January 2005 - cypherpunks-legacy

Sleuthing Spyware--And Its Corporate Sponsors
by R.A. Hettinga 26 Jan '05

26 Jan '05

<http://www.forbes.com/2005/01/19/cx_pp_0120spyedelman_print.html> Forbes Software Sleuthing Spyware--And Its Corporate Sponsors Penelope Patsuris, 01.19.05, 5:34 PM ET Benjamin Edelman became a spyware expert before most of us had any idea what was even clogging our computers. He's currently a candidate for a doctorate in economics at Harvard University and a Harvard Law student, but his work is hardly academic. Edelman, 24, has built a cottage industry documenting the nefarious ways of the spyware and adware industries, which he contends are one and the same. His extensive Web site is packed with the kind of hard evidence--screenshots and videos--that's required to combat the deception he says has been employed by companies like Claria, 180solutions, WhenU and DirectRevenue to make a buck. Each of these companies denies any wrongdoing, except DirectRevenue, whose spokesman had no comment. Many of Edelman's opponents say his accusations are self-serving, since he has at times worked for companies suing adware outfits. Edelman has lots of litigation experience despite his young age, having consulted for and testified on behalf of organizations like the ACLU, the National Association of Broadcasters and the National Football League. In 2002 he testified on behalf of a group of media outfits, including The New York Times Co. (nyse: NYT - news - people ), The Washington Post's (nyse: WPO - news - people ) interactive unit and Dow Jones (nyse: DJ - news - people ), in their lawsuit against adware outfit Gator--now named Claria. The suit claimed, among other things, that Gator's pop-up ads were unlawfully obscuring the media companies' own online content. The suit was settled under confidential terms in February 2003. Edelman doesn't just take on the makers of spyware--he outs the big-name companies that support them. In June 2004, he posted a list of WhenU advertisers, including J.P. Morgan Chase (nyse: JPM - news - people ), Verizon Communications (nyse: VZ - news - people ), Merck (nyse: MRK - news - people ) and T-Mobile. Advertisers react to the finger-pointing with varying degrees of concern. Verizon says that it "no longer uses WhenU," while a spokesman for T-Mobile says that he hasn't received any complaints about the WhenU ads and that "WhenU is opt-in and it can be removed easily." Repeated calls to Merck and J.P. Morgan Chase were not returned. Edelman's Web page also accuses WhenU of transmitting the browsing activity of its users back to the company, a practice that he says WhenU's privacy policy specifically promises not to engage in. He also writes that WhenU has spammed search giant Google (nasdaq: GOOG - news - people ). WhenU President Avi Naider says Edelman is wrong. "In the past Mr. Edelman has made statements about WhenU that drew incorrect conclusions about WhenU and were legally inappropriate," says Naider. "We take our privacy protection very seriously." He adds that WhenU's privacy policy has been audited by Microsoft's (nasdaq: MSFT - news - people ) former chief privacy officer, Richard Purcell, who is chairman of TRUSTe, a nonprofit online-privacy organization. Perhaps what's most interesting on Edelman's Web site is a video dated Nov. 18, 2004, which depicts roughly 25 different adware programs, including 180solutions, that download via security holes onto his browser. Todd Sawicki, 180's director of marketing, says that his company is taking various steps to prevent this kind of thing from happening, but that "unfortunately, where there is money, the bad guys will follow." Edelman's biggest beef with Claria: "Their license fails to prominently disclose the fact that they are collecting and storing information about what users do online," he says. "But when you read the Claria installer, it never tells you, 'We collect information.' Instead it says, 'We show you ads that are based on where you visit.' " Claria Chief Marketing Officer Scott Eagle says the company's updated user agreement clarifies that point, but admits that the update isn't presented to many users that get Claria when they download free software like Kazaa. Indeed, Claria said in an S-1 filing with the U.S. Securities and Exchange Commission--since withdrawn--that it gets most of its users via Kazaa. Still, Eagle questions Edelman's motives, saying he's worked for companies that are suing Claria. (Edelman did work for Teleflora, which has a case against Claria, but he no longer does.) Edelman counters, "My clients don't hire me to help them with litigation against Claria because I'm a big fan." The Harvard student also takes Claria advertisers to task, posting a screen shot of a British ad for Dell (nasdaq: DELL - news - people ) that appeared on his PC via Claria when he was browsing IBM's (nyse: IBM - news - people ) Web site. Edelman notes the irony that Dell has been quite vocal about the burden that the spyware boom has placed on its own customer support. "When any issues like this come to our attention, we put an end to them," says a Dell spokeswoman. "I can tell you that today we do not do business with anyone like Claria." Edelman says he has a long list of advertisers who currently work with Claria that he hasn't posted to his site. "They're a very litigious company," he says. Maybe he'll reconsider after he gets that law degree. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cracks in the Chinese Wall
by R.A. Hettinga 26 Jan '05

