July 2018 - cypherpunks-legacy

Re: [serval-project-dev] Re: Adding GPS location to IPv6 header
by Jeremy Lakeman 06 Jul '18

06 Jul '18

Allocate an IPv6 private network range using a scheme like this; http://tools.ietf.org/html/draft-hain-ipv6-geo-addr-01 Probably with around 36 bits (100m) of precision, leaving the rest of the /64 to flag that it's private and geographically based. Internet gateways have their own "real" /64. Internet traffic would be routed to the correct gateway based on the network of the source address. If each device uses the same 64bit host id on each network. Local mesh route calculations can be based on a single main address per device, with an additional routing entry added for each network we believe that host should have. A protocol like SCTP will also allow both parties to change networks without needing to re-establish links. Then the biggest scalability problem for routing packets world-wide to an individual is a directory service for publishing and resolving current network locations. On Tue, Nov 27, 2012 at 9:40 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > ----- Forwarded message from George Herbert <george.herbert(a)gmail.com> ----- > > From: George Herbert <george.herbert(a)gmail.com> > Date: Mon, 26 Nov 2012 14:51:57 -0800 > To: William Herrin <bill(a)herrin.us> > Cc: Eugen Leitl <eugen(a)leitl.org>, nanog(a)nanog.org > Subject: Re: Adding GPS location to IPv6 header > > The utility of this is somewhat moderated by limited geographical > mobility while a phone's active in a single session. One rarely > drives from San Francisco to LA typing all the way on their smartphone > data connection, for example. > > To the extent that you may apply IP ranges to wider geographical > areas, and limit the search space to a few % of the total, beyond > which devices get a new address pushed as they travel, this is > entirely manageable without the new header. > > Some services dislike the endpoint renumbering like that, and some > connections go kerfluey, but most web based activities handle the > endpoint getting a new IP just fine; this is what cookies are for. > Your SSH connections will remind you that you should be using screen, > or not type and drive. But the CHP and road hazards will already do > that. > > Eventually being allowed to use air-to-ground cell data on airliners > will be slightly worse, but again, most protocols shrug at this > problem. > > > -george > > On Mon, Nov 26, 2012 at 2:36 PM, William Herrin <bill(a)herrin.us> wrote: >> On Mon, Nov 26, 2012 at 10:20 AM, Eugen Leitl <eugen(a)leitl.org> wrote: >>> On Mon, Nov 26, 2012 at 12:56:52PM -0200, Carlos M. Martinez wrote: >>>> Just for redundancy's sake: No, L3 is **not** the place for this kind of >>>> information. L3 is supposed to be simple, easy to implement, fast to >>> >>> I agree. You need to put it into L2, and the core usage would >>> be for wireless meshes. Consider cases like Serval or cjdns, >>> which run on Android headsets and equivalent embeddeds. >>> Technically you wouldn't need GPS everywhere if you could >>> do ~m scale time domain reflectometry in free space. >>> It is possible to build a local contiguous map via >>> mutual time of flight triangulation (actually, just visibility >>> gives you a very good hint). >> >> Actually, I think you just articulated the first use for Ammar's idea >> that's not either wrong, absurd on its face or obviously better >> handled at a different location within the protocol stack. >> >> Suppose you have a large single-owner mesh network, such as a folks >> walking around with cell phones. If you want them to have a stable >> layer 3 address (and you do) then you're handling what amounts to /128 >> routes for tens of millions of devices. If you can guarantee that any >> packet *to* that address also contains a rough geographic location >> then you can discard any routes internally once they're more than a >> short geographic distance from the origin and route on the geography >> until you're close enough to find a specific /128 route. Tens of >> millions of routes is no problem if no single router needs to know >> more than a few thousand of them. >> >> By putting geographic location at layer 3, you're also handling it end >> to end which means you don't need a stateful border device to track >> the current location of all of those /128 routes. The device itself >> doesn't need to add location if it doesn't have the data; it's good >> enough for the receiving tower to attach a rough location. >> >> There are some assumptions in this model which are problematic. Key ones are: >> >> 1. Only valid as an interior gateway protocol (IGP). Geographic >> routing has been proven false for an EGP because it induces traffic to >> cross links for which neither source nor destination has permitted >> access. >> >> 2. Requires the application at the landed end to copy the IP option >> information into the outbound packets as well. This behavior is not >> presently guaranteed. >> >> 3. Assumes that the device will originate communication, receiving >> only replies from the landed end, or will use some intermediary to >> communicate current geographic information if inbound origination is >> required. >> >> >> At any rate, I think that discussion of adding a geographic option >> header to IPv6 should be tied up in the discussion of a routing >> protocol which critically depends on its presence and can't reasonably >> be built another way. Otherwise when a needful use case finally comes >> along, you'll discover that the option's rules of operation don't >> adequately enable it. >> >> Regards, >> Bill Herrin >> >> >> >> -- >> William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us >> 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> >> Falls Church, VA 22042-3004 >> > > > > -- > -george william herbert > george.herbert(a)gmail.com > > ----- End forwarded message ----- > -- > Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org > ______________________________________________________________ > ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org > 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE > > -- > You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. > To post to this group, send email to serval-project-developers(a)googlegroups.com. > To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. > For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. > -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Mexico's most vulnerable reporters lack digital security skills
by Nadim Kobeissi 06 Jul '18

