June 2004 - cypherpunks-legacy

Breaking Iranian Codes (Re: CRYPTO-GRAM, June 15, 2003)
by R. A. Hettinga 15 Jun '04

15 Jun '04

At 4:03 AM -0500 6/15/04, Bruce Schneier wrote: > Breaking Iranian Codes > > > >Ahmed Chalabi is accused of informing the Iranians that the U.S. had >broken its intelligence codes. What exactly did the U.S. break? How >could the Iranians verify Chalabi's claim, and what might they do about it? > >This is an attempt to answer some of those questions. > >Every country has secrets. In the U.S., the National Security Agency >has the job of protecting our secrets while trying to learn the secrets >of other countries. (Actually, the CIA has the job of learning other >countries' secrets in general, while the NSA has the job of >eavesdropping on other countries' electronic communications.) > >To protect their secrets, Iranian intelligence -- like the leaders of >all countries -- communicate in code. These aren't pencil-and-paper >codes, but software-based encryption machines. The Iranians probably >didn't build their own, but bought them from a company like the >Swiss-owned Crypto AG. Some encryption machines protect telephone >calls, others protect fax and Telex messages, and still others protect >computer communications. > >As ordinary citizens without serious security clearances, we don't know >which machines' codes the NSA compromised, nor do we know how. It's >possible that the U.S. broke the mathematical encryption algorithms >that the Iranians used, as the British and Poles did with the German >codes during World War II. It's also possible that the NSA installed a >"back door" into the Iranian machines. This is basically a >deliberately placed flaw in the encryption that allows someone who >knows about it to read the messages. > >There are other possibilities: the NSA might have had someone inside >Iranian intelligence who gave them the encryption settings required to >read the messages. John Walker sold the Soviets this kind of >information about U.S. naval codes for years during the 1980s. Or the >Iranians could have had sloppy procedures that allowed the NSA to break >the encryption. > >Of course, the NSA has to intercept the coded messages in order to >decrypt them, but they have a worldwide array of listening posts that >can do just that. Most communications are in the air-radio, microwave, >etc. -- and can be easily intercepted. Communications via buried cable >are much harder to intercept, and require someone inside Iran to tap >into. But the point of using an encryption machine is to allow sending >messages over insecure and imperceptible channels, so it is very >probable that the NSA had a steady stream of Iranian intelligence >messages to read. > >Whatever the methodology, this would be an enormous intelligence coup >for the NSA. It was also a secret in itself. If the Iranians ever >learned that the NSA was reading their messages, they would stop using >the broken encryption machines, and the NSA's source of Iranian secrets >would dry up. The secret that the NSA could read the Iranian secrets >was more important than any specific Iranian secrets that the NSA could >read. > >The result was that the U.S. would often learn secrets they couldn't >act upon, as action would give away their secret. During World War II, >the Allies would go to great lengths to make sure the Germans never >realized that their codes were broken. The Allies would learn about >U-boat positions, but wouldn't bomb the U-boats until they spotted the >U-boat by some other means...otherwise the Nazis might get suspicious. > >There's a story about Winston Churchill and the bombing of Coventry: >supposedly he knew the city would be bombed but could not warn its >citizens. The story is apocryphal, but is a good indication of the >extreme measures countries take to protect the secret that they can >read an enemy's secrets. > >And there are many stories of slip-ups. In 1986, after the bombing of >a Berlin disco, then-President Reagan said that he had irrefutable >evidence that Qadaffi was behind the attack. Libyan intelligence >realized that their diplomatic codes were broken, and changed >them. The result was an enormous setback for U.S. intelligence, all >for just a slip of the tongue. > >Iranian intelligence supposedly tried to test Chalabi's claim by >sending a message about an Iranian weapons cache. If the U.S. acted on >this information, then the Iranians would know that its codes were >broken. The U.S. didn't, which showed they're very smart about >this. Maybe they knew the Iranians suspected, or maybe they were >waiting to manufacture a plausible fictitious reason for knowing about >the weapons cache. > >So now the NSA's secret is out. The Iranians have undoubtedly changed >their encryption machines, and the NSA has lost its source of Iranian >secrets. But little else is known. Who told Chalabi? Only a few >people would know this important U.S. secret, and the snitch is >certainly guilty of treason. Maybe Chalabi never knew, and never told >the Iranians. Maybe the Iranians figured it out some other way, and >they are pretending that Chalabi told them in order to protect some >other intelligence source of theirs. > >During the 1950s, the Americans dug under East Berlin in order to >eavesdrop on a communications cable. They received all sorts of >intelligence until the East Germans discovered the tunnel. However, >the Soviets knew about the operation from the beginning, because they >had a spy in the British intelligence organization. But they couldn't >stop the digging, because that would expose George Blake as their spy. > >If the Iranians knew that the U.S. knew, why didn't they pretend not to >know and feed the U.S. false information? Or maybe they've been doing >that for years, and the U.S. finally figured out that the Iranians >knew. Maybe the U.S. knew that the Iranians knew, and are using the >fact to discredit Chalabi. > >The really weird twist to this story is that the U.S. has already been >accused of doing that to Iran. In 1992, Iran arrested Hans Buehler, a >Crypto AG employee, on suspicion that Crypto AG had installed back >doors in the encryption machines it sold to Iran -- at the request of >the NSA. He proclaimed his innocence through repeated interrogations, >and was finally released nine months later in 1993 when Crypto AG paid >a million dollars for his freedom -- then promptly fired him and billed >him for the release money. At this point Buehler started asking >inconvenient questions about the relationship between Crypto AG and the >NSA. > >So maybe Chalabi's information is from 1992, and the Iranians changed >their encryption machines a decade ago. > >Or maybe the NSA never broke the Iranian intelligence code, and this is >all one huge bluff. > >In this shadowy world of cat-and-mouse, it's hard to be sure of anything. > > >Hans Buehler's story: ><http://www.aci.net/kalliste/speccoll.htm> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

