical challenge. By analogy, says William McDavid, general counsel at J.P. Morgan Chase, "think if you're running a railroad, and we say to you, 'We want you to monitor everyone who takes your train and see if their trip is legitimate.' " Still, he says J.P. Morgan Chase is spending tens of millions of dollars to comply with the law, adding in-house lawyers and accountants and new computer software for self-monitoring. Regulators say they appreciate the logistical challenges banks face, but they note that this year's big cases aren't instances of banks missing an occasional check. Rather, banks seem to have ignored numerous transactions that should have raised red flags. Senior executives of Riggs, for instance, overlooked huge cash transactions by Saudi diplomats whom American law enforcement suspects of channeling money to extremist Islamic causes. The Bank Secrecy Act requires banks to keep basic data on account holders -- such as the identities of all beneficial owners and their sources of income -- and to file reports with the government when they do anything defined by federal regulators as inherently "suspicious," such as the wiring of large sums by obscure companies in jurisdictions with notoriously weak regulation. The act also requires banks to report any cash transaction of $10,000 or more. Even after Congress toughened the law, ambiguities remain. The USA Patriot Act, enacted in late 2001, added a new requirement that banks give more scrutiny to "high risk" customers. But it is unclear precisely what that term means. Similarly, the law was changed to require banks to conduct "special due diligence" on certain foreign financial firms with which they do business. But it isn't clear, American banks say, whether that applies only to foreign banks or also to overseas money-transfer companies. Morgenthau Probe INDUSTRY UNDER SCRUTINY Some major cases from 2004 that raise questions about banks' self-policing: * Riggs: Fined $25 million for failing to alert regulators to hundreds of millions of dollars of suspicious transfers involving foreign officials; a criminal investigation is pending. * J.P. Morgan Chase: Transferred millions of dollars for a Brooklyn ice-cream shop that allegedly sent money to an al Qaeda ally in Yemen; the bank wasn't prosecuted. * Bank of America: Under investigation in New York for its alleged role in transferring funds for a money transmitter in Uruguay purportedly tied to the narcotics trade; other major banks could be drawn into the case. * Bank of New York: Negotiating with federal prosecutors to pay a fine of perhaps $24 million to avert a potential criminal indictment on charges that it failed to report suspicious activity at one of its branches. * AmSouth: Agreed to pay $50 million in penalties for what federal banking regulators and prosecutors say was a breakdown in its money-laundering controls. * ABN Amro: New York branch of Dutch banking giant reached an agreement with the Federal Reserve in July to overhaul its compliance operation and shed its ties to banks in Eastern Europe and Russia; Treasury and Justice department inquiries are pending. Source: WSJ research In the Bank of America investigation, Mr. Morgenthau, the veteran Manhattan district attorney, says the bank has transferred hundreds of millions of dollars for a money transmitter in Uruguay called Lespan SA and its affiliates. The prosecutor and federal officials familiar with the matter say they suspect the money has come from Colombian drug trafficking and other criminal activity. Alvaro Barriero, an official at Lespan subsidiary Gales Casa Cambio in Montevideo, says Lespan hasn't engaged in any illegal activity. The firm has a very active legal-compliance department, he says. The Bank of America investigation could get much broader and sweep in other major banks as well. A related local prosecution earlier this year -- in which Mr. Morgenthau's office obtained the conviction of a New York money transmitter operating without a license -- yielded a mountain of data about wire transfers involving Lespan by Bank of America, J.P. Morgan Chase, Citigroup Inc. and Wachovia Corp. Mr. Morgenthau's staff is now reviewing transactions related to all four banks. At The Wall Street Journal's request, the data-analysis firm I2 Inc. examined the wire transfers from the New York case, more than 300,000 transactions between 1997 and early 2003. The analysis found that the four banks, among others, moved hundreds of millions of dollars between New York and Uruguay, Paraguay and Brazil at the behest of obscure firms in the British Virgin Islands, a well-known financial-secrecy haven. "It's a matter of major concern that there was this gap in our supervision and control" of the financial system, Mr. Morgenthau says. According to American and Brazilian officials, much of the money appears to have come from a lawless enclave known as the Tri-Border Area, a free-trade zone on the borders of Argentina, Brazil and Paraguay. The officials say the area is dominated by organized criminal groups, including narcotics traffickers and people raising money -- by means of smuggling and copyright piracy -- for the Lebanese terrorist group Hezbollah. American and Brazilian investigators are looking at whether the big banks made an effort to determine how small firms in Uruguay and Paraguay could possibly have taken in so much cash from legitimate commerce. The investigators are also examining whether the banks inquired into the ownership of the British Virgin Islands companies. Brazilian Investigation The Brazilian government jointly is investigating political corruption, tax evasion and other alleged financial crimes involving Lespan. In connection with its probe, Brazilian officials have sent a 100-page document to the U.S. Justice Department, seeking assistance from American investigators. The Brazilian document confirms major aspects of the Journal's computer analysis of the more than 300,000 wire transfers that came to light in the local New York case. The Brazilian document, which became publicly available through filings in U.S. federal courts, names Wachovia and several other banks as conduits for Lespan. The Journal's analysis of the evidence introduced in the local New York case provides only a sampling of this complex set of bank relationships