April 2004 - cypherpunks-legacy

Airport security failures justify CAPPS-II snoop system
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://www.theregister.co.uk/2004/04/26/airport_security_failures/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Identity ; Original URL: http://www.theregister.co.uk/2004/04/26/airport_security_failures/ Airport security failures justify CAPPS-II snoop system By Thomas C Greene (thomas.greene(a)theregister.co.uk) Published Monday 26th April 2004 20:21 GMT Recent government reports on the failure of American airport screeners to detect threat objects at security checkpoints may provide ammunition for proponents of the controversial Computer Assisted Passenger Prescreening System (CAPPS II) database solution, which is currently stalled by myriad snafus too numerous to mention. Human error The Department of Homeland Security (DHS) Inspector General and the Congressional General Accounting Office (GAO) have both submitted reports on the competence of airport passenger and baggage screeners, and found, not surprisingly, that they are no more effective today than they were before the security frenzy brought about by the 11 September atrocities. In testimony before the House Aviation Subcommittee (http://www.house.gov/transportation/aviation/04-22-04/04-22-04memo.html) Inspector General for Homeland Security Clark Ervin and GAO Managing Director Norman Rabkin said that the Transportation Security Administration's (TSA's) well-paid screening personnel are no more effective than the inexpensive rent-a-cops provided by private contractors. A comparison between federal screeners and those participating in a pilot program for private contractors called the PP5 Program. According to Ervin, federal and private screeners "performed about the same, which is to say, equally poorly." He added that "this result was not unexpected, considering the degree of TSA involvement in hiring, deploying, and training the [private sector] screeners." It's believed that TSA's interference in the PP5 Program and its bureaucratic inertia are important reasons why the private-sector screeners failed to outdo their civil-service counterparts. Both reports are biased against the TSA. They assume that TSA is a lost cause, although, ironically, it had originally been touted as a much-needed fix for the incompetence of private contractors, upon whom blame for the 9/11 atrocity was conveniently fixed in the immediate aftermath. It now appears that TSA is seen as the chief source of security incompetence and failure. "TSA's tight controls over the pilot program restricted flexibility and innovation that the contractors may have implemented to perform at levels exceeding that of the federal workforce. TSA needs to establish a more robust pilot program that allows greater flexibility to test new innovations and approaches," Ervin said. Defective detectives Indeed, passenger screening is no better than it was 17 years ago. Covert testing conducted in 1978 - back when screeners were reasonably polite and quick and unobtrusive about their business - found that 13 per cent of threat objects passed undetected. Today, in the wake of post-9/11 security hysteria, and its attendant aggressive bullying of the public and punishment-strip searching of anyone daring to pass a sarcastic comment, the figure is 20 per cent. TSA Administrator Admiral David Stone defended his outfit and took issue with the reports. "Testing in the Nineties was in no way even comparable to what we do," he said. While it may be true that today's covert testing is more sophisticated, detection equipment has also improved to make the screeners' jobs easier, though he neglected to emphasize this fact. The red teams and the blue teams have both got better tricks up their sleeves, so there's certainly nothing unfair about the penetration tests, as Stone tried to imply. Still, bad news for human screeners may well be good news for technology. Database Hell Stone showed little enthusiasm for the PP5 Program, but he is a big proponent of CAPPS II, having touted it before the same House committee back in March as a scheme promising to deliver "vital impact ... on aviation security." He has studied the