January 2005 - cypherpunks-legacy

Steal This Show
by R.A. Hettinga 30 Jan '05

30 Jan '05

<http://www.nytimes.com/2005/01/30/arts/television/30manl.html?th=&pagewante…> The New York Times January 30, 2005 Steal This Show By LORNE MANLY and JOHN MARKOFF SAAC RICHARDS didn't think of himself as a rebel, or a shock to the well-lubricated system of the television industry. He was merely unhappy with the cable box provided by his local operator. Dismayed by the sluggish channel-changing capability and the sparsely informative program guide, he decided to build a better cable box from scratch. Today, nearly three years since Mr. Richards, a 26-year-old computer software programmer in Willoughby, Ohio, embarked on his quest, hundreds of thousands of do-it-yourself television viewers are using the free software program he wrote, MythTV, to turn desktop personal computers into customized cable boxes, complete with the ability to record shows, surf the Web and strip out unwanted commercials. The members of the MythTV community, who now do not have to pay monthly fees to rent set-top boxes or digital video recorders, have plenty of more mischievous company in trying to outwit the television industry. Millions of viewers are now watching illegal copies of television programs - even full seasons copied from popular DVD's - that are flitting about the Internet, thanks to other new programs that allow users to upload and download the large files quickly. And entrepreneurial souls are busily concocting even newer applications, including one that searches the Internet for illegal copies of any television shows you may desire and automatically downloads them to your computer. These high-tech tricks address desires that have become standard in an age of instant media gratification: the desire to watch what you want, when and how you want it. And they're turning television - traditionally beamed into homes at the convenience of the broadcast and cable networks - into something more flexible, highly portable and commercial free. Not surprisingly, the repercussions - particularly the rapidly growing number of shows available for the plucking online - terrify industry executives, who remember only too well what Napster and other file-sharing programs did to the music industry. They fret that if unchecked, rampant trading of files will threaten the riches of the relatively new and surprisingly lucrative television DVD business. It could endanger sales of television shows to international markets and into syndication. And it could further endanger what for the past 50 years has been television's economic linchpin: the 30-second commercial. Hollywood has gotten a lot of headlines in recent months for fighting the online traffic in feature films. But behind the scenes, the studios and networks are just as focused on the proliferation of television shows being downloaded. Even more quietly, the conglomerates that produce the vast majority of television shows are scrambling to beat the downloaders by offering viewers a slew of attractive new gewgaws, from video-on-demand offerings that could let viewers order up an episode of "CSI" any time they like to a device that allows viewers who tune into the middle of a live TV broadcast to restart the program instantly. "We have to try as an industry to get ahead of this and give the audience an attractive model before the illegal file-sharer providers meet their needs," said David F. Poltrack, CBS Television's executive vice president for research and planning. "The clock is ticking on this," he added. It all started with the digital video recorder. First popularized by TiVo and ReplayTV about five years ago, the DVR gave consumers a new degree of control: instead of being at the mercy of the broadcast schedule or VCR's, they could now be their own television programmers, scheduling shows at their convenience, pausing live television and skipping easily past commercials. Smith Barney estimates that though only a little more than 6 million Americans now use DVR's, by 2010 nearly half of American television households, or 58 million homes, will have them. Meanwhile, the file-sharing networks that are the scourge of the music industry began to have their way with television. Two factors slowed the spread: television isn't as expensive as recorded music, and its digitized files are significantly larger and harder to maneuver than their music equivalents. But hacking the cable box or stealing pay-cable channels like HBO is a longstanding tradition. "There is a sense of entitlement that once it hits the airwaves it's free," said Brandon Burgess, NBC Universal's executive vice president for digital media, international channels and business development. Until recently, it was hard for average viewers to act on that sense. But these days all it takes is a broadband connection and a program like BitTorrent. Created by Bram Cohen, a 29-year-old programmer in Bellevue, Wash., BitTorrent breaks files hundreds or thousands of times bigger than a song file into small pieces to speed its path to the Internet and then to your computer. On the kind of peer-to-peer site that gave the music industry night sweats, an episode of "Desperate Housewives" that some fan copied and posted on the Internet can take hours to download; on BitTorrent, it arrives in minutes. BitTorrent may sound like some obscure techno-trickery, but more than 20 million people have already downloaded the application. Each week dozens of shows are shared by hundreds of thousands of people. "The Simpsons," "Family Guy" and "Friends" top the most-popular list, but even "SpongeBob SquarePants," "Trading Spaces" and "Extreme Makeover: Home Edition" landed in the Top 20 for the week ending Jan. 16, according to Big Champagne, which measures file-sharing activity. And the technology is getting easier to use by the day. Sajeeth Cherian, a 20-year-old communications engineering senior at Carleton University in Ottawa, decided there must be a better way to find BitTorrent files on the Web after listening to the constant gripes of his roommate about how much time he was spending searching for Japanese anime. Videora was his response. Plug in what shows you want to find, and it does all the work. He's charging $22.95 for the software. "I thought this was a big idea, a bigger idea than trying to shut my roommate up," Mr. Cherian said. Although it can be used for piracy, Videora is legal, he said: "I've considered this. I wouldn't want to get my pants sued off, and this has many legitimate uses." However, Videora's illegitimate uses threaten one of the most welcome bonanzas for the television industry in recent years. Television DVD's, an afterthought in the DVD market just three years ago, were an estimated $2.3 billion-dollar business last year, according to a