with Lespan. The analysis shows that Lespan used Citigroup's Citibank unit to move nearly $142 million to New York. Wachovia wired at least $38 million into and out of Lespan's operations in South America. Lespan relied on Bank of America to move at least $8.8 million, the records show. All told, the analysis of the records shows that Lespan used major banks to move at least $265 million between the U.S. and Latin America. J.P. Morgan Chase spokeswoman Judith Miller says, "Preventing money laundering is one of the highest priorities at J.P. Morgan Chase." Citigroup stopped doing business with Lespan in 2001 after detecting possible money-laundering, according to bank records and people familiar with the matter. A spokeswoman for Wachovia, Mary Eshet, says the bank has strong policies to prevent money laundering. She declines to comment further. Dropping Transmitters Big banks are scrambling to beef up their internal compliance staffs and acquire the latest software designed to flag suspicious transactions. One industry reaction that caught the government by surprise is that some banks are hastily ridding themselves of many of their money-transmitter clients. That threatens to hurt the money-transfer industry, which mainly serves the working immigrant poor. In a letter distributed this fall, Citibank informed money transmitters that they are "no longer considered a part of our target market." The letter gave recipients two weeks to find a new bank. Transmitters charge a fee to move funds for people who generally don't have bank accounts. The firms depend upon banks to carry out the transfers -- a mutually lucrative arrangement -- and have long operated with little regulation, making them vulnerable to exploitation by criminals and terrorists. It was only after it became known that the Sept. 11, 2001, plot was financed in large part through such transmitters that they were targeted by regulators. The largest money-transmitting companies, such as Western Union, a unit of First Data Corp., have compliance units and elaborate surveillance systems. Even with those protections, Western Union has come under closer scrutiny by regulators. A majority of the industry consists of small independent outfits that generally don't have much in the way of internal policing. The industry exports a total of more than $20 billion from the U.S. every year. Government officials are worried now that if money transferers can't go to banks, they will only be more likely to seek illegal methods of shipping cash. "It does no one any good if banks refuse to take these businesses -- that just encourages them to go underground," William Fox, the director of the Treasury Department's Financial Crimes Enforcement Network, said in a statement. "A transparent money-services sector is vital to the health of the world's economy." David Landsman, executive director of the National Money Transmitters Association, said in a recent letter to his members that he has warned U.S. officials that up to 75% of the check-cashing and transfer firms in New York could soon go out of business. Mr. Landsman says in an interview that nearly all transmitters are legitimate and that they play a vital role in providing cash to developing economies. Without them, immigrant workers will be forced to pay much higher bank fees to wire money home, he predicts. Yemeni Connection Prosecutors have alleged that Carnival French Ice Cream was primarily an unlicensed money-transmission operation for Yemeni immigrants. Between Sept. 11, 2001, and last year, when it was shut down, the shop allegedly moved at least $5.3 million out of the country through J.P. Morgan Chase. Some of that money came from charitable collections at mosques. Yet, according to J.P. Morgan Chase officials, there was little about Carnival that generated suspicion. In Park Slope, neighbors say the business fit right in with a pizza parlor, a cellphone store, a laundromat and other small shops on an ethnically mixed block. The firm opened its first account in 1982 with Manufacturer's Hanover, which was later acquired by Chase Manhattan, which merged with J.P. Morgan. Over the years, Yemeni immigrants associated with Carnival set up a series of at least 10 other accounts at various other New York banks in the names of other small businesses, such as Prospect Deli in Brooklyn. Funds then flowed among the accounts, creating the appearance of a network of small businesses, perhaps jointly owned by a group of immigrant entrepreneurs, as is common in some big cities. In reality, the government alleges, the other accounts were "feeder accounts" designed to avoid suspiciously large deposits into Carnival's primary Morgan account. These feeder accounts generally made deposits to Carnival's account below the $10,000 level that triggers a report to the federal government. Once channeled into the main Carnival account, the money was wired to Yemen and other countries. But the feeders were a fraud, the FBI alleges in filings in U.S. District Court in Brooklyn. Prospect Deli, the FBI says, pumped some $3.8 million into Carnival's J.P. Morgan Chase account from December 1997 to April 2003, even though the deli went out of business in 2000. While Carnival allegedly tried to hide its activity from the bank, an FBI agent involved in the case described in an arrest-warrant affidavit a number of "suspicious banking activities" for an account controlled by the ice-cream shop. The store's gross receipts from merchandise sales totaled less than $200,000 annually, FBI Agent Sharon Hassell said in the April 2003 sworn statement. Yet millions were wire-transferred out of its J.P Morgan Chase account "to a myriad of individuals, companies and foreign bank accounts, including banks in Saudi Arabia, Yemen, the United Arab Emirates, Canada, Thailand and China." J.P. Morgan Chase officials say they never suspected Carnival. They point out that on an average day, the bank processes more than 320,000 wire payments valued at nearly $2.3 trillion. By the end of 2005, J. P. Morgan Chase says it will have spent more than $20 million on improved transaction-monitoring systems and software. In the future, the bank's new protections will detect and flag customers like Carnival, bank officials say. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

