July 2018 - cypherpunks-legacy

DHS chief contemplating proactive cyber attacks (Steve Johnson)
by Richard Forno 06 Jul '18

06 Jul '18

Begin forwarded message (via Dave Farber's IP distribution): Steve Johnson, Homeland Security chief contemplating proactive cyber attacks *San Jose Mercury News*, 16 Apr 2012 sjohnson(a)mercurynews.com, Posted: 04/16/2012 07:35:38 PM PDT Updated: 04/16/2012 09:08:36 PM PDT http://www.mercurynews.com/rss/ci_20410915 Homeland Security Secretary Janet Napolitano said Monday she would consider having tech companies participate with the government in "proactive" efforts to combat hackers based in foreign countries. Napolitano, who made the comments during a meeting at the *San Jose Mercury News* with the editorial board and reporters, declined to say what steps corporations and federal agencies might take against foreign cybercrooks, who have been blamed for numerous computerized incursions against the United States. She made the remarks in response to a question, and emphasized the idea is merely one she would consider and that no decisions have been made. In discussing the private partnerships she is promoting to combat cyberattacks, Napolitano was asked if instead of just taking defensive measures, the government and companies should be launching proactive counterattacks against foreign-based culprits. "Should there be some aspect that is in a way proactive instead of reactive?" she responded, and then answered her own question with "yes." She added, "it is not something that we haven't been thinking about," noting someone else had raised the subject with her earlier Monday. However, Napolitano said some restrictions might have to be placed on businesses participating in such cyber activities because "what you are doing is authorizing a private entity to do what might otherwise be construed as an attack on another entity." [Long item truncated for RISKS. PGN] ------------------------------

1 0

DHS chief contemplating proactive cyber attacks (Steve Johnson)
by Richard Forno 06 Jul '18

06 Jul '18

Begin forwarded message (via Dave Farber's IP distribution): Steve Johnson, Homeland Security chief contemplating proactive cyber attacks *San Jose Mercury News*, 16 Apr 2012 sjohnson(a)mercurynews.com, Posted: 04/16/2012 07:35:38 PM PDT Updated: 04/16/2012 09:08:36 PM PDT http://www.mercurynews.com/rss/ci_20410915 Homeland Security Secretary Janet Napolitano said Monday she would consider having tech companies participate with the government in "proactive" efforts to combat hackers based in foreign countries. Napolitano, who made the comments during a meeting at the *San Jose Mercury News* with the editorial board and reporters, declined to say what steps corporations and federal agencies might take against foreign cybercrooks, who have been blamed for numerous computerized incursions against the United States. She made the remarks in response to a question, and emphasized the idea is merely one she would consider and that no decisions have been made. In discussing the private partnerships she is promoting to combat cyberattacks, Napolitano was asked if instead of just taking defensive measures, the government and companies should be launching proactive counterattacks against foreign-based culprits. "Should there be some aspect that is in a way proactive instead of reactive?" she responded, and then answered her own question with "yes." She added, "it is not something that we haven't been thinking about," noting someone else had raised the subject with her earlier Monday. However, Napolitano said some restrictions might have to be placed on businesses participating in such cyber activities because "what you are doing is authorizing a private entity to do what might otherwise be construed as an attack on another entity." [Long item truncated for RISKS. PGN] ------------------------------