recent Merrill Lynch research report. They now represent nearly 15 percent of total DVD revenue, with profit margins between 40 and 50 percent. Recent hit shows like "The Simpsons" can make a profit of $15 million - a season. And those are exactly the shows traded most online, according to Big Champagne. Although older shows are not quite as lucrative, the better ones can still bring in $1 million in profit for each season, the Merrill Lynch report found. So it's no surprise that the studios and networks are emptying their vaults; "The Bob Newhart Show," "Dynasty," "The A-Team," "Moonlighting" and "Remington Steele" are just a few of the DVD's planned for release this spring. Executives at the entertainment conglomerates and the Motion Picture Association of America argue that the industry and the government have to move - fast - to establish rules by which copyrighted television programming "cannot be moved around willy-nilly," as Rick Cotton, executive vice president and general counsel of NBC Universal, puts it. Otherwise, television executives say, the very creation of television programming is placed in jeopardy. "It's very expensive to produce and market, and people will be very reluctant to provide that content if it can't be adequately secured," said John Malcolm, the senior vice president and director of worldwide antipiracy operations for the M.P.A.A. One way to protect such content, according to the industry, is through the introduction of something called the broadcast flag. The Federal Communications Commission announced in the fall of 2003 that any digitally broadcast show must include an invisible antipiracy device. This has not gone over well with viewers. Last October, nine nonprofit groups petitioned the United States Court of Appeals for the District of Columbia Circuit, arguing that the action oversteps the F.C.C.'s authority, making life more complicated for law-abiding home viewers while being "entirely ineffective at stopping any pirate." At the grass roots, the response has been more direct: a rush to buy and even build television sets and DVD recorders that sidestep the ruling. Home consumer devices, from digital televisions to DVD recorders, sold before July 1 do not have to recognize the broadcast flag. So the Electronic Frontier Foundation, a digital civil liberties organization (and one of the nine petitioners), has decided to set up what it is calling the Television Digital Liberation Front. Starting last July 29, it began holding the first of a planned series of nationwide "buildathons" to help novices build home-brew digital televisions and DVR's based on systems like the perfectly legal MythTV software. Those systems are still pretty clunky to assemble, requiring technical skills beyond the grasp of most couch potatoes, not to mention bulky, fan-noise-spewing P.C.'s. But television tinkerers are trying to smooth these experiences - for profit or not. Cecil Watson, a 32-year-old software expert in Fontana, Calif., created KnoppMyth to make the installation of MythTV as simple as possible. The MythTV movement is "picking up steam," Mr. Watson said, because it satisfies the way he wants to watch television today - and he doesn't have to pay rental fees for a cable box or a DVR if he chooses not to. "It records the shows I want to watch and I now have the choice to spend the time the way I want," he said. The build-your-own-TV advocates say they're not looking to steal content; they're just looking for a reasonable amount of flexibility to watch the same recorded program in different rooms, or on the train to work; to lend friends a TV recording the way they used to lend videotapes; to bring the same set of recordings from their city home to their vacation house. Playing the same show on different screens around the house seems reasonable, said Mr. Cotton of NBC Universal. But he added that expanding the circle much beyond that, the way future versions of the recently released TiVoToGo offering might allow one to send recorded programs over the Internet to nine other devices, including P.C.'s and laptops, was dangerously excessive. "Once you allow that much, is the technology really secure?" Mr. Cotton asked. A spokeswoman for TiVo said that the current analog version does not allow transferring files outside a home network, but that the F.C.C. has nonetheless approved the company's security measures if it rolls out a robust digital version. Ultimately, whether the television industry can avoid the disruptive fury that sideswiped the music industry - and even find lucrative ways to benefit from a digital, broadband, interconnected and portable entertainment world - will depend on how fast and flexible the conglomerates are in meeting viewers' changing desires. It will also depend on understanding the motivation behind this flurry of new activity. It's not just the thrill of the illicit, like lighting up behind a Kroger's in high school. That is "woefully inadequate to describe why millions of people steal," said Mr. Garland of Big Champagne, the online media measurement company. "People aren't essentially lawless. It takes far more motivation than that." The industry has begun experimenting, rethinking the rules by which television is disseminated. Some of the proposals, which center on video on demand, are fairly radical, going beyond the movies, news programs and N.F.L. highlights that make up today's most ambitious offerings. Mr. Poltrack of CBS said that according to his network's research, a large number of viewers would welcome the chance to pay $1 to watch each television show, if they could do it on their own schedule and with the ability to skip commercials. With commercials, they'd be willing to pay 50 cents. And because the average viewer sees only half of a show's episodes, he said, this on-demand viewing won't hurt the regular showing. A further CBS study gave viewers the chance to build their own night of television, where they could choose among a select group of pay-per-view shows in addition to the regular schedule of free programming that night. More than half of the 211 respondents chose to pay extra for at least one show. "This is the way people want television delivered," Mr. Poltrack said. Before this video-on-demand vision materializes, a bewildering thicket of contract and revenue-sharing issues among the producers, programmers and distributors of television must be overcome. Nonetheless, executives understand that they have little alternative but to push ahead. Chasing after the people trafficking in television programming can do only so much good. "You'll make more money and suffer far less from the black market if you simply create the opportunity to access content freely," said Mr. Garland of Big Champagne. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

