September 2012 - cypherpunks-legacy

Did YouTube Really Block Michelle Obama's DNC Speech for Copyright Infringement?
by Lauren Weinstein 06 Sep '12

06 Sep '12

http://j.mp/OQe20R (This message on Google+) http://j.mp/OQexrV (Slate, via NNSquad) "Either way, this amounts to something less than a copyright apocalypse. Michelle Obama's speech is still available on plenty of other YouTube channels, including here, here, and here. But on the heels of the Hugo Awards debacle, it's another reminder of the need for human vigilance against overzealous digital-rights-management algorithms. In a statement chalking up the glitch to "a technical error on YouTube," an Obama campaign official added, "We do not expect tonight's coverage will be affected." Copyright bots, the gauntlet has been thrown!" Irrespective of this particular case, this whole area (not just YouTube) of automated content flagging needs serious attention from a number of standpoints. Here's an example of what has happened to me (and many other people). I uploaded a video of mine that included a segment of old, definitely public domain material. Shortly thereafter, my entire vid was flagged by YouTube's Content ID. Why? It took some digging to figure out, but it turns out a Content ID partner had uploaded a video of their own that happened to include a section of the same public domain material I had used. This apparently made it look like my video was infringing, since Content ID assumed the section of my vid that matched their vid was in violation. Wrong! But Content ID partners get the assumption of being correct, and there's no way for an average user to assert that something is public domain a priori. I was able to get this reversed by careful explanation on the appropriate forms, but I wonder how many people would just throw up their arms and say, "To hell with it!" and not bother? This is not an easy situation to solve, but the explicit assumption that Content ID partners are correct and that takedowns or other actions are immediate -- with a protest required to get blocks, etc. removed after the fact, strikes me as increasingly problematic. Lauren Weinstein (lauren(a)vortex.com) http://www.vortex.com/lauren Network Neutrality Squad: http://www.nnsquad.org +1 (818) 225-2800 ------------------------------

1 0

Re: The Cadillac Your Livery Driver Has Been Dreaming Of (R-27.01)
by jgar the jorrible 06 Sep '12

06 Sep '12

An MSN editorial had some insight: "...Is that my cell phone buzzing, or the seat? 2013 Cadillac XTS (c) GMCadillac has a good idea here. Instead of annoying the driver with flashing lights and buzzing sounds from various active safety systems, it sends all those warnings to his back and rear end. ... The touch-capacitive dash is another story. See those silver trim pieces that look like you should touch them? Don't. They're just finger guides. The actual sensors are above them, which is confusing and frustrating. They're also slow to respond to repeated inputs, like adjusting the cooled seat or the fan speed, unless you're deliberate with your pace and timing. Who wants to think about how you touch a control, especially while driving? Lincoln already came out with this system and it's no different. It's like tapping a plastic post and wondering if some magic will happen. You also feel kind of dumb getting it wrong, which tends to happen when you're paying attention to the road. This feature needs to die." http://editorial.autos.msn.com/blogs/autosblogpost.aspx?post=3De29f4907-f96… Personally, I'm amazed that any UI designer for car controls would even think of making hand-eye coordination necessary for ancillary controls. I can control my old New Beetle radio and HVAC by touch, with very little learning. But my other cars with touch screens, any little bump and the wrong command gets invoked. And the voice control? I could go on and on, but in a nutshell, not there yet, adds frustration. ------------------------------

1 0

"Automated DRM keeps spoiling the show, from the DNC to Mars" (Phipps-Samson)
by Gene Wirchenko 06 Sep '12

06 Sep '12

Simon Phipps and Ted Samson, Robots aren't smart enough to decide if video or song is used lawfully; instead of trying to improve content monitoring software, we should look to ditch it, *InfoWorld*, 5 Sep 2012 http://www.infoworld.com/t/drm/automated-drm-keeps-spoiling-the-show-the-dn… opening text (one of the examples): Science-fiction fans from all over the world were avidly watching the live broadcast of the Hugo Awards last Sunday from Chicon 7, the World Science Fiction Convention in Chicago. This is a venerable event with much more longevity than you might imagine: Attendees were celebrating the event's 70th year. One of the award winners, British author Neil Gaiman, was recognized for a script for the cult BBC TV series "Doctor Who." Following the showing of a clip from the episode, Gaiman took the podium for the award ceremony to make his acceptance speech. Then, however, the broadcast was abruptly cut off. A robot at Ustream, presumably using data provided by the BBC, decided on the basis of that short clip that this was an illegal broadcast of "Doctor Who" and pulled the plug. Worse, it turned out that no one at the Hugo Awards or at Ustream was empowered to turn it back on again. Ustream has promised to upgrade its robot to understand fair use, but the proposal is both ridiculous -- even judges struggle with fair use arguments -- and dangerous. ------------------------------

1 0

Практическое бюд-вание: методики, документы, примеры, автоматизация
by Практическое бюджетирование 06 Sep '12

