May 2004 - cypherpunks-legacy

[CYBERIA] 1st amendment protection of software
by Peter D. Junger 21 May '04

21 May '04

I have started a weblog, which is at <http://sasmara.law.cwru.edu/blog/>. One of the entries, which I enclose, about first amendment protection of software may be of interest to some members of this list. -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH EMAIL: junger(a)samsara.law.cwru.edu URL: http://samsara.law.cwru.edu NOTE: junger(a)pdj2-ra.f-remote.cwru.edu no longer exists --Begin Enclosure Expression Has Nothing to Do with It If one is concerned, as I am, with extending the First Amendment's protection of free speech and of the press to the writings of computer programmers and to the publication of information in digital form, one needs to find some way not to couch one's arguments in terms of ``freedom of expression.'' Burning a flag to protest a war is protected by the First Amendment, even though flag-burning is not literally speech, because flag-burning is ``expressive.'' That extension of the First Amendment beyond its literal scope does not, however, in any way imply that the speaking or publishing of materials that are not expressive are not acts entitled to First Amendment protection. Saying that ``one and one is two'' is not, I submit, expressive in the sense that burning a flag is expressive. That, however, does not give the government absolute authority under the First Amendment to forbid saying ``one and one is two,'' even though saying that might endanger the success of the government's fiscal policies or its conduct of the war in Iraq. Random numbers are not expressive in any sense at all, yet that does not mean that the publication of a table of random numbers would not be protected by the First Amendment. That might seem obvious, but when some years ago I challenged the constitutionality of the government's export regulations that forbade the publication of computer programs in digital form, the Government's response was to argue that computer programs are ``functional'' and therefore not ``expressive'' and that the publication of computer programs is thus not protected by the First Amendment. Put that way, the government's argument may not seem very persuasive. The trouble was, however, that there are no judicial precedents holding, or even saying, that non-expressive (or functional) speaking and publication are activities protected by the First Amendment--a point that is so obvious that it never has been litigated--and there are lots of precedents saying that one can only obtain a copyright on expressive writings and that functional writings are not copyrightable. Of course, the issue of whether a computer program is copyrightable has no bearing on whether it is entitled to First Amendment protection, but this apparently is not easy to see if one does not have the slightest idea as to what a computer program actually is. How difficult it is for courts, and lawyers, to understand that computer programs are simply writings like the recipes in a recipe book or the mathematical tables in an engineering handbook, is illustrated by the holding of the Federal District Court judge in my case, Junger v. Daley: Source code is ``purely functional,'' in a way that . . . instructions, manuals, and recipes are not. Unlike instructions, a manual, or a recipe, source code actually performs the function it describes. While a recipe provides instructions to a cook, source code is a device, like embedded circuitry in a telephone, that actually does the function of encryption. At that point my long-suffering lawyers had little choice but to adopt the government's interpretation of the First Amendment and argue that computer programs--or at least their source code--are protected by the First Amendment because they are ``expressive.'' And that argument prevailed. The Court of Appeals held in my case that Because computer source code is an expressive means for the exchange of information and ideas about computer programming, we hold that it is protected by the First Amendment. That was a great victory. Junger v. Daley is now the leading case holding that computer programs, or at least their source code, are protected by the First Amendment. The fact remains, however, that there is a much simpler reason for holding that the publication of computer programs--and not just source code--is protected by the First Amendment. To publish a computer program is to publish information and it is the publication of information that is protected by the freedom of the press. It's that simple. Expression has nothing to do with it --End Enclosure ********************************************************************** For Listserv Instructions, see http://www.lawlists.net/cyberia Off-Topic threads: http://www.lawlists.net/mailman/listinfo/cyberia-ot Need more help? Send mail to: Cyberia-L-Request(a)listserv.aol.com ********************************************************************** --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[CYBERIA] 1st amendment protection of software
by R. A. Hettinga 21 May '04

