July 2018 - cypherpunks-legacy

Secrecy News -- 12/19/12
by Steven Aftergood 05 Jul '18

05 Jul '18

Format Note: If you cannot easily read the text below, or you prefer to receive Secrecy News in another format, please reply to this email to let us know. SECRECY NEWS from the FAS Project on Government Secrecy Volume 2012, Issue No. 127 December 19, 2012 Secrecy News Blog: http://www.fas.org/blog/secrecy/ ** CAN DISCLOSURES OF CLASSIFIED INFO BE AUTHORIZED? ** RISING ECONOMIC POWERS, AND MORE FROM CRS ** IMAGERY DECLASSIFICATION PREPARATIONS CONTINUE ** JASON ON "COMPRESSIVE SENSING" FOR DOD SENSORS CAN DISCLOSURES OF CLASSIFIED INFO BE AUTHORIZED? It is plainly true that executive branch officials will sometimes disclose classified information to reporters and other uncleared individuals. But this practice is not explicitly authorized in any official statement of classification policy. In fact, with an exception for life-threatening emergencies, it is usually understood to be prohibited. How can the obviously flexible practice and the seemingly prohibitive policy be reconciled? A newly updated report from the Congressional Research Service presents a close reading of the relevant rules and regulations in search of some wiggle room for authorized disclosures of classified information. "Nothing in the Executive Order addresses an informal procedure for releasing classified information [to reporters]. E.O. 13526 section 1.1 provides that '[c]lassified information shall not be declassified automatically as a result of any *unauthorized* disclosure of identical or similar information,' but does not address what happens in the event of a disclosure that was in fact authorized," the CRS report observes. "By definition, classified information is designated as such based on whether its *unauthorized* disclosure can reasonably be expected to cause a certain level of damage to the national security. This may be read to suggest that disclosures may be authorized under such circumstances when no damage to national security is reasonably expected." (But under those circumstances, it might be noted, the information should be promptly declassified.) The CRS report, written by legislative attorney Jennifer K. Elsea, continues: "Nothing in the order provides explicit authority to release classified information that exists apart from the authority to declassify, but it is possible that such discretionary authority is recognized to release information outside the community of authorized holders without formally declassifying it." Indeed, this appears to be an accurate characterization of actual practice. In any case, "there is little to stop agency heads and other high-ranking officials from releasing classified information to persons without a security clearance when it is seen as suiting government needs." Again, an accurate description-- particularly since "the Attorney General has prosecutorial discretion to choose which leaks to prosecute." See "The Protection of Classified Information: The Legal Framework," updated December 17, 2012: http://www.fas.org/sgp/crs/secrecy/RS21900.pdf Overall, "Executive Branch policy appears to treat an official disclosure as a declassifying event, while non-attributed disclosures [to reporters or others] have no effect on the classification status of the information," the author writes. "For example, the Department of Defense instructs agency officials, in the event that classified information appears in the media, to neither confirm nor deny the accuracy of the information. The Under Secretary of Defense for Intelligence is then advised to 'consult with the Assistant Secretary of Defense for Public Affairs and other officials having a primary interest in the information to determine if the information was officially released under proper authority.'" But, the CRS report astutely notes, the relevant DoD regulation "does not clarify what happens in the event the disclosure turns out to have been properly authorized." And so it seems that the DoD regulation offers the conceptual space for an authorized disclosure of classified information. (As if to provide an ironic illustration of the point, the Under Secretary of Defense for Intelligence himself -- Michael Vickers -- was reportedly cited in a referral to the Department of Justice for disclosing potentially restricted information concerning the pursuit of Osama bin Laden to filmmakers. See "Bin Laden film leak was referred to Justice; leaker top Obama official" by Marisa Taylor and Jonathan S. Landay, McClatchy Newspapers, December 17, 2012. In a statement last night, the Department of Defense confirmed that Mr. Vickers is a subject of a pending Inspector General investigation. But it said the information in question was unclassified in its entirety.) The CRS report naturally does not constitute an authoritative interpretation of the executive order, and in some respects it may be in error. The report mistakenly states (at footnote 51) that the DOJ Media Leak Questionnaire that agencies must complete when a referring a leak for investigation is "apparently... part of a Memorandum of Understanding concluded