06 Sep '12

13-14 сентября Практическое бюджетирование: методики, документы, примеры, автоматизация код (495) - 7-42.9I_98 \\\/// +7 495 7Ч2*91/98 Программа: Бюджетирование как управленческая технология. Что такое "бюджет", а что такое "план"? Зачем компаниям нужны бюджеты? Связь бюджетирования со стратегическим и оперативным управлением. Практика и дискуссия: почему бюджетирование бывает неэффективным и как превратить его в управленческий инструмент. Внедрение бюджетирования. Пошаговый план внедрения бюджетирования. Основные проблемы, возникающие при внедрении бюджетирования и как их избежать на начальном этапе. Документы, которые должны быть разработаны для формализации бюджетного процесса. Документы бюджетирования. Разработка основного документа - концепции (стандарта) бюджетирования, в котором описываются основные параметры и правила работы бюджетной системы. Структура и правила формирования документа. Выбор подхода к построению системы бюджетирования - "сверху вниз", "снизу вверх", "смешанный". Основные параметры бюджетной модели. Взаимодействие бизнес-единиц группы компаний в бюджетировании. Практика и дискуссия: особенности разработки концепции для компаний, в которых работают слушатели. Разработка финансовой структуры компании. Бюджеты ЦФО. Разделение компании на объекты управления (центры финансовой ответственности - ЦФО). Как связана финансовая и организационная структуры компании? Классификация ЦФО. Чем отличается практика от теории - примеры "смешанных" ЦФО. Как сделать бюджет ЦФО: два подхода? Как сформировать "Положение о финансовой структуре" - форма и содержание документа. Практика и дискуссия: сравнение двух подходов к формированию бюджетов ЦФО Кейс: разработка финансовой структуры торговой компании. Методология процессного бюджетирования: операционные и финансовые бюджеты. Состав бюджетов. Определение состава бюджетов. Какие операционные и финансовые бюджеты включаем в систему бюджетирования компании и почему? Правила, по которым определяется набор бюджетов. Практические схемы бюджетирования производственного предприятия и торговой компании. Кейс: формирование набора бюджетов для компаний, в которых работают слушатели. Бюджетные формы. Операционные бюджеты. Прогнозирование продаж или почему финансистам нужно дружить с менеджерами по продажам. Виды бюджетных форм производственного предприятия и особенности их составления. Примеры. Виды бюджетных форм торговой компании и особенности их составления. Примеры. Финансовые бюджеты. Как сформировать БДР, БДДС и прогнозный баланс. Различные формы БДР: "бухгалтерский подход", "маржинальный подход", "МСФО подход". Связь БДР со стратегией компании и зачем нужны показатели EBITDA, EBIT, EBT? Практика и дискуссия: "бухгалтерский подход" (составления бюджетов с использованием двойной записи и сведение бюджетов в оборотно-сальдовую ведомость через двойную запись), "маржинальный подход", "МСФО подход" к формированию бюджетов. Методика "бюджетирования на результат", практическое применение. Связь стратегии с бюджетированием через KPI (КПЭ). Какие финансовые показатели используются в "бюджетировании на результат". Методика "бюджетирования на результат". Кейс: практический пример разработки "бюджетирования на результат" для торговой компании. Организация бюджетного процесса. Организация управления бюджетами. Разработка пакета внутренних управленческих документов по бюджетированию. Организация документооборота между подразделениями. Нужно ли создавать бюджетный комитет. Примеры бюджетного регламента. Практика и дискуссия: как распределить ответственность в рамках бюджетного регламента. ═Контроль за исполнением бюджетов. Контроль и анализ отклонений и корректировка бюджетов. Динамические и статические бюджеты. Факторный анализ отклонений (пример анализа отклонения по прибыли). Мотивация персонала к выполнению регламента бюджетирования и совершенствованию бюджетных показателей. Кейс: факторный анализ отклонения по прибыли. ═Автоматизация бюджетирования. Что должна уметь система автоматизации бюджетирования? Обзор рынка систем. Бюджетирование в 1С. Основные правила выбора системы. Как рассчитать стоимость внедрения? Стоимость участия: 16 900 рублей Вся информация по тел: +7 499 - 4Ч5.40.95 \\\/// код (495) - 7*Ч2-9I/98

1 0

Buy Ciails and Viarga online!
by Ja Huston via LinkedIn 06 Sep '12

06 Sep '12

USPS Delivery Shipping 1-4 Day USA U.S. & Canada Licensed Pharmaices ORDER NOW! Your http://doctorchro.ru Team!

