July 2018 - cypherpunks-legacy

EDRi-gram newsletter - Number 9.3, 9 February 2011
by EDRI-gram newsletter 05 Jul '18

05 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 9.3, 8 February 2011 ============================================================ Contents ============================================================ 1. Data retention law provisions declared unlawful in Cyprus 2. Commission's proposal for PNR Directive fails to impress MEPs 3. German study finds the data retention ineffective 4. UK Supreme Court to hear DNA cases 5. Spanish sports streaming domain seized by US authorities without warning 6. France: Increased powers for Hadopi authority 7. ENDitorial: Internet blocking and damage to child protection 8. Recommended Action 9. Recommended Reading 10. Agenda 11. About ============================================================ 1. Data retention law provisions declared unlawful in Cyprus ============================================================ The Cyprus Supreme Court decided on 1 February 2011 that some of the provisions of Law 183 (I) / 2007 on disclosure of telecommunications data are unlawful, as they breach the Cyprus Constitution and its jurisprudence, as revealed by the daily Cyprus Mail. Law 183 (I) / 2007 (Retention of Telecommunication Data for Purposes of Investigation of Serious Criminal Offences Law of 2007) was adopted by Cyrpus on 31 December 2007 as the national implementation of the EU Data retention directive. In the case brought to the Supreme Court, four people claimed that Articles 4 and 5 of the national law, that provided police forces access to the retained data, were unlawful. The court considered that the articles in question go beyond the provisions of the EU Directive which does not address the issue of access to the retained data. Therefore, the court considered it may check the constitutionality of these articles, especially in relation with Art 15 of the Cyprus Constitution (right to privacy) and article 17 (confidentiality of communications). Based on the Cyprus Constitution, and jurisprudence from itself and from the EctHR, the Supreme Court issued a unanimous ruling regarding the legality of court orders issued for the disclosure of telecommunications data by the district courts of Nicosia, Limassol and Larnaca at the request of police investigating serious crimes. The orders concerned the four complainants that claimed a breach of privacy and confidentiality of their communications. The court considered that three of the four court orders for disclosing telephone numbers and calls were illegal and should be annulled. In the case of the fourth person the case was rejected, since the person was imprisoned and banned for using a mobile phone. It is unclear how this decision will affect the law and its application. According to a statement of police spokesman Michalis Katsounotos to Cyprus Mail, "the decision will be studied in depth by the assistant police chief and all under investigation or criminal proceedings will be identified for which a court order was secured for the disclosure of telecommunications data, so that in consultation with the Attorney-general, a decision can be taken on the further handling of them." Big blow to police powers (3.02.2011) http://www.cyprus-mail.com/crime/big-blow-police-powers/20110203 Case file at the Supreme Court of Cyprus http://www.supremecourt.gov.cy/Judicial/SC.nsf/All/5B67A764B86AA78EC225782F… Ruling on the case of the Law 183 (I) / 2007 on disclosure of telecommunications data (1.02.2011) http://www.supremecourt.gov.cy/Judicial/SC.nsf/All/5B67A764B86AA78EC225782F… Constitution of the Republic of Cyrpus http://en.wikisource.org/wiki/Constitution_of_the_Republic_of_Cyprus ============================================================ 2. Commission's proposal for PNR Directive fails to impress MEPs ============================================================ On 2 February 2011, the European Commission released its proposal for a directive on the use of Passenger Name Records. This would require airlines flying into and out of the EU to give travellers' personal information to national authorities in the Member State of departure or arrival. Such data includes, for example, home address, mobile phone number, frequent flier information, email address and credit card information. The document is a follow up to the proposal for PNR in 2007, for which the European Parliament, led by rapporteur Sophia in't Veld (ALDE, Netherlands), requested from the Commission, particularly in terms of better justifications regarding the measure's supposed necessity and proportionality. With a number of databases related to travellers already in existence, such as the Schengen Information System (SIS), the Visa Information System (VIS) and the Advanced Passenger Information system (API), many members of European Parliament were and are sceptical about the necessity of a Passenger Name Record regime. The scope of the purpose of PNR is widened. Whereas, in the 2007 document, the purposes were preventing and combating terrorist offences and organised crime, now it extends to "serious crimes" (defined as offences which call for a minimum prison sentence of 3 years). As these crimes are not specified, there is, by definition, no way of assessing the necessity and proportionality of all crimes that could be covered by this wording. The processing of the PNR data outlined in Article 4 stipulates that the Passenger Information Unit (PIU -the body responsible for the storage and management of PNR databases), can use the data for profiling purposes, an issue that has been highly criticised in Parliament. The data can also be compared with other "relevant" databases, while not making clear which databases will be accessed by Member States. PIUs will also be obliged to hand over PNR data at the request of the competent authorities in Member States. Finally, the document proposes using the data to update and create new profiling criteria. The document indicates that it will "mask" some pieces of data after 30 days of storage. The data is, however, not anonymised - instead, a certain amount of data is "masked" with no