February 2005 - cypherpunks-legacy

None
by somebody 24 Feb '05

24 Feb '05

Gecko/20040910 To: "R. A. Hettinga" <rah(a)shipwright.com> Subject: TCPA_DEFCON_10.pdf (application/pdf Object) Bob -- This is not the world I desired, damnit! --------- Require third parties to provide the service. Alice and Bob agree that Carol shall provide free beer to all comers in perpetuity. <http://www.cypherpunks.to/TCPA_DEFCON_10.pdf> -- <somebody's .sig> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

George Will: Taking the streets back
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.townhall.com/columnists/georgewill/printgw20050224.shtml> Townhall.com Taking the streets back George Will (back to web version) | Send February 24, 2005 CHICAGO -- He looks like the actor Wilfred Brimley -- round as a beach ball; grandfatherly gray mustache -- but Philip J. Cline, this city's police superintendent, is, like his city, hard as a baseball. And as they say in baseball, he puts up numbers. Actually, he and his officers have driven some crucial numbers down. Last year homicides reached a 38-year low of 448, 25 percent below 2003's total of 600, which was lower than the 2002 and 2001 totals of 654 and 668. Nationally, homicides declined steadily after the peak of dealer-on-dealer violence in the crack cocaine epidemic of the late 1980s and early '90s. But the decline was slow in Chicago, where in 2001, 2002 and 2003 it ranked second, first and second among cities in the number of murders, not just the murder rate. In the last third of the 20th century, Chicago violence killed more than 28,000 people -- the population of many Illinois towns. In an American city, as in Baghdad, which is about the size of Chicago, the key to policing against violence is intelligence and other cooperation from a population that trusts the police. Which means, Cline says, replacing random patrols with strategic deployments of officers. He says 50 percent of Chicago's homicides are gang-related. Gang membership, now an estimated 65,000 strong, used to be a rite of passage for young men. Now it is increasingly a career choice for men turning the gangs into business organizations selling drugs and investing the proceeds in, among other things, real estate. One-third of the drug customers are suburbanites. Video on a police department laptop displays facets of the problem. One clip shows dealers giving away, in broad daylight, free samples to droves of potential customers. Another clip shows mass marketing as customers, again in midday, are walked, in groups of several dozen, across a street to a playground to make their purchases. Another clip shows a violent felon being released from Joliet prison, heading for Chicago but first visiting Indiana, thereby violating his terms of release. He was rearrested two hours out of prison. ``A land speed record,'' says Cline. Fewer than 10 percent of Chicago murder victims are white. And as a mordant student of murder says, ``There's always a correlation between homicides and ice cream trucks.'' Most victims are killed in hot weather, from May to October, mostly in July and August, when people are mingling -- and often drinking -- on stoops and street corners, and are irritable. The crime-infested Robert Taylor high-rise housing projects on the South Side have been closed and the Cabrini-Green project on the near North Side is being closed, which means a jostling for social space among displaced drug dealers. Cline says there were about 100 open-air drug markets in the city last year. Police closed about half of them, producing more displacements as markets opened elsewhere in the city. This process is frustrating but constructive because it means some slowing of the drug trade. But it can also cause an uptick in violence as dealers contest desirable turf. Cline says that when 100 markets are each pulling in $5,000 a day, serious money is at stake. Some of the money buys the guns that settle struggles for turf. Last year police seized 10,509 guns -- 29 a day. They probably will seize as many this year; they did in 2003. But this is not an exercise in bailing the ocean: Stiff sentences for gun possession, and stiffer ones for firing a gun, put a high price tag on regarding a gun as fashion necessity for the well-accessorized young man. Last year about 18,000 of the inmates released from Illinois prisons came back to Chicago; perhaps 25,000 will this year. Some of the returning convicts come home expecting to reclaim their shares of the drug business. Some of the younger dealers will decide it is easier to kill them than accommodate them. A new ``shot spotter'' technology can detect the trajectory of a bullet and direct a camera that scans 360 degrees. Soon there will be 80 such cameras watching strategic intersections. There is nothing surreptitious about this -- indeed, the cameras have blue lights and Chicago Police Department logos. The CPD wants dealers to know the area is being watched. The cost of the cameras is paid by seized assets from dealers. So, Cline says contentedly, ``they're paying to surveil themselves.'' Cline says the message to the neighborhoods is: ``We will take the corner back. You must hold the corner.'' Again, as in Baghdad. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Lucky Green: TCPA, the Mother(board) of all Big Brothers
by R.A. Hettinga 24 Feb '05

