July 2018 - cypherpunks-legacy

US DoJ wants ISPs to be forced to log their customers activities
by Perry E. Metzger 06 Jul '18

06 Jul '18

Quoting: The U.S. Department of Justice is quietly shopping around the explosive idea of requiring Internet service providers to retain records of their customers' online activities. http://news.com.com/Your+ISP+as+Net+watchdog/2100-1028_3-5748649.html -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [Freedombox-discuss] human-meaningful names and zooko's triangle [was: Re: FOAF developers taking FreedomBox into their equation]
by Henry Story 06 Jul '18

06 Jul '18

On 15 Mar 2011, at 00:26, Daniel Kahn Gillmor wrote: > (for some reason, my MUA thinks that this message from henry story may > be a scam. it is not.) > > On 03/13/2011 08:11 AM, Henry Story wrote: >> If you had a global reliable distributed public key inscription/lookup service, then one could create URLs based on it so that boxes could be moved easily. Perhaps one could create such HTTP URLs based on the existence of such a service. call these httpk urls. The could look something like this >> >> <httpk://lhslkdhfsdfsdfsfsfdsxxs23sfsdf/people/Alice#fb> > > Without getting into the details, it sounds to me like you're proposing > dropping human-meaningful identifiers entirely (and relying on the FOAF > assertions to situate the opaque identifiers in a social context). This > is an interesting approach, but it makes it difficult to mix between the > online and offline worlds, i think. > > At this point, I'd rather not comment on the specifics of whether to use > HTML forms, what specific structure each datapoint should use, etc, > because i think we don't have consensus yet on how we should handle the > basics of the naming question. > > If we give up on human-meaningful names, then yes, i think the rest of > the puzzle pieces fall into place -- it's not terribly hard to come up > with a distributed namebaddress resolution mechanism that covers a > cryptographically-strong namespace. We can then use that address > resolution mechanism to make requests about the rest of the related data > (e.g. what human-memorable name each entity claims for itself, and what > names other entities claim for it). > > Revocations become quite permanent in that case (the name itself gets > retired), and (it seems to me) it becomes difficult to refer cleanly and > unambiguously to a specific entity in the offline world while online, > and vice versa. > > However, petname-style proposals (which i think includes the system > Henry sketched here) implemented on trusted hardware allow humans to > have some sort of private/non-universal human-meaningful name that they > can apply to a given peer. > > What do other people think of the consequences of this sort of tradeoff? > > I'm assuming that people in this discussion are aware of the concept of > Zooko's Triangle (whether you subscribe to it or not). If you haven't > read about it yet, please take a second to do so: > > https://secure.wikimedia.org/wikipedia/en/wiki/Zooko's_triangle > http://zooko.com/distnames.html > > Regards, > > --dkg > I came across Zooko's triangle in a few recent posts by Dan Kaminsky, of which this one http://dankaminsky.com/2011/01/13/spelunk-tri/ In the e-mail you are responding to, I started with the idea of an httpk URL which I found to be a very useful one in helping me frame my thoughts. Its advantages and disadvantages are quite easy to see, and Zooko's triangle makes those clear. I then showed how if each server published the public keys/ip addresses for each of the servers it had fetched its TLS protected content from, one could have a system that used normal human readable names but could easily be mapped to secure URLS if needed. Or in other words: one could have a system where FreedomBoxes could work with the current DNS but also be alert to suspicious changes. One could work in both frameworks simultaneously. The question one would then have is what would a box do when the keys did not match? Perhaps just reduce the trust it put in information coming from a box, provisionally? It would have to be careful with the response being too strong, as this could lead to a form of attack that Bruce Schneier describes well: attack a system by creating many false alerts until the guards no longer pay attention to the alarm bells. Then attack. As far as how such a protocol would work, I agree it is way too early for that. The idea of a simple RDFa backed HTML form protocol was there to show that something like that could be built in an afternoon. Most of all the point was that we can build a Web based system on TLS and add these layers with time. They don't have to be built in from the start. Henry Social Web Architect http://bblfish.net/ _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [Freedombox-discuss] human-meaningful names and zooko's triangle [was: Re: FOAF developers taking FreedomBox into their equation]
by Henry Story 06 Jul '18

