July 2018 - cypherpunks-legacy

NSA director on NSA domestic wiretaps (to Cong in Oct 2002)
by John Gilmore 06 Jul '18

06 Jul '18

Paragraph 40, below, is about as bald a statement as an NSA director could make, saying he needs help to decide what he should be allowed to wiretap about US persons. We, the privacy community, did not respond. We were a bit surprised, but that was about the extent of the support we offered. Of course, we were living in a time where being anti-paranoia or anti-war or anti-president was considered treasonous by the president, and by most of the people who elected him, and many who worked for him. And we were living in the lost time when we expected the government to follow clearly written laws, until such time as they were rewritten. And nobody had ever gotten NSA to stop doing ANYTHING corrupt, without either suing them, beating them in the legislature, or shining some bright sunlight on one of their secrets -- in some cases it took all three. The door of the NSA Director's office has never been open for privacy activists to come in and review their secret programs for sanity and constitutionality, though it should be. His challenge to the NSA work force -- "to keep America free by making Americans feel safe again" -- is as bogus as TSA's "We're upholding the right to travel by making travel feel safe, even while we keep innocent YOU off the plane". It begs the question -- who do we need to feel safe FROM? Governments are historically thousands of times as likely to injure you than 'terrorists'. Do you feel safe from Bush and NSA and TSA today? Are you really sure your government isn't tapping and tracing you, building databases about who you call and who you travel with, with or without a warrant from some rubber stamp court? Indeed, what good would it have done if the whole privacy and crypto community had risen up to say, "You should follow the law!"? Bush was intent on breaking it in secret ANYWAY, and rather than exposing his treason, NSA followed his orders. Mr. Hayden did not pose the question as, "We are now wiretapping the foreign communications of US persons without warrants, in violation of the FISA; do you think this is OK?", though he was doing so at the time he made this speech. But that's the question that he and his successor will have to face civil and criminal charges over. http://www.nsa.gov/releases/relea00072.html "Statement for the record by Lieutenant General Michael V. Hayden, USAF, Director, National Security Agency... 17 October 2002" ... 2. We know our responsibilities for American freedom and security at NSA. Our workforce takes the events of September 11, 2001 very personally. By the very nature of their work, our people deeply internalize their mission. This is personal. ... 25. The final issue - what have we done in response - will allow me to give some specifics although I may be somewhat limited by the demands of classification. I will use some of the terms that Congress has used with us over the past year. 26. It was heartening, for example, to hear Congress echo the phrase of our SIGINT Director, Maureen Baginski, in the belief that we need to be "hunters rather than gatherers." She believed and implemented this strategy well before September 11th, and then she applied it with a vengeance to al-Qa'ida after the attacks. ... 36. There is a certain irony here. This is one of the few times in the history of my Agency that the Director has testified in open session about operational matters. The first was in the mid 1970s when one of my predecessors sat here nearly mute while being grilled by members of Congress for intruding upon the privacy rights of the American people. Largely as a result of those hearings, NSA is governed today by various executive orders and laws and these legal restrictions are drilled into NSA employees and enforced through oversight by all three branches of government. 37. The second open session was a little over two years ago and I was the Director at that time. During that session the House intelligence committee asked me a series of questions with a single unifying theme: How could I assure them that I was safeguarding the privacy rights of those protected by the U.S. constitution and U.S. law? During that session I even said - without exaggeration on my part or complaint on yours - that if Usama bin Laden crossed the bridge from Niagara Falls, Ontario to Niagara Falls, New York, U.S. law would give him certain protections that I would have to accommodate in the conduct of my mission. And now the third open session for the Director of NSA: I am here explaining what my Agency did or did not know with regard to 19 hijackers who were in this country legally. 38. When I spoke with our workforce shortly after the September 11th attacks, I told them that free people always had to decide where to draw the line between their liberty and their security, and I noted that the attacks would almost certainly push us as a nation more toward security. I then gave the NSA workforce a challenge: We were going to keep America free by making Americans feel safe again. 39. Let me close by telling you what I hope to get out of the national dialogue that these committees are fostering. I am not really helped by being reminded that I need more Arabic linguists or by someone second-guessing an obscure intercept sitting in our files that may make more sense today than it did two years ago. What I really need you to do is to talk to your constituents and find out where the American people want that line between security and liberty to be. 40. In the context of NSA's mission, where do we draw the line between the government's need for CT information about people in the United States and the privacy interests of people located in the United States? Practically speaking, this line-drawing affects the focus of NSA's activities (foreign versus domestic), the standard under which surveillances are conducted (probable cause versus reasonable suspicion, for example), the type of data NSA is permitted to collect and how, and the rules under which NSA retains and disseminates information about U.S. persons. 41. These are serious issues that the country addressed, and resolved to its satisfaction, once before in the mid-1970's. In light of the events of September 11th, it is appropriate that we, as a country, readdress them. We need to get it right. We have to find the right balance between protecting our security and protecting our liberty. If we fail in this effort by drawing the line in the wrong place, that is, overly favoring liberty or security, then the terrorists win and liberty loses in either case. 42. Thank you. I look forward to the committees' questions. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

