July 2018 - cypherpunks-legacy

[For IP, if you wish] CIA agents tracked through sloppy
by Francesco Callari 06 Jul '18

06 Jul '18

cellphone use. Dr. Farber, I thought the following may be of interest to IP readers. ------------------------------------------------------------------------ ----------- Today's US news sources show several reports on Italian prosecutors writing arrest warrants for 13 CIA agents in the kidnapping of a Muslim preacher in Milan in 2003. The Italian newspapers, however, provide some interesting technical details on the investigation, which hinged on tracking their cellphones. Excerpt translations follow. [Repubblica, 6/24/2005] Milan closes the inquiry - CIA, 12 agents face arrest. [...] "The CIA team bungled a lot, leaving clues everywhere. A group of cell phones is in Via Guerzoni [where the kidnapping occurred] around noon. The same cell phones moved toward Aviano Air Base shortly thereafter. Calls from those cell phone were made to the U.S. consulate and to numbers in Virginia. One of the same cell phones was located in Cairo the day after. From the cell phones [the investigators] tracked [...] the hotels in Milan where the team members stayed and the car rental agency where the van used in the operation was rented. [...] In those days of February 2003 the American team in Milan showed a surprising ignorance, or lack of care at least, in the use of their cellphones. Using the words of one of our sources, "they showed to know less than one of our homegrown thieves". Apparently they thought that replacing the phones' SIM cards was enough to prevent successful tracking. Not so, the Americans apparently ignored the unique hardware identifier of each GSM phone (the IMEI), which can be tracked regardless of the SIM card and the phone carrier. [Corriere della Sera, 6/24] Milan' prosecutors: jail the CIA agents. [Lots of details on the investigation results, including $120,000 of U.S. taxpayer's money spent by CIA team members to reside in 5 luxury hotels, plus a note about two couples of team members that took a vacation in "romantic hotels" in Valmalenco and along the Poet's Gulf after the kidnapping. The interesting bit involving cellphones is toward the end:] All the cellphones were irregular, since the registered owners were fake names, non-existing corporations and even innocent Milan women and a Rumenian bricklayer. However, the CIA operatives showed their own U.S. passports to register themselves in a total of 23 hotels and 4 rental car companies, and the phones could be placed in the same locations at the same times. The police tracked the photocopies of the passports, and determined that they were genuine documents, even though probably using showing cover names. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] CIA agents tracked through sloppy cellphone use.
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[EPIC_IDOF] My Essay on Data Mining
by Bruce Schneier 06 Jul '18