24 Feb '05

--- begin forwarded text

2 1

Peppercoin and SunTrust ink micropayments deal
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.finextra.com/fullstory.asp?pf=y&id=13273> News Finextra: Peppercoin and SunTrust ink micropayments deal Published: 22/02/2005 14:20:00 US micropayments firm Peppercoin has inked an alliance deal with SunTrust Merchant Services, a joint venture between SunTrust Banks and First Data Corporation, to deliver a small payments processing service to merchants. Reino Parking Systems has been signed as the first client. Peppercoin's Small Transaction Suite cuts processing costs for sub-$20 transactions conducted via conventional debit and credit cards. The SunTrust tie-up follows a similar recent agreement with Chase Merchant Services. Mark Friedman, president of Peppercoin, says: "With our joint solution, SunTrust Merchant Services' 67,000 business clients can immediately convert small cash payments, a $1.32 trillion annual market, to credit and debit card payments." Barbara Roeber, general manager/SVP, SunTrust Merchant Services, says the firm has recorded "a dramatic increase in demand for small payments capability" in the past six months. "Peppercoin's solution is the only one that supports our merchants' needs for digital, mobile and physical point of sale transactions." Reino Parking Systems has begun deployment for the processing of credit card transactions at Multispace parking meters in various US locations. The meters will be able to accept payment via credit card and mobile phone and consumers can elect to receive text messages alerting them to expiry times. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Chatter Punks
by John Young 24 Feb '05

24 Feb '05

Maybe it's been mentioned here but the book, "Chatter: Dispatches from the Secret World of Global Eavesdropping," by Patrick Radden Keefe mentions cypherpunks and a slew of people who've been around here, or discussed, cited, admired, attacked and hated here. Crypto is featured, along with the TLAs, the fools who run them, the lackies who suck their tits, the congress critters who give them a free pass no matter what fuck-ups damage the US and the unwary targets of spooks, 9/11 only one of many. It's a "lively read," and a lot of its smooth-narrative content won't be new to avid readers of disputatious, thankfully ungrammatically cpunks, but it does get the slick word out to the public in an easy to swallow fashion. For us jacket addicts, there are favorable blurbs by David Kahn and Seymour Hersh. Keefe calls John Gilmore, Duncan Campbell, and other uninstitutionalized insurgents outcasts, but IEDs are where it's at, right? He also claims the NSA is a pitiful giant, protected against change by ever increasing secrecy blessed by congress and the administration, and that most of its new hires are security guards to protect against knowing what's inside, not the personnel truly needed.