SR-IX: Using the Wrong Tool in the Wrong Place
by R.A. Hettinga 30 Jan '05

30 Jan '05

<http://globalpolitician.com/articles.asp?ID=329&print=true> Global Politician SR-IX: Using the Wrong Tool in the Wrong Place By Peter Gallo In the aftermath of the 9/11 terrorist attacks, the Financial Action Task Force ("FATF") expanded its brief from the fight against money laundering to include also terrorist financing, and, to this end, issued 8 'Special Recommendations' at the end of October 2001. Despite all the rhetoric and the considerable efforts since that time, however, none of this appears to have had much tangible success in achieving the stated objective of 'starving terrorists of funds.' Undeterred, on 22 October last year, the FATF issued a further Special Recommendation ("SR-IX") relating to Cash Couriers. This states: "Countries should have measures in place to detect the physical cross-border transportation of currency and bearer negotiable instruments, including a declaration system or other disclosure obligation." One cannot, of course, deny it is possible that terrorists routinely carry cash across international borders, but whether this is an area that should - or can - be addressed by additional legislation is debatable. Moreover, what not been made clear, however, is how such legislation is expected to have any material effect in the fight against terrorism, or even whether it is warranted. The manner in which SR-IX grew out of a pre-existing recommendation is itself a curious insight into the FATF's internal political machinations. What were originally #22 (relating to the reporting of cross-border cash movements) and #23 (reporting of cash transactions above a given threshold amount) in the 1996 edition of the FATF 40 Recommendations, were combined as Recommendation # 19, paragraphs 'a' and 'b' in the 2003 Revision. These, of course, related to conventional criminal money laundering. What has subsequently happened, is 19a has been removed from the 40 and published as SR-IX so it is now portrayed as an anti-terrorist measure, giving it enhanced importance. Moreover, the language that used to read "Countries should consider implementing feasible measures to detect and monitor the physical cross-border transportation of currency etc " now reads "Countries should have measures in place to detect the physical cross-border transportation of currency." First and foremost in considering such a measure, must be the practical issues of the feasibility and utility of implementing such a programme, given the benefits it would offer. The implication in this new Special Recommendation is that terrorist groups use couriers to hand carry large quantities of cash from one country to another to be used for terrorist purposes. This is, of course, not only very possible, it is quite likely that if a terrorist group were operating and traveling across an international border, they would prefer to carry cash with them rather than remit it by other means. What we do not know, however, is if this represents a significant vulnerability to the way in which terrorist operations are financed. On the contrary, the 9/11 attacks in the US, the events that have attracted most US attention on the whole subject of terrorist financing, were funded largely by remittances through the banking system. The best evidence as to the funding of the Bali bombings in 2002 appear to indicate the small amount of money needed to finance the attack was raised locally, and even it if was not, it is unlikely it was brought into Indonesia through an official border crossing point. Focusing attention on the international transportation of cash seems to ignore all the evidence that points to one fundamental conclusion; that most terrorist groups (at least in Asia) are primarily funded by local criminal activity, including extortion and kidnapping. It is entirely possible money is being smuggled into Iraq and used to fund attacks against the US forces there, but to believe that this could be prevented by introducing cash declarations on the border with either Turkey, Syria or Iran is stretching credibility. Terrorism in the Middle East may, admittedly, be funded differently from Asia, but even so; if groups in Palestine and elsewhere are being funded by donations from overseas; will a cash declaration requirement actually stop the money flow? In Asia, the borders of most concern, being the Sulu Sea between Indonesia and the Philippines, or the mountains between Afghanistan and Pakistan, already represent some of the most challenging Border Management problems in the world today. For hundreds of years, the competent authorities have been unable to prevent the flow of people across these borders. These people have a long history of carrying with them anything they chose, firearms included, along with all manner of contraband and other goods on which duty was never paid. One is at something of a loss, therefore, to understand what practical effect a cash declaration form will have. The requirement to declare cash over a given threshold amount when crossing an international border is not new. It has been a feature of the anti-money laundering legislation in the US for a number of years, but it is not possible to state with any confidence that it has put an end to cash smuggling related to crime, nor that it made it significantly harder for for criminal groups to move money across borders and or made it harder for Transnational Organised Crime groups to operate. The amounts of money required to finance terrorism are much smaller than encountered in conventional money laundering by Transnational Organised Crime groups. Why then, is it expected that making this a Special Recommendation to deal with Terrorist Financing will be any more successful in putting an end to cash smuggling used to fund terrorism? One of the most significant and salutary lessons from the US experience of Cash reporting was that the introduction of the threshold immediately gave rise to "smurfing" - the use of couriers and structured sub-threshold transactions to deposit quantities of cash into the banking system. There is an argument that the smurfing that evolved to circumvent the CTR requirement has exposed money laundering operations to a greater risk of exposure, and that the great number of individuals involved, and the multiplicity of cut-outs, front companies and nominees, at least in theory, increases the detection risk. This, however, may have resulted in the arrest and prosecution of a lot of these couriers, but it has not been spectacularly successful in bringing down the heads of the trafficking syndicates. Moreover, it is easier to identify structuring where cash is being deposited into the banking system, but it is much harder to identify in cross-border cash movements. Obviously, even if Mr X declares he is carrying $9,900 in cash, Mrs X declares she is carrying another $9,900, and a junior Ms or Mr X of the same address declare that they too are each carrying $9,900; we might conclude that the family have shared out the funds specifically to avoid triggering the mandatory report. Would that it were always so easy to make the connection! If they have different surnames and addresses, for example, identifying a structuring or smurfing scheme becomes a tad more difficult. Just because two or more passengers on the same flight may each be carrying a quantity of cash that is $5 short of the reporting threshold does not mean they are necessarily acting in a common purpose. Notwithstanding the pre-existing and mandatory US requirement that cash over the US$10,000 threshold be declared on exiting the country, one of the observations of the increased focus on anti-money laundering after the 9/11 attacks has been an increase in reports of bulk cash smuggling. It is the nature of smuggling that the people do not declare it! We should not forget that over 200 people died in Bali, in a bombing believed to have cost as little as US$10,000. Even if that money had to be hand carried in from abroad, there is no reason to suggest it would all have had to be brought in at the same time; and even in the extremely unlikely event that it did, the only difference