January 2005 - cypherpunks-legacy

New computerized passport raises safety concerns
by R.A. Hettinga 04 Jan '05

04 Jan '05

<http://www.sanluisobispo.com/mld/sanluisobispo/business/technology/10556269…> Posted on Mon, Jan. 03, 2005 New computerized passport raises safety concerns By Kristi Heim Seattle Times When traveling abroad these days, most Americans probably wouldn't want the contents of their passports to be secretly read by strangers. But when a new high-tech passport system goes into effect as early as next spring, that's exactly what critics say could happen. Before the end of the year, the first U.S. biometric passport will be issued with a tiny computer chip and antenna embedded inside it. The chip will contain a digital image of the person's face, along with other information such as name, birth date and birthplace. The data on the chip can be picked up wirelessly using a radio signal. When the traveler enters the United States, border-control officials will snap a digital photo of the person, scan the data from the passport and run a facial-recognition software program to compare the two images. The system is designed to prevent forged passports by making sure the original passport holder and the person standing at the immigration counter are one and the same. The problem, security and privacy experts say, is that the technical standard chosen for the system leaves passport data unprotected. The technology allows data on the chip to be read remotely using radio frequency identification or RFID. That means the passport does not have to be opened or even come in contact with a scanning device. Its contents can be read remotely -- some estimates claim as far away as 30 feet -- without the passport holder knowing anything about it. Privacy advocates and the American Civil Liberties Union have sharply criticized the proposed system, saying it effectively creates `a global infrastructure of surveillance.` `The U.S.-backed standard means that all the information on American passports can be read by anyone with an RFID reader, whether they are an identity thief, a terrorist trying to spot the Americans in a room or a government agent looking to vacuum up the identities of everyone at a political rally, gun show or mosque,` said Laura Murphy, director of the ACLU's Washington, D.C., legislative office. The ACLU also questioned the use of facial-recognition technology, which can be used to track people but is not foolproof when it comes to matching identity. The U.S. government is already requiring 27 foreign countries to include biometrics in their passports in order for their citizens to continue to travel to the United States without a visa. The mandate was passed in 2002 as part of an effort to tighten border security after the Sept. 11, 2001, attacks. Most of those countries, including the United Kingdom, have had trouble implementing the system and requested the deadline be postponed. Congress voted during the summer to extend the deadline one year to October 2005. Now the State Department plans to expand that program to include U.S. passports, which were not part of the original legislation. But it may only be a matter of time before countries required by the United States to issue biometric passports demand the same kind of passports from American visitors. By the end of 2005, according to the plan, all American passports produced domestically will be biometric passports. The new technology is set to go into diplomatic and official passports first, and move to all new and renewed regular passports around the middle of next year, said Kelly Shannon, spokeswoman in the State Department's Bureau of Consular Affairs. The standard being used for U.S. passports was developed by the International Civil Aviation Organization, a United Nations-affiliated group based in Montreal. As the standard was being decided this year, privacy and security experts argued it should include features to protect the data, such as encryption or the addition of a printed bar code inside the passport to `unlock` the data. Such features would let passport holders know who was reading their data and when. But the State Department so far has rejected proposals for encryption and other security measures. Department