July 2018 - cypherpunks-legacy

[IP] Books -- The New Hows and Whys of Global Eavesdropping
by David Farber 06 Jul '18

06 Jul '18

------ Forwarded Message From: "John F. McMullen" <observer(a)westnet.com> Date: Wed, 02 Mar 2005 00:57:49 -0500 (EST) To: johnmac's living room <johnmacsgroup(a)yahoogroups.com> Cc: Dave Farber <farber(a)cis.upenn.edu> Subject: Books -- The New Hows and Whys of Global Eavesdropping >From the New York Times -- http://www.nytimes.com/2005/03/02/books/02grim.html BOOKS OF THE TIMES | 'CHATTER' The New Hows and Whys of Global Eavesdropping By WILLIAM GRIMES Remember chatter? After 9/11, it was all over the news. For months, snatches of cellphone conversations in Karachi or Tora Bora routinely made the front page. Television newscasters could chill the blood instantly by reporting on "increased levels of chatter" somewhere in the ether. But what exactly was it? Who was picking it up, and how were they making sense of it? Patrick Radden Keefe does his best to answer these questions and demystify a very mysterious subject in "Chatter," a beginner's guide to the world of electronic espionage and the work of the National Security Agency, responsible for communications security and signals intelligence, or "sigint." In a series of semiautonomous chapters, he describes Echelon, the vast electronic intelligence-gathering system operated by the United States and its English-speaking allies; surveys the current technology of global eavesdropping; and tries to sort out the vexed issue of privacy rights versus security demands in a world at war with terrorism. Mr. Keefe writes, crisply and entertainingly, as an interested private citizen rather than an expert. A third-year student at Yale Law School, he follows in the footsteps of freelance investigators like James Bamford, who, through sheer persistence, managed to penetrate at least some of the multiple layers of secrecy surrounding the National Security Agency in his book "The Puzzle Palace." "Chatter" is a much breezier affair, filled with anecdotes, colorful quotes and arresting statistics. The United States has fewer than 5,000 spies operating around the world, for example, but 30,000 eavesdroppers. The National Security Agency employs more mathematicians than any other organization in the world, and every three hours its spy satellites gather enough information to fill the Library of Congress. Menwith Hill, the American listening station in North Yorkshire, England, has a staff as large as MI5, Britain's domestic intelligence service. Menwith Hill is just one in a network of American-run bases and overhead satellites that, Mr. Keefe writes, "have wrapped the earth in a spectral web of electronic surveillance." In some respects, their task is not that tough. "The air around us and the sky above us are a riot of signals," Mr. Keefe writes. "To intercept those signals is as easy as putting a cup out in the rain." As fiber-optic cables become the main channel for data transmission, surveillance will become more difficult, but at the moment the ability to collect electronic signals is far outstripping the ability to analyze it. Some messages are chatter. Others are chit-chat. In February 2003, the New York City police went on high alert, sending special teams into the subways and posting extra police at the tunnels leading in and out of Manhattan, all because the word "underground" had been picked up in an intercepted conversation between terrorists. Nothing happened. Was the word or the context misinterpreted? Or did the police presence thwart an attack? It's impossible to know. The National Security Agency has invested heavily in technology while cutting back on human analysts and foreign-language interpreters with the skill to detect shades of nuance in casual conversations. Should it now reinvest in training people fluent in Baluchi, the dialect spoken by Mohamed Atta, the lead hijacker in the 9/11 attacks? By the time their training is completed, voice-recognition technology may have turned out to be the smart bet. Sigint is a murky business. "Chatter" is often quite amusing. Mr. Keefe has great fun with Total Information Awareness, the ill-fated antiterrorist program announced by the Pentagon in the late summer of 2003. By linking private and government databases, Total Awareness would pick up on every electronic click, ping or chirp created by private citizens in the course of their daily lives. The very name, Mr. Keefe, points out, was ominous, Orwellian. So was the symbol for the Information Awareness Office, a pyramid with an eye on top surveying planet Earth. "In case anyone had any doubt about the program's intentions, the Web site bore the motto scientia est potentia, 'knowledge is power,' " Mr. Keefe writes. Hastily, the name was changed to Terrorism Information Awareness, but a suspicious Congress strangled the program in its cradle. That sounds like cause for celebration. But, as Mr. Keefe points out, that program might have noticed when $10,000 was wired to a Florida SunTrust bank account in the name of Mohamed Atta on July 19, 2000, or set off alarm bells when a dozen men, some of them on terrorist watch lists and others with lapsed visas, bought one-way tickets on flights departing at about the same time on Sept. 11, 2001. Mr. Keefe is a privacy agnostic. He does not know quite where to draw the line between legitimate national security concerns and the privacy rights of citizens. Somewhat feebly, he calls for vigorous debate on the issue. By temperament and by vocation, he loathes the secrecy culture of national spy agencies, but he has no patience with conspiracy theorists and idealists, like the German Green Party member who concluded in a European Union report on Echelon and its dangers that secret services cannot be controlled, and "must therefore be abolished." Mr. Keefe seems almost as nave, though, when he notes, in astonishment, that the National Security Agency does not publish a list of its employees, and that they are not allowed to write about their work in their diaries. Imagine that. In the end, Mr. Keefe allows everyone involved in the debate to have a say. He even gives equal time to a Defense Department official who tells him, bluntly, "the only people who think that intelligence wins wars - hot or cold - are intelligence people." So much for chatter. And you should see the phone bill. CHATTER Dispatches From the Secret World of Global Eavesdropping By Patrick Radden Keefe 300 pages. Random House. $24.95. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: LOIC tool used in the "Anonymous" attacks
by John Adams 06 Jul '18