actual anonymisation. These pieces of information can be easily re-personalised and, in fact, access to the full PNR data is always available to the Head of the PIU, "where it could be reasonably believed that it is necessary to carry out an investigation and in response to a specific and actual threat or risk or a specific investigation or prosecution." Furthermore, considering the list of PNR data to be collected, there are a number of personally identifiable information that will not be "masked", such as billing information (including credit card numbers). The document also prohibits the collection, storage and processing of "sensitive data", defined in the proposal as "any personal data that could reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or data concerning health or sexual life of the individual concerned". In the same paragraph however, it states the PNR data "should contain details on the passenger's reservation and travel itinerary", which include special meal requests which can indicate religious orientation; special service requests that can indicate disabilities or specific medical conditions and billing and contact information. MEP Sophia in't Veld seems pleased with the document, saying, "we will closely scrutinise the proposals, but at first glance there is a substantial improvement compared to the previous proposals". However, she did indicate that better justification of the necessity of collecting PNR data remains, and that Parliament needs the facts and figures before they can make a well founded decision. Other members of the European Parliament are not so optimistic. EPP member Manfred Weber (Germany) is sceptical of the necessity of PNR, saying, "there are deficits in the usage of current data. So why should we collect even more mass data?" "The EU-US PNR agreement is already bad enough", stated German Greens member Jan Albrecht. "The last thing we need to do in Europe is to copy this model, which infringes on the civil liberties of EU citizens." Claude Moraes (S&D, UK) has concerns about the Commission's proposal to profile individuals and indiscriminately collect personal data, calling on Commissioner Malmstrvm to "urgently come before the European Parliament and to provide precise evidence that massively collecting air travellers' data is an effective and necessary way to prevent terrorists from flying to and from Europe." Commissioner Malmstrvm is likely to meet with the LIBE committee in the next few weeks to discuss the contentious elements of the proposal. The entire negotiation process in the Council and the Parliament is expected to take around two years. Proposal for a Directive on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (2.02.2011) http://ec.europa.eu/home-affairs/news/intro/docs/com_2011_32_en.pdf ALDE press release: EP insists on proof of proportionality of data transfer (11.11.2010) http://www.alde.eu/press/press-and-release-news/press-release/article/ep-in… Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes (6.11.2007) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2007:0654:FIN:EN:… EU proposal for passenger data to fight serious crime and terrorism (2.02.2011) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/11/120&format=HT… Commission PNR FAQ (2.02.2011) http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/11/60&format=H… EU to collect data of international air travellers (1.02.2011) http://euobserver.com/22/31731 "Does the EU need to collect all air travellers' data?", ask S&D (2.02.2011) http://www.socialistsanddemocrats.eu/gpes/public/detail.htm?id=135236&secti… Greens press release: Passenger data (PNR): Commission proposes system for retaining passenger data based on spurious security grounds http://www.greens-efa.eu/cms/pressreleases/dok/369/369653.passenger_data_pn… (contribution by Raegan MacDonald - EDRi) ============================================================ 3. German study finds the data retention ineffective ============================================================ A study of police statistics published by the German Federal Crime Agency on 26 January 2011, finds telecommunications data retention ineffective for the prosecution of serious crime. An analysis of Federal Crime Agency statistics published on 27 January 2011 by German civil liberties NGO AK Vorrat reveals that data retention, while in force, did not make the prosecution of serious crime any more effective. With data retention in effect, more serious criminal acts (2009: 1 422 968) were registered by police than before (2007: 1 359 102), and a smaller proportion were cleared up (2009: 76.3%) than before the introduction of blanket retention of communications data (2007: 77.6%). Likewise, after the additional retention of Internet data began in 2009, the number of registered Internet offences surged from 167 451 in 2008 to 206 909 in 2009, while the clear-up rate for Internet crime fell (2008: 79.8%, 2009: 75.7%). According to AK Vorrat, user avoidance behaviour can explain the counterproductive effects of blanket data retention on the investigation of crime. In order to avoid the recording of sensitive information under a blanket data retention scheme, users begin to employ Internet cafis, wireless Internet access points, anonymisation services, public telephones, unregistered mobile telephone cards, non-electronic communications channels and the like. This avoidance behaviour cannot only render retained data meaningless but also frustrate more targeted investigation techniques that would otherwise have been available to law enforcement. Overall, blanket data retention can thus be counterproductive to criminal investigations, facilitating some, but rendering many more futile. AK Vorrat study: Registered Serious Crime in Germany (26.01.2011) http://www.vorratsdatenspeicherung.de/images/data_retention_effectiveness_r… Study finds telecommunications data retention ineffective (27.01.2011) http://www.vorratsdatenspeicherung.de/content/view/426/79/lang,en/ ============================================================ 4. UK Supreme Court to hear DNA cases ============================================================ Following a