vendor's PR boilerplate with great care. CAPPS II is a "second-generation prescreening system [that] will be a centralized, automated, threat-based, real time, risk assessment platform ... expected to employ technology and data analysis techniques to conduct an information-based identity authentication," he gushed. The system is a product of aviation defense contractor Lockheed Martin Corporation, promoted by US Transportation Secretary and former Lockheed Martin Vice President Norman Mineta, Stone's boss. At present, the grand "risk assessment platform" is mired in failure. What little of it currently works has not been tested adequately because carriers are withholding passenger data in fear of a public backlash on privacy grounds. The accuracy of the many databases that CAPPS II will scour for its incriminating evidence has not yet been established. Procedures for passengers to detect inaccurate data, and get inaccurate data and false positives resolved, have not been implemented. Major privacy threats inherent in the system, particularly those involving restrictions on access, have not been addressed. The potential for malevolent identity thieves to impersonate innocent travelers remains high. False consciousness This is all good, because CAPPS II is one of the worst possible solutions to airport security. It won't prevent terrorists from flying; rather, it will increase the probability of another successful attack using commercial aircraft. The reason is painfully obvious: a group can very conveniently use the system to pre-screen its members and discover which of them have profiles that result in extra scrutiny. Thus CAPPS II is a superb tool for terrorists to use in assessing airport defenses. A group of unarmed terrorists can board two or three flights in succession and observe how the system reacts to them. If, after a few trial runs, they discover that they're allowed to board unchallenged, they can assume that their profiles do not trigger a warning. Armed with that information, they'll stand a good chance of mounting a real attack. CAPPS II is a disaster for two reasons: first, it will create a false sense of security among airline staff and provide further excuses for screeners to perform poorly; and second, it offers terrorists an excellent training device that they can use to assemble a group of people who can get onto airplanes without arousing suspicion. Ironically, the closer CAPPS II comes to achieving its stated goals, the more effective it will become as a terrorist tool. So it is indeed good that its development is going poorly. The problem, however, is that the recently publicized failures among human screeners will provide rationale to rush it into service. CAPPS II may well find itself on a fast track, pushed hard by those who would exploit the popular misconception that computers and other high-tech gizmos can compensate for human fallibility. . Thomas C Greene is the author of Computer Security for the Home and Small Office, a complete guide to system hardening, online anonymity, encryption, and data hygiene for Windows and Linux, available at discount in the USA (http://www.amazon.com/exec/obidos/tg/detail/-/1590593162/) and in the UK (http://www.amazon.co.uk/exec/obidos/ASIN/1590593162/) Related stories American Airlines data used to test passenger snoop system (http://www.theregister.co.uk/2004/04/13/privacy/) The wrong stuff: what it takes to be a TSA terror suspect (http://www.theregister.co.uk/2004/04/07/aclu-suit/) Campaigners fight biometric passports (http://www.theregister.co.uk/2004/03/29/campaigners_fight_biometric_passpor…) Data on 10m Northwest fliers handed to NASA for testing (http://www.theregister.co.uk/2004/01/20/data_on_10m_northwest_fliers/) US using EU airline data to test CAPPS II snoop system (http://www.theregister.co.uk/2004/01/15/us_using_eu_airline_data/) Commission agrees US access to EU citizen personal data (http://www.theregister.co.uk/2003/12/17/commission_agrees_us_access/) Congress threatens two hi-tech Gestapo programs (http://www.theregister.co.uk/2003/07/17/congress_threatens_two_hitech_gesta…) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Fact checking
by R. A. Hettinga 27 Apr '04