06 Jul '18

Why Data Mining Won't Stop Terror Commentary by Bruce Schneier 02:00 AM Mar, 09, 2006 EST http://www.wired.com/news/columns/0,70357-0.html?tw=wn_index_3 In the post-9/11 world, there's much focus on connecting the dots. Many believe data mining is the crystal ball that will enable us to uncover future terrorist plots. But even in the most wildly optimistic projections, data mining isn't tenable for that purpose. We're not trading privacy for security; we're giving up privacy and getting no security in return. Most people first learned about data mining in November 2002, when news broke about a massive government data mining program called Total Information Awareness. The basic idea was as audacious as it was repellent: suck up as much data as possible about everyone, sift through it with massive computers, and investigate patterns that might indicate terrorist plots. Americans across the political spectrum denounced the program, and in September 2003, Congress eliminated its funding and closed its offices. But TIA didn't die. According to The National Journal, it just changed its name and moved inside the Defense Department. This shouldn't be a surprise. In May 2004, the General Accounting Office published a report (.pdf) listing 122 different federal government data-mining programs that used people's personal information. This list didn't include classified programs, like the NSA's eavesdropping effort or state-run programs like MATRIX. The promise of data mining is compelling, and convinces many. But it's wrong. We're not going to find terrorist plots through systems like this, and we're going to waste valuable resources chasing down false alarms. To understand why, we have to look at the economics of the system. Security is always a trade-off, and for a system to be worthwhile, the advantages have to be greater than the disadvantages. A national security data-mining program is going to find some percentage of real attacks and some percentage of false alarms. If the benefits of finding and stopping those attacks outweigh the cost -- in money, liberties, etc. -- then the system is a good one. If not, you'd be better off spending that capital elsewhere. Data mining works best when you're searching for a well-defined profile, a reasonable number of attacks per year and a low cost of false alarms. Credit-card fraud is one of data mining's success stories: all credit-card companies mine their transaction databases for data for spending patterns that indicate a stolen card. Many credit-card thieves share a pattern -- purchase expensive luxury goods, purchase things that can be easily fenced, etc. -- and data mining systems can minimize the losses in many cases by shutting down the card. In addition, the cost of false alarms is only a phone call to the cardholder asking him to verify a couple of purchases. The cardholders don't even resent these phone calls -- as long as they're infrequent -- so the cost is just a few minutes of operator time. Terrorist plots are different. There is no well-defined profile and attacks are very rare. Taken together, these facts mean that data- mining systems won't uncover any terrorist plots until they are very accurate, and that even very accurate systems will be so flooded with false alarms that they will be useless. All data-mining systems fail in two different ways: false positives and false negatives. A false positive is when the system identifies a terrorist plot that really isn't one. A false negative is when the system misses an actual terrorist plot. Depending on how you "tune" your detection algorithms, you can err on one side or the other: you can increase the number of false positives to ensure you are less likely to miss an actual terrorist plot, or you can reduce the number of false positives at the expense of missing terrorist plots. To reduce both those numbers, you need a well-defined profile. And that's a problem when it comes to terrorism. In hindsight, it was really easy to connect the 9/11 dots and point to the warning signs, but it's much harder before the fact. Certainly, many terrorist plots share common warning signs, but each is unique, as well. The better you can define what you're looking for, the better your results will be. Data mining for terrorist plots will be sloppy, and it'll be hard to find anything useful. Data mining is like searching for a needle in a haystack. There are 900 million credit cards in circulation in the United States. According to the FTC September 2003 Identity Theft Survey Report, about 1 percent (10 million) cards are stolen and fraudulently used each year. When it comes to terrorism, however, trillions of connections exist between people and events -- things that the data-mining system will have to "look at" -- and very few plots. This rarity makes even accurate identification systems useless. Let's look at some numbers. We'll be optimistic -- we'll assume the system has a one in 100 false-positive rate (99 percent accurate), and a one in 1,000 false-negative rate (99.9 percent accurate). Assume 1 trillion possible indicators to sift through: that's about 10 events -- e-mails, phone calls, purchases, web destinations, whatever -- per person in the United States per day. Also assume that 10 of them are actually terrorists plotting. This unrealistically accurate system will generate 1 billion false alarms for every real terrorist plot it uncovers. Every day of every year, the police will have to investigate 27 million potential plots in order to find the one real terrorist plot per month. Raise that false-positive accuracy to an absurd 99.9999 percent and you're still chasing 2,750 false alarms per day -- but that will inevitably raise your false negatives, and you're going to miss some of those 10 real plots. This isn't anything new. In statistics, it's called the "base rate fallacy," and it applies in other domains as well. For example, even highly accurate medical tests are useless as diagnostic tools if the incidence of the disease is rare in the general population. Terrorist attacks are also rare, any "test" is going to result in an endless stream of false alarms. This is exactly the sort of thing we saw with the NSA's eavesdropping program: the New York Times reported that the computers spat out thousands of tips per month. Every one of them turned out to be a false alarm. And the cost was enormous -- not just for the FBI agents running around chasing dead-end leads instead of doing things that might actually make us safer, but also the cost in civil liberties. The fundamental freedoms that make our country the envy of the world are valuable, and not something that we should throw away lightly. Data mining can work. It helps Visa keep the costs of fraud down, just as it helps Amazon alert me to books I might want to buy and Google show me advertising I'm more likely to be interested in. But these are all instances where the cost of false positives is low (a phone call from a Visa operator or an uninteresting ad) in systems that have value even if there is a high number of false negatives. Finding terrorism plots is not a problem that lends itself to data mining. It's a needle-in-a-haystack problem, and throwing more hay on the pile doesn't make that problem any easier. We'd be far better off putting people in charge of investigating potential plots and letting them direct the computers, instead of putting the computers in charge and letting them decide who should be investigated. _______________________________________________ EPIC_IDOF mailing list EPIC_IDOF(a)mailman.epic.org https://mailman.epic.org/cgi-bin/mailman/listinfo/epic_idof ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Essay on Data Mining
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

