July 2018 - cypherpunks-legacy

tor-ramdisk 20110119 released
by Anthony G. Basile 06 Jul '18

06 Jul '18

Hi everyone I want to announce to the list that a new release of tor-ramdisk is out. Tor-ramdisk is an i686, x86_64 or MIPS uClibc-based micro Linux distribution whose only purpose is to host a Tor server in an environment that maximizes security and privacy. Security is enhanced by hardening the kernel and binaries, and privacy is enhanced by forcing logging to be off at all levels so that even the Tor operator only has access to minimal information. Finally, since everything runs in ephemeral memory, no information survives a reboot, except for the Tor configuration file and the private RSA key, which may be exported/imported by FTP or SCP. Changelog: This release addresses a heap overflow in tor which allows arbitrary remote code execution. Tor was bumped to version 0.2.1.29 to address CVE-2011-0427. Busybox was bumped to... 1.18.2 and the kernel to 2.6.32.28 plus Gentoo's hardened-patches-2.6.32-37.extras. i686: Homepage: http://opensource.dyc.edu/tor-ramdisk Download: http://opensource.dyc.edu/tor-ramdisk-downloads x86_64: Homepage: http://opensource.dyc.edu/tor-x86_64-ramdisk Download: http://opensource.dyc.edu/tor-x86_64-ramdisk-downloads MIPS: Homepage: http://opensource.dyc.edu/tor-mips-ramdisk Download: http://opensource.dyc.edu/tor-mips-ramdisk-downloads -- Anthony G. Basile, Ph. D. Chair of Information Technology D'Youville College Buffalo, NY 14201 (716) 829-8197 *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Visualization: Tor nodes on Google Maps and Google Earth
by Moritz Bartl 06 Jul '18

06 Jul '18

Hi, I wrote a small ugly Python script to visualize Tor relays on Google Maps and Google Earth. You can see the result here: * Open KML file in Google Maps: http://maps.google.com/maps?q=http:%2F%2Fwww.torservers.net%2Fmisc%2Ftormap… * Download tormap.kml for Google Earth http://www.torservers.net/misc/tormap/tormap.kml The KML standard is being pushed by Google and should work for OpenStreetMap, too, but I couldn't get it to load there. Feel free to modify the script to generate other outputs. The initial idea was to scale the marker size to show the relay's bandwidth, but Google Maps does not support this. The markers might give a false impression of accuracy. Most IPs can only be tracked to city level (or even region), ie. the markers are somewhat near, not necessarily at the real location of the relay. You can download the script here: http://www.torservers.net/misc/tormap/tormap.py (LGPL) This is a one-time snapshot and I will not update it regularly, unless there is public interest to do so. The bandwidth categories are based on the reported "observed bandwidth" at the time of creation, so the actual number of high bandwidth nodes will fluctuate every time the script is run. It would be nice to extend this script to use longer-term bandwidth calculation like TorStatus does, and to generate a map over time using all the consensus data provided at http://archive.torproject.org/. An example of what this could look like is Vis4Net's Wikileaks Mirror World Map at http://labs.vis4.net/wikileaks/mirrors/ . ( Mostly copied from my blog at http://moblog.wiredwings.com/archives/20101213/Visualization-Tor-nodes-on-G… ) -- Moritz http://www.torservers.net/ *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: <nettime> monitoring and surveillance
by John Young 06 Jul '18