1 0

U.N.: Register every baby born
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.worldnetdaily.com/news/printer-friendly.asp?ARTICLE_ID=43005> WorldNetDaily Wednesday, February 23, 2005 THE NEW WORLD DISORDER U.N.: Register every baby born Desmond Tutu launches global campaign, claiming unlisted children 'nonentities' Posted: February 23, 2005 4:23 p.m. Eastern Desmond Tutu in New York urging registration of all children The United Nations is supporting a new campaign urging governments around the world to register every newborn child, and it's getting help from South African Archbishop Desmond Tutu. ''It is, in a very real sense, a matter of life and death,'' the Nobel Peace Prize winner said at a New York news conference. ''The unregistered child is a nonentity. The unregistered child does not exist. How can we live with the knowledge that we could have made a difference?'' The campaign, called "Write me down, make me real," is backed by UNICEF and calls on governments to record the estimated 48 million children whose births go unregistered each year. Sixteen years ago, the U.N. Convention on the Rights of the Child told countries to register every baby immediately after birth. Every nation has ratified the convention except two, the U.S. and Somalia. The aid agency Plan USA has released a report titled ''Universal Birth Registration - a Universal Responsibility.'' While it acknowledges it's impossible to know for sure how many unregistered children actually exist because they're not counted, estimates have suggested the figure is over half a billion. It lists percentages of children not registered by region: Sub-Saharan Africa: 71 percent South Asia: 63 percent Middle East and North Africa: 31 percent Asia Pacific: 22 percent Latin America/Caribbean: 14 percent CEE/CIS and Baltic states: 10 percent Industrialized countries: 2 percent "Governments worldwide are failing the world's children, as millions of youngsters without a birth certificate find it very difficult to prove their age or nationality," said Thomas Miller, Plan's chief executive. "Children without birth certificates are far more likely to find themselves without access to education, health care, civil rights or inheritance laws. "And parents whose children go missing during disasters like the tsunami or because they are abducted by traffickers may even be unable to get help with tracing their sons or daughters because they cannot prove the age of their children - or in many cases that their children even exist." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Feds square off with organized cyber crime
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.theregister.co.uk/2005/02/23/feds_nostalgic_for_old_school_hacke…> The Register Biting the hand that feeds IT The Register ; Security ; Network Security ; Feds square off with organized cyber crime By Kevin Poulsen, SecurityFocus (klp at securityfocus.com) Published Wednesday 23rd February 2005 22:08 GMT RSA 2005 Computer intruders are learning to play well with others, and that's bad news for the Internet, according to a panel of law enforcement officials and legal experts speaking at the RSA Conference in San Francisco last week. Christopher Painter, deputy director of the Justice Department's computer crime section, spoke almost nostalgically of the days when hackers acted "primarily out of intellectual curiosity." Today, he says, cyber outlaws and serious fraud artists are increasingly working in concert, or are one and the same. "What we've seen recently is a coming together of these two groups," said Painter. Ronald Plesco, counsel to the National Cyber-Forensics and Training Alliance, a computer forensics organization established by the FBI and private industry, agreed, and pointed to the trend in recent years of spammers building networks of compromised computers to launder their fraudulent email offerings. Tim Rosenberg, a research professor at the George Washington University, warned of "multinational groups of hackers backed by organized crime" and showing the sophistication of prohibition-era mobsters. "This is not about little Jimmy Smith breaking into his ex-employer's website and selling information to competitors," he said. "What we're seeing is just sheer, monstrous" levels of crime." Painter acknowledged that recreational hackers are still out there, but he believes they're a minority. He reads the future of cyber crime and investigation in the joint Secret Service and Justice Department "Operation Firewall" crackdown on Internet fraud rings last October, in which 19 men were indicted for allegedly trafficking in stolen identity information and documents, and stolen credit and debit card numbers. At the center of Operation Firewall was an online forum called Shadowcrew, which served as the trading floor for an underground economy capable of providing a dizzying array of illicit products and services, from credit card numbers to details on consumers worthy of having their identities' stolen. "Individuals all over the world would work together to hack into systems, steal information and then sell information," said Painter. "[It was] a very, very highly structured, organized network." Faced with that kind of organization, law enforcement agencies are turning to undercover operations, said Painter. To take down Shadowcrew, the Secret Service secretly busted a high level member of the group, turned him into an informant, and operated him undercover for more than a year, according to court records. "Law enforcement was essentially running that group at one point," said Painter. Painter prosecuted Kevin Mitnick in the 1990s, and he still insists that, from the victim's point of view, old-fashioned recreational hackers are as bad as today's multi-disciplined cyber criminals. "But it was a simpler time," he admitted after the presentation. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