EDRi-gram newsletter - Number 7.15, 29 July 2009
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 7.15, 29 July 2009 ============================================================ Contents ============================================================ 1. Hadopi 2's final vote is postponed till 15 September 2. EU wants to share more bank details with the US authorities 3. EC hearing on Google book deal 4. UK ISP gave up direct disconnection of file-sharers for a three strikes 5. Finnish CSS case application lodged in the European Court of Human Rights 6. EDPS: New privacy issues in relation to intelligent transport systems 7. France: CNIL's opinion on LOPPSI draft law 8. Russian Copyright law will apply to news reports 9. Recommended Action 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. Hadopi 2's final vote is postponed till 15 September ============================================================ The French deputies had only a few days before the summer vacation to debate the new text of the three strikes law (called Hadopi 2) that was adopted by the Senate on 8 July 2009. As the opposition introduced a very large number of amendments, a vote for the entire text was not possible and the National Assembly President's decision was to postpone the vote until September. The Assembly had 894 amendments to discuss but the text was not basically modified, but rather adjusted. One of the good decisions was that the surveillance of electronic communications will not be possible so e-mails were excluded from the investigation field. The access to the Internet will be cut off only in case of recurrent alleged illegal file-sharing or in case the Internet connection was not secured after a first warning from Hadopi authority. The deputies also approved the penal ordinance procedure meaning that the alleged illegal downloader can be sanctioned in his (her) absence, according to a rapid procedure, by a sole judge. The user in case could be given a fine but can also ask for a classical procedure. The text is different from the one voted by the Senate which means that a Mixted Paritary Commission will be needed in order to find a compromise between the two versions. Anyway, the text still ignores the presumption of innocence which is contradicting the Constitution, as previousely ruled by the Constitutional Council. The amendment regarding the two euro "creative contribution" to the Internet subscription in order to finance the creators was again rejected but during a meeting with the socialists, the new Minister of Culture Fridiric Mitterrand, while stating that he supported the Government position on Hadopi, also admitted that the draft law was not solving the issue of the financing of culture. And as the opposition has already promised to appeal again to the Constitutional Council in case the draft law is voted by the National Assembly, the text might also have to pass the constitutionality test as well. Analyse note of the draft law on criminal protection of the literary and artistic property on the Internet (only in French, 19.07.2009) http://www.laquadrature.net/files/LaQuadratureduNet_20090719_NoteHADOPI2AN.… French Anti-Piracy Sanctions Delayed (23.07.2009) http://www.billboard.biz/bbbiz/content_display/industry/e3i04ac5aa7296d367c… Hadopi 2: the deputies voted all the articles (only in French, 24.07.2009) http://www.01net.com/editorial/504691/hadopi-2-les-deputes-ont-vote-tous-le… Hadopi 2: the deputies' vote pushed till September (only in French, 21.07.2009) http://www.01net.com/editorial/504438/hadopi-2-le-vote-des-deputes-repousse… Hadopi 2: the deputies discharge cutting off messaging (only in French, 23.07.2009) http://www.01net.com/editorial/504470/hadopi-2-les-deputes-ecartent-la-coup… Hadopi 2, last debate day before the Parliamentary vacation (only in French, 23.07.2009) http://www.silicon.fr/fr/news/2009/07/23/hadopi_2__dernier_jour_de_debat_av… EDRIgram: Hadopi 2 adopted very fast by the French Senate (15.07.2009) http://www.edri.org/edri-gram/number7.14/3-strikes-second-senate ============================================================ 2. EU wants to share more bank details with the US authorities ============================================================ The dispute between EU and the US on access to the bank transfer details has come again to the public attention after the Belgium company SWIFT (Society for Worldwide Interbank Financial Telecommunication) that intermediates the international banking transactions has decided to open a new server in Switzerland that will focus on European customers. SWIFT has now two servers in the Netherlands and in the state of Virginia, with identical data. After 11 September 2001, US intelligence services had gained access to the system, including to European inner-transactions. This became public in 2006 and led to a data protection outcry. In 2007, a first agreement was reached between the US and the EU to establish what set of SWIFT data can be accessed by US authorities and under what circumstances. The European Commission also appointed the French judge Jean-Louis Bruguihre to examine if the US really use the data only for the anti-terrorism fight. The report, that has never been made public, was presented to the European Parliament on 17 February 2009 and concluded that the data was deleted when no longer necessary and that the US authorities fully respect the agreement with the EU. But Bruguihre, the Vice-President of the Tribunal de Grande Instance in Paris, has in the past 25 years gained a reputation as France's "leading terrorist hunter", so the outcome of the report was predictable. SWIFT will open a new server in Switzerland for inner-European transactions in September, which would exclude US authorities from accessing these. While this would have eased a lot of the criticism from data protection commissioners and the European Parliament, the European Commission is now drafting a new agreement with the US authorities before the new server starts operations. This met heavy cricism from MEPs, as the European Parliament would again be sidelined by this. MEPs as well as national-level politicians alsocriticized the plan on substantial grounds, citing fundamental privacy concerns. The chairman of the Austrian social democrats in the EP said: "the EU is not a colony of the US". Some MEPs have already questioned the re-election of Commission president Manuel Barroso. Because of the upcoming federal elections and the rising worries about surveillance among the German population, vocal criticism came especially from German politicians, including many Greens, the chairman of the Liberal Party, the conservative Bavarian head of government Horst Seehofer, and others. EU justice commissioner Jacques Barrot denied these accusations in a meeting on 23 July with the members of the newly formed European Parliamentary Committee on civil liberties, justice and home affairs. He also concluded that he wants in fact a better deal: "We must negotiate an agreement based on reciprocity rather than allowing the US to continue as they have up until now as if they were top dog." According to a Commission spokesperson, the deal will not include EU access to US banking transactions, though. Jaques Barrot confirmed that the Commission wants to re-negotiate this agreement after one year. By then, the Lisbon Treaty, which would give European Parliament a much more important role in this field, is expected to be in force. But an interim agreement was needed to be rapidly concluded in order not to stop the anti-terrorism fight. The Council of Foreign Ministers gave a green light on 27 July to the project, by unanimously agreeing to allow the Swedish Presidency to negotiate a temporary agreement with the US regarding access to data held by SWIFT. According to news reports, the mandate includes that the data would be given to US authorities on a per-request basis and could be stored in the US for five years. Apparently, the EU bodies want to built their own system of banking surveillance, that might include the SEPA (Single Euro Payment Area) transaction system. This may be done in connection with the proposed "Stockholm Programme", the EU's justice and home affairs work plan for 2010 to 2014. The draft already stipulates: "The instruments for combating the financing of terrorism must be adapted to the new potential vulnerabilities of the financial system and to the new payment methods used by terrorists. We must have a mechanism that allows both adequate monitoring of financial flows and effective and transparent identification of people and groups likely to finance terrorism. " Brussels wants to nullify protection of banking data (only in German, 20.07.2009) http://www.zeit.de/online/2009/30/bankdaten-eu-swift EU looking for better deal on data transfer (23.07.2009) http://euobserver.com/9/28486 EU still wants to give financial data to US intelligence services (only in German, 28.07.2009) http://netzpolitik.org/2009/eu-will-weiter-finanzdaten-an-die-us-geheimdien… EU-US data sharing causes uproar in Germany (28.07.2009) http://www.euractiv.com/en/justice/eu-us-data-sharing-causes-uproar-germany… EU supports more anti-terror data sharing with US (28.07.2009) http://www.google.com/hostednews/ap/article/ALeqM5h8BBdlIgQeLl2Hs7Dha2LN_05… EU Review of the United States' "Terrorist Finance Tracking Programme" confirms privacy safeguards (17.02.2009) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/09/264&format=HT… Communication from the Commission to the European Parliament and the Council: An area of freedom, security and justice serving the citizen (known as the "Stockholm Programme", 10.6.2009) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:52009DC0262:EN:… EDRi-gram: Terrorist Finance Tracking Program raises privacy questions (5.06.2006) http://www.edri.org/edrigram/number4.13/swift ============================================================ 3. EC hearing on Google book deal ============================================================ The European Commission (EC) will hold a hearing on 7 September 2009 to evaluate Google's proposed deal with U.S. publishers and authors granting Google the right to digitize and publish out of print copyrighted books and its possible impact upon copyright issues. Spokesman Oliver Drewes said EU officials wanted to get the opinion of European publishers, authors and consumers in order to be able to "draw provisional conclusions on the Google Inc.'s book-scanning settlement." The EU launched a formal inquiry in the matter after the German delegation, supported by UK and France, submitted an information note in May 2009, asking for action against Google's online library project. In the US, Google reached an agreement in October 2008 with the Authors Guild and the Association of American publishers in which Google accepted to pay about 88 million euro to create a Book Rights Registry, where authors and publishers can register works. Google would get rights in return for a share of any revenues collected by selling access to online books. The agreement is criticized for giving Google preferential rights especially in case of the "orphan works" (books for which the copyright owners cannot be identified). The regulators might also tackle the issue of the "most-favoured nation" clause guaranteeing Google