2004: The Year That Promised Email Authentication
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://www.circleid.com/print/855_0_1_0/> CircleID 2004: The Year That Promised Email Authentication By: Yakov Shafranovich >From CircleID Addressing Spam December 27, 2004 As the year comes to a close, it is important to reflect on what has been one of the major actions in the anti-spam arena this year: the quest for email authentication. With email often called the "killer app" of the Internet, it is important to reflect on any major changes proposed, or implemented that can affect that basic tool that many of us have become to rely on in our daily lives. And, while many of the debates involved myriads of specialized mailing lists, standards organizations, conferences and even some government agencies, it is important for the free and open source software (FOSS) community as well as the Internet community at large, to analyze and learn lessons from the events surrounding email authentication in 2004. "THE GHOST OF CHRISTMAS PAST" The quest for email authentication did not start from scratch. Authentication systems are a well known field in computer security, and have been researched for quite some time. Nevertheless, it is only during this past year that email authentication has gained a prominent push mainly due to the ever increasing spam problem. As well known, the original email architecture and protocols was not designed for an open network such as the Internet. Therefore, the original designers failed to predict the virtual tidal wave of junk email that took advantage of lack of authentication in the Internet email. As the result, a junk email filter is considered one of the essential tools any Internet citizen must have in his toolkit today. The push towards email authentication started in earnest with the publication of a proposal called RMX by a German engineer called Hadmut Danisch in early 2003. While other previous proposals have been published, none have gained any kind of traction. Hadmut's proposal on the other hand coincided with the opening of the Anti-Spam Research Group (ASRG) of the Internet Research Task Force (IRTF), which as an affiliate body of the IETF. The IETF created and currently maintains the Internet email standards, and an IETF affiliate was a logical body to work on addressing the spam problem on the Internet at large. Being that the ASRG brought together a sizable chunk of the anti-spam world, RMX gained more exposure that none of the previous work in the field ever had. What followed was a succession of proposals forked off the original RMX proposal until the spring of 2004 when most of them were basically confined to the dustbin of history together with RMX. In the end, only two proposals with any sizable following were left: Sender Policy Framework (SPF) and Microsoft's Caller-ID. The author of SPF, Meng Wong, managed to attract a large community to his proposal, giving it a much larger deployed base than any competitor. In many ways this effort can be compared to some of the open source projects, except this time this was an open standard rather than a piece of software. On the other side of the ring, so to speak, was Microsoft which surprised the email world with their own proposal called Caller-ID at the RSA conference in early 2004. Eventually, the IETF agreed to consider standardization of email authentication by opening a working group called MARID in March of 2004. With the merger of SPF and Microsoft's new Sender-ID proposal, hopes were running high about the coming success of email authentication and the coming demise of spam. Yet, ironically this working group earned itself a record by being one of the shortest in the existence of the IETF - it has lasted a little over six months until being formally shutdown in September of 2004. "ALL THAT IS GOLD DOES NOT GLITTER" During the work of IETF's MARID group the quest for the email authentication begun to permeate circles outside the usual cadre of anti-spam geeks. Technology publications, and even the mass media have begun to take note of the efforts occurring on an obscure mailing list tucked away among 200 other even more obscure groups, prodded in many cases by the public relations spokesmen of various companies in the anti-spam space, including Microsoft. Yet in many ways that was one of the fatal blows to the group and any hope of a common standard for email authentication. Several major issues arose during the operation of the working group. The first major issue that has been bubbling beneath the surface was technical in nature. SPF has come from a group of proposals that worked with the parts of the email infrastructure that was unseen by most users. This included email servers that exchanged email among ISPs and were unseen. In the technical lingo this type of authentication was known as "path authentication". It focused on authenticating the path the message took place between servers, and dealt with machines instead of end users. Sender-ID approached the problem from a different viewpoint. Prodded by financial companies and the fact that Microsoft itself makes more email client software than server software, Sender-ID dealt with the end user. It focused on "message authentication", based on the path the message took. While the goals make have been admirable, many technical questions arose as to whether Sender-ID would work. Most of them were rooted in the basic differences between path authentication vs. message authentication, and remained unresolved. The second major issue that arose was one of intellectual property rights. Microsoft filed for patents on parts of Sender-ID and was not forthcoming with information during the operation of the MARID WG. While the actual patent application were eventually published towards the end of life of the WG that came too late. The damage to the trust among the group members, and different parts of the community has already been done. The main point of contention was not necessarily the patents applications themselves - rather it was the mandatory patent license that Microsoft had drawn up. The language in the Sender-ID patent license was construed in a way that prevents use by any software licensed under the General Public License (GPL). Whether that was intentional or not we may never know, but the trust between Microsoft and the FOSS community which was strenuous at best was broken. The third major issue which played itself outside the mailing lists and hallways of the anti-spam world was the media. Given that the spam problem was only increasing, the media pounced on what was seen as the golden grail for stopping spam. Unfortunately, as most reporters are not knowledgeable in either Internet architecture or email protocols, they frequently reported email authentication as the final cure for spam. These created great expectations for email authentication which were blown away once the hard truth settled in: email authentication did not stop spam. Unlike what many had believed, email authentication did not address the spam problem directly. Rather, it was only the first step towards a larger solution with reputation and accreditation systems planned for the future. However, as this truth sunk in, many of the companies and community members were not as positive towards email authentication as before. The various disagreements, technical and non-technical, led some of the group participants to create their own alternatives proposals or look to crypto-solutions such as Yahoo's DomainKeys. As a result, any useful work of the MARID group slowed to a crawl with the IETF eventually shutting down the group. A major factor in that decision was letters from two large members in the FOSS community against Sender-ID: the Apache Foundation and the Debian Project. "LET'S VISIT UNCLE SAM" With the shutdown of MARID WG in September of 2004, both Sender-ID and SPF were left to fend for their own. While some have assumed that Sender-ID was left of the dead after being rejected by the IETF shortly before the closure of MARID, Microsoft was quietly gathering support for Sender-ID among the industry. Microsoft's goals become clear at the FTC's Email Authentication Summit in November of 2004: Sender-ID was pushed as an accepted email authentication standard to be mandated by the FTC. Among the sizable PR gains that Microsoft gained was the endorsement of Sender-ID by AOL, and a letter signed by representatives of 25 major email companies and ISPs, a list which curiously included Meng Wong, the author of SPF. The PR advantage was so great, that SPF was not even listed on the FTC's website for the conference. At the same time, other alternative proposals such as CSV and BATV have begun promulgating among the industry, all of which born during the death throes of MARID. The SPF community being faced with the choice of joining or rejecting Sender-ID, was split. Majority of the community as judging by the mailing list traffic opposed Sender-ID/SPF combination. Nevertheless, some members including Meng Wong, the original author, endorsed Sender-ID. This has led to a lot of infighting with an election of an "SPF Council". At this time, the SPF community is the midst of a political discussion about its future. At the same time, a separate low-key effort in the IETF is taking place to address some of the cryptography solutions for Internet email. Proposals such as Yahoo's DomainKeys, Cisco's IdentifiedMail, etc. seek to achieve "message authentication" promised by Sender-ID but on a much more solid technical ground and with less IPR and PR issues. This effort is purposely left low key with even the mailing list itself hard to find, and certainly no media stories promising the end of spam. The IETF-MAILSIG effort as this is now called seeks to avoid the same problems that doomed MARID with hopes of developing useful technologies to reduce spam. Nevertheless, this effort was high-key enough for some of the companies involved to show case it at the FTC's summit. Needless to say, the FTC is staying silent on its plans. WHAT THE FUTURE HOLDS While we still don't have workable email authentication, the Sender-ID/SPF saga did accomplish a lot in many other ways. These events have shown to the technology community at large that the FOSS world plays an ever increasing role in the Internet as whole. The Apache Foundation and the Debian Project carried enough weight to the IETF to consider their opinion, marking probably the first time that FOSS opinions carried significant weight in the standards process. This debacle has also lead to an increased awareness of the growing problems in the patent system with Sender-ID being cited as a prime example of a patent system gone wrong. While smaller sagas such as PanIP's rampage on small e-businesses, Acacia's assault of video streaming and other similar incidents have been happening for a while, the Sender-ID/IETF story has brought this issue to the forefront of the Internet community for at least a short time. What has followed has been positive developments with governments, corporations and individuals recognizing the increasing problems in today's patent system and some beginning to seek reform. As for spam, Microsoft, Cisco, the SPF community and many others are still working on it. Some of the positive developments coming out of the Sender-ID episode have been an increased awareness of how the email architecture actual works and the increased realization that better coordination among the Internet community is necessary. As for email authentication - there is still 2005... -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