21 May '04

--- begin forwarded text

1 0

welcoming computer viruses
by Tyler Durden 21 May '04

21 May '04

Well, why can we use this to our advantage? As usual, this thought emerges from Tyler Durden's punch-drunk brain, but it's worth considering... Imagine I'm working for a large Fortune 100 Company. Now imagine I hear about a sasser-like worm that will install atself and spread, BUT "it has been confirmed" that the worm will proceed to vomit spam at X for a period of 48 hours. Depend on X (eg, the CIA, Microsoft, Re-elect George W...) I might be more than willing to download that virus, provided I had some kind of assurance that it wouldn't trash all my work (and if it closes down my company for a day or two, all the better 'cause I'm way overworked). Of course, I'll need plausible denial: "Oh, I thought that was my boss sending me a file..."). -TD >From: Eric Cordian <emc(a)artifact.psychedelic.net> >To: cypherpunks(a)minder.net >Subject: Re: Science: throttling computer viruses >Date: Thu, 20 May 2004 11:01:46 -0700 (PDT) > >Major Variola writes: > > > Computer viruses and worms are an increasing problem throughout the > > world. By some estimates 2003 was the worst year yet: > > Viruses halted or hindered operations at numerous businesses and other > > organizations, disrupted cash-dispensing machines, > >I have a dual boot system which normally runs Linux. Since it had been a >couple of months since I last ran XP, I booted it on Tuesday to run >Windows Update, and keep it current with critical patches. Within >minutes, before I had even downloaded the first update, my box ground to a >nearly screeching halt from Sasser, and some other piece of malware which >was trying to make thousands of connections to random IPs on port 5000. > >I've had Linux exposed to the Net for years, and have never had these >kinds of problems. You really wonder why someone doesn't arrest Bill >Gates for software malpractice. > >It's really silly when code can leap into your machine, install itself, >configure itself to start up again every time the system is booted, and >then sit there using all your system resources looking for other boxes to >victimize. Didn't we learn all we needed to know about provably correct >secure inpenetrable kernels with MULTICS in the 1960's? Why has the world >of computing been subjected to 20 years of Microsoft slowly reinventing >the wheel starting with DOS, and they still haven't gotten it right. > >We recall McDonalds toys with parts kids can bite off and choke on, but we >let millions of lines of closed source code that does Lord-knows-what on >various network ports run on nearly every machine in the universe with >impunity. > >-- >Eric Michael Cordian 0+ >O:.T:.O:. Mathematical Munitions Division >"Do What Thou Wilt Shall Be The Whole Of The Law" > _________________________________________________________________ Get 200+ ad-free, high-fidelity stations and LIVE Major League Baseball Gameday Audio! http://radio.msn.click-url.com/go/onm00200491ave/direct/01/

1 0

RE: US airport fake ID study 'was found in al-Qaida cave'
by Tyler Durden 21 May '04

21 May '04

SO... This begs the question: Can we start issuing Cypherpunks LEO IDs? -TD >From: "R. A. Hettinga" <rah(a)shipwright.com> >To: cypherpunks(a)al-qaeda.net, cypherpunks(a)al-qaeda.net >Subject: US airport fake ID study 'was found in al-Qaida cave' >Date: Fri, 21 May 2004 08:30:51 -0400 > ><http://www.theregister.co.uk/2004/05/20/us_airport_id_security/print.html> > >The Register > > > > Original URL: >http://www.theregister.co.uk/2004/05/20/us_airport_id_security/ > >US airport fake ID study 'was found in al-Qaida cave' >By John Lettice (john.lettice(a)theregister.co.uk) >Published Thursday 20th May 2004 21:47 GMT > >The US House Aviation Subcommittee yesterday heard how congressional >investigators used false IDs to gain access to a series of federal >buildings and two commercial airports, and how a copy of the report >detailing their success was later found in an al-Qaida cave in Afghanistan. >The investigators were 100 per cent successful in getting past security, >but apparently less so in the case of their own report's security. > >Subcommittee Chairman John Mica told a hearing >(http://www.winonadailynews.com/articles/2004/05/20/ap/HiTech/d82lr3m00.txt) >on biometric ID in aviation that the deployment of more secure ID needed to >be accelerated, given that terrorists are interested in gaining access to >restricted airport areas. The congressional investigators had made their >fake IDs using software downloaded from the Internet, and apparently this >passed muster. > >Documentation presented to the hearing however included even more >comforting information about the security of the US aviation industry. If >you look down near the bottom of this document, >(http://www.house.gov/transportation/aviation/05-19-04/05-19-04memo.html) >in the section covering the Registered Traveler program you will find a >subsection dealing with Law Enforcement Officer (LEO) Credentials. As you >see, it says: "Currently, Federal LEO's can fly armed at any time, simply >by presenting their agency's credential. In addition, LEO's from 18,000 >separate State and local law enforcement agencies may fly armed if they >present their agency's credential and a letter on their agency's letterhead >stating that they have an official, work-related reason to fly armed. The >use of so many different types of law enforcement credentials increases the >risk that an unauthorized person could use a forged credential to carry a >gun on-board." > >Under the Registered Traveler Pilot program LEOs wishing to fly armed will >have biometric ID issued by the Transportation Security Administration >saying so, but it's not clear to us whether this will mean LEOs from the >18,000 non-Federal agencies will have to have this if they want to fly >armed, or whether the letterhead will still be enough. The pilot program >starts at five airports next month, and one would hope that the authorities >elsewhere will be taking extra special care in scrutinising LEO credentials >pending a wider rollout. . > > >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"Several times a week, to enter a TV studio say, or to board a plane, I >have to produce a tiny picture of my face." -- Christopher Hitchens > _________________________________________________________________ Watch LIVE baseball games on your computer with MLB.TV, included with MSN Premium! http://join.msn.click-url.com/go/onm00200439ave/direct/01/