decision of the European Court of Human Rights (ECtHR), the UK Coalition Government has recently stated its intention to dramatically reduce the retention period of DNA data. In 2008, the ECtHR ruled that a blanket policy of retaining DNA samples of people who were not charged or convicted of offences indefinitely was breaching human rights. The UK Supreme Court has recently held hearings in two cases related to the retention of DNA, fingerprints and other information by the Police of Metropolis of two individuals, independently arrested by the police for suspected offences but had no further action taken against them. "It makes good sense to hold the DNA of dangerous convicts, but holding intimate information on thousands of innocents is discriminatory as well as intrusive. The high numbers of black men arrested and never charged explains but doesn't justify their over-representation on the database. In the absence of long-trailed new law from Parliament, Britain's highest court must inject fairness into DNA retention practice," stated Liberty's legal officer Anna Fairclough. The Supreme Court will decide whether the respective data retention violates the rights of the plaintiffs under Article 8 of the European Convention on Human Rights. The decision will probably largely influence the actions taken further on by the UK authorities. The Coalition expressed the intention to introduce a similar policy to that in Scotland where only the samples of people suspected of serious offences are retained and only for a limited period of time. "The Government is committed to adopting the protections of the Scottish model for DNA retention. In particular, we are examining whether the provisions of section 23 of the Crime and Security Act 2010 should be brought into force. This would empower the National DNA Database Strategy Board to issue binding guidance to chief police officers on the types of case in which deletion would be appropriate," Home Office Minister James Brokenshire announced in the Parliament. For the time being, according to the statistics, one out of four people whose DNA data are retained by the UK police forces are innocent and the data are retained indefinitely. In January 2011, Northern Ireland's High Court of Justice ruled that the retention of a 14-year-old boy's DNA by the police was not illegal, stating ECHR's 2008 ruling could not be followed because it was not binding and it was in conflict with the earlier ruling by the House of Lords. "The lengthy, perhaps indefinite, retention by the police of the Applicant's photographic images seems incompatible with the broad and elastic formulations of the scope of Article 8(1) [of the ECHR]," said Mr Justice McLoskey who added: "But for [the House of Lords] decision and our analysis of it, we consider that there is substantial force in the view that the retention of the Applicant's photographic images by the Police Service for a minimum period of seven years, which may be extended indefinitely, unconnected in any concrete or rational way with any of the statutory purposes, interferes with his right to respect for private life guaranteed by Article 8(1)." Innocent DNA retention to be challenged (31.01.2011) http://www.telegraph.co.uk/news/uknews/law-and-order/8291385/Innocent-DNA-r… Supreme Court to revisit DNA retention (30.01.2011) http://gizmonaut.net/blog/uk/supreme_court_to_revisit_dna_retention.html Police DNA retention ruled lawful by NI High Court (21.01.2011) http://www.theregister.co.uk/2011/01/21/police_dna_retention_lawful/ EDRi-gram: ECHR decided against the UK DNA Database (17.12.2008) http://www.edri.org/edri-gram/number6.24/echr-marper-case-dna-uk ============================================================ 5. Spanish sports streaming domain seized by US authorities without warning ============================================================ The US authorities have recently seized, without any warning, the domain names of several sports streaming sites over alleged copyright infringements within the "Operation In Our Sites" action launched at the beginning of July 2010, targeting websites having allegedly offered users copyrighted material without copyright owners' consent. In July 2010, the Department of Justice (DOJ) and Homeland Security's Immigration and Customs Enforcement (ICE) seized a series of film streaming domain names. It is now the turn of sports streaming domain names. Among the recently seized domains, DOJ and ICE have included Rojadirecta.org, a popular sports steaming website, despite the fact that the site is owned by a Spanish company and its only relation to the US is that the .org domain is maintained by a US company. Furthermore, the site has already been declared legal by two Spanish court rulings in 2009 and 2010, following an action introduced by sports rights holder Audiovisual Sport in 2007. "In our opinion the US authorities are completely despising the Spanish justice system and sovereignty," stated Igor Seoane, Rojadirecta's owner for TorrentFreak. Rojadirecta, as a streaming site, does not host any copyrighted material but indexes HTTP links to sports streams that can be found on the Internet and links to torrent files hosted on other sites. This seizure of a site domain already declared legal in Spain, raises concerns related to generic domain names that are controlled exclusively by US companies. Without even contacting the site owners, the US authorities may obtain a seizure warrant from a District Court judge and use this to take control over the domains in question even if the sites are not based in the US, which provides US censorship powers over a great part of the Internet. Besides Rojadirecta.org, the domains of several other sports streaming sites were seized by DOJ and ICE, only a few days before the Super Bowl, the most-watched American television broadcast. This seems like a pattern. In November, the US authorities seized domains of online retailers of alleged counterfeit goods, just a few days before "Cyber Monday", a commercial event. The sites in question had the option to move to alternative domains, which they did in a short time. Rojadirecta is presently available