something to test ...
by Joe Schmoe 30 Dec '04

30 Dec '04

A test message. --Josh __________________________________ Do you Yahoo!? Yahoo! Mail - Find what you need with new enhanced search. http://info.mail.yahoo.com/mail_250

1 0

In war on terrorism, U.S. drafts shops to be on guard
by R.A. Hettinga 29 Dec '04

29 Dec '04

--- begin forwarded text

1 0

[IP] Cell phones for eavesdropping - finally some public "chatter" (fwd from dave@farber.net)
by Eugen Leitl 29 Dec '04

29 Dec '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

Jet Is an Open Secret in Terror War
by R.A. Hettinga 29 Dec '04

29 Dec '04

<http://www.washingtonpost.com/ac2/wp-dyn/A27826-2004Dec26?language=printer> The Washington Post washingtonpost.com Jet Is an Open Secret in Terror War By Dana Priest Washington Post Staff Writer Monday, December 27, 2004; Page A01 The airplane is a Gulfstream V turbojet, the sort favored by CEOs and celebrities. But since 2001 it has been seen at military airports from Pakistan to Indonesia to Jordan, sometimes being boarded by hooded and handcuffed passengers. The plane's owner of record, Premier Executive Transport Services Inc., lists directors and officers who appear to exist only on paper. And each one of those directors and officers has a recently issued Social Security number and an address consisting only of a post office box, according to an extensive search of state, federal and commercial records. Bryan P. Dyess, Steven E. Kent, Timothy R. Sperling and Audrey M. Tailor are names without residential, work, telephone or corporate histories -- just the kind of "sterile identities," said current and former intelligence officials, that the CIA uses to conceal involvement in clandestine operations. In this case, the agency is flying captured terrorist suspects from one country to another for detention and interrogation. The CIA calls this activity "rendition." Premier Executive's Gulfstream helps make it possible. According to civilian aircraft landing permits, the jet has permission to use U.S. military airfields worldwide. Since Sept. 11, 2001, secret renditions have become a principal weapon in the CIA's arsenal against suspected al Qaeda terrorists, according to congressional testimony by CIA officials. But as the practice has grown, the agency has had significantly more difficulty keeping it secret. According to airport officials, public documents and hobbyist plane spotters, the Gulfstream V, with tail number N379P, has been used to whisk detainees into or out of Jakarta, Indonesia; Pakistan; Egypt; and Sweden, usually at night, and has landed at well-known U.S. government refueling stops. As the outlines of the rendition system have been revealed, criticism of the practice has grown. Human rights groups are working on legal challenges to renditions, said Morton Sklar, executive director of the World Organization for Human Rights USA, because one of their purposes is to transfer captives to countries that use harsh interrogation methods outlawed in the United States. That, he said, is prohibited by the U.N. Convention on Torture. The CIA has the authority to carry out renditions under a presidential directive dating to the Clinton administration, which the Bush administration has reviewed and renewed. The CIA declined to comment for this article. "Our policymakers would never confront the issue," said Michael Scheuer, a former CIA counterterrorism officer who has been involved with renditions and supports the practice. "We would say, 'Where do you want us to take these people?' The mind-set of the bureaucracy was, 'Let someone else do the dirty work.' " The story of the Gulfstream V offers a rare glimpse into the CIA's secret operations, a world that current and former CIA officers said should not have been so easy to document. Not only have the plane's movements been tracked around the world, but the on-paper officers of Premier Executive Transport Services are also connected to a larger roster of false identities. Each of the officers of Premier Executive is linked in public records to one of five post office box numbers in Arlington, Oakton, Chevy Chase and the District. A total of 325 names are registered to the five post office boxes. An extensive database search of a sample of 44 of those names turned up none of the information that usually emerges in such a search: no previous addresses, no past or current telephone numbers, no business or corporate records. In addition, although most names were attached to dates of birth in the 1940s, '50s or '60s, all were given Social Security numbers between 1998 and 2003. The Washington Post showed its research to the CIA, including a chart connecting Premier Executive's officers, the post office boxes, the 325 names, the recent Social Security numbers and an entity called Executive Support OFC. A CIA spokesman declined to comment. According to former CIA operatives experienced in using "proprietary," or front, companies, the CIA likely used, or intended to use, some of the 325 names to hide other activities, the nature of which could not be learned. The former operatives also noted that the agency devotes more effort to producing cover identities for its operatives in the field, which are supposed to stand up under scrutiny, than to hiding its ownership of a plane. The CIA's