26 Jan '05

<http://online.wsj.com/article_print/0,,SB110671549118636405,00.html> The Wall Street Journal January 26, 2005 COMMENTARY Cracks in the Chinese Wall By EMILY PARKER January 26, 2005 China's leaders may have convinced themselves that the country's relatively new, albeit unbalanced, material prosperity will be enough to keep an uneasy population from peering into some of the darker corners of the country's Communist history. And the popular reaction (or lack thereof) to purged former leader Zhao Ziyang's death last week appears to prove them right at first glance. The relative tranquility does make it appear as if young Chinese, intoxicated by the opportunities of China's dizzying economic growth, don't really understand -- or care -- about what really happened at Tiananmen Square in 1989, or why Zhao's sympathies with the student protesters led to his downfall. But that is not exactly the case. Increased access to information through the Internet, which is just one of the many fruits of China's development, is producing a predicament for China's leadership. China's pragmatic leaders undoubtedly saw allowing widespread access to the Internet as necessary for growth, but hoped to rein in its power by using firewalls to block "unsavory" information. But the Internet has only endowed citizens with a heightened awareness of the amount of information that is being blocked. When Zhao died last week, his passing was mostly observed in silence. State media played down the death, if it was reported at all, and relevant Web sites were often either sterilized or blocked entirely. But some Chinese, rather than quietly observe the systematic blockage of news, turned to the few tools at their disposal, and used the Internet to both obtain and spread information. The Internet, in fact, served as a forum for Chinese to congregate and express their mourning or, more often, frustration. While many Chinese went online to pay their respects to Zhao, the anger and sadness on these sites often had little to do with the man who died. Comments extracted and translated from discussions on mainland-accessible Chinese-language Web sites in the days following Zhao's death showcase a collective lament for the limits on freedom of information in China today. These voices aren't necessarily those of dissidents in exile, or intellectuals, or even citizens who are particularly politically minded. Rather, they are the voices of ordinary Chinese who, after having reaped the fruits of greater access to information, are only more aware of the freedoms of which they are still deprived. One particularly telling message, posted on a mainland-accessible Chinese language Web site shortly after Zhao's death, sheds light on a mainlander's journey to learn the truth: "In 1989 I was only seven years old, I only have a fuzzy impression of what happened that year, as for Zhao, I don't have a very detailed understanding. . . But today, while I was eating, my grandmother said, "Zhao Ziyang died, why isn't the news or the papers reporting it?" I was curious, so I went searching on the Internet, but I found that I couldn't open many Web sites, which made me think something was strange. It was extremely difficult to even find this Web site, but after reading it, I was shocked. . . I now can't help but feel worried about the future of our country." Indeed, the sudden media silence after Zhao's death only caused many to realize that something was seriously wrong. "I'm too young, I don't understand the reasons or the results, I pay a silent tribute. This morning I couldn't connect to any overseas Web sites, and I realized that something had happened. What I really don't understand is . . . [why it's necessary to put so much effort into] blocking all overseas Web sites, it's as though they have a guilty conscience." Another said, "I live in Guangzhou, and that night I wasn't able to access two Hong Kong TV stations, so I realized immediately that something major had happened, it turns out that general secretary Zhao had died! . . . In this era, how much longer can you block information?" Anger was a common sentiment online: "Today I heard from a friend that secretary Zhao had died, I felt shocked, but what made me even more furious was [the government's] conduct. People can't forget history. . . I'm really furious!" Some cybernauts said they weren't even clear on Zhao's contribution, but were nonetheless indignant at attempts to sweep under the rug the death of a man who played such an important historical role. "Putting aside Zhao's merits and faults for the time being, we have already completely lost the right to speak, and to hear about him! What kind of world is this?" Another writer used the occasion of Zhao's death to issue a warning: "Our party blocked information on the Internet. . . and didn't allow freedom of speech. . . The party did the same thing during SARS, what was the result then?" Other netizens, as if in direct response to the pervasive stereotype that younger Chinese are ignorant or indifferent about their country's history, stepped up to act as representatives for their generation: "Under Communist Party tutelage, there aren't many young people who remember Zhao. Please allow me to represent young people by saying: . . . 'The people won't forget you, history won't forget you!'" Another appealed to other netizens to uncover the truth: "I still don't really understand, because in '89 I was only four years old, can someone senior to me please let me know what happened in that year? What is the truth? Thank you." These Web sites were not simply a forum for expressing grievances. They served another important function as well: They acted as road maps to direct curious Chinese to news sources, while creating a bridge between Chinese who were hungry for information, and those who know where to find it. In this way, the Internet links a community, just as it does elsewhere in the world for people with shared interests. In China the shared interest broke through the government's wall of silence. Someone would plead: "Is there anywhere that has a detailed report [on Zhao]? A lot of Web sites are blocked!" and those in the know would post Web addresses -- or links -- of sites that were still accessible. Others would list which mainland-accessible search engines were the most useful for getting information about Zhao, and which ones were useless. One writer, perhaps frustrated by previous encounters with blocked or "edited" Web sites, upon discovering one forthright discussion on Zhao's death, commented, "Is [this site] the last place for free expression?" Amongst all others, I found this question particularly poignant: Although the discussion thread the writer was referring to did manage to avoid censors for a whole week after Zhao's death, when I tried to open it from Hong Kong yesterday, it appeared to have vanished. The silver lining, however, is that other sites will just crop up in its place. And savvy Chinese netizens will only figure out new ways to obtain and spread information within the limited freedoms that the Internet provides. China's leaders may hope that prosperity will help justify maintaining a wall to block information. But the cracks are beginning to show. Amidst all the sadness and frustration expressed online, there was one ray of hope: "Thank you, Internet, for giving us one last place to speak!" Ms. Parker is an editorial page writer at The Asian Wall Street Journal. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Blinky's Pitch-Man Speaks: Terror's Server
by R.A. Hettinga 26 Jan '05