on several alternative domains, such as .es, .in and .me. Channelsurfing.net, one of the other seized sites is now available under Channelsurf.eu, Atdhe.net has moved to Atdhenet.tv while Ilemi.com turned to Ilemi.tv. Rojadirecta : judged as legal in Spain, seized by USA (update) (only in French, 2.02.2011) http://www.numerama.com/magazine/17946-rojadirecta-juge-legal-en-espagne-sa… U.S. Resume Controversial File-Sharing Domain Seizures (Update) (1.02.2011) http://torrentfreak.com/us-resume-file-sharing-domain-seizures-110201/ Sports Streaming / Torrent Links Site Victorious in Court (10.05.2010) http://torrentfreak.com/sports-streaming-torrent-links-site-victorious-in-c… U.S. Seizes Sports Streaming Sites in "Super Bowl Crackdown"(update) (2.02.2011) http://torrentfreak.com/u-s-seizes-sports-streaming-sites-in-super-bowl-cra… ============================================================ 6. France: Increased powers for Hadopi authority ============================================================ The Hadopi law continues to develop as the French Government pushes last minute amendments to be passed by the Parliament. Thus, the French National Assembly adopted on 1 February 2011, late at night, an amendment filed at the last moment by the Government, that would allow French three strikes authority (Hadopi) to pay private-sector companies for carrying out online surveillance and filtering. Amendment 151 to the draft Law on Simplifying and Improving the Quality of Laws extends Hadopi powers to "provide support for innovative research and experimentation projects by state or privately-owned entities that would assist the Authority in fulfilling its mission (...)", meaning that the authority would have the freedom to subsidise private entities for "the development of the legal offer and the observation of legal and illegal use of works". Although it was passed in a rush and late at night, the amendment did not go unnoticed. The legal commission of the General Assembly showed concerns regarding the constitutionality of the amendment stating it had no time to examine it and asked for its withdrawal. Deputy Alain Vidalies warned that the opposition would take the issue to the Constitutional Court, considering the amendment as a "legislative knight" (a text which has actually no relation to the text examined). Another draft decree related to Hadopi was on CNIL's agenda on 20 January 2011 and is now to be examined by the State Council. The decree, already modified once in October 2010, introduces means to interconnect ISPs' subscriber files with infringement information received by the Hadopi authority and makes electronic transmissions of all files from Hadopi to courts. This modification fulfils Hadopi's wish to manage all three strikes processes up to the courts by information systems, as the authority stated in November 2010: "Actually, the information system manages the first pedagogical phases of the graduate response procedure (...) It must be completed to manage the next exchange phase with the prosecutor offices and jurisdictions, for which a decree of the Culture Minister is to be published next month." The current procedure is that the files are verified first by the Commission for the Protection of Rights (CPD) before being sent to the prosecutor. However, the president of CPD stated in an interview at the end of 2010 that he supported the idea that the "negligent infraction" can be verified by the repeated offence and therefore, no additional evidence is necessary. "If the subscriber has not changed his behaviour after three offences, he has therefore not placed any security measure (...) the consequences of your actions are those that prove the infringement ", said CPD President. The transmission of Hadopi files to the prosecutor offices is already covered by a procedural decree of July 2010 which says that the files are sent "to the prosecutor of the Republic attached to the competent high court." The idea is to make these transmissions electronic and to allow the courts to send their decisions electronically. Hadopi wants to make certain that a decision to suspend a subscriber's Internet access is applied. The authority also wants to be sure the subscriber cannot use another ISP during the suspension period. Hadopi law modified in the middle of the night to finance private actors! (only in French, 2.02.2011) http://www.numerama.com/magazine/17948-la-loi-hadopi-modifiee-en-pleine-nui… Hadopi: a legislative knight voted at night by the Assembly (only in French, 4.02.2011) http://www.01net.com/www.01net.com/editorial/527873/hadopi-un-cavalier-legi… Hadopi: towards a decree for electronic transmission to prosecutor's offices (only in French, 1.02.2011) http://www.numerama.com/magazine/17944-hadopi-vers-un-decret-pour-la-transm… Hadopi wants to make electronic the graduate response phase (only in French, 18.11.2010) http://www.itespresso.fr/hadopi-cherche-informatiser-phase-riposte-graduee-… ============================================================ 7. ENDitorial: Internet blocking and damage to child protection ============================================================ The child protection industry has been campaigning for years for the introduction of EU-wide mandatory blocking of websites accused of being illegal by the police, by independent authorities, etc. This is as a result of a very laudable reflex - child abuse websites are even more abhorrent than one would imagine and blocking a bad thing can only logically be a good thing. Politically, it is an easy message. Unfortunately, child protection in an international context is polluted with easy messages and unthinking reflexes. Every government loves sounding tough on child protection and every soundbite that does not require concrete action results in a weakening of real measures being taken to protect children from real abuse. The self-appointed childrens' representatives consistently support and encourage these meaningless and counterproductive soundbites, ultimately damaging the very interests they claim to defend. Every country in the world except Somalia has signed and ratified either the UN Child Rights Convention