July 2018 - cypherpunks-legacy

[liberationtech] Microsoft Releases 2012 Law Enforcement Requests Report
by James Losey 05 Jul '18

05 Jul '18

>From the blog post: "As noted in the data table (available in the PDF below) in 2012, Microsoft and Skype received a total of 75,378 law enforcement requests. Those requests potentially impacted 137,424 accounts. While it is not possible to directly compare the number of requests to the number of users affected, it is likely that less than 0.02% of active users were affected. The data shows that, after a careful review of each request by our compliance teams, 18% of law enforcement requests to Microsoft resulted in the disclosure of no customer data. Approximately 79.8% of requests to Microsoft resulted in the disclosure of only non-content information, and only a small number of law enforcement requests (2.2%) resulted in the disclosure of customer content. To further explain the data, we have included Frequently Asked Questions and Answers below." Report page: http://www.microsoft.com/about/corporatecitizenship/en-us/reporting/transpa… Blog post: http://blogs.technet.com/b/microsoft_on_the_issues/archive/2013/03/21/micro… PDF: http://download.microsoft.com/download/F/3/8/F38AF681-EB3A-4645-A9C4-D4F31B… NY Times: http://www.nytimes.com/2013/03/22/technology/microsoft-releases-report-on-l… -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[gsc] Fwd: [IG061070621] IceGold support: Anti-money
by Darren Rhodes 05 Jul '18

05 Jul '18

laundering regulation Reply from Icegold. The regulation did originate from an EU directive - see message from Icegold reproduced below. Darren. ---------- Forwarded message ---------- From: Icegold Support <support(a)icegold.com> Date: 2 Jan 2008 10:45 Subject: Re: [IG061070621] IceGold support: Anti-money laundering regulation To: Darren Rhodes <darren.rhodes(a)gmail.com> Hello, Darren Rhodes <darren.rhodes(a)gmail.com> wrote: > In your news section you say, "Due to the pending adoption of the > new version > of Estonia's Anti Money-laundering Law ...". > I would be grateful if you could pass on details of the money > laundering > regulation (preferrably in English). The Estonian AML law has been adopted from EU DIRECTIVE 2005/60/EC (http://europa.eu.int/eur-lex/lex/LexUriServ/site/en/oj/2005/l_309/l_3092005… ) - All EU member countries had to adopt it by the end of 2007. Our law has been signed in parliament on Dec 20th: http://www.riigikogu.ee/?page=en_etapid&op=ems&eid=163492&u=20080102114239 .. and approved by President on Dec 27th: http://president.ee/en/duties/press_releases.php?gid=86520 It will take effect in 10 days after being published in the State Gazette (https://www.riigiteataja.ee/ert/intr/en.htm) which will happen in the next few days. The full text is in Estonian: http://www.riigikogu.ee/?page=pub_ooc_file&op=emsplain&content_type=text/ht… .. and the clauses addressing us directly are (i'll try to translate as good as i can): Muisted ' 6. Krediidiasutus ja finantseerimisasutus (2) Finantseerimisasutus kdesoleva seaduse tdhenduses on: 4) alternatiivsete maksevahendite teenuse pakkuja; (4) Alternatiivsete maksevahendite teenuse pakkuja on isik, kes oma majandus- vui kutsetegevuse kdigus ostab, m||b vui vahendab side-, |lekande- vui kliirings|steemi kaudu rahalist vddrtust omavaid vahendeid, mille abil on vuimalik tdita rahalisi kohustusi vui mida saab vahetada kehtiva vddringu vastu, kuid kes ei ole luikes 1 nimetatud isik ega finantseerimisasutus krediidiasutuste seaduse tdhenduses. Definitions ' 6. Credit and financial institutions (2) financial institution in the context of this law is: 4) provider of alternative payment systems (4) Provider of alternative payment systems is a person who - using communications, wiretransfering or clearing system - buys, sells or mediates means having monetary value which can be used to fulfill monetary liabilities or exchanged into valid currency and is not a credit institution as defined in the credit institution law Hoolsusmeetmed ' 15. Krediidiasutuse ja finantseerimisasutuse poolt hoolsusmeetmete kohaldamise erisused (1) Krediidiasutuses vui finantseerimisasutuses konto avamisel vui muu teenuse esmakordsel kasutamisel isiku poolt, kellega krediidiasutusel vui finantseerimisasutusel ei ole drisuhet, tuleb tehingus osaleva vui teenust kasutava isiku isikusamasus tuvastada, viibides isiku vui tema esindajaga samas kohas. (8) Alternatiivsete maksevahendite teenuse pakkuja on kohustatud: 1) tuvastama iga kliendi isikusamasuse drisuhte loomisel ja tehingu tegemisel kliendiga samas kohas viibides, kui selle kliendi tehingute vddrtus kalendrikuus |letab 15 000 krooni vui vurdvddrse summa muus vddringus; Due diligence measures 15. Distinct measures for credit and financial institutions (1) When opening an account or using another service for the first time in a credit or financial instutution, the person's identity must be verified while being in the same place with him (= face to face, customer physically present) (8) provider of alternative payment system is required to: 1) verify every customer's identity in the same place with him when establishing a business relationship or when making a transaction with the amount exceeding 15000 EEK (~1000 EUR) in one month. I hope that answers your question. Sincerely, Mati Malsub Customer Support IceGold -- Key ID:- 0xB76FE0B9 http://pgpkeys.mit.edu:11371/ http://en.scientificcommons.org/