terms that are at least as good as those offered to other Internet companies in future. Google executives argue that the company will have no unfair advantages while providing increased access to books. In support of their cause, the company will probably bring as argument Viviane Reding's position who, earlier this month, stated that EU needed to urgently standardize its copyright laws to encourage book digitization. Another argument that might be in Google's favour is that this is the only initiative to scan millions of books and make them available on the Internet. Also, Google's leading lawyer David Drummond said that Google would be open to changing the terms of the deal if it received a "compelling argument" from regulators. The U.S. Justice Department is also looking now into this settlement. EU sets hearing over Google books deal (20.07.2009) http://www.reuters.com/article/internetNews/idUSTRE56J3JX20090720 Google book deal faces growing scrutiny (11.07.2009) http://www.ft.com/cms/s/0/81bf17c0-5557-11de-b5d4-00144feabdc0.html EU seeks opinions on Google Books (20.07.2009) http://news.cnet.com/8301-1023_3-10290954-93.html?FORM=ZZNR4 EU asks publishers for feedback on Google Books (20.07.2009) http://finance.yahoo.com/news/EU-asks-publishers-for-apf-3599301835.html/pr… EDRi-gram: EU will examine Google Books project (3.06.2009) http://www.edri.org/edri-gram/number7.11/google-books-ec ============================================================ 4. UK ISP gave up direct disconnection of file-sharers for a three strikes ============================================================ UK ISP Karoo belonging to Hull based KCom telecom company, announced on 24 July it would change its policy and apply a three-strikes system for the customers allegedly infringing copyright. Within the agreement with the entertainment industries, the UK ISPs have agreed to send out warning letters to users suspected of downloading copyrighted material from the Internet. Karoo, holding the monopoly in Hull as the only ISP in area, has been exceeded this procedure for some time now, having directly disconnected its users for suspected file-sharing. In order to get their service restored, customers had to sign a document admitting their guilt and promising not to repeat the offence. Therefore, the method not only ignored the presumption of innocence but actually blackmailed users by obliging them to admit guilt in order to be reconnected. Following the exposure of the company's policy by BBC which made public the case of a customer having been disconnected and asked to fill in a form admitting her guilt in order to be reconnected, Karoo decided to adopt a three-strikes rule in which suspected file-sharers will receive three written warnings before action is taken. The major issue is that Karoo takes its actions without any court decision, based only on accusations made by anti-piracy organizations which use evidence gathering methods that are far from being accurate or reliable. Although rights holders have stated that their data was never wrong, a report made last year by the University of Washington, Department of Computer Science and Engineering has clearly shown the vulnerabilities of the methods. "Whether a false positive sent to a user that has never even used BitTorrent or a truly infringing user that relies on incomplete IP blacklists, there is currently no way for anyone to wholly avoid the risk of complaints.(...) We have further demonstrated that IP blacklists, a standard method for avoiding systematic monitoring, are wholly ineffective given current identification techniques and provide only limited coverage of likely monitoring agents" says the report. Therefore, as the report and reality have shown, there is a large risk that innocent people are accused of illegal file-sharing. Plug-pulling ISP changes policy (24.07.2009) http://news.bbc.co.uk/2/hi/technology/8166640.stm Kang-Karoo courts: guilt by accusation, punishment without trial (24.07.2009) http://www.openrightsgroup.org/2009/07/kang-karoo-courts-guilt-by-accusatio… Karoo backs down and adopts 'three strikes' policy for illegal p2p file sharers instead of immediate cut off (24.07.2009) http://www.thinkbroadband.com/news/4013-karoo-backs-down-and-adopts-three-s… UK ISP Cuts Off Alleged Pirates (24.07.2009) http://torrentfreak.com/uk-isp-cuts-off-alleged-pirates-090724/ Challenges and Directions for Monitoring P2P File Sharing Networks ,or, Why My Printer Received a DMCA Takedown Notice" (1.06.2008) http://dmca.cs.washington.edu/uwcse_dmca_tr.pdf ============================================================ 5. Finnish CSS case application lodged in the European Court of Human Rights ========================================================== Finnish Activist Mikko Rauhala has lodged an application to the European Court of Human Rights versus the Finnish state, regarding his right to freedom of expression. The appeal is a follow up to the lengthy court process against Mr. Rauhala in Finland. The process started when Mr. Rauhala started a discussion board on the Internet, on which people could talk about the DVD copy protection method Content Scrambling System (CSS). Mr. Rauhala's motivation for this act was to criticize the implementation of the EU Copyright Directive in Finland which came into force in 2006. According to the implementation of the directive, "organized discussion" regarding circumventing technological protection measures, like the CSS, was prohibited. Mr. Rauhala's motivation was to display the disbeneficial nature of the directive. Thus, he himself reported his actions to the Finnish police in the first place, thinking that the police would not investigate the issue or that the public prosecutor would not press charges. However the Police started its investigation with the public prosecutor who was supported strongly by the Finnish Anti-Piracy Association which arranged the "expert" testimonies for the prosecutor. Soon thereafter, the case was referred to the Helsinki District Court which decided in Rauhala's favor; that CSS was not a type of protection measure covered by the Directive and therefore the ban did not apply. The district attorney appealed to the Helsinki Appellate Court, which stated that Mr. Rauhala was guilty of illegally circumventing a technological protection measure and of providing an illegal service for the circumvention of protection measures. The Supreme Court of Finland denied Mr. Rauhala's application. Mr. Rauhala had no other choice than to make an application to the European Court of Human Rights, because in all the court instances his argument that the discussion he was administering was within the confines of the Right to Freedom of Speech, as enshrined in the Finnish Constitution, was not considered. Mr. Rauhala is represented by the Helsinki, Finland based law firm Turre Legal. EDRi-gram: Finish CSS decision overturned (4.06.2008) http://www.edri.org/edrigram/number6.11/finish-css-overturned (contribution by Markku Rdsdnen - Summer Associate, Turre Legal, Finland) ============================================================ 6. EDPS: New privacy issues in relation to intelligent transport systems ============================================================ Peter Hustinx, the European Data Protection Supervisor (EDPS), issued on 22 July his opinion on the European Commission's proposed plan, adopted in December 2008, to accelerate and coordinate the deployment of intelligent transport systems (ITS) in road transportation in Europe, and their connection with other modes of transport . The deployment includes an Action Plan establishing priority areas for action and a Directive proposal laying down the framework for their implementation. Intelligent Transport Systems (ITS) are applications using Information and Communication Technologies embedded in different modes of transport that interact between them (such as GPS systems), meant to make transport safer and cleaner and to reduce traffic congestion. ITS applications and services are based on the collection, processing and exchange of a large range of data and allow for the tracking of a vehicle and the collection of personal data such as driving habits. As such, they raise several privacy and data protection issues. "The problem is not what the data tells the state, but what happens with interlocking information it already has. If you correlate car tracking data with mobile phone data, which can also track people, there is the potential for an almost infallible surveillance system," said Simon Davies, director of the watchdog Privacy International. While welcoming the fact that the proposed ITS deployment plan aims at harmonising the data processes throughout Europe, the EDPS however warned that the proposed plan raised a series of issued related to privacy and data protection. Hustinx believes there is a lack of clarity of the proposed legal framework that might create diversity in the implementation of ITS in Europe thus leading to different levels of data protection in Europe. "The EDPS emphasizes the need for further harmonisation on these issues at EU level to clarify outstanding issues (such as definition of the roles and responsibilities of ITS actors, which specific ITS applications and systems must be embedded in vehicles, the development of harmonised contracts for the provision of ITS services, the specific purposes and modalities of use of ITS etc)." One important aspect in his opinion is that data controllers must be clearly identified "as they will bear the responsibility to ensure that privacy and data protection considerations are implemented at all levels of the chain of processing." Also, the data controllers providing ITS services should implement appropriate safeguards "so that the use of location technologies is not intrusive from a privacy viewpoint. This should notably require further clarification as to the specific circumstances in which a vehicle will be tracked, strictly limiting the use of location devices to what is necessary for that purpose and ensuring that location data are not disclosed to unauthorized recipients". The interconnection of the systems and applications must also be done "with due respect for data protection principles and practical safeguards on security," and personal data must be processed only if necessary "for the specific purpose for which ITS is used and pursuant to an appropriate legal basis". The EDPS emphasizes the importance of not using the processed personal data "for further purposes that are incompatible with those for which they were collected" and he recommends the introduction of an explicit reference to the notion of ''privacy by design'' for ITS applications and systems saying that data "may not be used for purposes other than the ones for which they were collected in a way incompatible with those purposes." The EDPS recommends that privacy and data protection should be considered during the early design stages of any ITS. "Privacy and security requirements should be incorporated within standards, best practices, technical specifications and systems." His final recommendation is that data protection authorities, such as Article 29 Working Party and the EDPS should be closely involved in all the initiatives related to the deployment of ITS "through consultation