06 Jul '18

That's incredible. I honestly did not know any of this. Drug lords in the Middle East aren't half as terrifying. With this kind of terrifying landscape, what accessible technology could possibly secure the communications of Mexican journalists against not only interception, but against their own future torture and other such ancillary, surrounding threats that may be borne from using encryption? This situation is so awful that we security people should add it to our repertoire of absolutes ("will this survive NSA intervention?" "will this survive Mexican drug cartel intervention?") They really add to the threat landscape by being not only more unbridled and omnipotent than a bad regime, but not even subject to the smallest shred of responsibility in terms of governance and stability. Even the worst governments still are. I don't know what on earth Mexican journalists are supposed to do when confronted with such an absurd threat landscape. NK On Wed, Feb 27, 2013 at 1:42 AM, Ryan Gallagher <ryan(a)rjgallagher.co.uk>wrote: > On 27 February 2013 00:01, Eva Galperin <eva(a)eff.org> wrote: > >> I'm not sure that I would support ranking drug cartels as a less >> technologically sophisticated threat than the government in Mexico. >> > > Very much agree, Eva. If I were working out of Mexico it would be under > the assumption that the cartels could, if they really wanted to, obtain the > same info that is available to law enforcement agencies and/or government > officials via the use of surveillance tech. > > Mexico has a fairly sophisticated surveillance infrastructure. Since at > least 2006 it has has apparently operated a Verint mass monitoring system > that can intercept "virtually any wired, wireless or broadband > communication network and service," and this system has since been upgraded > with the help of the US government: > http://www.nextgov.com/technology-news/2012/04/state-department-provide-mex… > > Mexican authorities also have access to other tools, such as spy trojans: > http://www.slate.com/blogs/future_tense/2012/08/03/surveillance_technology_… > > And as Bloomberg Businessweek reported in 2011: "Recent killings indicate > the cartels are taking the new online tactics seriouslyband that the > activists may have miscalculated in counting on nicknames and IP addresses > for protection....the U.S. firm Stratfor and security experts in Mexico > warned that, with so many government officials on the take, the cartels > likely have access to the military-grade tracking technology used by the > Mexican government. In at least one case, according to journalist Valdez, > the Sinaloan cartel hired a hacker to hunt down a government informant." > http://www.businessweek.com/magazine/mexicos-drug-war-takes-to-the-blogosph… > > Best, > > Ryan > > >> While there isn't a lot of evidence that drug cartels have used >> technologically sophisticated means to track down anonymous/pseudonymous >> bloggers and journalists, corruption is sufficiently widespread that if >> my life depended on it, I would assume that the drug cartels could have >> access to the same information that the government has through bribery >> and threats. >> >> There are circumstances in which I would support the use of Cryptocat by >> Mexican journalists (and it's certainly an improvement over sending >> messages in the clear, which many Mexican journalists are doing) but >> transmitting information which you would like to keep secret from drug >> cartels is probably not one of them. >> >> ************************************************ >> Eva Galperin >> Global Policy Analyst >> Electronic Frontier Foundation >> eva(a)eff.org >> (415) 436-9333 ex. 111 >> ************************************************ >> >> On 2/25/13 1:36 PM, Nadim Kobeissi wrote: >> > Hi, >> > At Cryptocat we are developing an easy to use instant messaging tool >> that >> > is available in 34 languages. It encrypts all of your conversations, >> > preserves your privacy and works in your browser. >> > >> > If you are a Mexican journalist and your opponent is not highly skilled >> in >> > information technology intelligence (not a government, but a drug >> cartel) >> > then you should try Cryptocat. It does not leave a record of >> conversations >> > anywhere and does not transmit anything in the clear. >> > >> > Get Cryptocat here: https://crypto.cat >> > Make sure to read the warnings on the site to get familiar with the >> app's >> > limitations. >> > >> > >> > NK >> > >> > >> > On Mon, Feb 25, 2013 at 10:13 PM, Brian Conley < >> brianc(a)smallworldnews.tv>wrote: >> > >> >> Hi Kyle, >> >> >> >> I've been developing a tool called StoryMaker for journalists and >> citizen >> >> journalists. >> >> >> >> It's private/secure by design, so ideal for this use case. >> >> >> >> There is a 10 lesson curriculum in mobile digital safety, and the app >> >> itself that could all be translated into Spanish. Then perhaps the app >> >> and/or curriculum might be used to educate and assist them in their >> work? >> >> >> >> https://www.transifex.com/projects/p/storymaker/language/es/ >> >> >> >> Resources 20-29 + 210 are the digital safety lessons. >> >> >> >> cheers >> >> >> >> brian >> >> >> >> On Mon, Feb 25, 2013 at 1:04 PM, Kyle Maxwell <krmaxwell(a)gmail.com> >> wrote: >> >> >> >>> I'm curious how the infosec community, particularly those of us who >> >>> speak and write Spanish, can assist in helping Mexican activists and >> >>> journalists. I understand that a large portion of that community >> >>> actively exchanges data on Twitter; any pointers would be appreciated. >> >>> >> >>> Feel free to contact me off-list if desired. >> >>> >> >>> On Mon, Feb 25, 2013 at 1:02 PM, G.W. Schulz <gwschulz30(a)gmail.com> >> >>> wrote: >> >>>>> "Most Mexican journalists and bloggers reporting on highly sensitive >> >>>>> topics (such as crime, corruption, violence and human rights issues) >> >>> do not >> >>>>> fully understand the risks and threats they face when they use >> digital >> >>> and >> >>>>> mobile technology, even though the topics they cover make them even >> >>> more >> >>>>> vulnerable, a new survey by Freedom House and the International >> Center >> >>> for >> >>>>> Journalists finds." >> >>>> >> >>>> >> >>>> >> >>> >> http://ijnet.org/stories/mexicos-most-vulnerable-reporters-lack-digital-sec… >> >>> >> >>> >> >>> -- >> >>> Kyle Maxwell [krmaxwell(a)gmail.com] >> >>> http://www.xwell.org >> >>> Twitter: @kylemaxwell >> >>> -- >> >>> Unsubscribe, change to digest, or change password at: >> >>> https://mailman.stanford.edu/mailman/listinfo/liberationtech >> >>> >> >> >> >> >> >> >> >> -- >> >> >> >> >> >> >> >> Brian Conley >> >> >> >> Director, Small World News >> >> >> >> http://smallworldnews.tv >> >> >> >> m: 646.285.2046 >> >> >> >> Skype: brianjoelconley >> >> >> >> >> >> >> >> -- >> >> Unsubscribe, change to digest, or change password at: >> >> https://mailman.stanford.edu/mailman/listinfo/liberationtech >> >> >> > >> > >> > >> > -- >> > Unsubscribe, change to digest, or change password at: >> https://mailman.stanford.edu/mailman/listinfo/liberationtech >> -- >> Too many emails? Unsubscribe, change to digest, or change password by >> emailing moderator at companys(a)stanford.edu or changing your settings at >> https://mailman.stanford.edu/mailman/listinfo/liberationtech >> > > > -- > Too many emails? Unsubscribe, change to digest, or change password by > emailing moderator at companys(a)stanford.edu or changing your settings at > https://mailman.stanford.edu/mailman/listinfo/liberationtech > -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