1 0

Once all our cars can talk to each other, what will they reveal about us?
by Eugen Leitl 05 Sep '12

05 Sep '12

http://www.itworld.com/it-managementstrategy/292996/once-all-our-cars-can-t… Once all our cars can talk to each other, what will they reveal about us? In the future, cars will be networked, personalized, and connected to the cloud. The laws protecting personal data collected from these cars? Still largely road kill. By Dan Tynan 4 comments September 03, 2012, 1:28 PM b Last week I had the pleasure of attending the IFA 2012 consumer electronics show in Berlin as a guest of the IFA organizers. When not drinking Pilsner and eating bratwurst I managed to squeeze in a panel on the future of the car, featuring representatives from Ford, Microsoft, Inrix (the leading provider of aggregated traffic data to onboard GPS systems), and TuneIn Radio, makers of a music app for cars. I also interviewed Pim van der Jagt, a managing director for Ford Europe. Bottom line? In a few short years our cars will be connected and talking to each other. They will also be able to collect vast amounts of data about who we are, where we go, and what we do. Some of these things will undoubtedly make our vehicles much safer; some may erase what little roadside privacy we have left. This is more than just Jetsons-like fantasy. Last month the National Highway Traffic Safety Administration (NHTSA) and eight major car manufacturers launched a year-long test of car-to-car communications in Ann Arbor. Some 2800 cars, trucks, and city buses have been equipped with gear that will broadcast their size, speed, and location to each other as they roll down the road, using a special band of WiFi spectrum reserved for vehicle-to-vehicle communications. If another car gets too close or a pedestrian suddenly steps into the intersection, drivers receive an alert and can react accordingly. Your location data is no more private than the color of your car, says Federal judge Why location privacy is important Location may be the next killer app Some 70 percent of all accidents can be avoided if cars are networked, says van der Jagt. But thatbs really just the beginning. Technology already exists that would allow your carbs computer to take control of the brakes and accelerator to avoid a collision, or to moderate the speed of each car to keep traffic flowing. And while webre still a long ways away from being able to climb into the backseat and take a nap while our cars drive us to our destination (sorry Google Car fans), systems that can take the wheel during certain situations - like when stuck in bumper-to-bumper traffic -- are likely to appear much sooner, says van der Jagt. The only question is whether drivers would be willing to hand the wheel over to their computer. Because the cars in the Ann Arbor test only need to know the location of other vehicles within 300 meters, therebs no need to connect to the Internet or record your carbs location, says van der Jagt. And since the system doesnbt collect any data from the carbs registration or VIN, therebs no way for Ford or anyone else to know who you are and where youbre going, he adds. But thatbs just one aspect of the connected car. The car of the future will also be personalized. It will be able to tell who just climbed behind the wheel and adjust the seats, mirrors, environmental controls, and radio stations accordingly. Using your smart phone, it will be able to connect to your data in the cloud, download your Outlook calendar, remind you about your next meeting, calculate when youbll get there, and send an email to other attendees if youbre running late. It will know the music you like to listen to, the routes you like to take each day and how fast you drive to get there. Van der Jagt says Ford is even working on sensors built into the seats that can monitor your heart rate to determine if youbre about to fall asleep at the wheel or just had a heart attack. For those features, the car (and its various mobile service providers) will definitely need to know who you are and where you are. The question then becomes, what happens to all this data? At this point, Inrix collects all its traffic data anonymously, and Ford and Microsoftbs philosophy is the customer owns the data. But exactly what that means is unclear. Are identity and location data stored, and if so, by whom and for how long? What other entities will have access to this information? Will the cops demand this data in order to nab speeders? And what about companies that want to monetize that data b like an insurance company that offers discounts for good drivers while penalizing those who put the pedal to the metal on a semi-regular basis, as Progressive Insurance already does via its b black boxb electronic data recorders? Whatbs to keep a mobile service provider from selling that data to the highest bidders? Webve already seen what happens with cell phone data thatbs collected by the wireless companies: Police made more than 1.3 million requests for location data last year alone, roughly two thirds of them in non-emergency situations. It was up to the wireless companiesb attorneys to determine whether those requests would be honored and their customersb location data shared. Federal courts have recently ruled that sharing such data without a warrant is not a violation of our Fourth Amendment rights against unlawful search and seizure. And while commercial use of location data is still in its infancy, in part because wireless companies fear a privacy backlash, that wonbt last forever. That data too could be a target of law enforcement requests. If the tests in Ann Arbor prove successful, car-to-car networking is likely to be mandated by NHTSA b and may appear in cars as early as 2018. The notion of cloud-connected cars is less certain, but also seems inevitable. The question will be whether we will gain the legal right to control how our car data is used, or if the mobile service companies will be the ones with their hands firmly on the wheel. Got a question about social media? TY4NS blogger Dan Tynan may have the answer (and if not, hebll make something up). Visit his snarky, occasionally NSFW blog eSarcasm or follow him on Twitter: @tynanwrites. For the latest IT news, analysis and how-tobs, follow ITworld on Twitter and Facebook.