27 Apr '04

[having problems with an MX record somewhere. Let's see if this works...] At 3:04 PM -0400 4/26/04, Damian Gerow parsed a sentence thusly: >That's not saying that he invented the internet, it's saying that he took >initiative in creating it. Okay. I'll bite. Let's do a Rorschach test. Please parse *this* sentence: "A well regulated militia, being necessary to the security of a free state, the right of the people to keep and bear arms, shall not be infringed." :-) Too hard? How about this one: "Counsel is fully aware that Ms. Lewinsky has filed, has an affidavit which they are in possession of saying that there is absolutely no sex of any kind in any manner, shape or form, with President Clinton..." ;-) YMO"I"MV? Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "...if a person can't communicate, the very least he can do is to shut up." -- Tom Lehrer

1 0

U.K. Identity Card Will Make Fraud Easier, Expert Says
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://quote.bloomberg.com/apps/news?pid=10000102&sid=a7DltmImQUYE&refer=uk> Bloomberg ines Expanding European Union in Economic Competitiveness Study Amvescap, BAE, BP, BAT, Ferraris, Solitaire: U.K., Irish Equity Preview Royal Mail Group Seeking Permission to Price Letters by Size, Not Weight U.K. Identity Card Will Make Fraud Easier, Expert Says April 27 (Bloomberg) -- A U.K. identity card will not prevent terrorism and may make identity fraud easier, a leading security expert says, undermining the case for the cards made by Home Secretary David Blunkett. Blunkett on Monday set out plans for a national identity card featuring ``biometric'' measures such as fingerprints and iris scans to be introduced in 2007. A six-month trial of biometric recording and verification, involving 10,000 volunteers, has just begun. He said an ID card would protect Britain from terrorism, identity fraud and ``benefit tourism'' - people visiting the U.K. to claim welfare payments. ``An ID card makes ID fraud easier because it's a one-stop shop,'' said Bruce Schneier, a security expert and author of Beyond Fear: Thinking Sensibly About Security in an Uncertain World. ``My fear is that once you have a credential that everybody trusts, faking it becomes so much more valuable. There will be a false sense of security and you can abuse that.'' In an interview with the BBC in London on Monday, Blunkett cited information from the security forces that 35 percent of terrorists had used fake IDs. ``How is this going to help?'' said Schneier, who has testified on security before the US congress, from California. ``Let's pretend he's right, and let's pretend the card is 100 percent successful. So now there's no terrorists using fake IDs. Does it reduce the threat of an attack? No. They will just find another way. Any anti-terrorist measure that forces a terrorist to change his tactics in a meaningless way is a waste of money.'' The Home Office said in a statement that because the new cards would use biometric measures, the system would identify people trying to apply for multiple cards under different names. ``Biometrics won't stop me getting a card in your name,'' said Schneier. ``Pictures are a biometric, and we use pictures on cards in the US and fraud happens all the time. What's new is biometrics being checked by computer. Is your computer reliable? Mine isn't. ``The operators who run the computers are bribeable. What does it cost to bribe someone to go into a database and change the fingerprint?'' The plan to introduce a compulsory identity card for the first time since the cards were scrapped after World War II has met resistance from other member's of Prime Minister Tony Blair's government, including Trade and Industry Secretary Patricia Hewitt. Parliament will be given a vote before the cards are made compulsory in 2013. ``The whole point of this trial is to see what glitches we uncover,'' the Home Office said in a statement Replying to Schneier's criticisms. ``We will work to make the system as secure as possible.'' -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

recent node activity
by Riad S. Wahby 27 Apr '04

27 Apr '04

The al-Qaeda.net node was down for about 30 hours or thereabouts. It ought to be back up now. Messages received during that period have been resent. Sorry for the unannounced outage. Things should be better now. -- Riad Wahby rsw(a)jfet.org MIT VI-2 M.Eng

1 0

Re: Fact checking
by R. A. Hettinga 27 Apr '04

27 Apr '04

At 5:36 PM -0400 4/26/04, Damian Gerow wrote: >: YMO"I"MV? > >Hum. I've never seen this before -- what's it stand for? Your Meaning Of "Is" May Vary... ;-) Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Fact checking
by Tyler Durden 27 Apr '04