06 Jul '18

Odd that the Weimar-Princeton announcement makes no mention of scholars and researchers gathering, aggregating, mining and messing with Internet users data under guise of investigating and analyzing the world's greatest-ever spying machine by spying on the gullible users "to protect them," the motto of secret agents forever. Bundles of irresistable funding for that, indeed, alliances and standards-setting bodies have been established to bless this villainy and the finely-coutured apologists for the villainous institutions and "leading" scholars. Be sure tell the public right away with every media study announcement about the spy agencies' multi-millions being distributed to eager institutions to foster open source spying, spy training, covert spying and camouflage thereof. Admire the spread of euphemistic "security studies" and "surveillance studies" and "social media studies" and in particular "open source studies." Even the spy agencies vaunt these luser lures in their recruiting materials. High-tech seekers, media mavens especially solicited by CIA University, rush to intern in home bases of spies and pursue advanced degrees in their cash-rich outliers in universities. Note who runs these social studies programs ever adaptable to the king's coin. Remember the invention by Plato of Socrates, a friendly fellow favoring open discourse, to undergird the highly privileged philosopher as king. Machiavelli adored Plato's conceit. Remember the invention of philosophy to undergird dissimulation, wise faculty club debate tea cup held with little finger poised just so to signal how pleasurable it is to outsmart. Meta surveillance studies presumably sanitizes the vile practice of social studies long invested in codifying human behavior, first as allegedly disinterested scholarship, then to repackage and sell as means of political control to full-spectrum authoritatives ever indebted to funding sources open and secret, especially the secret which requires non-disclosure as a condition of scholarly bribery. Dissimulation provides an escape from complicity, thank heavens for duplictious obfuscation. "I had no idea my work would be used that way." Here's a suggestion: if any use of scholarly research is ever used for secret purposes the original scholars shall be hung until dead from Alma Mater, left to rot as a signal of why secrecy is the greatest threat to democracy. Monitoring the extended use of scholarly research shall no longer be forgiven by exculpatory sophistry. No more excusing the study of complicity by deeper treachery of exploiting hard-up students to do spies' "dirty work." Oops that is the name of a famous spy story dissimulation. Odd that the illegality of data gathering on the Internet is never admitted by overseers of the intellectual commonweal. Odd that privacy policies are always taken "very seriously," but never disclosed as duplicitous. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mail.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

tor-ramdisk 20110119 released
by Anthony G. Basile 06 Jul '18

06 Jul '18

Hi everyone I want to announce to the list that a new release of tor-ramdisk is out. Tor-ramdisk is an i686, x86_64 or MIPS uClibc-based micro Linux distribution whose only purpose is to host a Tor server in an environment that maximizes security and privacy. Security is enhanced by hardening the kernel and binaries, and privacy is enhanced by forcing logging to be off at all levels so that even the Tor operator only has access to minimal information. Finally, since everything runs in ephemeral memory, no information survives a reboot, except for the Tor configuration file and the private RSA key, which may be exported/imported by FTP or SCP. Changelog: This release addresses a heap overflow in tor which allows arbitrary remote code execution. Tor was bumped to version 0.2.1.29 to address CVE-2011-0427. Busybox was bumped to... 1.18.2 and the kernel to 2.6.32.28 plus Gentoo's hardened-patches-2.6.32-37.extras. i686: Homepage: http://opensource.dyc.edu/tor-ramdisk Download: http://opensource.dyc.edu/tor-ramdisk-downloads x86_64: Homepage: http://opensource.dyc.edu/tor-x86_64-ramdisk Download: http://opensource.dyc.edu/tor-x86_64-ramdisk-downloads MIPS: Homepage: http://opensource.dyc.edu/tor-mips-ramdisk Download: http://opensource.dyc.edu/tor-mips-ramdisk-downloads -- Anthony G. Basile, Ph. D. Chair of Information Technology D'Youville College Buffalo, NY 14201 (716) 829-8197 *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IRR] SA passes Electronic Communications and Transactions Bill
by Ian Douglas 06 Jul '18