or its Optional Protocol on the sale of children, child prostitution and child pornography. The Convention requires governments to take all appropriate national, bilateral and international measures to prevent the exploitative use of children in "pornographic" performances. The Optional Protocol requires governments to ensure that child "pornography" is "fully covered under its penal and criminal law". We are told that some countries leave child abuse websites online for months. Where is the public condemnation from the United Nations for these blatant breaches of its most successful binding Convention? Where are the shadow reports from child protection organisations condemning those countries for gross failures to protect the weakest in society? Where are the sanctions from governments bound under international law to take "all appropriate national, bilateral and international measures to prevent the abuse"? They are lost in soundbites. The problem is that the Convention and the Optional Protocol have no enforcement mechanisms. They can be signed and forgotten and states can move on to the next soundbite. We are told that web blocking is meant to be a "complementary measure". It will be part of a wider strategy. Unfortunately, it requires no action from governments - building on years of failure and years of soundbites, they will be able to claim that they are fighting child abuse when all they are really doing is asking Internet providers to put up a screen - a screen which will mask their own failures better than the abuse. So, why does the child protection industry insist on promoting blocking? It would be unfair to say that they are funded by governments and therefore unwilling to criticise them. The issue appears to be based more on misunderstandings than anything else. If we look at one particular child campaigner's blog (link below), we can see this quite clearly. He says: "Blocking is, after all, a form of deletion. It renders the material inaccessible to the great majority of internet users in the country where blocking happens." A system which leaves the material online is not a form of deletion. Nobody has been able to indicate any statistical difference between the number of - or trends in - reports to child abuse hotlines in countries with or without blocking. It has, therefore, no discernible impact on the great majority of internet users. In any event, the great majority of internet users never find child abuse material and, according to statistics from Internet hotlines. Furthermore, the great majority (over 75%) of those who think that they do have actually found entirely legal material. He goes on to say: "Opponents of blocking are sort of saying everyone should be able to see the images until no one can." It is difficult to know which opponents of blocking might be referred to here. Innocent people very rarely access the material and there is no evidence that blocking stops this to an appreciable extent. What we object to are measures which take the pressure off governments to take real action against websites containing evidence of real abuse and which destroy fundamental rights in the process He then explains that: "A number of opponents of blocking make references to "the thin end of the wedge" and to "dangerous precedents", sometimes referred to jointly or severally as the "slippery slope". "Where will it all end?" they ask." This fails to recognise that this is not a "stand alone" argument. The "slippery slope" is an inevitable cost. Any policy in any area requires the costs and benefits to be compared and balanced. As there is no demonstrable benefit to blocking, the slippery slope alone would make the measure disproportionate. He continues: "More reprehensible in some ways are those who make no attempt to deny that blocking child abuse images is a good thing to do. Instead, and often without any apparent embarrassment, they say they would do it in a trice if only they could be sure blocking would forever be limited to that. Terrorism, anorexia or suicide related materials frequently get mentioned as examples of the types of content it is known others are pushing to be blocked." Having worked on this issue for several years, I have never once heard someone make this argument. Blocking is dangerous, counter-productive and useless for child abuse images, whether other types of site are blocked does not change this. He adds: "Why do they find it difficult to agree that they should be blocked pending their deletion? It does not add up." Having seen governments sign, ratify and forget the UN Child Rights Convention, the Convention's Optional Protocol, the International Labour Organisation Convention on the worst forms of child labour and the Stockholm Declaration, it does not add up that people interested in child protection would want to give governments yet another soundbite - another way of hiding inaction on child protection behind empty promises. There MUST be investigations in order to identify and rescue as many children as possible. There MUST be investigations in order to find and prosecute both the owners and users of such sites. Blocking will immediately warn the people behind the websites that they have been spotted by law enforcement authorities and they can act to protect themselves. Why would child protection organisations want this? He says: "The techie world generally dislikes solutions which it believes are "broken" i.e. that can be defeated or circumvented, but the point is the knowledge and the determination to circumvent or defeat blocking are very unevenly distributed." The problem that the techie world has is the same as the one that the political world increasingly has with blocking. Techies are parents too and therefore understand that all efforts to protect children must be effective. They understand that every failed initiative has real human consequences. If a policy has demonstrable costs and no demonstrable benefits, it must be avoided. He continues: "Critics say that if the EU gives official blessing to the use of blocking it would enable totalitarian regimes in other parts of the world to point to it to justify their own