26 Jan '05

At 3:14 PM -0400 10/3/04, R. A. Hettinga wrote: >In arbitrary order (in other words, *I* chose it. :-)), and with >apologies to Toru Iwatani, by way of Michael Thomasson at ><http://www.gooddealgames.com/articles/Pac-Man%20Ghosts.html>, here >it is: > > >A Proposed Nomenclature for the Four Horseman of The Infocalypse > > Horseman Color Character Nickname > >1 Terrorism Red Shadow "Blinky" >2 Narcotics Pink Speedy "Pinky" >3 Money Laundering Aqua Bashful "Inky" >4 Paedophilia Yellow Pokey "Clyde" > >It is acceptable to refer to a horseman by any of the above, i.e., >"Horseman No. 1", "The Red Horseman", "Shadow", or "Blinky". > >Apparently there was a, um, pre-deceased, dark-blue ghost, used in >Japanese tournament play, named "Kinky", I leave that particular >horseman for quibblers. ------- <http://www.technologyreview.com/articles/05/02/issue/feature_terror.asp?p=0> Technology Review Terror's Server By David Talbot Febuary 2005 NOTEBOOK Richard A. Clarke spent 11 years in senior policymaking positions at the White House, advising presidents on matters of counterterrorism and cyber security. When the Sept. 11 attacks took place he was the counterterrorism adviser to the National Security Council. He now heads Good Harbor Consulting. Clarke recently spoke with Technology Review Chief Correspondent David Talbot about terrorist exploitation of the Internet. David Talbot: How is the use of the Internet by terrorist groups changing? Richard Clarke: It's important for publicity and propaganda purposes. It is one of their best vehicles for that. It may be useful for communications, but I think they are increasingly relying on (human) couriers. There is some potential that they are using the Internet to engage in cyber-crime as a funding source. DT: Is it getting any easier to track down the location or identity of a terrorist communication? RC: You can assume all kinds of one-time identities on the Internet. The risk of course, is that a smart computer forensics team can trace back, if not to a particular house, certainly to a particular city where the communication might have come from. They've tried to get around that in the past by using cyber-cafes. But if they are effectively masking their IDs and locations by going through multiple hops and spoofing IP (internet protocol) addresses, it's more difficult. Related Stories: Two hundred two people died in the Bali, Indonesia, disco bombing of October 12, 2002, when a suicide bomber blew himself up on a tourist-bar dance floor, and then, moments later, a second bomber detonated an explosives-filled Mitsubishi van parked outside. Now, the mastermind of the attacks-Imam Samudra, a 35-year-old Islamist militant with links to al--Qaeda-has written a jailhouse memoir that offers a primer on the more sophisticated crime of online credit card fraud, which it promotes as a way for Muslim radicals to fund their activities. Law enforcement authorities say evidence collected from Samudra's laptop computer shows he tried to finance the Bali bombing by committing acts of fraud over the Internet. And his new writings suggest that online fraud-which in 2003 cost credit card companies and banks $1.2 billion in the United States alone-might become a key weapon in terrorist arsenals, if it's not already. "We know that terrorist groups throughout the world have financed themselves through crime," says Richard Clarke, the former U.S. counterterrorism czar for President Bush and President Clinton. "There is beginning to be a reason to conclude that one of the ways they are financing themselves is through cyber-crime." Online fraud would thereby join the other major ways in which terrorist groups exploit the Internet. The September 11 plotters are known to have used the In-ternet for international communications and information gathering. Hundreds of jihadist websites are used for propaganda and fund-raising purposes and are as -easily accessible as the mainstream websites of major news organizations. And in 2004, the Web was awash with raw video of hostage beheadings perpetrated by -followers of Abu Musab al-Zarqawi, the Jordanian-born terror leader operating in Iraq. This was no fringe phenomenon. Tens of millions of people downloaded the video files, a kind of vast medieval spectacle enabled by numberless Web hosting companies and Internet service providers, or ISPs. "I don't know where the line is. But certainly, we have passed it in the abuse of the Internet," says Gabriel Weimann, a professor of communications at the University of Haifa, who tracks use of the Internet by terrorist groups. Meeting these myriad challenges will require new technology and, some say, stronger self-regulation by the online industry, if only to ward off the more onerous changes or restrictions that might someday be mandated by legal authorities or by the security demands of business interests. According to Vinton Cerf, a founding father of the Internet who codesigned its protocols, extreme violent content on the Net is "a terribly difficult conundrum to try and resolve in a way that is constructive." But, he adds, "it does not mean we shouldn't do anything. The industry has a fair amount of potential input, if it is to try to figure out how on earth to discipline itself. The question is, which parts of the industry can do it?" The roadblocks are myriad, he notes: information can literally come from anywhere, and even if major industry players agree to restrictions, Internet users themselves could obviously go on sharing content. "As always, the difficult question will be, Who decides what is acceptable content and on what basis?" Some work is already going on in the broader battle against terrorist use of the Internet. Research labs are developing new algorithms aimed at making it easi-er for investigators to comb through e-mails and chat-room dialogue to uncover crimi-nal plots. Meanwhile, the industry's anti-spam efforts are providing new tools for authenticating e-mail senders using cryptography and other methods, which will also help to thwart fraud; clearly, terror-ist exploitation of the Internet adds a -national-security dimension to these efforts. The question going forward is whether the terrorist use of the medium, and the emerging responses, will help usher in an era in which the distribution of online content is more tightly controlled and tracked, for better or worse. NOTEBOOK (Continued) DT: How are efforts coming along to improve cyber-security, say, by authenticating who is sending a piece of information? RC: The more immediate reason that people in the U.S. are thinking about that is spam. Microsoft and AOL and others have formed working groups to come up with a way of having email authentication. Even thought we've passed the Can-Spam Act, (it doesn't) seem to be effective because people are able to offshore their services. There is very serious work going on to come up with authenticated email. DT: So the fight against spam is also the fight against the use of the Internet by terrorists? RC: It's relevant to counterterrorism because it would prevent a lot of cyber crime, which may be how they are funding themselves. It may also make it difficult to assume identities for on-time use communications. You do have the possibility of extending this (into chat rooms and other forums). Related Stories: The Rise of Internet Terror Today, most experts agree that the Internet is not just a tool of terrorist organizations, but is central to their operations*. Some say that al-Qaeda's online presence has become more potent and pertinent than its actual physical presence since the September 11 attacks. "When we say al-Qaeda is a global ideology, this is where it exists-on the Internet," says Michael Doran, a Near East scholar and terrorism expert at Princeton University. "That, in itself, I find absolutely amazing. Just a few years ago, an organization like this would have been more cultlike in nature. It wouldn't be able to spread around the world the way it does with the Internet." The universe of terror-related websites extends far beyond al-Qaeda, of course. According to Weimann, the number of such websites has leapt from only 12 in 1997 to around 4,300 today. (This includes sites operated by groups like Hamas and Hezbollah, and others in South America and other parts of the world.) "In seven years it has exploded, and I am quite sure the number will grow next week and the week after," says Weimann, who described the trend in his report "How Modern Terrorism Uses the Internet," published by the United States Institute of Peace, and who is now at work on a book, Terrorism and the Internet, due out later this year. These sites serve as a means to recruit members, solicit funds, and promote and spread ideology. "While the [common] perception is that [terrorists] are not well educated or very sophisticated about telecommunications or the Internet, we know that that isn't true," says Ronald Dick, a former FBI deputy assistant director who headed the FBI's National Infrastructure Protection Center. "The individuals that the FBI and other law enforcement agencies have arrested have engineering and telecommunications backgrounds; they have been trained in academic institutes as to what these capabilities are." (Militant Islam, despite its roots in puritani-cal Wahhabism, taps the well of Western liberal education: Khalid Sheikh Mohammed, the principal September 11 mastermind, was educated in the U.S. in mechanical engineering; Osama bin Laden's deputy Ayman al-Zawahiri was trained in Egypt as a surgeon.) The Web