6 7

Low-elevation skymapping at 2.45 Ghz
by Major Variola (ret) 15 Jun '04

15 Jun '04

Telescopes are sold for < $200 which include programmable positioning devices (2 axes obvioiusly). I suppose its just a reduction drive and the usual electro-mech-control stuff but it implies a high degree of angular resolution for cheap. Has anyone: 1. ever used the refractor type telescope tube as-is as a super-long pringles directional 802.11 antenna? In fact the front optics may not interfere... 2. ever used the electronically controlled mount on a steady platform and a highly directional antenna (dishes included) to really see what the world really looks like at 2.mumble Ghz passive with an 802.11 decoder? I mean, radio astronomers do detailed sky surveys all the time. Why restrict yourself to the sky? (Yes, I realize our friends at Ft Meade have probably been using scanning-tunnelling-microscope type piezo-servo actuators to keep a steady gaze for some time..)

1 0

Chip-a-Child: National Scientific Corporation IBUS WiFi
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://www.nsclocators.com/news/06-14-04_PR_IBUSwifi.htm> National Scientific Announces Wi-Fi Enabled Version of IBUS Technology to Track Children on School Buses Scottsdale, AZ/June 14, 2004/Business Wire/ -- -- U.S. technology firm National Scientific Corporation (OTCBB: NSCT) today announced a new Wi-Fi enabled version to its IBUS school bus passenger authentication system. This latest product offering allows school districts to more effectively track and identify school bus passengers. By adding Wi-Fi capability to National Scientific's IBUS product, school districts can simply and easily track students who are riding on their school buses. This new Wi-Fi enabled GPS data logging unit tracks the location of buses and logs students boarding or disembarking from the bus. A series of strategically located Wi-Fi access points are used to securely move that data from the school bus back to the school's online student database. School districts save time and money while increasing student safety when they utilize a student tracking system such as IBUS. "Wi-Fi capability significantly lowers deployment and maintenance costs by reducing the hardware components needed for the system while streamlining access to student security data," said Graham Clark, National Scientific Corporation's president. "We have a number of initiatives aimed at simplifying Medicaid transportation reimbursement of special needs students and when combined with our Wi-Fi IBUS technology, we believe we have a very strong product offering that should generate a significant return on the investment." IBUS is a student tracking system, which includes an ID card reader and a GPS module for time and location information. Additionally this system interfaces with any standard 802.11x Wi-Fi access points. Complete specifications for this product are available on the Company's website at www.national-scientific.com. National Scientific Corporation designs and builds versatile wireless platforms for location-sensitive applications. The Company is a technology leader in combining systems for indoor and outdoor positioning. For more information about NSC, its people, and its technology please visit the Company's web site at www.national-scientific.com. Certain information and comments contained in this press release may be forward-looking statements (within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934). Factors set forth in the company's Annual Report on Form 10-KSB for the fiscal year ended September 30, 2003, its subsequent Form 10-QSB filings together with other factors that appear in this press release or in the Company's other SEC filings could affect the Company's actual results and could cause the Company's actual results to differ materially from those expressed in any forward-looking statements made by, or on behalf of the company, in this press release. The Company undertakes no obligation to publicly release the results of any revisions to the forward-looking statements made in this press release to reflect events or circumstances after the date hereof, or to reflect the occurrence of unanticipated events. ### -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA 'Maybe we should just brand all babies.' -- Ronald Reagan, sarcastically, on the subject of a national ID card.