2008: The year of hack the vote?
by ' =JeffH ' 06 Jul '18

06 Jul '18

2008: The year of hack the vote? http://blogs.zdnet.com/security/?p=753 December 17th, 2007 Posted by Larry Dignan @ 2:12 am The state of Ohio has released a comprehensive study of voting machine security and the report will have you longing for paper. A 334-page PDF report http://www.sos.state.oh.us/sos/info/EVEREST/14-AcademicFinalEVERESTReport.p… from the Ohio Secretary of State reveals insufficient security, poor implementation of security technology, lax auditing and shoddy software maintenance. The report, which covers voting systems from Election Systems and Software (ES&S), Hart InterCivic and Premier Election Solutions formerly known as Diebold, was conducted by Ohio\u2019s EVEREST (Evaluation and Validation of Election-Related Equipment, Standards and Testing) initiative in conjunction with research teams from Penn State, University of Pennsylvania and WebWise Security. The EVEREST report was released Dec. 7 and I found it via Slashdot. Overall, the report really raises questions about election systems. Buffer overflows, leaky encryption, audit problems and firmware issues abound. One machine, the M100, from ES&S accepts counterfeit ballots. The Premier AV-TSX allows an unauthenticated user to read or tamper with its memory. The Hart EMS has audit logs that can be erased. In fact, the first 17 pages of the report\u2013essentially the table of contents\u2013is an indictment of these systems. To make matters worse, these machines don\u2019t run constantly. That means malicious software could be planted and not turn up until election time. These machines aren\u2019t patched regularly either. The report is too massive to detail completely here, but at a high level here are the takeaways from the EVEREST report: * Systems uniformly stunk at security and \u201cfailed to adequately address important threats against election data and processes.\u201d * A root cause of these security failures was \u201cpervasive mis-application of security technology.\u201d Standard practices for cryptography, key and password management and security hardware go ignored. * Auditing capabilities are a no show. \u201cIn all systems, the logs of election practices were commonly forgeable or erasable by the principals who they were intended to be monitoring.\u201d Translation: If there\u2019s an attack the lack of auditing means you can\u2019t isolate or recover from the problem. * Software maintenance practices \u201cof the studied systems are deeply flawed.\u201d The EVEREST report calls the election software \u201cfragile.\u201d Why would these machines be so enticing as a target? You could swing an entire election, produce incorrect results, block groups of voters, cast doubt on an election or delay results. And it may not take a brain surgeon to alter these systems. The EVEREST teams reported that they were able to subvert every voting system and not be detected \u201cwithin a few weeks.\u201d Meanwhile, the EVEREST teams found the issues with only limited access since vendors weren\u2019t exactly cooperative (Section 2.4 of the PDF has the details). The researchers say: Any argument that suggests that the attacker will somehow be less capable or knowledgeable than the reviewer teams, or that they will not be able to reverse engineer the systems to expose security flaws is not grounded in fact. As for the attackers, EVEREST ranks the following folks in ascending order of capabilities: * Outsiders have no special access to voting equipment, but could affect equipment to an extent that it is connected to the Internet. All of the systems reviewed run Microsoft Windows and occasionally connect to the Internet. In addition, an attacker could create a counterfeit upgrade disk and mail it to install malware. * Voters have limited and partially supervised access to voting systems while casting a vote. * Poll workers have extensive access to polling place equipment, management terminals before, during and after voting. They can authorize who votes and who doesn\u2019t and opportunities to tamper with equipment abound. * Election officials have extensive access to back-end election systems and voting equipment. Access is only loosely supervised if at all. One possibility: Bad software prompts election officials to \u201ccorrect\u201d results. * Vendor employees have access to the hardware and source code of system during development. Employees may also be on site to assist workers and election officials. \u201cSome vendors use third-party maintenance and election day support whose employees are not tightly regulated,\u201d according to EVEREST. Add it up and any hack the vote opportunities will most likely be an inside job of some sort. The attacks may or may not be detectable. --- end --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

