February 2005 - cypherpunks-legacy

Payroll site closes on security worries
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://news.com.com/2102-1029_3-5587859.html?tag=st.util.print> CNET News Payroll site closes on security worries By Robert Lemos Story last modified Wed Feb 23 15:54:00 PST 2005 Online payroll service provider PayMaxx shuttered its automated W-2 site on Wednesday after a researcher claimed that two security holes had exposed data on more than 25,000 people. A description of the problem posted on Think Computer's Web site by Aaron Greenspan, president of the software start-up, said the security issues could allow anyone to view the W-2 forms generated for employees of PayMaxx's clients for the last five years. PayMaxx did not acknowledge or deny the problems, saying that a third-party security company was investigating the allegations. "No system in the world is 100 percent secure from a sophisticated and determined hacker," the Tennessee-based payroll company said in a statement sent to CNET News.com. "PayMaxx has made and continues to make every effort to secure its system against any breach." The incident comes a week after background-check provider ChoicePoint acknowledged that data thieves had created dozens of fake companies to acquire more than 145,000 records touching on the personal lives of U.S. citizens. Federal legislators are considering strong protections on identity data following the ChoicePoint leak, and a class action lawsuit has been filed in California. Greenspan, a former PayMaxx customer, said he discovered the alleged problems in the company's system more than two weeks ago, after he received notification from the company that his W-2 tax form was available online for download and printing. The link to access the W-2 included an ID number, and he wondered whether the company had protected against an obvious security problem: adding one to the ID number to get the next form. Instead of being denied access, Greenspan found that another person's W-2 was downloaded and readable. Sequential, rather than randomized, ID numbers made it easy to call up numerous customers' data. The hole could have allowed employees at PayMaxx's clients to access more than 25,000 W-2 forms for last year and the W-2 forms for years back to 2000, he said. He said his investigation revealed that PayMaxx's database contained a record for testing purposes that contained a Social Security number of 000-00-0000 and a password of all zeros. That could allow anyone to log into the site and then use the lack of authentication to sequentially download all the W-2 forms, Greenspan said. "Anyone could have been exploiting these security issues for years, and no one would have known about it," he said. PayMaxx confirmed that the test account did exist as described in Greenspan's paper, but took issue with other allegations. The company stated that from a review of Greenspan's paper, it had found several of his claims to be inaccurate, but did not specify which claims. While PayMaxx did not confirm the problem, the company did qualify the extent of the damage. "Our initial analysis indicates that if Mr. Greenspan was able to improperly access any W-2 forms, a limited number of forms were accessed," the company said in the statement. That does not contradict Greenspan's claims, since the researcher said that he had only accessed enough of the site to confirm the issue and gauge the extent of the problem. PayMaxx charged that Greenspan had "attempted to hack" into its Web site. It said he had held back details of the alleged flaws and had requested that PayMaxx hire his company. "Due to the lack of specificity provided by Mr. Greenspan in his obvious sales pitch, PayMaxx did not view his communications as credible," the company said. "Consequently, we declined his offer to hire his services." Greenspan acknowledged that he had given PayMaxx few details, but took issue with their lack of response to his security concerns. "I did tell them that there was a problem, and gave them several options to deal with it, and instead they chose to do nothing," Greenspan said. "It is not my job to go around and fix problems for free." PayMaxx declined to comment on whether it had notified any of its customers about the report of a problem. Under California's Security Breach Information Act (S.B. 1386), companies that may have leaked personal or financial data must advise their customers as soon as possible. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Solutions to net security fears
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://news.bbc.co.uk/2/low/technology/4273135.stm> The BBC Friday, 25 February, 2005, 08:10 GMT Solutions to net security fears By Jo Twist BBC News science and technology reporter Fake bank e-mails, or phishing, and stories about ID theft are damaging the potential of using the net for online commerce, say e-business experts. Trust in online security is falling as a result. Almost 70% of those asked in a poll said that net firms are not doing enough to protect people. The survey of more than 1,000 people reported that 43% were not willing to hand over personal information online. It is worrying for shopaholics and firms who want to exploit the net. More people are becoming aware of online security issues but they have little confidence that companies are doing enough to counter the threats, said security firm RSA, which carried out the poll. An estimated 12 million Britons now use the net as a way of managing their financial affairs. Security experts say that scare stories and the vulnerabilities dogging e-commerce and e-banking are being taken seriously - by banks in particular. Who are you? "I don't think the threat is overplayed," Barry Beal, global security manager for Capgemini, told the BBC News website. He added: "The challenge for banks is to provide the customer with something that improves security but balances that with usability." Ensuring extra security measures are in place protects them too, as well as the individual, and it is up to both parties to make sure they do what is necessary to prevent fraud, he said. "Card issuers will keep us informed of types of attacks and what procedure to take to protect ourselves. If we do that, they will indemnify us," he said. Many believe using login details like usernames and passwords are simply not good enough anymore though. One of the biggest challenges to improving security online is how to authenticate an individual's identity. Several security companies have developed methods which complement or