a cash declaration threshold at the border would make would be that it required two or three people to carry it, not just one. Futhermore, that always assumes that the money was hand carried in to Indonesia, and hand carried in through an international airport past Immigration and Customs checks. The reality of the situation is that that probably never happened The further irony is that in most cases, the international borders where terrorists would prefer to hand carry cash are those same borders where local traders and businessmen do likewise. It may be simplistic to describe these as less developed or unsophisticated economies, but without even considering any corruption problems or the effectiveness of their border management, the usefulness of any cross-border cash declaration system does not appear to be assured. In more technically advanced economies, on the other hand, like Singapore or Hong Kong, it may be possible to impose and even enforce such a system, but even then, it is extremely unlikely that it would prevent terrorists operating there. Provided that any international terrorists have some degree of local support, and it is almost inconceivable that a terrorist attack could or would ever be carried out without; there are many alternative ways and means of sending money in and out of places like Singapore or Hong Kong. Admittedly, means such as money remittances, letters of credit, bank transfers or the use of a credit card all involve some interface with the financial system, but that eliminates the risk that the terrorist courier will be caught just for carrying cash. The original "Special 8" included regulation of Alternative Remittance Systems, such as door-to-door money underground banking systems such as Hawala and the Black Market Peso Exchange. Although almost impossible to eradicate, at least some degree of control over the system offers some law enforcement benefit as it creates a paper trail where none might previously have existed. To further extend the regulatory environment, however, and create a new offence of failing to declare smuggling activities, although possibly useful in prosecuting the small number of individuals caught carrying cash; is very unlikely to make it "more difficult" for terrorist organizations to move money around the world. Even if border management authorities could prevent any cash being carried or smuggled across their borders, it would not prevent money flowing in and out of the country. The point was made above, the introduction of Cash Transaction Reporting simply created a role for 'smurfs' and although, in theory, that exposed the criminal organization to an increased detection risk, most of the prosecutions were of low-level couriers not major money launderers or drug traffickers. Those syndicates always distanced the leadership from the 'smurfs' who were exposed to the risk of detection in making cash deposits. Smurfs are obviously seen as disposable, and in extreme islamist terrorism, where suicide bombing has become commonplace; the terrorist attackers themselves are disposable. They can, in that case, use credit cards and write cheques with little regard for the consequences, the practical chances of tracing funds back to a terrorist source are slim, and the chances of a cash courier being able to identify the source of the funds are even slimmer. There are two scenarios in considering the courier, he could be a member of the terrorist organization who knows he is carrying cash for a terrorist purpose; in which case he is probably very unlikely to make any voluntary declaration or disclosure that will be of any value, or he could be courier with no knowledge of the organization for whom he is carrying the money; in which case the best that one could hope for would be that he could identify the individual who gave them the job. Bankok jails are full of people who were unable to do that when arrested in possession of a suitcase full of heroin. The Recommendation addresses penalties for persons making false declarations; but the practical reality is identifying them in the first place. If the authorities are in receipt of credible intelligence to indicate that a passenger on a certain inbound flight is a courier for a terrorist organization, it should be possible to detain him under existing anti-terrorism legislation anyway. Under the existing law in most countries whose legislation already complies with the FATF 40 Recommendations, any individual carrying cash for the purpose of furthering a terrorist activity will already committing an offence, without the need for further legislation. Money intended to, say, buy materials that will be used to build a bomb - clear use of money intended to be used in connection with an indictable offence - so this would generally be covered by existing anti-money laundering legislation . If, on the other hand, the money was to be used generally to support a terrorist organization, legislation introduced to implement United Nations Security Council Resolution 1373 should already make that a criminal offence. Whether the courier is a terrorist himself or just a cash courier is irrelevant, any hopes that the Government may have that he would declare the cash it is probably fanciful. None of this, of course, addresses the threshold level, stipulated in SR-IX to be a maximum of US$15,000. One of the bigger problems associated with the use of anti-money laundering legislation against terrorist financing is the amounts of money involved. Terrorism, unfortunately, is cheap. The financial cost of an enormous terrorist atrocity such as the US$10,000 Bali bombing is so small, that it is difficult to see what possible benefit a US$15,000 declaration limit would have. Even if the threshold is set much lower, sat US$5,000; the only inconvenience that would present a terrorist organization intent on importing cash would be the need to 'smurf' it over the border in smaller amounts. It is difficult to understand how the FATF could say this additional Special Recommendation is expected to "make it tougher to move terrorist money across borders and make it harder for terrorists to operate." Will a system of cross-border cash declarations be any beneficial value at all? Curiously enough, despite all of this negative criticism, it might. It may be a total irrelevance as an anti-terrorist measure, but there are other reasons why cash is carried across borders; these include money smuggling, particularly in connection with the adjustment of balances in underground banking operations out of Taiwan, and straight-forward capital flight out of China. Of course, the downside is that these may have a negative effect on tourism or the retail sector in Hong Kong, but that was not the question. The greater danger, however, is that we focus attention in the wrong place. In order to starve terrorists of funds, (if such a thing is even possible) we need to concentrate on the source, not the application of funds. In order for the banking system to play a meaningful role; they need to share much more information with Law Enforcement than they already do, and mechanisms to lift the veil of secrecy that surrounds financial information. Even then, such actions will almost certainly result in more prosecutions for conventional money laundering, particularly relating to tax evasion, than it ever will to terrorist financing. The problem is that a lot of that tax evasion takes place with the professional support and collusion of the financial industry; so that would involve requiring the private sector to surrender themselves in order to capture a tiny minority whose involvement with the financial system may be marginal at best. None of this addresses the underlying problem; that terrorist groups are not profit motivated, they do not depend on large, and people do not join them, or support them, for financial reasons. They join them or support them for other reasons, and preventing money being carried across international borders is not going to have any impact on that whatsoever. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Graduate Cryptographers Unlock Code of 'Thiefproof' Car Key
by R.A. Hettinga 30 Jan '05