gives jihad a public face. But on a less visible level, the Internet provides the means for extremist groups to surreptitiously organize attacks and gather information. The September 11 hijackers used conventional tools like chat rooms and e-mail to communicate and used the Web to gather basic information on targets, says Philip Zelikow, a historian at the University of Virginia and the former executive director of the 9/11 Commission. "The conspirators used the Internet, usually with coded messages, as an important medium for international communication," he says. (Some aspects of the terrorists' Internet use remain classified; for example, when asked whether the Internet played a role in recruitment of the hijackers, Zelikow said he could not comment.) Finally, terrorists are learning that they can distribute images of atrocities with the help of the Web. In 2002, the Web facilitated wide dissemination of videos showing the beheading of Wall Street Journal reporter Daniel Pearl, despite FBI requests that websites not post them. Then, in 2004, Zarqawi made the gruesome tactic a cornerstone of his terror strategy, starting with the murder of the American civilian contractor Nicholas Berg-which law enforcement agents believe was carried out by Zarqawi himself. From Zarqawi's perspective, the campaign was a rousing success. Images of orange-clad hostages became a headline-news staple around the world-and the full, raw videos of their murders spread rapidly around the Web. "The Internet allows a small group to publicize such horrific and gruesome acts in seconds, for very little or no cost, worldwide, to huge audiences, in the most powerful way," says Weimann. And there's a large market for such material. According to Dan Klinker, webmaster of a leading online gore site, Ogrish.com, consumption of such material is brisk. Klinker, who says he operates from offices in Western and Eastern Europe and New York City, says his aim is to "open people's eyes and make them aware of reality." It's clear that many eyes have taken in these images thanks to sites like his. Each beheading video has been downloaded from Klinker's site several million times, he says, and the Berg video tops the list at 15 million. "During certain events (beheadings, etc.) the servers can barely handle the insane bandwidths-sometimes 50,000 to 60,000 visitors an hour," Klinker says. NOTEBOOK DT: In 2004, a number of video clips showing terrorist beheadings of western hostages in Iraq became widely available online. Is this a new concern? RC: It's an extension of what they have been doing, which is using the Internet for posting propaganda. They tend not to have their own web sites, but either post it on a chat room or bulletin board that tends to be used by people who like to view that material. Or the other thing they've done is hack their way into a site and post it. DT: Should Internet Service Providers do more to stop such material from being disseminated? RC: The small Mom-and-Pop ISP's are pretty irresponsible. But when you look at Yahoo or MSN or AOL, they have compliance staffs, enforcement staffs, people who monitor activity. In their service agreements, they make it explicit they can terminate. They are very fearful of government regulation, and the FCC has the legal authority from Congress to regulate, but it has decided not to use it. DT: Do you think this FCC posture should change? RC: It goes to the larger issue of regulating Internet content at all. I think as a mater of public policy, we've agreed, so far, we are not going to regulate Internet content, except for child pornography. You also can't engage in fraud. I'm not sure that we want to go any further. However, most of these beheadings begin on overseas servers and I don't understand why the CIA or NSA doesn't just knock off these overseas servers. Related Stories: Avoiding the Slippery Slope To be sure, Internet users who want to block objectionable content can purchase a variety of filtering-software products that attempt to block sexual or violent content. But they are far from perfect. And though a hodgepodge of Web page rating schemes are in various stages of implementation, no universal rating system is in effect-and none is mandated-that would make filters chosen by consumers more effective. But passing laws aimed at allowing tighter filtering-to say nothing of actually mandating filtering-is problematical. Laws aimed at blocking minors' -access to pornography, like the Communications Decency Act and Children's Online Protection Act, have been struck down in the courts on First Amendment grounds, and the same fate has befallen some state laws, often for good reason: the filtering tools sometimes throw out the good with the bad. "For better or worse, the courts are more concerned about protecting the First Amendment rights of adults than protecting children from harmful material," says Ian Ballon, an expert on cyberspace law and a partner at Manatt, Phelps, and Phillips in Palo Alto, CA. Pornography access, he says, "is something the courts have been more comfortable regulating in the physical world than on the Internet." The same challenges pertain to images of extreme violence, he adds. The Federal Communications Commission enforces "decency" on the nation's airwaves as part of its decades-old mission of licensing and regulating television and radio stations. Internet content, by contrast, is essentially unregulated. And so, in 2004, as millions of people watched video of beheadings on their computers, the FCC fined CBS $550,000 for broadcasting the exposure of singer Janet Jackson's breast during the Super Bowl halftime show on television. "While not flatly impossible, [Internet content] regulation is hampered by the variety of places around the world at which it can be hosted," says Jonathan Zittrain, codirector of the Berkman Center for Internet and Society at Harvard Law School--and that's to say nothing of First Amendment concerns. As Zittrain sees it, "it's a gift that the sites are up there, because it gives us an opportunity for counterintelligence." As a deterrent, criminal prosecution has also had limited success. Even when those suspected of providing Internet-based assistance to terror cells are in the United States, obtaining convictions can be difficult. Early last year, under provisions of the Patriot Act, the U.S. Department of Justice charged Sami Omar al-Hussayen, a student at the University of Idaho, with using the Internet to aid -terrorists. The government -alleged that al-Hussayen maintained websites that promoted jihadist-related ac-tivities, including funding terrorists. But his defense argued that he was simply using his skills to promote Islam and wasn't responsible for the sites' radical content. The judge reminded the jury that, in any case, the Constitution protects most speech. The jury cleared al-Hussayen on the terrorism charges but deadlocked on visa-related charges; al-Hussayen agreed to return home to his native Saudi Arabia rather than face a retrial on the visa counts. NOTEBOOK DT: What about clamping down on cyber-fraud that might be funding terror groups? RC: Internet crime including fraud and extortion is a global problem in the hundreds of millions of dollars of losses a year, if not into the billions. If one percent of Internet crime were funding Al Qaeda, that would be a lot of money. A lot of countries don't have adequately trained or resourced Internet crime squads. While the U.S. does train other countries, it doesn't do enough of it. Even after they are trained, they need a little support beyond the training. So having an international fund to provide training to poorer countries to have Internet crime squads is probably a better idea. Related Stories: Technology and ISPs But the government and private-sector strategy for combatting terrorist use of the Internet has several facets. Certainly, agencies like the FBI and the National Security Agency-and a variety of watchdog groups, such as the Site Institute, a nonprofit organization based in an East Coast location that it asked not be publicized-closely monitor jihadist and other terrorist sites to keep abreast of their public statements and internal communications, to the extent possible. It's a massive, needle-in-a-haystack job, but it can yield a steady stream of intelligence tidbits and warnings. For ex-ample, the Site Institute recently discovered, on a forum called the Jihadi Message Board, an Arabic translation of a U.S. Air Force Web page that mentioned an Ameri-can airman of Lebanese descent. According to Rita Katz, executive director of the Site Institute, the jihadist page added, in Arabic, "This hypocrite will be going to Iraq in September of this year [2004]-I pray to Allah that his cunning leads to his slaughter. I hope that he will be slaughtered the Zarqawi's way, and then [go from there] to the lowest point in Hell." The Site Institute alerted the military. Today, on one if its office walls hangs a plaque offering the thanks of the Air Force Office of Special Investigations. New technology may also give intelligence agencies the tools to sift through online communications and discover terrorist plots. For example, research suggests that people with nefarious intent tend to exhibit distinct patterns in their use of e-mails or online forums like chat rooms. Whereas most people establish a wide variety of contacts over time, those engaged in plotting a crime tend to keep in touch only with a very tight circle of people, says William Wallace, an operations researcher at Rensselaer