FCC 'crosses the line' with broadcast flag - court
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.theregister.co.uk/2005/02/23/broadcast_flag_in_trouble/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2005/02/23/broadcast_flag_in_trouble/ FCC 'crosses the line' with broadcast flag - court By Thomas C Greene in Washington (thomas.greene at theregister.co.uk) Published Wednesday 23rd February 2005 21:48 GMT The US Federal Communications Commission (FCC) overstepped its authority by requiring devices capable of receiving digital TV broadcasts to recognize data called a 'broadcast flag' that can prevent copying, a federal judge has said. US Circuit Judge Harry Edwards told the FCC that it had "crossed the line" when it required DRM technology to be included in all DTV devices on sale in the USA from 1 July. This would include TVs, set top boxes, PC tuner cards, VCRs, DVD players, and similar devices. The FCC argued that its ancillary powers authorize it to regulate the reception of broadcasts, not just their transmission. While Congress did not authorize the Commission to regulate the proper designs of the devices, it also didn't expressly forbid it, which FCC takes as a license to issue specifications. "Ancillary does not mean you get to rule the world," judge Edwards observed. Judge David Sentelle wondered if FCC thought it could regulate washing machines, since Congress didn't expressly forbid that, either. In response to FCC whining that without adequate DRM technology, digital broadcasts would be limited, Judge Sentelle noted that, while this might be regrettable, it is not the FCC's responsibility. "It's going to have less content if it's not protected, but Congress didn't direct that you maximize content," he said. Unfortunately, there is a legal detail here that might moot the whole issue. Judge Sentelle noted that the plaintiffs, largely consumer and library groups, might not have standing to make a complaint against FCC unless they can show how the regulation causes them specific harm. So it is entirely possible that the complaint will be shut down on a technicality. On the other hand, if it is not, the broadcast industry has additional appeals to mount, and, if finally thwarted in the courts, can always resort to lobbying Congress for the legislation it wants. Thus there is every possibility that American consumers will be stuck with broadcast flag-compliant devices in the near future. Those thinking of buying DTV-related gear might want to make their purchases sooner rather than later, in hopes that some non-compliant devices are still available. . Related stories FCC Chairman Michael Powell resigns (http://www.theregister.co.uk/2005/01/21/michael_powell_resigns_from_fcc/) Feds OK DVD+R/RW DRM tech (http://www.theregister.co.uk/2004/08/06/vcps_thumbs_up/) FCC locks down US TV (http://www.theregister.co.uk/2003/11/06/fcc_locks_down_us_tv/) ) Copyright 2005 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Fighting computer crooks the Las Vegas way
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.theregister.co.uk/2005/02/23/las_vegas_threat_detection/print.ht…> The Register Biting the hand that feeds IT The Register ; Software ; Applications ; Fighting computer crooks the Las Vegas way By John Leyden (john.leyden at theregister.co.uk) Published Wednesday 23rd February 2005 17:38 GMT RSA 2005 Computing techniques used to identify cheaters in Las Vegas are being applied to wider computer security and fraud detection problems. SRD, a Las Vegas software developer which was acquired by IBM last month, is taking its identity resolution software from the gaming tables into corporate boardrooms. SRD's business intelligence software (now renamed DB2 Identity Resolution) can draw out non-obvious relationships between information stored on a variety of databases. Las Vegas gaming companies use the technology as a way to identify customers and their associates worthy of investigation for possible cheating. The software looks at information on employee records, suppliers, in-house arrests and incidents and industry-published professional counters and cheaters' lists to identify action items. For example, the system can tell if a person who has been arrested for card counting phones up a relative of a card dealer. "The casino industry uses our technology to discover individuals who may have the wrong intent before ferreting out problems with an investigative team," explained Jeff Jonas, founder and chief scientist of SRD (now renamed IBM's Entity Analytics Solutions). SRD's technology minimises the resources needed for an investigation and works best where a firm owns the data it is processing, according to Jonas. "It's problematic sharing information between organisations, so we've developed an anonymous identity resolution approach," he told a workshop Detecting Asymetric and Insider Threats - Las Vegas style at last week's RSA Conference in San Francisco. ID managed and correlated in crypto form To preserve anonymity, SRD has developed a technique to compare data in cryptographic form, instead of real information. Raw data can be confusing - for example, different spellings of Mohammed can be used on records of the same person, while Social Security numbers can be inputted instead of driving license IDs. But this can be overcome by pre-processing data to create a finite number of hashes for comparison. Adding salt to this data prevents statistical attack. This approach enables banks in the process of merging, say, to share anonymized data. Anonymous identity resolution can also help banks identify possible money-laundering activity or to combat disparate security threats. According to Jonas SRD software is tuned to minimise false positives,. Jonas, who describes himself as a data modeller, draws a distinction between data mining and SRD's "rules based expert system". Data mining looks for patterns in data that suggest, for example, individuals who share characteristics with a bank's most profitable customers. Data mining is tuned to avoid false negatives; but in applications like fraud detection and counter-terrorism addressed by SRD's technology false positives are the problem. "[SRD's technology] It's not probabilistic like data mining. A probabilistic approach works well if all you are using is 27c stamps but not if you're pointing guns at people," Jonas said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