EDRI-gram newsletter - Number 4.15, 2 August 2006
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 4.15, 2 August 2006 ============================================================ Contents ============================================================ EDRI-gram in German 1. Digital Rights Ireland Challenge to Data Retention 2. EU might fingerprint children even before 12 years old 3. End of activities Bits of Freedom 4. Telecom Italia wiretapping scandal 5. EU trying to push again biometrics on national ID cards 6. The French copyright law changed by the Constitutional Council 7. The Schengen Information System II delayed 8. Recommended reading 9. Agenda 10. About ============================================================ EDRI-gram in German ============================================================ Starting with July 2006, EDRI-gram will be available also in German, a few days after the English edition. The translation is done by Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users. Translations are available for all 2006 editions back to issue 3.23 at : http://www.unwatched.org/ ============================================================ 1.Digital Rights Ireland Challenge to Data Retention ============================================================ The Irish Government filed a challenge to the data retention directive on 6 July 2006. The challenge had been announced some time before by the Minister for Justice but was filed just before the time limit for the action had expired. The case challenges the legal basis for the directive, alleging that this was a matter relating to criminal justice and as such the appropriate measure would have been a framework decision under the third pillar. The challenge is purely procedural in nature, however, and does not address privacy concerns about the directive. It appears that Slovakia, which shared Ireland's concerns about the legal basis and also voted against the directive, has decided not to bring a challenge of its own but will support the Irish case. Digital Rights Ireland (DRI) has written to the Irish Minister for Justice and Law Reform, the Minister for Communications, Marine and Natural Resources and to the Garda (Police) Commissioner. They have looked for undertakings from them to cease breaching the Constitutional, statutory and European rights of the citizens of Ireland by discontinuing data retention. Failing a positive response, they have instructed their solicitors, McGarr Solicitors, to prepare legal action. The DRI challenge relates to both domestic data retention schemes (in place since 2002) and the data retention directive. The challenge will seek to have the domestic laws struck down as illegal, unconstitutional, and in breach of the European Convention on Human Rights. The challenge will also seek an injunction restraining implementation of the directive and a referral to the European Court of Justice to test the legality of the directive. T.J. McIntyre, University College Dublin law lecturer and chairman of DRI said: "This is a complete reversal of the assumption that people are innocent until proven guilty. This legislation is the first time we have seen any state impose mass surveillance on its population on the basis that at some point in the future someone might commit a crime. This mass surveillance by the state is a breach of our right to privacy, as set out in our constitution and in the European Convention on Human Rights. At the moment, the movements and telephone calls of every citizen are being monitored. If we allow the EU directive to be implemented, this surveillance will extend to the emails and web browsing of every citizen. The undertakings we have sought from the Ministers for Justice and Communications and the Garda Commissioner are urgently required if the ongoing breach of citizens' rights is to stop. If they are not forthcoming we have informed all the parties that our legal team have instructions to commence legal proceedings." Ireland in court challenge to terror directive (20.5.2006): http://home.eircom.net/content/irelandcom/topstories/8095654?view=Eircomnet Irish Government challenges Data Retention Directive - but ignores privacy rights (7.07.2006) http://www.digitalrights.ie/2006/07/07/irish-government-challenges-data-ret… tion-directive-but-ignores-privacy-rights/ DRI challenge to Data Retention (29.07.2006) http://www.digitalrights.ie/2006/07/29/dri-challenge-to-data-retention/ State may face legal challenge over its access to phone data (29.07.2006) http://www.ireland.com/newspaper/front/2006/0729/1154075749923.html EDRI-gram : European parliament adopts data retention directive (18.01.2006) http://www.edri.org/edrigram/number4.1/dataretention (Contribution by TJ McIntyre, Digital Rights Ireland) ============================================================ 2. EU might fingerprint children even before 12 years old ============================================================ The report from the EU Council Presidency meeting of 26 June 2006 proposes that all children in the European Union should be mandatory fingerprinted if they are over 12 years old. "If provided for by national legislation" this action could be extended to all children, even below 12 years of age. The Council is putting under discussion fingerprints as compulsory for EU passports in order to prevent passport fraud. The decision will be taken in a secret meeting of a committee made of representatives of the 25 governments and chaired by the European Commission. The text proposed by the EU Council says that a member state can establish the age limit as low as they want and after 12, this process is mandatory. It will mean taking a biometric identifier from children at an "enrolment centre". The same document also proposes the "scanning of the facial image" from 0 to 12 of age with storage in a chip according to the national legislation and compulsory after 12, for EU passports. The scanning and storage on a "chip" means "digitising" the normal passport picture sent by post, not requiring the presence of the child. Reports say that small children are not suitable for "biometric face recognition by means of a photograph". The same issues are valid for fingerprints. The scientific studies have shown that below the age of 6, fingerprints are not developed enough for biometric capture. The