1 0

[FoRK] Are you a potential terrorist? (fwd from jbone@place.org)
by Eugen Leitl 21 May '04

21 May '04

----- Forwarded message from Contempt for Meatheads <jbone(a)place.org> -----

1 0

US airport fake ID study 'was found in al-Qaida cave'
by R. A. Hettinga 21 May '04

21 May '04

<http://www.theregister.co.uk/2004/05/20/us_airport_id_security/print.html> The Register Original URL: http://www.theregister.co.uk/2004/05/20/us_airport_id_security/ US airport fake ID study 'was found in al-Qaida cave' By John Lettice (john.lettice(a)theregister.co.uk) Published Thursday 20th May 2004 21:47 GMT The US House Aviation Subcommittee yesterday heard how congressional investigators used false IDs to gain access to a series of federal buildings and two commercial airports, and how a copy of the report detailing their success was later found in an al-Qaida cave in Afghanistan. The investigators were 100 per cent successful in getting past security, but apparently less so in the case of their own report's security. Subcommittee Chairman John Mica told a hearing (http://www.winonadailynews.com/articles/2004/05/20/ap/HiTech/d82lr3m00.txt) on biometric ID in aviation that the deployment of more secure ID needed to be accelerated, given that terrorists are interested in gaining access to restricted airport areas. The congressional investigators had made their fake IDs using software downloaded from the Internet, and apparently this passed muster. Documentation presented to the hearing however included even more comforting information about the security of the US aviation industry. If you look down near the bottom of this document, (http://www.house.gov/transportation/aviation/05-19-04/05-19-04memo.html) in the section covering the Registered Traveler program you will find a subsection dealing with Law Enforcement Officer (LEO) Credentials. As you see, it says: "Currently, Federal LEO's can fly armed at any time, simply by presenting their agency's credential. In addition, LEO's from 18,000 separate State and local law enforcement agencies may fly armed if they present their agency's credential and a letter on their agency's letterhead stating that they have an official, work-related reason to fly armed. The use of so many different types of law enforcement credentials increases the risk that an unauthorized person could use a forged credential to carry a gun on-board." Under the Registered Traveler Pilot program LEOs wishing to fly armed will have biometric ID issued by the Transportation Security Administration saying so, but it's not clear to us whether this will mean LEOs from the 18,000 non-Federal agencies will have to have this if they want to fly armed, or whether the letterhead will still be enough. The pilot program starts at five airports next month, and one would hope that the authorities elsewhere will be taking extra special care in scrutinising LEO credentials pending a wider rollout. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "Several times a week, to enter a TV studio say, or to board a plane, I have to produce a tiny picture of my face." -- Christopher Hitchens

1 0

[IP] Microsoft told to explain e-mail deletion memos
by R. A. Hettinga 21 May '04