1 0

[drone-list] Drone Campaign Network
by Eugen Leitl 05 Sep '12

05 Sep '12

----- Forwarded message from Gregory Foster <gfoster(a)entersection.org> -----

1 0

[Freedombox-discuss] counter-freedombox
by Eugen Leitl 05 Sep '12

05 Sep '12

----- Forwarded message from Boruch Baum <boruch_baum(a)gmx.com> -----

1 0

Leave Your Cellphone at Home
by Eugen Leitl 05 Sep '12

05 Sep '12

http://nplusonemag.com/leave-your-cellphone-at-home Sarah Resnick Leave Your Cellphone at Home Interview with Jacob Appelbaum >From OCCUPY Gazette 4, out May 1. Earlier this year in Wired, writer and intelligence expert James Bamford described the National Security Agencybs plans for the Utah Data Center. A nondescript name, but it has another: the First Intelligence Community Comprehensive National Cyber-security Initiative Data Center. The $2 billion facility, scheduled to open in September 2013, will be used to intercept, decipher, analyze, and store the agencybs intercepted communicationsbeverything from emails, cell phone calls, Google searches, and Tweets, to retail transactions. How will all this data be stored? Imagine, if you can, 100,000 square-feet filled with row upon row of servers, stacked neatly on racks. Bamford projects that its processing-capacity may aspire to yottabytes, or 1024 bytes, and for which no neologism of higher magnitude has yet been coined. To store the data, the NSA must first collect it, and here Bamford relies on a man named William Binney, a former NSA crypto-mathematician, as his main source. For the first time, since leaving the NSA in 2001, Binney went on the record to discuss Stellar Wind, which we all know by now as the warrantless wiretapping program, first approved by George Bush after the 2001 attacks on the twin towers. The program allowed the NSA to bypass the Foreign Intelligence Surveillance Court, in charge of authorizing eavesdropping on domestic targets, permitting the wholesale monitoring of millions of American phone calls and emails. In his thirty years at the NSA, Binney helped to engineer its automated system of networked data collection which, until 2001, was exclusively directed at foreign targets. Binney left when the organization started to use this same technology to spy on American citizens. He tells of secret electronic monitoring rooms in major US telecom facilities, controlled by the NSA, and powered by complex software programs examining Internet traffic as it passes through fiber-optic cables. (At a local event last week, Binney circulated a list of possible interception points, including 811 10th Avenue, between 53rd & 54th St., which houses the largest New York exchange of AT&T Long Lines.) He tells of software, created by a company called Narus, that parses US data sources: any communication arousing suspicion is automatically copied and sent to the NSA. Once a name enters the Narus database, all phone calls, emails and other communications are automatically routed to the NSAbs recorders. The NSA wasnbt the only intelligence-gathering agency to have its domestic surveillance powers expanded in the wake of September 11th. The USA PATRIOT Act, for instance, allows the FBI to spy on US citizens without demonstrating probable cause that its targets are engaged in criminal activities. Under Section 215 of the Act, the now infamous National Security Lettersbwhich formerly required that the information being sought pertain to a foreign power or agent of a foreign powerbcan compel the disclosure of sensitive information held by banks, credit companies, telephone carrier, and Internet Service Providers, among many others, about US citizens. The recipient of an NSL is typically gagged from disclosing the fact or nature of the request. Itbs no secret that, whereas the Fourth Amendment prevents against unreasonable search and seizure, concerns over b national securityb occasioned its disregard and the violation of privacy rights of even the most ordinary citizens. Activists have all the more reason to worry, repeatedly turning up as the subject of terrorist investigations. For instance, in 2006 the ACLU revealed that the Pentagon was secretly conducting surveillance of protest activities, antiwar organizations, and groups opposed to military recruitment policies, including Quakers and student organizations. Relying on sources from the Department of Homeland Security, local police departments, and FBI Joint Terrorism Task Forces, the Pentagon collected, stored, and shared this data through the Threat and Local Observation Database, or TALON, designed to track terrorist threats. Or take Scott Crow, a self-described anarchist and veteran organizer in the global justice movement, who, as the New York Times reported last year, is one of dozens of political activists across the country to have come under scrutiny from the FBIbs increased counterterrorism operation. The FBI set up a video camera outside his house, monitored guests as they came and went, tracked his emails and phone conversations, and picked through his trash to identify his bank and mortgage companies, presumably to send them subpoenas. Others to have been investigated included animal rights activists in Virginia and liberal Roman Catholics in Nebraska. When in 2008, President Obama took the reigns from George W. Bush, there was an expectation that much, or at least some, of this activity would be curbed. Yet, as Bamfordbs article attests, the govermentbs monitoring and collection of our digital data remains steadfast. When the Occupy protests started in mid-September of last year, I relied on data-generating technologies increasingly, more so than I had ever before. Within a few weeks I had joined multiple OWS-related listservs; Ibd started following Twitter with unprecedented commitment; I spent more hours on Facebook than I care to acknowledge. I doubt I am the only one. At the same time, there was a widespread sense of precautionbjust because we were engaging in legal activities, covered by our First Amendment rights, no one, it seemed, should presume herself exempt from the possibility of surveillance. Sensitive conversations took