Polytechnic Institute. This phenomenon is quite predictable. "Very few groups of people communicate repeatedly only among themselves," says Wallace. "It's very rare; they don't trust people outside the group to communicate. When 80 percent of communications is within a regular group, this is where we think we will find the groups who are planning activities that are malicious." Of course, not all such groups will prove to be malicious; the odd high-school reunion will crop up. But Wallace's group is developing an algorithm that will narrow down the field of so-called social networks to those that warrant the scrutiny of intelligence officials. The algorithm is scheduled for completion and delivery to intelligence agencies this summer. And of course, the wider fight against spam and online fraud continues apace. One of the greatest challenges facing anti-fraud forces is the ease with which con artists can doctor their e-mails so that they appear to come from known and trusted sources, such as colleagues or banks. In a scam known as "phishing," this tactic can trick recipients into revealing bank account numbers and passwords. Preventing such scams, according to Clarke, "is relevant to counterterrorism because it would prevent a lot of cyber-crime, which may be how [terrorists] are funding themselves. It may also make it difficult to assume identities for one-time-use communications." New e-mail authentication methods may offer a line of defense. Last fall, AOL endorsed a Microsoft-designed system called Sender ID that closes certain security loopholes and matches the IP (Internet Protocol) address of the server sending an inbound e-mail against a list of servers authorized to send mail from the message's purported source. Yahoo, the world's largest e-mail provider with some 40 million accounts, is now rolling out its own system, called Domain Keys, which tags each outgoing e-mail message with an encrypted signature that can be used by the recipient to verify that the message came from the purported domain. Google is using the technology with its Gmail accounts, and other big ISPs, including Earthlink, are following suit. Finally, the bigger ISPs are stepping in with their own reactive efforts. Their "terms of service" are usually broad enough to allow them the latitude to pull down objectionable sites when asked to do so. "When you are talking about an online community, the power comes from the individual," says Mary Osako, Yahoo's director of communications. "We encourage our users to send [any concerns about questionable] content to us-and we take action on every report." NOTEBOOK Fundraising & TV [Mike Bloxham] Amid all the coverage of the Tsunami and its consequences, viewers around the world have been moved by the images of devastation, loss and displacement. Many... >From Stephen to Zithromax [Simson Garfinkel] A fascinating story in The Harvard Crimson details a rather shocking security lapse in which "the confidential drug purchase histories of many Harvard students... IPCC Dissension [David Appell] A prominent member of the Intergovernmental Panel on Climate Change (IPCC) has resigned after accusing a lead author of injecting his personal opinions into... Wisconsin Professors Report on Growing Use of Games [Simson Garfinkel] According to this report recently published by three professors at the University of Wisconsin, immersive games are increasingly being used as training tools... Cars That Sense Emotions [Simson Garfinkel] ... That's what's being cooked up by the Broxburn-based firm Affective Media. Working with researchers at Edinburgh University, they've created a car that uses... > Read more posts Related Stories: Too Little, or Too Much But most legal, policy, and security experts agree that these efforts, taken together, still don't amount to a real solution. The new anti-spam initiatives represent only the latest phase of an ongoing battle. "The first step is, the industry has to realize there is a problem that is bigger than they want to admit," says Peter Neumann, a computer scientist at SRI International, a nonprofit research institute in Menlo Park, CA. "There's a huge culture change that's needed here to create trustworthy systems. At the moment we don't have anything I would call a trustworthy system." Even efforts to use cryptography to confirm the authenticity of e-mail senders, he says, are a mere palliative. "There are still lots of problems" with online security, says Neumann. "Look at it as a very large iceberg. This shaves off one-fourth of a percent, maybe 2 percent-but it's a little bit off the top." But if it's true that existing responses are insufficient to address the problem, it may also be true that we're at risk of an overreaction. If concrete links between online fraud and terrorist attacks begin emerging, governments could decide that the Internet needs more oversight and create new regulatory structures. "The ISPs could solve most of the spam and phishing problems if made to do so by the FCC," notes Clarke. Even if the Bali bomber's writings don't create such a reaction, something else might. If no discovery of a a strong connection between online fraud and terrorism is made, another trigger could be an actual act of "cyberterrorism"-the long-feared use of the Internet to wage digital attacks against targets like city power grids and air traffic control or communications systems. It could be some online display of homicide so appalling that it spawns a new drive for online decency, one countenanced by a newly conservative Supreme Court. Terrorism aside, the trigger could be a pure business decision, one aimed at making the Internet more transparent and more secure. Zittrain concurs with Neumann but also predicts an impending overreaction. Terrorism or no terrorism, he sees a convergence of security, legal, and business trends that will force the Internet to change, and not necessarily for the better. "Collectively speaking, there are going to be technological changes to how the Internet functions-driven either by the law or by collective action. If you look at what they are doing about spam, it has this shape to it," Zittrain says. And while technologi-cal change might improve online security, he says, "it will make the Internet less flexible. If it's no longer possible for two guys in a garage to write and distribute killer-app code without clearing it first with entrenched interests, we stand to lose the very processes that gave us the Web browser, instant messaging, Linux, and e-mail." A concerted push toward tighter controls is not yet evident. But if extremely violent content or terrorist use of the Internet might someday spur such a push, a chance for prekmptive action may lie with ISPs and Web hosting companies. Their efforts need not be limited to fighting spam and fraud. With respect to the content they publish, Web hosting companies could act more like their older cousins, the television broadcasters and newspaper and maga-zine editors, and exercise a little editorial judgment, simply by enforcing existing terms of service. Is Web content already subject to any such editorial judgment? Generally not, but sometimes, the hopeful eye can discern what appear to be its consequences. Consider the mysterious inconsistency among the results returned when you enter the word "beheading" into the major search engines. On Google and MSN, the top returns are a mixed bag of links to responsible news accounts, historical information, and ghoulish sites that offer raw video with teasers like "World of Death, Iraq beheading videos, death photos, suicides and crime scenes." Clearly, such results are the product of algorithms geared to finding the most popular, relevant, and well-linked sites. But enter the same search term at -Yahoo, and the top returns are profiles of the U.S. and British victims of beheading in Iraq. The first 10 results include links to biographies of Eugene Armstrong, Jack Hensley, Kenneth Bigley, Nicholas Berg, Paul Johnson, and Daniel Pearl, as well as to memorial websites. You have to load the second page of search results to find a link to Ogrish.com. Is this oddly tactful ordering the aberrant result of an algorithm as pitiless as the ones that churn up gore links elsewhere? Or is -Yahoo, perhaps in a nod to the victims' memories and their families' feelings, making an exception of the words "behead" and "beheading," treating them differently than it does thematically comparable words like "killing" and "stabbing?" Yahoo's Osako did not reply to questions about this search-return oddity; certainly, a technological explanation cannot be excluded. But it's clear that such questions are very sensitive for an industry that has, to date, enjoyed little intervention or regulation. In its response to complaints, says Richard Clarke, "the industry is very willing to covperate and be good citizens in order to stave off re-gulation." Whether it goes further and adopts a stricter editorial posture, he adds, "is a decision for the ISP [and Web hosting company] to make as a matter of good taste and as a matter of supporting the U.S. in the global war on terror." If such decisions evolve into the industrywide assumption of a more journalistic role, they could, in the end, be the surest route to a more responsible medium-one that is less easy to exploit and not so vulnerable to a clampdown. David Talbot is Technology Review's chief correspondent. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[i2p] weekly status notes [jan 25] (fwd from jrandom@i2p.net)
by Eugen Leitl 25 Jan '05