between the Department of Justice and elements of the Intelligence Community." But a review of the Memorandum, described in Secrecy News earlier this week, shows that that supposition is incorrect. The two are separate documents. See "Crimes Reports and the Leak Referral Process," Secrecy News, December 17, 2012: http://www.fas.org/blog/secrecy/2012/12/crimes_reports.html Anti-leak legislation that is pending in the Senate would require executive branch officials to record all authorized disclosures of classified intelligence to the press, and to notify Congress when they occur (cf. sections 501 and 502 of Title V of the FY 2013 intelligence authorization bill). These provisions, which may prove unworkable in practice, are presumably intended to enable Congress to publicly comment on classified intelligence matters with the same freedom that agency officials already do. But the public interest concern raised by the notification provisions is that if they are strictly imposed, they may discourage all authorized disclosures of classified intelligence, yielding a net reduction in public access to government information. RISING ECONOMIC POWERS, AND MORE FROM CRS New and updated reports from the Congressional Research Service that Congress has directed CRS not to release to the public include the following. Rising Economic Powers and U.S. Trade Policy, December 3, 2012: http://www.fas.org/sgp/crs/row/R42864.pdf Unauthorized Aliens Residing in the United States: Estimates Since 1986, December 13, 2012: http://www.fas.org/sgp/crs/misc/RL33874.pdf DOD Alternative Fuels: Policy, Initiatives and Legislative Activity, December 14, 2012: http://www.fas.org/sgp/crs/natsec/R42859.pdf Federal Land Ownership: Current Acquisition and Disposal Authorities, December 13, 2012: http://www.fas.org/sgp/crs/misc/RL34273.pdf The Controlled Substances Act: Regulatory Requirements, December 13, 2012: http://www.fas.org/sgp/crs/misc/RL34635.pdf IMAGERY DECLASSIFICATION PREPARATIONS CONTINUE Intelligence community officials have been meeting with representatives of the National Archives to discuss the anticipated declassification and release of intelligence imagery from the KH-9 satellite dating between 1971 and 1984. Officials have been negotiating the transfer of the original negatives from the KH-9 system and the provision of finding aids, according to a newly released but heavily redacted report from the National Geospatial Intelligence Agency, dated June 2012. http://www.fas.org/irp/agency/nga/imagery-declass.pdf Multiple releases of declassified imagery are planned over the coming year "with final delivery of imagery scheduled for September 2013." See "Intelligence Imagery Set to be Disclosed in 2013," Secrecy News, October 22, 2012. http://www.fas.org/blog/secrecy/2012/10/hexagon_imagery.html JASON ON "COMPRESSIVE SENSING" FOR DOD SENSORS The latest report from the elite JASON science advisory panel is devoted to the subject of "compressive sensing." This term generally refers to the use of sensors for imaging (or other sensing) of an object in a manner that uses a limited subset of the available data in order to improve efficiency or conserve resources. "Compressive sensing involves intentionally under-sampling an object or image, typically in a random manner, and then using a companion process known as sparse reconstruction to recover the complete object or image information...," the JASON report says. "Compressed sensing can conceivably lead to reductions in data link requirements, reductions in radar resources needed for radar image formation (thereby providing the radar more resources for its other functions such as target detection, target tracking, and fire control), increased angular resolution without commensurate increases in array costs, and increased fields of view without degradation in resolution..." "Compressive sensing is not a 'free lunch'," the report cautions, "but always involves a tradeoff; reduced data may save measurement resources, but it also means a lower signal-to-noise ratio and possibly other artifacts, such as side lobes or false alarms." A copy of the new JASON report was obtained by Secrecy News. See "Compressive Sensing for DoD Sensor Systems," November 2012: http://www.fas.org/irp/agency/dod/jason/compress.pdf _______________________________________________ Secrecy News is written by Steven Aftergood and published by the Federation of American Scientists. The Secrecy News Blog is at: http://www.fas.org/blog/secrecy/ To SUBSCRIBE to Secrecy News, go to: http://www.fas.org/sgp/news/secrecy/subscribe.html To UNSUBSCRIBE, go to http://www.fas.org/sgp/news/secrecy/unsubscribe.html OR email your request to saftergood(a)fas.org Secrecy News is archived at: http://www.fas.org/sgp/news/secrecy/index.html Support the FAS Project on Government Secrecy with a donation: http://www.fas.org/member/donate_today.html _______________________ Steven Aftergood Project on Government Secrecy Federation of American Scientists web: www.fas.org/sgp/index.html email: saftergood(a)fas.org voice: (202) 454-4691 twitter: @saftergood ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