place in loud bars, never over email. Text messages were presumed unsafe. In meetings, cell phone batteries were removed on occasion. Nevertheless, it was easy to feel unimportant (why would anyone watch me?) and equally easy to let standards relaxbespecially when it meant reclaiming conveniences that, once enjoyed, webre difficult to give up. Leaving a trail of potentially incriminating digital data seemed inevitable. But how bad could it really be? And was there no way to use these same tools while safeguarding our privacy? In late April, I sat down with the independent security researcher, hacker, and privacy advocate Jacob Appelbaum, who knows a thing or two about the surveillance state. Appelbaum is one of the key members of the Tor project, which relies on a worldwide volunteer network of servers to reroute Internet traffic across a set of encrypted relays. Doing so conceals a userbs location, and protects her from a common form of networking surveillance known as traffic analysis, used to infer who is talking to whom over a public network. Tor is both free (as in freedom) and free of charge. Appelbaum is also the only known American member of the international not-for-profit WikiLeaks. Resnick: The recent article in Wired describes where and how the NSA plans to store its share of collected data. But as the article explains, the Utah facility will have another important function: cryptanalysis, or code-breaking, as much of the data cycling through will be heavily encrypted. It also suggests that the Advanced Encryption Standard (AES), expected to remain durable for at least another decade, may be cracked by the NSA in a much shorter time if theybve built a secret computer that is considerably faster than any of the machines we know about. But more to the pointbis encryption safe? Appelbaum: Some of it is as safe as we think it can be, and some of it is not safe at all. The number one rule of b signals intelligenceb is to look for plain text, or signaling informationbwho is talking to whom. For instance, you and I have been emailing, and that information, that metadata, isnbt encrypted, even if the contents of our messages are. This b social graphb information is worth more than the content. So, if you use SSL-encryption to talk to the OWS server for example, great, they donbt know what youbre saying. Maybe. Letbs assume the crypto is perfect. They see that youbre in a discussion on the site, they see that Bob is in a discussion, and they see that Emma is in a discussion. So what happens? They see an archive of the website, maybe they see that there were messages posted, and they see that the timing of the messages correlates to the time you were all browsing there. They donbt need to know to break a crypto to know what was said and who said it. Resnick: And this type of surveillance is called b&? Appelbaum: Traffic analysis. Itbs as if they are sitting outside your house, watching you come and go, as well as the house of every activist you deal with. Except theybre doing it electronically. They watch you, they take notes, they infer information by the metadata of your life, which implies what it is that youbre doing. They can use it to figure out a cell of people, or a group of people, or whatever they call it in their parlance where activists become terrorists. And itbs through identification that they move into specific targeting, which is why itbs so important to keep this information safe first. For example, they see that webre meeting. They know that I have really good operational security. I have no phone. I have no computer. It would be very hard to track me here unless they had me physically followed. But they can still get to me by way of you. They just have to own your phone, or steal your recorder on the way out. The key thing is that good operational security has to be integrated into all of our lives so that observation of what webre doing is much harder. Of course itbs not perfect. They can still target us, for instance, by sending us an exploit in our email, or a link in a web browser that compromises each of our computers. But if they have to exploit us directly, that changes things a lot. For one, the NYPD is not going to be writing exploits. They might buy software to break into your computer, but if they make a mistake, we can catch them. But itbs impossible to catch them if theybre in a building somewhere reading our text messages as they flow by, as they go through the switching center, as they write them down. We want to raise the bar so much that they have to attack us directly, and then in theory the law protects us to some extent. Resnick: So if I were arrested, and the evidence presented came from a targeted attack on my computer, and I knew about the attack, I would have some kind of legal recourse? Appelbaum: Well, thatbs an interesting question. What is the legal standard for breaking into someonebs computer because they were at a protest? Congratulations, take that to the Supreme Court, you might be able to make some really good law. I think the answer is that itbs a national newsworthy incidentbnobody knows the cops break into peoplebs computers. The cops break into someonebs house, the Fourth Amendment is super clear about thatbit canbt be done without a warrant. Resnick: In January of last year, it was reported that the records for your Twitter accountb along with those of Julian Assange, Private Bradley Manning, Dutch hacker Rop Gonggrjp, and Icelandic lawmaker Brigatta Jonsdottirbwere subpoenaed by the US government. What is perhaps most notable in this case is not that the accounts were subpoenaed, but that the orders, usually gagged and carried out in secret, became public knowledge. Twitter contested the secrecy order and won the right to notify you. Several months later, the Wall Street Journal revealed that Google and the Internet service provider Sonic.net, had received similar orders to turn over your data. Appelbaum: Twitter notified me. But as for Google and Sonic.net, I read about it in the Wall Street Journal like everybody else. So now I can talk about it because it was in a