1 0

Firms Join Up to Combat Web Fraud
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://online.wsj.com/article_print/0,,SB108724856255936731,00.html> The Wall Street Journal June 15, 2004 Firms Join Up to Combat Web Fraud IBM, Other Heavyweights Seek Standards to Block Filching of Personal Data By KEVIN J. DELANEY Staff Reporter of THE WALL STREET JOURNAL June 15, 2004; Page D5 Over a dozen corporate heavyweights are teaming up to fight "phishing," the use of the Internet by crooks to filch personal data such as bank-account numbers and user passwords. The companies, which include International Business Machines Corp., Fidelity Investments and Tenet Healthcare Corp., tomorrow plan to announce the formation of the Trusted Electronic Communications Forum, a trade group that is expected to research and promote technical standards to combat phishing. Research firm Gartner Group estimates that 57 million U.S. Internet users have received e-mail linked to phishing scams and about 1.8 million may have divulged personal information as a result. And the problem is increasing: In research conducted in April, Gartner found that 76% of all known or suspected phishing attacks had taken place in the previous six months. In a typical phishing attack, a consumer receives an e-mail purporting to be from a bank, telecom company, or other institution. The fraudulent e-mails are designed to resemble actual messages from the company, usually by lifting its design and corporate logos. They often direct consumers to a similarly counterfeit Web site and ask them to enter personal information, such as a bank-account number and online-banking password. Crooks use that information to defraud the consumer. Their success at mimicking legitimate e-mails and Web sites has made such scams increasingly effective. Citigroup Inc.'s Citibank unit, eBay Inc. and its PayPal unit were the three organizations targeted most often by phishing scams in April, according to the Anti-Phishing Working Group, another industry association, with 400 members from over 250 organizations. Financial-services institutions represented 15 of the 20 most-targeted organizations in April, according to the group. "The epidemic as a whole has increased so much in size and success rates in the past several months," says Shawn Eldridge, TECF's chairman and director of product and market strategy at PostX Corp. "The problem is very large and no one is immune." Corporations are concerned about phishing because of its potential negative impact on electronic commerce and online services they offer. The TECF aims to promote standard technologies and business practices to combat phishing and assist in prosecuting offenders. Its other founding members include ABN AMRO Bank NV, AT&T Wireless Services Inc., Best Buy Co., Charles Schwab Corp., E*Trade Financial Corp., HSBC Holdings PLC, Royal Bank of Scotland Group PLC, Siebel Systems Inc. and Target Corp. Avivah Litan, a senior analyst at Gartner, Stamford, Conn., says the involvement of many different organizations is important. "They're coming up with solutions that really need to be widespread if they're going to be used and effective," says Ms. Litan, who was briefed ahead of the TECF announcement. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Interview with Glenn Henry, founder of VIA processor subsidiary Centaur
by Eugen Leitl 15 Jun '04