21 May '04

--- begin forwarded text

1 0

Science: throttling computer viruses
by Major Variola (ret) 21 May '04

21 May '04

Gist: they can spread too fast to deal with unless you throttle all connections. Science, Vol 304, Issue 5670, 527-529 , 23 April 2004 COMPUTER SCIENCE: Technological Networks and the Spread of Computer Viruses Justin Balthrop, Stephanie Forrest, M. E. J. Newman, Matthew M. Williamson* Computer viruses and worms are an increasing problem throughout the world. By some estimates 2003 was the worst year yet: Viruses halted or hindered operations at numerous businesses and other organizations, disrupted cash-dispensing machines, delayed airline flights, and even affected emergency call centers. The Sobig virus alone is said to have caused more than $30 billion in damage (1). And most experts agree that the damage could easily have been much worse. For example, Staniford et al. describe a worm that could infect the entire Internet in about 30 s (2). A worm of this scale and speed could bring the entire network to a halt, or worse. The term virus refers to malicious software that requires help from computer users to spread to other computers. E-mail viruses, for instance, require someone to read an e-mail message or open an attached file in order to spread. The term worm refers to infections that spread without user intervention. Because they spread unaided, worms can often spread much faster than viruses. Computer infections such as viruses and worms spread over networks of contacts between computers, with different types of networks being exploited by different types of infections. The structure of contact networks affects the rate and extent of spreading of computer infections, just as it does for human diseases (3-7); understanding this structure is thus a key element in the control of infection. Both traditional and network-based epidemiological models have been applied to computer contagion (3-5). Recent work has emphasized the effects of a network's degree distribution. A network consists of nodes or vertices connected by lines or edges, and the number of edges connected to a vertex is called its degree. Of particular interest are scale-free networks, in which the degree distribution follows a power law, where the fraction pk of vertices with degree k falls off with increasing k as k- for some constant . This structure has been reported for several technological networks, including the Internet (8) and the World Wide Web (9, 10). Infections spreading over scale-free networks are highly resilient to control strategies based on randomly vaccinating or otherwise disabling vertices. This is bad news for traditional computer virus prevention efforts, which use roughly this strategy. On the other hand, targeted vaccination, in which one immunizes the highest degree vertices, can be very effective (11, 12). These results rely crucially on the assumption that the degree distribution follows a power law, and also that the contact pattern is static. Many technological networks relevant to the spread of viruses, however, are not scale-free. Vaccination strategies focusing on highly connected network nodes are unlikely to be effective in such cases. Furthermore, network topology is not necessarily constant. In many cases the topology depends on the replication mechanism used by a virus and can be manipulated by virus writers to circumvent particular control strategies that we attempt. If, for instance, targeted vaccination strategies were found to be effective against viruses spreading over scale-free networks, viruses might be rewritten so as to change the structure of the network to some non-scale-free form instead. To make these ideas more concrete, we consider four illustrative networks, each of which is vulnerable to attack: (A) the network of possible connections between computers using the Internet Protocol (IP), (B) a network of shared administrator accounts for desktop computers, (C) a network of e-mail address books, and (D) a network of e-mail messages passed between users. In network A, each computer has a 32-bit IP address and there is a routing infrastructure that supports communication between any two addresses. We consider the network in which the nodes are IP addresses and two nodes are connected if communication is possible between the corresponding computers. Many epidemics spread over such an IP network. Notable examples include the Nimda and SQLSlammer worms. Network B is a product of the