replace passwords, which are easily compromised and easy to forget. Last year, a street survey found that more than 70% of people would reveal their password for a bar of chocolate. On average, people have to remember four different passwords. Some resort to using the same one for all their online accounts. Those who use several passwords often write them down and hide them in a desk or in a document on their computer. In a separate survey by RSA, 80% said they were fed up with passwords and would like a better way to login to work computer systems. For many, the ideal is a single online identity that can be validated once with a series of passwords and questions, or some biometric measurement like a fingerprint or iris scan with a token like a smartcard. Token trust Activcard is just one of the many companies, like RSA Security, which has been trying to come up with just that. RSA has a deal with internet provider AOL that lets people pay monthly for a one-time passcode generation service. Users get a physical token which automatically generates a code which stays active for 60 seconds. Many companies use a token-based method already for employees to access networks securely already. Activcard's method is more complex. It is currently trailing its one-time passcode generation technology with UK banks. Steve Ash, from Activcard, told the BBC News website there are two parts to the process of identification. The most difficult is to ascertain whether an individual is who they say they are when they are online. "The end solution is to provide a method where you combine something the user knows with something they have and present those both." The method it has developed makes use of the chip embedded in bank cards and a special card reader which can generate unique codes that are active for a specified amount of time. This can be adjusted at any time and can be active for as little as 30 seconds before it changes. It combines that with usual usernames and passwords, as well as other security questions. "You take the card, put it in the reader, enter your pin number, and a code is given. "If you wanted then to transfer funds, for instance, you would have to have the code to authorise the transaction." The clever bit happens back at the bank's secure servers. The code is validated by the bank's systems, matching the information they expect with the customer's unique key. "Each individual gets a key which is unique to them. It is a 2048-bit long number that is virtually impossible to crack," said Mr Ash. It means that in a typical security attack, explains Mr Ash, even if password information is captured by a scammer using keystroke software or just through spoof websites, they need the passcode. "By the time they go back [to use the information], the code has expired, so they can't prove who they are," according to Mr Ash. In the next few years, Mr Ash predicts that this kind of method will be commonplace before we see biometric authentication that is acceptable for widespread use. "PCs will have readers built into them, the cost of readers will be very cheap, and more people will have the cards." The gadgets we carry around, like personal digital assistants (PDAs) and mobiles, could also have integrated card reader technology in them. "The PDA or phone method is a possible alternative as people are always carrying phones around," he said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Study: Security fears daunt online shoppers
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://news.zdnet.com/2102-1009_22-5575569.html?tag=printthis> ZDNet By Dawn Kawamoto URL: http://news.zdnet.com/2100-1009_22-5575569.html One-fourth of online shoppers have reduced their purchases in the past year as concerns over identity theft have risen, according to a survey released Monday. That increased reluctance to shop online comes as Americans become more aware of the possible risks, the consumer study by RSA Security indicated. Some 61 percent of respondents said they feel more informed about identity theft issues, and 23 percent noted they feel more vulnerable than they did a year ago. "Clearly, there's a lot of work to be done if businesses want to build more online trust with consumers," John Worrall, vice president of worldwide marketing at RSA Security, said in a statement. "While awareness of threats remains high, consumer confidence in dealing with those threats is low." The third annual study asked more than 1,000 U.S. consumers about how their attitudes to identity theft, computer attacks and other security issues had changed over the past two years. The results were released to coincide with the annual RSA security conference, which gets under way in San Francisco this week. Financial institutions, which hope to move more customers to online banking as a means to cut their operational costs, continue to face resistance. Twenty-one percent of consumers refuse to use online banking, the survey found. Banks have been particular targets of the rapid rise in phishing attacks, as attackers find that money can be made by luring victims into handing over sensitive information such as social security numbers and bank account details. The survey found that more than half of respondents felt traditional user IDs and passwords do not provide adequate security. Despite this, people also said they have not changed their approach to password use. Two out of three Web users said they use fewer than five passwords for all access to electronic information. Of the total, 15 percent said they use a single password. Those results have not changed from last year, RSA said. The majority of consumers, nearly 70 percent, felt the online merchants they do business with are falling short on protecting their personal information. Another report, released jointly by the Business Software Alliance and the Information Systems Security Association on Monday, found that companies are increasingly sending the responsibility of overseeing security to the executive suite. Forty-four percent of businesses surveyed last year said their senior management is responsible for security, up from 39 percent in 2003. But the number of security professionals who believe a major cyberattack will occur in the next 12 months has declined over the past year, the report said. The figure has dropped to 59 percent last year, from 65 percent in 2003. "This survey demonstrates that awareness and action are replacing fear," Robert Holleyman, BSA's chief executive, said in a statement. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