06 Jul '18

It's hard to believe that it took eight people to run wireshark and write this simplistic paper about LOIC. The analysis is weak at best (it seems they only had a few days to study the problem), and never analyzes the source code which has been widely available at https://github.com/NewEraCracker/LOIC A cursory analysis of HTTPFlooder.cs would give you all you need to know to understand the attack and block the tool; If you find your network attacked by this tool, you'll immediately discover a large volume of HTTP requests with no User-Agent or Accept: headers. Drop those requests at the border. You can also compile requests of that nature to analyze the size of the swarm that is attacking you. In analysis, I've found this to be on the order of 2000-3000 hosts. It's a decently sized ACL to place on your ingress routers, but these attacks can be thwarted. -j On Sat, Dec 11, 2010 at 7:19 AM, Marshall Eubanks <tme(a)multicasttech.com> wrote: > Interesting analysis of the 3 "LOIC" tool variants used in the "Anonymous" Operation Payback attacks on Mastercard, Paypal, etc. > > http://www.simpleweb.org/reports/loic-report.pdf > > LOIC makes no attempt to hide the IP addresses of the attackers, making it easy to trace them if they are using their own computers. > > Regards > Marshall > > > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] Skype Outage
by Matthew Kaufman 06 Jul '18

06 Jul '18

On 12/22/2010 9:54 PM, Julian Cain wrote: > > On Dec 23, 2010, at 12:33 AM, Salman Abdul Baset<sa2086(a)columbia.edu> wrote: > >> On Thu, 23 Dec 2010, Julian Cain wrote: >> >>> Here I display some of todays >>> work: http://www.youtube.com/watch?v=YHpFIMlItrM >>> >> Cool stuff. >> >> My first guess at why Skype super node numbers are decreasing at this time of the year are that most Skype super nodes run in universities and it is the end of the academic semester. So students are shutting down their machines and Skype super nodes. Infact, it is safe to say that if the universities cracked down on Skype, there will not likely be enough super nodes to sustain the Skype network. >> > There are ~100,000 standby supernodes at any one moment also the hardcoded supernodes are for the most part installed into universities as you state. I believe this to be an automated event. > > If you compare which supernodes went down to those that didn't the version numbers are similar. I've captured these packets and decrypted them and currently looking into my findings. It is fairly common knowledge that many people running the current version of the Windows client experienced a crash last night at around the same time. This matches Skype's public message at http://blogs.skype.com/en/2010/12/skype_downtime_today.html "many of them were taken offline by a problem affecting some versions of Skype". Not surprisingly, a whole lot of the nodes run Windows and thus the fraction of supernodes which are running Windows is also high. More clients trying to reach supernodes than there is supernode capacity looks exactly like a DDOS against the supernode addresses, of course. This is a common restart failure mode for all types of network systems... one must always balance the reconnect backoff times between the risk of flooding the servers (in this case, distributed out to supernodes in a p2p system) and the user experience of taking forever to reconnect after a local network outage (which may be indistinguishable from a global server-side problem). > Most of the supernodes were non-responsive at ~12:00 EST. There were only ~2k routing traffic at the peak of this event and the network requires ~71,000 to support peak load hours. > > It will be interesting to hear what they claim happened. I'm not an official spokesperson for Skype, so I can't really say more than what's in the official blog... though it does say almost exactly what's above. Matthew Kaufman _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: LOIC tool used in the "Anonymous" attacks
by John Adams 06 Jul '18