1 0

[gsc] Fwd: [IG061070621] IceGold support: Anti-money
by Darren Rhodes 05 Jul '18

05 Jul '18

laundering regulation Reply from Icegold. The regulation did originate from an EU directive - see message from Icegold reproduced below. Darren. ---------- Forwarded message ---------- From: Icegold Support <support(a)icegold.com> Date: 2 Jan 2008 10:45 Subject: Re: [IG061070621] IceGold support: Anti-money laundering regulation To: Darren Rhodes <darren.rhodes(a)gmail.com> Hello, Darren Rhodes <darren.rhodes(a)gmail.com> wrote: > In your news section you say, "Due to the pending adoption of the > new version > of Estonia's Anti Money-laundering Law ...". > I would be grateful if you could pass on details of the money > laundering > regulation (preferrably in English). The Estonian AML law has been adopted from EU DIRECTIVE 2005/60/EC (http://europa.eu.int/eur-lex/lex/LexUriServ/site/en/oj/2005/l_309/l_3092005… ) - All EU member countries had to adopt it by the end of 2007. Our law has been signed in parliament on Dec 20th: http://www.riigikogu.ee/?page=en_etapid&op=ems&eid=163492&u=20080102114239 .. and approved by President on Dec 27th: http://president.ee/en/duties/press_releases.php?gid=86520 It will take effect in 10 days after being published in the State Gazette (https://www.riigiteataja.ee/ert/intr/en.htm) which will happen in the next few days. The full text is in Estonian: http://www.riigikogu.ee/?page=pub_ooc_file&op=emsplain&content_type=text/ht… .. and the clauses addressing us directly are (i'll try to translate as good as i can): Muisted ' 6. Krediidiasutus ja finantseerimisasutus (2) Finantseerimisasutus kdesoleva seaduse tdhenduses on: 4) alternatiivsete maksevahendite teenuse pakkuja; (4) Alternatiivsete maksevahendite teenuse pakkuja on isik, kes oma majandus- vui kutsetegevuse kdigus ostab, m||b vui vahendab side-, |lekande- vui kliirings|steemi kaudu rahalist vddrtust omavaid vahendeid, mille abil on vuimalik tdita rahalisi kohustusi vui mida saab vahetada kehtiva vddringu vastu, kuid kes ei ole luikes 1 nimetatud isik ega finantseerimisasutus krediidiasutuste seaduse tdhenduses. Definitions ' 6. Credit and financial institutions (2) financial institution in the context of this law is: 4) provider of alternative payment systems (4) Provider of alternative payment systems is a person who - using communications, wiretransfering or clearing system - buys, sells or mediates means having monetary value which can be used to fulfill monetary liabilities or exchanged into valid currency and is not a credit institution as defined in the credit institution law Hoolsusmeetmed ' 15. Krediidiasutuse ja finantseerimisasutuse poolt hoolsusmeetmete kohaldamise erisused (1) Krediidiasutuses vui finantseerimisasutuses konto avamisel vui muu teenuse esmakordsel kasutamisel isiku poolt, kellega krediidiasutusel vui finantseerimisasutusel ei ole drisuhet, tuleb tehingus osaleva vui teenust kasutava isiku isikusamasus tuvastada, viibides isiku vui tema esindajaga samas kohas. (8) Alternatiivsete maksevahendite teenuse pakkuja on kohustatud: 1) tuvastama iga kliendi isikusamasuse drisuhte loomisel ja tehingu tegemisel kliendiga samas kohas viibides, kui selle kliendi tehingute vddrtus kalendrikuus |letab 15 000 krooni vui vurdvddrse summa muus vddringus; Due diligence measures 15. Distinct measures for credit and financial institutions (1) When opening an account or using another service for the first time in a credit or financial instutution, the person's identity must be verified while being in the same place with him (= face to face, customer physically present) (8) provider of alternative payment system is required to: 1) verify every customer's identity in the same place with him when establishing a business relationship or when making a transaction with the amount exceeding 15000 EEK (~1000 EUR) in one month. I hope that answers your question. Sincerely, Mati Malsub Customer Support IceGold -- Key ID:- 0xB76FE0B9 http://pgpkeys.mit.edu:11371/ http://en.scientificcommons.org/

1 0

Re: [liberationtech] What I've learned from Cryptocat
by Tom Ritter 05 Jul '18

05 Jul '18

I agree with a lot of the points being raised, including all of Moxie's (especially about Google v Riseup) but also Eleanor's regarding niche products and irrelevancy. In particular I want to expand on this bit: On 6 August 2012 22:29, Moxie Marlinspike <moxie(a)thoughtcrime.org> wrote: > Let's stop using the word "plaintext," because my understanding is that > none of the chat services we're speaking of transmit data in the clear. > As I see it, there are currently three possible vectors for attack with > "existing" web-based chat services: > > 1) SSL interception. > 2) Server compromise. > 3) Server operator. > > The technology in CryptoCat v1 does not address any of these three > vectors, and all of them remain possible. My position is that it's > actually more susceptible to attack via #1 and #2 than existing > web-based chat solutions. I agree with that position wholeheartedly. Still, possible does not equate to easy. Cryptocat is the Jackie Robinson of Web Crypto Services[0]. And not to fault Nadim, as this is a volunteer effort, but there is more it can and should do to make it harder for #1 - just as Google and Facebook have done. - Cryptocat should use DNSSEC - even if validating resolvers are not deployed, it's another piece. Maybe down the road when a binary plugin is developed, it can validate the DNSSEC chain.[1] - It should Pin certificates in Chrome. As soon as the header is supported in any other browser it should use it. Same with TACK. - It should assert the SSL certificate with both DANE and DNSSEC-Stapled Certificates - It should (it does for the record, just saying) use Strict Transport Security - It should (it now does as of Sunday) deploy Content Security Policy - It should do all the other security techniques recommended: x-frame-options, X-Content-Type-Options, etc - Where it is possible, plugins should assert the validity of the Code and Keys - Controversial: It should use per-request mutated javascript obfuscation to make it more difficult to inline-middle the application in realtime[2] - It could experiment with browser enhancements to provide signed javascript files and so on All of those are not too difficult for an individual to try, and it makes SSL Interception harder. It's not any less possible, but it raises the bar. If you think these techniques aren't effective - I challenge you to do a live MITM of the gmail interface and have it still function seemlessly. It just flat-out won't work in Chrome of course, but even in Firefox - it is not trivial.[4] That's what I mean by being Jackie Robinson - you just have to be 'better'. Above and beyond. Trying to fix #2 is way, way harder because it's just impractical to tell someone "Oh, compile everything from source, run a perfectly secure Linux box with PaX and grsecurity, etc etc" Ideally, that's what we'd have. I suppose the important part is to acknowledge the risk of server compromise, and keep the bars approximately equal. If all the above measures were employed, but the server left the way it was - then rooting the box is absolutely easier. Google and Facebook have a huge advantage here. [0] If you don't get the reference, Jackie Robinson broke the segegration barrier in US baseball - he was spit, cursed, threatened with murder, had pitches thrown at his head - and through it all, he just played the game steadfastly. There's an urban legend (I'm unsure on it's truth) that his contract stated he couldn't complain, even when fans spit on him. [1] If your arguement is 'I don't trust DNSSEC' my response is 'Me neither, but I believe in beaurcracy and turf wars and that it'd be more difficult for a government to subvert two PKIs than one.' [2] If your arguement against it is "but then I can't audit it" my argument is "you don't audit it now." If your argument is still "I can't trust the code delivered" my response is "well, since you obviously are doing local SSL interception to read the server responses, hash the mutated javascript serverside, and send a PGP signature along with it so you can do the same and trust it that way". [3] [3] Heck, maybe that's a way to upgrade web services to thick client services - have an optional thick client someone can run that sits as a proxy running verification. Same web interface works with or without the tool, but the tool provides run-time verification. [4] Javascript obfuscation makes it difficult to rewrite the code; if you add code - CSP prevents you from exfiltrating easily; and if you exfiltrate to another user in the chat the chatters *should see* this other user in the chat they don't trust. > I believe your position is that it improves > on vector #3 by virtue of being not-Facebook. (I'm curious how you > measure #3 in comparison to GChat.) > > If we postulate that CryptoCat does improve vector #3 by virtue of being > not-Facebook, it isn't a result of the technology, but simply that we've > agreed Nadim has a better monitoring/interception track record than > Facebook. If that's something you think is valuable, it actually seems > like it'd potentially be better served by having someone like the EFF or > Riseup host a web-based and SSL-protected chat service, without brining > any additional cryptography confusion into the mix. A trust project, > not a cryptography project. Yes, yes, yes. There is a *tremendous* amount of implicit and unmentioned TRUST in the person operating the service or relying on the software. That's why anyone would use RedPhone, TextSecure or WhisperCore back when it was closed source. Because people *trusted* Moxie. If the EFF hosted an e-mail solution I'd be throwing money at them to let me sign up. Because Google is huge and diverse - they are obligated to respond to legal threats in most of the countries of the world. Because Google is huge and opaque - I have little faith in their ability to notify me/etc in the event of a LE request. But the EFF has both juristiction on their side (arguably they'd have more if they were based in, say, Scandenavia) and they have trust. I trust that the EFF will fight harder for me than Google. And there's intimidation factor - a LE agency ought to know if they come the the EFF with a request they need to back it up with a supoena or warrant. I absolutely think of riseup as a trust project. I would like to see many more of them. Nick Merril's Calyx Institute I think of as a Trust Project. He's trying very hard to remove Trust, and make it a cryptography project - but he literally has to build the infrastructure for that because it doesn't exist. (Which is one of the reasons you can't actually buy any services from them yet.) It will be *very* interesting to see how Phil Z's and Jon Callas' Silent Circle positions itself. A trust project? They're aiming to remove trust also; but to what extent can they? Trying to improve upon the trust factor is extraordinarily difficult. I think, in the short term, it relies on linking up with a person or organization people already trust - and therefore somehow convincing them to trust you. And in the long term - devoting your life to being a trustworthy individual. Not something we can solve with cryptography - even a thick client. Anyway, I realize I haven't addressed the issue of 'Should cryptocat move to this model or that, shut itself down, add warnings, push forward with users, etc'. But I wanted to raise the point that it can do more, today, to make users safers - and if _any_ webapp in this sphere wants to push the envelope, it should probably do those things first.* And since people are already using it, these are options to improve security besides just shutting it down. -tom * None of this is meant to be a slight at Nadim, who has certainly earned my respect for both his effort and his results so far. _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