China walks out of wireless LAN security talks
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://www.commsdesign.com/printableArticle/;jsessionid=IUWFMVHO5S3NAQSNDBG…> China walks out of wireless LAN security talks Patrick Mannion Feb 24, 2005 (12:26 PM) MANHASSET, N.Y. - China walked out of a wireless standards meeting this week, accusing the International Organization for Standardization of favoring the IEEE's 802.11i ANSI-certified wireless LAN security scheme over its own controverisal proposal, EE Times has learned. The gambit came after China's Wireless Authentication and Privacy Infrastructure (WAPI) security scheme was withdrawn and placed on a slower track by the ISO. This week's meeting in Sulzbach, Germany, included the ISO/IEC JTC1 SC6 WG1 working group created to resolve the dispute. China initially agreed last year to refrain from making its WAPI security scheme mandatory for wireless LAN equipment in China. It then approached ISO with a fast-track submission in an effort to make WAPI an international security standard. The 802.11i proposal is also on the fast-track for ISO approval, possibly by April. Until this week, the ISO group was focused on whether or not both 802.11i and WAPI should be cemented as enhanced - but optional - security standards. However, sources said tempers flared when China's original fast-track submission, designated 1N7506 of China National Standard GB15629.11 (WAPI), was withdrawn from consideration. It was replaced by a revised submission, designated 6N12687, that removed the China proposal from the organization's fast-track approval process. The withdrawal was based on a procedural issue, according to a source, and the clock for approval was reset indefinitely to a later submission. The result is a delay in moving the WAPI proposal through ISO. Sources said China walked out specifially over disputes centering on which members have authority to seek a withdrawal and the timing of the request. Chinese delegates also accused ISO of favoring the IEEE 802.11i proposal. It remains unclear for now whether the dispute will affect the current suspension of China's original law requiring mandatory implementation of WAPI. The IEEE is currently drafting a formal response, but declined to comment. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Arab Bank Told by U.S. to Restrict Wire Transfers (Update5)
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://www.bloomberg.com/apps/news?pid=10000103&sid=atzqhwfJoPgc&refer=us> Bloomberg Arab Bank Told by U.S. to Restrict Wire Transfers (Update5) Feb. 25 (Bloomberg) -- Arab Bank Plc, the target of lawsuits by relatives of victims of terrorist attacks in the Middle East, was ordered by a U.S. regulator to restrict wire transfers and stop taking deposits at its New York branch. Amman, Jordan-based Arab Bank, the third-largest Arab lender, failed to monitor fund transfers at the branch for suspicious activity and to obtain enough information about them, the Office of the Comptroller of the Currency said in a consent order released in Washington today. The bank neither admitted nor denied wrongdoing. ``The inadequacy of the branch's controls over its funds transfer business is especially serious in light of the high-risk characteristics of many of the transactions,'' the OCC said. The order, which didn't mention the lawsuits, requires Arab Bank to pay off or transfer all deposit accounts and wind down money transfers at the New York branch, all but ending the branch's ability to do business as a traditional bank. The 75- year-old bank, which will now focus its New York business on trade and corporate finance, must also provide a daily report to the OCC of assets and keep all records in English. Bank spokeswoman Heather Geisler said transfers were a small part of the branch's operations. She said the branch dealt mostly with trade and corporate finance. U.S. regulators have intensified their surveillance of money transfers since the terrorist attacks of September 11, 2001. Families of victims of the attacks have used courts to target Arab individuals, banks and governments, including Saudi Arabia. The families that sued Arab Bank are seeking $2 billion in damages. Suits The suits, filed July 2 and Jan. 21 in a U.S. District Court in Brooklyn, say that the Saudi Committee in Support of the Intifada Al-Quds used Arab Bank to make at least six payments of 20,000 Saudi riyals ($5,332) each to relatives of bombers and gunmen. The charity has raised more than $100 million to aid Palestinians injured in the conflict with Israel. Chief Banking Officer Shukry Bishara said in an interview this month that Arab Bank didn't know the payments were going to families linked to the attacks. ``Nothing in the consent agreement asserts that transactions happened that were not supposed to,'' Geisler said in an e-mail. ``But rather it talks about weaknesses in Arab Bank's ability to report potentially suspicious activity.'' Nofal Barbar, regional manager for Arab Bank, wasn't available for comment, his office said. The bank's New York branch, its only one in the U.S, is on the second floor of an office building on Madison Avenue in midtown Manhattan. The bank has 22 branches in the West Bank and Gaza Strip and $2 billion in deposits. ``Arab Bank is committed to achieving and implementing best practices in the rapidly evolving area of transactional reporting,'' Bishara said in a statement today. ``This agreement builds on and will help strengthen our internal controls and will give our customers and regulators even more confidence in the safety and security of Arab Bank.'' Bishara said in a Feb. 7 interview that the bank might close the New York branch. Under the consent order, the bank can operate on a restricted basis in the U.S. provided it maintains ``quality'' assets to cover debits and protect the U.S. deposit insurance fund. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