2008: The year of hack the vote?
by ' =JeffH ' 06 Jul '18

06 Jul '18

2008: The year of hack the vote? http://blogs.zdnet.com/security/?p=753 December 17th, 2007 Posted by Larry Dignan @ 2:12 am The state of Ohio has released a comprehensive study of voting machine security and the report will have you longing for paper. A 334-page PDF report http://www.sos.state.oh.us/sos/info/EVEREST/14-AcademicFinalEVERESTReport.p… from the Ohio Secretary of State reveals insufficient security, poor implementation of security technology, lax auditing and shoddy software maintenance. The report, which covers voting systems from Election Systems and Software (ES&S), Hart InterCivic and Premier Election Solutions formerly known as Diebold, was conducted by Ohio\u2019s EVEREST (Evaluation and Validation of Election-Related Equipment, Standards and Testing) initiative in conjunction with research teams from Penn State, University of Pennsylvania and WebWise Security. The EVEREST report was released Dec. 7 and I found it via Slashdot. Overall, the report really raises questions about election systems. Buffer overflows, leaky encryption, audit problems and firmware issues abound. One machine, the M100, from ES&S accepts counterfeit ballots. The Premier AV-TSX allows an unauthenticated user to read or tamper with its memory. The Hart EMS has audit logs that can be erased. In fact, the first 17 pages of the report\u2013essentially the table of contents\u2013is an indictment of these systems. To make matters worse, these machines don\u2019t run constantly. That means malicious software could be planted and not turn up until election time. These machines aren\u2019t patched regularly either. The report is too massive to detail completely here, but at a high level here are the takeaways from the EVEREST report: * Systems uniformly stunk at security and \u201cfailed to adequately address important threats against election data and processes.\u201d * A root cause of these security failures was \u201cpervasive mis-application of security technology.\u201d Standard practices for cryptography, key and password management and security hardware go ignored. * Auditing capabilities are a no show. \u201cIn all systems, the logs of election practices were commonly forgeable or erasable by the principals who they were intended to be monitoring.\u201d Translation: If there\u2019s an attack the lack of auditing means you can\u2019t isolate or recover from the problem. * Software maintenance practices \u201cof the studied systems are deeply flawed.\u201d The EVEREST report calls the election software \u201cfragile.\u201d Why would these machines be so enticing as a target? You could swing an entire election, produce incorrect results, block groups of voters, cast doubt on an election or delay results. And it may not take a brain surgeon to alter these systems. The EVEREST teams reported that they were able to subvert every voting system and not be detected \u201cwithin a few weeks.\u201d Meanwhile, the EVEREST teams found the issues with only limited access since vendors weren\u2019t exactly cooperative (Section 2.4 of the PDF has the details). The researchers say: Any argument that suggests that the attacker will somehow be less capable or knowledgeable than the reviewer teams, or that they will not be able to reverse engineer the systems to expose security flaws is not grounded in fact. As for the attackers, EVEREST ranks the following folks in ascending order of capabilities: * Outsiders have no special access to voting equipment, but could affect equipment to an extent that it is connected to the Internet. All of the systems reviewed run Microsoft Windows and occasionally connect to the Internet. In addition, an attacker could create a counterfeit upgrade disk and mail it to install malware. * Voters have limited and partially supervised access to voting systems while casting a vote. * Poll workers have extensive access to polling place equipment, management terminals before, during and after voting. They can authorize who votes and who doesn\u2019t and opportunities to tamper with equipment abound. * Election officials have extensive access to back-end election systems and voting equipment. Access is only loosely supervised if at all. One possibility: Bad software prompts election officials to \u201ccorrect\u201d results. * Vendor employees have access to the hardware and source code of system during development. Employees may also be on site to assist workers and election officials. \u201cSome vendors use third-party maintenance and election day support whose employees are not tightly regulated,\u201d according to EVEREST. Add it up and any hack the vote opportunities will most likely be an inside job of some sort. The attacks may or may not be detectable. --- end --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Judge dismisses John Gilmore's ID-required lawsuit [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