What happens in Vegas...
by Kurt Albershardt 05 Jul '18

05 Jul '18

Very interesting look at government data mining <http://www.pbs.org/wgbh/pages/frontline/homefront/etc/producer.html> Jeff Jonas' Non-Obvious Relationship Analysis (NORA) was sold to IBM, which markets it as Entity Analytics <http://www-306.ibm.com/software/data/db2/eas/> <http://www-03.ibm.com/industries/financialservices/doc/content/resource/tho…> ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] What happens in Vegas...
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

[tahoe-dev] raise your hand if you have a patch for Tahoe-LAFS that needs tests
by Zooko Wilcox-O'Hearn 05 Jul '18

05 Jul '18

Folks: As I mentioned on: https://tahoe-lafs.org/trac/tahoe-lafs/ticket/68#comment:88 , I've heard of several patches for Tahoe-LAFS that are complete enough to be useful but can't be committed to trunk because they don't have tests. This includes the multi-introducer patch by Faruq that killyourtv is talking about on that ticket. If I recall correctly Faruq wrote a basic test of subscribing to multiple introducers 9, but we don't have tests of other interesting cases, like what happens when one introducer is connected and you subscribe to it and hear about a server, and then that introducer goes offline and a different introducer appears and you connect to it and hear a different (newer) announcement about that server. Anyway, I was wondering how many people know of patches that you would like to see in Tahoe-LAFS trunk, and the reason it is not already committed to trunk is that it doesn't have tests, and you're not sure what sort of thing we expect in tests or how to write tests for Twisted code, etc. You can find such patches by querying the trac for the keyword 'test-needed': 2. If that describes you, let me know when you would be available for a tutorial session on IRC where we pick one such patch and walk through the process of writing tests for it. Brian Warner and David-Sarah Hopwood are two of the best engineers in the universe, and they are both (not coincidentally) two of the best unit-test-writers in the universe, so I would find a time when at least one and hopefully both of them would be willing to help. (I would definitely recommend hanging out with these folks on IRC for a couple of hours and working on a real patch for a real project. You could pay some famous person or company big bucks for software engineering training and not improve your skills as much.) This coming weekend, when Andrew Miller and Zancas and I will be hacking in person in Boulder, might be a good time to get on IRC and help us write unit tests. Regards, Zooko 9 https://tahoe-lafs.org/trac/tahoe-lafs/browser/ticket68-multi-introducer/sr… 2 https://tahoe-lafs.org/trac/tahoe-lafs/query?status=!closed&keywords=~test-… _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

What happens in Vegas...
by Kurt Albershardt 05 Jul '18

05 Jul '18

Very interesting look at government data mining <http://www.pbs.org/wgbh/pages/frontline/homefront/etc/producer.html> Jeff Jonas' Non-Obvious Relationship Analysis (NORA) was sold to IBM, which markets it as Entity Analytics <http://www-306.ibm.com/software/data/db2/eas/> <http://www-03.ibm.com/industries/financialservices/doc/content/resource/tho…> ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] What happens in Vegas...
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