UK, meanwhile, stated that it had encountered no special problems in collecting fingerprints from five-year-old asylum seekers. The tests were carried out at 2 asylum centres in London and Liverpool and were meant to prevent multiple registration for extra-benefits. The different approaches of the member states on this matter was highlighted also during the June meeting of the Visa Working Party. For instance, Germany stated that the national legislation was stipulating the age of 14 for biometric data for German nationals but was in favour of a differentiated approach and wished to go down to the age of 6 for visa applicants. The UK delegation said that storing facial image "(at any age)" was a security measure "even if it can not be used for facial recognition" and stated that it could go down to 5 years old for fingerprinting, based on the tests carried out in asylum centres. The Netherlands gave the age of 6 for taking fingerprints while Sweden also stated it could agree with the age of 6 for passports. According to Statewatch editor Tony Bunyan, the discussions in the EU related to the minimum age for fingerprinting are just related to technical possibilities and have nothing to do with whether this is right or wrong from the moral or political standpoint. He stated these decisions are made in secret meetings on the basis of secret documents, and do not take into consideration the opinions of people and parliaments. Also, that with this proposal, EU states will be given the freedom to fingerprint children from the day they are born provided they have the necessary technology for that. EU states will be free to fingerprint children from day one of their life as soon as it is technologically possible (07.2006) http://www.statewatch.org/news/2006/jul/08fingerprinting-children.htm Report from the EU Council Presidency meeting ( 26.07.2006) http://www.statewatch.org/news/2006/jul/9403-rev1-06.pdf Report from the Visa Working Party/Mixed Committee(13-14.06.2006) http://www.statewatch.org/news/2006/jul/10540-06.pdf Millions of children to be fingerprinted (30.07.2006) http://observer.guardian.co.uk/uk_news/story/0,,1833407,00.html Asylum toddlers get fingerprinted (15.05.2006) http://news.bbc.co.uk/1/hi/uk_politics/4773005.stm EDRI-gram : EU governments want 2 biometric identifiers for every citizen (3.11.2004) http://www.edri.org/edrigram/number2.21/biometrics ============================================================ 3. End of activities Bits of Freedom ============================================================ >From 1 September 2006 the Dutch NGO Bits of Freedom (BOF) will cease its activities. Since its establishment in 2000, Bits of Freedom has successfully defended digital civil rights, such as privacy on the Internet and online freedom of speech in the Netherlands. The board of Bits of Freedom doesn't see any possibilities to continue the activities now that the two employees (Maurice Wessling and Sjoera Nas) have both decided to leave. Another cause for the demise of the organisation is the continuing uncertainty about the finances. The foundation does not have any financial reserve and in spite of generous company sponsors and private donations, it was increasingly difficult to create a workable budget. The office in Amsterdam will be closed on 1 September and the organisation will not have employees any more. Legally, the foundation will not be dismantled, in order to allow the board to continue the annual presentation of the Big Brother Awards. Since its establishment, Bits of Freedom has advocated the upkeep of fundamental civil rights in the digital era. During the past 6 years both governments and companies have initiated many measures and activities that have endangered civil rights. Governments have extended their powers in many ways. In stead of dedicated investigations into the activities of people suspected of serious crimes, law enforcement authorities silently but massively revert to data-mining techniques to examine the daily behaviour of innocent citizens. This sets unwarranted and unprecedented limits to personal privacy. Necessity and effectiveness of many new legal measures have - unjustly - been left out of the debate. During the last six years, Bits of Freedom developed expertise on many topics, from the legal interception of telephony and internet communications to privacy & RFID. BOF also dedicated serious research to other topics such as spam, copyrights and internet notice and takedown. The organisation has fulfilled an important role as policy watchdog and has alerted a large audience on many new threats to civil rights. This was also made possible by collaborations with many other academic and consumer organisations, individual experts and sympathisers. Fundamental rights, especially privacy, are of the utmost importance. Bits of Freedom definitely does not cease its activities with a satisfied feeling of having accomplished the most important goals. To the contrary, a bottom-up civil rights movement in the Netherlands seems more necessary than ever. Bits of Freedom was one of the founders of European Digital Rights in 2002. The employees and board of Bits of Freedom wish EDRI success in its important future work. Bits of Freedom http://www.bof.nl/ (Contribution by Maurice Wessling - EDRi-member Bits of Freedom Netherlands) ============================================================ 4. Telecom Italia wiretapping scandal ============================================================ Telecom Italia, one of the major electronic communications providers in Italy is in the middle of a huge scandal regarding the illegal wiretapping and surveillance of the telephone networks. The journalists from the weekly L'Espresso have proven that an entire system called Radar was capable of recording sensitive information about millions of Italians. The system was discovered by the internal audit, but also by the Milan Prosecutors that have opened an investigation against Marco Mancini, the deputy director and director of the first "foreign" or counter-intelligence division SISMI (Military Intelligence and Security Service) and his friends Giuliano Tavaroli former director of security in Telecom Italia and Emanuele Cipriani, owner of the private investigation company Polis d'Istinto. Tavaroli, who occupied the key national position to which were passed