<x-flowed> GILMORE v. ASHCROFT JOHN GILMORE, Plaintiff, v. JOHN ASHCROFT, in his official capacity as Attorney General of the United States; ROBERT MUELLER, in his official capacity as Director of the Federal Bureau of Investigation; NORMAN MINETA, in his official capacity as Secretary of Transportation; MARION C. BLAKEY, as Administrator of the Federal Aviation Administration; Admiral JAMES M. LOY, in his official capacity as Acting Undersecretary of Transportation for Security; TOM RIDGE, in his official capacity as Chief of the Office of Homeland Security; UAL CORPORATION, aka UNITED AIRLINES; and DOES I-XXX, Defendants. No. C 02-3444 SI UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA March 19, 2004, Decided March 23, 2004, Filed ... Defendants have moved to dismiss plaintiff's complaint for failure to state a claim upon which relief can be granted. Having carefully considered the arguments of the parties and the papers submitted, the Court GRANTS the motions to dismiss n1 and DENIES plaintiff's request for judicial notice. ... BACKGROUND Plaintiff John Gilmore is a California resident who is suing the United States n2 and Southwest Airlines for refusing to allow him to board an airplane on July 4, 2002 without either displaying a government-issued identification consenting to a search. Plaintiff alleges that these security requirements imposed by the United States government and effected by the airline companies violate several of his constitutional rights, including his rights under the First and Fourth Amendments. n3 ... LEGAL STANDARD The Court may dismiss a complaint when it is not based on a cognizable legal theory or pleads insufficient facts to support a cognizable legal claim. Smilecare Dental Group v. Delta Dental Plan, 88 F.3d 780, 783 (9th Cir. 1996). DISCUSSION Plaintiff's complaint alleges that as a result of the requirement that passengers traveling on planes show identification and his unwillingness to comply with this requirement, he has been unable to travel by air since September 11, 2001. Plaintiff's complaint asserts causes of action challenging the apparent government policy that requires travelers either to show identification or to consent to a search which involves wanding, walking through a magnetometer or a light pat-down. Whether this is actually the government's policy is unclear, as the policy, if it exists, is unpublished. However, this Court for the purpose [*6] of evaluating plaintiff's complaint, assumes such a policy does exist, and reviews plaintiff's complaint accordingly. Plaintiff asserts the unconstitutionality of this policy on the following grounds: vagueness in violation of the Due Process Clause; violation of the right to be free from unreasonable searches and seizures; violation of the right to freedom of association; and violation of the right to petition the government for redress of grievances. The federal defendants and airline defendant both brought motions to dismiss. As plaintiffs' claims are common to both sets of defendants, this Court treats them collectively. While there are questions about the private defendant's liability as a state actor and about the federal defendants' liability for the private defendant's actions, as this Court has not found plaintiff's complaint to have alleged a constitutional violation, those issues need not be addressed at this time. ... 1. Standing As a preliminary matter, the federal defendants have objected to all of plaintiff's claims other than plaintiff's challenges to the identification requirement. It is unclear from plaintiff's complaint whether he intended to plead any [*7] other claims, but he did allude to the "government's plan to create huge, integrated databases by mingling criminal histories with credit records, previous travel history and much more, in order to create dossiers on every traveling citizen," including creation of "no fly" watchlists. Complaint, P8. He pointed to newspaper and magazine articles and internet websites describing various activities and directives issued by various federal agencies, including the increased use of the Consumer Assisted Passenger Prescreening System ("CAPPS") in the wake of the terrorist attacks on September 11, 2001. Complaint, PP35-50. The federal defendants argue that "as a threshold matter, plaintiff has standing in this action solely insofar as he challenges an alleged federally-imposed requirement that airlines request identification as part of the screening process at airports. The complaint is devoid of any allegation that plaintiff personally has suffered any injury that is fairly traceable to any other practice, procedure, or criterion that may be used by any defendant in screening airline passengers for weapons and explosives." Motion to Dismiss at 2:21-25. ... Accordingly, to the extent that plaintiff pleads causes of action beyond those stemming from the identification requirement, those causes of action are DISMISSED for lack of standing or jurisdiction. 2. Plaintiff's First Cause of Action: violation of the Due Process Clause Plaintiff alleges that the identification requirement is "unconstitutionally vague in violation of the Due Process Clause of the Fifth Amendment because it is vague, being unpublished, and thus provides no way for ordinary people or reviewing courts to conclusively determine what is legal." Complaint, P52. This claim directly attacks the policy, regulation, order or directive requiring production of identification at airports. In this case, the federal defendants refuse to [*10] concede whether a written order or directive requiring identification exists, or if it does, who issued it or what it says. They contend, however, that to the extent this action challenges an order issued by the TSA or the FAA, 49 U.S.C. ' 46110(a) vests exclusive jurisdiction in the Courts of Appeals to decide the challenge. ... Because this claim squarely attacks the orders or regulations issued by the TSA and/or the FAA with respect to airport security, this Court does not have jurisdiction to hear the challenge. As a corollary, without having been provided a copy of this unpublished statute or regulation, if it exists, the Court is unable to conduct any meaningful inquiry as to the merits of plaintiff's vagueness argument. This argument would better be addressed to the Ninth Circuit Court of Appeals or to the Court of Appeals for the District of Columbia Circuit, both of which have jurisdiction to review these matters. 3. Plaintiff's Second Cause of Action: violation of the Fourth Amendment right to be free from unreasonable searches and seizures ... In plaintiffs' case, he was not required to provide identification on pain of criminal or other governmental sanction. Identification requests unaccompanied by detention, arrest, or any other penalty, other than the significant inconvenience of being unable to fly, do not amount to a seizure within the meaning of the Fourth Amendment. Plaintiff has not suggested that he felt that he was not free to leave when he was asked to produce [*15] identification. None of the facts submitted by plaintiff suggests that the request for identification implicated plaintiff's Fourth Amendment rights. Therefore, plaintiff's claim that the identification requirement is unreasonable does not raise a legal dispute that this Court must decide. ... 3. Plaintiff's Third and Fourth Causes of Action: violation of the right to travel protected by the Due Process Clause ... However, plaintiff's allegation that his right to travel has been violated is insufficient as a matter of law because the Constitution does not guarantee the right to travel by any particular form of transportation. Miller v. Reed, 176 F.3d 1202, 1205 (9th Cir. 1999) ("Burdens on a single mode of transportation do not implicate the right to interstate travel."); Monarch Travel Serv. Assoc. Cultural Clubs, Inc., 466 F.2d 55 2(9th Cir. 1972). The right to travel throughout the United States confers a right to be "uninhibited by statutes, rules and regulations which unreasonably burden or restrict this movement." Saenz v. Roe, 526 U.S. 486, 499 (9th Cir. 1973). This Court rejects plaintiff's argument that the request [*20] that plaintiff either submit to search, present identification, or presumably use another mode of transport, is a violation of plaintiff's constitutional right to travel. ... 4. Plaintiff's Fourth Cause of Action: violation of the right to freedom of association protected by the First and Fifth Amendments Plaintiff's allegation that his right to associate freely was violated fails because the only actions which violate this right are those which are "direct and substantial or significant." Storm v. Town of Woodstock, 944 F. Supp. 139, 144 (N.D. N.Y. 1996). Government action which only indirectly affects associational rights is not sufficient to state a claim for violation of the freedom to associate. To the extent that plaintiff alleged plans to exercise his associational rights in Washington, D.C., the Court finds that plaintiff's rights were not violated as plaintiff had numerous other methods of reaching Washington. ... For the foregoing reasons, plaintiff's complaint is dismissed. Plaintiff's claims against the federal defendants and Southwest Airlines are dismissed with prejudice; plaintiff's claims against United Airlines are dismissed without prejudice. Plaintiff's request for judicial notice is denied. [Docket ## 6, 8, 10, 22, 28]. IT IS SO ORDERED. Dated: March 19, 2004 SUSAN ILLSTON United States District Judge _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) </x-flowed> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] The Son of TIA
by Dave Farber 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------- Original Message -------- Subject: for IP? Date: Fri, 10 Feb 2006 16:42:14 -0700 From: Bob Devine <devinebob(a)gmail.com> To: dave(a)farber.net In its latest issue, Newsweek describes the Son of TIA. You *just* knew that the Pentagon wouldn't really kill TIA... One paragraph from the article: "Yet today, very quietly, the core of TIA survives with a new codename of Topsail (minus the futures market), two officials privy to the intelligence tell NEWSWEEK. It is in programs like these that real data mining is going on andbconsidering the furor over TIAbwith fewer intrusions on civil liberties than occur under the NSA surveillance program. "It's the best thing to come out of American intelligence in decades," says John Arquilla, an intelligence expert at the Naval Postgraduate School in Monterey, Calif. "It is truly Poindexter's brainchild. Of all the people in the intelligence business, he has the keenest appreciation of using advanced information technology for intelligence gathering." Poindexter, who lives just outside Washington in Rockville, Md., could not be reached for comment on whether he is still involved with Topsail." http://www.msnbc.msn.com/id/11238800/site/newsweek/print/1/displaymode/1098/ Bob Devine -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFD7U9ztcdvoAezhUsRAqDYAKCfXW7Rr7EK1bMN/g2WDQ9r3alZHgCeJEMN 4nxoEa35RQyfcLdKKgjFOH0= =lVMv -----END PGP SIGNATURE----- ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] Judge dismisses John Gilmore's ID-required lawsuit [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