EDRi-gram newsletter - Number 7.5, 11 March 2009
by EDRI-gram newsletter 05 Jul '18

05 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 7.5, 11 March 2009 ============================================================ Contents ============================================================ 1. Nokia Law approved 2. IRMA tries to block websites 3. No e-voting in Germany 4. EP wants a better balance between Internet security and privacy rights 5. At Large Structures in ICANN get together for the first time 6. Swedish Pirate Bay trial waiting now for the decision 7. Biometric passports law - upheld by the Romanian authorities 8. Yahoo penalised in Belgium for not disclosing personal data 9. UK Tribunal wants the Gateway reviews on ID scheme made public 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. Nokia Law approved ============================================================ The snooping law, also called Lex Nokia, was approved in the Finnish Parliament two weeks ago. EDRi-member Electronic Frontier Finland has appealed to Tarja Halonen, the President of Finland, to intervene: before signing it President Halonen should request the Supreme Court's opinion on whether the amended Act on the Protection of Privacy in Electronic Communications clashes with the constitution. Member of Parliament, Jaakko Laakso (Left Alliance) suggested that the Parliament should request a statement on the constitutionality of the law from the Venice Commission. Some parliamentarians, for example Heli Jdrvinen (Greens), also agreed with professor Tuomas Ojanen, who has advised that some organizations should take the matter up with the European Court of Human Rights. Other EDRi-members have confirmed that the situation can be worst in other European countries. In Spain there is no specific law, but based on a sentence from the Spanish Supreme Court, employers can inspect data and communications at work under the condition that the employer previously declares a policy for the use of computers and Internet at work, e.g. what digital communications and files are going to be inspected. Therefore, employers can establish the level of privacy at work, as for the Supreme Court the usage of computers and Internet is not covered by the law on worker's rights. In France there is a decision from 9 July 2008 by the Cassation Court concluding that "connections established by an employee to Internet websites during his working time and thanks to the computer provided by his employer to execute his work are presumed to have a professional character, such that the employer may search them in order to identify them, in the absence of the employee". In other words, the whole navigation history of an employee can be searched by the employer. Previously, a decision of 2006 by the same court in a different case, established that all computer files of an employee are presumed as professional, unless they are explicitely marked as "personal", and can thus be searched in his absence. For email messages, the same court ruled in a third case in 2001 that email should obey the same regime (professional, unless marked as "personal"). In summary, in France anything unmarked as "personal" is searchable by the employer, in the absence of the employee. Parliament Passes "Lex Nokia" Bill (4.03.2009) http://www.yle.fi/uutiset/news/2009/03/parliament_passes_quotlex_nokiaquot_… Finnish Parliament approves e-mail tracking law (5.03.2009) http://www.google.com/hostednews/ap/article/ALeqM5jRG7d99c10vDp52Lh3KNxJKz8… EFFI urges Finnish president to intervene in Lex Nokia (5.03.2009) http://newsroom.finland.fi/stt/showarticle.asp?intNWSAID=21122&group=Politi… Spanish Supreme Court Decision on snooping (only in Spanish, 26.09.2007) http://www.habeasdata.org/Sentencia-TS-sobre-control-empresarial-del-correo… Cybersurveillance at work in France (only in French, 28.07.2008) http://www.legalbiznext.com/droit/Cybersurveillance-du-salarie-dans French DPA (CNIL) - Guide for employers and employees (only in French, 2008) http://www.cnil.fr/fileadmin/documents/La_CNIL/publications/CNIL_GuideTrava… Venice Commission http://www.venice.coe.int/site/main/Presentation_E.asp EDRi-gram: Lex Nokia storms into the Finnish Parliament (25.02.2009) http://www.edri.org/edri-gram/number7.4/lex-nokia-finland ============================================================ 2. IRMA tries to block websites ============================================================ IRMA, the Irish Recorded Music Association, wants to block Irish Internet users' access to certain websites. In February 2009, after having reached the deal with Eircom, the association sent letters to Irish Internet providers asking them to block the sites that it indicated, under threat of legal action. Eircom has already agreed to a "three strikes" approach and IRMA was to take the same approach with all other Irish ISPs. In terms of the agreement, the evidence of illegal downloads will be provided by IRMA and Eircom will take action without a court hearing. Unfortunately, the agreement also means that Eircom is not to oppose any application blocking file-sharing websites from their network. Apparently, IRMA will monitor peer-to-peer networks using DtecNet. Any allegedly suspicious IP addresses will be passed on to IRMA which will "present the evidence" to Eircom, without the necessity of a court hearing and in the absence of the accused. "While IrelandOffline doesn't condone illegal file-sharing, this move is not a proper solution to the problem, and impedes on legal and legitimate internet access in the process," said Eamonn Wallace, spokesperson for broadband lobby group IrelandOffline. According to Damien Mulley, former chairman of IrelandOffline, IRMA will start by blocking The Pirate Bay, then Mininova, IsoHunt, YouTube and "I don't think they'll stop there too, any site that links to The Pirate Bay and the others on the hate list will probably be added to the list too. (..) this is what it is in my view an attack on our freedom to read, our freedom to write, our freedom to move around the web". Those who will suffer most will the users, who will be cut off based on allegations made by the association without any involvement of the court and the websites which could be blocked, based on a court hearing where they will have no say. Blackout Ireland, a group of Irish Internet users, believes that this scheme not only is inefficient in combating piracy but it is also a serious breach of civil liberties. At the same time, blocking websites never works as pirates can easily circumvent any blockage and only legitimate users will actually suffer from it. "Censorship is not a solution. It is avoiding the issue. It does not pay artists for their work," says Blackout Ireland. Blackout Ireland is also organizing a blackout that started on 5 March and will last for one week encouraging people to set their picture on sites like Facebook, Bebo, Twitter, MSN, etc black and to take a stand on this issue by blog posts, letters to newspapers or any form of communication. Irish Blackout: Why Irish ISPs Should Stand with Their Customers (4.03.2009) http://www.eff.org/deeplinks/2009/03/irish-blackout Blackout Ireland - Some Questions (28.02.2009) http://andyaz.ie/blackout-ireland-some-questions/ Lobby group calls for stop to censorship plans (26.02.2009) http://www.siliconrepublic.com/news/article/12374/digital-life/lobby-group-… Music industry pushing for internet filtering as well as "three strikes" - what can you do about it?(26.02.2009) http://www.digitalrights.ie/2009/02/26/music-industry-pushing-for-internet-… Blackout Ireland http://www.blackoutireland.com/ IRMA letter to ISPs (13.02.2009) http://blog.blacknight.com/images/irmaletter.pdf EDRI-gram: Irish ISP settled to introduce 3 strikes (11.02.2009) http://www.edri.org/edri-gram/number7.3/3-strikes-ireland ============================================================ 3. No e-voting in Germany ============================================================ The German Federal Constitutional Court decided on 3 March 2009 that electronic voting used for the last 10 years, including for the 2005 general elections, was unconstitutional and therefore not to be used for the next elections in September 2009. The court ruled that the use of the electronic machines contradicts the public nature of elections and the equipment used in 2005 had some shortcomings. However, as there has been no evidence of errors in the past, the results of the previous elections remain valid. The use of e-voting was challenged by political scientist Joachim Wiesner and his son, physicist Ulrich Wiesner who complained that the system was not transparent because the voter could not check what actually happened to his vote, being actually asked to blindly trust the technology. The voting machines which are manufactured by the Dutch firm Nedap, do not print out receipts. In the plaintiffs' opinion, the results could be manipulated. A petition signed by over 45 000 people in 2005, trying to ban e-voting, had been rejected by the German Government. Now, the court ruled that the Federal Voting Machines Ordinance having introduced e-voting was unconstitutional because it did not "ensure that only such voting machines are permitted and used which meet the constitutional requirements of the principle of the public nature of elections." Also the court considered that, differently from the traditional voting system where manipulations and frauds are much more difficult involving a high degree of effort and a high risk of detection, "programming errors in the software or deliberate electoral fraud committed by manipulating the software of electronic voting machines can be recognised only with difficulty." Also, in the court's opinion, the electors should be able to verify how their vote is recorded without having to possess detailed computer knowledge. "If the election result is determined through computer-controlled processing of the votes stored in an electronic memory, it is not sufficient if merely the result of the calculation process carried out in the voting machine can be taken note of by means of a summarising printout or an electronic display." A campaign against electronic voting has been initiated by EDRi member Chaos Computer Club together with the Dutch foundation Wij vertrouwen stemcomputers niet (We don't trust voting computers) because of the risk of electronic errors and the potential for abuse. After a group of hackers had succeeded in tampering with similar machines in the Netherlands in 2006, the Dutch Government imposed a moratorium on the use of electronic voting machines and Ireland also has banned electronic voting. German Court Rules E-Voting Unconstitutional (3.03.2009) http://www.dw-world.de/dw/article/0,,4069101,00.html Federal Constitutional Court - Press release on Use of voting computers in 2005 Bundestag election unconstitutional (3.03.2009) http://www.bundesverfassungsgericht.de/en/press/bvg09-019en.html Voting machines unconstitutional in Germany (3.03.2009) http://able2know.org/topic/129942-1 EDRi-gram: Electronic voting machines eliminated in the Netherlands (24.10.2007) http://www.edri.org/edrigram/number5.20/e-voting-machines-netherlands ============================================================ 4. EP wants a better balance between Internet security and privacy rights ============================================================ On 5 March 2009, during a hearing of the Civil Liberties and Home Affairs (LIBE) Committee focused on the strengths and weaknesses