public newspaper. Those are b 2703(d) administrative subpoenas,b and they asked for IP addresses, and the email addresses of the people I communicated with, among other things. The government asserts that it has the right to get that metadata, that b signalingb or relationship information, without a warrant. They get to gag the company, and the company canbt fight it, because itbs not their data, itbs my data, or itbs data about me, so they have no Constitutional standing. And the government asserts that I have no expectation of privacy because I willingly disclosed it to a third party. And in fact my Twitter data was given to the governmentbno one has really written about that yet. We are still appealing but we lost the stay, which means Twitter had to disclose the data to the government, and whether or not they can use it is pending appeal. Once they get the data, itbs not like itbs private or secretband even if they canbt use it as evidence, they can still use it in their investigations. Resnick: In January of this year, the Twitter account of writer and OWS protester Malcolm Harris was subpoenaed by the Manhattan District Attorneybs Office. I think itbs safe to assume these incidents are not anomalies. In which case, is there a way to use social media sites like Twitter without putting our private data at risk? Because these sites can be very useful tools of course. Appelbaum: In the case of something like Twitter, you can use Tor on the Android phonebwe have a version of Tor for Android called Orbotband Twitter together and thatbs essentially the best youbre going to do. And even that isnbt particularly great. Twitter keeps a list of IP addresses where youbve logged in, but if you use Tor, it wonbt know you are logging in from your phone. Itbs powerful, but the main problem is that itbs kind of complicated to use. On your computer, you can use the Tor browser, and when you log into Twitter, youbre fine, no problem allbyour IP address will trace back to Tor again. So now when the government asserts that you have no expectation of privacy, you can say all right, well I believe I have an expectation of privacy, which is why I use Tor. I signal that. And the private messaging capability of Twitterbdonbt use it for sensitive stuff. Twitter keeps a copy of all its messages. Resnick: During the perceived wave of Internet activism throughout the 2009 Iranian election protests, a new proprietary software called Haystack received a lot of media attention. Haystack promised Iranian activists tightly encrypted messages, access to censored websites, and the ability to obfuscate Internet traffic. You later tested the software and demonstrated its claims to be false. For those of us who donbt have your technical skill set, how can we assess whether a particular tool is safe to use, especially if itbs new? Appelbaum: First, is the source code available? Second, if the claims are just too good to be true, they probably are. Therebs a thing called snake oil crypto or snake oil software, where the product promises the moon and the sun. When a developer promises that a proprietary software is super secure and only used by important people, itbs sketchy. Third, are the people working on this part of the community that has a reputation for accomplishing these things? Thatbs a hard one, but ask someone you know and trust. How would you go on a date with someone? How would you do an action with someone? Transitive trust is just as important in these situations. Another thing to look at is whether itbs centralized or decentralized. For example Haystack was centralized, whereas Tor is decentralized. Also, how is it sustained? Will it inject ads into your web browser, like AnchorFree, the producer of the Hotspot Shield VPN? Or is it like Riseup.net, whose VPN service monetizes not through your traffic, but through donations and solidarity and mutual aid? And if they can inject ads, that means they can inject a back door. Thatbs super sketchybif they do that, thatbs bad news. So you want to be careful about that. Finally, remember: The truth is like a bullet that pierces through the armor of charlatans. Resnick: What should we know about cell phones? Itbs hard to imagine going to a protest without one. But like all networked technologies, surely they are double-edged? Appelbaum: Cell phones are tracking devices that make phone calls. Itbs sad, but itbs true. Which means software solutions donbt always matter. You can have a secure set of tools on your phone, but it doesnbt change the fact that your phone tracks everywhere you go. And the police can potentially push updates onto your phone that backdoor it and allow it to be turned into a microphone remotely, and do other stuff like that. The police can identify everybody at a protest by bringing in a device called an IMSI catcher. Itbs a fake cell phone tower that can be built for 1500 bucks. And once nearby, everybodybs cell phones will automatically jump onto the tower, and if the phonebs unique identifier is exposed, all the police have to do is go to the phone company and ask for their information. Resnick: So phones are tracking devices. They can also be used for surreptitious recording. Would taking the battery out disable this capability? Appelbaum: Maybe. But iPhones, for instance, donbt have a removable battery; they power off via the power button. So if I wrote a backdoor for the iPhone, it would play an animation that looked just like a black screen. And then when you pressed the button to turn it back on it would pretend to boot. Just play two videos. Resnick: And how easy is it to create something like to that? Appelbaum: There are weaponized toolkits sold by companies like FinFisher that enable breaking into BlackBerries, Android phones, iPhones, Symbian devices and other platforms. And with a single click, say, the police can own a person, and take over her phone. Resnick: Rightbin November of last year, the Wall Street Journal first reported on this new global market for off-the-shelf surveillance technology, and created b Surveillance Catalogb on their website, which includes documents