27 Apr '04

>How do you start motivating a lazy and apathetic public to learn about >their >candidates, and vote? Door-to-door campaigns? Talks at the local library? >Grocery store posters? Well, imagine if we could buy votes...I'd bet we could scrounge up a few hundred thousand votes for the price of a few vials of crack. Then imagine we 'elect' bin Laden as a Senator or something with these votes. I bet people would start voting after that. -TD >From: Harmon Seaver <hseaver(a)cybershamanix.com> >To: cypherpunks(a)minder.net >Subject: Re: Fact checking >Date: Tue, 27 Apr 2004 07:15:04 -0500 > >On Mon, Apr 26, 2004 at 08:20:06PM -0400, Damian Gerow wrote: > > > > Thus spake Harmon Seaver (hseaver(a)cybershamanix.com) [26/04/04 19:25]: > > : And the local elections are no prime pickings either, it's crooks >to the left > > : of us, crooks to the right of us, ahead and behind, above and below. >Extremely > > : few real choices. The real problem is -- most people don't vote. What >needs to > > : be done is a real grass roots effort to educate people and get them to >vote. > > > > So, how does one start a grass roots effort? I'm Canuck, and I'm not > > exactly impressed with this year's pickings up North. My last vote was >a > > vote /against/ the in-office party, not for the party I'd like to see in > > office. > > > > How do you start motivating a lazy and apathetic public to learn about >their > > candidates, and vote? Door-to-door campaigns? Talks at the local >library? > > Grocery store posters? > > All of the above, but mostly door-to-door voter registration. When you >consider that both klinton and dubbya were elected with only 13%-14% of the >eligible voters, it wouldn't take all that many new voters to really make a >difference. > > > >-- >Harmon Seaver >CyberShamanix >http://www.cybershamanix.com >Hoka hey! > _________________________________________________________________ Stop worrying about overloading your inbox - get MSN Hotmail Extra Storage! http://join.msn.com/?pgmarket=en-us&page=hotmail/es2&ST=1/go/onm00200362ave…

1 0

Re: Fact checking
by Tyler Durden 27 Apr '04

27 Apr '04

"How do you start motivating a lazy and apathetic public to learn about their candidates, and vote? Door-to-door campaigns? Talks at the local library? Grocery store posters?" Well, we could just tell them their lives would be much better under Kodos, rather than Kang. -TD >From: Damian Gerow <dgerow(a)afflictions.org> >To: Harmon Seaver <hseaver(a)cybershamanix.com> >CC: cypherpunks(a)ds.pro-ns.net >Subject: Re: Fact checking >Date: Mon, 26 Apr 2004 20:20:06 -0400 > >Thus spake Harmon Seaver (hseaver(a)cybershamanix.com) [26/04/04 19:25]: >: And the local elections are no prime pickings either, it's crooks to >the left >: of us, crooks to the right of us, ahead and behind, above and below. >Extremely >: few real choices. The real problem is -- most people don't vote. What >needs to >: be done is a real grass roots effort to educate people and get them to >vote. > >So, how does one start a grass roots effort? I'm Canuck, and I'm not >exactly impressed with this year's pickings up North. My last vote was a >vote /against/ the in-office party, not for the party I'd like to see in >office. > >How do you start motivating a lazy and apathetic public to learn about >their >candidates, and vote? Door-to-door campaigns? Talks at the local library? >Grocery store posters? > _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee. Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