officials said encryption would hinder interoperability of the system among the different countries using it and slow down already tedious border crossings. It should function like RFID technology that monitors the flow of cars from a distance through automatic toll roads, for example. Security expert Bruce Schneier, founder and chief technical officer of Counterpane Internet Security, said encryption would not solve security problems for the passport system. Instead, he recommends a system that requires direct contact with the chip. `The owner of the passport has to acquiesce to give the data to somebody,` Schneier said. If the passport has to touch the reader or be opened before it can be read, there is less chance for secret `skimming` of personal data. That is a growing concern as RFID technology becomes more widespread around the world, and readers can be produced inexpensively in devices as small as a mobile phone. `The question comes down to why the government is fixating on this technology,` Schneier said. `I cannot figure out a motive, unless they want to read it surreptitiously themselves.` Adding a computer chip to passports does not provide a means to track U.S. citizens, said State Department spokesman Kurtis Cooper. The information stored on the chip is the same as on the printed passport and will be used only to verify identity at ports of entry, he said. As the system is further tested and developed, Cooper said, the department is looking for ways to `reduce further any risk that would compromise the privacy of the data as citizens use their passport.` Meanwhile, the Department of Homeland Security has started a pilot program to test biometric technology for foreign visitors at a dozen airports around the country. The department awarded a multibillion-dollar contract in June to a consortium called the Smart Border Alliance to design and build the U.S. Visitor and Immigration Status Indicator Technology (US-VISIT) program, which makes use of biometrics. The Smart Border Alliance, led by Accenture, includes Bellevue, Wash.-based Saflink. Saflink provides software that replaces passwords with biometric identification such as fingerprints, voices or facial characteristics. It takes the unique points of a fingerprint or a face and transforms them into a series of ones and zeros -- a biometric `signature,` allowing the signature stored in a chip or database to be compared with the one presented live. `You're never going to have a perfect match between today and tomorrow,` said Saflink marketing director Thomas Doggett. But false identifications can be reduced to a manageable level. `With the paper-based system from the old world, it's too easy for intruders to manipulate documents,` he said. Smart-card identification technology has broader applications as a container to store information such as health records and access privileges, which Saflink is helping supply to the U.S. military. In the future, the government may decide to add new biometrics or different, expanded technologies to U.S. passports. The State Department requires the new passports to carry a 64-kilobyte chip, more capacity than is needed to hold current passport data. Other technology could be added, such as a second digital photo, a digital fingerprint or an iris scan, to improve the accuracy of matches. Travel guidebook author Edward Hasbrouck isn't waiting around for that. He's getting his passport renewed before the new system is in place and urging others to do the same. Passports are valid for 10 years. Without better security, the new passports `couldn't be better suited to facilitate both surveillance and identity theft if they were designed for the purpose,` he said. Hasbrouck believes the new passports will enable `undetectable tracking and the identification of travelers, as well as secret, remote collection of all the data needed to create perfect passport forgeries.` One simple but effective solution may deter unwanted snoops, says Schneier: Cover the passport with aluminum foil. Radio frequencies have a hard time penetrating metal. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] Jasper Green Lasers: useful tool or terrorist weapon? (fwd from dave@farber.net)
by Eugen Leitl 04 Jan '05