oppressive use of blocking." Nobody says that blocking of child abuse images will directly cause this. However, "mission creep" is not a risk, it is a guarantee. Lawless blocking, such as in the UK and Sweden is not a risk, it is an existing fact. If, and it is already beginning to happen, EU countries block child abuse websites to hide their own international failures, if they block entirely legal gambling websites in order to protect tax revenues and gambling monopolies and if they block websites accused of copyright infringement in order to protect outdated industries that cannot cope with the digital age, if EU countries abandon the rule of law and permit blocking without any involvement of law enforcement (let alone judicial) authorities, it is not alone encouraging totalitarian regimes to undermine access to information, it is providing a blueprint for them. Sadly and disappointingly, the campaigner then goes on to give statistics which have been comprehensively, repeatedly and unquestionably disproven. One of the many clear analyses of why the "statistics" are misleading nonsense is linked from the bottom of this page. To finish, and bearing in mind that total lack of any benefit of blocking and the real dangers to child protection that blocking presents, I will finish with two quotations from the campaigner that sum up the debate very neatly: "If your starting point is the best interests of the child there is no way you can end up concluding that, actually, after a lot of careful thought, a great deal of soul searching and hand wringing it is best to leave pictures of children being raped on full public view for a little while longer." "This argument turns sexually-abused children into bargaining chips." This is completely and reprehensibly true. It is incomprehensible to find oneself trying to defend measures that will force governments to take proper action against child abuse, being fought every step of the way by those people whose job it is to do this. Campaigner's blog: Campaign bulletin: child pornography on the internet - bad reasons and non-reasons for opposing blocking (29.01.2011) http://johnc1912.wordpress.com/2011/01/29/bad-reasons-and-non-reasons-for-o… Statistics: Twisting the facts to fit the story: child porn nonsense (7.02.2006) http://kierenmccarthy.co.uk/2006/02/07/twisting-the-facts-to-fit-the-story-… EDRi's blocking booklet http://www.edri.org/files/blocking_booklet.pdf (Contribution by Joe McNamee - EDRi) ============================================================ 8. Recommended Action ============================================================ Modernisation of the Council of Europe Convention 108 With new data protection challenges arising everyday, the Convention is being overhauled to meet new realities and time is now ripe to think about modernising it. The technological developments of the information and communication society as well as the globalisation of exchanges lead to unexplored challenges and potential new risks for the protection of human rights and fundamental freedoms. Is Convention 108's protection still in line with today's needs in respect of data protection or should it be modified and complemented in order to better satisfy the legitimate expectations of individuals and concerned professionals? http://www.coe.int/t/dghl/standardsetting/dataprotection/Consultation_Moder… ============================================================ 9. Recommended Reading ============================================================ Statewatch Analysis: EU: Deepening the democratic deficit: the failure to "enshrine" the public's right of access to documents by Tony Bunyan http://www.statewatch.org/analyses/no-121-eu-access-to-documents.pdf Transparency NGOs call on EU not to restrict document access (2.02.2011) http://euobserver.com/18/31736/?rk=1 ============================================================ 10. Agenda ============================================================ 18 February 2011, Berlin, Germany Open data: apps for everyone? Opportunities and challenges in the re-use of public sector information. http://www.epsiplatform.eu/news/events/opendata_apps_for_everyone 23-28 February 2011, Gosier, Guadeloupe, France ICDS 2011- 5th International Conference on Digital Society http://www.iaria.org/conferences2011/ICDS11.html 24-25 February 2011, Berlin, Germany The First OAPEN Conference http://meetings.copernicus.org/oapen2011/ 9 March 2011, Amsterdam, The Netherlands Big Brother Awards NL https://www.bigbrotherawards.nl 11-12 March 2011, Ankara, Turkey ICEGEG-2011- 3rd International Conference on E-Government and E-Governance http://www.icegeg.com/index.html 28 March 2011, Paris, France 5th European eAccessbility Forum: Benefits and costs of e-accessibility http://inova.snv.jussieu.fr/evenements/colloques/colloques/70_index_en.html 1 April 2011, Bielefeld, Germany Big Brother Awards Germany http://www.bigbrotherawards.de/index_html-en 15-17 April 2011, Berlin, Germany Re:publica XI: Conference about blogs, social media and the digital society http://re-publica.de/11/en/ 17-18 May 2011, Berlin Germany European Data Protection Reform & International Data Protection Compliance http://www.edpd-conference.com 12-15 June 2011, Bled, Slovenia 24th Bled eConference, eFuture: Creating Solutions for the Individual, Organisations and Society http://www.bledconference.org/index.php/eConference/2011 14-16 June 2011, Washington DC, USA CFP 2011 - Computers, Freedom & Privacy "The Future is Now" http://www.cfp.org/2011/wiki/index.php/Main_Page 11-12 July 2011, Barcelona, Spain 7th International Conference on Internet, Law & Politics (IDP 2011): Net Neutrality and other challenges for the future of the Internet Abstract submission: 18 February 2011 http://p2pfoundation.ning.com/profiles/blogs/7th-international-conference ============================================================ 11. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and are visible on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. Unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edri/2.html - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Nirvana
by Jon Callas 05 Jul '18