U.S. claims deficiencies at N.Y. Arab Bank
by R.A. Hettinga 26 Feb '05

26 Feb '05

<http://seattlepi.nwsource.com/printer/ap.asp?category=1310&slug=Arab%20Bank> SEATTLE POST-INTELLIGENCER Friday, February 25, 2005 7 Last updated 2:49 p.m. PT U.S. claims deficiencies at N.Y. Arab Bank By MARCY GORDON AP BUSINESS WRITER WASHINGTON -- U.S. regulators said Friday that Arab Bank PLC, one of the largest financial institutions in the Middle East, has inadequate controls against money laundering at its New York branch and has been ordered to stop transferring funds or opening new accounts there. In an unusual move, the Office of the U.S. Comptroller of the Currency, a Treasury Department agency, said the branch was being converted into an entity that will not conduct traditional banking activities but will continue to engage in corporate and trade financing. Jordan-based Arab Bank, with operations in 30 countries, faces several lawsuits in the United States by relatives of terrorism victims in Israel who allege it supported terrorism by funneling donations to Palestinian suicide bombers and their families. The bank, which had said recently it would close the New York branch, agreed to the conditions in a consent order with the comptroller's office. "The inadequacy of the branch's controls over its funds transfer business is especially serious in light of the high-risk characteristics of many of the transfers," the comptroller's office said in the order, which was dated Thursday and announced Friday. Rep. Sue Kelly, R-N.Y., who heads a House subcommittee that has investigated terrorists' use of the U.S. financial system, called the action by the comptroller's office encouraging but added, "I remain deeply concerned about reports of Arab Bank's role in supporting terrorism and look forward to learning additional facts regarding this situation in the coming weeks and months." Families of about 40 U.S. citizens killed in terrorist attacks in Israel sued Arab Bank in federal court in New York City last summer, accusing it of channeling money to Palestinian terrorist groups and of making insurance payments to beneficiaries of suicide bombers. "This isn't the time to declare victory," Gary M. Osen, an attorney representing the families, said Friday. "The Treasury Department has taken an important step by setting up a process for closing Arab Bank's U.S. operations, but we're a long way from a full reckoning with Arab Bank for what they've done." The plaintiffs also allege that the Texas-based Holy Land Foundation for Relief and Development used Arab Bank's New York branch to transfer money to Hamas, a Palestinian terrorist organization blamed for dozens of attacks in Israel. The Justice Department in August indicted the Holy Land Foundation on charges of providing millions of dollars in support to Hamas. Officials of Arab Bank have called those allegations "completely false and totally irresponsible." In a statement Friday, Shukry Bishara, Arab Bank's chief banking officer, said the agreement with the U.S. regulators "will help strengthen our internal controls and will give our customers and regulators even more confidence in the safety and security of Arab Bank." The decision to close the New York branch was announced earlier this month by the Central Bank of Jordan, which oversees the operations of Arab Bank - the kingdom's largest financial institution with some $32 billion in assets. The bank is partly owned by the prominent Palestinian Shoman family, and its shareholders include the Saudi Oger Co., which was owned by former Lebanese Prime Minister Rafik Hariri, who was killed on Feb. 14 in a bombing in Beirut. -- On the Net: Office of the Comptroller of the Currency: http://www.occ.treas.gov Arab Bank PLC: http://www.arabbank.com -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