1 0

[i2p] weekly status notes [dec 14]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all, time for the weekly status notes * Index 1) Net status 2) mail.i2p 3) roadmap 4) i2pcontent 5) i2p-bt 6) ??? * 1) Net status The 0.4.2.3 release included a whole slew of fixes and the net handled things pretty well. Over time we ran into a few long standing peer selection and overload problems on duck's irc server though, but after some patches that seems to have recovered nicely. There are a few key modifications that have been made since 0.4.2.3 that we'll be rolling out into a 0.4.2.4 release fairly soon: = bandwidth-based tunnel throttling = reenabling (with some tweaks) the probabalistic dropping of messages under heavy congestion = various profiling and ranking fixes = some time sync related updates. That last one is worth a bit more discussion, as it relates to something we've been seeing over the last day or two. For some reason, we have had a small portion of the network somehow get their clocks skewed by 5 minutes. We've recently improved the safe and automatic healing of the time synchronization, and there's also some new code to proactively kick out peers whose clocks skew after the connection is established. These are only partial solutions though - in the long run, we need secure NTP synchronization (or at least synchronization within our 60s margin of error). Before you say it, let me just reiterate that I'd love to get rid of the clock synchronization issue, and if you can come up with a way to do so securely, we'll do so. In any case, with the various fixes in place I do expect we'll have a new 0.4.2.4 release in the next day or three, so keep your ears to the ground. * 2) mail.i2p I've been hearing some whispering of some neat features coming from mail.i2p lately, and postman has some things he wants to discuss - swing on by the meeting and see what's up! * 3) roadmap No Dorothy, we aren't going to have the 1.0 release this month. I've updated http://www.i2p.net/roadmap with both revised content and a more conservative schedule. The old 0.4.3 release is being placed as 0.5 and 0.4.4 is being placed as 0.6, since they're both pretty hefty updates. You'll also note one of 0.6's new items - "Basic content distribution infrastructure". Thats... * 4) I2PContent Frosk has been posting [1] up some really cool ideas for a content distribution network on top of I2P, merging the old MyI2P with the original P2P network, the only one that can push terrabytes of data around without batting an eye and has a 20+ year track record - Usenet. Frosk's work on this is looking pretty exciting, so check out the posts on his blog and get in touch with him if you want to help! [1] http://frosk.i2p/ * 5) i2p-bt As announced [2] last week, duck & gang have claimed the swarming file transfer bounty [3] with their port [4] of the original BitTorrent to I2P! See the announcement for more details. [2] http://dev.i2p.net/pipermail/i2p/2004-December/000517.html [3] http://www.i2p.net/bounties [4] http://duck.i2p/i2p-bt/ * 6) ??? I'm sure there are thing that I'm overlooking and there's much left unsaid, so swing on by the meeting tonight and discuss things further. =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBv1LSGnFL2th344YRAsJ9AJ9by/2pRJs0dtkJF9A+qezpSRgPHQCgzTEz vL+gi2piiZq3aup7iyN/wRY= =3w0k -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[Politech] Data retention: Not just ISPs, but Google, domain registrars, and more? [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