<x-flowed> GILMORE v. ASHCROFT JOHN GILMORE, Plaintiff, v. JOHN ASHCROFT, in his official capacity as Attorney General of the United States; ROBERT MUELLER, in his official capacity as Director of the Federal Bureau of Investigation; NORMAN MINETA, in his official capacity as Secretary of Transportation; MARION C. BLAKEY, as Administrator of the Federal Aviation Administration; Admiral JAMES M. LOY, in his official capacity as Acting Undersecretary of Transportation for Security; TOM RIDGE, in his official capacity as Chief of the Office of Homeland Security; UAL CORPORATION, aka UNITED AIRLINES; and DOES I-XXX, Defendants. No. C 02-3444 SI UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA March 19, 2004, Decided March 23, 2004, Filed ... Defendants have moved to dismiss plaintiff's complaint for failure to state a claim upon which relief can be granted. Having carefully considered the arguments of the parties and the papers submitted, the Court GRANTS the motions to dismiss n1 and DENIES plaintiff's request for judicial notice. ... BACKGROUND Plaintiff John Gilmore is a California resident who is suing the United States n2 and Southwest Airlines for refusing to allow him to board an airplane on July 4, 2002 without either displaying a government-issued identification consenting to a search. Plaintiff alleges that these security requirements imposed by the United States government and effected by the airline companies violate several of his constitutional rights, including his rights under the First and Fourth Amendments. n3 ... LEGAL STANDARD The Court may dismiss a complaint when it is not based on a cognizable legal theory or pleads insufficient facts to support a cognizable legal claim. Smilecare Dental Group v. Delta Dental Plan, 88 F.3d 780, 783 (9th Cir. 1996). DISCUSSION Plaintiff's complaint alleges that as a result of the requirement that passengers traveling on planes show identification and his unwillingness to comply with this requirement, he has been unable to travel by air since September 11, 2001. Plaintiff's complaint asserts causes of action challenging the apparent government policy that requires travelers either to show identification or to consent to a search which involves wanding, walking through a magnetometer or a light pat-down. Whether this is actually the government's policy is unclear, as the policy, if it exists, is unpublished. However, this Court for the purpose [*6] of evaluating plaintiff's complaint, assumes such a policy does exist, and reviews plaintiff's complaint accordingly. Plaintiff asserts the unconstitutionality of this policy on the following grounds: vagueness in violation of the Due Process Clause; violation of the right to be free from unreasonable searches and seizures; violation of the right to freedom of association; and violation of the right to petition the government for redress of grievances. The federal defendants and airline defendant both brought motions to dismiss. As plaintiffs' claims are common to both sets of defendants, this Court treats them collectively. While there are questions about the private defendant's liability as a state actor and about the federal defendants' liability for the private defendant's actions, as this Court has not found plaintiff's complaint to have alleged a constitutional violation, those issues need not be addressed at this time. ... 1. Standing As a preliminary matter, the federal defendants have objected to all of plaintiff's claims other than plaintiff's challenges to the identification requirement. It is unclear from plaintiff's complaint whether he intended to plead any [*7] other claims, but he did allude to the "government's plan to create huge, integrated databases by mingling criminal histories with credit records, previous travel history and much more, in order to create dossiers on every traveling citizen," including creation of "no fly" watchlists. Complaint, P8. He pointed to newspaper and magazine articles and internet websites describing various activities and directives issued by various federal agencies, including the increased use of the Consumer Assisted Passenger Prescreening System ("CAPPS") in the wake of the terrorist attacks on September 11, 2001. Complaint, PP35-50. The federal defendants argue that "as a threshold matter, plaintiff has standing in this action solely insofar as he challenges an alleged federally-imposed requirement that airlines request identification as part of the screening process at airports. The complaint is devoid of any allegation that plaintiff personally has suffered any injury that is fairly traceable to any other practice, procedure, or criterion that may be used by any defendant in screening airline passengers for weapons and explosives." Motion to Dismiss at 2:21-25. ... Accordingly, to the extent that plaintiff pleads causes of action beyond those stemming from the identification requirement, those causes of action are DISMISSED for lack of standing or jurisdiction. 