15 Jun '04

http://linuxdevices.com/articles/AT2656883479.html [ker-snip] The third one, is one you haven't asked me about, this is actually my pet hobby, here -- we've added these fully sophisticated and very powerful security instructions into the... Q19: That was my last question! A19: So the classic question is, hey, you built some hardware, who's going to use it? Well, the answer is, six months after we first started shipping our product with encryption in it [story], we have three or four operating systems, including Linux, OpenBSD, and FreeBSD, directly supporting our security features in the kernel. Getting support that quickly can't happen in the Microsoft world. Maybe they'll support it someday, maybe they won't. Quite honestly, if you want to build it, and hope that someone will come, you've got to count on something like the free software world. Free software makes it very easy for people to add functionality. You've got extremely talented, motivated people in the free software world who, if they think it's right to do it, will do it. That was my strategy with security. We didn't have to justify it, because it's my hobby, so we did it. But, it would have been hard to justify these new hardware things without a software plan. My theory was simple: if we do it, and we do it right, it will appeal to the really knowledgeable security guys, most of whom live in the free software world. And those guys, if they like it, and see it's right, then they will support it. And they have the wherewithal to support it, because of the way open software works. So those are my three themes, ignoring the fourth one, that's obvious: that without competition, Windows would cost even more. To summarize, for our business, [Linux is] important because it allows us to build lower-cost PC platforms, it allows people to build new, more sophisticated embedded applications easier, and it allows us, without any software costs, to add new features that we think are important to the world. Our next processor -- I haven't ever told anyone, so I won't say what it is -- but our next processor has even more things in it that I think will be just as quickly adopted by the open source software world, and provide even more value. It's always bothered me that hardware can do so many things relatively easily and fast that aren't done today because there's no software to support it. We just decided to try to break the mold. We were going to do hardware that, literally, had no software support at the start. And now the software is there, in several variations, and people are starting to use it. I actually think that's only going to happen in the open source world. Q20: We'd like a few words from you about your security strategy, how you've been putting security in the chips, and so on. A20: Securing one's information and data is sort of fundamental to the human need -- it's certainly fundamental to business needs. With the current world, in which everyone's attached to the Internet -- with most peoples' machines having back-door holes in them, whether they know it or not -- and with all the wireless stuff going on, people's data, whether they know it or not, is relatively insecure. The people who know that are using secure operating systems, and they're encrypting their data. Encrypting of data's been around for a long time. We believe, though, that this should be a pervasive thing that should appear on all platforms, and should be built into all things. It turns out, though, that security features are all computationally intensive. That's what they do. They take the bits and grind them up using computations, in a way that makes it hard to un-grind them. So, we said, they're a perfect candidate for hardware. They're well-defined, they're not very big, they run much faster in hardware than in software -- 10 to 30 times, in the examples we use. And, they are so fundamental, that we should add the basic primitives to our processor. How did we know what to add? We added government standards. The U.S. government has done extensive work on standardizing the encryption protocols, secure digital signature protocols, secure hash protocols. We used the most modern of government standards, built the basic functions into our chip, and did it in such a way that made it very easy for software to use. Every time you send an email, every time you send a file to someone, that data should be encrypted. It's going out on the Internet, where anyone with half a brain can steal it. Second, if you really care about not letting people have access to certain data that's on your hard drive, it ought to be encrypted, because half the PCs these days have some, I don't know what the right word is, some "spy" built into it, through a virus or worm, that can steal data and pass it back. You'll never get that prevented through operating system upgrades. I do have some background, sort of, in security: it's always been my hobby. The fundamental assumption you should make is, assume that someone else can look at what you're looking at. In other words, don't try to protect your data by assuming that no one's going to come steal your hard drive, or no one can snoop through a backdoor in Windows. You protect your data by saying, "Even if they can see the data, what good is it going to do them?" We think this is going to be a pervasive need. The common if-you-will person's awareness of worms and viruses has gone up a million percent in the last few years, based on all the problems. The awareness of the need to protect data is going to go up substantially, too. We're doing more than encryption, though. There's another need, which is coming, related to message authentication and digital signatures. We're encrypting all the time. Every time you buy something over the Web, your order is encrypted. So there is encryption going on already. But the next major thing -- and this is already done in the high-security circles of banks -- is message authentication through digital signatures. How do you know someone didn't intercept that order, and they're sending in their own orders using your credit card number? How do you know, when you get a message from somebody, that they didn't substitute the word "yes" for "no," things like that? These are very important in the world of security. They're well understood in the government world, or the high-security world, and there are government standards on how you do these things. They are called secure hashes, and things like that. So we've added features for those. To summarize, the things we've added fall into three categories. One is a good hardware random number generator. That was actually the first thing, and that's actually one of the hardest things to do. It sounds trivial, but it's actually very hard to generate randomness, with any kind of process. It needs to be done in hardware. Software cannot generate random numbers that pass the tests that the government and others define. The second thing we did is a significant speedup in the two basic forms of encryption. One's called symmetric key encryption, and the government standard is AES, which is a follow-on to a thing called DES. So we do AES encryption very fast. The other form of encryption that's widely used is public key encryption, and the most common form there is a thing called RSA. That's what's being used, you know, for secure Web transactions. We think we're the only people who've done this: we added instructions in our new processor that's coming to speed up RSA. The third thing we've done is added what's called a secure hash algorithm. Again, it's a government standard. Its used for message authentication and digital signatures. It deals with the issue, if you send me an email, how do I know that the email I got was the one you sent? That it wasn't intercepted and changed? And more fundamentally, how do I know that it actually came from you? Anyone can put their name, in our world, on that email. Things like that. So there's got to be some code in that email that I can look at, and know that only you could have sent it. I can explain this more if you want to know. Q21: That's probably sufficient. We're looking more for the strategy. A21: Okay, let me back up. Our strategy was, assuming that we believe that security is fundamental and ought to be there, to define the primitive operations that need to be done as the building blocks of security. Those we put into hardware. We're not trying to impose a particular, I don't know, protocol or use. We're just making available the tools. We're doing it for free. The tools are in the processors, at no extra price. They don't require any OS support, no kernel support, no device drivers. It's getting into the kernels of BSD and Linux, but applications can directly use the features [even without kernel support], and the hardware takes care of the multitasking aspects. The two guys who worked on it with me are both heavy Linux users. They wrote to friends in the security and Linux communities. Very little marketing money was spent. When the security press release went out, at the Embedded Processor Forum, it had three key quotes, real quotes. Not quotes written by PR managers. My quote was written by a PR manager, but the others weren't. All three were big names in the security world, and all were saying good stuff. Q22: Beyond security, are other cool features planned? A22: The next chip has some tools to do computationally intensive things where hardware provides a big advantage. But I don't want to say yet what they are. Q23: Would they be useful for multimedia? Yes, for multimedia, and for other things. Q24: Like a DSP? A24: Kind of like that. Q25: Okay, we won't push. We appreciate you taking the time to speak with us. We can't imagine getting the president of AMD or Intel to do this. A25: Our whole strategy is so close to the, if you will, the fate of Linux. We identify so much with it. We're low-cost, aimed at the common person, we're aimed at new applications, and we don't have any massive PR or marketing or sales budget, so. Actually, I have a special softness in my heart for Linux. I think without Linux our business would be much less than what it is today. It's just very important to us, so, I wanted to give you guys the time. About the Interviewee Glenn Henry is the founder and president of Centaur Technology. Throughout his career, he has played an integral role in the development of the U.S. computer industry. Prior to founding Centaur in April 1995, Henry served as a consultant to MIPS Technology (SGI) for one year. From 1988 to 1994 he was Chief Technology Officer and Senior Vice President of the Product Group at Dell Computer Corporation. As Senior VP, he was responsible for all product development activities and, at various times, also responsible for product marketing, manufacturing, procurement, information systems, and technical support. Before his tenure at Dell, Henry served 21 years with IBM. He was the instigator, lead architect, and development manager responsible for the IBM System/32, System38 (forerunner of AS/400), and RT/PC (forerunner of Power systems). In 1985, he was appointed an IBM Fellow. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