30 Jan '05

<http://www.nytimes.com/2005/01/29/national/29key.html?oref=login&pagewanted…> The New York Times January 29, 2005 Graduate Cryptographers Unlock Code of 'Thiefproof' Car Key By JOHN SCHWARTZ ALTIMORE - Matthew Green starts his 2005 Ford Escape with a duplicate key he had made at Lowe's. Nothing unusual about that, except that the automobile industry has spent millions of dollars to keep him from being able to do it. Mr. Green, a graduate student at Johns Hopkins University, is part of a team that plans to announce on Jan. 29 that it has cracked the security behind "immobilizer" systems from Texas Instruments Inc. The systems reduce car theft, because vehicles will not start unless the system recognizes a tiny chip in the authorized key. They are used in millions of Fords, Toyotas and Nissans. All that would be required to steal a car, the researchers said, is a moment next to the car owner to extract data from the key, less than an hour of computing, and a few minutes to break in, feed the key code to the car and hot-wire it. An executive with the Texas Instruments division that makes the systems did not dispute that the Hopkins team had cracked its code, but said there was much more to stealing a car than that. The devices, said the executive, Tony Sabetti, "have been fraud-free and are likely to remain fraud-free." The implications of the Hopkins finding go beyond stealing cars. Variations on the technology used in the chips, known as RFID for radio frequency identification, are widely used. Similar systems deduct highway tolls from drivers' accounts and restrict access to workplaces. Wal-Mart is using the technology to track inventory, the Food and Drug Administration is considering it to foil drug counterfeiting, and the medical school at the University of California, Los Angeles, plans to implant chips in cadavers to curtail unauthorized sale of body parts. The Johns Hopkins researchers say that if other radio frequency ID systems are vulnerable, the new field could offer far less security than its proponents promise. The computer scientists are not doing R.&D. for the Mafia. Aviel D. Rubin, a professor of computer science who led the team, said his three graduate students did what security experts often do: showed the lack of robust security in important devices that people use every day. "What we find time and time again is the security is overlooked and not done right," said Dr. Rubin, who has exposed flaws in electronic voting systems and wireless computer networks. David Wagner, an assistant professor of computer science at the University of California, Berkeley, who reviewed a draft of a paper by the Hopkins team, called it "great research," adding, "I see it as an early warning" for all radio frequency ID systems. The "immobilizer" technology used in the keys has been an enormous success. Texas Instruments alone has its chips in an estimated 150 million keys. Replacing the key on newer cars can cost hundreds of dollars, but the technology is credited with greatly reducing auto theft. - Early versions of in-key chips were relatively easy to clone, but the Texas Instruments chips are considered to be among the best. Still, the amount of computing the chip can do is restricted by the fact that it has no power of its own; it builds a slight charge from an electromagnetic field from the car's transmitter. Cracking the system took the graduate students three months, Dr. Rubin said. "There was a lot of trial and error work with, every once in a while, a little 'Aha!' " The Hopkins researchers got unexpected help from Texas Instruments itself. They were able to buy a tag reader directly from the company, which sells kits for $280 on its Web site. They also found a general diagram on the Internet, from a technical presentation by the company's German division. The researchers wrote in the paper describing their work that the diagram provided "a useful foothold" into the system. (The Hopkins paper, which is online at www.rfidanalysis.org, does not provide information that might allow its work to be duplicated. The researchers discovered a critically important fact: the encryption algorithm used by the chip to scramble the challenge uses a relatively short code, known as a key. The longer the code key, which is measured in bits, the harder it is to crack any encryption system. "If you were to tell a cryptographer that this system uses 40-bit keys, you'd immediately conclude that the system is weak and that you'd be able to break it," said Ari Juels, a scientist with the research arm of RSA Security, which financed the team and collaborated with it. The team wrote software that mimics the system, which works through a pattern of challenge and response. The researchers took each chip they were trying to clone and fed it challenges, and then tried to duplicate the response by testing all 1,099,511,627,776 possible encryption keys. Once they had the right key, they could answer future challenges correctly. Mr. Sabetti of Texas Instruments argues that grabbing the code from a key would be very difficult, because the chips have a very short broadcast range. The greatest distance that his company's engineers have managed in the laboratory is 12 inches, and then only with large antennas that require a power source. Dr. Rubin acknowledged that his team had been able to read the keys just a few inches from a reader, but said many situations could put an attacker and a target in close proximity, including crowded elevators. The researchers used several thousand dollars of off-the-shelf computer equipment to crack the code, and had to fill a back seat of Mr. Green's S.U.V. with computers and other equipment to successfully imitate a key. But the cost of equipment could be brought down to several hundred dollars, Dr. Rubin said, and Adam Stubblefield, one of the Hopkins graduate students, said, "We think the entire attack could be done with a device the size of an iPod." The Texas Instruments chips are also used in millions of the Speedpass tags that drivers use to buy gasoline at ExxonMobil stations without pulling out a credit card, and the researchers have shown that they can buy gas with a cracked code. A spokeswoman for ExxonMobil, Prem Nair, said the company used additional antifraud measures, including restrictions that only allow two gas purchases per day. "We strongly believe that the Speedpass devices and the checks that we have in place are much more secure than those using credit cards with magnetic stripes," she said. The team discussed its research with Texas Instruments before making the paper public. Matthew Buckley, a spokesman for RSA Security, said his company, which offers security consulting services and is developing radio frequency ID tags that resist unauthorized eavesdropping, had offered to work with Texas Instruments free of charge to address the security issues. Dr. Wagner said that what graduate students could do, organized crime could also do. "The white hats don't have a monopoly on cryptographic expertise," he said. Dr. Rubin said that if criminals did eventually duplicate his students' work, people could block eavesdroppers by keeping the key or Speedpass token in a tinfoil sheath when not in use. But Mr. Sabetti, the Texas Instruments executive, said such precautions were unnecessary. "It's a solution to a problem that doesn't exist," he said. Dan Bedore, a spokesman for Ford, said the company had confidence in the technology. "No security device is foolproof," he said, but "it's a very, very effective deterrent" to drive-away theft. "Flatbed trucks are a bigger threat," he said, "and a lot lower tech." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Woman Accused In Unusual Computer Crime
by R.A. Hettinga 29 Jan '05

29 Jan '05

<http://www.wcax.com/global/story.asp?s=2868253&ClientType=Printable> WCAX Woman Accused In Unusual Computer Crime Burlington, Vermont -- January 27, 2005 A Burlington woman has became the first in Vermont to be charged with a bizarre computer crime. The alleged high-tech caper involved identity theft, harassment, and an attempt to make a co-worker look like a lunatic,according to police. "Yeah, I think, you know, people thought I was off my rocker for a while," said Jeanne Landau, the alleged victim. She says she was shocked and scared last fall when friends accused her of sending threatening e-mails to a co-worker. "It was disappointment and fear certainly for a little while until I figured out who had actually been doing it," added Landau. Police say the culprit is Bess Carney, 25, of Burlington. At a Thursday court hearing in Burlington, Carney was charged with false reporting of a crime, identity theft, and unauthorized access to a computer. Carney used computers at work in an attempt to harm Landau by e-mailing threats to herself, according to police reports. First she opened a Yahoo e-mail account in Landau's name and then she mailed herself threats from that phony Landau account, say police. "She was then forwarding these e-mails to mutual friends of the two parties and really making it look as though Jeanne Landau was responsible for this and that she was insane and very mentally unstable," said Sgt. Ken Tisdel, the Burlington Police detective in charge of the investigation. "I don't know the motivation behind it unfortunately," said Landau. "I think it might've started as a prank and then it spun out of control and I don't think she expected it to go this far," she added. Carney pled innocent to the charges. She was released on conditions. She declined comment as she left the courthouse and let her lawyer, Edward Kenney, do the talking to the press. "It's accurate that Bess has insisted on her innocence," said Kenney. "She pled not guilty today and I really can't get into the facts of the case at all at this point." Kenney said he may challenge the legal basis for the charges and attempt to have them dismissed. Police say this is the first computer case of its kind to be criminally charged, but more complaints are coming in. And to those who might think of doing the same thing, police warn that the culprits will be caught. " Anything that you do on that computer no matter if you've deleted it or whatever you've done, we will recover that information and we will find out if you've done this," said Detective Sgt. Tisdel -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Customs service seizes depleted uranium in Russia region
by Justin 29 Jan '05