common operating system feature that allows computer system administrators to read and write data on the disks of networked machines. Some worms, including Nimda and Bugbear, can spread by copying themselves from disk to disk over this network. Network C has nodes representing users and a connection from user i to user j if j's e-mail address appears in i's address book. Many e-mail viruses use address books to spread (for example, ILoveYou). A closely related network is network D, in which the nodes represent computer users, and two users are connected if they have recently exchanged e-mail. Viruses such as Klez spread over this network. Degree distributions have been measured for examples of each of the four networks (see the figure). In network A, all vertices have the same degree, so the distribution has a single peak at this value (blue histogram). In network B, the distribution consists of four discrete peaks, presumably corresponding to different classes of computers, administrators, or administration strategies (red histogram). Infectious connections. (Left) Degree distributions for the IP (blue) and administrator (red) networks. The administrator network data were collected on a system of 518 users of 382 machines at a large corporation. Computers in this network are connected if any user has administrative privileges on both computers. (Right) Cumulative degree distributions for the e-mail address book (blue) and e-mail traffic (red) networks. The e-mail address book data were collected from a large university (7). The e-mail traffic data were collected for complete e-mail activity of a large corporate department over a 4-month period (18). The two e-mail networks have more continuous distributions and are shown as cumulative histograms. Although neither network has a power-law degree distribution, both have moderately long tails, which suggests that targeted vaccination strategies might be effective. However, calculations show that for network C, about 10% of the highest degree nodes would need to be vaccinated to prevent an epidemic from spreading (7), whereas network D would require about 80%. The first of these figures is probably too high for an effective targeted vaccination strategy, and the second is clearly far too high. (Targeted vaccination would be entirely ineffective in the other two networks as well, because the nodes are much more highly connected.) The two e-mail networks illustrate the ways in which different virus replication strategies can lead to different network topologies. An e-mail virus could look for addresses in address books, thereby spreading over a network with a topology like that of network C, or it could search through other files or folders on the machine for addresses of senders and recipients of archived e-mail messages, giving a topology more like network D. Another example is provided by the Nimda virus, which infects Web servers by targeting random IP addresses, producing a network like network A. However, if the virus had a more intelligent way of selecting IP addresses to attack (e.g., by inspecting hyperlinks), then it might spread over a topology more like that of the Web, which is believed to have a power-law degree distribution (9, 10). A control strategy is needed that is immune to changes in network topology and that does not require us to know the mechanisms of infections before an outbreak. A number of methods have been proposed (13). One such strategy is throttling, first introduced for the control of misbehaving programs (14) and recently extended to computer network connections (15). In this context, throttling limits the number of new connections a computer can make to other machines in a given time period. Because it works by limiting spreading rates rather than stopping spread altogether, the method does not completely eliminate infections but only slows them down. Frequently, however, this is all that is necessary to render a virus harmless or easily controllable by other means (16). Throttling is most effective when viruses generate traffic at a rate significantly higher than normal network communications. Luckily this is true for many common protocols and the viruses that exploit them (15, 17). For a virus to spread, it needs to propagate itself to many different machines; to spread quickly, it must do so at a high rate. For example, the Nimda worm attempts to infect Web servers at a rate of around 400 new machines per second, which greatly exceeds the