04 Jan '05

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0

E-mails can have 'explosive' impact in court cases
by R.A. Hettinga 04 Jan '05

04 Jan '05

<http://www.montereyherald.com/mld/montereyherald/business/10385104.htm?temp…> Posted on Fri, Dec. 10, 2004 E-mails can have 'explosive' impact in court cases By TRICIA BISHOP The Baltimore Sun Brian L. Moffet said he saw the writing on the wall about three years ago. The attorney was arguing a national class-action suit with 50,000 pieces of paper entered into evidence when the judge asked, ''Where are the e-mails?'' That sent Moffet into scramble mode. ''It was the first time I realized it was something that was going to have to be addressed,'' he said. More than 90 percent of all new information is created and stored in electronic form, according to the University of California at Berkeley. And more than two-thirds of that is never printed. Not since the adoption of the Xerox machine 45 years ago has the centuries-old legal profession been so affected by new technology. A handful of law firms, including Moffet's -- Gordon, Feinblatt, Rothman, Hoffberger & Hollander LLC -- have created units specifically to mine for electronic information and help clients manage it. But experts say many lawyers aren't yet comfortable with hunting for electronic data and may be setting themselves up for claims of malpractice because of it. ''Think about it,'' said Ken Withers, an attorney at the Federal Judicial Center, the Washington-based research and education arm of the national court system. ''If 92 percent of the information is in electronic form, then they're only asking for 8 percent of the information. Obviously, they're not getting a full picture of what's going on.'' Recent court decisions have put attorneys and companies on notice by posing hefty fines against businesses and public institutions that don't properly handle -- or hand over -- electronic records. In July, Phillip Morris USA Inc. was sanctioned $2.75 million for failing to keep and produce such data in a case that claimed the company marketed cigarettes to minors. That same month, a New York court instructed a jury to infer that the absence of electronic records could be considered intentional and damaging to the defendants. And a year ago, Baltimore City defendants in a housing discrimination case produced 80,000 e-mails too late, causing U.S. District Court Judge Paul W. Grimm to refuse their admittance into evidence and preclude some witnesses from testifying. Electronic evidence ''is absolutely explosive in terms of the impact,'' Grimm said in a recent telephone interview. ''At first it was somewhat unusual. But in the late '90s and early 2000, we started seeing a drumbeat of cases'' submitting e-mail evidence in particular, which is often more salacious because of its casual nature. ''Discovery'' -- the technical term for the lawyer's process of collecting evidence and information to try a case -- once meant pawing through file cabinets in search of a paper trail. But the explosion of e-mail and other electronic data has turned the procedure on its head, making it more costly and cumbersome, but also critical. E-mail and data can be found on laptops, network servers, disks, hard drives, backup tapes, cell phones, and portable digital assistants -- making them all fair game when mining for dirt that could make or break a case. ''Now, we not only have to sweep files for relevant information. We have to sweep the computers that are relevant, too,'' said Thomas P. Vartanian, a Washington attorney and a member of the American Bar Association's technology committee. Without in-house electronic discovery teams, lawyers and companies typically turned to outside businesses for help. The first such companies began on the West Coast in the late 1980s. But it wasn't until a decade later that the new market began taking off, said George J. Socha, Jr., an attorney, market analyst and consultant in St. Paul, Minn. Today, about 160 companies concentrate on electronic discovery, whose total revenues grew to $430 million in 2003 from $40 million in 1999. Cases involving records mismanagement and accounting fraud -- such as those of Arthur Andersen LLP and Enron Corp. -- have heightened mistrust of corporations by juries, said Lori Ann Wagner, a partner at Faegre & Benson LLC in Minneapolis. Her firm, whose electronic discovery task force in 1999 is considered one of the pioneers among law firms, helps clients put policies in order to avoid the appearance of misconduct. But many companies still don't have well-defined or well-reasoned processes. Recently, a California software company filed a motion in U.S. District Court in Baltimore that claimed Microsoft Corp. purposely created policies to destroy evidence. The plaintiffs, Burst.Com Inc., contend Microsoft stole its intellectual property and destroyed the e-mails that would prove it. They've requested that the judge issue an ''adverse inference'' instruction to the jury, which permits members to infer that the destroyed evidence was harmful to Microsoft. Dealing with data is not easy for companies or their attorneys. The information is enormous in scope and costly to maintain and search. Word documents have multiple versions, e-mails have replaced telephone calls and they are sent to multiple recipients, embedded data are attached to files, and deleted data are not truly gone until it's overwritten, which could take years. All of it is discoverable, meaning millions of pieces of information might come into play. And right now, there are no universal rules governing the electronic discovery process, though various groups have offered guidelines. Some states -- Delaware, Wyoming, New Jersey, Kansas and Arkansas -- have implemented their own rules, but some experts complain of a lack of uniformity. ''The volume of electronic information is much higher than anything we ever imagined in the paper world,'' said Withers of the Federal Judicial Center. ''Computers generate far more than humans are capable of comprehending.'' The Judicial Conference of the United States -- the policy-making body for the country's court system -- has proposed amendments to the federal Rules of Civil Procedure that specifically address electronic discovery. The proposals have been presented for comment, which ends in February, and would not take effect until December 2006 at the earliest. The current proposals would require attorneys to lay ground rules for electronic discovery early on, help decide who pays for what, add options to pull back privileged communication mistakenly handed over, and ease the burden of production on some defendants by only asking for easily accessible documents. Among the possible changes is a new definition of what a ''document'' is: It could include an entire computer and everything on it. Law schools are trying to train the next generation of lawyers to think in such terms. But while most students are already familiar with the Internet and tech toys, ''trying to harness all of that recreational knowledge and turn it into professional expertise is a challenge for all law schools,'' said Theresa K. LaMaster, assistant dean for technology affairs at the University of Maryland School of Law. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Conspiracy Theory O' The Day
by R.A. Hettinga 04 Jan '05

04 Jan '05

--- begin forwarded text

1 0

[i2p] weekly status notes [jan 4] (fwd from jrandom@i2p.net)
by Eugen Leitl 04 Jan '05