The Bush administration has made it entirely clear that new laws forcing Internet service providers to save certain customer records for police convenience will be a priority this year. The concept is called data retention (also known as treating all Americans as suspects). This is not entirely new. The Bush Justice Department has been quietly shopping it around since at least mid-2005; I wrote about it at the time: http://news.com.com/Your+ISP+as+Net+watchdog/2100-1028_3-5748649.html But bureaucracies take a while to really get organized, and it wasn't until last year that Gonzales and Mueller got their talking points lined up and found some uncritical sympathizers in the U.S. Congress to carry their water for them. Here's a timeline: http://news.com.com/2100-1028_3-6118283.html This brings us to the key questions: What's the scope? Who will have to comply, and what type of data will be forcibly retained? Certainly broadband Internet service providers will be regulated. But how about coffee shops, bookstores, companies (like CNET) that provide free open wireless points, or even private individuals who do? Will they have to keep logs of who connects and what their users do? FBI and DOJ have also talked about search engines being forced to comply: http://news.com.com/2100-7348_3-6126877.html This may not be a big deal for Google, which seems to want to retain all user search data until the heat death of the universe, but it does limit the valuable competition over privacy-friendly practices that's taking place among search engines. AOL says it deletes personally identifiable search data after 30 days (and does not keep backups), and Ixquick.com is trying to differentiate itself from its rivals by embracing what its CEO told me was "the privacy cause": http://news.com.com/2100-1025_3-6034626.html http://news.com.com/2100-1025_3-6103486.html Domain name registrars have also been mentioned as targets of regulation. Rep. Bart Stupak, a privacy-impaired Democrat now in a position to make some mischief as chairman of an oversight subcommittee, said in September that: "If we do compel data retention, is there any reason Web hosting sites should be treated differently than ISPs?" See: http://energycommerce.house.gov/Subcommittees/ovin.shtml http://news.com.com/2100-1028_3-6119878.html GoDaddy's general counsel was on the panel and, unfortunately for the well-being of thousands of her customers, chose to curry favor by agreeing with this constitutionally-challenged politico rather than standing on principle. She allowed that such a law would be "productive" for law enforcement but should not include the content of communications. Unfortunately, in the realpolitik of Washington, that's tantamount to an enthusiastic endorsement. And Gonzales has already signaled that he's interested in more than just what IP address was assigned to what user. That's defined as non-content data, and it's readily accessible to Joe Local Cop (not to mention an FBI agent) armed with a simple subpoena, no judge's signature required. But last week (and nobody really noticed this), Gonzales suggested he wants to force data retention laws on ISPs for data that "could be accessed with a court order." See: http://news.com.com/2100-1036_3-6151325.html By talking about a court order instead of a subpoena, Gonzales seemed to be implying content data instead of just IP addresses. A subpoena is merely a request for documents signed by a lawyer; a court order is signed by a judge and compliance isn't exactly optional. Federal law draws a distinction: http://www4.law.cornell.edu/uscode/html/uscode42/usc_sec_42_00002000--aa000-. html I admit my interpretation relies on Gonzales being precise with his words (though the alternative is realizing our nation's top law enforcement officer knows less about court practices than a first year law student). If I'm right, Gonzales is contemplating the content of email you send, the content of web pages you visit, the content of IMs you send, the content of VoIP calls you -- all recorded, or some subset recorded, for future police convenience. Earlier today, Eric Wenger, a trial attorney with the Justice Department's computer crime unit, showed up at a bar association meeting and said the DOJ does not have a position on "what records would have to be retained": http://news.com.com/2100-1028_3-6152598.html One last thought: If all ISPs must keep track of what their users are doing, then criminals, terrorists, First Amendment supporters and all other miscreants would be more likely to use anonymizing proxies like Tor or anonymizer.com. If the DOJ is serious about this anti-privacy campaign, banning the use or operation of anonymizing services might be a next step (after all, data retention probably doesn't help track someone if he's using Tor). Unlikely? Probably. But not impossible. Remember, back in 1997, one House of Representatives committee voted to ban all encryption without backdoors for the DOJ, a step that made about as much sense as today's data retention mandates: http://news.com.com/2100-1023-961969.html -Declan _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