all authorized requests by magistrates to make wiretaps, has recently resigned and is under investigation by the Milan Prosecutors for association in violating privacy. In the computers of another central figure of the scandal, Cipriani, the magistrates have found a huge archive of files regarding magistrates, political persons, football players and referees - all the major figures in the recent scandals in Italy. Apparently, wiretaps that could have been used to blackmail them were also found during the investigation. According to Telecom Italia's own investigation, their procedure and machines used for the legal wiretaps had a number of flaws and it was technically possible to spy on the telephone conversations, without leaving any trace. Moreover the interceptions were analysed with two special software programs: Enterprise Miner and Analyst's Notebook. An investigation was started also by the Italian Data Protection Commission (Garante per la protezione dei dati personali) to check if the personal data protection requirements have been observed. The situation has become much more complicated after the recent death of Adamo Bove, an investigation cop and a leading expert on electronic surveillance who apparently committed suicide by jumping from the highway. Bove had been hired by TIM to manage their Radar software system and had discovered a flaw in the system allowing people to enter the Telecom system without a trace. He announced the fact to the Milan magistrates, that has lead to the above-mentioned top-secret investigation. The telecom wiretapping scandal has shown that private companies and reporters in connection with SISMI were able to access information regarding Italian citizens, using the system in place for legal wiretapping. The man from the case "Thus they were spying for Telecom" speaks (only in Italian, 2.06.2006) http://www.repubblica.it/2006/05/sezioni/cronaca/spionaggio-calcio/parla-00… privato/parla-007-privato.html The suicide thriller, poisons and a too slow investigation (only in Italian, 24.07.2006) http://www.repubblica.it/2006/07/sezioni/cronaca/suicidio-bove/giallo-inchi… ta/giallo-inchiesta.html Telecom case - The Data Protection Authority makes a move (only in Italian, 29.05.2006) http://punto-informatico.it/p.aspx?id=1504309 Need for Enhanced Security Measures in Processing Telephone Traffic Data - Decision of 1 June 2006 - Italian Data Protection Authority (1.06.2006) http://www.garanteprivacy.it/garante/doc.jsp?ID=1303462 007 Operazione Corriere (only in Italian, 1.06.2006) http://espresso.repubblica.it/dettaglio/007%20Operazione%20Corriere/1300368… 0 ============================================================ 5. EU trying to push again biometrics on national ID cards ============================================================ According to a EU document presented by Statewatch in July 2006, The Visa Working Party on 13-14 June 2006 proposed another approach on the issue of the biometrics to be introduced on national ID cards. The issue had met resistance back in February when several members of the European Council have expressed doubts especially as Belgium and the Czech Republic opposed to the measures proposed by EU, without a public debate. In December 2005 the two governments gave a statement by which expressed their view that the introduction of biometrics into the ID national cards involved discussions of private life protection, financial and organizational issues, besides the technical aspect. The report of the meeting of the Visa Working party state that Council's Legal Service "confirmed that as there is no legal basis in the Treaty governing these issues that could, indeed, be the way to take this matter forward!", meaning the Council has no legal powers to introduce the biometrics for national ID cards and leaving this issue at the decision of each member state. The Conclusions of the Council, although non-binding, are however used to give legitimacy to the national measures thus paving the way for a "harmonized" approach when enough member states follow the standards. Biometrics and national ID cards back on the table (07.2006) http://www.statewatch.org/news/2006/jul/09eu-id-cards.htm Report from the Visa Working Party/Mixed Committee(13-14.06.2006) http://www.statewatch.org/news/2006/jul/10540-06.pdf Commission to resurrect biometric ID cards? (02.02.2006) http://www.statewatch.org/news/2006/feb/02com-Id-cards.htm ============================================================ 6. The French copyright law changed by the Constitutional Council ============================================================ The French Constitutional Council ruled on the most controversial copyright and related rights law, known as DADVSI law, concluding that some provisions of the law "violated the constitutional protections of property". The Council has considered as unconstitutional several provisions adopted by the French Parliament that were meant to balance the initial text which was too much in favour of the industry, thus making the law even stricter. One of the aspects considered by the Council as against the equality principle was the gradual system in the application of fines for making works available on P2P networks, which was ranging from 38 to 150 euros. Under the circumstances, the penalties remain at the level of 3 years of imprisonment and 300,000 euros in fines. "By eliminating the reduced penalties, the council put ordinary people sharing music back in the same league as criminal counterfeiters," said Jean-Baptist Soufron, legal director for the Association of Audionautes. Probably the most severe decision of the Council is related to provisions related to interoperability. Basically the Council considered the government did not define interoperability properly and withdrew interoperability from the DRM circumventions exceptions. This definitely pleased Apple. Dominique Menard, partner at the Lovells law firm and a specialist in intellectual property said: "The Constitutional Council has highlighted fundamental protections for intellectual property in such a way as to put iTunes a little further from risk of the French law." The Council changed also some of the provisions adopted by the French Parliament making the creators of file-sharing software and software that could interact with DRM-protected content to be