[tahoe-dev] raise your hand if you have a patch for Tahoe-LAFS that needs tests
by Zooko Wilcox-O'Hearn 05 Jul '18

05 Jul '18

Folks: As I mentioned on: https://tahoe-lafs.org/trac/tahoe-lafs/ticket/68#comment:88 , I've heard of several patches for Tahoe-LAFS that are complete enough to be useful but can't be committed to trunk because they don't have tests. This includes the multi-introducer patch by Faruq that killyourtv is talking about on that ticket. If I recall correctly Faruq wrote a basic test of subscribing to multiple introducers 9, but we don't have tests of other interesting cases, like what happens when one introducer is connected and you subscribe to it and hear about a server, and then that introducer goes offline and a different introducer appears and you connect to it and hear a different (newer) announcement about that server. Anyway, I was wondering how many people know of patches that you would like to see in Tahoe-LAFS trunk, and the reason it is not already committed to trunk is that it doesn't have tests, and you're not sure what sort of thing we expect in tests or how to write tests for Twisted code, etc. You can find such patches by querying the trac for the keyword 'test-needed': 2. If that describes you, let me know when you would be available for a tutorial session on IRC where we pick one such patch and walk through the process of writing tests for it. Brian Warner and David-Sarah Hopwood are two of the best engineers in the universe, and they are both (not coincidentally) two of the best unit-test-writers in the universe, so I would find a time when at least one and hopefully both of them would be willing to help. (I would definitely recommend hanging out with these folks on IRC for a couple of hours and working on a real patch for a real project. You could pay some famous person or company big bucks for software engineering training and not improve your skills as much.) This coming weekend, when Andrew Miller and Zancas and I will be hacking in person in Boulder, might be a good time to get on IRC and help us write unit tests. Regards, Zooko 9 https://tahoe-lafs.org/trac/tahoe-lafs/browser/ticket68-multi-introducer/sr… 2 https://tahoe-lafs.org/trac/tahoe-lafs/query?status=!closed&keywords=~test-… _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-dev] New tech report: Counting daily bridge users
by Karsten Loesing 05 Jul '18

05 Jul '18

Hi everyone, I just finished a new tech report titled "Counting daily bridge users": https://research.torproject.org/techreports/counting-daily-bridge-users-201… >From the abstract: "As part of the Tor Metrics Project, we want to learn how many people use the Tor network on a daily basis. Counting users in an anonymity network is, obviously, a difficult task for which we cannot collect too sensitive usage data. We came up with a privacy-preserving approach for estimating directly connecting user numbers by counting requests to the directory mirrors and deriving approximate user numbers from there. In this report we describe a modified approach for estimating the number of users connecting via bridges by evaluating directory requests made to bridges. We compare this new approach to our current approach that estimates bridge user numbers from total unique IP addresses seen at bridges. We think that results from the new approach are closer to reality, even though that means there are significantly fewer daily bridge users than originally expected." Feedback is much appreciated and could influence our implementation of user number estimates in the future (#7154). Thanks, Karsten _______________________________________________ tor-dev mailing list tor-dev(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Dailydave] iAWACS CFP - The no-limit workshop
by Anthony Desnos 05 Jul '18