normal rate of connections to new Web servers of about one per second or slower (15). A throttling mechanism that limited connections to new Web servers to about one per second would slow Nimda by a factor of 400 without affecting typical legitimate traffic. This could easily be enough to change a serious infection into a minor annoyance, which could then be eliminated by traditional means. Slowing the spread of Nimda by a factor of 400 (from a day to more than a year) would have allowed plenty of time to develop and deploy signatures and prophylactic software patches. (Of course, if throttling were implemented on only a subset of the nodes in a network, then infections could spread more easily.) In addition to reducing virus spread, throttling has the practical benefit of reducing the amount of traffic generated by an epidemic, thus reducing demand on networking equipment--often the primary symptom of an attack. Targeted vaccination strategies for the control of computer viruses are unlikely to be generally effective because the networks over which viruses spread are not sufficiently dominated by highly connected nodes, and because network topology can be influenced strongly by the way in which a virus is written. Throttling provides a promising alternative strategy that works with any network topology and can greatly reduce viruses' impact by slowing their spread to the point where they can be treated by conventional means. The disparity between the speed of computer attacks (machine and network speed) and the speed of manual response (human speed) has increased in recent years. If this trend continues, automated mechanisms like throttling will likely become an essential tool, complementing the largely manual approach of software patching in use today. The idea of rate limits is not specific to viruses, and could be applied to many situations in which an attack or cascading failure occurs faster than possible human response. References and Notes 1.Citations documenting these events are listed on www.cs.unm.edu/~judd/virus.html, as are citations to each of the viruses and worms mentioned above. 2.S. Staniford, V. Paxson, N. Weaver, in Proceedings of the USENIX Security Symposium (USENIX Association, Berkeley, CA, 2002), pp. 149-167. 3.J. O. Kephart, S. R. White, in Proceedings of the 1991 IEEE Computer Society Symposium on Research in Security and Privacy (IEEE Computer Society, Los Alamitos, CA, 1991), pp. 343-359. 4.R. Pastor-Satorras, A. Vespignani, Phys. Rev. Lett. 86, 3200 (2001) [APS]. 5.A. L. Lloyd, R. M. May, Science 292, 1316 (2001). 6.H. Ebel, L.-I. Mielsch, S. Bornholdt, Phys. Rev. E 66, 035103 (2002) [APS]. 7.M. E. J. Newman, S. Forrest, J. Balthrop, Phys. Rev. E 66, 035101 (2002) [APS]. 8.M. Faloutsos, P. Faloutsos, C. Faloutsos, Comput. Commun. Rev. 29, 251 (1999). 9.R. Albert, H. Jeong, A.-L. Barabasi, Nature 401, 130 (1999) [Abstract]. 10.J. M. Kleinberg, S. R. Kumar, P. Raghavan, S. Rajagopalan, A. Tomkins, in Proceedings of the International Conference on Combinatorics and Computing, vol. 1627 of Lecture Notes in Computer Science (Springer, Berlin, 1999), pp. 1-18. 11.R. Albert, H. Jeong, A.-L. Barabasi, Nature 406, 378 (2000) [Medline]. 12.D. S. Callaway, M. E. J. Newman, S. H. Strogatz, D. J. Watts, Phys. Rev. Lett. 85, 5468 (2000) [APS]. 13.D. Moore, C. Shannon, G. Voelker, S. Savage, in Proceedings of the 22nd Annual Joint Conference of IEEE Computer and Communication Societies (INFOCOM) (IEEE Communications Society, New York, 2003), pp. 1901-1910. 14.A. Somayaji, S. Forrest, in Proceedings of the 9th USENIX Security Symposium (USENIX Association, Berkeley, CA, 2000), pp. 185-197. 15.M. M. Williamson, in Proceedings of ACSAC Security Conference (IEEE Computer Society, Los Alamitos, CA, 2002), pp. 61-68. 16.M. M. Williamson, Complexity 9, 34 (November- December 2003) [Abstract]. 17.M. M. Williamson, in Proceedings of ACSAC Security Conference (IEEE Computer Society, Los Alamitos, CA, 2003), pp. 76-85. 18.J. R. Tyler, D. M. Wilkinson, B. A. Huberman, in Communities and Technologies, M. Huysman, E. Wenger, V. Wulf, Eds. (Kluwer, Dordrecht, Netherlands, 2003), pp. 81-95 [publisher's information]. 19.We thank J. Gassaway for help collecting the e-mail address book data set, C. Hickman for the administrator data set, and J. Tyler and B. Huberman for the e-mail traffic data set. Supported by the James S. McDonnell Foundation, NSF, Defense Advanced Research Projects Agency, Intel Corp., and Santa Fe Institute.