plane secret began to unravel less than six weeks after the Sept. 11, 2001, attacks. On Oct. 26, 2001, Masood Anwar, a Pakistani journalist with the News in Islamabad, broke a story asserting that Pakistani intelligence officers had handed over to U.S. authorities a Yemeni microbiologist, Jamil Qasim Saeed Mohammed, who was wanted in connection with the October 2000 bombing of the USS Cole. The report noted that an aircraft bearing tail number N379P, and parked in a remote area of a little-used terminal at the Karachi airport, had whisked Mohammed away about 2:40 a.m. Oct. 23. The tail number was also obtained by The Post's correspondent in Pakistan but not published. The News article ricocheted among spy-hunters and Web bloggers as a curiosity for those interested in divining the mechanics of the new U.S.-declared war on terrorism. At 7:54:04 p.m. Oct. 26, the News article was posted on FreeRepublic.com, which bills itself as "a conservative news forum." Thirteen minutes later, a chat-room participant posted the plane's registered owners: Premier Executive Transport Services Inc., of 339 Washington St., Dedham, Mass. "Sounds like a nice generic name," one blogger wrote in response. "Kind of like Air America" -- a reference to the CIA's secret civilian airlines that flew supplies, food and personnel into Southeast Asia, including Laos, during the Vietnam War. Eight weeks later, on Dec. 18, 2001, American-accented men wearing hoods and working with special Swedish security police brought two Egyptian nationals onto a Gulfstream V that was parked at night at Stockholm's Bromma Airport, according to Swedish officials and airport personnel interviewed by Swedish television's "Cold Facts" program. The account was confirmed independently by The Post. The plane's tail number: N379P. Wearing red overalls and bound with handcuffs and leg irons, the men, who had applied for political asylum in Sweden, were flown to Cairo, according to Swedish officials and documents. Ahmed Agiza was convicted by Egypt's Supreme Military Court of terrorism-related charges; Muhammad Zery was set free. Both say they were tortured while in Egyptian custody. Sweden has opened an investigation into the decision to allow them to be rendered. A month later, in January 2002, a U.S.-registered Gulfstream V landed at Jakarta's military airport. According to Indonesian officials, the plane carried away Muhammad Saad Iqbal Madni, an Egyptian traveling on a Pakistani passport and suspected of being an al Qaeda operative who had worked with shoe bomber suspect Richard C. Reid. Without a hearing, he was flown to Egypt. His status and whereabouts are unknown. The plane's tail number was not noted, but the CIA is believed to have only one of the expensive jets. Over the past year, the Gulfstream V's flights have been tracked by plane spotters standing at the end of runways with high-powered binoculars and cameras to record the flights of military and private aircraft. These hobbyists list their findings on specialized Web pages. According to them, since October 2001 the plane has landed in Islamabad; Karachi; Riyadh, Saudi Arabia; Dubai; Tashkent, Uzbekistan; Baghdad; Kuwait City; Baku, Azerbaijan; and Rabat, Morocco. It has stopped frequently at Dulles International Airport, at Jordan's military airport in Amman and at airports in Frankfurt, Germany; Glasglow, Scotland, and Larnaca, Cyprus. Premier Executive Transport Services was incorporated in Delaware by the Prentice-Hall Corporation System Inc. on Jan. 10, 1994. On Jan. 23, 1996, Dean Plakias, a lawyer with Hill & Plakias in Dedham, filed incorporation papers with the Commonwealth of Massachusetts listing the company's president as Bryan P. Dyess. According to public documents, Premier Executive ordered a new Gulfstream V in 1998. It was delivered in November 1999 with tail number N581GA, and reregistered for unknown reasons on March 2000 with a new tail number, N379P. It began flights in June 2000, and changed the tail number again in December 2003. Plakias did not return several telephone messages seeking comment. He told the Boston Globe recently that he simply filed the required paperwork. "I'm not at liberty to discuss the affairs of the client business, mainly for reasons I don't know," he told the Globe. Asked whether the company exists, Plakias responded: "Millions of companies are set up in Massachusetts that are just paper companies." A lawyer in Washington, whose name is listed on a 1996 IRS form on record at the Secretary of the Commonwealth's office in Massachusetts -- and whose name is whited out on some copies of the forms -- hung up the phone last week when asked about the company. Three weeks ago, on Dec. 1, the plane, complete with a new tail number, was transferred to a new owner, Bayard Foreign Marketing of Portland, Ore., according to FAA records. Its registered agent in Portland, Scott Caplan, did not return phone calls. Like the officers at Premier Executive, Bayard's sole listed corporate officer, Leonard T. Bayard, has no residential or telephone history. Unlike Premier's officers, Bayard's name does not appear in any other public records. Researchers Margot Williams and Julie Tate contributed to this report. Williams has since left The Washington Post. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