25 Jan '05

----- Forwarded message from jrandom <jrandom(a)i2p.net> -----

1 0

PET 2005 Submission deadline approaching (7 Feb) and PET Award (21 Feb)
by R.A. Hettinga 25 Jan '05

25 Jan '05

--- begin forwarded text

1 0

Sun rolls out Identity Auditor
by R.A. Hettinga 25 Jan '05

25 Jan '05

<http://www.infoworld.com/article/05/01/24/04NNsunid_1.html?source=NLC-SEC20…> InfoWorld Sun rolls out Identity Auditor Software applies identity management for repeatable compliance By Cathleen Moore January 24, 2005 Sun Microsystems (Profile, Products, Articles) this week introduced identity audit and compliance software designed to give IT departments visibility into employee identity and system-access activities. The Sun Java System Identity Auditor can help with the difficult and expensive regulatory compliance requirements of reporting on systems and applications, proving internal controls, and giving auditors data on historical access privileges. "Identity - which [covers] who has access to what, who did what, and when - is essential to compliance," said Sara Gates, vice president of identify management at Sun. "The problem Identity Auditor addresses is automating compliance processes companies suffer through." Having visibility into identity and access-related activities is a key part of compliance for certain regulations, most notably Sarbanes-Oxley, said Jonathan Penn, principal analyst of identity and security at Forrester Research. "It may be that only certain systems or data are important to protect under those regulations. But it is important to have insight into who has access to what and why that access has been granted," Penn said. Sun's Identity Auditor makes it easier to implement controls through functionality focused on access-exclusion policies as well as the workflow dealing with conflicts that may arise between users' access rights and policy, Penn said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Everyone an Exhibitionist
by R.A. Hettinga 25 Jan '05