05 Jul '18

> > Perhaps that ties in with the revival of Trusted Computing - see > www.lightbluetouchpaper.org/2011/09/20/trusted-computing-2-0/ > Much better to counter with TPM-protected malware. http://www.cs.utexas.edu/~adunn/pubs/malware-tpm.pdf Jon _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

From epayments news
by Somebody 05 Jul '18

05 Jul '18

Fujitsu Transaction Solutions Inc. will unveil a new handheld computer next week designed for retailers. The Fujitsu iPAD, a compact, Microsoft Windows CE .NET-based mobile device, available in mid-2002, will combine a scanner, magnetic- and smart-card reader, keypad with encryption capabilities, and phone capability. The devices are intended to give retailers a complete, wireless retail appliance. iPAD can be used for inventory management, debit transactions, price verifications, phone calls, line busting, mobile POS and gift registry. The product uses an Intel processor and can support any 802.11b wireless LAN infrastructure. With 'Windows CE .NET', iPAD will support both XML and VoIP. 802.11b capable as well as a magstripe reader? Perfect retail device for skimmers don't you think? (PS If you do forward this, zap my name OK?) <Somebody> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

None
by Randall 05 Jul '18

05 Jul '18

<dewayne(a)warpspeed.com> Subject: Data mining that protects privacy? http://htdaw.blogsource.com/post.mhtml?post_id=349601 Sunday, June 18, 2006 at 12:34 PM EDT Research explores data mining, privacy By BRIAN BERGSTEINSat Jun 17, 10:50 PM ET As new disclosures mount about government surveillance programs, computer science researchers hope to wade into the fray by enabling data mining that also protects individual privacy. Largely by employing the head-spinning principles of cryptography, the researchers say they can ensure that law enforcement, intelligence agencies and private companies can sift through huge databases without seeing names and identifying details in the records. For example, manifests of airplane passengers could be compared with terrorist watch lists b without airline staff or government agents seeing the actual names on the other side's list. Only if a match were made would a computer alert each side to uncloak the record and probe further. "If it's possible to anonymize data and produce ... the same results as clear text, why not?" John Bliss, a privacy lawyer in IBM Corp.'s "entity analytics" unit, told a recent workshop on the subject at Harvard University. The concept of encrypting or hiding identifying details in sensitive databases is not new. Exploration has gone on for years, and researchers say some government agencies already deploy such technologies b though protecting classified information rather than individual privacy is a main goal. Even the data-mining project that perhaps drew more scorn than any other in recent years, the Pentagon's Total Information Awareness research program, funded at least two efforts to anonymize database scans. Those anonymizing systems were dropped when Congress shuttered TIA, even while the data-mining aspects of the project lived on in intelligence agencies. Still, anonymizing technologies have been endorsed repeatedly by panels appointed to examine the implications of data mining. And intriguing progress appears to have been made at designing information-retrieval systems with record anonymization, user audit logs b which can confirm that no one looked at records beyond the approved scope of an investigation b and other privacy mechanisms "baked in." The trick is to do more than simply strip names from records. Latanya Sweeney of Carnegie Mellon University b a leading privacy technologist who once had a project funded under TIA b has shown that 87 percent of Americans could be identified by records listing solely their birthdate, gender and ZIP code. Sweeney had this challenge in mind as she developed a way for the U.S. Department of Housing and Urban Development to anonymously track the homeless. The system became necessary to meet the conflicting demands of two laws b one that requires homeless shelters to tally the people they take in, and another that prohibits victims of domestic violence from being identified by agencies that help them. Sweeney's solution deploys a "hash function," which cryptographically converts information to a random-appearing code of numbers and letters. The function can't be reversed to reveal the original data. When homeless shelters had to submit their records to regional HUD offices for counting how many people used the facilities, each shelter would send only hashed data. A key detail here is that each homeless shelter would have its own computational process, known as an algorithm, for hashing data. That way, one person's name wouldn't always translate into the same code b a method that could be abused by a corrupt insider or savvy stalker who gained access to the records. However, if the same name generated different codes at different shelters, it would be impossible to tell whether one person had been to two centers and was being double-counted. So Sweeney's system adds a second step: Each shelter's hashed records are sent to all other facilities covered by the HUD regional office, then hashed again and sent back to HUD as a new code. It might be hard to wrap your mind around this, but it's a fact of the cryptography involved: If one person had been to two different shelters b and so their anonymized data got hashed twice, once by each of the shelters applying its own formula b then the codes HUD received in this second phase would indicate as much. That would aid an accurate count. Even if HUD decides not to adopt the system, Sweeney hopes it finds use in other settings, such as letting private companies and law enforcement anonymously compare whether customer records and watch lists have names in common. A University of California, Los Angeles professor, Rafail Ostrovsky, said the CIA and the National Security Agency are evaluating a program of his that would let intelligence analysts search huge batches of intercepted communications for keywords and other criteria, while discarding messages that don't apply. Ostrovsky and co-creator William Skeith believe the system would keep innocent files away from snoops' eyes while also extending their reach: Because the program would encrypt its search terms and the results, it could be placed on machines all over the Internet, not just computers in classified settings. "Technologically it is possible" to bolster security and privacy, Ostrovsky said. "You can kind of have your cake and eat it too." That may be the case, but creating such technologies is just part of the battle. One problem is getting potential users to change how they deal with information. Rebecca Wright, a Stevens Institute of Technology professor who is part of a five-year National Science Foundation-funded effort to build privacy protections into data-mining systems, illustrates that issue with the following example. The Computing Research Association annually analyzes the pay earned by university computer faculty. Some schools provide anonymous lists of salaries; more protective ones send just their minimum, maximum and average pay. Researchers affiliated with Wright's project, known as Portia, offered a way to calculate the figures with better accuracy and privacy. Instead of having universities send their salary figures for the computer association to crunch, Portia's system can perform calculations on data without ever storing it in unencrypted fashion. With such secrecy, the researchers argued, every school could safely send full salary lists. But the software remains unadopted. One large reason, Wright said, was that universities questioned whether encryption gave them legal standing to provide full salary lists when they previously could not b even though the new lists never would leave the university in unencrypted form. Even if data-miners were eager to adopt privacy enhancements, Wright and other researchers worry that the programs' obscure details might be difficult for the public to trust. Steven Aftergood, who heads the Federation of American Scientists' project on government secrecy, suggested that public confidence could be raised by subjecting government data-mining projects to external privacy reviews. But that seems somewhat unrealistic, he said, given that intelligence agencies have been slow to share surveillance details with Congress even on a classified basis. "That part of the problem may be harder to solve than the technical part," Aftergood said. "And in turn, that may mean that the problem may not have a solution." ___ On the Net: Portia: http://crypto.stanford.edu/portia Sweeney: http://lab.privacy.cs.cmu.edu/people http://news.yahoo.com/s/ap/data_mining_privacy;_ylt=AsYnPYpeRWoPlHcna. 3LYyJhr7sF;_ylu=X3oDMTBhcmljNmVhBHNlYwNtcm5ld3M- -- My Original Writing blog - http://itgotworse.blogsource.com ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Data mining that protects privacy?
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

governmental datamining: Going to Canada? Check your past
by Jeff.Hodges＠KingsMountain.com 05 Jul '18