04 Jan '05

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

Banks Test ID Device for Online Security
by R.A. Hettinga 04 Jan '05

04 Jan '05

Okay. So AOL and Banks are *selling* RSA keys??? Could someone explain this to me? No. Really. I'm serious... Cheers, RAH -------- <http://www.nytimes.com/2004/12/24/technology/24online.html?oref=login&pagew…> The New York Times December 24, 2004 Banks Test ID Device for Online Security By JENNIFER A. KINGSON or years, banks gave away toasters to people who opened checking accounts; soon they may be distributing a more modern kind of appliance. Responding to an increase in Internet fraud, some banks and brokerage firms plan to begin issuing small devices that would help their customers prove their identities when they log on to online banking, brokerage and bill-payment programs. E*Trade Financial intends to introduce such a product in the first few months of 2005. And U.S. Bancorp says it will test a system, though it has not given a timetable. The devices, which are hand-held and small enough to attach to a keychain, are expected to cost customers roughly $10. They display a six-digit number that changes once a minute; people seeking access to their accounts would type in that number as well as a user name and password. The devices are freestanding; they do not plug into a computer. Some banks, like Wachovia of Charlotte, N.C., and Commerce Bancshares of Kansas City, Mo., already use these hardware tokens to identify employees and corporate customers, and say they are evaluating the technology for retail banking use. Others, like Fidelity Investments and Bank of America, are researching the matter. "Every single major bank is considering it," said James Van Dyke, principal and founder of Javelin Strategy and Research of Pleasanton, Calif., which advises financial services companies on payments and technology issues. Although there are drawbacks in terms of cost and convenience - as well as questions about what would happen if a customer lost the device or it were stolen - there is growing pressure from bank regulators to add safeguards of this type to online financial services. In a report last week, the Federal Deposit Insurance Corporation, which insures bank deposits, said that existing authentication systems were not secure enough and that an extra layer of security should be added to the sign-in process. "The financial services industry's current reliance on passwords for remote access to banking applications offers an insufficient level of security," the F.D.I.C.'s report said. Two-factor authentication, which typically includes a memorized password and a hardware security device, "has the potential to eliminate, or significantly reduce, account hijacking," it said. To be sure, there are many ways to add the kind of security that the agency is seeking, and any number of technology vendors eager to supply products. The F.D.I.C. evaluated some possible alternatives, including smart cards, which are plastic cards with embedded microprocessor chips; biometrics, which identify people by their fingerprints, voice or physical characteristics; and shared secrets, in which a customer is asked a question that, in theory, only he or she could answer. But the system that has so far taken root in the market is the one that relies on number-changing hardware tokens, which have the shape and feel of the plastic security devices that people click to unlock their cars. Several large banks in Europe and Australia - including Credit Suisse, ABN Amro and Rabobank - already issue these tokens to customers, sometimes making them bear the cost of the device. In the United States in September, America Online introduced a program, AOL Passcode, that lets subscribers buy the keychain device for $9.95 and use it for authentication purposes, at a subscriber fee of $1.95 to $4.95 a month, depending on the number of screen names linked to it. Proponents of these devices are aware that they present other problems. Financial companies are concerned about making online banking less convenient and about adding fees for the hardware token. Customers with accounts at several institutions may wind up with an unwieldy number of tokens or swamp call centers with questions about the new systems. Several foreign banks have made the tokens mandatory for online customers. E*Trade, which is expected to be the first United States financial institution to introduce the program for retail customers, will make it optional and charge for the device. Joshua S. Levine, chief technology officer at E*Trade, said the technology seemed to provide the "comfort that most people want." And "when you have your money at stake," he said, "you really want to feel comfortable." E*Trade has been testing its program for the last two months, giving the devices free to 200 interested customers. So far, the tests have attracted customers with high incomes who conduct many transactions and tend to be knowledgeable about technology, Mr. Levine said. "Based on the feedback these customers have been giving us," he added, "we feel it will be very successful." A hardware token is only one way to increase security. At E*Trade, customers who want to conduct wire transfers must wait for a confirmation number to be sent to their cellphones or personal digital assistants, then enter that number to complete the transaction, Mr. Levine said. People who sign up for the E*Trade hardware tokens and lose them will have to call customer service to authenticate themselves, he said. U.S. Bancorp plans to try out a system involving hardware tokens that will be based on technology from VeriSign, the Internet security company. The bank declined to add details. The urgency surrounding the issue is linked to an increase in "phishing," the practice of sending fraudulent e-mail messages en masse to bait people into disclosing sensitive information. Newer scams involve "malware," which can install itself on a computer through e-mail or pop-up ads, detect when someone starts to use an online banking program or make a credit card payment, and then record the person's keystrokes and capture account details. The victims do not even have to do something foolhardy like giving away account numbers or passwords. "We're just seeing new stuff out there all the time," said Dave Jevans, chairman of the Anti-Phishing Working Group, a coalition of companies in financial services and information technology. But he added: "I don't think people need to be any more scared than going to an A.T.M. at nighttime. They need to be cautious; don't do silly things." People who run antivirus software on their home computers, who have installed firewalls to guard against incursions, and who take other security precautions need not worry so much about the proliferation of online threats, security experts say. But they add that these people are probably not in the majority. Some bankers say they are leery about rushing to install new systems that may not solve all the problems. Concerns over phishing have "provoked some of the government agencies to come up with simple solutions to very complex problems," said John Carlson, a former regulator with the Office of the Comptroller of the Currency who is now a senior director at BITS, the technology arm of the Financial Services Roundtable, a trade group. "Consumer acceptance and ease of use are huge issues," he said. At Wachovia, which offers both hardware tokens and digital certificates to corporate customers, Joanne Young, the wholesale business manager for e-commerce, says that the certificates are easier to use, although unlike the tokens, they are not portable from one machine to another. When she telecommutes, "I always have to find my hardware token on my computer at home," Ms. Young said. "My kids are always moving it on my desk." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Conspiracy Theory O' The Day
by R.A. Hettinga 04 Jan '05