of the current framework on security and privacy on the Internet, Members of the European Parliament (EP) and experts agreed on the necessity to create a better balance between Internet security and the protection of online personal data. The participants, including the European Data Protection Supervisor, academics, representatives of the Commission and of the Czech Presidency, supported a report drafted by Stavros Lambridinis proposing recommendations aimed at providing "adequate protection of fundamental freedoms while delivering also an enhanced security." The report calls on the Member States and the European Commission to draft proposals defining global standards for data protection, security and freedom of expression. The rapporteur believes the access to the internet should be treated just like the access to education and should never be blocked by governments or private companies. He also considers that the user's consent to share data should be clearly defined to create a fairer balance of powers between users and governments and private companies. EDPS Peter Hustinx said that as the Internet has become an integral part of our everyday life, "we must apply the same values as we do in our society (...), fundamental rights must apply and that's that. (...) In the old world it was fairly simple. On the internet there is a system of layers, responsibility is more complex and therefore tends to vanish. This must be clarified". Hustinx emphasized the fact that the present European regulatory framework applying to the Internet is a holistic one and that a horizontal approach was needed. In his opinion, the Data Protection Directive applying to the Internet does not give a very clear definition of personal data on the Internet and that the current responsibility and control mechanisms should be also clarified and improved. He believes a key issue is that of the user's consent for data sharing. Presently, there is a large range of types of online consents which leads to a complex regulatory environment. It is also difficult now to reach transparency of the data processing. The EDPS added that he did not want to see "an environment of permanent surveillance" (making reference to three-strikes schemes), that international cooperation and self-regulation should be promoted and children awareness-raising should be increased. During the hearing, Gus Hosein of Privacy International expressed his concern related to the fact that the EU seems to have followed Bush administration as regards data retention. "Is that what you want to export to the rest of the world? The EU should be a ray of light for human rights but at the moment it's the opposite (...) we must change course and the Lambrinidis report is the opportunity to turn things round," he said. Jim Killock, executive director of the Open Rights Group, warned about potential dangers of an uncontrolled use of personal data by the governments and public institutions and asked the EU for a close monitoring and the issue. In his opinion, transparency and user consent must be clear rules and strict regulation should apply to protect personal data. He believes it is important "to ensure that a charter of rights comes into being very soon". Professor Steve Peers from University of Essex, the author of "Strengthening security and fundamental freedoms on the Internet - An EU Policy on the fight against cybercrime" study commissioned by the EP, also made some recommendations. He believes in the necessity of adopting a non-binding Internet Bill of Rights, drawn up by the EP and supported by industry players, NGOs, Member States, EU institutions and national public authorities. He also recommended that the EU criminal law should be brought in line with the provisions of the different Council of Europe Conventions regarding offences related to data interception, breach of confidentiality and data security, spam or child pornography. As final remarks of the hearing, the Presidency representative, Mr Ondrej Veselsk}, Head of International Law Department at the Ministry of Interior of the Czech Republic, stated that a balance between privacy and security should be achieved, that the rules of the "real world" should apply to the Internet as well, that access to the Internet should be open and that a larger cooperation is necessary in the fight against cybercrime. He stated that one of the priorities of the Czech Presidency was the protection of minors and the presidency intended to improve the cooperation between the different police of the Member States. Stavros Lambridinis's report will be put to the vote at the Strasbourg full plenary session of the European Parliament on 23 March 2009. Committee on Civil Liberties, Justice and Home Affairs - Streanghening Fundamental Freedoms and Security on the Internet (5.03.2009) http://www.europarl.europa.eu/meetdocs/2004_2009/documents/oj/770/770844/77… EP Press Release - Protecting citizens' rights on the internet (6.03.2009) http://www.europarl.europa.eu/news/expert/infopress_page/019-50634-061-03-1… Europeans push for more online rights to privacy (6.03.2009) http://www.macworld.com/article/139244/privacy.html ============================================================ 5. At Large Structures in ICANN get together for the first time ============================================================ For the first time in ICANN history, at the 34th International ICANN meeting in Mexico City the representatives of 88 At-Large Structures (ALS) from five Regional At-Large Organizations representing ICANN's global At-Large community came together to discuss the main ICANN policies and ALS's role in ICANN institutions. The first-ever gathering of the representatives of individual Internet users (At Large Summit - ATLAS) participating in ICANN was an opportunity to make direct recommendations in relation with ICANN policy, by developing a public statement on 5 key-areas where five working groups with ALS members have identified the major issues as brought up by the Internet user representatives. Four EDRi-members (Netzwerk Neue Medien - Germany, FITUG- Germany, ISOC Bulgaria and APTI Romania) part of the European At Large Organization (EURALO) participated in the working groups. The first working group focused on engagement in ICANN recommending the consultation of regional ALSes for the most effective ways to reach communities and end users and to use the multilingualism best practices of other international organizations, such as the UN. The second working group discussed the future structure and governance of ICANN, as capture, internationalization and the continued funding of ICANN are among the more important governance issues now facing the institution. The group suggested a number of actions to provide safeguards against capture. They have also underlined that "given the economic and social importance globally of a safe and stable Internet, the process of internationalization of ICANN must safeguard the global/worldwide role of ICANN regarding domain names and numbers identifiers and promote larger participation from all stakeholders globally." The new gTLDS (generic Top Level Domains) and IDNs (internationalized domain name) was the main focus of the third working group, highlighting that the current fee schedule for the new gTLDs is a clear barrier to the entry of potential applicants, especially those who have no interest in monetizing the TLD and those initiated in the developing and least developed countries. The group also suggested opening a third round of gTLD applications, with a fixed deadline, that will be subject to the string contention dispute mechanisms described in the current guide. The ALSes expressed their concern that the proposed "Legal Rights" objection protocol exceeded the existing territorial and class-of-goods limitations contained in the current international trademark treaties. They suggested that ICANN should not engage in any trademark protection regime which extends beyond existing international treaties; doing so in effect turns ICANN into an unauthorized treaty organization. Working group four debated the hot topics of transparency and accountability and issued reconsiderations regarding the development of a budget for each ICANN entity (including At-Large) according to their mandates including staff costs. The budgets should be made public with the annotation of substantive ICANN documents under consultation to indicate the origin of support or dissent for specific proposals. The members of ALSes also envisaged "that in order to give ICANN a clearer image of a multi-stakeholder organisation, including Civil Society, the composition of the Board should be re-balanced to afford a greater visibility and representation of the Civil Society as represented by the At Large Community. ALAC proposes that the ICANN Board should include two voting Directors nominated by the At Large Community." New DNS security issues that fall within the ICANN's Mandate formed the core of the debates in the fifth working group and urged ICANN to support the industry efforts to accommodate DNSSEC and its provision in a more secure environment and to proceed in the process of having the root signed in a way that provides integrity and is globally accepted. The ALSes also initiated a series of thematic sessions on the topics interesting for its members, but also other ICANN constituencies. The session on the Internet rights and principles noted that "ICANN still lacks a coherent and systemic approach to evaluate the impact that its policy decisions have on rights in general, be them human rights, consumer rights or other founding principles, as internationally recognized and/or defined in the major national legislations." A hot topic was privacy and the Whois database, where the Internet users representatives highlighted the ICANN's inability to progress and to make policies compatible with the various national laws. It was suggested that ICANN should cease aiming at a single global policy and accommodate national differences instead, depending on the country of the registrar and registrant, explaining the differences in privacy regulation between Europe and US. The sessions discussed the issue of respecting freedom of expression when selecting new gTLDs. The ongoing policy provision that allows ICANN to reject applications based on morality-based objections was criticized. The participants supported the idea of a standardized statement of registrant rights (Registrants Rights Charter) to be compulsorily shown by registrars (and resellers as well) when a registrant buys a domain name. Participants agreed to work further on a proposal for its substance as well as means to include the charter into ICANN's policy body as a follow-up to the meeting. The process is open and anyone can join. Another Thematic Session highlighted the failure of ccTLDs as regards the identity control of registrants and registrars. A second aspect was the abuse of the weakness of registrars in the GTLD space giving the spammers and other criminals, free way to do what they want. At the end of this ICANN meeting, the announcement of Dr Paul Twomey, the President and Chief Executive Officer of ICANN that he would not seek renewal of his contract at the end of 2009, was acknowledged by the ALSes as a starting point for further activities and challenges. At Large Summit (Atlas) Declaration Mexico (4.03.2009) http://www.atlarge.icann.org/files/atlarge/correspondence-05mar09-en.pdf At-Large Summit Successfully Concluded (5.03.2009) http://www.atlarge.icann.org/announcements/announcement-05mar09-en.htm Registrants Rights Charter - draft http://internetrightsandprinciples.org/node/74 ICANN's President and CEO Announces Departure (2.03.2009) http://www.icann.org/en/announcements/announcement-02mar09-en.htm Briefing Note - Overall Summary of the Mexico City Meeting (5.03.2009) http://mex.icann.org/briefing-note ============================================================ 6. Swedish Pirate Bay trial waiting now for the decision ============================================================ The Pirate Bay trial in Sweden continued until 3 March 2009 with the hearings of the prosecution and defence witnesses. The earlier events of the trial were covered in the previous EDRi-gram. While a day before, the representatives of the music industry tried to convince the jury that The Pirate Bay was responsible for half of the losses the industry had suffered during the last years because of illegal downloadings, the defence witnesses tried to show BitTorrent was not a bad thing and file-sharing was actually beneficial. One of the witnesses, Kristoffer Schollin from Gothenburg University, an IT lecturer with interest in file sharing, made a special witness report for the court and explained that torrent files were a more sophisticated type of Internet link (such as an http hyperlink) and that The Pirate Bay was an "open database" of torrent files, a type of Bulletin Board. He also stated that there were other large companies using the same technology and besides. He also admitted that while searching for torrents via Google, more results could be found than with The Pirate Bay. Regarding the issue of whose actual tracker is used when a torrent file is activated, Schollin said that a torrent being available on The Pirate Bay, doesn't automatically mean that the file uses The Pirate Bay's tracker. He explained also how to make a torrent file which links to content. In the creation stage, an Internet connection is not even necessary everything being done on a user's PC with a torrent client, not on The Pirate Bay. The torrent file thus created can be uploaded on the Internet and it is further on indexed by Google, which then allows anyone to access the torrent via a Google search. One of the points he emphasized was that actually he believed the popularity of The Pirate Bay was mostly due to the many discussions and mediatization Contradicting the music industry representatives who declare that sales of CDs have decreased due to illegal downloading, Roger Wallis, a media professor, composer and Chairman of the Swedish Composers of Popular Music, confirmed that downloading caused an increase in sales of live event tickets and that there were also other reasons for the CD sales decrease, such as the growth of computer games. During the same day, a film was played to show how a torrent is created. and how torrent files can be shared through MSN, Skype, through blogs like Wordpress. The last two days of the trial were dedicated to the closing arguments of the prosecution and of the defence. Prosecutor Hekan Roswall said The Pirate Bay should not be treated as a service provider to get a "common carrier" status, and that the Supreme Court had already previously ruled that someone running a BBS could be found guilty of assisting copyright infringement and The Pirate Bay should be viewed as such. He said he was not asking the court to rule on the legality of BitTorrent itself, but on what the defendants did with the technology. Roswall called for the confiscation of The Pirate Bay hardware and demanded for one year jail for all four defendants. Peter Danowsky of the IFPI claimed that The Pirate Bay was a commercial operation and that the defendants had contributed to copyright infringement. Therefore the record labels had to be compensated for the losses caused by the operation of The Pirate Bay. Henrik Pontin from Antipiratbyren argued that the defendants clearly knew that what they were doing was illegal, and The Pirate Bay clearly operated as a business, making money from advertising revenue. He asked for damages for the entertainment industry and for jail for the defendants so as to give an example to others who wics to infringe copyright. Monique Wadsted, representing the movie companies, also called for a "very significant" prison sentence because the defendants were aware of their criminal acts and made money from it. "They have made more than 10 million Swedish crowns in revenue during one year. And they continue to run the operation in spite of being convicted in other countries. Furthermore, they spit on the rights holders and tell them to go to hell," she said. During the last day of the trial, the four defence lawyers made their closing statements arguing that the Pirate Bay site acted just as a search engine. They considered the prosecution had failed in revealing any uploaders or downloaders from The Pirate Bay, and in establishing that most of the links on the Pirate Bay were to copyright material. Linking to copyright material wasn't specific to The Pirate Bay, it was an Internet problem. Carl Lundstrvm's lawyer, Per E Samuelson, argued that attacking The Pirate Bay was like going against car manufacturers for the problems experienced on the roads. Regarding the financial issues of the matter, in the defence opinion, the prosecution had exaggerated regarding the amount of money the site made. Gottfrid Svartholm's lawyer Ola Salomonsson said there were only four adverts on The Pirate Bay, not 64 as the prosecution had claimed. The revenues therefore were less than the costs. The defence approach in the court was that of "I am not Responsible". The verdict is due on 17 April 2009. The Pirate Bay Trial Day 9: BitTorrent Is Not Evil (26.02.2009) http://torrentfreak.com/pirate-bay-trial-day-9-bittorrent-is-not-evil-09022… A good day for the roses: Pirate Bay trial, day 9 (26.02.2009) http://www.guardian.co.uk/technology/blog/2009/feb/26/pirate-bay-trial-roses The Pirate Bay Trial Day 10: Calls for Jail Time (02.03.2009) http://torrentfreak.com/the-pirate-bay-trial-day-10-calls-for-jail-time-090… Pirate Bay Day 11: trial ends, verdict awaited (3.03.2009) http://www.guardian.co.uk/technology/blog/2009/mar/03/pirate-bay-last-day EDRI-gram: The trial of The Pirate Bay in Sweden (25.02.2009) http://www.edri.org/edri-gram/number7.4/pirate-bay-trial-sweden ============================================================ 7. Biometric passports law - upheld by the Romanian authorities ============================================================ The Emergency Government Ordinance introducing biometric passports in Romania remains applicable as the Legal Commission of the Senate advised it favourably on 3 March 2009 and the Romanian Appeal Court rejected on 18 February the appeal made by several NGOs for its suspension. The ordinance had been resent on the 28 February to the legal commission by the Romanian Senate after heavy debates and concerns. Besides the very hot debate around the "malefic figure 666" allegedly occurring in the chip of the passports, the discussions in the Senate addressed also concerns related to the lack of a proper security system for the data stored for biometric passports. "If a hacker with a laptop passes by you and captures the frequency of your passport chip, he can change you, in a few hours, from a criminal record free person into a drug or weapon dealer for example" stated Georgian Pop, deputy in the defence commission. The ordinance has been heavily contested, the opponents arguing that it breaches the rights provided by the Constitution of Romania, the right to private life and the right to religion. It was also argued that the Government had not announced this act publicly, with the intention to meet EU requirements without taking into consideration the public opinion. A big debate turned around the religious aspect of the matter. A lawyer at the case opened by the NGOs stated that "the introduction of chips into passports affects the right to religion because it changes the name given by God into a figure" and the procedure affects human freedom by surveillance and control measures. Recently, the Saint Synod, the Romanian Orthodox Church highest board has agreed with the introduction of the biometric passports, but required the implementation of an alternative for those who do not wish to have biometric passports with chips. "As some people are reluctant towards the biometric passports, an intervention will be made to the institutions of the Romanian State (Presidency, Parliament, Government) with the request to adopt the necessary measures to modify and complete the legislation in force by extending the provisions regarding the emergency cases (temporary passport) and for cases when, due to conscience or religious reasons, the person does not want an electronic passport including biometric data" says the press release of the Romanian Patriarchy. The head of the General Division of passports Aurel-Vasile Sime stated that figure 666 did not occur anywhere and that the passports would not be biometric but electronic, including two biometric elements: face image and fingerprints. He also added that these new passports would not be mandatory, the Romanian citizens being able to choose temporary passports valid for one year that do not include biometric elements. Since the end of 2008 many protests have taken places in several cities in the country against the introduction of electronic passports in Romania and they continued even after the favourable advice of the Legal Commission of the Senate and the rejection by the Bucharest Appeal Court of the NGOs appeal. About 300 members from several protested on 7 March in front of the Romanian Patriarchy. The participants stated that the measure meant all Romanians are considered potential criminals and that was an attack to their identity. They also protested against the lack of firmness from the Orthodox Church in this matter. Romania is one of the first country to introduce biometric passports that include fingerprints, while even in the EU countries a strategy for the personal data protection in this respect is still unclear. Favourable advice for the EGO introducing electronic passports with biometric identification elements (only in Romanian, 3.03.2009) http://www.hotnews.ro/stiri-ultima_ora-5464136-aviz-favorabil-pentru-oug-pr… The senators decided to resend the ordinance on the introduction of biometric passports to the Legal Commission (only in Romanian, 25.02.2009) http://www.hotnews.ro/stiri-politic-5448158-senatorii-decis-retrimiterea-co… The Ordinance on biometric passports goes forward (Video) (only in Romanian, 18.02.2009) http://www.mediafax.ro/social/ordonanta-privind-pasapoartele-biometrice-mer… The biometric passports advised by the defence commission of the Deputy Chamber (only in Romanian, 10.02.2009) http://www.mediafax.ro/social/pasapoartele-biometrice-avizate-de-comisia-de… Saint Synod requires an alternative to the biometric passports (only in Romanian, 28.02.2009) http://www.realitatea.net/sfantul-sinod-solicita-alternativa-la-pasapoartel… The request regarding the suspension of the effects of the ordinance on the introduction of biometric passports rejected by the court (only in Romanian, 18.02.2009) http://www.hotnews.ro/stiri-esential-5428486-cererea-privind-suspendarea-ef… EDRIgram: Romania: Protests against biometric passports (11.02.2009) http://www.edri.org/edri-gram/number7.3/romania-biometric-passports-protests ============================================================ 8. Yahoo penalised in Belgium for not disclosing personal data ============================================================ Yahoo was fined by a Belgian court on 2 March 2009 for refusing to hand over to the Belgium authorities personal data of people involved in a cyber-crime investigation. The Belgium authorities had required Yahoo to disclose detailed account information for a number of e-mail addresses used by alleged cons under pseudonyms. Yahoo refused, arguing that such a request should have followed the proper channels and should have been addressed to US authorities and not to them as a commercial company. They would be willing to offer the information at the request of the US authorities. However, the prosecution claimed that the company should hand over the required data as the company has operation services in Belgium and therefore they should comply with the laws of the country. The court ruled in favour of the prosecution and fined the American company 55 000 euro plus 10 000 euro for each day it keeps refusing to hand over the requested users' data. The judge said that the procedure for requesting data "poses absolutely no problem with Google and Microsoft". The official statement of the company was that it strongly disagreed with the court's ruling and that it would file an appeal. "Yahoo! Inc., a U.S. corporation, does not have business operations in Belgium and does not maintain the customer information at issue in Belgium. The United States and Belgium have a formal international treaty which the prosecutor should have followed to properly seek information from a U.S. company. Yahoo! is not withholding information from the Belgium government. We have a legal and policy basis for not disclosing information in this type of case until the recognized international legal process is followed. We have raised this issue with the U.S. Government," was the company statement. Yahoo seems to be more cautious after fierce criticism as it happened in 2007 after having complied with the request of the Chinese authorities and gave up personal account information which led to the imprisonment of a political dissident back. Since then, the company has signed up for the Global Network Initiative (GNI), an organisation aimed at preserving free speech on the Internet. GNI members are bound to challenge requests for disclosure of private data from governments in case these requests are considered to be in breach of international human rights laws. Belgium condemns Yahoo! for its refusal to communicate personal data (only in French, 3.03.2009) http://tempsreel.nouvelobs.com/actualites/medias/multimedia/20090303.OBS704… Yahoo Fined By Belgian Court For Refusing To Give Up E-Mail Account Info (2.03.2009) http://www.techcrunch.com/2009/03/02/yahoo-fined-by-belgian-court-for-refus… EDRIgram: Internet giants gather for freedom of speech - Global Network Initiative (5.11.2008) http://www.edri.org/edrigram/number6.21/global-network-initiative ============================================================ 9. UK Tribunal wants the Gateway reviews on ID scheme made public ============================================================ On 19 February, the UK tribunal ordered the disclosure of two internal reviews called the Gateway reviews regarding the national identity card scheme of the government. The Gateway reviews are independent and expert reviews carried out at key decision points of significant programmes or programs of those deemed risky. The reviews are performed by independent practitioners from outside the programme/project by using a series of interviews, documentation reviews and their expertise to provide valuable additional perspective on the respective programmes/projects and on the external challenge of the processes. The ID government programme was subjected to two "Gateway zero" reviews, in 2003 and 2004. The Treasury's Office of Government Commerce (OGC) operating the Gateway system did not wish to disclose the reports stating that it was in the public interest to maintain them out of the public eyes and argueing that making the reports public would make them "bland and anodyne". The tribunal refuted OGC argument considering OGC had to prove a "real and weighty" causal relationship between disclosure and damage and as OGC failed to do so, secrecy would be far from being in the public interest. The tribunal concluded that "disclosure of the requested information would clearly add to the public's knowledge in this respect and therefore to the public interest which sought to ensure that schemes as complex albeit as sensitive as the ID cards scheme were properly scrutinised and implemented." OGC claimed that the disclosures of the report might have "adverse press reactions ... if any form of criticism were contained in the report in question" and that the reviews should be kept away from citizens because they might seem "uninformative or hard to understand". It also argued that the respective information did not bring any valuable addition to the debate on the merits of identity cards as a whole. The tribunal considered that none of the arguments presented was OGC's problem. "It is not for the tribunal, let alone the OGC or the (information) commissioner, to second-guess the scope and content of the possible public debate." In the UK, the Freedom of Information Act 2000 which came into force in 2005 requires 100 000 public authorities to respond promptly to requests for information and provide that information, including emails, meeting minutes, research and reports, with a series of exceptions. These exemptions range from sensible data (personal data, national security) to materials deemed to be commercially sensitive. An authority can deny requests considered vexatious or too expensive to carry out. The tribunal decision was promulgated on 19 February, giving the OGC 28 days to comply. Public interest is not served by secrecy (3.03.2009) http://www.guardian.co.uk/commentisfree/libertycentral/2009/mar/03/identity… What is an OGC Gateway Review? - OGC Gateway Review for Programmes & Projects http://www.ogc.gov.uk/what_is_ogc_gateway_review.asp Explainer: Freedom of information (24.02.2009) http://www.guardian.co.uk/commentisfree/libertycentral/2009/feb/24/freedomo… ============================================================ 10. Recommended Reading ============================================================ Article 29 Working Group - Opinion 2/2009 on the protection of children's personal data (General Guidelines and the special case of schools) http://ec.europa.eu/justice_home/fsj/privacy/workinggroup/wpdocs/2009_en.htm http://ec.europa.eu/justice_home/fsj/privacy/workinggroup/wpdocs/2009_de.htm http://ec.europa.eu/justice_home/fsj/privacy/workinggroup/wpdocs/2009_fr.htm Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism, Martin Scheinin http://www2.ohchr.org/english/issues/terrorism/rapporteur/docs/A.HRC.10.3.p… Report: Leading Jurists Call for Urgent Steps to Restore Human Rights in efforts to counter terrorism http://ejp.icj.org/hearing2.php3?id_article=167&lang=en ============================================================ 11. Agenda ============================================================ 17 March 2009, Brussels, Belgium Conference on the European patent system organised by the Science and Technology Options Assessment (STOA) panel of the European Parliament http://cordis.europa.eu/search/index.cfm?fuseaction=events.document&EV_LANG… 18-20 March 2009, Prague, Czech Republic The Responsibilities of Content Providers and Users http://www.media-conference.cz 18-20 March 2009, Athens, Greece WebSci'09: Society On-Line http://www.websci09.org/ 23 March 2009, Berlin, Germany German-French Experts Meeting on Technologies for Electronic Identification http://www.e-identify-df.de/ 26-27 March 2009, London, UK 5th Communia Workshop: Accessing, Using, Reusing Public Sector Content and Data http://www.communia-project.eu/ws05 27-29 March 2009, Manchester, UK Oekonux Conference: Free Software and Beyond The World of Peer Production http://www.oekonux-conference.org/ 28 March 2009, London, UK Open Knowledge Conference (OKCon) 2009 http://www.okfn.org/okcon/ 29-31 March 2009, Edinburgh, UK Governance Of New Technologies: The Transformation Of Medicine, Information Technology And Intellectual Property - An International Interdisciplinary Conference http://www.law.ed.ac.uk/ahrc/conference09/ 1-3 April 2009, Berlin, Germany re:publica 2009 "Shift happens" http://www.re-publica.de/09/ Subconference: 2nd European Privacy Open Space http://www.privacyos.eu/ 4 April 2009, Paris, France French 2009 Big Brother Awards http://bigbrotherawards.eu.org/ 21-23 April 2009, Winchester, UK BILETA 2009 Annual Conference http://www.winchester.ac.uk/?page=9871 23-24 April 2009, Brussels, Belgium The future of intellectual property - Creativity and innovation in the digital era http://www.intellectualproperty-conference.eu 11 May 2009, Brussels, Belgium GigaNet is organizing the 2nd international academic workshop on Global Internet Governance: An Interdisciplinary Research Field in Construction. Deadline for abstracts submissions is 20 March 2009. http://giganet.igloogroups.org/publiclibr/giganetcos/2009brusse 13-14 May 2009 Uppsala, Sweden Mashing-up Culture: The Rise of User-generated Content http://www.counter2010.org/workshop_call 19-20 May 2009, Brussels, Belgium European Commission organizes a personal data protection conference to look at new challenges for privacy http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_03_03_09_en.pdf 24-28 May 2009, Venice, Italy ICIMP 2009, The Fourth International Conference on Internet Monitoring and Protection http://www.iaria.org/conferences2009/ICIMP09.html 1-4 June 2009, Washington, DC, USA Computers Freedom and Privacy 2009 http://www.cfp2009.org/ 5 June 2009, London, UK The Second Multidisciplinary Workshop on Identity in the Information Society (IDIS 09): "Identity and the Impact of Technology" Call for papers deadline: 13 March 2009 http://is2.lse.ac.uk/idis/2009/ 28-30 June 2009, Torino, Italy COMMUNIA Conference 2009: Global Science & Economics of Knowledge-Sharing Institutions http://www.communia-project.eu/conf2009 2-3 July 2009, Padova, Italy 3rd FLOSS International Workshop on Free/Libre Open Source Software Paper submission by 31 March 2009 http://www.decon.unipd.it/personale/curri/manenti/floss/floss09.html 13-16 August 2009, Vierhouten, The Netherlands Hacking at Random http://www.har2009.org/ 23-27 August 2009, Milan, Italy World Library and Information Congress: 75th IFLA General Conference and Council: "Libraries create futures: Building on cultural heritage" http://www.ifla.org/IV/ifla75/index.htm 10-12 September 2009, Potsdam, Germany 5th ECPR General Conference, Potsdam Section: Protest Politics Panel: The Contentious Politics of Intellectual Property http://www.ecpr.org.uk/potsdam/default.asp 16-18 September 2009, Crete, Greece World Summit on the Knowledge Society WSKS 2009 http://www.open-knowledge-society.org/ October 2009, Istanbul, Turkey eChallenges 2009 http://www.echallenges.org/e2009/default.asp 16 October 2009, Bielefeld, Germany 10th German Big Brother Awards Deadline for nominations: 15 July 2009 http://www.bigbrotherawards.de/ 15-18 November 2009, Sharm El Sheikh, Egypt UN Internet Governance Forum http://www.intgovforum.org/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[i2p] 0.6 is available
by jrandom 05 Jul '18