at a sufficiently early stage before the development of relevant measures." European Data Protection Supervisor Opinion on the Communication from the Commission on an Action Plan for the Deployment of Intelligent Transport Systems in Europe and the accompanying Proposal for a Directive of the European Parliament and of the Council laying down the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other transport modes (22.07.2009) http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consu… Big Brother is watching: surveillance box to track drivers is backed (31.03.2009) http://www.guardian.co.uk/uk/2009/mar/31/surveillance-transport-communicati… Intelligent transport raises privacy concerns (23.07.2009) http://www.euractiv.com/en/infosociety/intelligent-transport-raises-privacy… ============================================================ 7. France: CNIL's opinion on LOPPSI draft law ============================================================ The French Data Protection Authority (CNIL) has now made public its opinion of 16 April 2009 on seven articles belonging to LOPPSI, the French draft law on orientation and programming for the performance of the domestic security that may give the police the possibility to spy on electronic communications and which introduces Internet filtering by administrative decision. The draft law was presented on 27 May by Minister of Justice Michhle Alliot-Marie to the French Council of Ministers but it's only now that CNIL can make its opinion public due to new legal provisions introduced in May. The Minister did not choose to take CNIL's opinion into consideration. In its opinion, CNIL was expressing fears related to several provisions of the draft, especially in relation to the collection and retention of data, installation of Trojan horses on computers as well as the surveillance of public access to the Internet. CNIL considered that such instruments should be installed and used by "guaranteeing the proportionality of the surveillance measure with the targeted objectives" and warned on problems that might be caused to professional users dealing with sensitive data such as lawyers, politicians, medical staff, or journalists. The opinion also stated that the legislator was the one who had to "provide conciliation between, on the one hand, preventing disturbances to the public order and finding infringers, both necessary for the preservation of the rights and constitutional principles and, on the other hand, the exercising of constitutionally guaranteed freedoms amongst which there are the freedom to come and go and the respect of private life, protected by articles 2 and 4 of the Declaration of the Rights of Man and the Citizen of 1789, as well as the individual freedom, that article 66 of the Constitution places under surveillance of the legal authority." In the meantime, the digital rights campaigners continue to fight laws such as LOPPSI or Hadopi. Thus, ODEBI league, an Internet users association, launched on 20 July a "numerical army" meant to fight the lack of information or disinformation in the presentation of projects with a final objective to protect the rights of Internet users. CNIL's opinion on LOPPSI draft law made public (only in French, 25.07.2009) http://www.numerama.com/magazine/13563-L-avis-de-la-CNIL-sur-le-projet-de-l… Deliberation n02009-200 of 16 April 2009 bearing the opinion on seven articles of the draft law on orientation and programming for the performance of the domestic security (only in French, 16.04.2009) http://www.cnil.fr/en-savoir-plus/deliberations/deliberation/delib/207/ ODEBI league launches a "numerical army" project (only in French, 20.07.2009) http://www.numerama.com/magazine/13492-La-Ligue-ODEBI-lance-un-projet-d-arm… EDRI-gram: The French Government wants to spy on electronic communications (3.06.2009) http://www.edri.org/edri-gram/number7.11/france-law-on-spying ============================================================ 8. Russian copyright law will apply to news reports ============================================================ A new modification in the Russian copyright legislation was drafted by the Government in order to extend the protection to news reports. The new draft was pushed by the biggest Russian news agencies which were claiming that other regional and online publications are plagiarizing their news reports. The law could be submitted to the Russian Parliament in the fall. The draft presented by the Communications and Press Deputy Minister Alexander Zharov foresees fines from 10 to 20 000 rubles (approx. 230-460 euros), but also the confiscation of the production as sanctions for plagiarism for an agency. The plagiating reporter of the agency could also be fined with 1 - 5 000 rubles (23 - 115 euros). The present draft is still unclear on how the fines will be applied and under what specific circumstances the confiscation will be enforced, thus causing critics to say that the new law could be used to shut up the unwanted voices. Andrei Richter, head of Moscow's Media Law and Policy Institute, considered the law a step forward and commented: "Currently, news agencies have to go to court and prove that they have suffered financial losses because of the plagiarism." But other news editors, such as Moscow Post editor Alexei Kozlov were not too happy. He called the bill "an opportunity to punish a rival media outlet." As a consequence of the financial crisis, the European newspapers and magazine publishers are also trying to lobby for tougher copyright laws. A public call to the European Commission in this respect was signed at a meeting on 26 June in Berlin, convened by the European Publishers' Council and the World Association of Newspapers. The letter was based on a German initiative called the "Hamburg Declaration' adopted by 149 German publishers earlier that month. The letter stated that: "Numerous providers are using the work of authors, publishers and broadcasters without paying for it. Over the long term, this threatens the production of high-quality content and the existence of independent journalism. For this reason, we advocate strongly urgent improvements in the protection of intellectual property on the Internet." The new call is also trying to have the Automated Content Access Protocol (ACAP), pushed by the publishers industry as the perfect solution to avoid copying news, imposed by law ACAP is a meta data standard that aims at specifing how online aggregators (including search engines) handle a publisher's work by defining usage by third parties rights. Bill Extends Copyright Protection to News (22.07.2009) http://www.moscowtimes.ru/article/1010/42/379728.htm European Publishers Call on E.U. to Protect Copyright (9.07.2009) http://www.nytimes.com/2009/07/10/technology/internet/10copyright.html?_r=1 European publishers want a law to control online news access (10.07.2009) http://arstechnica.com/media/news/2009/07/european-publishers-want-news-acc… International publishers demand new intellectual property rights protection to safeguard the future of journalism (9.07.2009) http://www.epceurope.org/presscentre/archive/International_publishers_deman… ============================================================ 9. Recommended Action ============================================================ Call for new Experts to the EU Agency ENISA's Permanent Stakeholders' Group Do you have the competence to be one of the Experts advising ENISA? The European Network and Information Security Agency, i.e. the EU Agency ENISA, is launching the call for new members to its Permanent Stakeholders' Group (PSG). The PSG advises the Executive Director in e.g. drawing up a proposal for the Agency's work programme, and all issues related thereto. Deadline for applications: 30 October 2009 http://www.enisa.europa.eu/pages/02_01_press_2009_07_17_psg_call.html ============================================================ 10. Recommended Reading ============================================================ European Court of Justice Decision - Infopaq International A/S vs Danske Dagblades Forening (19.07.2009) http://curia.europa.eu/jurisp/cgi-bin/gettext.pl?lang=en&num=79909283C19080… The copying and reproduction of just 11 words of a news article can be copyright infringement, the European Court of Justice (ECJ) has ruled. Europe's highest court has said that a clippings service's copying could be unlawful. http://www.out-law.com/default.aspx?page=10205 French Parliament Information Report on the Police Files (only in French, 2009) http://www.assemblee-nationale.fr/13/pdf/rap-info/i1548.pdf ============================================================ 11. Agenda ============================================================ 13-16 August 2009, Vierhouten, The Netherlands Hacking at Random http://www.har2009.org/ 23-27 August 2009, Milan, Italy World Library and Information Congress: 75th IFLA General Conference and Council: "Libraries create futures: Building on cultural heritage" http://www.ifla.org/IV/ifla75/index.htm 10-12 September 2009, Potsdam, Germany 5th ECPR General Conference, Potsdam Section: Protest Politics Panel: The Contentious Politics of Intellectual Property http://www.ecpr.org.uk/potsdam/default.asp 12 September 2009, Worldwide 2nd International Action Day "Freedom not Fear - Stop the Surveillance Mania" Demonstrations, Events, Privacy Parties etc. in many countries http://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2009 16-18 September 2009, Crete, Greece World Summit on the Knowledge Society WSKS 2009 http://www.open-knowledge-society.org/ 17-18 September 2009, Amsterdam, Netherlands Gikii, A Workshop on Law, Technology and Popular Culture Institute for Information Law (IViR) - University of Amsterdam http://www.law.ed.ac.uk/ahrc/gikii/2009.asp 23-24 September 2009, Copenhagen, Denmark The Net will not forget European conference on ICT and Privacy http://www.ict-privacy.dk/ 29-30 September 2009, Warsaw, Poland 3rd International Conference "Keeping Children and Young People Safe Online" http://konferencja.saferinternet.pl/articles-2009/3rd_international_confere… 16 October 2009, Bielefeld, Germany 10th German Big Brother Awards http://www.bigbrotherawards.de/ 21-23 October 2009, Istanbul, Turkey eChallenges 2009 http://www.echallenges.org/e2009/default.asp 24-25 October 2009, Vienna, Austria 3rd European Privacy Open Space http://www.privacyos.eu 25 October 2009, Vienna, Austria Austrian Big Brother Awards Deadline for nominations: 21 September 2009 http://www.bigbrotherawards.at/ 29 October - 1 November 2009, Barcelona, Spain International Forum on Free Culture http://exgae.net/los-oxcars 3 November 2009, Madrid, Spain Civil Society Conference: "Global Privacy Standards for a Global Economy" Organized by Electronic Privacy Information Center http://www.privacyconference2009.org/privacyconf2009/home/eventos_previos/C… 4-6 November 2009, Madrid, Spain 31st International Conference of Data Protection and Privacy http://www.privacyconference2009.org 13-15 November 2009, Gothenburg, Sweden Free Society Conference and Nordic Summit http://www.fscons.org/ 15-18 November 2009, Sharm El Sheikh, Egypt UN Internet Governance Forum http://www.intgovforum.org/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Over a decade of DDOS--any progress yet?
by James Hess 06 Jul '18