1 0

Re: What Should Freedom Lovers Do?
by An Metet 26 Apr '04

26 Apr '04

Lew Rockwell had written: > The Rothbardian approach to a pro-freedom strategy comes down to the > following four affirmations: 1) the victory of liberty is the highest > political end; 2) the proper groundwork for this goal is a moral passion > for justice; 3) the end should be pursued by the speediest and most > efficacious possible means; and 4) the means taken must never contradict > the goal, "whether by advocating gradualism, by employing or advocating any > aggression against liberty, by advocating planned programs, by failing to > seize any opportunities to reduce State power, or by ever increasing it in > any area." This is good advice for cypherpunks as well. We all support the victory of liberty, and we have a moral passion for justice. Whether our means are the speedious and most efficacious may be questionable, but it's not like other forums are seeing vastly greater success. And it's best if freedom lovers push forward on all fronts. Our goals of providing liberty through cryptography are complementary to other efforts to achieve freedom. But the last point is the one I want to emphasize, a continuing theme in my writings for the past several years: that the means must not contradict the goal. Too often have cypherpunks fallen into the trap of advocating violence and aggression as a means to achieve their freedoms. Tim May was the worst of these, wishing for the nuclear obliteration of Washington, cheering the Oklahoma City bombings, even threatening the lives of family members of those who would break their word to him. The destruction of innocents must never be part of the agenda of a supporter of freedom. Of course, if we stick to cypherpunk means, the issue does not arise. Cryptographic anonymity threatens no one but aggressors. It is purely defensive in nature. Using PGP, TOR or Freenet does not harm innocent children or anyone else. Yet these technologies open up new possibilities for freedom of speech today, and hopefully for freedom of contract in the future. In my devotion to freedom, I apparently go beyond the point where most cypherpunks are comfortable, in that I support private initiatives and technologies of all sorts and oppose government regulation of them. I am a supporter and admirer of Microsoft, which has achieved tremendous market success without relying on government support, indeed in the face of steadfast government opposition. I oppose government antitrust efforts in general, and specifically those directed against Microsoft. Yet how many other cypherpunks have spoken up in favor of this widely hated company? Where is your love of freedom, if you can be silent in the face of government infringement of their rights? Re-read Rothbard's fourth point, and understand that support of antitrust actions is exactly what he cautions against. Last year a widely published diatribe against online "monoculture" called for Microsoft to be compelled to engage in all sorts of activities, including rewriting all their software to run on Linux. This homage to statism was authored by, among others, a man who once called himself libertarian: Perry Metzger, moderator of the cryptography mailing list. No one who loves freedom should allow himself to be associated with any such proposal. Likewise, I support privately organized technological initiatives such as DRM and even Trusted Computing. It doesn't matter what the net impact or effects of these technologies will be (although I think they will be overall neutral to positive). The only important point is that these are free and non-coercive, without government regulation. Of course, DRM is presently strengthened by the DMCA, an evil and counter-productive infringement on personal rights, but here it is important to focus on what is wrong and what is right. What is wrong is government restriction; what is right is technology and contract to enforce mutually agreed-upon conditions and permissions. Cypherpunks should take a close look at how they choose which issues to support and oppose. Bear in mind Rothbard's advice against advocating aggression against liberty, advocating planned programs, or supporting the increase in State power in any area. We must be uncompromising in our support for freedom and liberty. If we stick to our goals of building technology to let people communicate privately and anonymously, that will be our contribution to the freedom of the future world. == Read the Unlimited Freedom blog, http://invisiblog.com/1c801df4aee49232/

2 1

Re: BBC on all-electronic Indian elections
by Tyler Durden 26 Apr '04

26 Apr '04

"Hmmm... that's a thought. Tim May as president. Election slogan: "You're *all* going up the chimneys."" Wasn't there something close a few years ago? I remember a write-in campaign to get "Unabomber" Ted Kascinsky elected as President. -TD >From: Jack Lloyd <lloyd(a)randombit.net> >To: sunder <sunder(a)sunder.net> >CC: cypherpunks(a)al-qaeda.net >Subject: Re: BBC on all-electronic Indian elections >Date: Mon, 26 Apr 2004 11:34:39 -0400 > >On Mon, Apr 26, 2004 at 11:18:52AM -0400, sunder wrote: > > Jack Lloyd wrote: > > > > >Still, I liked this quote: '"I came to vote because wasting one's >ballot > > >in a > > >democracy is a sin," he told the BBC.' Not too common a view in the US > > >these > > >days, it seems like. > > > > What do you expect when the previous choice we've had was between Al "I > > Invented the Innnernet" Gore, and George "Nucular" Dubbya? > >AFAIK most local/state elections have even lower turnout than the recent >ones >for the prez. Anyway, you could always have voted for Nader/Brown/Tim >May/etc. > >Hmmm... that's a thought. Tim May as president. Election slogan: "You're >*all* >going up the chimneys." > _________________________________________________________________ MSN Toolbar provides one-click access to Hotmail from any Web page FREE download! http://toolbar.msn.com/go/onm00200413ave/direct/01/

1 0

[>Htech] WT: FBI up for private screens (fwd from checker@panix.com)
by Eugen Leitl 26 Apr '04

26 Apr '04

----- Forwarded message from Premise Checker <checker(a)panix.com> -----

1 0