06 Jul '18

It's hard to believe that it took eight people to run wireshark and write this simplistic paper about LOIC. The analysis is weak at best (it seems they only had a few days to study the problem), and never analyzes the source code which has been widely available at https://github.com/NewEraCracker/LOIC A cursory analysis of HTTPFlooder.cs would give you all you need to know to understand the attack and block the tool; If you find your network attacked by this tool, you'll immediately discover a large volume of HTTP requests with no User-Agent or Accept: headers. Drop those requests at the border. You can also compile requests of that nature to analyze the size of the swarm that is attacking you. In analysis, I've found this to be on the order of 2000-3000 hosts. It's a decently sized ACL to place on your ingress routers, but these attacks can be thwarted. -j On Sat, Dec 11, 2010 at 7:19 AM, Marshall Eubanks <tme(a)multicasttech.com> wrote: > Interesting analysis of the 3 "LOIC" tool variants used in the "Anonymous" Operation Payback attacks on Mastercard, Paypal, etc. > > http://www.simpleweb.org/reports/loic-report.pdf > > LOIC makes no attempt to hide the IP addresses of the attackers, making it easy to trace them if they are using their own computers. > > Regards > Marshall > > > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] Skype Outage
by Matthew Kaufman 06 Jul '18

06 Jul '18

On 12/22/2010 9:54 PM, Julian Cain wrote: > > On Dec 23, 2010, at 12:33 AM, Salman Abdul Baset<sa2086(a)columbia.edu> wrote: > >> On Thu, 23 Dec 2010, Julian Cain wrote: >> >>> Here I display some of todays >>> work: http://www.youtube.com/watch?v=YHpFIMlItrM >>> >> Cool stuff. >> >> My first guess at why Skype super node numbers are decreasing at this time of the year are that most Skype super nodes run in universities and it is the end of the academic semester. So students are shutting down their machines and Skype super nodes. Infact, it is safe to say that if the universities cracked down on Skype, there will not likely be enough super nodes to sustain the Skype network. >> > There are ~100,000 standby supernodes at any one moment also the hardcoded supernodes are for the most part installed into universities as you state. I believe this to be an automated event. > > If you compare which supernodes went down to those that didn't the version numbers are similar. I've captured these packets and decrypted them and currently looking into my findings. It is fairly common knowledge that many people running the current version of the Windows client experienced a crash last night at around the same time. This matches Skype's public message at http://blogs.skype.com/en/2010/12/skype_downtime_today.html "many of them were taken offline by a problem affecting some versions of Skype". Not surprisingly, a whole lot of the nodes run Windows and thus the fraction of supernodes which are running Windows is also high. More clients trying to reach supernodes than there is supernode capacity looks exactly like a DDOS against the supernode addresses, of course. This is a common restart failure mode for all types of network systems... one must always balance the reconnect backoff times between the risk of flooding the servers (in this case, distributed out to supernodes in a p2p system) and the user experience of taking forever to reconnect after a local network outage (which may be indistinguishable from a global server-side problem). > Most of the supernodes were non-responsive at ~12:00 EST. There were only ~2k routing traffic at the peak of this event and the network requires ~71,000 to support peak load hours. > > It will be interesting to hear what they claim happened. I'm not an official spokesperson for Skype, so I can't really say more than what's in the official blog... though it does say almost exactly what's above. Matthew Kaufman _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Books -- The New Hows and Whys of Global Eavesdropping
by David Farber 06 Jul '18