29 Jan '05

[print_logo_russian.gif] _________________________________________________________________ Customs service seizes depleted uranium in Russia region 28.01.2005, 13.28 MOSCOW, January 28 (Itar-Tass) - The customs service in a Volga region has seized more than 37 kilograms of depleted uranium. A spokesman at the Federal Customs Service told Itar-Tass on Friday that workers of the Orenburg customs service spotted the dangerous cargo on Wednesday during examination of a car with a radiation detector. The radiation-emitting object was a cylindrical protective container intended for remote manipulation with radioactive substances. It contained 37.5 kilograms of uranium-238, which is a depleted form. An owner of the container described it in a customs declaration as a "dumb-bell". He said he had found it at a dump and used it for exercise and sometimes straightened nails with it. Specialists are looking for the origin of the container. A criminal case on an attempt of contraband of a radioactive substance has been opened. Specialists of the Russian Agency of Atomic Energy told Itar-Tass that neither a conventional nor "dirty" bomb could be made from the confiscated amount of uranium. Uranium-238 is one of the most available elements in the earth crust. About 60,000 tonnes of uranium a year is extracted in the world. _________________________________________________________________ ) ITAR-TASS. All rights reserved. You undertake not to copy, store in any medium (including in any other website), distribute, transmit, re-transmit, broadcast, modify or show in public any part of the ITAR-TASS website without the prior written permission of ITAR-TAS. [spacer.gif]

1 0

Safeway Club Card Leads to Bogus Arson Arrest
by Eugen Leitl 29 Jan '05

29 Jan '05

Link: http://slashdot.org/article.pl?sid=05/01/29/030223 Posted by: michael, on 2005-01-29 11:03:00 from the if-you're-innocent-you-have-nothing-to-fear dept. [1]Richard M. Smith writes "Tukwila, Washington firefighter, Philip Scott Lyons found out the hard way that supermarket loyalty cards come with a huge price. Lyons was arrested last August and charged with attempted arson. Police alleged at the time that Lyons tried to set fire to his own house while his wife and children were inside. According to [2]KOMO-TV and the Seattle Times, a major piece of evidence used against Lyons in his arrest [3]was the record of his supermarket purchases that he made with his Safeway Club Card. Police investigators had discovered that his Club Card was used to buy fire starters of the same type used in the arson attempt. For Lyons, the story did have a [4]happy ending. All charges were dropped against him in January 2005 because another person stepped forward saying he or she set the fire and not Lyons." References 1. http://www.ComputerBytesMan.com/ 2. http://www.komotv.com/stories/32785.htm 3. http://seattletimes.nwsource.com/html/localnews/2002055245_arson06m.html 4. http://heraldnet.com/stories/05/01/28/100loc_arson001.cfm ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

2 1

Lawsuit alleges 'online currency' scam
by R.A. Hettinga 28 Jan '05

28 Jan '05

<http://news.com.com/2102-1030_3-5553141.html?tag=st.util.print> CNET News Lawsuit alleges 'online currency' scam By Declan McCullagh Story last modified Thu Jan 27 08:47:00 PST 2005 A lawsuit claiming that a "gold backed" Internet currency scheme bilked investors out of more than $250 million can proceed against a bank implicated in it, a federal judge has ruled. At the height of its popularity, the OSGold currency boasted more than 60,000 accounts created by people drawn to promises of "high yield" investments that would provide guaranteed monthly returns of 30 percent to 45 percent. But around July 2002, the eve of the maturity date for the investment program, the company that offered the accounts suddenly ceased payouts. David Reed, who had founded the company called One Groupe International, eventually was discovered to have relocated from the United States to Cancun, Mexico. Concluding they had been fleeced, a group of OSGold investors banded together to sue Reed and 19 other defendants including two Latvian banks that allegedly lent their imprimatur to the project. It was "fronted by the sale of a nonexistent gold-backed Internet currency and was fueled by a mammoth 'Ponzi' scheme disguised as a guaranteed high-yield investment program," the OSGold investors say in court documents. U.S. District Judge Lewis Kaplan ruled on Friday that the lawsuit could proceed against the Latvian Economic Commercial Bank (Lateko), which had attempted to dismiss the charges. Kaplan, in New York, dismissed some charges against Lateko, including breach of fiduciary duty, but permitted the rest to stand. "Lateko's apparently false denials to a possibly important business partner and its continued cooperation with (Reed and other defendants) even after the scheme suspiciously began to collapse tend to show conscious disregard or recklessness and give rise to a strong inference of fraudulent intent," Kaplan wrote. Lateko's involvement began in December 2001, when it allegedly inked a deal with Reed and other defendants to provide anonymous debit cards that could be used to withdraw money from OSGold accounts from ATMs linked to the Cirrus network. Lawyers for Lateko in the New York offices of Baker & McKenzie did not respond to an interview request. Suspecting something odd was going on, some companies involved in providing gold-backed Internet currencies tried to distance themselves from OSGold early on. In May 2001, the Gold and Silver Reserve (responsible for the e-gold currency) announced it would no longer link to companies that did business with "or make reference to" OSGold. A Ponzi scheme is an illegal pyramid scheme in which some early investors are paid off with money from later investors in an attempt to make the system look legitimate. But when later investors demand their money, the fraud collapses. This type of scheme is named for 1920s-era swindler Charles Ponzi, who promised investors a 40 percent return in 90 days. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Unintended Consequences
by R.A. Hettinga 28 Jan '05