25 Jan '05

<http://online.wsj.com/article_print/0,,SB110661672884334854,00.html> The Wall Street Journal January 25, 2005 BOOKS Everyone an Exhibitionist By HEATHER MAC DONALD January 25, 2005; Page D12 In the debates over the Patriot Act and other antiterrorist measures, a group of critics has emerged who claim that the entire realm of "privacy" is in peril. But such privacy advocates, as we might call them, have a problem even bigger than the government: the public. Despite the advocates' warnings about Big Brother, Americans keep scarfing up every new consumer convenience, regardless of how much personal information is extracted in return. Cell phones, credit cards and the Internet record our tastes, purchases and movements in minute detail. And that computerized portrait does not stay put: Anyone who wants to sell us yet more goodies more efficiently can buy it. In fact, people give away personal information even when they don't have to. In 1998, hundreds of thousands of magazine readers filled out an eight-page, 700-item questionnaire about themselves just because Condi Nast was curious about its subscribers' most intimate medical problems and life-style choices. Americans clearly have a far more relaxed view of privacy than the activists who claim to speak on their behalf. Data collection gets more thorough and more common. Should we worry? Yet the doomsayers carry on. In "No Place to Hide" (Free Press, 348 pages, $26), Washington Post reporter Robert O'Harrow Jr. warns of a future in which most external aspects of our lives end up in a database, potentially available to corporations and law-enforcement officials. The cutting-edge capacities he describes for tracking individuals -- biometric face-scanners, say, or tiny radio transmitters -- are indeed sobering. But he places too much emphasis on what can go wrong with data collection and not enough on its enormous benefits. Despite its impressive scope, "No Place to Hide" presents a lopsided view of the information revolution. In fact, it offers a case study in how to generate a good privacy scare: * Refusing to balance costs and benefits. Mr. O'Harrow presents every horror story he can find about a data system gone awry. Florida authorities bar an eligible voter from voting in the 2000 presidential election in Florida after computers falsely identify him as a felon. Police accuse three innocent women of murder because the surveillance camera on an ATM had an inaccurate clock. (The error was discovered before prosecution.) Such misfirings are regrettable, and every measure should be taken to avoid them. But ATM cameras have much more often deterred or solved crimes than generated false charges. The cost to democratic legitimacy of election fraud outweighs the minimal risk that antifraud technology will disenfranchise eligible voters. Virtually every modern discovery that improves life -- from vaccines to automobiles -- carries risks; balancing those risks against the technology's benefits is a skill that privacy advocates seem to lack. * Ignoring privacy safeguards. "No Place to Hide" chronicles the rise of data warehousing companies, such as Axciom and ChoicePoint, that vacuum up every piece of information about consumers that they can find. After 9/11, these companies offered their databases to national-security agencies to prevent another attack. Since then, federal researchers have feverishly explored how to use such information to track down future terrorists. Mr. O'Harrow worries that the nascent partnership between data companies and the government will result in a surveillance state. But computer experts are just as feverishly exploring how to prevent the misuse of data, such as concealing individual identities until evidence of a crime develops. Mr. O'Harrow is silent on the promising technologies that aim to protect privacy while increasing public safety. * Living in a time warp. For privacy advocates, it's always 1968, when J. Edgar Hoover's FBI was monitoring political activists with no check on its power. But that FBI is dead and gone. In its place has arisen a risk-averse bureau that, in the years preceding 9/11, worried more about avoiding civil-liberties controversies than about preventing terrorism. The red tape that now constrains intelligence-gathering makes a repeat of Hoover's excesses unthinkable. Yet Mr. O'Harrow condemns the most imperative post-9/11 reforms -- e.g., tearing down "the Wall" that once prevented information-sharing within the antiterror community -- as a dangerous power grab. * Sticking with theory over facts. No self-respecting privacy Jeremiad can do without a reference to the Panopticon, the imaginary prison conceived by philosopher Jeremy Bentham that allows the constant surveillance of its inmates. For privacy scolds, we are already imprisoned in the Panopticon, thanks in part to anticrime video cameras on city streets and in private buildings. According to Panopticon theory, surveillance produces a cowed, inhibited society because, as Mr. O'Harrow puts it, "it chills culture and stifles dissent." As it happens, London, Baltimore, Cincinnati and Los Angeles have set up cameras in public spaces, to great fanfare. It would have been easy for Mr. O'Harrow to visit one of those cities to report on the effect. What he would have found is that, rather than skulking against walls or cowering indoors, residents engage in the same exhibitionistic behavior as before, only more so, because more people now feel safe enough to use the streets. We can be thankful that Mr. O'Harrow doesn't try to define privacy, usually an exercise in wind-baggery. It would have been useful, however, if he had disclosed his bottom line. Does he think that personal information should never be used for national security or marketing, or only under certain conditions? By the end of the book, he has criticized so many information systems -- including fingerprinting -- that he would seem to regard as unacceptable any identification method that is not 100% accurate. He sneers at background checks for prospective employees without considering whether even he might jump at the chance to run a criminal scan on a nanny for his children. In any case, it's going to take a lot more than privacy scares to persuade Americans to forgo that next nifty device -- a wristwatch, perhaps, that includes a Global Positioning System, camera and cell phone -- no matter how many consumer companies or cops might want to track its use. Ms. Mac Donald is a contributing editor of the Manhattan Institute's City Journal. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Gripes About Airport Security Grow Louder
by R.A. Hettinga 25 Jan '05

25 Jan '05

<http://online.wsj.com/article_print/0,,SB110661076703534640,00.html> The Wall Street Journal January 25, 2005 THE MIDDLE SEAT By SCOTT MCCARTNEY Gripes About Airport Security Grow Louder More Travelers Are Stopped For 'Secondary' Checks; A Missed Flight to Atlanta January 25, 2005 The frequency of secondary security screening at airports has increased, and complaints are soaring. Roughly one in every seven passengers is now tagged for "secondary screening" -- a special search in which an airport screener runs a metal-detecting wand around a traveler's body, then pats down the passenger and searches through bags -- according to the Transportation Security Administration. Currently, 10% to 15% of passengers are picked randomly before boarding passes are issued, the TSA says. An additional number -- the TSA won't say how many -- are selected by the government's generic profiling system, where buying a one-way ticket, paying cash or other factors can earn you extra screening. And more travelers are picked by TSA screeners who spot suspicious bulges or shapes under clothing. "It's fair to say the frequency of secondary screening has gone up," says TSA spokeswoman Amy von Walter. "Screeners have greater discretion." That may explain why passenger complaints about screening have roughly doubled every month since August. According to numbers compiled by the TSA and reported to the Department of Transportation, 83 travelers complained about screening in August, then 150 in September and 385 in October. By November, the last month reported, complaints had skyrocketed to 652. To be sure, increased use of pat-down procedures in late September after terrorists smuggled bombs aboard two planes in Russia undoubtedly boosted those numbers, though many of those complaints were categorized as "courtesy" issues, not "screening," in the data TSA reports to the DOT. There were 115 courtesy complaints filed with the DOT in September, then 690 in October. By November, the number of courtesy complaints receded to 218. Yet the increased traveler anger at secondary screening hasn't receded. Road warriors complain bitterly about the arbitrary nature of the screening -- many get singled out for one leg of a trip, but not another. For Douglas Downing, a secondary-screening problem resulted in a canceled trip. Mr. Downing was flying from Seattle to Atlanta last fall. He went through security routinely and sat at the gate an hour ahead of his flight's departure. As he boarded, a Delta Air Lines employee noticed that his boarding pass, marked with SSSS, hadn't been cleared by the TSA. He was sent back to the security checkpoint. By the time he got screened and returned to the gate, the flight had departed. Delta offered a later flight, but his schedule was so tight he had to cancel the trip. Delta did refund the ticket, even though the airline said it was the TSA's mistake not to catch the screening code. TSA officials blamed Delta. TSA screeners often blame airlines, according to frequent travelers. Ask a screener why you got picked for screening, and they often say the airline does the selection and questions should be directed to the airline. But airlines say they shouldn't be blamed, since they are only running the TSA's programs, and the TSA's Ms. von Walter concurs. "I wouldn't go so far as to say we're blaming them," she said. "Perhaps some screeners are misinformed in those cases." She also says the TSA isn't sure why screening complaints have risen so sharply since August, although the agency says it may be the result of greater TSA advertising of its "contact center" (e-mail TSA-ContactCenter(a)dhs.gov or call 1-866-289-9673). If you do get picked, here is how it happened. The TSA requires airlines to pick 10% to 15% of travelers at random. Airlines can "de-select" a passenger picked at random, such as a child, officials say. In addition, the government's current passenger-profiling system, called Computer Assisted Passenger Prescreening System, or CAPPS, picks out passengers. The system, which resides in or communicates with each airline's reservation computers, gives you a score based largely on how you bought your ticket. Airline officials say the TSA has changed the different weightings given various factors, and certain markets may have higher programmed rates for selectees. Passenger lists also are checked against the TSA's list of suspicious names, which has included rather common names and even names of U.S. senators. Interestingly, airline gate agents who see suspicious-looking passengers can no longer flag them for security. Some ticket-counter agents did flag several hijackers for extra security on Sept. 11, 2001, and were praised for their work in the 9/11 Commission's final report. At the time, all that meant was the airline took precautions with the hijackers' checked luggage. But because of racial-discrimination concerns, airline officials aren't allowed to single out passengers for scrutiny; only TSA screeners can do that. If picked in advance by the computer system, your boarding pass gets marked some way to identify your "selectee" status. Some airlines print "SSSS" in a corner. When you show up at the checkpoint, you should be picked out as a selectee. The TSA counts on contractors checking boarding passes and driver's licenses to steer you to the selectee line, but that is also why screeners make travelers display boarding passes several times through the gauntlet. At some airports, the TSA also does one final check of boarding passes when you leave the security area -- to check again for selectees. Once checked, the TSA marks your boarding pass so that flight attendants or airline gate agents boarding planes know you got a thorough poking and prodding. The TSA says it hopes the frequency of secondary screening will decline when it gets its new profiling system in place. "Secure Flight" will use passenger records from airlines to, it is hoped, sniff out terrorists. The system will focus on the passenger and not simply how the ticket was bought. The TSA is testing comparing airline bookings against other commercially available information as well as government databases, which has raised privacy concerns. Current testing using historical airline data is supposed to end this month. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 2