06 Jul '18

On Mon, Dec 6, 2010 at 1:50 AM, Sean Donelan <sean(a)donelan.com> wrote: > February 2000 weren't the first DDOS attacks, but the attacks on multiple > Other than buying lots of bandwidth and scrubber boxes, have any other DDOS > attack vectors been stopped or rendered useless during the last decade? Very little, no, and no. Not counting occasional application bugs that are quickly fixed. Even TCP weaknesses that can facilitate attack are still present in the protocol. New vectors and variations of those old vectors emerged since the 1990s. So there is an increase in the number of attack vectors to be concerned about, not a reduction. SYN and Smurf are Swords and spears after someone came up with atomic weaponry. The atomic weaponry named "bot net". Which is why there is less concern about the former types of single-real-origin-spoofed-source attacks. Botnet-based DDoS is just "Smurf" where amplification nodes are obtained by system compromise, instead of router misconfiguration, and a minor variation on the theme where the chain reaction is not started by sending spoofed ICMP ECHOs. Since 2005 there are new beasts such as "Slowloris" and "DNS Reflection". DNS Reflection attacks are a more direct successor to smurf; true smurf broadcast amplification points are rare today, diminishing returns for the attacker, trying to find the 5 or 6 misconfigured gateways out there, but that doesn't diminish the vector of spoofed small request large response attacks. Open DNS servers are everywhere. SYN attacks traditionally come from a small number of sources and rely on spoofing to attack limitations on available number of connection slots for success. New vectors that became most well-known in the late 90s utilize botnets, and an attacker can make full connections therefore requiring zero spoofing, negating the benefit of SYN cookies. In other words, SYN floods got supplanted by TCP_Connect floods. -- -JH ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Over a decade of DDOS--any progress yet?
by James Hess 06 Jul '18