28 Jan '05

<http://www.securityfocus.com/printable/columnists/293> SecurityFocus COLUMNISTS 293 Columnists < http://www.securityfocus.com/columnists/293 > Unintended Consequences By Scott Granneman Jan 19 2005 01:11PM PT Back in the 1970s, long before the revolution that would eventually topple him from power, the Shah of Iran was one of America's best friends (he was a dictator who brutally repressed his people, but he was anti-communist, and that made him OK in our book). Wanting to help out a good friend, the United States government agreed to sell Iran the very same intaglio presses used to print American currency so that the Shah could print his own high quality money for his country. Soon enough, the Shah was the proud owner of some of the best money printing machines in the world, and beautiful Iranian Rials proceeded to flow off the presses. All things must come to an end, and the Shah was forced to flee Iran in 1979 when the Ayatollah Khomeini's rebellion brought theocratic rule to Iran. Everyone reading this undoubtedly knows the terrible events that followed: students took American embassy workers hostage for over a year as Iran declared America to be the "Great Satan," while evidence of US complicity in the Shah's oppression of his people became obvious, leading to a break in relations between the two countries that continues to worsen to this day. During the early 90s, counterfeit $100 bills began to flood the Mideast, eventually spreading around the world. Known as "superbills" or "superdollars" by the US Treasury due to the astounding quality of the forgeries, these $100 bills became a tremendous headache not only for the US and its economy, but also for people all over the world that depend on the surety of American money. Several culprits have been suggested as responsible for the superbills, including North Korea and Syria, but many observers think the real culprit is the most obvious suspect: an Iranian government deeply hostile to the United States ... and even worse, an Iranian government possessing the very same printing presses used to create American money. If you've ever wondered just why American currency was redesigned in the 1990s, now you know. In the 1970s, the US rewarded an ally with a special machine; in the 1990s, the US had to change its money because that ally was no longer an ally, and that special machine was now a weapon used to attack the US's money supply, where it really hurts. As an example of the law of unintended consequences, it's powerful, and it illustrates one of the main results of that law: that those unintended consequences can really bite back when you least expect them. Unprepared and unready Sometimes unintended consequences occur from the best of intentions. For instance, Denny's is known for being open 24 hours a day, every day, always. The story goes that in 1998, for the first time in 35 years, Denny's decided to close its doors on Christmas, but there was a big problem: since Denny's was always open, many stores didn't have locks on the doors, so they couldn't close. Likewise, email was invented in 1971 and was immediately embraced as a great way to communicate with folks all over the world. Since virtually everyone on the Net pretty much knew each other at the time, email was developed without a lot of safeguards. Spoofing the sender? Not a real issue. False headers? Why in the world would anyone want to do that? Purposely misspelled words in the subject to get past filters? First of all, what the heck are filters, and why would someone want to spell something weird to get past one? It was a more innocent age, but that innocence was lost long ago, thanks to a trickle ... no, a stream ... no, a flood, an absolutely Biblical flood of garbage, scams, lies, ads, swindles, and just plain crap. In fact, it's gotten so bad that MX Logic, an antispam vendor, now estimates that 75% of all email is spam, while in same article Postini Inc. jacks that number up to 88% of all email. Think about that: only about 1 in 10 emails is legitimate. That's truly pathetic, almost enraging, and it's finally leading (slowly, oh so slowly) to necessary changes - not in the legal system, since the CAN-SPAM Act of 2003 seems to have done virtually nothing to stem the tide - but in email infrastructure, to things like Microsoft's proposed Sender ID, Yahoo's Domain Keys, and Sender Policy Framework. Of course, at this time there's no consensus on the solution, and with patents and other contentious issues of so-called intellectual property acting as flies in the ointment, we may never reach a unified approach to the problem of spam. Naturally, that just helps the spammers. But they don't mind - they're busy helping each other. Fast forward from 1971 to 2005. Would the inventors recognize the monstrosity they innocently unleashed upon the world? Making things easier for the bad guys Bruce Schneier, in his excellent Beyond Fear, reports that drivers in Russia have made interesting choices that have not always resulted in improving their situations. Crime is a large and growing problem in Russia, and one of the biggest threats is in the area of auto theft. To combat car theft, automobile owners installed car alarms. The result? Thieves waited until the owner approached the car to turn off the alarm, and then shot him, took his keys, and drove away in the car. Round one to the bad guys. Fine. So car owners quit using alarms, and instead installed security systems that made cars virtually impossible to hotwire. Ah ha! Round two to the good guys. Not so fast - since cars were extremely difficult to hotwire, thieves turned to carjackings instead, which is far more likely to result in injury or death to the car owner. Round three to the bad guys, and once again we see how "security" sometimes serves only to make things easier for the criminals. A similar thing has popped up recently with one of my favorite bugaboos, DRM. I'm opposed to DRM for quite a number of reasons (if you're looking for an excellent list of those reasons, read Cory Doctorow's brilliant dissection of DRM), and now there's a new one: because it actually helps the bad guys. Microsoft has touted its Windows Media Player (or WMP) as an industy- and DRM-friendly app that supports so-called "protected" media files. Basically, if you try to play a DRM-laden Windows media file, WMP checks to see if you have a valid license to do so. If you do, the file plays; if you don't, WMP heads off to a web site specified by the media file to acquire and download (and often purchase) a license. But guess what? WMP doesn't check to see where it's going, or even what it's downloading, so individuals up to no good simply redirect it to sites where users end up with spyware, viruses, and other nastiness on their Windows machines. One researcher went ahead, pressed "Yes" to allow stuff to install, and then measured the results: "My computer quickly became contaminated with the most spyware programs I have ever received in a single sitting ... all told, the infection added 58 folders, 786 files, and an incredible 11,915 registry entries to my computer." Amazing. Astounding. And another example of how some supposed "security" actually makes things easier for the bad guys - and makes things far worse for the good guys (and by "good guys," I mean users, not the companies pushing DRM). Feel safer, act riskier Social scientists have noticed an interesting pattern in human behavior over the years: it seems that the more safe and secure people feel, the more likely they are to engage in risky behavior. For proof of this, look no further than the Iroquois Theater in Chicago, opened for business in November of 1903. Fires at this time were a serious threat in theaters, due to the hot lights hung all around the stage in close proximity to backdrops and sets decorated with oil paints. Not to worry, though: the managers of the Iroquois advertised that they had put into place an asbestos curtain that would drop in case of fire, protecting the audience from the flames. Additional precautions common to theaters of the time that should have been put into place - things like firemen near the stage, and readily avilable fire hoses and extinguishers - were ignored because it was believed that the asbestos curtain was the ultimate in fire safety. On 30 December 1903, a velvet curtain caught on fire as 1900 men, women, and children were packed in to see an afternoon performance of the musical "Mr. Blue Beard, Jr." The asbestos curtain was lowered, but got caught on a lamp and failed to close, exposing the crowd to flames and smoke. People rushed the doors in a panic, but the doors open inwardly, making them impossible to open. 603 people died in the fire - and the supposed asbestos curtain turned out to be a fake, since it too burned in the fire. Chicago's strict fire codes resulted from the fire, but it was a steep price to pay. Computer viruses, worms, and spyware don't compare to death and destruction, but we see the same sort of human behavior - feeling safer, acting riskier - at work. For years, anti-virus software from third-party vendors has been included with most new Windows machines, and now both AOL and Microsoft are bundling A/V software with their products. Virtually all of the A/V software included with new PCs is time limited: it's free for 3 months, or maybe 6 months, and then the user has to buy it. You and I both know that few users actually go ahead and sign up ... but many users still believe they're protected. In fact, a recent study covered in The Register illustrates this tendency. Researchers looked at the computers of 329 volunteers. Nearly all of the machines were infected with viruses, spyware, and other garbage - one fellow had 1,059 spyware and adware programs on his machine! - yet about 75% of those same users "reported believing that their PC is very secure or moderately secure". I'm not surprised. And now Microsoft is adding "free" anti-spyware to the mix. Is this a good thing? On the one hand, sure - now people will have anti-spyware on their machines, and as regular readers know, it is badly needed, given the outrageous levels of spyware out there on the Net. On the other hand, how effective is this software going to be? We've seen increasing attacks on security software over the past year; on top of that, Microsoft's other security software - like its firewall - is hardly a shining paragon in its category. Further, it appears that history will repeat itself: Microsoft's ultimate aim is to charge for its bundled anti-virus and anti-spyware as part of a new A1 security subscription service. What's the result? Users think they're protected - after all, their computer comes with anti-virus software! it comes with anti-spyware software! it's got a firewall! - but in reality they're still vulnerable. Given that mindset, why not use Internet Explorer? Why not use Outlook Express, or Outlook? Why not click on whatever appears in the web browser? Or in email? Why worry about security? They're safe and secure! It's enough to make a security pro want to take off from work and go see a mid-day show. The law of unexpected consequences is one that we simply can't afford to forget, and even though they're impossible to adequately plan for, we can minimize their effects. We have to worry about it, and we have to always ask the hard question: given this new thing foo, what are all the possible results that could happen? Brainstorm. Think out of the box. Don't be afraid to consider whatever crazy idea pops into your head. Trust me: it's never crazy enough. My British readers at least have one advantage over us Yanks: it appears that so many people in the UK are taking Prozac that the drinking water now contains traces of the drug. Wait a little longer, and security pros in the UK won't be worrying about unintended consequences: thanks to one that I would have never thought of, they'll be blissfully unconcerned about them. And on it goes. Further Reading "Iroquois Theatre Fire of 1903". Chicago Historical Society (17 February 2004). McNeil Jr., Donald G. "New C-Note Is Awaited In the Land Of Fake Bills". The New York Times (3 December 1995): 9. Scott Granneman is a senior consultant for Bryan Consulting Inc. in St. Louis. He specializes in Internet Services and developing Web applications for corporate, educational, and institutional clients. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Scientists Work on Software to Scan Arabic
by R.A. Hettinga 28 Jan '05