06 Jul '18

On 15 Mar 2011, at 00:26, Daniel Kahn Gillmor wrote: > (for some reason, my MUA thinks that this message from henry story may > be a scam. it is not.) > > On 03/13/2011 08:11 AM, Henry Story wrote: >> If you had a global reliable distributed public key inscription/lookup service, then one could create URLs based on it so that boxes could be moved easily. Perhaps one could create such HTTP URLs based on the existence of such a service. call these httpk urls. The could look something like this >> >> <httpk://lhslkdhfsdfsdfsfsfdsxxs23sfsdf/people/Alice#fb> > > Without getting into the details, it sounds to me like you're proposing > dropping human-meaningful identifiers entirely (and relying on the FOAF > assertions to situate the opaque identifiers in a social context). This > is an interesting approach, but it makes it difficult to mix between the > online and offline worlds, i think. > > At this point, I'd rather not comment on the specifics of whether to use > HTML forms, what specific structure each datapoint should use, etc, > because i think we don't have consensus yet on how we should handle the > basics of the naming question. > > If we give up on human-meaningful names, then yes, i think the rest of > the puzzle pieces fall into place -- it's not terribly hard to come up > with a distributed namebaddress resolution mechanism that covers a > cryptographically-strong namespace. We can then use that address > resolution mechanism to make requests about the rest of the related data > (e.g. what human-memorable name each entity claims for itself, and what > names other entities claim for it). > > Revocations become quite permanent in that case (the name itself gets > retired), and (it seems to me) it becomes difficult to refer cleanly and > unambiguously to a specific entity in the offline world while online, > and vice versa. > > However, petname-style proposals (which i think includes the system > Henry sketched here) implemented on trusted hardware allow humans to > have some sort of private/non-universal human-meaningful name that they > can apply to a given peer. > > What do other people think of the consequences of this sort of tradeoff? > > I'm assuming that people in this discussion are aware of the concept of > Zooko's Triangle (whether you subscribe to it or not). If you haven't > read about it yet, please take a second to do so: > > https://secure.wikimedia.org/wikipedia/en/wiki/Zooko's_triangle > http://zooko.com/distnames.html > > Regards, > > --dkg > I came across Zooko's triangle in a few recent posts by Dan Kaminsky, of which this one http://dankaminsky.com/2011/01/13/spelunk-tri/ In the e-mail you are responding to, I started with the idea of an httpk URL which I found to be a very useful one in helping me frame my thoughts. Its advantages and disadvantages are quite easy to see, and Zooko's triangle makes those clear. I then showed how if each server published the public keys/ip addresses for each of the servers it had fetched its TLS protected content from, one could have a system that used normal human readable names but could easily be mapped to secure URLS if needed. Or in other words: one could have a system where FreedomBoxes could work with the current DNS but also be alert to suspicious changes. One could work in both frameworks simultaneously. The question one would then have is what would a box do when the keys did not match? Perhaps just reduce the trust it put in information coming from a box, provisionally? It would have to be careful with the response being too strong, as this could lead to a form of attack that Bruce Schneier describes well: attack a system by creating many false alerts until the guards no longer pay attention to the alarm bells. Then attack. As far as how such a protocol would work, I agree it is way too early for that. The idea of a simple RDFa backed HTML form protocol was there to show that something like that could be built in an afternoon. Most of all the point was that we can build a Web based system on TLS and add these layers with time. They don't have to be built in from the start. Henry Social Web Architect http://bblfish.net/ _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

<nettime> Conor Friedersdorf: The Legislation That Could Kill Internet Privacy for Good (The Atlantic)
by Patrice Riemens 06 Jul '18