06 Jul '18

On Mon, Dec 6, 2010 at 1:50 AM, Sean Donelan <sean(a)donelan.com> wrote: > February 2000 weren't the first DDOS attacks, but the attacks on multiple > Other than buying lots of bandwidth and scrubber boxes, have any other DDOS > attack vectors been stopped or rendered useless during the last decade? Very little, no, and no. Not counting occasional application bugs that are quickly fixed. Even TCP weaknesses that can facilitate attack are still present in the protocol. New vectors and variations of those old vectors emerged since the 1990s. So there is an increase in the number of attack vectors to be concerned about, not a reduction. SYN and Smurf are Swords and spears after someone came up with atomic weaponry. The atomic weaponry named "bot net". Which is why there is less concern about the former types of single-real-origin-spoofed-source attacks. Botnet-based DDoS is just "Smurf" where amplification nodes are obtained by system compromise, instead of router misconfiguration, and a minor variation on the theme where the chain reaction is not started by sending spoofed ICMP ECHOs. Since 2005 there are new beasts such as "Slowloris" and "DNS Reflection". DNS Reflection attacks are a more direct successor to smurf; true smurf broadcast amplification points are rare today, diminishing returns for the attacker, trying to find the 5 or 6 misconfigured gateways out there, but that doesn't diminish the vector of spoofed small request large response attacks. Open DNS servers are everywhere. SYN attacks traditionally come from a small number of sources and rely on spoofing to attack limitations on available number of connection slots for success. New vectors that became most well-known in the late 90s utilize botnets, and an attacker can make full connections therefore requiring zero spoofing, negating the benefit of SYN cookies. In other words, SYN floods got supplanted by TCP_Connect floods. -- -JH ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[serval-project-dev] We have store-and-forward SMS working on the mesh
by Paul Gardner-Stephen 06 Jul '18

06 Jul '18

See http://servalpaul.blogspot.com/2011/11/demonstrating-serval-rhizome-store-a… for some details, video and cartoon to explain a little of how it works. I am also working on a white paper that describes it in much more detail. -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

NSA director on NSA domestic wiretaps (to Cong in Oct 2002)
by John Gilmore 06 Jul '18

06 Jul '18

Paragraph 40, below, is about as bald a statement as an NSA director could make, saying he needs help to decide what he should be allowed to wiretap about US persons. We, the privacy community, did not respond. We were a bit surprised, but that was about the extent of the support we offered. Of course, we were living in a time where being anti-paranoia or anti-war or anti-president was considered treasonous by the president, and by most of the people who elected him, and many who worked for him. And we were living in the lost time when we expected the government to follow clearly written laws, until such time as they were rewritten. And nobody had ever gotten NSA to stop doing ANYTHING corrupt, without either suing them, beating them in the legislature, or shining some bright sunlight on one of their secrets -- in some cases it took all three. The door of the NSA Director's office has never been open for privacy activists to come in and review their secret programs for sanity and constitutionality, though it should be. His challenge to the NSA work force -- "to keep America free by making Americans feel safe again" -- is as bogus as TSA's "We're upholding the right to travel by making travel feel safe, even while we keep innocent YOU off the plane". It begs the question -- who do we need to feel safe FROM? Governments are historically thousands of times as likely to injure you than 'terrorists'. Do you feel safe from Bush and NSA and TSA today? Are you really sure your government isn't tapping and tracing you, building databases about who you call and who you travel with, with or without a warrant from some rubber stamp court? Indeed, what good would it have done if the whole privacy and crypto community had risen up to say, "You should follow the law!"? Bush was intent on breaking it in secret ANYWAY, and rather than exposing his treason, NSA followed his orders. Mr. Hayden did not pose the question as, "We are now wiretapping the foreign communications of US persons without warrants, in violation of the FISA; do you think this is OK?", though he was doing so at the time he made this speech. But that's the question that he and his successor will have to face civil and criminal charges over. http://www.nsa.gov/releases/relea00072.html "Statement for the record by Lieutenant General Michael V. Hayden, USAF, Director, National Security Agency... 17 October 2002" ... 2. We know our responsibilities for American freedom and security at NSA. Our workforce takes the events of September 11, 2001 very personally. By the very nature of their work, our people deeply internalize their mission. This is personal. ... 25. The final issue - what have we done in response - will allow me to give some specifics although I may be somewhat limited by the demands of classification. I will use some of the terms that Congress has used with us over the past year. 26. It was heartening, for example, to hear Congress echo the phrase of our SIGINT Director, Maureen Baginski, in the belief that we need to be "hunters rather than gatherers." She believed and implemented this strategy well before September 11th, and then she applied it with a vengeance to al-Qa'ida after the attacks. ... 36. There is a certain irony here. This is one of the few times in the history of my Agency that the Director has testified in open session about operational matters. The first was in the mid 1970s when one of my predecessors sat here nearly mute while being grilled by members of Congress for intruding upon the privacy rights of the American people. Largely as a result of those hearings, NSA is governed today by various executive orders and laws and these legal restrictions are drilled into NSA employees and enforced through oversight by all three branches of government. 37. The second open session was a little over two years ago and I was the Director at that time. During that session the House intelligence committee asked me a series of questions with a single unifying theme: How could I assure them that I was safeguarding the privacy rights of those protected by the U.S. constitution and U.S. law? During that session I even said - without exaggeration on my part or complaint on yours - that if Usama bin Laden crossed the bridge from Niagara Falls, Ontario to Niagara Falls, New York, U.S. law would give him certain protections that I would have to accommodate in the conduct of my mission. And now the third open session for the Director of NSA: I am here explaining what my Agency did or did not know with regard to 19 hijackers who were in this country legally. 38. When I spoke with our workforce shortly after the September 11th attacks, I told them that free people always had to decide where to draw the line between their liberty and their security, and I noted that the attacks would almost certainly push us as a nation more toward security. I then gave the NSA workforce a challenge: We were going to keep America free by making Americans feel safe again. 39. Let me close by telling you what I hope to get out of the national dialogue that these committees are fostering. I am not really helped by being reminded that I need more Arabic linguists or by someone second-guessing an obscure intercept sitting in our files that may make more sense today than it did two years ago. What I really need you to do is to talk to your constituents and find out where the American people want that line between security and liberty to be. 40. In the context of NSA's mission, where do we draw the line between the government's need for CT information about people in the United States and the privacy interests of people located in the United States? Practically speaking, this line-drawing affects the focus of NSA's activities (foreign versus domestic), the standard under which surveillances are conducted (probable cause versus reasonable suspicion, for example), the type of data NSA is permitted to collect and how, and the rules under which NSA retains and disseminates information about U.S. persons. 41. These are serious issues that the country addressed, and resolved to its satisfaction, once before in the mid-1970's. In light of the events of September 11th, it is appropriate that we, as a country, readdress them. We need to get it right. We have to find the right balance between protecting our security and protecting our liberty. If we fail in this effort by drawing the line in the wrong place, that is, overly favoring liberty or security, then the terrorists win and liberty loses in either case. 42. Thank you. I look forward to the committees' questions. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[serval-project-dev] We have store-and-forward SMS working on the mesh
by Paul Gardner-Stephen 06 Jul '18

