April 2004 - cypherpunks-legacy

The wrong stuff: what it takes to be a TSA terror suspect
by R. A. Hettinga 07 Apr '04

07 Apr '04

<http://www.theregister.co.uk/2004/04/07/aclu-suit/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Original URL: http://www.theregister.co.uk/2004/04/07/aclu-suit/ The wrong stuff: what it takes to be a TSA terror suspect By John Lettice (john.lettice(a)theregister.co.uk) Published Wednesday 7th April 2004 17:47 GMT The plaintiffs' statements in an American Civil Liberties Union lawsuit against the Department of Homeland Security and the Transport Security Administration provides some useful clues about what it takes to make the grade as a dangerous terror suspect. Career USAF Master Sergeant and mother of three? Retired Presbyterian Minister? ACLU special projects co-ordinator with Pakistani-type name? Well yes, that last one might not have come entirely as a surprise to you, but the ACLU has chosen its sample plaintiffs well. They are all American citizens who've experienced repeated delays and embarrassments because they are on the shady 'no fly' list distributed to US airlines by the TSA. No reason for their presence on this list is obtainable, and there would appear to be no easy mechanism for getting off it. According to the statement of Rev John F Shaw (71), when he complained to the TSA's Ombudsman's office a TSA agent explained "that the list is computer-generated and linked to another database known as CAPPS." The CAPPS link is a strong signal that the no fly list will in the future be substantially expanded as the TSA expands its use of airline passenger data. The statements also indicate that the TSA itself has no ready mechanism for getting people off the list. It seems to agree with some of the plaintiffs that they're false positives, but they keep getting the treatment on subsequent flights anyway. Two of the plaintiffs have actually been given letters from the TSA verifying their identity, but one of these still experiences problems. The second, student Alexandra Hay, was given a personal escort through Philadelphia Airport by the TSA along with the letter after the ACLU threatened to sue on her behalf. Attorney David Nelson meanwhile reports he has been stopped over 40 times, and that other people called David Nelson, including the one who's a sitcom star, have had similar problems. The ACLU is asking that the court declare that the no-fly list violates passengers' constitutional rights to freedom from unreasonable search and seizure and due process of law under the Fourth and Fifth Amendments. . Related link ACLU launches suit (http://www.aclu.org/SafeandFree/SafeandFree.cfm?ID=15430&c=272) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Utah vs. first amendment, global 'net, cookies
by Major Variola (ret.) 07 Apr '04

07 Apr '04

(I'm not defending hostile spyware but there are problems with the law..) http://www.pcworld.com/news/article/0,aid,115527,00.asp Tom Spring, PC World Friday, April 02, 2004 Utah has become the first state to make spyware a crime, passing a law that makes it illegal to install such programs on a PC without approval. Starting in early May, violators face a fine of $10,000 per incident, under the new Spyware Control Act. The Utah law aims to regulate the use of spyware and other advertising software, which is infamous for annoying computer users by tracking and reporting their Web whereabouts and displaying ads. A software company that wants to load a surveillance program onto a Utah user's PC must make full disclosure, under the law. It must reveal what user behavior its software records, what information goes back to a central server, how often ads will appear, and how the ads look. Vendors must also clearly state the purpose of the downloaded software and any changes it makes to a PC's system. <snip> Opponents say the Spyware Control Act is a legal threat to a technology company's right to innovate. Hackett says the Utah law could be interpreted to ban free ad-sponsored software, and perhaps even threaten common e-mail programs that track when and which messages are delivered. State Rep. Urquhart says the law will let a Utah firm sue a spyware company that doesn't follow the Spyware Control Act, when its program displays ads on the Web site of a Utah-based business. He also says the act will help protect consumers by forcing spyware companies to be more upfront about their software.