06 Jul '18

------ Forwarded Message From: "John F. McMullen" <observer(a)westnet.com> Date: Wed, 02 Mar 2005 00:57:49 -0500 (EST) To: johnmac's living room <johnmacsgroup(a)yahoogroups.com> Cc: Dave Farber <farber(a)cis.upenn.edu> Subject: Books -- The New Hows and Whys of Global Eavesdropping >From the New York Times -- http://www.nytimes.com/2005/03/02/books/02grim.html BOOKS OF THE TIMES | 'CHATTER' The New Hows and Whys of Global Eavesdropping By WILLIAM GRIMES Remember chatter? After 9/11, it was all over the news. For months, snatches of cellphone conversations in Karachi or Tora Bora routinely made the front page. Television newscasters could chill the blood instantly by reporting on "increased levels of chatter" somewhere in the ether. But what exactly was it? Who was picking it up, and how were they making sense of it? Patrick Radden Keefe does his best to answer these questions and demystify a very mysterious subject in "Chatter," a beginner's guide to the world of electronic espionage and the work of the National Security Agency, responsible for communications security and signals intelligence, or "sigint." In a series of semiautonomous chapters, he describes Echelon, the vast electronic intelligence-gathering system operated by the United States and its English-speaking allies; surveys the current technology of global eavesdropping; and tries to sort out the vexed issue of privacy rights versus security demands in a world at war with terrorism. Mr. Keefe writes, crisply and entertainingly, as an interested private citizen rather than an expert. A third-year student at Yale Law School, he follows in the footsteps of freelance investigators like James Bamford, who, through sheer persistence, managed to penetrate at least some of the multiple layers of secrecy surrounding the National Security Agency in his book "The Puzzle Palace." "Chatter" is a much breezier affair, filled with anecdotes, colorful quotes and arresting statistics. The United States has fewer than 5,000 spies operating around the world, for example, but 30,000 eavesdroppers. The National Security Agency employs more mathematicians than any other organization in the world, and every three hours its spy satellites gather enough information to fill the Library of Congress. Menwith Hill, the American listening station in North Yorkshire, England, has a staff as large as MI5, Britain's domestic intelligence service. Menwith Hill is just one in a network of American-run bases and overhead satellites that, Mr. Keefe writes, "have wrapped the earth in a spectral web of electronic surveillance." In some respects, their task is not that tough. "The air around us and the sky above us are a riot of signals," Mr. Keefe writes. "To intercept those signals is as easy as putting a cup out in the rain." As fiber-optic cables become the main channel for data transmission, surveillance will become more difficult, but at the moment the ability to collect electronic signals is far outstripping the ability to analyze it. Some messages are chatter. Others are chit-chat. In February 2003, the New York City police went on high alert, sending special teams into the subways and posting extra police at the tunnels leading in and out of Manhattan, all because the word "underground" had been picked up in an intercepted conversation between terrorists. Nothing happened. Was the word or the context misinterpreted? Or did the police presence thwart an attack? It's impossible to know. The National Security Agency has invested heavily in technology while cutting back on human analysts and foreign-language interpreters with the skill to detect shades of nuance in casual conversations. Should it now reinvest in training people fluent in Baluchi, the dialect spoken by Mohamed Atta, the lead hijacker in the 9/11 attacks? By the time their training is completed, voice-recognition technology may have turned out to be the smart bet. Sigint is a murky business. "Chatter" is often quite amusing. Mr. Keefe has great fun with Total Information Awareness, the ill-fated antiterrorist program announced by the Pentagon in the late summer of 2003. By linking private and government databases, Total Awareness would pick up on every electronic click, ping or chirp created by private citizens in the course of their daily lives. The very name, Mr. Keefe, points out, was ominous, Orwellian. So was the symbol for the Information Awareness Office, a pyramid with an eye on top surveying planet Earth. "In case anyone had any doubt about the program's intentions, the Web site bore the motto scientia est potentia, 'knowledge is power,' " Mr. Keefe writes. Hastily, the name was changed to Terrorism Information Awareness, but a suspicious Congress strangled the program in its cradle. That sounds like cause for celebration. But, as Mr. Keefe points out, that program might have noticed when $10,000 was wired to a Florida SunTrust bank account in the name of Mohamed Atta on July 19, 2000, or set off alarm bells when a dozen men, some of them on terrorist watch lists and others with lapsed visas, bought one-way tickets on flights departing at about the same time on Sept. 11, 2001. Mr. Keefe is a privacy agnostic. He does not know quite where to draw the line between legitimate national security concerns and the privacy rights of citizens. Somewhat feebly, he calls for vigorous debate on the issue. By temperament and by vocation, he loathes the secrecy culture of national spy agencies, but he has no patience with conspiracy theorists and idealists, like the German Green Party member who concluded in a European Union report on Echelon and its dangers that secret services cannot be controlled, and "must therefore be abolished." Mr. Keefe seems almost as nave, though, when he notes, in astonishment, that the National Security Agency does not publish a list of its employees, and that they are not allowed to write about their work in their diaries. Imagine that. In the end, Mr. Keefe allows everyone involved in the debate to have a say. He even gives equal time to a Defense Department official who tells him, bluntly, "the only people who think that intelligence wins wars - hot or cold - are intelligence people." So much for chatter. And you should see the phone bill. CHATTER Dispatches From the Secret World of Global Eavesdropping By Patrick Radden Keefe 300 pages. Random House. $24.95. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