06 Jul '18

See http://servalpaul.blogspot.com/2011/11/demonstrating-serval-rhizome-store-a… for some details, video and cartoon to explain a little of how it works. I am also working on a white paper that describes it in much more detail. -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-dev] Proposal 206: Preconfigured directory sources for bootstrapping
by Nick Mathewson 06 Jul '18

06 Jul '18

Filename: 206-directory-sources.txt Title: Preconfigured directory sources for bootstrapping Author: Nick Mathewson Created: 10-Oct-2012 Status: Open Target: 0.2.4.x Motivation and History: We've long wanted a way for clients to do their initial bootstrapping not from the directory authorities, but from some other set of nodes expected to probably be up when future clients are starting. We tried to solve this a while ago by adding a feature where we could ship a 'fallback' networkstatus file -- one that would get parsed when we had no current networkstatus file, and which we would use to learn about possible directory sources. But we couldn't actually use it, since it turns out that a randomly chosen list of directory caches from 4-5 months ago is a terrible place to go when bootstrapping. Then for a while we considered an "Extra-Stable" flag so that clients could use only nodes with a long history of existence from these fallback networkstatus files. We never built it, though. Instead, we can do this so much more simply. If we want to ship Tor with a list of initial locations to go for directory information, why not just do so? Proposal: In the same way that Tor currently ships with a list of directory authorities, Tor should also ship with a list of directory sources -- places to go for an initial consensus if you don't have a somewhat recent one. These need to include an address for the cache's ORPort, and its identity key. Additionally, they should include a selection weight. They can be configured with a torrc option, just like directory authorities are now. Whenever Tor is starting without a consensus, if it would currently ask a directory authority for a consensus, it should instead ask one of these preconfigured directory sources. I have code for this (see git branch fallback_dirsource_v2) in my public repository. When we deploy this, we can (and should) rip out the Fallback Networkstatus File logic. How to find nodes to make into directory sources: We could take any of three approaches for selecting these initial directory sources. First, we could try to vet them a little, with a light variant of the process we use for authorities. We'd want to look for nodes where we knew the operators, verify that they were okay with keeping the same IP for a very long time, and so forth. Second, we could try to pick nodes for listing with each Tor release based entirely on how long those nodes have been up. Anything that's been a high-reliability directory for a long time on the same IP (like, say, a year) could be a good choice. Third, we could blend the approach and start by looking for up-for-a-long-time nodes, and then also ask the operators whether their nodes are likely to stay running for a long time. I think the third model is best. Some notes on security: Directory source nodes have an opportunity to learn about new users connecting to the network for the first time. Once we have directory guards, that's going to be a fairly uncommon ability. We should be careful in any directory guard design to make sure that we don't fall back to the directory sources any more than we need to. See proposal 207. _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Secrecy News -- 12/20/12
by Steven Aftergood 06 Jul '18