"State of Fear" by Michael Crichton
by Anonymous 29 Dec '04

29 Dec '04

Just finished reading it (It was a Christmas present). The story involves the heroes foiling a plot by eco-terrorists who attempt to create "natural" disasters in an effort to push their agenda regarding global warming. Along the way the Crichton presents a pretty convincing argument that scientists don't really have a good enough understanding of our climate to really estimate the impacts of mankind and that many of the events claimed to be evidence of global warming are statistically insignificant and contain a huge amounts of bias. In addition, he provides references to many examples where mankind has failed miserably at trying to "manage and preserve" the environment. He also makes a feast (literally, read the book :-) ) of Hollywood stars who push environmental causes and claim to pine for the more "simplistic and environmentally friendly" life of native islanders all the while living in their huge mansions, driving their SUV's and traveling around the world in private jets. The title "State of Fear" comes the concept well known to many on the list that best way to control society is via fear. In this case fear of global warming. There are a lot of footnotes and an extensive bibliography of the current research both supporting and debunking global warming. It will interesting to see if this book makes it into a movie (It almost seems like a rebuttal of the movie "The Day After Tomorrow"). Crichton's other books include, "The Andromeda Strain" (I'm sure most of us old-timers on the list will recognize that one), "Disclosure", "Airframe", and (the one most new subscribers will recognize), "Jurassic Park". I recommend taking a look.

1 0

LAPD: We Know That Mug
by R.A. Hettinga 29 Dec '04

29 Dec '04

<http://www.wired.com/news/print/0,1294,66142,00.html> Wired News LAPD: We Know That Mug Associated Press Story location: http://www.wired.com/news/technology/0,1282,66142,00.html 08:33 AM Dec. 26, 2004 PT LOS ANGELES -- The Los Angeles Police Department is experimenting with facial-recognition software it says will help identify suspects, but civil liberties advocates say the technology raises privacy concerns and may not identity people accurately. "It's like a mobile electronic mug book," said Capt. Charles Beck of the gang-heavy Rampart Division, which has been using the software. "It's not a silver bullet, but we wouldn't use it unless it helped us make arrests." But Ramona Ripston, executive director of the American Civil Liberties Union of Southern California, said the technology was unproven and could encourage profiling on the basis of race or clothing. "This is creeping Big Brotherism," Ripston said. "There is a long history of government misusing information it gathers." The department is seeking about $500,000 from the federal government to expand the use of the technology, the Los Angeles Times reported Saturday. Police have been testing it on Alvarado Street just west of downtown Los Angeles. In one recent incident, two officers suspected two men illegally riding double on a bicycle of being gang members. If they were, they may have been violating an injunction that barred those named in a court documents from gathering in public and other activities. As the officers questioned the men, Rampart Division Senior Lead Officer Mike Wang pointed a hand-held computer with an attached camera at one of the men. Facial-recognition software compared his image to those of recent fugitives, as well as to dozens of members of local gangs. Within seconds, the screen displayed nine faces that had contours similar to the man's. The computer said the image of one particular gang member subject to the injunction was 94 percent likely to be a match. That enough to trigger a search that yielded a small amount of methamphetamine. The man did turn out to be the gang member, and was arrested on suspicion of violating the injunction by possessing illegal drugs. The city attorney's office has not yet decided whether to charge the man. The LAPD has been using two computers donated by their developer, Santa Monica company Neven Vision, which wanted field-testing of its technology. The computers are still considered experimental. The Rampart Division has used the devices about 25 times in the two months officers have been testing them. The technology has resulted in 16 arrests for alleged criminal contempt of a permanent gang injunction, and three arrests on outstanding felony warrants. On one occasion, the computer was used to clear a man the officers suspected of being someone else, police said. So far, the city attorney has filed seven injunction cases in arrests that involved the technology. A judge dismissed a case after questioning the technology, but it has been refiled. Suspects in two cases pleaded guilty. Other experiments with facial-recognition software have had mixed results. Officials in Tampa, Fla., stopped using it last year because it didn't result in arrests. And a Boston's Logan International Airport in 2002, two systems failed 96 times to identify people who volunteered to help test it. The technology correctly identified 153 other volunteers. Luis Li, chief of the Los Angeles city attorney's criminal branch, said the technology should not present legal problems because it was used only as an initial means of identification. "If you are standing in the street, you have no expectation of privacy," he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[fc-announce] FC05 Preliminary Program Now Online
by R.A. Hettinga 29 Dec '04