OpenSSL Security Advisory
by OpenSSL 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenSSL Security Advisory [05 Feb 2013] ======================================== SSL, TLS and DTLS Plaintext Recovery Attack (CVE-2013-0169) ============================================================ Nadhem Alfardan and Kenny Paterson have discovered a weakness in the handling of CBC ciphersuites in SSL, TLS and DTLS. Their attack exploits timing differences arising during MAC processing. Details of this attack can be found at: http://www.isg.rhul.ac.uk/tls/ All versions of OpenSSL are affected including 1.0.1c, 1.0.0j and 0.9.8x Note: this vulnerability is only partially mitigated when OpenSSL is used in conjuction with the OpenSSL FIPS Object Module and the FIPS mode of operation is enabled. Thanks go to Nadhem J. AlFardan and Kenneth G. Paterson of the Information Security Group Royal Holloway, University of London for discovering this flaw. An initial fix was prepared by Adam Langley <agl(a)chromium.org> and Emilia Kdsper <ekasper(a)google.com> of Google. Additional refinements were added by Ben Laurie, Andy Polyakov and Stephen Henson of the OpenSSL group. Affected users should upgrade to OpenSSL 1.0.1d, 1.0.0k or 0.9.8y TLS 1.1 and 1.2 AES-NI crash (CVE-2012-2686) ============================================= A flaw in the OpenSSL handling of CBC ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a DoS attack. If you are unsure if you are using AES-NI see "References" below. Anyone using an AES-NI platform for TLS 1.2 or TLS 1.1 on OpenSSL 1.0.1c is affected. Platforms which do not support AES-NI or versions of OpenSSL which do not implement TLS 1.2 or 1.1 (for example OpenSSL 0.9.8 and 1.0.0) are not affected. Thanks go to Adam Langley <agl(a)chromium.org> for initially discovering the bug and developing a fix and to Wolfgang Ettlingers <wolfgang.ettlinger(a)gmail.com> for independently discovering this issue. Affected users should upgrade to OpenSSL 1.0.1d OCSP invalid key DoS issue (CVE-2013-0166) ============================================ A flaw in the OpenSSL handling of OCSP response verification can be exploitedin a denial of service attack. All versions of OpenSSL are affected including 1.0.1c, 1.0.0j and 0.9.8x This flaw was discovered and fixed by Stephen Henson of the OpenSSL core team. Affected users should upgrade to OpenSSL 1.0.1d, 1.0.0k or 0.9.8y. References ========== URL for this Security Advisory: http://www.openssl.org/news/secadv_20130204.txt Wikipedia AES-NI description: http://en.wikipedia.org/wiki/AES-NI -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEVAwUBURETXqLSm3vylcdZAQLE2QgAuHTRN3khjkmt/NRS4hg/mT+YRD+aJMsU mhCoqYvVuW0GVJHCY4yiBUoj0bgTfwWyazQRaWSFX8ewc/mHqNKYoVBSczb9nxqZ Kh41maLcKGMHtDNQlb5bINa95+9Ix9+J9Izdd7dWycpApN/azCV+r/kkXVArAq8J jYZ5Wl7PtSELArAtN5R56TgmSpcZvnIkqm7dV9rkJZGE9PBXskiLJjozWqPHgvQC HcAXNuAgrWJjuCKimictGoC0gP+tmF7tMIqYKT8/16qAqWs4vBk/Z0rxpQ4wV6pU 6jWjcFL+dVQm/59RKtYwsnBPmXgH9zg7kS2y0xcHTWJG3EKucxe8zQ== =BgHn -----END PGP SIGNATURE----- ______________________________________________________________________ OpenSSL Project http://www.openssl.org Announcement Mailing List openssl-announce(a)openssl.org Automated List Manager majordomo(a)openssl.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Why we spent a decade+ building strong crypto & security
by John Gilmore 06 Jul '18