06 Jul '18

Format Note: If you cannot easily read the text below, or you prefer to receive Secrecy News in another format, please reply to this email to let us know. SECRECY NEWS from the FAS Project on Government Secrecy Volume 2012, Issue No. 128 December 20, 2012 Secrecy News Blog: http://www.fas.org/blog/secrecy/ ** DETAINED LINGUIST RELEASED UNDER SUPERVISION ** CONGRESS PERMITS RECLASSIFICATION OF RESTRICTED DATA ** OFFSHORING, CHEMICAL WEAPONS, AND MORE FROM CRS DETAINED LINGUIST RELEASED UNDER SUPERVISION Yesterday former Navy contract linguist James Hitselberger, who has been charged under the Espionage Act with mishandling classified records, was ordered released under supervision while awaiting trial. Mr. Hitselberger is a multi-lingual translator and collector of rare documents, including records that are now housed in a dedicated collection at the Hoover Institution at Stanford University. Unfortunately for him, the government says that his collection activity extends to some documents that are currently classified. (Document Collector Charged Under Espionage Statute, Secrecy News, November 7, 2012). http://www.fas.org/blog/secrecy/2012/11/collector_charged.html Prosecutors had opposed his pre-trial release, arguing that he had fled from law enforcement by traveling for months through Europe, and that he posed a flight risk. But Mr. Hitselberger's public defender argued effectively that could not have "fled" since he had not been charged with anything until recently, that he had traveled openly under his own name, that he remained in contact with his former employer, and that he voluntarily returned to a U.S. Army facility in Kuwait to recover his possessions. "As far as he knew, Mr. Hitselberger was free to travel--which he did," Judge Rudolph Contreras summarized in a memorandum opinion issued today. "And as he traveled, he kept in regular contact with many people through many means, openly used his United States passport, and was willing to go to a military base, which no reasonable fugitive would be likely to do." http://www.fas.org/sgp/jud/hitsel/122012-memop.pdf Therefore Judge Contreras ruled for the defense and granted his release, albeit under "high intensity supervision" and with "Global Positioning System monitoring" of his whereabouts. Moreover, "he is expressly prohibited... from entering or being in the immediate vicinity of Union Station, any other bus or train station that provides service outside of the Washington metropolitan area, or any airport...." http://www.fas.org/sgp/jud/hitsel/121912-order.pdf Mr. Hitselberger has no record of criminal activity, no predisposition to violent behavior, and even prosecutors admit that he was not engaged in espionage on behalf of a foreign power. There is also no indication that even the mildest adverse consequence arose from his alleged conduct. And yet the government has opted to charge him with two felony counts under the Espionage Act, which seems like an extraordinary overreaction given the circumstances. In a different policy environment, loss of job and loss of clearance -- which Mr. Hitselberger has already suffered -- would have been deemed a fully satisfactory response to an offense of this type and magnitude. Thus, speaking at his 1997 CIA confirmation hearing about his response to leaks (at p. 108), George Tenet said "I don't want to prosecute anybody; I want to fire somebody. That will send the right signal to people." http://www.fas.org/irp/congress/1997_hr/tenet.pdf But today, the Obama Justice Department seems unwilling to accept anything short of the maximum available punishment for unauthorized disclosures, at least for those who are not senior officials or acting under color of authority. It's not only the Administration, however. This week the House and Senate adopted a sense of Congress resolution urging the Department of Justice to "investigate possible violations of Federal law related to unauthorized disclosures of classified information," adding that "in appropriate cases, individuals responsible for such unauthorized disclosures should be prosecuted to the full extent of the law." http://www.fas.org/sgp/congress/2012/unauth.html Further anti-leak legislation is under imminent consideration in the Senate. Meanwhile, the White House yesterday issued a new "National Strategy for Information Sharing and Safeguarding." "To foster trust and safeguard our information, policies and coordinating bodies must focus on identifying, preventing, and mitigating insider threats and external intrusions, while departments and agencies work to enhance capabilities for data-level controls, automated monitoring, and cross-classification solutions," the Strategy states. http://www.fas.org/sgp/eprint/strategy.pdf CONGRESS PERMITS RECLASSIFICATION OF RESTRICTED DATA Certain nuclear weapons-related information that has been removed from the category of Restricted Data (RD) and designated as Formerly Restricted Data (FRD) can now be restored to the RD category, under a provision approved by Congress in the FY 2013 national defense authorization act. http://www.fas.org/sgp/congress/2012/rd-reclass.html Until now, the removal of information from the Restricted Data category was irreversible, being prohibited by the Atomic Energy Act. That prohibition is nullified by the new legislation. The authority to reclassify FRD as RD was requested by the Department of Energy last year. "There is sensitive nuclear weapons design information embodied in some FRD... that should be subject to the more stringent security protections afforded RD now than current programmatic capabilities of DoD and the Intelligence Community permit," wrote Energy Secretary Steven Chu in an August 4, 2011 letter. (Dept of Energy Wants to Reclassify Some Info as 'Restricted Data', Secrecy News, January 17, 2012.) http://www.fas.org/blog/secrecy/2012/01/doe_rd.html > From an outside point of view, the reclassification of any such information will be undetectable and should not entail an increase in government secrecy. RD and FRD are equally opaque to the general public. In fact, the move could potentially have positive repercussions. By removing the most sensitive information from the FRD category, it should become more feasible to treat the remaining FRD as "ordinary" classified information and to declassify it in an orderly fashion-- something which does not happen currently. Improving declassification procedures for FRD was among the recommendations presented to the White House earlier this month by the Public Interest Declassification Board. http://www.archives.gov/declassification/pidb/ "FRD information concerns the military utilization of nuclear weapons, including storage locations and stockpile information and often dates from the end of World War II through the height of the Cold War," the PIDB explained in its report. "Although often no longer sensitive or current, this type of FRD information is of high interest to researchers yet remains largely unavailable to the public, because there is no process for systematically reviewing it for declassification and release under the terms of the Executive Order for national security information." Therefore, the PIDB recommended, "The classification status of Formerly Restricted Data (FRD) information should be re-examined. A process should be implemented for the systematic declassification review of historical FRD information." In a 2010 statement to the PIDB, the Federation of American Scientists suggested that the FRD category be eliminated altogether, arguing that it has become obsolete and unnecessary. But such a step was further than the PIDB was prepared to go. http://www.fas.org/sgp/eprint/sa-frd.pdf The Senate voted last week to reauthorize the Public Interest Declassification Board until 2014, and the House followed suit yesterday by a vote of 409-1. Rep. Don Young of Alaska voted against the measure for reasons he did not explain. http://www.fas.org/sgp/congress/2012/pidb-reauth.html OFFSHORING, CHEMICAL WEAPONS, AND MORE FROM CRS New and updated reports from the Congressional Research Service that Congress has not made available to the public include the following. Offshoring (or Offshore Outsourcing) and Job Loss Among U.S. Workers, December 17, 2012: http://www.fas.org/sgp/crs/misc/RL32292.pdf Chemical Weapons: A Summary Report of Characteristics and Effects, December 13, 2012: http://www.fas.org/sgp/crs/nuke/R42862.pdf Party Leaders in the United States Congress, 1789-2012, December 18, 2012: http://www.fas.org/sgp/crs/misc/RL30567.pdf U.S. Wind Turbine Manufacturing: Federal Support for an Emerging Industry, December 18, 2012: http://www.fas.org/sgp/crs/misc/R42023.pdf Survivor Benefits for Families of Civilian Federal Employees and Retirees, December 18, 2012: http://www.fas.org/sgp/crs/misc/RS21029.pdf The Federal Communications Commission: Current Structure and Its Role in the Changing Telecommunications Landscape, December 18, 2012: http://www.fas.org/sgp/crs/misc/RL32589.pdf _______________________________________________ Secrecy News is written by Steven Aftergood and published by the Federation of American Scientists. The Secrecy News Blog is at: http://www.fas.org/blog/secrecy/ To SUBSCRIBE to Secrecy News, go to: http://www.fas.org/sgp/news/secrecy/subscribe.html To UNSUBSCRIBE, go to http://www.fas.org/sgp/news/secrecy/unsubscribe.html OR email your request to saftergood(a)fas.org Secrecy News is archived at: http://www.fas.org/sgp/news/secrecy/index.html Support the FAS Project on Government Secrecy with a donation: http://www.fas.org/member/donate_today.html _______________________ Steven Aftergood Project on Government Secrecy Federation of American Scientists web: www.fas.org/sgp/index.html email: saftergood(a)fas.org voice: (202) 454-4691 twitter: @saftergood ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Details needed about monitoring and data retention in Syria
by Andrew Lewis 06 Jul '18

06 Jul '18

Jacob, The people I have talked to claim to be from the tech side of intelligence agencies, and indicated a disorganized mess with competing fiefdoms. All my other poking and proding internally point to a ton of different and random equipment across different ISPs. However I have no info or access to the demarc at this point, so I'll take what your saying as the truth, I am merely indicating that my sources are not just average joes as far as I know and is based on my own investigations into the matter. Yes mobiles are terribly weak from a security PoV. And since this is where most of the Internet and communication penetration is at in these countries, it is even scarier. -Andrew Somewhat ironically, Sent from my iPhone On Jan 10, 2012, at 9:33 PM, Jacob Appelbaum <jacob(a)appelbaum.net> wrote: > On 01/10/2012 01:11 PM, Jillian C. York wrote: >> No, but it's certainly useful when putting the surveillance in >> perspective. Just as many of the Egyptians who later accessed their files >> from State Security offices had never been detained or questioned, it's >> quite possible that much of Syria's surveillance is for surveillance's sake. >> > > I imagine that the Narus systems likely running in Egypt will have in > impact in a number of years. Just the same as the snort IDS at the edge > of Syria. These are databases that over time become more and more > valuable. When smart people learn about them, smart people will do much > much scarier things than the original creators of these systems. > > > I think it's really important to keep perspective about perspective. > > We're still around fifteen days away from a full year of revolution in > Egypt. I'm sure we haven't seen everything yet and I'm certain that what > we have seen, we probably don't understand very well. If the Egyptians > were using Narus or Cisco interception, would we know? I've been told > that the Cisco interception is used for arrests, so what do we make of that? > >> Which is not to say the recommendations are wrong - they're not. But the >> full picture includes both the reality of the surveillance systems and the >> reality of how authorities are using their capabilities. >> > > Sure, I think we agree on the first point. Additionally, I'd add that > different authorities use their capabilities in myriad of ways. > > We do not know the full reality, only the capabilities. By being > cautious, we're trying to mitigate many of the possibilities even in the > worst of actualities. > > The irony is that for internet chatting and web browsing, I think we've > got an ironclad solution; where as for phones, we're basically all > doomed - from billing to content. > > All the best, > Jacob > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0