None
by Robert J. Berger 06 Jul '18

06 Jul '18

<dave(a)farber.net> Subject: The secret lobbying campaign your phone company doesn't want you to know about [I hope everyone has written their Congressmen to not dare give immunity to these anti-freedom activities! -Rob] Case Dismissed? The secret lobbying campaign your phone company doesn't want you to know about By Michael Isikoff and Mark Hosenball Newsweek Updated: 4:00 a.m. PT Sept 20, 2007 <http://www.msnbc.msn.com/id/20884696/site/newsweek/> Sept. 20, 2007 - The nationbs biggest telecommunications companies, working closely with the White House, have mounted a secretive lobbying campaign to get Congress to quickly approve a measure wiping out all private lawsuits against them for assisting the U.S. intelligence communitybs warrantless surveillance programs. The campaignbwhich involves some of Washington's most prominent lobbying and law firmsbhas taken on new urgency in recent weeks because of fears that a U.S. appellate court in San Francisco is poised to rule that the lawsuits should be allowed to proceed. If that happens, the telecom companies say, they may be forced to terminate their cooperation with the U.S. intelligence communitybor risk potentially crippling damage awards for allegedly turning over personal information about their customers to the government without a judicial warrant. b Itbs not an exaggeration to say the U.S. intelligence community is in a near-panic about this,b said one communications industry lawyer familiar with the debate who asked not to be publicly identified because of the sensitivity surrounding the issue. But critics say the language proposed by the White Housebdrafted in close cooperation with the industry officialsbis so extraordinarily broad that it would provide retroactive immunity for all past telecom actions related to the surveillance program. Its practical effect, they argue, would be to shut down any independent judicial or state inquires into how the companies have assisted the government in eavesdropping on the telephone calls and e-mails of U.S. residents in the aftermath of the September 11 terror attacks. b Itbs clear the goal is to kill our case," said Cindy Cohn, legal director of the Electronic Frontier Foundation, a San Francisco-based privacy group that filed the main lawsuit against the telecoms after The New York Times first disclosed, in December 2005, that President Bush had approved a secret program to monitor the phone conversations of U.S. residents without first seeking judicial warrants. The White House subsequently confirmed that it had authorized the National Security Agency to conduct what it called a b terrorist surveillance programb aimed at communications between suspected terrorists overseas and individuals inside the United States. But the administration has also intervened, unsuccessfully so far, to try to block the lawsuit from proceeding and has consistently refused to discuss any details about the extent of the programbrebuffing repeated congressional requests for key legal memos about it. <snip> ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Dewayne-Net] The secret lobbying campaign your phone
by dewayne＠warpspeed.com 06 Jul '18

06 Jul '18

company doesn't want you to know about [Note: This item comes from reader Robert Berger. DLH]

1 0

[IP] The secret lobbying campaign your phone company doesn't want you to know about
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[RISKS] Risks Digest 26.79
by RISKS List Owner 06 Jul '18

06 Jul '18

RISKS-LIST: Risks-Forum Digest Tuesday 17 April 2012 Volume 26 : Issue 79 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/26.79.html> The current issue can be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: Hospital generator failure following earthquake (Jonathan Hunt) For want of an isolating ground, a railroad was shutdown (Danny Burstein) Insider attack on smart meters (PGN) UK Government to give consumers control over smart meter data amidst privacy concerns (Bob Waixel) Why one in five U.S. adults don't use the Internet (CNN) 60% of Wikipedia entries about companies contain errors: correcting them isn't easy (Science News) Computer Fraud Act Case Dismissed (Donn Parker) GPS is a humanitarian weapon system (jidanni) DHS chief contemplating proactive cyber attacks (Steve Johnson via Richard Forno) MintChip -- a virtual cryptocurrency backed up by a government (Mark Thorson) ICANN data breach exposes gTLD applicant data ... (ars technica) CIA's Secret Fear: High-Tech Border Checks Will Blow Spies' Cover (Robert Schaefer) "Apple under fire for backing off IPv6 support" (Gene Wirchenko) CISPA, Cybersecurity, and the Devil in the Dark (Lauren Weinstein) Web freedom faces greatest threat ever, warns Google's Sergey Brin (The Guardian) DARPA Challenge Seeks Robots to Drive Into Disasters (ACM TechNews) Walled gardens look rosy for Facebook, Apple -- and would-be censors (The Guardian) Re: Unraveling a massive click fraud scheme (Martin Ward) "Did first DDOS attack sink the Titanic?" (Gene Wirchenko) Abridged info on RISKS (comp.risks) ----------------------------------------------------------------------

1 0

DHS chief contemplating proactive cyber attacks (Steve Johnson)
by Richard Forno 06 Jul '18