sued by copyright holders, even if the "software is intended for non-copyrighted contents". The law, which is now stricter than the initial text, will be either promulgated and then published in the Official Journal after which it can enter into force or it can be resubmitted to the Parliament for further discussions. DADVSI : The Constitutional Council makes the law tougher ! (27.07.2006) http://www.ratiatum.com/news3414_DADVSI_Le_Conseil_Constitutionnel_aggrave_… _loi.html The DADVSI law validated and made stricter by the Constitutional Council (27.07.2006) http://www.pcinpact.com/actu/news/30385-La-loi-DADVSI-validee-en-partie-par… e-Conse.htm EDRI-gram : New French copyright law gives Apple satisfaction (5.06.2006) http://www.edri.org/edrigram/number4.13/frenchcopyright Parts of French "iPod law" ruled unconstitutional (29.07.2006) http://arstechnica.com/news.ars/post/20060729-7380.html ============================================================ 7. The Schengen Information System II delayed ============================================================ Scheduled to start operating in June 2006, the Schengen Information System II (SIS II) that would allow the competent authorities in the Member States to obtain information regarding certain categories of persons and property, will be delayed, as it resulted from a meeting of ministers of the interior and ministers of justice from EU member states in Brussels. The reasons given for the delay were related to legal and technical problems. Several European data protection commissioners who are supposed to approve of SIS II have shown resistance to the system considering there is not enough information of the way in which the collected data will be used by the police. The degree of access of the police to the biometric data included in the new passports has not yet been established. From the technical standpoint, the database system, initially to be set up in Strasbourg by Steria Mummert Consulting and HP Belgium, now undertaken by Unisys and Microsoft has not yet been completed as the data base is supposed to contain all exist and entry data, which is a very difficult task. The integration of the new EU members in the system in 2007 appeared as no longer realistic and the discussions are now whether to speed up the system or prepare it in stages. In the opinion of Bernhard Marfurt, the Swiss Ambassador for EU, developing SIS II in stages might make it technically obsolete. "SIS II must above all keep pace with technical developments," he said. At a first phase, this delay means that in 2007 travellers will still have to show their passports at the borders of EU with the new member states but effects are expected in the long run as well. Events like the European Soccer Championship in 2008 could determine Switzerland and Austria to take the same attitude Germany took during the latest Soccer World Cup meaning reintroducing their border controls during the event. The reintroduction of border controls at EU borders in Germany was mainly aimed at stopping potential criminals, especially violent football fans, from entering the country. Schengen Information System II will experience a delay (26.07.2006) http://www.heise.de/english/newsticker/news/75955 Germany to temporarily have checks at its borders for the Football World Cup (25.04.2006) http://www.heise.de/english/newsticker/news/72347 Schengen Information System http://europa.eu/scadplus/leg/en/lvb/l33183.htm EDRI-gram : EU Parliament Members want more privacy in SIS II (10.05.2006) http://www.edri.org/edrigram/number4.9/sisII ============================================================ 8.Recommended reading ============================================================ Report with a proposal for a European Parliament recommendation to the Council on the negotiations for an agreement with the United States of America on the use of passenger name records (PNR) data to prevent and combat terrorism and transnational crime, including organised crime. Prepared by Committee on Civil Liberties, Justice and Home Affairs Rapporteur: Sophia in 't Veld http://www.statewatch.org/news/2006/jul/ep-libe-eu-us-pnr-report.pdf ============================================================ 9.Agenda ============================================================ 2-4 August 2006, Bregenz, Austria 2nd International Workshop on Electronic Voting 2006 http://www.e-voting.cc/stories/1246056/ 3 August 2006 , Prague, Czech Republic Travellers privacy and EU - One day seminar organized by Iuridicum Remedium, providing a space for privacy experts to meet Czech officials to discuss passports, biometrics, RFID, PNR deal and other issues related to privacy risks possibly encountered by travellers in the EU. http://www.bigbrotherawards.cz/en/index.html 14 August 2006, London, UK Scrambling for Safety 8 Discussions on the two current Home Office RIPA consultations (on government access to decryption keys and the code of practice for government access to phone/Internet usage data). http://dooooooom.blogspot.com/2006/07/public-meeting-on-ripa-consultations.… ml 2-4 September 2006, Jerusalem, Israel NATO Advanced Research Workshop on Identity, Security and Democracy; Social, Ethical and Policy implications of Automated Systems for Human Identification organised by the Centre for Science, Society and Citizenship and the Israeli Center for the Study of Bioterrorism. http://www.biteproject.org 7-8 September 2006, Munich, Germany 1st Conference on Policy, Law and Economics of Intellectual Property - European Policy for Intellectual Property http://www.epip.eu/activities_conferences.php 14-16 September 2006, Berlin, Germany Wizards of OS 4 Information Freedom Rules http://wizards-of-os.org/ 14-15 September, Barcelona, Spain A New Open Europe: Public access to documents and data protection http://www.statewatch.org/news/2006/jul/open-europe.pdf =========================================================== 10. About =========================================================== EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 21 members from 14 European countries and 5 observers from 5 more countries (Italy, Ireland, Poland, Portugal and Slovenia). European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] [info] The NSA Is Building the Countrybs Biggest Spy Center (Watch What You Say)
by Marsh Ray 06 Jul '18