Ronald McDonald's SS
by Eugen Leitl 25 Jan '05

25 Jan '05

I'm sure in due time they'll just start calling it Strategic Support, period. http://news.yahoo.com/news?tmpl=story&cid=1802&u=/washpost/20050123/ts_wash… st/a29414_2005jan22&printer=1 Secret Unit Expands Rumsfeld's Domain Sun Jan 23, 1:14 AM ET By Barton Gellman, Washington Post Staff Writer The Pentagon (news - web sites), expanding into the CIA (news - web sites)'s historic bailiwick, has created a new espionage arm and is reinterpreting U.S. law to give Defense Secretary Donald H. Rumsfeld broad authority over clandestine operations abroad, according to interviews with participants and documents obtained by The Washington Post. The previously undisclosed organization, called the Strategic Support Branch, arose from Rumsfeld's written order to end his "near total dependence on CIA" for what is known as human intelligence. Designed to operate without detection and under the defense secretary's direct control, the Strategic Support Branch deploys small teams of case officers, linguists, interrogators and technical specialists alongside newly empowered special operations forces. Military and civilian participants said in interviews that the new unit has been operating in secret for two years -- in Iraq (news - web sites), Afghanistan (news - web sites) and other places they declined to name. According to an early planning memorandum to Rumsfeld from Gen. Richard B. Myers, chairman of the Joint Chiefs of Staff, the focus of the intelligence initiative is on "emerging target countries such as Somalia, Yemen, Indonesia, Philippines and Georgia." Myers and his staff declined to be interviewed. The Strategic Support Branch was created to provide Rumsfeld with independent tools for the "full spectrum of humint operations," according to an internal account of its origin and mission. Human intelligence operations, a term used in counterpoint to technical means such as satellite photography, range from interrogation of prisoners and scouting of targets in wartime to the peacetime recruitment of foreign spies. A recent Pentagon memo states that recruited agents may include "notorious figures" whose links to the U.S. government would be embarrassing if disclosed. Perhaps the most significant shift is the Defense Department's bid to conduct surreptitious missions, in friendly and unfriendly states, when conventional war is a distant or unlikely prospect -- activities that have traditionally been the province of the CIA's Directorate of Operations. Senior Rumsfeld advisers said those missions are central to what they called the department's predominant role in combating terrorist threats. The Pentagon has a vast bureaucracy devoted to gathering and analyzing intelligence, often in concert with the CIA, and news reports over more than a year have described Rumsfeld's drive for more and better human intelligence. But the creation of the espionage branch, the scope of its clandestine operations and the breadth of Rumsfeld's asserted legal authority have not been detailed publicly before. Two longtime members of the House Intelligence Committee, a Democrat and a Republican, said they knew no details before being interviewed for this article. Pentagon officials said they established the Strategic Support Branch using "reprogrammed" funds, without explicit congressional authority or appropriation. Defense intelligence missions, they said, are subject to less stringent congressional oversight than comparable operations by the CIA. Rumsfeld's dissatisfaction with the CIA's operations directorate, and his determination to build what amounts in some respects to a rival service, follows struggles with then-CIA Director George J. Tenet over intelligence collection priorities in Afghanistan and Iraq. Pentagon officials said the CIA naturally has interests that differ from those of military commanders, but they also criticized its operations directorate as understaffed, slow-moving and risk-averse. A recurring phrase in internal Pentagon documents is the requirement for a human intelligence branch "directly responsive to tasking from SecDef," or Rumsfeld. The new unit's performance in the field -- and its latest commander, reserve Army Col. George Waldroup -- are controversial among those involved in the closely held program. Pentagon officials acknowledged that Waldroup and many of those brought quickly into his service lack the experience and training typical of intelligence officers and special operators. In his civilian career as a federal manager, according to a Justice Department (news - web sites) inspector general's report, Waldroup was at the center of a 1996 probe into alleged deception of Congress concerning staffing problems at Miami International Airport. Navy Vice Adm. Lowell E. Jacoby, director of the Defense Intelligence Agency, expressed "utmost confidence in Colonel Waldroup's capabilities" and said in an interview that Waldroup's unit has scored "a whole series of successes" that he could not reveal in public. He acknowledged the risks, however, of trying to expand human intelligence too fast: "It's not something you quickly constitute as a capability. It's going to take years to do." Rumsfeld's ambitious plans rely principally on the Tampa-based U.S. Special Operations Command, or SOCOM, and on its clandestine component, the Joint Special Operations Command. Rumsfeld has designated SOCOM's leader, Army Gen. Bryan D. Brown, as the military commander in chief in the war on terrorism. He has also given Brown's subordinates new authority to pay foreign agents. The Strategic Support Branch is intended to add missing capabilities -- such as the skill to establish local spy networks and the technology for direct access to national intelligence databases -- to the military's much larger special operations squadrons. Some Pentagon officials refer to the combined units as the "secret army of Northern Virginia." Known as "special mission units," Brown's elite forces are not acknowledged publicly. They include two squadrons of an Army unit popularly known as Delta Force, another Army squadron -- formerly code-named Gray Fox -- that specializes in close-in electronic surveillance, an Air Force human intelligence unit and the Navy unit popularly known as SEAL Team Six. The Defense Department is planning for further growth. Among the proposals circulating are the establishment of a Pentagon-controlled espionage school, largely duplicating the CIA's Field Tradecraft Course at Camp Perry, Va., and of intelligence operations commands for every region overseas. Rumsfeld's efforts, launched in October 2001, address two widely shared goals. One is to give combat forces, such as those fighting the insurgency in Iraq, more and better information about their immediate enemy. The other is to find new tools to penetrate and destroy the shadowy organizations, such as al Qaeda, that pose global threats to U.S. interests in conflicts with little resemblance to conventional war. In pursuit of those aims, Rumsfeld is laying claim to greater independence of action as Congress seeks to subordinate the 15 U.S. intelligence departments and agencies -- most under Rumsfeld's control -- to the newly created and still unfilled position of national intelligence director. For months, Rumsfeld opposed the intelligence reorganization bill that created the position. He withdrew his objections late last year after House Republican leaders inserted language that he interprets as preserving much of the department's autonomy. Lt. Gen. William G. Boykin, deputy undersecretary for intelligence, acknowledged that Rumsfeld intends to direct some missions previously undertaken by the CIA. He added that it is wrong to make "an assumption that what the secretary is trying to say is, 'Get the CIA out of this business, and we'll take it.' I don't interpret it that way at all." "The secretary actually has more responsibility to collect intelligence for the national foreign intelligence program . . . than does the CIA director," Boykin said. "That's why you hear all this information being published about the secretary having 80 percent of the [intelligence] budget. Well, yeah, but he has 80 percent of the responsibility for collection, as well." CIA spokeswoman Anya Guilsher said the agency would grant no interviews for this article. Pentagon officials emphasized their intention to remain accountable to Congress, but they also asserted that defense intelligence missions are subject to fewer legal constraints than Rumsfeld's predecessors believed. That assertion involves new interpretations of Title 10 of the U.S. Code, which governs the armed services, and Title 50, which governs, among other things, foreign intelligence. Under Title 10, for example, the Defense Department must report to Congress all "deployment orders," or formal instructions from the Joint Chiefs of Staff to position U.S. forces for combat. But guidelines issued this month by Undersecretary for Intelligence Stephen A. Cambone state that special operations forces may "conduct clandestine HUMINT operations . . . before publication" of a deployment order, rendering notification unnecessary. Pentagon lawyers also define the "war on terror" as ongoing, indefinite and global in scope. That analysis effectively discards the limitation of the defense secretary's war powers to times and places of imminent combat. Under Title 50, all departments of the executive branch are obliged to keep Congress "fully and currently informed of all intelligence activities." The law exempts "traditional . . . military activities" and their "routine support." Advisers said Rumsfeld, after requesting a fresh legal review by the Pentagon's general counsel, interprets "traditional" and "routine" more expansively than his predecessors. "Operations the CIA runs have one set of restrictions and oversight, and the military has another," said a Republican member of Congress with a substantial role in national security oversight, declining to speak publicly against political allies. "It sounds like there's an angle here of, 'Let's get around having any oversight by having the military do something that normally the [CIA] does, and not tell anybody.' That immediately raises all kinds of red flags for me. Why aren't they telling us?" The enumeration by Myers of "emerging target countries" for clandestine intelligence work illustrates the breadth of the Pentagon's new concept. All those named, save Somalia, have allied themselves with the United States -- if unevenly -- against al Qaeda and its jihadist allies. A high-ranking official with direct responsibility for the initiative, declining to speak on the record about espionage in friendly nations, said the Defense Department sometimes has to work undetected inside "a country that we're not at war with, if you will, a country that maybe has ungoverned spaces, or a country that is tacitly allowing some kind of threatening activity to go on." Assistant Secretary of Defense Thomas O'Connell, who oversees special operations policy, said Rumsfeld has discarded the "hide-bound way of thinking" and "risk-averse mentalities" of previous Pentagon officials under every president since Gerald R. Ford. "Many of the restrictions imposed on the Defense Department were imposed by tradition, by legislation, and by interpretations of various leaders and legal advisors," O'Connell said in a written reply to follow-up questions. "The interpretations take on the force of law and may preclude activities that are legal. In my view, many of the authorities inherent to [the Defense Department] . . . were winnowed away over the years." After reversing the restrictions, Boykin said, Rumsfeld's next question "was, 'Okay, do I have the capability?' And the answer was, 'No you don't have the capability. . . . And then it became a matter of, 'I want to build a capability to be able to do this.' " Known by several names since its inception as Project Icon on April 25, 2002, the Strategic Support Branch is an arm of the DIA's nine-year-old Defense Human Intelligence Service, which until now has concentrated on managing military attachis assigned openly to U.S. embassies around the world. Rumsfeld's initiatives are not connected to previously reported negotiations between the Defense Department and the CIA over control of paramilitary operations, such as the capture of individuals or the destruction of facilities. According to written guidelines made available to The Post, the Defense Department has decided that it will coordinate its human intelligence missions with the CIA but will not, as in the past, await consent. It also reserves the right to bypass the agency's Langley headquarters, consulting CIA officers in the field instead. The Pentagon will deem a mission "coordinated" after giving 72 hours' notice to the CIA. Four people with firsthand knowledge said defense personnel have already begun operating under "non-official cover" overseas, using false names and nationalities. Those missions, and others contemplated in the Pentagon, skirt the line between clandestine and covert operations. Under U.S. law, "clandestine" refers to actions that are meant to be undetected, and "covert" refers to those for which the U.S. government denies its responsibility. Covert action is subject to stricter legal requirements, including a written "finding" of necessity by the president and prompt notification of senior leaders of both parties in the House and Senate. O'Connell, asked whether the Pentagon foresees greater involvement in covert action, said "that remains to be determined." He added: "A better answer yet might be, depends upon the situation. But no one I know of is raising their hand and saying at DOD, 'We want control of covert operations.' " One scenario in which Pentagon operatives might play a role, O'Connell said, is this: "A hostile country close to our borders suddenly changes leadership. . . . We would want to make sure the successor is not hostile." Researcher Rob Thomason contributed to this report. -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

4 5

NKS Summer School 2005
by NKS Summer School 25 Jan '05

25 Jan '05

The 2005 NKS Summer School will be hosted at Brown University from June 20 to July 8 and we want to make sure that the best possible candidates have a chance to apply. This is a unique opportunity for graduate students, undergraduates, postdocs, teachers, and professionals to carry out an original NKS project that pursues major educational and career objectives. Each student will work one-on-one with a project mentor and interact directly with Stephen Wolfram. This tuition-free program includes three weeks of lectures, ongoing informal discussions, and plenty of independent time for rigorous scientific research and exploration. We encourage you to apply or to refer anyone who might be interested in pursuing intensive NKS research. Professors or instructors recommending students to this program should send email to nks-summerschool(a)wolfram.com and let us know a little bit about each student. The deadline to apply is March 15. For more information on the 2005 NKS Summer School, go to: http://www.wolframscience.com/summerschool Sincerely, Todd Rowland, Ph.D. NKS Summer School Academic Director Catherine Boucher, Ph.D. NKS Summer School Program Director

1 0