06 Jul '18

Kiddieporn appears to still function as the primary omnibus baseball bat to smash 'the anarchy' on the Internet (with terrorism a good second). But as with 'white slave trafficking' it will become interesting to see when the concept itself that it seeks to represent will come under closer scrutiny... bwo support.antenna.nl original to: http://www.theatlantic.com/politics/archive/2011/08/the-legislation-that-co… The Legislation That Could Kill Internet Privacy for Good By Conor Friedersdorf The Atlantic, Aug 1 2011, An overzealous bill that claims to be about stopping child pornography turns every Web user into a person to monitor Every right-thinking person abhors child pornography. To combat it, legislators have brought through committee a poorly conceived, over-broad Congressional bill, The Protecting Children from Internet Pornographers Act of 2011. It is arguably the biggest threat to civil liberties now under consideration in the United States. The potential victims: everyone who uses the Internet. The good news? It hasn't gone before the full House yet. The bad news: it already made it through committee. And history shows that in times of moral panic, overly broad legislation has a way of becoming law. In fact, a particular moment comes to mind. In the early 20th Century, a different moral panic gripped the United States: a rural nation was rapidly moving to anonymous cities, sexual mores were changing, and Americans became convinced that an epidemic of white female slavery was sweeping the land. Thus a 1910 law that made it illegal to transport any person across state lines for prostitution "or for any other immoral purpose." Suddenly premarital sex and adultery had been criminalized, as scam artists would quickly figure out. "Women would lure male conventioneers across a state line, say from New York to Atlantic City, New Jersey," David Langum* explains, "and then threaten to expose them to the prosecutors for violation" unless paid off. Inveighing against the law, the New York Times noted that, though it was officially called the White Slave Traffic Act (aka The Mann Act), a more apt name would've been "the Encouragement of Blackmail Act." That name is what brought the anecdote back to me. A better name for the child pornography bill would be The Encouragement of Blackmail by Law Enforcement Act. At issue is how to catch child pornographers. It's too hard now, say the bill's backers, and I can sympathize. It's their solution that appalls me: under language approved 19 to 10 by a House committee, the firm that sells you Internet access would be required to track all of your Internet activity and save it for 18 months, along with your name, the address where you live, your bank account numbers, your credit card numbers, and IP addresses you've been assigned. Tracking the private daily behavior of everyone in order to help catch a small number of child criminals is itself the noxious practice of police states. Said an attorney for the Electronic Frontier Foundation: "The data retention mandate in this bill would treat every Internet user like a criminal and threaten the online privacy and free speech rights of every American." Even more troubling is what the government would need to do in order to access this trove of private information: ask for it. I kid you not -- that's it. As written, The Protecting Children from Internet Pornographers Act of 2011 doesn't require that someone be under investigation on child pornography charges in order for police to access their Internet history -- being suspected of any crime is enough. (It may even be made available in civil matters like divorce trials or child custody battles.) Nor do police need probable cause to search this information. As Rep. James Sensenbrenner says, (R-Wisc.) "It poses numerous risks that well outweigh any benefits, and I'm not convinced it will contribute in a significant way to protecting children." Among those risks: blackmail. In Communist countries, where the ruling class routinely dug up embarrassing information on citizens as a bulwark against dissent, the secret police never dreamed of an information trove as perfect for targeting innocent people as a full Internet history. Phrases I've Googled in the course of researching this item include "moral panic about child pornography" and "blackmailing enemies with Internet history." For most people, it's easy enough to recall terms you've searched that could be taken out of context, and of course there are lots of Americans who do things online that are perfectly legal, but would be embarrassing if made public even with context: medical problems and adult pornography are only the beginning. How clueless do you have to be to mandate the creation of a huge database that includes that sort of information, especially in the age of Anonymous and Wikileaks? How naive do you have to be to give government unfettered access to it? Have the bill's 25 cosponsors never heard of J. Edgar Hoover? You'd thing that Rep. Steve Chabot (R-Ohio), who claims on his Web site to be "an outspoken defender of individual privacy rights," wouldn't lend his name to this bill. But he co-sponsored it! You'd think that the Justice Department of Eric Holder, who is supposed to be friendly to civil libertarians, would oppose this bill. Just the opposite. And you'd think that lots of tea partiers, with all their talk about overzealous government and intrusions on private industry, would object. But they haven't. As Julian Sanchez recently wrote on a related subject, "In an era in which an unprecedented quantity of information about our daily activities is stored electronically and is retrievable with a mouse click, internal checks on the government's power to comb those digital databases are more important than ever... If we aren't willing to say enough is enough, our privacy will slip away one tweak at a time." [*The piece originally stated that David Langum was affiliated with the University of Chicago. In fact, the only connection is that the quoted argument was published by the University of Chicago Press. Thanks to the alert reader who caught my error.] # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

US DoJ wants ISPs to be forced to log their customers activities
by Perry E. Metzger 06 Jul '18

06 Jul '18

Quoting: The U.S. Department of Justice is quietly shopping around the explosive idea of requiring Internet service providers to retain records of their customers' online activities. http://news.com.com/Your+ISP+as+Net+watchdog/2100-1028_3-5748649.html -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

<nettime> Conor Friedersdorf: The Legislation That Could Kill Internet Privacy for Good (The Atlantic)
by Patrice Riemens 06 Jul '18