06 Jul '18

On 03/24/2012 01:28 AM, J.A. Terranson wrote: > > Ahhhhh... Probably not. Think Jim Bell et al. I suspect it is far more > likely that the vast majority of subscribers here are listed in the > Potentially Dangerous category, if not the flat out Budding Terrorist > label. Oh good grief. Do you even know how many subscribers this list has? If not, one shouldn't make such a statement without basis. The subscriber count wasn't public last I checked (today). Perhaps Jack Lloyd will tell us. My guess is the majority of subscribers hardly ever post. Of those who do, many are noted academics, professional engineers, industry executives, public speakers, and others of good repute. If you're looking for someplace to feel subversive around, this isn't it. Crypto is a mainstream engineering discipline these days, and one greatly needed by modern civilization. Can we kill this thread now please? - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-dev] Proposal: Internal Mapaddress for Tor Configuration Testing
by Mike Perry 06 Jul '18

06 Jul '18

Also at: https://gitweb.torproject.org/user/mikeperry/torspec.git/blob/mapaddress-ch… --------------------------------------------------------------- Title: Internal Mapaddress for Tor Configuration Testing Author: Mike Perry Created: 08-10-2012 Status: Open Target: 0.2.4.x+ Overview This proposal describes a method by which we can replace the https://check.torproject.org/ testing service with an internal XML document provided by the Tor client. Motivation The Tor Check service is a central point of failure in terms of Tor usability. If it is ever out of sync with the set of exit nodes on the Tor network or down, user experience is degraded considerably. Moreover, the check itself is very time-consuming. Users must wait seconds or more for the result to come back. Worse still, if the user's software *was* in fact misconfigured, the check.torproject.org DNS resolution and request leaks out on to the network. Design Overview The system will have three parts: an internal hard-coded IP address mapping (127.84.111.114:80), a hard-coded mapaddress to a DNS name (selftest.torproject.org:80), and a DirPortFrontPage-style simple HTTP server that serves an XML document for both addresses. Upon receipt of a request to the IP address mapping, the system will create a new 128 bit randomly generated nonce and provide it in the XML document. Requests to http://selftest.torproject.org/ must include a valid, recent nonce as the GET url path. Upon receipt of a valid nonce, it is removed from the list of valid nonces. Nonces are only valid for 60 seconds or until SIGNAL NEWNYM, which ever comes first. The list of pending nonces should not be allowed to grow beyond 10 entries. The timeout period and nonce limit should be configurable in torrc. Design: XML document format for http://127.84.111.114 To avoid the need to localize the message in Tor, Tor will only provide a XML object with connectivity information. Here is an example form: <tor-test> <tor-bootstrap-percent>100</tor-bootstrap-percent> <tor-version-current>true</tor-version-current> <dns-nonce>4977eb4842c7c59fa5b830ac4da896d9</dns-nonce> <tor-test/> The tor-bootstrap-percent field represents the results of the Tor client bootstrap status as integer percentages from bootstrap_status_t. The tor-version-current field represents the results of the Tor client consensus version check. If the bootstrap process has not yet downloaded a consensus document, this field will have the value null. The dns-nonce field contains a 128-bit secret, encoded in base16. This field is only present for requests that list the Host: header as 127.84.111.114. Design: XML document format for http://selftest.torproject.org/nonce <tor-test> <tor-bootstrap-percent>100</tor-bootstrap-percent> <tor-version-current>true</tor-version-current> <dns-nonce-valid>true</dns-nonce-valid> <tor-test/> The first two fields are the same as for the IP address version. The dns-nonce-valid field is only true if the Host header matches selftest.torproject.org and the nonce is current and valid. Upon receipt of a valid nonce, that nonce is removed from the list of valid nonces. Design: Request Servicing Care must be taken with the dns-nonce generation and usage, to prevent users from being tracked through leakage of nonce value to application content. While the usage of XML appears to make this impossible due to stricter same-origin policy enforcement than JSON, same-origin enforcement is still fraught with exceptions and loopholes. In particular: Any requests that contain the Origin: header MUST be ignored, as the Origin: header is only included for third party web content (CORS). dns-nonce fields MUST be omitted if the HTTP Host: header does not match the IP address 127.84.111.114. Requests to selftest.torproject.org MUST return false for the dns-nonce-valid field if the HTTP Host: header does not match selftest.torproject.org, regardless of nonce value. Further, requests to selftest.torproject.org MUST validate that 'selftest.torproject.org' was the actual hostname provided to SOCKS4A, and not some alternate address mapping (due to DNS rebinding attacks, for example). Design: Application Usage Applications will use the system in two steps. First, they will make an HTTP request to http://127.84.111.114:80/ over Tor's SOCKS port and parse the resulting XML, if any. If the request at this stage fails, the application should inform the user that either their Tor client is too old, or that it is misconfigured, depending upon the nature of the failure. If the request succeeds and valid XML is returned, the application will record the value of the dns-nonce field, and then perform a second request to http://selftest.torproject.org/nonce_value. If the second request succeeds, and the dns-nonce-valid field is true, the application may inform the user that their Tor settings are valid. If the second request fails, or does not provide the correct dns-nonce, the application will inform the user that their Tor DNS proxy settings are incorrect. If either tor-bootstrap-percent is not 100, or tor-version-current is false, applications may choose to inform the user of these facts using properly localized strings and appropriate UI. Security Considerations XML was chosen over JSON due to the risks of the identifier leaking in a way that could enable websites to track the user[1]. Because there are many exceptions and circumvention techniques to the same-origin policy, we have also opted for strict controls on dns-nonce lifetimes and usage, as well as validation of the Host header and SOCKS4A request hostnames. 1. http://www.hpenterprisesecurity.com/vulncat/en/vulncat/dotnet/javascript_hi… -- Mike Perry _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: UK RIPA Pt 3
by Florian Weimer 06 Jul '18