06 Jul '18

Begin forwarded message (via Dave Farber's IP distribution): Steve Johnson, Homeland Security chief contemplating proactive cyber attacks *San Jose Mercury News*, 16 Apr 2012 sjohnson(a)mercurynews.com, Posted: 04/16/2012 07:35:38 PM PDT Updated: 04/16/2012 09:08:36 PM PDT http://www.mercurynews.com/rss/ci_20410915 Homeland Security Secretary Janet Napolitano said Monday she would consider having tech companies participate with the government in "proactive" efforts to combat hackers based in foreign countries. Napolitano, who made the comments during a meeting at the *San Jose Mercury News* with the editorial board and reporters, declined to say what steps corporations and federal agencies might take against foreign cybercrooks, who have been blamed for numerous computerized incursions against the United States. She made the remarks in response to a question, and emphasized the idea is merely one she would consider and that no decisions have been made. In discussing the private partnerships she is promoting to combat cyberattacks, Napolitano was asked if instead of just taking defensive measures, the government and companies should be launching proactive counterattacks against foreign-based culprits. "Should there be some aspect that is in a way proactive instead of reactive?" she responded, and then answered her own question with "yes." She added, "it is not something that we haven't been thinking about," noting someone else had raised the subject with her earlier Monday. However, Napolitano said some restrictions might have to be placed on businesses participating in such cyber activities because "what you are doing is authorizing a private entity to do what might otherwise be construed as an attack on another entity." [Long item truncated for RISKS. PGN] ------------------------------

1 0

[i2p] weekly status notes [dec 14]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all, time for the weekly status notes * Index 1) Net status 2) mail.i2p 3) roadmap 4) i2pcontent 5) i2p-bt 6) ??? * 1) Net status The 0.4.2.3 release included a whole slew of fixes and the net handled things pretty well. Over time we ran into a few long standing peer selection and overload problems on duck's irc server though, but after some patches that seems to have recovered nicely. There are a few key modifications that have been made since 0.4.2.3 that we'll be rolling out into a 0.4.2.4 release fairly soon: = bandwidth-based tunnel throttling = reenabling (with some tweaks) the probabalistic dropping of messages under heavy congestion = various profiling and ranking fixes = some time sync related updates. That last one is worth a bit more discussion, as it relates to something we've been seeing over the last day or two. For some reason, we have had a small portion of the network somehow get their clocks skewed by 5 minutes. We've recently improved the safe and automatic healing of the time synchronization, and there's also some new code to proactively kick out peers whose clocks skew after the connection is established. These are only partial solutions though - in the long run, we need secure NTP synchronization (or at least synchronization within our 60s margin of error). Before you say it, let me just reiterate that I'd love to get rid of the clock synchronization issue, and if you can come up with a way to do so securely, we'll do so. In any case, with the various fixes in place I do expect we'll have a new 0.4.2.4 release in the next day or three, so keep your ears to the ground. * 2) mail.i2p I've been hearing some whispering of some neat features coming from mail.i2p lately, and postman has some things he wants to discuss - swing on by the meeting and see what's up! * 3) roadmap No Dorothy, we aren't going to have the 1.0 release this month. I've updated http://www.i2p.net/roadmap with both revised content and a more conservative schedule. The old 0.4.3 release is being placed as 0.5 and 0.4.4 is being placed as 0.6, since they're both pretty hefty updates. You'll also note one of 0.6's new items - "Basic content distribution infrastructure". Thats... * 4) I2PContent Frosk has been posting [1] up some really cool ideas for a content distribution network on top of I2P, merging the old MyI2P with the original P2P network, the only one that can push terrabytes of data around without batting an eye and has a 20+ year track record - Usenet. Frosk's work on this is looking pretty exciting, so check out the posts on his blog and get in touch with him if you want to help! [1] http://frosk.i2p/ * 5) i2p-bt As announced [2] last week, duck & gang have claimed the swarming file transfer bounty [3] with their port [4] of the original BitTorrent to I2P! See the announcement for more details. [2] http://dev.i2p.net/pipermail/i2p/2004-December/000517.html [3] http://www.i2p.net/bounties [4] http://duck.i2p/i2p-bt/ * 6) ??? I'm sure there are thing that I'm overlooking and there's much left unsaid, so swing on by the meeting tonight and discuss things further. =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBv1LSGnFL2th344YRAsJ9AJ9by/2pRJs0dtkJF9A+qezpSRgPHQCgzTEz vL+gi2piiZq3aup7iyN/wRY= =3w0k -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0