06 Jul '18

Kiddieporn appears to still function as the primary omnibus baseball bat to smash 'the anarchy' on the Internet (with terrorism a good second). But as with 'white slave trafficking' it will become interesting to see when the concept itself that it seeks to represent will come under closer scrutiny... bwo support.antenna.nl original to: http://www.theatlantic.com/politics/archive/2011/08/the-legislation-that-co… The Legislation That Could Kill Internet Privacy for Good By Conor Friedersdorf The Atlantic, Aug 1 2011, An overzealous bill that claims to be about stopping child pornography turns every Web user into a person to monitor Every right-thinking person abhors child pornography. To combat it, legislators have brought through committee a poorly conceived, over-broad Congressional bill, The Protecting Children from Internet Pornographers Act of 2011. It is arguably the biggest threat to civil liberties now under consideration in the United States. The potential victims: everyone who uses the Internet. The good news? It hasn't gone before the full House yet. The bad news: it already made it through committee. And history shows that in times of moral panic, overly broad legislation has a way of becoming law. In fact, a particular moment comes to mind. In the early 20th Century, a different moral panic gripped the United States: a rural nation was rapidly moving to anonymous cities, sexual mores were changing, and Americans became convinced that an epidemic of white female slavery was sweeping the land. Thus a 1910 law that made it illegal to transport any person across state lines for prostitution "or for any other immoral purpose." Suddenly premarital sex and adultery had been criminalized, as scam artists would quickly figure out. "Women would lure male conventioneers across a state line, say from New York to Atlantic City, New Jersey," David Langum* explains, "and then threaten to expose them to the prosecutors for violation" unless paid off. Inveighing against the law, the New York Times noted that, though it was officially called the White Slave Traffic Act (aka The Mann Act), a more apt name would've been "the Encouragement of Blackmail Act." That name is what brought the anecdote back to me. A better name for the child pornography bill would be The Encouragement of Blackmail by Law Enforcement Act. At issue is how to catch child pornographers. It's too hard now, say the bill's backers, and I can sympathize. It's their solution that appalls me: under language approved 19 to 10 by a House committee, the firm that sells you Internet access would be required to track all of your Internet activity and save it for 18 months, along with your name, the address where you live, your bank account numbers, your credit card numbers, and IP addresses you've been assigned. Tracking the private daily behavior of everyone in order to help catch a small number of child criminals is itself the noxious practice of police states. Said an attorney for the Electronic Frontier Foundation: "The data retention mandate in this bill would treat every Internet user like a criminal and threaten the online privacy and free speech rights of every American." Even more troubling is what the government would need to do in order to access this trove of private information: ask for it. I kid you not -- that's it. As written, The Protecting Children from Internet Pornographers Act of 2011 doesn't require that someone be under investigation on child pornography charges in order for police to access their Internet history -- being suspected of any crime is enough. (It may even be made available in civil matters like divorce trials or child custody battles.) Nor do police need probable cause to search this information. As Rep. James Sensenbrenner says, (R-Wisc.) "It poses numerous risks that well outweigh any benefits, and I'm not convinced it will contribute in a significant way to protecting children." Among those risks: blackmail. In Communist countries, where the ruling class routinely dug up embarrassing information on citizens as a bulwark against dissent, the secret police never dreamed of an information trove as perfect for targeting innocent people as a full Internet history. Phrases I've Googled in the course of researching this item include "moral panic about child pornography" and "blackmailing enemies with Internet history." For most people, it's easy enough to recall terms you've searched that could be taken out of context, and of course there are lots of Americans who do things online that are perfectly legal, but would be embarrassing if made public even with context: medical problems and adult pornography are only the beginning. How clueless do you have to be to mandate the creation of a huge database that includes that sort of information, especially in the age of Anonymous and Wikileaks? How naive do you have to be to give government unfettered access to it? Have the bill's 25 cosponsors never heard of J. Edgar Hoover? You'd thing that Rep. Steve Chabot (R-Ohio), who claims on his Web site to be "an outspoken defender of individual privacy rights," wouldn't lend his name to this bill. But he co-sponsored it! You'd think that the Justice Department of Eric Holder, who is supposed to be friendly to civil libertarians, would oppose this bill. Just the opposite. And you'd think that lots of tea partiers, with all their talk about overzealous government and intrusions on private industry, would object. But they haven't. As Julian Sanchez recently wrote on a related subject, "In an era in which an unprecedented quantity of information about our daily activities is stored electronically and is retrievable with a mouse click, internal checks on the government's power to comb those digital databases are more important than ever... If we aren't willing to say enough is enough, our privacy will slip away one tweak at a time." [*The piece originally stated that David Langum was affiliated with the University of Chicago. In fact, the only connection is that the quoted argument was published by the University of Chicago Press. Thanks to the alert reader who caught my error.] # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [HacDC:Byzantium] Request from a Researcher
by The Doctor 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/21/2013 02:17 PM, Rachel B wrote: > talk to me. I have been a longtime lurker to this community, and I > thought that I had done enough lurking and introduce myself. I am Welcome to the Byzantium list! > specifically interested in learning more about how Byzantium has > already been used in emergency situations and what people learned > from those experiences. I know that what I'm asking seems a little > vague right now, so I would be happy to clarify to anyone > interested. The last time Byzantium Linux was used in an emergency situation was during the aftermath of Hurricane Sandy in New York City. We built a version of Byzantium specifically for the use case of restoring connectivity to the rest of the global Net if there was a gateway because responders were encountering great difficulties coordinating with one another and with external organizations. We learned a lot of things there, chief among them that rapid deployment is essential. Sandy was the reason we built an autoconfiguration daemon which pretty much takes the user out of the loop insofar as configuring a Byzantium node is concerned, which frees them up to do other things (like clearing out wreckage). Unfortunately, we also learned the hard way that you can't necessarily count on assistance from people during a disaster situation. There was an organization up there that promised assistance (in the form of computers that could be used as Byzantium nodes) that changed their mind at the last minute, which forced us to fall back on a backup plan. What we took away from this was that interoperability with other mesh projects is essential, so we added interoperability with the Commotion Wireless project while we were up there (and got it working on the first try). Since that time, we've been working with other wireless network projects on automatic, transparent interoperability. On that point, I'll open things up to Sitwon and Haxwithaxe. > If this is the place to look for and ask around, great! If not, no You came to the right mailing list. > problem. I'm happy for any lead that you can offer. On a personal > note, I'm very happy that this project exists and was even lucky > enough to snag a copy at CarolinaCon. Still haven't had the chance > to play around with it, but I hope that could change soon. Glad to hear it! We'll definitely let you know when the next release comes out. Welcome to the 'list. - -- The Doctor [412/724/301/703] [ZS|Media] Developer, Project Byzantium: http://project-byzantium.org/ PGP: 0x807B17C1 / 7960 1CDC 85C9 0B63 8D9F DD89 3BD8 FF2B 807B 17C1 WWW: https://drwho.virtadpt.net/ "Al! I've leaped into a .signature file! What does Ziggy say?" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlEERbAACgkQO9j/K4B7F8GjIwCdGuFJxDxdwIcG/PDYEls+KTf0 ZU8An150wOYxwZSP+9ite4q7WKp66EuN =3+gm -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "Project Byzantium (Emergency Mesh Networking)" group. To post to this group, send email to Byzantium(a)hacdc.org. To unsubscribe from this group, send email to Byzantium+unsubscribe(a)hacdc.org. For more options, visit this group at http://groups.google.com/a/hacdc.org/group/Byzantium/?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cpunx-news] [ISN] Nortel helps build 'Great Firewall of China' (fwd)
by Eugene Leitl 06 Jul '18