05 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all, After 5 months of crunching and testing on the 0.5 series of releases, we've got the 0.6 build ready for your enjoyment. In here the big change is the new SSU [1] transport running on UDP instead of TCP, allowing us to remove the per-peer thread and memory issues we have seen so far. In addition, some peer review by an anonymous contributor has allowed us to improve some of the cryptographic routines used in the tunnels and connection establishment. A full list of changes is as always up on the web [2]. [1]http://dev.i2p.net/cgi-bin/cvsweb.cgi/i2p/router/doc/udp.html?rev=HEAD [2]http://dev.i2p.net/cgi-bin/cvsweb.cgi/i2p/history.txt?rev=HEAD This release includes the base SSU functionality - enabling communication between reachable peers reliably and efficiently, but 0.6.1 will include support for "introducers", letting people behind firewalls and NATs that they don't control join the network and participate fully. While the 0.6 release is deployed and we measure its real world performance, we'll be crunching away on 0.6.1 with the aim of getting that out later this summer. After 0.6.1 stabilizes, we'll package 'er up and stick the "1.0" label on it and move our focus towards providing more engaging user experiences. Updating will be fairly easy, but due to a minor bug in previous releases, you won't be able to use the 0 click update. Instead, just grab the i2pupdate.zip [3] and save it to your I2P install directory, then click on "Graceful restart" [4]. After it restarts, you'll want to "reseed" and make sure your router is reachable from the outside world via UDP on your SSU port (8887 by default). This release is NOT backwards compatible, so please upgrade ASAP - a few services are already on the new release - squid.i2p, cvs.i2p, www.i2p, and dev.i2p, so grab yours today :) [3] http://www.i2p.net/download [4] http://localhost:7657/configservice.jsp This release was a long time coming, both due to caution necessary when designing, implementing, and testing a new transport protocol, as well as my fairly hectic move to a new region and the resulting infrequent internet access. Thanks again for your patience, and especially to the folks contributing code, content, and cash - we'd be in tough shape without y'all! =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFC57tZWYfZ3rPnHH0RAsKdAJ4+U4eDZG17xhUPxHktS531Yx0G9ACdEbLU tl1jInwpe6hlBQ/paK6bA0w= =gfSw -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [IP] Telecoms required to save logs of e-mail
by Phil Karn 05 Jul '18