05 Jul '18

First International Alternative Workshop on Aggressive Computing and Security The no-limit workshop "Enhancing security with the attacker's mind - Orthodoxy and self confidence are weaknesses" "There is no such thing as forbidden knowledge, only forbidden use of knowledge" iAWACS ESIEA - Laval - October 2009 Thinking security can not be done without adopting a preferential mode of thought of the attacker. A system cannot be defended if we do not know how to attack it. If the theory is still an interesting approach to formalize things, the operational approach must be the ultimate goal: to talk about security is meaningless if we do not actually do security. In recent years the major security conferences in the subjects preferred to select papers according to fashion topics, conforming to something like orthodoxy and organize selection as beauty contests. As a result excellent yet unorthodox scientific papers are often rejected and sink into oblivion. The first international Alternative Workshop in Aggressive Computing and Security (iAWACS'09) aims to focus on this vision and to allow researchers and specialists to present relevant research works, with interesting results and operational (theoretical and/or applied) in the field of security. The different points of view, away from unconventional fashion and orthodoxy are particularly welcome. The aim is also to promote discussion of ideas around these topics. Articles submitted will be selected according to the following criteria: # Interest and scientific/technical correctness/accuracy, # New results, # Operational quality Regarding this last point, the authors should give all information and conditions for reproducibility of results they intend to present. This may include, during the selection phase by the reviewers, assessments based on challenges to the authors by the reviewers. iAwacs is not just another hackers workshop where the last exploit is disclosed. The aim of the conference is to make security concepts evolves through both the attacker's view AND a thorough formalization backed by experimental results. The main topics covered (list not exhaustive) are: # Cryptanalysis techniques # Steganalysis techniques # Malicious cryptography # Advances computer virology techniques (malware, backdoor...) # Active security product analysis and testing # Active security auditing # Mathematical concepts and applications with respect to the attacker's view # Cyberwarfare techniques # Cryptographic and steganography techniques # Invisible trap/bacdoor techniques in algorithms and applications # Implementation attacks # Interception/eavesdropping techniques # Forensics and anti-forensics techniques # Tempest and anti-tempest techniques # InfoOps techniques # Satellite hijacking Articles should be submitted in electronic format, preferably in LaTeX format, in English. Submission of Word/OOwriter documents is accepted. The address for submission is iawacs2009(a)esiea.fr. Submissions under hidden identities or aliases are not allowed.A technical challenge will be organized during the conference. Attendees who want to participate must register on site. For this first edition, the theme we have chosen is "Evaluation against active antivirus software to evaluate their resistance to removal by a malicious code." All results will be shared with publishers of antivirus concerned. The technical details of the challenge will be announced later. Important dates : # Submission deadline: July 15th, 2009 # Notification deadline: August 20th, 2009 # Final manuscript submission for inclusion into the proceedings: September 20th, 2009 # Conference dates: October 23rd - 25th, 2009 The conference proceedings will be published with ISBN by the Presses Techniques ESIEA. They will be given to registered participants at the conference and can then be bought on the conference homepage. The conference will be held at Ecole SupC)rieure en Informatique, Electronique et Automatique, in Laval from Friday 23rd to Sunday 25th, 2009 morning. Each author will have 45 minutes of speaking time, each presentation will be followed by a technical discussion between speakers and listeners. Laval is nice medieval city located 250 km west from Paris and can be reach by high speed train (TGV) from Paris International Airport. Conference registration amount to 400 euros (includes proceedings ,coffee breaks, lunches, cocktail reception, social events on Friday evening and Saturday evening, the conference, shuttle bus between the hotels and the conference venue). Program Chair : Eric Filiol Program Co-Chair : Robert Erra Contacts : # Program chair: iawacs2009(a)esiea.fr # Organization comitee: iawacs2009_orga(a)esiea.fr # Press contact: iawacs2009_press(a)esiea.fr http://www.esiea-recherche.eu http://www.esiea-recherche.eu/iawacs_2009.html _______________________________________________ Dailydave mailing list Dailydave(a)lists.immunitysec.com http://lists.immunitysec.com/mailman/listinfo/dailydave

1 0

Re: Update: Torbutton 1.0.1
by Roger Dingledine 05 Jul '18

05 Jul '18

On Sat, Mar 18, 2006 at 01:59:13PM -0600, Scott Squires wrote: > Announcing Torbutton 1.0.1 > http://zargon.hobbesnet.org/~squires/torbutton/torbutton-1.0.1.xpi I've just changed the Tor installation docs to recommend Torbutton rather than SwitchProxy: http://zargon.hobbesnet.org/~squires/torbutton/ If you all could please give it a try and let us know if you can find any compatibility problems, bugs, etc, that would be great. I'd like to get all the issues worked out so we can have a stable plugin to recommend. Thanks! --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0