06 Jul '18

Hi All Thought Ant Brooks would say something about this but since he did not, here is a quick summary with comments. Please do not distribute outside this list as I have supplied basically the same thing to a paying customer for inclusion in their newsletter... Hopefully I didn't screw up factually. SA passes Electronic Communications and Transactions Bill On 7 June 2002, the SA Parliament passed the ECT bill [1], against fierce opposition, especially from within the Internet industry. While the bill does have some positive aspects, some of its other far-ranging provisions have aroused ire amongst industry old-timers and professionals. The bill provides legislation in the following areas: * Planning and implementation of a national e-strategy, including provision of internet access to disadvantaged communitites. * Electronic transactions and signatures, which are given legal standing. * E-Government services. * Cryptography providers. This section makes it illegal to supply cryptographic products without registering, and paying a fee. * Authentication service providers, and standards for being an accredited Authentication Service Provider. See "Cryptography". * Electronic transactions and e-commerce, including protections for consumers. * Spam seems to be given "opt-out" status, not "opt-in", although other provisions try to limit the use of "personal information". * So-called "Critical Databases". * The Domain Name Authority and administration, where between 8 and 16 [**] people will do the work now done by one man. The sub-text is that new subdomains will be created and auctioned off, although this is not explicitly mentioned. The cell-phone industry provides a clue. * Limitations on the liability of Internet Service Providers. The Service Provider is seen as a "mere conduit" as long as, amongst other provisions, he does not "modify the data contained in the transmission". The effect of this provision on ISPs who automatically remove viruses from client email is not specified. ISPs do not have a general obligation to monitor traffic on or through their systems. * The appointment of "Cyber Inspectors", who can enter ISP secure server rooms with a warrant and poke their noses wherever they like. * Cyber Crime, which outlaws amongst others, hacking, cracking and malicious code. The provisions which have attracted the most flak revolve around the new .za domain name authority. It is currently run by Mike Lawrie, who has been doing it since the commercial internet arrived in South Africa. He has ICANN approval. He is so upset by the provisions of the new bill that he has threatened to "pull the plug". [2] So far this has not happened. [1] http://www.gov.za/gazette/bills/2002/b8-02.pdf [2] http://www.iol.co.za/index.php?set_id=1&click_id=31&art_id=qw10230782404 92B261 [**] Since writing the above, the Gov has ammended Section 10, which deals with the .za namespace. They dropped the number of people from "8 -- 16" down to 9. Also other changes. http://co.za/ect/chapterX-2002-06-07.html Uniforum, a non-profit which runs the .co.za domains, have posted their suggested ammendments to the ammendments, and invited comment from current .co.za domain holders. http://co.za/ect/chapterX-comments-2002-06-07.html Naturally I had quite a bit to say on the topic.. :-) Furthermore, my mind had mulled over other aspects of the bill since I wrote the above last Tuesday, and other issues came up: 1. Only registered cryptography suppliers may supply cryptographic products to South Africans. I suppose this could mean that Apache will not be allowed, leaving the field to Microsoft... I can't see any open-source software movement registering with every tinpot government around the world. Nor can I see Bruce Schneier registering to supply Blowfish or Twofish... The law is written aimed at suppliers, with no comment about the legal position of users of unregistered crypto products. [Ultimate objective: All your secrets are belong to us?] 2. If spam is given legal opt-out status, this puts ISPs in a difficult position, and could lead to SA becoming a spammer's haven. Cheers, Ian p.s. I was going to use a controversial Subj: line, like "SA Government goes berserk" or somesuch but decided against it.. :-) -------------------------------------------------------------- ian(a)zti.co.za http://www.zti.co.za Zero to Infinity - The net.works Phone/Fax +27-21-948-3809 _______________________________________________ Irregulars mailing list Irregulars(a)tb.tf http://tb.tf/mailman/listinfo/irregulars --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Lucrative-L] updated lucrative source now in CVS
by Patrick 06 Jul '18

06 Jul '18

I imported Lucrative source into SourceForge CVS so anyone who wishes can get the latest and greatest Lucrative. There are numerous improvements in design and efficiency over v7, more features, and so on. https://sourceforge.net/projects/lucrative There are several tools at SF for lodging bug reports, feature requests, and so on. Please feel free, even encouraged, to make use of them. And I invite participation by developers to contribute to the source. I don't have any specific tasks that I need help on at the moment, but I will use the SF tools to make notes. Also, people uncomfortable or unable to contribute to the source should feel free to contribute anything else they desire: pretty graphics, interface mockups, diagrams, charts, requirements or specifications, documents of all sorts, complaints. One point I would like advice on is whether to extend the FIBI (format for the interchange of bearer instruments) protocol to allow exchange of Chaumian cash as well as Wagnerian. Patrick The Lucrative Project: http://lucrative.thirdhost.com ...................................................... To subscribe or unsubscribe from this discussion list, write to lucrative-l-request(a)lucrative.thirdhost.com with just the word "unsubscribe" in the message body (or, of course, "subscribe") --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

[Dewayne-Net] Boundless' CEO to speak at NYC Wireless: Using
by Dewayne Hendricks 06 Jul '18

06 Jul '18

City-Scale WiFi to Fight Crime Reply-To: dewayne(a)warpspeed.com [Note: For readers in the NYC area. DLH] >From: Steve Morton <smorton(a)BoundlessS.com> >Date: December 26, 2005 11:11:26 AM PST >To: info(a)dandin.com >Subject: [please forward to Dewayne Hendricks] Boundless' CEO to >speak at NYC Wireless: Using City-Scale WiFi to Fight Crime > >Dewayne, > ><http://www.nycwireless.net/tiki-view_articles.php> > >NYCwireless December Meeting Announcement >All are invited - please re-post everywhere ! > >Wednesday, December 28th, 2005 at 7:15pm > >Bway.net >568 Broadway at Prince St, NE corner >Suite 404 >New York, NY 10012 > >Agenda: > >1. Steve Morton / Boundless Security Systems: Can City-Scale WiFi >Reduce Crime ? > > What are the obstacles and opportunities for city-scale >wireless video surveillance, especially in crime-plagued >neighborhoods ? > > A fascinating discussion about BoundlessS.com's new WiFi >video surveillance system that greatly enhances image clarity, >network capacity and mobility. This could be a tremendously >effective tool for law enforcement that could help reduce crime. >How can privacy concerns be balanced ? Steve will also cover system >design, and possible deployment schemes ? followed by an extended >Q&A session. > >2. Year-end roundup and NYCwireless-2006 resolutions > >3. Workshop breakout sessions: small group discussions from novice >to advanced questions > >Happy Holidays, > > >Steven G. Morton, CEO, CTO Weblog at: <http://weblog.warpspeed.com> ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Boundless' CEO to speak at NYC Wireless: Using City-Scale WiFi
by David Farber 06 Jul '18