obtained from attendees of a secretive surveillance conference held near Washington, D.C. WikiLeaks has also released documents on these companies. The industry has grown from almost nothing to a retail market worth $5 billion per year. And whereas companies making and selling this gear say it is available only to governments and law enforcement and is intended to catch criminals, critics say the market represents a new sort of arms trade supplying Western governments and repressive nations alike. Appelbaum: Itbs scary because [accessing these products is so] easy. But when a company builds a backdoor, and sells it, and says trust us, only good guys will use itb& well, first of all, we donbt know how to secure computers, and anybody that says otherwise is full of shit. If Google can get owned, and Boeing can get owned, and Lockheed Martin can get owned, and engineering and communication documents from Marine One can show up on a filesharing network, is it realistic to assume that perfect security is possible? Knowing this is the case, the right thing is to not build any backdoors. Or assume these backdoors are all abused and bypass them so that the data acquired is very uninteresting. Like encrypted phone calls between two peoplebitbs true they can wiretap the data, but theybll just get noise. When Hillary Clinton and the State Department say they want to help people abroad fight repressive governments, they paint Internet freedom as something they can enable with $25 million. Whereas in reality the FBI makes sure that our communications tech isnbt secure. This makes it impossible for people like me to help people abroad overthrow their governments because our government has ensured that all their technology is backdoor ready. And in theory, they try to legitimize state surveillance here, and there they try to make it illegitimate. They say, b In over-there-a-stan, surveillance is oppressive. But over here, itbs okay, we have a lawful process.b (Which is not necessarily a judicial process. For example, Eric Holder and the drones . . . sounds like a band, right?) Resnick: Okay, so one thing Ibve heard more than once at meetings when security culture comes up is that . . . well, therebs a sense that too much precaution grows into (or comes out of) paranoia, and paranoia breeds mistrustband all of it can be paralyzing and lead to a kind of inertia. How would you respond to something like that? Appelbaum: The people who that say thatbif theybre not cops, theybre feeling unempowered. The first response people have is, whatever, Ibm not important. And the second is, theybre not watching me, and even if they were, therebs nothing they could find because Ibm not doing anything illegal. But the thing is, taking precautions with your communications is like safe sex in that you have a responsibility to other people to be safebyour transgressions can fuck other people over. The reality is that when you find out it will be too late. Itbs not about doing a perfect job, itbs about recognizing you have a responsibility to do that job at all, and doing the best job you can manage, without it breaking down your ability to communicate, without it ruining your day, and understanding that sometimes itbs not safe to undertake an action, even if other times you would. Thatbs the education component. So security culture stuff sounds crazy, but the technological capabilities of the police, especially with these toolkits for sale, is vast. And to thwart that by taking all the phones at a party and putting them in a bag and putting them in the freezer and turning on music in the other roombtrue, someone in the meeting might be a snitch, but at least therebs no audio recording of you. Part of informed consent is understanding the risks you are taking as you decide whether to participate in something. Thatbs what makes us freebthe freedom to question what webre willing to do. And of course itbs fine to do that. But itbs not fine to say, I donbt believe therebs a risk, youbre being paranoid, Ibm not a target. When people say that they donbt want to take precautions, we need to show them how easy it is to do it. And to insist that not doing it is irresponsible, and most of all, that these measures are effective to a degree, and worth doing for that reason. And itbs not about perfection, because perfection is the enemy of b good enough.b I would encourage people to think about the activity they want to engage in, and then say, Hey, this is what I want to do. Work together collaboratively to figure out how to do that safely and securely, but also easily without needing to give someone a technical education. Because thatbs a path of madness. And if people arenbt willing to change their behaviors a little bit, you just canbt work with them. I mean thatbs really what it comes down to. If people pretend that theybre not being oppressed by the state when they are literally being physically beaten, and forced to give up retinal scans, thatbs fucking ridiculous. We have to take drastic measures for some of these things. The FBI has this big fear that theybre going to b go dark,b which means that all the ways they currently obtain information will disappear. Well, America started with law enforcement in the dark; once, we were perceived to be innocent until proven guilty. And just because the surveillance is expanding, and continues to expand, doesnbt mean we shouldnbt push back. If you havenbt committed a crime they should have no reason to get that information about you, especially without a warrant. Resnick: Are there any other tools or advice you would suggest to an activist, or anyone for that matter? Appelbaum: Well, itbs important to consider the whole picture of all the electronic devices that we have. First, you should use Tor and the Tor browser for web browsing. Know that your home internet connection is probably not safe, particularly if itbs tied to your name. If you use a Mac or Windows operating system, be especially careful. For instance, therebs a program called Evilgrade that makes it easy for attackers to install a backdoor on a computer by exploiting