05 Jul '18

for IP if you wish. =JeffH http://sfgate.com/cgi-bin/article.cgi?file=/c/a/2007/02/23/ MNGCAO9NSB1.DTL&type =printable Going to Canada? Check your past Tourists with minor criminal records turned back at border C.W. Nevius Friday, February 23, 2007 There was a time not long ago when a trip across the border from the United States to Canada was accomplished with a wink and a wave of a driver's license. Those days are over. Take the case of 55-year-old Lake Tahoe resident Greg Felsch. Stopped at the border in Vancouver this month at the start of a planned five-day ski trip, he was sent back to the United States because of a DUI conviction seven years ago. Not that he had any idea what was going on when he was told at customs: "Your next stop is immigration.'' Felsch was ushered into a room. "There must have been 75 people in line," he says. "We were there for three hours. One woman was in tears. A guy was sent back for having a medical marijuana card. I felt like a felon with an ankle bracelet.'' Or ask the well-to-do East Bay couple who flew to British Columbia this month for an eight-day ski vacation at the famed Whistler Chateau, where rooms run to $500 a night. They'd made the trip many times, but were surprised at the border to be told that the husband would have to report to "secondary'' immigration. There, in a room he estimates was filled with 60 other concerned travelers, he was told he was "a person who was inadmissible to Canada.'' The problem? A conviction for marijuana possession. In 1975. Welcome to the new world of border security. Unsuspecting Americans are turning up at the Canadian border expecting clear sailing, only to find that their past -- sometimes their distant past -- is suddenly an issue. <snip/> ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/@now Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] governmental datamining: Going to Canada? Check your past
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

Re: [cryptography] Nirvana
by Jon Callas 05 Jul '18

05 Jul '18

> > Perhaps that ties in with the revival of Trusted Computing - see > www.lightbluetouchpaper.org/2011/09/20/trusted-computing-2-0/ > Much better to counter with TPM-protected malware. http://www.cs.utexas.edu/~adunn/pubs/malware-tpm.pdf Jon _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Freedombox-discuss] Globaleaks demo of the Prototype online! $ /etc/init.d/globaleaks start
by Arturo Filastr 05 Jul '18

05 Jul '18

Hi All, We are pleased to announce the release of the GlobaLeaks Prototype Demo. You are all invited to take a look at it and try how it feels to a Node Administrator, Whistleblower and TULIP receiving target. You can reach the demo on http://demo.globaleaks.org/ GlobaLeaks is the first Open Source Whistleblowing Framework. It empowers anyone to easily setup and maintain their own Whistleblowing platform. It is also a collection of what are the best practices for people receiveiving and submitting material. GlobaLeaks works in all environments: media, activism, corporations, public agencies. For the full release notice you can visit http://www.globaleaks.org/news/ For all the links and information on the project http://www.globaleaks.org. GlobaLeaks has been tested by more than 50 drunk Venetian hackers, here is a link the presentation given at the Italian Hacker camp ESC: http://www.slideshare.net/globaleaks/globaleaks-live-launch-venice-2011. And most importantly, please come and hack with use and let's change the world! http://www.launchpad.net/globaleaks/ Happy hacking, A Random GlobaLeaks Contributor _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[serval-project-dev] Re: Serval mesh multicast non-functional
by Paul Gardner-Stephen 05 Jul '18

05 Jul '18

Hello, On Dec 1, 10:45 pm, "L. Martin Ringler" <l.martin.ring...(a)gmail.com> wrote: > It appears Serval doesn't handle multicast UDP messages. Is this > deliberate or broken? It is not deliberate on our part. A number of complications are likely to be present when trying to do multicast: 1. The phones may not have kernel support for it compiled in (or more likely, some models will, while others wont). 2. I don't know if BATMAN does multicast (I suspect OLSR might, but I really don't know). > Why muticast messages are important... > > 1. To maintain a routing table for non pure mesh where some of the > nodes are seperated by a functional backbone the mesh messages will > have to be multicast since broadcast messages will be restricted to > the local subnet. Most modern routers block IP broadcast traffic. I agree multicast is good here, but there are ways around this, even if they aren't ideal. In particular, if there is a mesh node at either end, then they can (eventually) bridge traffic. Some of this will become much simpler once we move to the overlay mesh, at which point multicast will not be sensibly possible, anyway. > 2. Some applications that could use the ad-hoc mesh are Position > Location type apps. You and your friends are skiing and you get > seperated, your app would tell you where they are etc. I think you > would need to multicast the Position Location Information and > broadcast wouldn't work if 2 or more discreet groups were on the same > Serval mesh. Actually, there are ways around this, and we are currently working on exactly this kind of groups of people sharing information problem that you mention. We see no reason why our planned protocols shouldn't work with multiple groups in the same physical area, even with overlapping membership. > Is the Ad-hoc mesh encryted? Seems to be in the clear. It is all in the clear at present. We have plans to add voice, SMS etc encryption and authentication in over coming months. Mesh management traffic will remain en claire, but the overlay mesh will increase the ability to authenticate even that. Paul. -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0