06 Jul '18

The US government's moves to impose totalitarian control in the last year (secret trials, enemies lists, massive domestic surveillance) are what some of the more paranoid among us have been expecting for years. I was particularly amused by last week's comments from the Administration that it'll be too hard to retrain the moral FBI agents who are so careful of our civil rights -- so we'll need a new domestic-spying agency that will have no compunctions about violating our civil rights and wasting our money by spying on innocent people. While there's plenty of fodder for argument among the details, the overall thrust of the effort seems pretty clear. Now's a great time to deploy good working encryption, everywhere you can. Next month or next year may be too late. And even honest ISPs, banks, airlines (hah), etc, may be forced by law or by secret pressure to act as government spies. Make your security work end-to-end. Got STARTTLS? Got IPSEC? Got SSH? Use it or lose it. John Gilmore --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: US Food Aid Propaganda
by WalkerBill＠aol.com 06 Jul '18

06 Jul '18

yeah, what is 37,000 food packages? 20 tons? less than one planeload... meanwhile the food aid that was supporting 5 million Afghans is cut off. ###

1 0

[Politech] Update from Europe on data retention: What's happening now [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

Previous Politech message: http://www.politechbot.com/2007/01/24/not-just-isps/ -------- Original Message -------- Subject: Data retention in Europe Date: Mon, 29 Jan 2007 21:56:14 +0100 From: Erich M. <me(a)quintessenz.org> To: declan(a)well.com Declan, Concerning your posting on the upcoming data retention laws in the US here is some news on the same topiq all over europe that might be of interest. [pls see links to the doqumentation below] By 2007/08 the new EU "directive on the retention of data ... in ... publicly available electronic communications services or of public communications networks" requires all EU countries to turn their existing data protection laws upside down. Traffic data [who calls whom when where / who uses which IP address when etc.] currently have to be deleted when no longer needed for technical and billing purposes by the network operator. That is the gist of all current data protection laws all over Europe: storage of communications traffic data without the citizen's consent is until now explicitly forbidden. The data retention directive says: A large amount of traffic data from telephone networks and the internet must be stored by network operators now for a period of up to two years.The timing depends on national decision. England, France, Ireland, Poland and Sweden have all in all shown their least respect to privacy and the rights of the individual being. Interestingly the EU hardliners are a mix of social-democrat and conservative governments. A meeting of authoritarian and populist politicians from both sides of the spectrum ... In some EU countries with strong data protection laws like Germany there has been fierce and ongoing opposition. Chambers of commerce, ISPAs and About 10.000 people already have signed in to challenge the upcoming German data retention law for violating the German constitution. The Austrian government is neither in favour of changing core data protection laws that have been enacted only a few years ago. quintessenz has doqumented how this dangerous and much debated directive was rushed through various bodies of the EU. The roots of this directive can be traced back to the "Convention on Cybercrime by the Council of Europe [COE] and to the G/7 summits of the late nineties. EU Data Retention - doqumentation, news and links http://quintessenz.org/d/000100002986 Key doquments on "the making of" data retention 1997 - 2006 http://quintessenz.org/cgi-bin/index?funktion=links&id=000100002986&type=fi… cu Erich -- pgp-Key http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE386BAA1 -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0