06 Jul '18

-- Eugen* Leitl <a href="<http://www.lrz.de/~ui22204/> ______________________________________________________________ ICBMTO: N48 04'14.8'' E11 36'41.2'' <http://www.lrz.de/~ui22204> 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: Mon, 22 Oct 2001 03:19:35 -0500 (CDT) From: InfoSec News <isn(a)c4i.org> To: isn(a)attrition.org Subject: [ISN] Nortel helps build 'Great Firewall of China' Forwarded from: J <dharma(a)uninet.ee> <http://www.tibet.ca/wtnarchive/2001/10/19_3.html> Nortel helps build 'Great Firewall of China' JACK AUBRY Montreal Gazette Thursday, October 18, 2001 Nortel Networks is working hand in hand with the Chinese government to build "the Great Firewall of China," at least in part to target and repress political dissidents using the Internet, a new report concludes. Former Liberal cabinet minister Warren Allmand, president of the International Centre for Human Rights and Democratic Development, will release today in Montreal the damning report, titled China's Golden Shield: Corporations and the Development of Surveillance Technology in the People's Republic of China. "The Chinese state has found an extraordinary ally in private telecommunications firms located primarily in Western countries. Many companies, including notably Nortel Networks, until recently Canada's largest firm, are playing key roles in meeting the security needs of the Chinese government," said the report. The centre is releasing the report to coincide with the Asia-Pacific Economic Co-operation meeting in Shanghai this weekend, to be attended by Prime Minister Jean Chrétien and U.S. President George W. Bush. International pressure for China to clean up its human-rights act appears to have lessened since the Communist country agreed to take part in the broad coalition fighting terrorism. China has used the war on terrorism to characterize Tibetans as "terrorists," something the Canada Tibet Committee calls "an excuse to stifle legitimate dissent and peaceful struggles for human rights and democracy." Tina Warren, a spokesman for Nortel, said the company had yet to receive the report and judged it "inappropriate" to comment until it is reviewed. The 40-page report, written by researcher Greg Walton, said Nortel and other firms are helping China build "a more sophisticated system of content filtration at the individual level." In the report's acknowledgements, Walton credits several online activists by their Internet monikers, including the Hacktivismo! Project, OxBlood Ruffin, Drunken Master, cDc, y Oda and "so many others - on both sides of the firewall - who very sensibly choose to remain anonymous." The report added, "Old-style censorship is being replaced with a massive, ubiquitous architecture of surveillance: the Golden Shield. Ultimately the aim is to integrate a gigantic online database with an all-encompassing surveillance network." The network would include speech and face recognition, closed-circuit television, smart cards, credit records and Internet surveillance technologies. China has already arrested numerous people for Internet-related crimes, from supplying E-mail addresses to Internet publications to circulating pro-democracy articles. The report suggests Nortel's privacy statement for the Internet, which states it will not sell, rent or share personal data with any other organization, appears at odds with its work in China. - ISN is currently hosted by Attrition.org ************************************************************************** Subscribe to Freematt's Alerts: Pro-Individual Rights Issues Send a blank message to: freematt(a)coil.com with the words subscribe FA on the subject line. List is private and moderated (7-30 messages per week) Matthew Gaylor, (614) 313-5722 ICQ: 106212065 Archived at http://groups.yahoo.com/group/fa/ **************************************************************************