He Pushed the Hot Button of Touch-Screen Voting
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://www.nytimes.com/2004/06/15/politics/15vote.html?pagewanted=print&pos…> The New York Times June 15, 2004 He Pushed the Hot Button of Touch-Screen Voting By KATHARINE Q. SEELYE Kevin Shelley is a big and voluble Irish politician, the son of a former San Francisco mayor, and not the sort you would figure for the heretofore semi-obscure job of California secretary of state. But Mr. Shelley, who was elected to the post in November 2002 after a career as a state legislator, has adapted the job to suit his style, taking the arcane matter of voting machines and turning it into a hobbyhorse that some predict he could ride to the governor's office. Mr. Shelley, a Democrat, has gained national notice for his skepticism toward touch-screen voting and his insistence that voters be able to look at a paper record inside the voting booth to verify their ballots. He says such paper trails are crucial if government wants voters to have confidence that their ballots are being counted correctly. As a result, he has ordered that after July 1, 2005, no county in California can buy a touch-screen system without a paper record that is verifiable by the voter, and as of July 2006, all touch-screen systems here must be equipped with paper trails, regardless of when they were bought. Until the machines have that capability, he wants people who do not trust them to have the option of voting by a traditional paper ballot. Then, on April 30, he banned the use of certain touch screens in 4 counties and decertified them in 10 other counties until additional security measures could be put in place. "Someone said to me, 'The problem with Kevin Shelley is, he's an activist,' " Mr. Shelley recalled in an interview earlier this month in his office here overlooking the black-and-gold dome of City Hall in San Francisco. "I plead guilty. But, oh my God, never has it been more important to be an activist." His directive has national implications because 40 percent of all touch-screen voting machines in use are in California. If vendors start making equipment to the specifications of the huge California market, that market is likely to dictate what is available to the rest of the country. But Mr. Shelley's advocacy of paper trails has set off a fierce and emotional reaction among local election officials in California and elsewhere and has brought the purchase of such systems to a near standstill. Nearly one third of voters nationwide this November will vote on touch screens. Local officials say that despite demonstrations from computer experts that hackers can break into the machines, there is no evidence that anyone has done so. Moreover, voters may expect an actual, individual receipt after they vote; what happens instead is that a paper record, visible to the voter, is created in the machine. Officials have also expressed concern about paper jams. Mr. Shelley's insistence on paper trails has prompted officials in four California counties to sue him. The clash is being repeated in other states and courtrooms and has even roiled the venerable League of Women Voters, where advocates of paper trails tried to overthrow the league's establishment, which has been against them. They settled yesterday on a compromise resolution to support "secure, accurate, recountable and accessible" systems, all code words for paper trails. Conny B. McCormack, the respected registrar of Los Angeles County, the biggest voting jurisdiction in the country, has emerged as one of Mr. Shelley's chief critics. Ms. McCormack said that Mr. Shelley had confounded local officials by handing down directives that require a technology that does not yet exist. Rather than inspire voter confidence, she said, Mr. Shelley has undermined it. (Manufacturers have said that if the technology were required, they could supply it, but not in time for the November elections.) "He put out a report on April 20 saying that touch screens were 100 percent accurate," Ms. McCormack said. "And then two days later he decertified them." She said such actions had "destabilized the entire election process in California and potentially nationwide." In random testing during the March 2 California primary, Mr. Shelley's office found that the machines "recorded the votes as cast with 100 percent accuracy." In an effort to prod the industry, Mr. Shelley yesterday issued standards for the manufacturers in developing paper trails, the first in the country. They include requirements that voters who are disabled be able to vote and verify their vote without assistance, that voters be able to verify their votes before casting them and that the paper records be printed in both English and the voter's preferred language. "I'm insisting, quite unapologetically, on the need to have these appropriate security measures in place to protect the voters, which is my principal charge," Mr. Shelley said. Mr. Shelley, 48, grew up in politics, the son of Jack Shelley, a former mayor of San Francisco. His father also served in Congress and the California Legislature, where, he was one of two lawmakers to vote against the internment of Japanese-Americans in World War II. "My dad's vote seems like a no-brainer now," Mr. Shelley said. "But at the time, it spoke to who he was and what he believed in, and he passed that on to me." (Jack Shelley died of lung cancer in 1974, when his son was 18.) Mr. Shelley began his career as a legislative director in Washington for Representative Phil Burton, a liberal icon in California. He was elected to the San Francisco Board of Supervisors and then the State Assembly, where he served for the allowable limit of three two-year terms and became majority leader. He said he ran for secretary of state because he wanted to counteract the decline in voting, though he has used the office to highlight other issues, like domestic partner rights and corporate responsibility. Mr. Shelley did not deny an interest in the governor's office someday but said his goal for now was "to make policy and set precedent; it has nothing to do with my future." Eric Jaye, a political consultant here and longtime associate of Mr. Shelley, said he had transformed what was essentially an administrative post "into a bully pulpit." Several recent analyses have bolstered Mr. Shelley's view that touch screens need more security. These include a recommendation by the chairman of the federal Election Assistance Commission that every voting jurisdiction that uses touch screens enhance their security, with either paper trails or other methods, by November. A joint report issued yesterday by the Kennedy School of Government at Harvard and the National Science Foundation endorsed touch screens with paper trails as the most effective voting system. Still, many officials who run elections believe the push for paper trails is more window-dressing than a necessary expense. San Bernardino County, which is among those suing Mr. Shelley, plans to ignore his directive to provide separate paper ballots for those uncomfortable with touch screens. "It would be an expression of a lack of confidence in the machines," for which the county just spent $14 million, said David Wert, a spokesman for the county supervisors. In May, the supervisors noted that Mr. Shelley had certified the county's system before the March 2 primary and that "absolutely nothing has occurred since that certification to call the system's performance or reliability into question." To those who say he is only fanning fears, Mr. Shelley laughs. "If a machine breaks down in San Diego, and it breaks down in Georgia, and they break down in Maryland, and they break down in Alameda and we have high schools where they can hack into the systems, the deficiencies are in the machines," he said. "Look," he added, "I believe these machines have a very, very firm place in our future, but I also believe that in responding to the chaos in Florida in 2000 these machines were rushed out before all the kinks were worked out." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