1 0

VoteHere Release Audit Trail Code
by R. A. Hettinga 07 Apr '04

07 Apr '04

<http://www.internetnews.com/dev-news/print.php/3336851> Internetnews.com VoteHere Release Audit Trail Code By Jim Wagner April 7, 2004 E-voting software developer VoteHere made its audit checking source code available for download Tuesday in a bid to prove its software does what it promises: provide a verifiable audit trail over every citizen's vote. Much of the debate surrounding the electronic tabulation of votes has centered on the machines' ability (or inability in this case) to record votes and then let voters and election officials verify the correct vote was entered and stored in the central repository. Jim Adler, VoteHere founder, said the source code makes good on its promise back in August 2003 when the company announced a partnership with e-voting machine manufacturer Sequoia, to release the code for all to see. "We're a bunch of cryptographers and as students of cryptography, we know there's no real security in obscurity and feel that openness and transparency are an important part of the process, especially with technology that is used to audit an e-voting machine," he told internetnews.com. To date, attempts by e-voting opponents to get software makers to release their code for public scrutiny have met with failure. The most notable case dealt with manufacturer Diebold Election Systems, which filed cease-and-desist orders against a group of college students who discovered vulnerabilities in its machines and posted their findings on the Internet, as well as anyone who put links to the vulnerabilities on their Web site and their Internet service providers (ISP). In December 2003, the company withdrew the orders after the college students, through the Electronic Frontier Foundation (EFF) filed suit against them. Eight days later, Diebold and five other manufacturers banded together under the Information Technology Association of America to "identify and address security concerns" and "raise the profile of electronic voting." VoteHere officials expect the open-sourcing of its audit trail will close the debate on its area of security, at least. Though it's software only runs on Sequoia's machines, Adler said the manufacturer makes up 20 to 30 percent of the industry's market share. The company paid Dr. Robert Baldwin, co-founder of California-based Plus Five Consulting and former technical director of RSA Security, to conduct an independent analysis of its code, who said he was in no way affiliated with VoteHere. "We actually found fewer types of problems than we normally find when we look at other people's code," he told internetnews.com. "I think they definitely had an eye towards producing higher-quality code because they knew somebody was going to go looking at it. The software could easily look at 100 million-person audit trail and verify it within an hour." Individuals who want to review the code can download it here: <http://www.votehere.com/downloads.html> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Firm invites experts to punch holes in ballot software
by Major Variola (ret) 07 Apr '04

07 Apr '04

Peter, what would be wrong with having a machine in the booth that prints any valid receipt BUT is not connected to the voting system. "To vote use the red machine; if you're being coerced you can use the blue machine to print as many receipts as intimidators." A trade off between (mild) user complexity and the desire for receipts (without coercion). At 10:17 AM 4/7/04 -0400, Trei, Peter wrote: >This is kind of broken. Allowing the voter to get a receipt which >they take away with them for verification may allow the voter to verify >that their vote was recorded as cast, but also allows coercion and >vote buying. > >To their credit, the creators thought of this, and suggest a >partial procedural fix in the threat analysis document: > > P4. Let voters discard verification receipts in poll site trash > can and let any voter take them > Result: Buyer/coercer can't be sure voter generated verification >receipt > > P5. Have stacks of random printed codebooks freely available in poll >site > Result: Vote buyer/coercer can't be sure captured codebook was used > > P6. Have photos of on-screen codebooks freely available on-line > Result: Vote buyer/coercer can't be sure captured codebook was used > >The first problem, or course, is that a person under threat of >coercion will need to present the coercer with a receipt showing >exactly the mix of votes the coercer required. This is leads >to a combinatorial explosion of fake receipts that need to be available. > >Having only one vote on each receipt might mitigate this, but it still >gets really messy. > >Second, it's not clear how this protects against the coercer checking the >ballot online - will every fake also be recorded in the system, so >it passes the online check? Having both real and fake ballots in >the verification server makes me very nervous. > >Its possible I've missed something - this is based on a quick glance >through the online documents, but I don't see any advantage this >system has over the much more discussed one where the reciept is >printed in a human readable way, shown to the voter, but retained >inside the machine as a backup for recounts. > >Just my private, personal opinion. > >Peter Trei

1 0

[Politech] Reason magazine cover story has unusual privacy theme
by Major Variola (ret) 07 Apr '04

07 Apr '04

_Reason_ pulls a cryptomesque BigEye op on subscribers:

1 0

RE: Muslim Rivals Unite In Baghdad Uprising
by Tyler Durden 07 Apr '04

07 Apr '04

I swear you can see flopsweat on Rumsfeld as he's trying to explain troop buildup as being more or less a deployment accident (though soon to be followed by non-accidental buildups). Even this arrogant little fuck now realizes he's stepped in deep doo-doo. As for the laughter, I'll be laughing too until the next round of planes perform a little touchdown downtown here. Ah well. I suckle from the breast of US big-business...those are the risks I take. -TD >From: Harmon Seaver <hseaver(a)cybershamanix.com> >To: cypherpunks(a)minder.net >Subject: Muslim Rivals Unite In Baghdad Uprising >Date: Tue, 6 Apr 2004 22:15:51 -0500 > >Bwaaaahhhahahahhahah --ROFL This thing is getting funnier by the minute. > >" On Monday, residents of Adhamiya, a largely Sunni section of northern >Baghdad, >marched with followers of Moqtada Sadr, the militant Shiite cleric whose >call >for armed resistance was answered by local Sunnis the same afternoon, >residents >said." > >http://www.washingtonpost.com/wp-dyn/articles/A56091-2004Apr6.html > > >-- >Harmon Seaver >CyberShamanix >http://www.cybershamanix.com >Hokay hey! > _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.com/go/onm00200415ave/direct/01/

1 0

RE: Firm invites experts to punch holes in ballot software
by Trei, Peter 07 Apr '04