06 Jul '18

* Peter Fairbrother: > I forgot to mention that Pt.3 also includes coercive demands for > access keys - so for instance if Mr Bill Gates came to the UK, and if > there was some existing question about Microsoft's behaviour in some > perhaps current EU legal matter, Mr Gates could be required to give up > the keys to the Microsoft internal US servers. Or go to jail. Well, if Mr Gates is a witness and not a suspect, such coercive measures are well within the legal framework of most countries. As a witness, you must testify. It simply does not matter if the information you are asked to provide is encrypted, or is stored in a database and needs significant preprocessing to obtain. It would be quite surprising if this was any different in the UK. So it's purely the self-incrimination part that is questionable from a legal POV. I think this bears repeating because we face a similar discussion in Germany regarding covert data seizure using technological measures, and the discussion focuses almost entirely on the technological measures. But the legal obstacle is just the covertness. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: UK RIPA Pt 3
by Florian Weimer 06 Jul '18

06 Jul '18

* Peter Fairbrother: > I forgot to mention that Pt.3 also includes coercive demands for > access keys - so for instance if Mr Bill Gates came to the UK, and if > there was some existing question about Microsoft's behaviour in some > perhaps current EU legal matter, Mr Gates could be required to give up > the keys to the Microsoft internal US servers. Or go to jail. Well, if Mr Gates is a witness and not a suspect, such coercive measures are well within the legal framework of most countries. As a witness, you must testify. It simply does not matter if the information you are asked to provide is encrypted, or is stored in a database and needs significant preprocessing to obtain. It would be quite surprising if this was any different in the UK. So it's purely the self-incrimination part that is questionable from a legal POV. I think this bears repeating because we face a similar discussion in Germany regarding covert data seizure using technological measures, and the discussion focuses almost entirely on the technological measures. But the legal obstacle is just the covertness. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [drone-list] drone-list Digest, Vol 28, Issue 2
by Chris Csikszentmihalyi 06 Jul '18

06 Jul '18

Amie, In case you haven't seen them, there are many companies making land drones bristling with guns. For instance, Foster-Miller: http://en.wikipedia.org/wiki/Foster-Miller_TALON Do an image search for SWORDS; their business model seems to be to put every kind of gun they can think of on the platform. iRobot and others have similar initiatives. Future coastal RNCs will also doubtlessly deploy USVs: http://www.youtube.com/watch?v=oBW2mSpEyi0 That said, as the Tampa Trib has learned, there is often a great distance between demo videos, press releases, and a weaponized drone-in-the-wild. F-M and iRobot are "respectable" Route 128 businesses, though, with military contracts, so they are worth following. C. _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0