U.S. wants passenger names one hour before takeoff
by R.A. Hettinga 25 Feb '05

25 Feb '05

<http://www.upi.com/view.cfm?StoryID=20050224-105943-7064r> United Press International U.S. wants passenger names one hour before takeoff By Shaun Waterman UPI Homeland and National Security Editor Published 2/24/2005 11:25 PM WASHINGTON, Feb. 24 (UPI) -- The Department of Homeland Security is drafting a rule that will require airlines to pass on passenger manifest information as much as an hour before the departure of international flights bound for the United States, officials confirmed to United Press International Thursday. "We need to be able to identify any suspected terrorists or other criminals (on board) before the plane takes off," Christiana Halsey of the department's Customs and Border Protection directorate said, adding that the department was working on a so-called Notice of Proposed Rule Making -- the first legal step down the regulatory path. The regulation then goes through several drafts, each of which is published for comment by interested parties before being finalized by the White House's Office of Management and Budget. Industry representatives declined to comment for the record in advance of the notice's publication but fretted privately that the logistical demands would be another blow to the financially battered airlines. One congressional official suggested that the federal government might have to underwrite any additional costs incurred. Halsey said that the passenger names would, as at present, be checked by the directorate's National Targeting Center against the United States' consolidated terrorist watchlist -- which contains the names and aliases of thousands individuals thought linked to terrorism -- and against several other law-enforcement databases. "We're not just looking for terrorists," she said. All that would change is that airlines would have to submit the data up to one hour before the plane takes off, rather than within 15 minutes of departure under current procedures. Other knowledgeable sources said the rule would also cover passengers who wanted to transit the United States on their way somewhere else, but Halsey said she had no information about that. In August 2003 the so-called Transit-Without-Visa program -- under which foreigners with onward flights could enter U.S. airline transit lounges regardless of whether they were entitled to enter the country or not -- was suspended indefinitely by the United States. The program was beneficial for airlines and U.S. airports, which foreigners could use as hubs for intercontinental flights without having to obtain a U.S. visa. But the interrogation of Sept. 11, 2001, planner Khalid Sheikh Mohammed and other detainees had revealed that the al-Qaida terror network saw the program as a loophole in U.S. border security -- a way to get potential hijackers into planes over American cities. The option the department is currently working on, according to one person familiar with it, would create one group of passengers -- U.S. citizens, foreign visa holders and nationals of Canada and the so-called visa-waiver nations -- who could transit the country without additional security checks. Nationals of a second group of countries would also be eligible to transit if their passenger information was received long enough in advance of their departure. Now that there is a single terror watchlist, officials explain, it makes much less difference whether it is checked weeks in advance of a trip by a consular officer at a U.S. embassy as part of a visa issuance process or hours in advance of a plane's departure by a Customs and Border Protection official at the directorate's National Targeting Center. Indeed, the proposed change to the rule about the passenger manifests -- known as the Advanced Passenger Information System -- overlaps with and to a certain extent renders moot the protracted tussle between Homeland Security and the European Union over the so-called Passenger Name Record. PNR data, a much more extensive record including credit-card and frequent-flyer details as well as religious dietary preferences, has -- partly for that reason -- become a real cause celebre among privacy advocates in Europe, while APIS, which has been submitted by airlines to U.S Immigration and Customs authorities for years, has largely escaped notice. Officials insist -- not entirely convincingly -- that, either way, getting passenger information to U.S. authorities early will benefit the airlines and their customers. Over the past year several transatlantic flights have been diverted -- generally to Bangor, Maine, the Eastern-most major U.S. airport -- after it emerged that one or more passengers on board were matches for individuals with suspected terror links. In the most celebrated case a Washington, D.C.-bound jetliner was diverted last September after officials discovered that Yusef Islam -- better known as the singer Cat Stevens -- was on board. He was deported after being questioned. Officials said at the time that his name was on a "no fly" list and that he should not have been allowed to board the plane. And during the winter of 2004 a dozen flights from London and Paris were canceled -- in some cases after names thought linked to terrorism turned up on passenger manifests. "If we get the information in advance," said Halsey, "we can minimize -- if not entirely eliminate" such costly diversions and cancellations. "They are inconvenient for the passengers and expensive for the airlines." But airlines seem unlikely to welcome the move, nonetheless. "We are not going to comment until we see something definitive," said Diana Cronin of the Air Transport Association, which represents major U.S. carriers. Other industry sources said privately the move could create serious logistical problems for airlines, which currently do not finalize their passenger manifests until the doors of the plane close at the gate as the plane departs. "Airlines make money when their planes are in the air," said one industry lobbyist, pointing out that anything that increases wait times between flights would squeeze an industry already beset by financial crisis. "From our perspective," Ed Fluhr, manager of legislative affairs at the Travel Industry Association of America, told UPI, "the U.S. government recently has done a good job of explaining new security measures" such as the digital fingerprinting and photographing of all foreign visitors arriving by air and sea under the US-VISIT program. But he added that, "Anything that adds to the perception -- or the reality -- of unnecessarily intrusive security measures can be a reason for a traveler to go elsewhere." DHS spokesman Dennis Murphy said the department was very sensitive to the needs of the traveler and the airline industry. "The objective is to get the information early enough in the process without unduly impacting airlines and their passengers. "We are making a huge effort to counter the impression of fortress America," he said, alluding to fears that the introduction of US-VISIT would damage the image of the United States as a tourist destination. Such concerns have so far proved largely groundless, although some industry analysts fret that the weak dollar may be masking the deterrent effect on visitors from Europe and Asia of being fingerprinted upon entry. Nonetheless, officials say they recognize industry concerns about the logistical issues the new rule raises and are working with the airlines to allay them. "We know there are issues with connecting flights," said Halsey. "We know there is concern" about passengers who arrive or cancel their departure at the last minute. "We know there might be additional costs." She said the department was listening to the industry's concerns. "We need the stakeholders on board," she said. One senior congressional staffer was dismissive of industry concerns. "They'll complain about the cost, they'll warn about delays. ... They'll make problems," he said, adding, "No one likes to be regulated. ... That's capitalism." He predicted that, in the end, the airlines would "suck it up" but try to stick the taxpayer with any bill. "There may be cost issues," he said, adding that the industry "lived and died by its margins." When Congress mandated hardened cockpit doors in the aftermath of the Sept. 11 attacks, the staffer recalled, lawmakers made sure the industry was reimbursed for the cost. "If that (additional cost of the new rule) can be demonstrated, I'm sure Congress would be receptive to the idea of doing that again," he said. None of the officials UPI spoke to cared to make a prediction about when the rule notice would be published. "It is still in the inter-agency process," said Murphy. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