1 0

EDRi-gram newsletter - Number 7.13, 1 July 2009
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 7.13, 1 July 2009 ============================================================ Contents ============================================================ 1. Article 29 Working Party on online social networking 2. Rapidshare forced by the court to filter more than 5000 tracks 3. Judge unbiased, no retrial for The Pirate Bay 4. 'Right to the silence of the chips' in the new EC Communication 5. Norway will not chase file-sharers 6. France: No to new EDVIGE! 7. Swedish court: IP addresses are personal data 8. The French Government acts like a bulldog with its three strikes law 9. ENDitorial: EU DP - state of the play, potential for enhancements 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. Article 29 Working Party on online social networking ============================================================ Article 29 Working Party issued on 22 June 2009 an opinion on how European privacy laws affect social networking sites such as Facebook or Myspace. The opinion states the social networking sites should be responsible for the compliance to European privacy laws and, on the other hand, that users of such sites should upload pictures or information about other individuals only with the consent of the respective individuals. Presently, social networking users share pictures and tag friends' images without requiring a prior consent and generally, communicate publicly, placing their own and others' private information on shared "walls". The Data Protection Authorities recommend that users are given the opt out choice and are warned of the privacy risks and on the personal data that is being made available to others. The opinion says that "the homepage should contain a link to a complaint facility covering data protection issues for both members and non-members". The group also draws attention to the processing of personal data on the Internet for commercial purposes, recommending that before using the collected data aimed for personalised advertisements, the sites should obtain the prior consent of the respective users. Data on sensitive topics such as race, religion or sexual orientation should not be processed or passed on to advertisers and individuals should be allowed to adopt a pseudonym. Special attention should be given to the processing of the minors' personal data. This is an opinion that has been lately supported by the European Commission which has announced future strong measures to regulate online tailored ads. The opinion also advises imposing limits on retaining the data of inactive users believing that abandoned accounts, together with their accompanying data, should be deleted. The Article 29 Working Party's opinion is based on the principle that social networking websites must be subject to the EU Data Protection Directive even when their headquarters are outside the European Union space. The group interprets the definition of "data controller" as covering the service providers who, therefore, must adhere to privacy laws. Although an exception is made for personal or "household" users, when users broadcast or gather information very widely via such sites, they become data controllers themselves which could affect users who organise concerts, human rights letter-writing campaigns or try to sell a homemade product online. The recommendations are not binding but show the trend in the legislative measures that might be taken in the future at the national as well as EU level. The group has focused lately on privacy issues related to search engines and its initiatives have led to actions in this direction. The big search engines such as Google, Microsoft and Yahoo!, have been pressed to reduce the retention period of data collected from their users. The opinion has implications on the way the responsibility of social networks themselves is seen in carrying images and information that could breach protecting privacy and security rules. The European Commission has lately focused more on protecting citizens and consumers' privacy and social networking websites are considered potentially dangerous for inexpert users. Information Society Commissioner Viviane Reding has shown her support to this line of action and has kept pushing the major players in this field in adopting a code of conduct meant to protect young users, threatening to otherwise take further action to protect privacy. Article 29 Data Protection Working Party - Opinion 5/2009 on online social networking (12.06.2009) English http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2009/wp163_en.pdf German version http://ec.europa.eu/justice_home/fsj/privacy/workinggroup/wpdocs/2009_de.htm French version http://ec.europa.eu/justice_home/fsj/privacy/workinggroup/wpdocs/2009_fr.htm EU data monitors outline Facebook ground rules (25.06.2009) http://euobserver.com/9/28370/?rk=1 EU privacy regulators eye online social networks (25.06.2009) http://www.euractiv.com/en/infosociety/eu-privacy-regulators-eye-online-soc… Citizens' privacy must become priority in digital age, says EU Commissioner Reding (14.04.2009) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/09/571&format=HT… EDRI-gram: Behavioural targeting at the European Consumer Summit (8.04.2009) http://www.edri.org/edri-gram/number7.7/behavoural-target-eu-consumers ============================================================ 2. Rapidshare forced by the court to filter more than 5000 tracks ============================================================ The file-sharing site Rapidshare.de has recently lost another case to the German copyright society GEMA, being ordered by the Regional Court in Hamburg to "proactively filter" more than 5000 tracks from GEMA's catalogue. In January 2008, another regional court in D|sseldorf had already found that RapidShare was responsible for what its users uploaded to the service. Hence, RapidShare implemented a screening process and maintained hashes of files that were pulled down for infringement but GEMA was not contented with