29 Dec '04

--- begin forwarded text User-Agent: Microsoft-Entourage/11.1.0.040913 From: "Stuart E. Schechter" <ses(a)ll.mit.edu> To: <fc-announce(a)ifca.ai> Subject: [fc-announce] FC05 Preliminary Program Now Online Sender: fc-announce-admin(a)ifca.ai Date: Wed, 29 Dec 2004 11:37:27 -0500 The program and preliminary schedule can be found at: http://www.ifca.ai/fc05/program.html An official call for participation will be sent out as soon as registration is open. (We expect this to be early next week.) If you've yet to make travel arrangements, I would encourage you to stay in Dominica on Thursday night (3/3) or longer to avoid a rush to the airport after the morning program. In the past, attendees who have stayed after the conference have found that this is an excellent time to meet with others. Keynote Speakers ================ Lynne Coventry (NCR) Bezalel Gavish (Southern Methodist University) Panel Sessions ============== Financial Technology in the Developing World Allan Friedman (Harvard) - Organizer Alessandro Acquisti (CMU) H William Burdett, Jr. (Foley & Lardner, LLP) Jon Peha (CMU) Phishing Steve Myers (Indiana University) - Organizer Drew Dean (SRI) Stuart Stubblebine (Stubblebine Research Labs) Richard Clayton (Cambridge, UK) Markus Jakobsson (Indiana University CACR) Research Papers =============== Fraud within Asymmetric Multi-Hop Cellular Networks Gildas Avoine (EPFL, Lausanne, Switzerland) Information-Theoretic Security Analysis of Physical Uncloneable Functions P. Tuyls B. Skoric S. Stallinga A.H. Akkermans W. Ophey (Philips Research Laboratories, The Netherlands) Views, Reactions and Impact of Digitally-Signed Mail in e-Commerce. Simson L. Garfinkel Jeffrey I. Schiller Erik Nordlander (MIT) David Margrave (Amazon.com) Robert C. Miller (MIT) Identity-based Partial Message Recovery Signatures (or How to Shorten ID-based Signatures) Fangguo Zhang (Sun Yat Sen University, P.R.China) Yi Mu Willy Susilo (University of Wollongong, Australia) How to Non-Interactively Update a Secret Eujin Goh (Stanford University) Philippe Golle (Palo Alto Research Center) Interactive Diffie-Hellman Assumptions with Applications to Password-Based Authentication Michel Abdalla David Pointcheval (Ecole Normale Superieure) Achieving Fairness in Private Contract Negotiation Keith Frikken Mikhail Atallah (Purdue University) Protecting Secret Data from Insider Attacks David Dagon Wenke Lee Richard Lipton (Georgia Tech) RFID Traceability A Multilayer Problem Gildas Avoine Philippe Oechslin (EPFL Lausanne Switzerland) A User-Friendly Approach to Human Authentication of Messages Jeff King Andre dos Santos (Georgia Tech) Countering Identity Theft through Digital Uniqueness, Location Cross-Checking, and Funneling P.C. van Oorschot (Carleton University) S. Stubblebine (Stubblebine Research Labs) Policy-Based Cryptography and Applications Walid Bagga Refik Molva (Eurecom) A Privacy Protecting Coupon System Liqun Chen (HP Laboratories) Matthias Enzmann (Fraunhofer SIT) Ahmad-Reza Sadeghi (University of Bochum) Markus Schneider (Fraunhofer SIT) Michael Steiner (IBM T.J. Watson) Analysis of a Multi-Party Fair Exchange Protocol and Formal Proof of Correctness in the Strand Space model Steve Kremer Aybek Mukhamedov Eike Ritter (University of Birmingham, UK) Secure Biometric Authentication for Weak Computational Devices Mikhail J. Atallah Keith B. Frikken (Purdue) Michael T. Goodrich (UC Irvine) Roberto Tamassia (Brown) Small Coalitions Cannot Manipulate Voting Edith Elkind (Princeton University) Helger Lipmaa (Helsinki University of Technology) Efficient Privacy-Preserving Protocols for Multi-Unit Auctions Felix Brandt (Stanford) Tuomas Sandholm (Carnegie Mellon University) Risk Assurance for Hedge Funds using Zero Knowledge Proofs Michael Szydlo (RSA Security/Independent) Testing Disjointness of Private Datasets Aggelos Kiayias (University of Connecticut) Antonina Mitrofanova (Rutgers University) Time Capsule Signature Yevgeniy Dodis (NYU) Dae Hyun Yum (POSTECH) Probabilistic Escrow of Financial Transactions with Cumulative Threshold Disclosure Stanislaw Jarecki (UC Irvine) Vitaly Shmatikov (UT Austin) Approximation in Message Authentication Giovanni Di Crescenzo Richard Graveman (Telcordia) Gonzalo Arce Renwei Ge (U Delaware) Systems & Applications Presentations ==================================== Securing Sensitive Data with the Ingrian DataSecure Platform Andrew Koyfman (Ingrian Networks) Ciphire Mail Email Encryption Lars Eilebrecht (Ciphire Labs) _______________________________________________ fc-announce mailing list fc-announce(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc-announce --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Natural selection acts on the quantum world
by R.A. Hettinga 29 Dec '04