2 million bank accounts robbed
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://www.msnbc.msn.com/id/5184077/> MSNBC Survey: 2 million bank accounts robbed Criminals taking advantage of online banking, Gartner says EXCLUSIVE By Bob Sullivan Technology correspondent MSNBC Updated: 4:25 a.m. ET June 14, 2004 Nearly 2 million Americans have had their checking accounts raided by criminals in the past 12 months, according to a soon-to-be released survey by market research group Gartner. Consumers reported an average loss per incident of $1,200, pushing total losses higher than $2 billion for the year. advertisement Gartner researcher Avivah Litan blamed online banking for most of the problem. "There has been a big increase in the abuse of existing checking accounts," Litan said. "What's really scary about it is right now there are no back-end fraud detection solutions for it." The survey results, extrapolated from a telephone poll of 5,000 consumers conducted in April, offer a rare glimpse at the state of bank fraud: Financial institutions are tight-lipped about fraud losses. But Litan said the study confirms comments she regularly hears from bank investigators. "The results are consistent with what banks are telling me. ... When I talk to them, they all nod their heads that this is the area where they are seeing the most fraud escalation," she said. 'Constant siege' The trend neatly follows a sharp rise in so-called phishing e-mails, which attempt to steal consumers' user names and passwords by imitating e-mail from legitimate financial institutions. A Gartner study released in May showed at least 1.8 million consumers had been tricked into divulging personal information in phishing attacks, most within the past year. Phishing attempts designed specifically to steal bank information began to skyrocket about 10 months ago, according to Dave Jevans, chair of the Anti-Phishing Working Group. Overall, phishing e-mails have jumped 4,000 percent in the past six months, and just last month, Citibank overtook eBay as the most common target. The company faced an average of 16 attacks per day, and 475 separate phishing attacks during April, an increase of nearly 400 percent from March. Citibank didn't immediately return requests for comment. "It's working, there's no doubt about that...There's people who are under constant siege now," Jevans said. "It's like people setting up fake ATMs everywhere." Some days, banks are targeted dozens of times, which not only leads to identity theft, but also jam-packed customer service telephone lines. "Clearly the issues are far more significant than anyone expected they would be. Phishing and spoofing (setting up look-alike bank Web sites) are really getting to people," said Larry Ponemon, founder of privacy think tank Ponemon Institute, and a bank consultant. "It is an epidemic. It's a very big problem." Creative ways to drain accounts But phish isn't the only way criminals gain access to online bank accounts, according to industry experts. Computer criminals are becoming increasingly proficient at writing Trojan horse programs and keyloggers that steal passwords and account information. Such secret malicious programs, which exerts say are more widespread than many realize, could be the cause of up to half the account takeovers, Litan speculated. Such programs can be installed on home users' computers through virus-laden e-mails. People who do their online banking at public computers, such as at Internet cafes, are also at risk from this kind of password swiping. FREE VIDEO * Run at the bank MSNBC.com's Bob Sullivan reports on online banking theft. NBC News The Gartner survey found that more than 4 million consumers reported suffering checking account takeovers at any time during recent years, with half that number saying it had happened in the most recent 12-month span -- indicating a sharp increase in the activity. While consumers who responded to the survey didn't know how the money was moved out of their checking accounts -- fake ATM cards are another possibility, for example -- Litan said she suspects a sharp rise in hackers taking over online bank accounts is the likely cause. Criminals are using creative ways to transfer money out of hijacked accounts, she said. "A couple of banks tell me (the criminals) set up a bill payment account, then pay themselves," she said. Another method, said U.S. Postal Inspector Barry Mew, takes advantage of the images of canceled checks made available to online bankers. Imposters use them to create authentic-looking counterfeit checks; they have an added air of legitimacy, since the check numbers are appropriately in series. Enough safeguards? Online banking, including online bill paying, has spiked in popularity in recent years, particularly as more financial institutions offer the service for free. According to Gartner, 45 percent of the 141 million U.S. adults who use the Internet pay bills online. Consumers like the convenience and banks like the operating savings. But not everyone is comfortable banking online, and Gartner's study confirms some of that group's worst fears: that accounts can be tapped into by criminals. "They should be afraid," Litan said. "The banks should be requiring more than just passwords to use online banking. They all know they have to do something, but they are all afraid to take the first step." Identity theft expert Rob Douglas described the study results as "blockbuster," and said banks may be forced to re-think the way they are giving consumers access to checking accounts online. "They may say it's because customers are not practicing the appropriate safeguards," he said. "But when it comes to online banking, they are not doing a good enough job of educating customers what to watch out for. Someone is making a lot of money." Litan said the industry was reeling in part because there is no software designed to detect unusual checking account withdrawal patterns, outside of software that looks for money laundering, which doesn't catch simple unauthorized withdrawals. Most credit card users are familiar with industry software called Falcon, which alerts issuers when out-of-the-ordinary purchases are attempted. Such software will often cause a card issuer to call a consumer and ask questions like, "Are you really in London buying a diamond necklace right now?" There's no similar product for online banking, Litan said. Still, there are simpler solutions banks could implement to protect themselves and consumers. One idea is a "shared secret" -- a picture that consumers would give to a bank, which would then appear each time the consumer visited the bank's site, confirming it was the authentic corporate Web site and not a "spoof" site controlled by a hacker. "There's a lot at stake here," Litan said. "And there's a lot that banks can do." Limited window for refunds In most cases, analysts say, consumers are eventually refunded the money they lose. Federal regulations governing electronic transfers, known as Regulation E, requires banks to refund the money as long as consumers notify the institution within 60 days of receiving their bank statement. But outside the 60-day window, banks are under no obligation to issue refunds. Fact File Know your rights Regulation E protects consumers when they are hit by electronic financial fraud * What's covered * Consumer liability * What consumers should do * What banks are required to do * For more information Consumers have well-defined rights with respect to fraudulent electronic transfers, and should generally be able to obtain refunds with little hassle. The rights are spelled out in what's known as "Reg-E," or the Federal Reserve Board's Regulation E. The Fed was authorized to draw up the regulation by the Electronic Funds Transfer Act of 1979. The regulation covers all manner of transfers into and out of bank accounts outside of paper checks, including the use of debit cards. It does not cover credit card transactions. * Print this Many banks don't make consumer rights clear enough, said George Tubin, an analyst at Tower Group. He praised Bank of America, Citibank, and Wells Fargo for offering credit-card style "zero liability" policies on their online banking products. "Until a bank is comfortable enough with their product to say you're covered, how can consumers feel comfortable?" he said. Betty Reese, a spokeswoman for Bank of America, said her firm simply requires consumers to report any fraud on "a timely basis." She decline to disclose fraud statistics. Still, getting a refund can be inconvenient, and there are scattered reports of banks not making the process easy. And ultimately, all consumers pay when banks increase fees to recoup their losses. The new Gartner results "are staggering numbers," said Jim Bruene, editor and founder of the Online Banking Report. "If that's true, we are really facing a monster problem," he said. "It's something that could have been anticipated by the banks. ... There should be and will be more controls in place." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 2