2. Plaintiff's First Cause of Action: violation of the Due Process Clause Plaintiff alleges that the identification requirement is "unconstitutionally vague in violation of the Due Process Clause of the Fifth Amendment because it is vague, being unpublished, and thus provides no way for ordinary people or reviewing courts to conclusively determine what is legal." Complaint, P52. This claim directly attacks the policy, regulation, order or directive requiring production of identification at airports. In this case, the federal defendants refuse to [*10] concede whether a written order or directive requiring identification exists, or if it does, who issued it or what it says. They contend, however, that to the extent this action challenges an order issued by the TSA or the FAA, 49 U.S.C. ' 46110(a) vests exclusive jurisdiction in the Courts of Appeals to decide the challenge. ... Because this claim squarely attacks the orders or regulations issued by the TSA and/or the FAA with respect to airport security, this Court does not have jurisdiction to hear the challenge. As a corollary, without having been provided a copy of this unpublished statute or regulation, if it exists, the Court is unable to conduct any meaningful inquiry as to the merits of plaintiff's vagueness argument. This argument would better be addressed to the Ninth Circuit Court of Appeals or to the Court of Appeals for the District of Columbia Circuit, both of which have jurisdiction to review these matters. 3. Plaintiff's Second Cause of Action: violation of the Fourth Amendment right to be free from unreasonable searches and seizures ... In plaintiffs' case, he was not required to provide identification on pain of criminal or other governmental sanction. Identification requests unaccompanied by detention, arrest, or any other penalty, other than the significant inconvenience of being unable to fly, do not amount to a seizure within the meaning of the Fourth Amendment. Plaintiff has not suggested that he felt that he was not free to leave when he was asked to produce [*15] identification. None of the facts submitted by plaintiff suggests that the request for identification implicated plaintiff's Fourth Amendment rights. Therefore, plaintiff's claim that the identification requirement is unreasonable does not raise a legal dispute that this Court must decide. ... 3. Plaintiff's Third and Fourth Causes of Action: violation of the right to travel protected by the Due Process Clause ... However, plaintiff's allegation that his right to travel has been violated is insufficient as a matter of law because the Constitution does not guarantee the right to travel by any particular form of transportation. Miller v. Reed, 176 F.3d 1202, 1205 (9th Cir. 1999) ("Burdens on a single mode of transportation do not implicate the right to interstate travel."); Monarch Travel Serv. Assoc. Cultural Clubs, Inc., 466 F.2d 55 2(9th Cir. 1972). The right to travel throughout the United States confers a right to be "uninhibited by statutes, rules and regulations which unreasonably burden or restrict this movement." Saenz v. Roe, 526 U.S. 486, 499 (9th Cir. 1973). This Court rejects plaintiff's argument that the request [*20] that plaintiff either submit to search, present identification, or presumably use another mode of transport, is a violation of plaintiff's constitutional right to travel. ... 4. Plaintiff's Fourth Cause of Action: violation of the right to freedom of association protected by the First and Fifth Amendments Plaintiff's allegation that his right to associate freely was violated fails because the only actions which violate this right are those which are "direct and substantial or significant." Storm v. Town of Woodstock, 944 F. Supp. 139, 144 (N.D. N.Y. 1996). Government action which only indirectly affects associational rights is not sufficient to state a claim for violation of the freedom to associate. To the extent that plaintiff alleged plans to exercise his associational rights in Washington, D.C., the Court finds that plaintiff's rights were not violated as plaintiff had numerous other methods of reaching Washington. ... For the foregoing reasons, plaintiff's complaint is dismissed. Plaintiff's claims against the federal defendants and Southwest Airlines are dismissed with prejudice; plaintiff's claims against United Airlines are dismissed without prejudice. Plaintiff's request for judicial notice is denied. [Docket ## 6, 8, 10, 22, 28]. IT IS SO ORDERED. Dated: March 19, 2004 SUSAN ILLSTON United States District Judge _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) </x-flowed> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] The Son of TIA
by Dave Farber 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------- Original Message -------- Subject: for IP? Date: Fri, 10 Feb 2006 16:42:14 -0700 From: Bob Devine <devinebob(a)gmail.com> To: dave(a)farber.net In its latest issue, Newsweek describes the Son of TIA. You *just* knew that the Pentagon wouldn't really kill TIA... One paragraph from the article: "Yet today, very quietly, the core of TIA survives with a new codename of Topsail (minus the futures market), two officials privy to the intelligence tell NEWSWEEK. It is in programs like these that real data mining is going on andbconsidering the furor over TIAbwith fewer intrusions on civil liberties than occur under the NSA surveillance program. "It's the best thing to come out of American intelligence in decades," says John Arquilla, an intelligence expert at the Naval Postgraduate School in Monterey, Calif. "It is truly Poindexter's brainchild. Of all the people in the intelligence business, he has the keenest appreciation of using advanced information technology for intelligence gathering." Poindexter, who lives just outside Washington in Rockville, Md., could not be reached for comment on whether he is still involved with Topsail." http://www.msnbc.msn.com/id/11238800/site/newsweek/print/1/displaymode/1098/ Bob Devine -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFD7U9ztcdvoAezhUsRAqDYAKCfXW7Rr7EK1bMN/g2WDQ9r3alZHgCeJEMN 4nxoEa35RQyfcLdKKgjFOH0= =lVMv -----END PGP SIGNATURE----- ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [liberationtech] Travel with notebook habit
by Julian Oliver 06 Jul '18