07 Apr '04

>Firm invites experts to punch holes in ballot software > The company's software is designed to let voters verify that their ballots >were properly handled. It assigns random identification numbers to ballots >and candidates. After people vote, they get a receipt that shows which >candidates they chose--listed as numbers, not names. Voters can then use >the Internet and their ballot identification number to check that their >votes were correctly counted. This is kind of broken. Allowing the voter to get a receipt which they take away with them for verification may allow the voter to verify that their vote was recorded as cast, but also allows coercion and vote buying. To their credit, the creators thought of this, and suggest a partial procedural fix in the threat analysis document: P4. Let voters discard verification receipts in poll site trash can and let any voter take them Result: Buyer/coercer can't be sure voter generated verification receipt P5. Have stacks of random printed codebooks freely available in poll site Result: Vote buyer/coercer can't be sure captured codebook was used P6. Have photos of on-screen codebooks freely available on-line Result: Vote buyer/coercer can't be sure captured codebook was used The first problem, or course, is that a person under threat of coercion will need to present the coercer with a receipt showing exactly the mix of votes the coercer required. This is leads to a combinatorial explosion of fake receipts that need to be available. Having only one vote on each receipt might mitigate this, but it still gets really messy. Second, it's not clear how this protects against the coercer checking the ballot online - will every fake also be recorded in the system, so it passes the online check? Having both real and fake ballots in the verification server makes me very nervous. Its possible I've missed something - this is based on a quick glance through the online documents, but I don't see any advantage this system has over the much more discussed one where the reciept is printed in a human readable way, shown to the voter, but retained inside the machine as a backup for recounts. Just my private, personal opinion. Peter Trei

1 0

Muslim Rivals Unite In Baghdad Uprising
by Harmon Seaver 06 Apr '04

06 Apr '04

Bwaaaahhhahahahhahah --ROFL This thing is getting funnier by the minute. " On Monday, residents of Adhamiya, a largely Sunni section of northern Baghdad, marched with followers of Moqtada Sadr, the militant Shiite cleric whose call for armed resistance was answered by local Sunnis the same afternoon, residents said." http://www.washingtonpost.com/wp-dyn/articles/A56091-2004Apr6.html -- Harmon Seaver CyberShamanix http://www.cybershamanix.com Hokay hey!

1 0

Firm invites experts to punch holes in ballot software
by R. A. Hettinga 06 Apr '04

06 Apr '04

Ah, the old hack-me "contest" arrives in the electronic voting business. I love the smell of burning snake-oil in the morning... Cheers, RAH ------- <http://zdnet.com.com/2102-1105_2-5186016.html?tag=printthis> Firm invites experts to punch holes in ballot software By Robert Lemos CNET News.com April 6, 2004, 4:23 PM PT URL: http://zdnet.com.com/2100-1105-5186016.html VoteHere, a maker of security software for voting machines, published the source code for its product online in hopes of garnering additional analysis of its method for verifying the integrity of electronic votes. The company, which has patented its VHTi technology, wants comments, not competition, so it released the code and several documents to its Web site under a license that restricts use of the code to analysis for a period of 60 days. "We pride ourselves on being good students of cryptography," said Jim Adler, founder and CEO of the Bellevue, Wash., company. "We know there is no security through obscurity, so we want to be open." Revealing encryption algorithms for peer review is a standard practice in encryption circles and allows experts to poke holes in other people's technology. VoteHere hopes the additional scrutiny will prove that its technology is sound, Adler said. The company's software is designed to let voters verify that their ballots were properly handled. It assigns random identification numbers to ballots and candidates. After people vote, they get a receipt that shows which candidates they chose--listed as numbers, not names. Voters can then use the Internet and their ballot identification number to check that their votes were correctly counted. "It doesn't protect the system from compromise, but it detects when compromises happen," Adler said. "We are the barking dogs: If anything touches the ballots, it can be detected." The move comes as questions arise about the security of electronic and Internet voting. Though few problems with electronic voting machines arose on March 1, Super Tuesday, many problems have cropped up during other elections. Some states, Michigan among them, are going full bore to ballots cast on the Internet, despite some computer scientists' concerns that the Net is not secure enough to prevent election tampering. About 28 percent of Michigan voters cast their ballot online in February during that state's Democratic caucus. In the same month, the Department of Defense backed away from plans to conduct a trial that could have let the 6 million Americans abroad cast their vote online. VoteHere has had its own security issues to deal with as well. In December, the company called in the FBI to investigate a breach in the company's network. Adler said the investigation was ongoing and stressed that VoteHere's plans to release source code had been in the works since last summer. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Choicepoint - collecting the data of our lives
by Poindexter＠SAFe-mail.net 05 Apr '04

05 Apr '04

And you thought my Information Awareness program was a threat? "The Constitution guarantees some privacy, but not anonymity, Smith has said repeatedly. The courts concur. People have no right to lie about who they are, or to request credentials that convey rights and privileges - such as driver's licenses or permits - without proving their identities. The people who wish to remain anonymous trouble Smith the most. "It is the anonymous person," he writes, "or small group of people, who represent the greatest risks - economic, physical or emotional - facing us today." http://www.govexec.com/features/0304/0304s1.htm

1 0