weaknesses in the auto-update feature of many software programs. So if you have Adobebs PDF reader, and youbre downloading and installing the update from Adobe, well, maybe youbll get a little extra thing, and youbre owned. And the cops have a different but better version of that software. Which is part of why I encourage people to use Ubontu or Debian or Linux instead of proprietary systems like a Mac or whatever. Because there are exploits for everything. If youbre in a particularly sensitive situation, use a live bootable CD called TAILSbit gives you a Linux desktop where everything routes over Tor with no configuration. Or, if youbre feeling multilingual, host stuff in another country. Open an email account in Sweden, and use TAILS to access it. Most important is to know your options. A notepad next to a fireplace is a lot more secure than a computer in some ways, especially a computer with no encryption. You can always throw the notepad in the fireplace and thatbs that. For email, using Riseup.net is good news. The solutions they offer are integrated with Tor as much as possible. Theybre badass. Because of the way they run the system, Ibm pretty sure that the only data they have is encrypted. And Ibd like to think that what little unencrypted data they do have, they will fight tooth and nail to protect. Whereas, yes, you can use Tor and Gmail together, but itbs not as integratedbwhen you sign in, Gmail doesnbt ask if you want to route this over Tor. But also, Google inspects your traffic as a method of monetization. Ibd rather give Riseup fifty dollars a month for the equivalent service of Gmail, knowing their commitment to privacy. And also knowing that they would tell the cops to go fuck themselves. Therebs a lot of value in that. For chatting, use software with off-the-record messaging (OTR)bnot Googlebs b go off the record,b but the actual encryption softwarebwhich allows you to have an end-to-end encrypted conversation. And configure it to work with Tor. You can bootstrap a secure communication channel on top of an insecure one. On a Mac, use Adiumbit comes with OTR, but you still have to turn it on. When you chat with people, click verify and read the fingerprint to each other over the telephone. You want to do this because there could be a b man in the middleb relaying the messages, which means that you are both talking to a third party, and that third party is recording it all. As for your cell phone, consider it a tracking device and a monitoring device and treat it appropriately. Be very careful about using cell phones, but consider especially the patterns you make. If you pull the battery, youbve generated an anomaly in your behavior, and perhaps thatbs when they trigger people to go physically surveil you. Instead, maybe donbt turn it off, just leave it at home. Because, as I said earlier, in a world with lots of data retention, our data trails tell a story about us, and even if the story is made of truthful facts, itbs not necessarily the truth. On a cell phone, you can install stuff like OStel, which allows you to make encrypted voice-over-the-Internet calls, or PrivateGSMbitbs not free, but itbs available for BlackBerries, Android phones, iPhones and so on. Which means that if they want to intercept your communication, they have to break into your phone. Itbs not perfect. Gibberbot for the Android allows you to use Tor and Jabberbwhich is like Google Chatbwith OTR automatically configured. You type in your Jabber ID, it routes over Tor, and when you chat with other people, it encrypts the messages end-to-end so even the Jabber server canbt see whatbs being said. And there are a lot of tools like that to choose from. Another thing to consider is the mode in which we meet. If we want to edit something collaboratively, therebs a program called Etherpad. And therebs a social networking application called Crabgrass, and hosted at we.riseup.net. Itbs like a private Facebook. Riseup still has a lot of the data, but itbs private by default. So itbs secure, short of being hacked, which is possible, or short of some legal process. And if you use it in a Tor browser, and never reveal information about yourself, youbre in really good shape. Unlike Facebook, which is like the Stasi, but crowdsourced. And I mean that in the nicest way possible. I once had a Facebook accountbitbs fun and a great way to meet people. But it is not safe for political organizing, especially when youbre part of the minority, or when youbre not part of the minority, but you are part of the disempowered majority. As a final thought, Ibd say just to remember that a big part of this is social behavior and not technology per se. And a big part of it is accepting that while we may live in a dystopian society right now, we donbt always have to. Thatbs the tradeoff, right? Because what is OWS working toward? The answer is, something different. And if we want an end to social inequality, the surveillance state is part of what we have to change. If we make it worthless to surveil people, we will have done this. So, it needs to be the case that what we do doesnbt hang us for what we wish to create. Image: NSA headquarters, Ft. Meade, MD.

1 0

Apple patent would disable phone based on location
by Lauren Weinstein 05 Sep '12

05 Sep '12

"Among a bevy of patents awarded to Apple this week was one that would enable or disable certain features of a phone depending on its location. It could be useful, but it also raises serious questions about who really owns your device." http://j.mp/PZNegI (NBC via NNSquad) A lot of ideas are patented but never used. Anyway, without reading the patent in detail, I'd note there are a variety of apps (that probably postdate the patent application) that do this already. One problem with any attempt to enforce such a regime is that you need everyone to have phones carrying the capability, and you have to be ready for the litigation exposure if (for example) an important call or message is blocked by such a system. It doesn't take much imagination to think of a bunch of other exposure examples as well. ------------------------------

1 0