05 Jul '18

>BRUSSELS, Belgium?EU justice and interior ministers agreed Friday >on plans that would require telecommunications companies to retain >records of phone calls and e-mails for a minimum of six months for >use in investigations of terrorism and other serious crimes. and Bob Franksten comments: > Too bad reporters don't ask question such as whether the legislatures understand that you don?t need a phone company to make a phone call and you don?t need a PTT to send email. Note that an ISP can easily log email even when a user runs his own SMTP server and/or delivers his own outbound mail. You just record all the raw packets to port 25. On the other hand, the SMTP STARTTLS (start transport layer security) command is getting pretty common these days, as most MTA senders will now use it automatically whenever the receiving MTA advertises support for it. Receiver support is not the default because it requires a X.509 certificate, but some installation scripts (e.g., Debian Linux) automatically generate and install a self-signed certificate if required. Even much of my incoming spam comes in with STARTTLS these days. I figure that should make traffic analysis just a little more difficult. When a SMTP session uses STARTTLS, only the IP addresses of the MTAs are visible to a passive wiretap at the ISP. Because self-signed certificates are so common, however, an active man-in-the-middle attack would probably work in most cases. Clearly we need certificate caching like that implemented in SSH. >Under Friday's deal, investigators will be able to view logs of >phone calls and e-mail messages, but it does not allow them to view >content of the messages. That implies that only headers need be logged, so PGP or S/MIME by itself (without STARTTLS) provide no protection at all as they both leave all email headers in the clear. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Telecoms required to save logs of e-mail
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

[IP] 325,000 Names on Terrorism List
by Dave Farber 05 Jul '18

05 Jul '18

-------- Original Message -------- Subject: 325,000 Names on Terrorism List Date: Wed, 15 Feb 2006 11:25:33 -0500 From: Daz <articles.daz(a)gmail.com> To: David Farber <dave(a)farber.net> 325,000 Names on Terrorism List Rights Groups Say Database May Include Innocent People By Walter Pincus and Dan Eggen Washington Post Staff Writers Wednesday, February 15, 2006; Page A01 The National Counterterrorism Center maintains a central repository of 325,000 names of international terrorism suspects or people who allegedly aid them, a number that has more than quadrupled since the fall of 2003, according to counterterrorism officials. The list kept by the National Counterterrorism Center (NCTC) -- created in 2004 to be the primary U.S. terrorism intelligence agency -- contains a far greater number of international terrorism suspects and associated names in a single government database than has previously been disclosed. Because the same person may appear under different spellings or aliases, the true number of people is estimated to be more than 200,000, according to NCTC officials. <...snip...> <http://www.washingtonpost.com/wp-dyn/content/article/2006/02/14/AR2006021402 125.html?referrer=email&referrer=email> ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] Data retention bill officially surfaces in the U.S. Congress [priv]
by Declan McCullagh 05 Jul '18

05 Jul '18

Well, it took a few years, but it finally happened. A data retention bill was introduced today, courtesy of the those freedom-loving House Republicans and their "law and order agenda." But it's actually a Democrat (Rep. Diana DeGette) who's the most enthusiastic proponent of this scheme, so you can bet that whatever happens will be bipartisan in the end. Oh, and the bill also includes mandatory Web labeling. I've placed the documents here: http://politechbot.com/docs/smith.data.retention.labeling.draft.020607.pdf http://politechbot.com/docs/smith.gop.law.and.order.agenda.020607.doc http://politechbot.com/docs/smith.republican.agenda.package.020607.doc And my article is here: http://news.com.com/2100-1028_3-6156948.html Excerpt: Details about data retention requirements would be left to Gonzales. At a minimum, the bill says, the regulations must require storing records "such as the name and address of the subscriber or registered user to whom an Internet Protocol address, user identification or telephone number was assigned, in order to permit compliance with court orders." Because there is no limit on how broad the rules can be, Gonzales would be permitted to force Internet providers to keep logs of Web browsing, instant message exchanges, or e-mail conversations indefinitely. (The bill does not, however, explicitly cover search engines or Web hosting companies, which officials have talked about before as targets of regulation.) Previous Politech message: http://www.politechbot.com/2007/01/24/not-just-isps/ -Declan _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0