04 Jan '05

--- begin forwarded text

1 0

RE: California Bans a Large-Caliber Gun, and the Battle Is On
by Trei, Peter 04 Jan '05

04 Jan '05

John Kelsey wrote > Interesting questions: How hard is it for someone to > actually hit an airplane with a rifle bullet? How often do > airplane maintenance people notice bulletholes? Damn hard. There's a reason winghunters use shotguns, and anti-aircraft guns are full auto. The only way an attacker would have a chance is to stand at the end of the runway, and fire while the plane passes overhead. I have heard of police choppers and ultra lights being fired on from the ground, but never a commercial flight in the US. The scenario the gun-grabbers posit is someone doing this with tracer rounds. Commercial aircraft do not have self-sealing tanks, and if the attacker is incredibly lucky he might be able to start a fire. 50 BMG can be effectively used in anti-material roles, but firing on planes in the air is not one of them. Barrett actually tried to make an shoulder-fired AA model at one point, but abandoned it as impractical. As has been pointed out, 50 BMG rifles have never been used in the commission of a felony. They are being demonized because they Look Scary (check out www.barrettrifles.com) Peter Trei

1 0

Re: California Bans a Large-Caliber Gun, and the Battle Is On
by John Kelsey 04 Jan '05

04 Jan '05

Interesting questions: How hard is it for someone to actually hit an airplane with a rifle bullet? How often do airplane maintenance people notice bulletholes? My understanding is that a single bullethole in a plane is not likely to do anything serious to its operation--the hole isn't big enough to depressurize the cabin of a big plane, and unless it hits some critical bits of the plane, it's not going to cause mechanical problems. I don't think the bigger .50 round would fundamentally change that. So this could be one of those things that just happens from time to time, without getting much press. (Most people have never heard of phantom controllers either, but they're a real phenomenon, and they seem at least as dangerous as some nut with a rifle taking potshots at landing planes.) --John

1 0

Re: How to Build a Global Internet Tsunami Warning System in a Month
by John Kelsey 04 Jan '05

04 Jan '05

>From: "Major Variola (ret)" <mv(a)cdc.gov> >Sent: Jan 3, 2005 4:45 PM >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Re: How to Build a Global Internet Tsunami Warning System in a Month ... >3. Homebrew warning systems will face the same problems as eg pro >volcano warning systems: too many false alarms and no one cares. The best defense would seem to be a population with a lot of TVs and radios. At least after the first tsunami hit, the news would quickly spread, and there were several hours between when the waves arrived at different shores. (And a 9.0 earthquake on the seafloor, or even a 7.0 earthquake on the seafloor, is a rare enough event that it's not crazy to at least issue a "stay off the beach" kind of warning.) My first take on this is that it's an example of the many ways that it's better to be in a rich country than a poor one. Major natural disasters are a lot bloodier in poor countries, for lots of infrastructure reasons (good communications to get out the warning, good roads to evacuate on, resources available for disaster planning long before the disaster hits, building codes or best practices that require some resistance to known disasters, etc.). --John

1 0