28 Jan '05

<http://www.nytimes.com/aponline/technology/AP-Arabic-Software.html?oref=log…> The New York Times January 27, 2005 Scientists Work on Software to Scan Arabic By THE ASSOCIATED PRESS Filed at 8:09 a.m. ET BUFFALO, N.Y. (AP) -- Computer scientists are developing software to scan Arabic documents, including handwritten ones, for specific words and phrases, filling a void that became apparent following the Sept. 11. attacks. Besides helping with intelligence gathering, the software should expand access to modern and ancient Arabic manuscripts. It will allow Arabic writings to be digitized and posted on the Web. ``The whole Internet is skewed toward people who speak English,'' said Venu Govindaraju, director of the Center for Unified Biometrics and Sensors at the University at Buffalo, where the software is being developed. Govindaraju fears that if optical character recognition software isn't developed for a particular language, ``then all the classic texts in that language will disappear into oblivion.'' Bill Young, an Arab language specialist at the University of Maryland, said the software could help scan through masses of typed pages for specific names or words, though he cautioned that handwritten Arabic presents serious challenges for computers. For instance, the word mas'uul, meaning responsible, can be written in more than one way, he said. So the software would have to be given instructions about possible variations. Govindaraju, who helped develop software to recognize handwritten addresses in English, said the Arabic software would take into account the fact that characters may take different forms depending on where within a word they appear, and that Arabic vowels are pronounced but often not written. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: MPAA files new film-swapping suits
by Major Variola (ret) 28 Jan '05

28 Jan '05

At 04:41 PM 1/28/05 +0100, Eugen Leitl wrote: >Not really. The P2P assm^H^H^H^H architects are reissuing new systems with >holes patched reactively. There's no reason for a P2P system designed in 1996 >to be water-tight to any threat model of 2010. (Strangely enough, they had >IP nazis and lawyers back then, too). I was surprised to see that the EFF listed ADCs as endangered tech. Because the hollywood nazis regard (and damn rightly so) the analog hole as real. That a fairly stead organization as EFF would regard the desparate death-sounds of hollywood as a serious threat to such basic tech was astounding. I've had cross-compiled code (for the MMC2107) identified as a virus (and therefore erased) by an antivirus program on a PC. This only lost an hour or two of work. Imagine that your medical measurements, or kids' performances, happen to match an ADC's copy protection codes. Imagine that all your silicon belongs to us, us=hollywood=congress. Imagine that all your printing presses belong to the State, for the protection of the commercial merde. ------ "Be neither perpetrator, bystander, nor victim" ---a commentator on the 60th anniversary of Auswitz, coming to a goverment center near you ----- Uranium --the Great Equalizer

1 0