29 Dec '04

<http://www.nature.com/news/2004/041220/pf/041220-12_pf.html> Close window?? Published online: 23 December 2004 Natural selection acts on the quantum world Philip Ball Objective reality may owe its existence to a 'darwinian' process that advertises certain quantum states. If observing the world tends to change it, how come we all see the same butterfly? A team of US physicists has proved a theorem that explains how our objective, common reality emerges from the subtle and sensitive quantum world. If, as quantum mechanics says, observing the world tends to change it, how is it that we can agree on anything at all? Why doesn't each person leave a slightly different version of the world for the next person to find? Because, say the researchers, certain special states of a system are promoted above others by a quantum form of natural selection, which they call quantum darwinism. Information about these states proliferates and gets imprinted on the environment. So observers coming along and looking at the environment in order to get a picture of the world tend to see the same 'preferred' states. If it wasn't for quantum darwinism, the researchers suggest in Physical Review Letters1, the world would be very unpredictable: different people might see very different versions of it. Life itself would then be hard to conduct, because we would not be able to obtain reliable information about our surroundings... it would typically conflict with what others were experiencing. Taking stock The difficulty arises because directly finding out something about a quantum system by making a measurement inevitably disturbs it. "After a measurement," say Wojciech Zurek and his colleagues at Los Alamos National Laboratory in New Mexico, "the state will be what the observer finds out it is, but not, in general, what it was before." They survive monitoring by the environment to leave 'descendants' that inherit their properties. ? Wojciech Zure Physicist, Los Alamos National Laboratory in New MexicoBecause, as Zurek says, "the Universe is quantum to the core," this property seems to undermine the notion of an objective reality. In this type of situation, every tourist who gazed at Buckingham Palace would change the arrangement of the building's windows, say, merely by the act of looking, so that subsequent tourists would see something slightly different. Yet that clearly isn't what happens. This sensitivity to observation at the quantum level (which Albert Einstein famously compared to God constructing the quantum world by throwing dice to decide its state) seems to go away at the everyday, macroscopic level. "God plays dice on a quantum level quite willingly," says Zurek, "but, somehow, when the bets become macroscopic he is more reluctant to gamble." How does that happen? Quantum mush The Los Alamos team define a property of a system as 'objective', if that property is simultaneously evident to many observers who can find out about it without knowing exactly what they are looking for and without agreeing in advance how they'll look for it. Physicists agree that the macroscopic or classical world (which seems to have a single, 'objective' state) emerges from the quantum world of many possible states through a phenomenon called decoherence, according to which interactions between the quantum states of the system of interest and its environment serve to 'collapse' those states into a single outcome. But this process of decoherence still isn't fully understood. "Decoherence selects out of the quantum 'mush' states that are stable, that can withstand the scrutiny of the environment without getting perturbed," says Zurek. These special states are called 'pointer states', and although they are still quantum states, they turn out to look like classical ones. For example, objects in pointer states seem to occupy a well-defined position, rather than being smeared out in space. The traditional approach to decoherence, says Zurek, was based on the idea that the perturbation of a quantum system by the environment eliminates all but the stable pointer states, which an observer can then probe directly. But he and his colleagues point out that we typically find out about a system indirectly, that is, we look at the system's effect on some small part of its environment. For example, when we look at a tree, in effect we measure the effect of the leaves and branches on the visible sunlight that is bouncing off them. But it was not obvious that this kind of indirect measurement would reveal the robust, decoherence-resistant pointer states. If it does not, the robustness of these states won't help you to construct an objective reality. Now, Zurek and colleagues have proved a mathematical theorem that shows the pointer states do actually coincide with the states probed by indirect measurements of a system's environment. "The environment is modified so that it contains an imprint of the pointer state," he says. All together now Yet this process alone, which the researchers call 'environment-induced superselection' or einselection2, isn't enough to guarantee an objective reality. It is not sufficient for a pointer state merely to make its imprint on the environment: there must be many such imprints, so that many different observers can see the same thing. Happily, this tends to happen automatically, because each individual's observation is based on only a tiny part of the environmental imprint. For example, we're never in danger of 'using up' all the photons bouncing off a tree, no matter how many people we assemble to look at it. This multiplicity of imprints of the pointer states happens precisely because those states are robust: making one imprint does not preclude making another. This is a Darwin-like selection process. "One might say that pointer states are most 'fit'," says Zurek. "They survive monitoring by the environment to leave 'descendants' that inherit their properties." "Our work shows that the environment is not just finding out the state of the system and keeping it to itself", he adds. "Rather, it is advertising it throughout the environment, so that many observers can find it out simultaneously and independently." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0