this and went back to court. GEMA created a software that can search web forums and extract links to content that seem to infringe GEMA's copyrights but Rapidshare complained that the software did not work. "It's questionable whether the application can deal with mechanisms to prevent the scraping of links, open encrypted files, accurately identify audio files or find links in forums that can't be accessed by search engines," said Rapidshare CEO Bobby Chang. In October 2008, the court decided the systems implemented by Rapidshare were not efficient enough considering that "a business model that doesn't use common methods of prevention cannot claim the protection of the law." "The judgment states that the hosting service itself is now responsible for making sure that none of the music tracks concerned are distributed via its platform in the future. (...) This means that the copyright holder is no longer required to perform the ongoing and complex checks," was GEMA's statement. The decision may imply that, in the future, user-generated content sites located in Germany will need to take proactive, efficient measures to screen copyrighted material. "We do not consider the court's decision to be a breakthrough," said Chang, who added: "As other proceedings in similar disputes with GEMA have shown, there is considerable disparity amongst the individual courts in some cases. Our experience is that the courts of appeal tend to restrict the scope of the decisions made by the lower courts." Rapidshare has announced that they would appeal the verdict. Rapidshare to appeal German court decision (29.06.2009) http://www.afterdawn.com/news/archive/18325.cfm Rapidshare stung with 24m fine (24.06.2009) http://www.theregister.co.uk/2009/06/24/rapidshare_gema/ German Court Orders RapidShare to Proactively Filter Songs (23.06.2009) http://www.dmwmedia.com/news/2009/06/23/german-court-orders-rapidshare-proa… Achtung! RapidShare ordered to filter all user uploads (24.06.2009) http://arstechnica.com/tech-policy/news/2009/06/achtung-rapidshare-hit-with… EDRI-gram: RapidShare needs to check every file for copyright infringement (8.10.2008) http://www.edri.org/edrigram/number6.19/rapidshare-hamburg-decision ============================================================ 3. Judge unbiased, no retrial for The Pirate Bay ============================================================ On 25 June 2009, Sweden's Court of Appeal ruled that judge Norstrvm in The Pirate Bay (TPB) case was not biased as the lawyers representing TPB founders had claimed. Therefore there will be no retrial for TPB in Stockholm District Court. The TPB lawyers had accused Norstrvm of being in a conflict of interests as he was a member of several organizations funded by the recording industry organization IFPI. The Court of Appeal acknowledged that the judge was a member of organisations acting in the interests of rights holders, but emphasized that copyright holders benefited of constitutional protection under the Swedish law. "We have reached the conclusion that we do not agree with the conflict of interest claim," said appeals court judge Anders Eka to news agency TT. "For a judge to back the principles on which this legislation rests cannot be considered bias," said the court ruling. The court criticised Norstrvm for not having stated, before the trial, that he was a member of those organizations but considered this was not sufficient reason to declare the district court verdict null and void. "This is part of a pattern. It shows that the Swedish legal system is no longer to be trusted when it comes to copyright cases. It's a travesty of justice quite simply", commented newly elected European Parliament member Christian Engstrvm of the Swedish Pirate Party who added: "There are certainly problems with the laws too but this also shows that the courts are not capable of applying the laws in a correct manner. I've been a lay judge for seven years and I've never seen an indictment as bad as the Pirate Bay verdict. But that didn't stop the court from setting ridiculous sentences." The Pirate Bay defendants can still appeal the results of the first trial. One of them, Peter Sunde has stated: "The Pirate Bay will now file charges against Sweden for violation for Human Rights. ... (The bias-judge is himself biased...)". The Pirate Bay faces now another legal case brought to court by the Dutch anti-piracy organization BREIN which wants to close the file-sharing site in the Netherlands and see three of TPB founders to court on 21 July. As the organization was unable to find the exact whereabouts of the three men, it used Twitter and Facebook social networking websites to deliver the court summons. "The internet works both for those who respect copyrights and those who violate them. Now they know that the hearing will take place on July 21st in Amsterdam," said BREIN CEO Tim Kuik. However, it remains to be seen whether the summoned founders will show up. Neij who is living in Bangkok, Thailand, claimed he had seen no summons on the respective sites. "I have Twitter and Facebook accounts, but I haven't seen anything about it," he told the TT news agency. In a recent announcement posted by Thelocal.se on 30 June 2009, said that The PirateBay "is set to be purchased for 60 million crowns (approx. $5.55 million euros) by Global Gaming Factory X (GGF), a company specializing in internet cafi management software." GGF said in its statement that it wanted content providers and copyright owners to get paid for content downloaded. TPB has confirmed on their blog that they might get aquired by the above mentioned company. No retrial in Pirate Bay case (25.06.2009) http://www.thelocal.se/20280/20090625/ Dutch Antipiracy Organization Takes Aim at Pirate Bay (24.06.2009) http://www.pcworld.com/article/167273/dutch_antipiracy_organization_takes_a… Pirate Bay served with Dutch lawsuit via Twitter and Facebook (24.06.2009) http://www.thelocal.se/20244/20090624/ Pirate Bay retrial denied; judge declared "unbiased"(25.06.2009) http://arstechnica.com/tech-policy/news/2009/06/pirate-bay-retrial-denied-j… Swedish IT company to buy Pirate Bay (30.06.2009) http://www.thelocal.se/20364/20090630/ ============================================================ 4. 