3 2

[David_Heinrich@urmc.rochester.edu: [mises] praxeology and game theory]
by Gabriel Rocha 21 May '04

21 May '04

Possibly of interest to some here... ----- Forwarded message from Pro-Choice <David_Heinrich(a)urmc.rochester.edu> -----

2 1

Database Measured 'Terrorism Quotient'
by R. A. Hettinga 20 May '04

20 May '04

<http://apnews.myway.com/article/20040520/D82M9B400.html> AP: Database Measured 'Terrorism Quotient' Email this Story May 20, 7:25 AM (ET) By BRIAN BERGSTEIN sponsored links Voice Your Opinion - Take today's My Way Poll, featuring a new topic daily. http://poll.myway.com Play Free Online Games - Collapse, Bounce Out, Jigsaw, Crossword, Mah Jong and tons more. http://games.myway.com NEW YORK (AP) - Before helping to launch the criminal information project known as Matrix, a database contractor gave U.S. and Florida authorities the names of 120,000 people who showed a statistical likelihood of being terrorists - sparking some investigations and arrests. The "high terrorism factor" scoring system also became a key selling point for the involvement of the database company, Seisint Inc., in the Matrix project. Public records obtained by The Associated Press from several states show that Justice Department officials cited the scoring technology in appointing Seisint sole contractor on the federally funded, $12 million project. Seisint and the law enforcement officials who oversee Matrix insist that the terrorism scoring system ultimately was kept out of the project, largely because of privacy concerns. However, new details about Seisint's development of the "terrorism quotient," including the revelation that authorities apparently acted on the list of 120,000, are renewing privacy activists' suspicions about Matrix's potential power. "Assuming they have in fact abandoned the terrorist quotient, there's nothing that stops them from bringing it back," said Barry Steinhardt, director of the technology and liberty program at the American Civil Liberties Union, which learned about the list of 120,000 through its own records request in Utah. Matrix - short for Multistate Anti-Terrorism Information Exchange - combines state records and data culled by Seisint to give investigators fast access to information on crime and terrorism suspects. It was launched in 2002. Because the system includes information on people with no criminal record as well as known criminals, Matrix has drawn objections from liberal and conservative privacy groups. Utah and at least eight other states have pulled out, leaving Florida, Connecticut, Ohio, Michigan and Pennsylvania. The AP has received thousands of pages of Matrix documents in records requests this year, including meeting minutes and presentation materials that discuss the project in detail. Not one indicates that Matrix planners decided against using the statistical method of determining an individual's propensity for terrorism. When the AP specifically requested documents indicating the scoring system was scrapped, the general counsel's office for Florida state police said it could not uncover any. Even so, people involved with Matrix pledge that the statistical method was removed from the final product. "I'll put my 26 years of law enforcement experience on the line. It is not in there," said Mark Zadra, chief investigator for the Florida Department of Law Enforcement. He said Matrix, which has 4 billion records, merely speeds access to material that police have always been able to get from disparate sources, and does not automatically or proactively finger suspects. Bill Shrewsbury, a Seisint executive and former federal drug agent, said the terrorism scoring algorithm that produced the list of 120,000 names was "put on the shelf" after it was demonstrated immediately following Sept. 11, 2001. He said the scoring system requires intelligence data that was fed into the software for the initial demonstration but is not commonly available. "Nor are we interested in pursuing that," he said. The Utah documents included a Seisint presentation saying the scoring system was developed by the company and law enforcement officials by reverse engineering an unnamed "Terrorist Handbook" that reveals how terrorists "penetrate and in live our society." The scoring incorporated such factors as age, gender, ethnicity, credit history, "investigational data," information about pilot and driver licenses, and connections to "dirty" addresses known to have been used by other suspects. According to Seisint's presentation, dated January 2003 and marked confidential, the 120,000 names with the highest scores were given to the Immigration and Naturalization Service, FBI, Secret Service and Florida state police. (Later, those agencies would help craft the software that queries Matrix.) Of the people with the 80 highest scores, five were among the Sept. 11 hijackers, Seisint's presentation said. Forty-five were identified as being or possibly being under existing investigations, while 30 others "were unknown to FBI." "Investigations were triggered and arrests were made by INS and other agencies," the presentation added. Two bullet points stated: "Several arrests within one week" and "Scores of other arrests." It does not provide details of when and where the investigations and arrests took place. Phil Ramer, who heads Florida state police's intelligence division, said his agency found the list a useful starting point for some investigations, though he said he could not recall how many. He stressed that the list was not used as the sole evidence to make arrests. "What we did with the list is we went back and found out how they got on the list," Ramer said. Dean Boyd, a spokesman for U.S. Immigration and Customs Enforcement, a descendant of INS in the Department of Homeland Security, said he could not confirm that INS used or was given the list. Although Seisint says it shelved the scoring system - known as high terrorist factor, or HTF - after the original demonstrations in the wake of Sept. 11, 2001, the algorithm was touted well into 2003. A records request by the AP in Florida turned up "briefing points," dated January 2003, for a presentation on Matrix to Vice President Dick Cheney and other top federal officials delivered jointly by Seisint, Florida Gov. Jeb Bush and Florida's top police official. One of the items on Seisint's agenda: "Demonstrate HTF with mapping." Matrix meeting minutes from February 2003 say Cheney was briefed along with Homeland Security Director Tom Ridge and FBI Director Robert Mueller. In May 2003, the Justice Department approved Seisint as sole data contractor on the project, citing the company's "technical qualifications," including software "applying the 'terrorism quotient' in all cases." "The quotient identifies a set of criteria which accurately singled out characteristics related to the perpetrators of the 9-11 attacks and other terrorist events," said a memo from an Office of Justice Programs policy adviser, Bruce Edwards. "This process produced a scoring mechanism (that), when applied to the general criminal population, yields other people that may have similar motives." A spokeswoman for the Office of Justice Programs declined to comment. Ramer, the Florida agent, said the scoring system was scrapped because it was "really specific to 9/11," and not applicable for everyday use. Also, he said, "we didn't want anybody abusing it." Seisint Inc., is a Boca Raton, Fla., company founded by a millionaire, Hank Asher, who stepped down from its board of directors last year after revelations of past ties to drug smugglers. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0