No Encryption for E-Passports
by R.A. Hettinga 24 Feb '05

24 Feb '05

<http://www.wired.com/news/print/0,1294,66686,00.html> Wired News No Encryption for E-Passports By Ryan Singel? Story location: http://www.wired.com/news/privacy/0,1848,66686,00.html 02:00 AM Feb. 24, 2005 PT Despite widespread criticism from security experts that a proposed high-tech upgrade to Americans' passports actually introduces new security risks, the government is declining to encrypt data on new high-tech e-passports, according to proposed new rules published last week. In response to this outside criticism and some public questioning by one of its own contractors, the State Department delayed its rollout of the chip-equipped passports and hired additional companies to provide prototypes. Other countries are also wrangling with the issue, as the United States is requiring all 27 countries whose citizens do not need visas to visit America to begin issuing e-passports by October. So far only Belgium has started production, and it is likely the deadline, which was originally October 2004, will be pushed back another year. The new passports will include a radio frequency identification tag, a chip that will store all the information on the data page of the passport, including name, date and place of birth, and a digitized version of the photo passport, according to the proposal in the Federal Register. RFID chips are widely used in automatic toll-payment systems such as FasTrak, or identification chips implanted in the necks of pets. The chips are activated by a reader using certain radio frequency waves, which the chips use as an energy source to send back the encoded information. Border agents, equipped with readers, would be able to pull up passport information on a screen and visually compare the digitized photo against the passport bearer. Agents will also be able to use facial identification software to compare the person to the digitized photo, which is not feasible with current passports. The State Department, which has responsibility for passports and visas, hopes the measure will improve security and help curb passport forgery. The government will use chips that can only be written to once, and a further safeguard is provided in the form of a digital signature, which allows readers to verify that the information on the chip is the information originally written to it. But the rules, which are open for comment until April 4, rule out encrypting the bearer's name, birth date and digital photo, saying such a move would impede worldwide adoption of e-passports and that encrypted data would slow down entry and exit at customs. The lack of encryption baffles privacy advocates and security researchers, who say the new passports are vulnerable to "skimming," an attack that uses an unauthorized reader to gather information from the RFID chip without the passport owner's knowledge. The State Department concedes that skimming is a legitimate threat, but says the chips will have a read range of inches, that eavesdropping at border stations would be very conspicuous and that the passports will have a shielding mechanism -- perhaps a foil case or a weave in the cover that will cloak the chip when the passport is closed. That does little to satisfy critics such as Lee Tien, an attorney at the Electronic Frontier Foundation. "The State Department has not responded in any meaningful way to any of the privacy community," Tien said. "They are offering the equivalent of duct tape and baling wire as far (as) protecting peoples' information from being read. "It is my understanding it's possible to read this information from 10 to 30 feet away with the right equipment," Tien said. "When you think about the issues Americans have, especially when they travel abroad -- do you really want your passport to be broadcasting your name and nationality? This isn't good for privacy or the physical security of Americans abroad." Bruce Schneier, a security expert and author who founded Counterpane Internet Security, questions how much shielding helps, since travelers often have to show identification to exchange currency or check into a hotel. "Shielding is a good idea, but the problem is if you travel in Europe you are asked to show your passport a lot," Schneier said. "So all that shielding means is that someone who wants to sniff my passport just has to pick his location." Schneier, who just renewed his passport to make sure he will not have an unencrypted passport for another 10 years, says he has yet to hear a good argument as to why the government is requiring remotely readable chips instead of a contact chip -- which could hold the same information but would not be skimmable. "A contact chip would be so much safer," Schneier said. "The only reason I can think of is the government wants surreptitious access. I'm running out of other explanations. I'd love to hear one." Not everyone in the RFID industry thinks the proposed rules compromise security more than they help. "The goal is to create a stronger identification vehicle and that is what is being achieved in the e-passport initiative," said Erik Michielsen, director of RFID and ubiquitous networks at ABI Research. Michielsen, who calls himself a supporter of RFID technology, acknowledges there are legitimate security concerns, but thinks that the government should look at how other countries handle these concerns and learn from them, even as it proceeds with the current plan. "With any emerging technology, security issues arise and must be addressed," Michielsen said. "It's not whether security issues are solved today. It's assuring that as this moves toward a rollout that they are routinely addressed and resources are dedicated to ensuring consumers' privacy." The State Department, which is accepting written responses to the proposal until April 4 via e-mail sent to PassportRules(a)state.gov, did not return a call requesting comment. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0