Post-9/11 laws expand to more than terrorism
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://www.timesrecordnews.com/trn/cda/article_print/1,1983,TRN_5707_296259…> Times Record News To print this page, select File then Print from your browser URL: http://www.timesrecordnews.com/trn/nw_washington/article/0,1891,TRN_5707_29… Post-9/11 laws expand to more than terrorism By LANCE GAY June 14, 2004 Federal and state prosecutors are applying stiff antiterrorism laws adopted after the 9/11 attacks to broad, run-of-the-mill probes of political corruption, financial crimes and immigration frauds. If the government gets its way, even routine transactions of buying or selling American homes could soon come under the scrutiny of money-laundering provisions of the USA Patriot Act. The Treasury Department, which already has caught up financial transactions in casinos, storefront check-cashing stores and auto dealers for scrutiny, wants to expand Patriot Act coverage to home purchases as well. Since 9/11, critics say the greatest effect of new state and federal antiterrorism laws has been on crimes already covered by other laws. Washington-area snipers John Muhammad and Lee Boyd Malvo were both convicted under a post-9/11 Virginia antiterrorism statute making it a death-penalty offense to be involved in more than one murder in a three-year period. Muhammad was sentenced to death, and Malvo was given life imprisonment without parole. The FBI has used Patriot Act provisions in a political corruption probe involving a Las Vegas girlie bar, and the Justice Department reported to the House Judiciary Committee last year that it used the new law in probes of credit-card fraud, theft from a bank account and a kidnapping. In the first action of its kind, the Treasury Department also used the Patriot Act this year to put Syria's largest commercial bank and two commercial banks in Myanmar on blacklists - actions that forbid any U.S. financial institution from doing business with them. Legal experts say they're not surprised that antiterrorism laws are being used for more than just terrorism. Peter Swire, a law professor at Ohio State University, recalled that Congress adopted antiracketeering laws in 1970 with the intent to thwart mobsters, but the punitive laws have since been broadened and put to use in civil cases against corporations, and most recently against the organized campaigns of pro-life protesters against abortion clinics. Swire worked in the Clinton administration and chaired a White House working group looking at issues involved with electronic surveillance. He said many Patriot Act provisions, which sped through Congress within days after 9/11, were proposals that either Congress or the White House had previously rejected. Many provisions are slated to expire next year unless Congress makes the changes permanent. Swire said one little-noted impact of that law on the judicial system is that prosecutors can add more charges against defendants, even when terrorism isn't involved. "Prosecutors like to have more arrows in their quiver - it gives them more leverage in plea bargaining," he said. Plea bargaining is the process where prosecutors offer to drop some charges in return for a defendant's guilty plea in order to avoid costly, time-consuming trials. Swire contends the Patriot Act has been so controversial that the Justice Department has been very cautious in using all of its provisions. "They are careful because they know people are checking to see if it is abused," he said. "Once it becomes permanent, I think it will be used more widely." The American Civil Liberties Union and other civil rights groups are campaigning for Congress to terminate some of the more controversial provisions of the Patriot Act, contending the law unnecessarily expands government powers. The ACLU says the government already has sufficient investigative tools, and the Patriot Act has been used for non-terrorist-related crimes such as seizing stolen funds from bank accounts in Belize. Michael Mello, a law professor at Vermont Law School, disagrees and said the Patriot Act made some needed changes in government procedures, including provisions that tore down barriers that prohibited the FBI and CIA from sharing information. "There's been a sea change by tearing down that wall," said Mello. "To forbid the FBI from getting spooks' (CIA) information that someone in the United States was carrying out a significant criminal enterprise is insane." In spite of the criticism from the ACLU and others, Mello said he doesn't believe the Patriot Act has been misused or has resulted in any expansion of government powers. "In the absence of evidence, the critics lose," he said. Mello agrees that there are some provisions in the Patriot Act that should be allowed to expire. He opposes a controversial provision allowing the Justice Department to use so-called "national security letters" to obtain library records, medical records and banking records of people put under surveillance. The Patriot Act wasn't needed when police searched library records in the hunt for Unabomber Ted Kaczynski or the effort to track New York's Zodiac killer, Mello noted. Many government activities under the Patriot Act remain shrouded in secrecy. One of the provisions not expiring is an expansion of police powers to obtain "sneak-and-peek" warrants allowing surveillances - including break-ins - without notifying the people being watched. The government is being more aggressive in asking courts for surveillance warrants. The Justice Department last year made a record 1,727 requests for wiretap approvals from the secretive Foreign Intelligence Surveillance Court, but does not publicly disclose how many investigations that might involve. Attorney General John Ashcroft told the Senate Judiciary Committee last week that the Patriot Act has been used judiciously, and he urged Congress to give speedy consideration to extending it. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Reverse Scamming 419ers
by Eric Cordian 15 Jun '04