06 Jul '18

to Fight Crime X-Mailer: Apple Mail (2.746.2) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

Re: [liberationtech] Carrier IQ
by Marnie Froberg 06 Jul '18

06 Jul '18

Senator Al Franken as Chairman of the Subcommittee on Privacy Technology and the Law has sent a letter to CarrierIQ asking a number of very specific questions regarding user information and technical specifics. It will be interesting to read their response, if there is one. A copy of the letter is available here: http://www.forbes.com/sites/andygreenberg/2011/12/01/heres-the-letter-senat… The full text of the letter: Dear Mr. Lenhart, I am very concerned by recent reports that your companybs softwarebpre-installed on smartphones used by millions of Americansbis logging and may be transmitting extraordinarily sensitive information from consumersb phones, including: b" when they turn their phones on; b" when they turn their phones off; b" the phone numbers they dial; b" the contents of text messages they receive; b" the URLs of the websites they visit; b" the contents of their online search queriesbeven when those searches are encrypted; and b" the location of the customer using the smartphonebeven when the customer has expressly denied permission for an app that is currently running to access his or her location. It appears that this software runs automatically every time you turn your phone on. It also appears that an average user would have no way to know that this software is runningband that when that user finds out, he or she will have no reasonable means to remove or stop it. These revelations are especially concerning in light of Carrier IQbs public assertions that it is b not recording keystrokes or providing tracking toolsb (November 16), b [d]oes not record your keystrokes,b and b [d]oes not inspect or report on the content of your communications, such as the content of emails and SMSsb (November 23). I understand the need to provide usage and diagnostic information to carriers. I also understand that carriers can modify Carrier IQbs software. But it appears that Carrier IQbs software captures a broad swath of extremely sensitive information from users that would appear to have nothing to do with diagnosticsbincluding who they are calling, the contents of the texts they are receiving, the contents of their searches, and the websites they visit. These actions may violate federal privacy laws, including the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. This is potentially a very serious matter. I ask that you provide answers to the following questions by December 14, 2011. (1) Does Carrier IQ software log usersb location? (2) What other data does Carrier IQ software log? Does it log: a. The telephone numbers users dial? b. The telephone numbers of individuals calling a user? c. The contents of the text messages users receive? d. The contents of the text messages users send? e. The contents of the emails they receive? f. The contents of the emails users send? g. The URLs of the websites that users visit? h. The contents of usersb online search queries? i. The names or contact information from usersb address books? j. Any other keystroke data? (3) What if any of this data is transmitted off of a usersb phone? When? In what form? (4) Is that data transmitted to Carrier IQ? Is it transmitted to smartphone manufacturers, operating system providers, or carriers? Is it transmitted to any other third parties? (5) If Carrier IQ receives this data, does it subsequently share it with third parties? With whom does it share this data? What data is shared? (6) Will Carrier IQ allow users to stop any logging and transmission of this data? (7) How long does Carrier IQ store this data? (8) Has Carrier IQ disclosed this data to federal or state law enforcement? (9) How does Carrier IQ protect this data against hackers and other security threats? (10) Does Carrier IQ believe that its actions comply with the Electronic Communications Privacy Act, including the federal wiretap statute (18 U.S.C. B' 2511 et seq.), the pen register statute (18 USC B' 3121 et seq.), and the Stored Communications Act (18 U.S.C. B' 2701 et seq.)? (11) Does Carrier IQ believe that its actions comply with the Computer Fraud and Abuse Act (18 U.S.C. B' 1030)? Why? I appreciate your prompt attention to this matter. Sincerely, AL FRANKEN Chairman, Subcommittee on Privacy Technology and the Law _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0