FW: T-Shirt and Securing Wireless Apps in Vertical Markets Webinar from Unstrung
by Tyler Durden 25 Feb '05

25 Feb '05

>Dear Colleague, > >As an industry professional, you may be interested to know about an >upcoming online event being presented by Unstrung (www.unstrung.com) the >worldwide source for analysis of the wireless economy. This free Web >seminar - "Securing Wireless Applications in Vertical Markets" - will >evaluate recent progress in a critical sector. The benefits of deploying >wireless technology in vertical markets are well documented, but security >issues continue to be the main concern holding back widespread wireless >adoption in these environments. Keeping information out of the hands of >interlopers has become a critical task for any net manager. > >During this presentation we'll focus on: > >- The critical role of security in vertical markets - why does it matter? >- The diverse security demands of different vertical markets >- Potential effects of wireless network attacks in different markets >- Case studies of deployments in vertical markets and lessons learned >- Securing today's wireless networks and emerging future technologies > >Join us on Wednesday, March 2, at 2:00 p.m. New York / 7:00 p.m. London >time, for this live Webinar sponsored by AirTight Networks, Bluesocket, and >Newbury Networks. It's free. What's more, to thank you for your >participation you'll receive a complimentary Unstrung t-shirt. > >Click here to view the Unstrung t-shirt: > >http://img.lightreading.com/unstrung/unstrung_shirt.gif > >To sign up for the Webinar, please register through the following link: > >http://metacast.agora.com/link.asp?m=23979&s=4936527&l=0 > >We hope to see you there! > >Unstrung

1 0

test message, please ignore
by Riad S. Wahby 25 Feb '05

25 Feb '05

see subject -- Riad S. Wahby rsw(a)jfet.org

1 0

None
by somebody 25 Feb '05

25 Feb '05

Gecko/20040910 To: "R. A. Hettinga" <rah(a)shipwright.com> Subject: TCPA_DEFCON_10.pdf (application/pdf Object) Bob -- This is not the world I desired, damnit! --------- Require third parties to provide the service. Alice and Bob agree that Carol shall provide free beer to all comers in perpetuity. <http://www.cypherpunks.to/TCPA_DEFCON_10.pdf> -- <somebody's .sig> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0