15 Jun '04

I visited that 419eaters site, and I must say I have really mixed feelings about what the people are doing there. It's certainly unethical for Nigerians to try and make a living by bilking foreigners with elaborate schemes that promise vast riches in return for an advance fee. But Nigeria is a very poor country, with high unemployment, where people are forced by economic circumstances to do almost anything to try and feed their families. I see no reason to be proud of reverse-scamming a Nigerian out of $80 when it might be his entire family's food money for the month. Only idiots fall for Nigerian Spam. (well, aside from that lady who worked at a bank, and sent some Nigerian $1.3 million of the bank's money) It seems to me the relationship between affluent Americans and poor Nigerians is an example of a dominant class/subordinate class structure, and in such a structure, the subordinate class has rights, and the dominant class has responsibilities. It is beneath the station of those those with the power to define, describe, and profile the world to pick the pocket of some poor black man in Africa, while encouraging him to pose for funny pictures that will be laughed at on some comfortably well off white person's web site. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

7 10

PayPal settles customer suit
by R. A. Hettinga 15 Jun '04

15 Jun '04

<http://news.com.com/2102-1038_3-5233490.html?tag=st.util.print> CNET News http://www.news.com/ PayPal settles customer suit By Paul Festa Staff Writer, CNET News.com http://news.com.com/2100-1038-5233490.html Story last modified June 14, 2004, 4:38 PM PDT PayPal has reached a preliminary settlement with some customers who accused the eBay unit of illegally freezing their funds. The company on Friday said it will pay a total of $9.25 million to settle the federal class-action suit, $3.4 million of which will pay lawyers' fees and costs. PayPal admitted no wrongdoing in settling the claims, which were filed in 2002 as part of two federal class-action suits that also alleged other customer service deficiencies. Those two cases were merged, and a third case, pending in California state court, will be dismissed if the settlement agreement is approved. "In this agreement, PayPal does not acknowledge that any of the allegations in the case are true," PayPal said in an e-mail to customers. The unit "entered into the settlement agreement to avoid further costs of litigation and to devote resources to more productive areas of our business." An attorney for PayPal customers called the settlement a win not only in securing a financial reward, but in changing the way PayPal does business. "I think we got it right," said Daniel Girard, a partner with Girard Gibbs & De Bartolomeo in San Francisco. "The settlement provides for cash recovery and also for a series of changes to the operating procedures at PayPal." Between June and September 2003, while the litigation was still pending, PayPal released $5.1 million in frozen customer funds, Girard said. As part of the settlement, PayPal agreed to change the way it handled dispute resolution. PayPal acknowledged that the settlement included an injunction mandating certain changes to the company's procedures, but maintained that the modifications had come about independent of the litigation. "PayPal has always been looking for ways to improve customer service," said company spokeswoman Amanda Pires. The litigation "didn't really change the way PayPal has been operating. We have improved our customer service as part our normal course of business." PayPal claims 45 million member accounts around the world. The settlement was the product of mediation, begun early last fall, before a court-appointed special master. Within a week, the parties plan to file the preliminary settlement with the U.S. District Court in San Jose, Calif., for approval. The case involves PayPal customers who used the service between Oct. 1, 1999 and Jan. 31, 2004. European Union residents are exluded. PayPal said it will publish the allocation plan in July or August. Customers will be informed of settlement terms within two months of the court's preliminary approval. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0