06 Jul '18

..on Thu, Dec 27, 2012 at 07:36:16PM -0600, Matt Mackall wrote: > On Thu, 2012-12-27 at 23:56 +0100, Radek Pilar wrote: > > Full HDD encryption (including swap space and hibernate file) and > > powered down or hibernated (s2disk) machine is the only way to go. > > Expect that if you're a target of state oppression that your laptop WILL > be taken away from you for hours at border crossings. This was a routine > occurrence for me between 2001 and 2006 or so. Fortunately for me, I > didn't warrant the big guns: the customs officers involved usually > reported their techs being completely thwarted/baffled by my Linux > screensaver. > > However, it would be fairly straightforward to take apart a laptop, > install a hardware keylogger inside, and reassemble it in that sort of > timeframe, then recover your key and decrypt your laptop on your return > trip. So unless you have some sort of tamper-proof seals on your laptop, > you can't trust it once it leaves your physical possession. > > Also note that encryption is NOT sufficient. Canadian customs officials > have demanded that I log in to my laptop so they could peruse my photo > collection (?!) as a condition of entering the country and/or being > released from customs. It's easy to imagine much more severe coercion if > the authorities are actually interested in your data. Not having a hard > disk is excellent defense against such coercive privacy invasions but > encryption is not. Since then, I've personally started keeping a dummy, > empty account on my laptop for basic deniability: nothing to see here > but my travel itinerary, can I go now? > > But if the operational security or privacy of your laptop actually > matters and you must take a laptop, I have to agree with Jacob: don't > travel with your data. Same applies for cameras and phones. This is why I personally think it's wise to carry just a skeleton system over the border on a bootable USB stick, with full disk encryption. Once on the other side of the border, securely download the data required (as I said in last post). Sticks are easier to throw away/hide and if your laptop is stolen/seized within the country your data doesn't have to go with it - the stick's in your pocket or in your sock when walking around. Before you cross the border again the stick should be physically destroyed. This is better than trusting data deletion. It can be smart to have a stock standard Windows install on the physical hard-disk that wakes from sleep on lid-open with a picture of you and a dog laughing in the sunny grass. Invite them to browse around and find nothing. Never use that Windows install, of course. Boot Debian GNU/Linux or BackTrack Linux on the stick. I've been extensively questioned at the border on a few occassions over the years /because/ my laptops don't have a Desktop as such, no icons either. Both my arms were grabbed at the Australian border as I reached to type 'firefox' in a terminal, to start the browser in an attempt to show them a normal looking environment. Terminals at the border are not a good idea. To avoid the machine being tampered with, invest in a solid state netbook and super-glue the shell together. It's not a crime. Cheers! -- Julian Oliver http://julianoliver.com http://criticalengineering.org -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

How to wiretap or identify a GSM phone - and enable the masses
by John Gilmore 06 Jul '18

06 Jul '18

David Burgess, a software/radio engineer formerly employed in building GSM-tapping equipment, has turned his efforts to publicly implementing the GSM standards in free software under GPLv3. He hopes to provide low-cost GSM communication service to billions in underserved regions of the world. He also hopes to demystify the cellular networks for a generation of hackers. His OpenBTS software builds on the GNU Radio framework and the USRP computer/radio interfaces to implement a fully functional GSM network base station, making voice and SMS calls with ordinary GSM handsets, and back-hauling via VoIP networks. Early code was tested at Burning Man last year, and he hopes to provide free communcation service to BM participants this year (as well as doing some testing in field conditions under serious load). His understanding of the GSM protocols comes from reading the published standards documents, which are written in bureaucratese but can be decrypted without a secret key. However, a former customer of his has been suing him for alleged disclosure of trade secrets, claiming that either the GSM protocol or perhaps the way to wiretap a GSM phone is secret (the published court documents make vague allegations, as usual). David's blog, "The OpenBTS Chronicles" has a variety of interesting posts, one of which links to a German patent on an IMSI-catcher which lets wiretappers force a phone to identify itself, and to a UK High Court decision that upholds it (and also reveals a Nokia patent on how to do a man-in-the-middle attack on a GSM phone). Clearly the things revealed in these documents are not trade secrets. But they may be of interest to this list. I also found that David's posting on "The Value of Knowing How Stuff Works" struck a chord with me. http://openbts.blogspot.com/ http://openbts.blogspot.com/2009/04/some-comments-on-imsi- catchers.html http://openbts.blogspot.com/2009/05/value-of-knowing-how-stuff-works.html http://en.wikipedia.org/wiki/OpenBTS http://www.gnuradio.org/trac/wiki/OpenBTS http://openbts.sourceforge.net/ John --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0