'Right to the silence of the chips' in the new EC Communication ============================================================ A new communication from the European Commission to the other European bodies on the RFID (radio-frequency identification) titled "Internet of Things - An action plan for Europe" was made public on 18 June 2009. The communication builds on the work of the Recommendation on the use of RFID published on 12 May 2009 after a fifteen-month period of consultations. The communication includes a 14-point action plan to address the main issues raised from the RFID usage as discussed in the working group and in the consultation period. One of the most important action point is the launch of "a debate on the technical and legal aspects of the 'right to silence of the chips', which has been referred to under different names by different authors and expresses the idea that individuals should be able to disconnect from their networked environment at any time." This is one of the main actions of the plan in order to allow the usage of the RFID while respecting privacy and the protection of personal data, two fundamental rights of the EU. The communication underlines that these rights will have an influence on how the Internet of Things is conceived but, at the same time, its development will affect the way we understand privacy. The European Commission also announced that in 2010 it intends to publish a broader Communication on privacy and trust in the ubiquitous information society. The Communication makes it clear that "simply leaving the development of Internet of Things to the private sector, and possibly to other world regions is not a sensible option." Thus, the concept of governance of the RFID usage will be initiated and promoted by the Commission in international fora in order to establish a set of principles and to set up an "architecture" with a sufficient level of decentralised management. Communication from the Commission to the European Parliament: Internet of Things - An action plan for Europe (18.06.2009) http://ec.europa.eu/information_society/policy/rfid/documents/commiot2009.p… EU lays out plans for the "internet of things" (18.06.2009) http://www.v3.co.uk/computing/news/2244448/eu-prepares-mass-rfid EDRi-gram: RFID and Informed Consent - Using and removing of RFID functionality (5.12.2007) http://www.edri.org/edrigram/number5.23/rfid-informed-consent EDRi-gram: EU supports RFID with proper protection of consumers' privacy (20.05.2009) http://www.edri.org/edri-gram/number7.10/rfid-european-commission-recommand… ============================================================ 5. Norway will not chase file-sharers ============================================================ The Norwegian data protection authority has decided that ISPs had to delete all IP address-related data just 3 weeks after collection, a decision that will make difficult to chase file-sharers. The regulator started with two ISPs, Tele2 and Lyse Tele but the decision, subject by the Personal Data Act, will apply to all ISPs in Norway. As Norway is not a member of the European Union, it is not bound to comply to the European data retention directive which says that this type of data must be held for at least 6 months. In Norway, now, data retention can go from a few days to five months. The Norwegian telecom regulator has also recently ruled that the identity of file-sharers can be disclosed to copyright holders only by court order. And to make things even tougher for copyright holders, Simonsen law firm, the only legal company having had a licence to track file-sharers, has seen it expire with no renewal provided. Simonsen has had the licence since 2006 having been enabled to monitor alleged pirates and collect their IP addresses. The licence was however temporary and it won't be renewed due to the very little debate on the matter. Data protection authorities have requested legislative clarification on what the license can and cannot do, but have not received the requested information from the competent authorities. Simonsen lawyer Espen Txndel said that his law firm would object against the non-renewal of their license. "One can not deny (the copyright holders) their right to protect their interests in this way," he said. Anti-Piracy Lawyers Lose License To Chase Pirates (22.06.2009) http://torrentfreak.com/anti-piracy-lawyers-loses-license-to-chase-pirates-… Data Protection Makes Identifying Online Pirates a Nightmare (10.06.2009) http://torrentfreak.com/data-protection-makes-identifying-online-pirates-a-… Norway organises the immunity of P2Ps (only in French, 25.06.2009) http://www.numerama.com/magazine/13272-La-Norvege-organise-l-immunite-de-se… Anti-Piracy Lawyers Thwarted in Norway (23.06.2009) http://www.tomsguide.com/us/Anti-Piracy-Twarted-Lawyers-License,news-4114.h… ============================================================ 6. France: No to new EDVIGE! ============================================================ A text of a draft law on Police Files initiated by the two French deputies Delphine Batho and Jacques-Alain Binisti has been approved by the Laws Commission of the National Assembly. The draft law contains a new form of the EDVIGE file, nicknamed now EDVIGE 3.0. EDVIGE was a new database created in June 2008 with the purpose of filing "individuals, groups, organisations and moral persons which, due to their individual or collective activity, are likely to attempt to public order". Not only these persons will be filed (without any offence committed), but also "those who undertake or have undertaken direct and non fortuitous relations with them." Filing was supposed to start at age 13 and the database would be used by French intelligence services and the administrative police. Following a massive civil society protest, the database was initially revised into EDVIRSP (or so-called EDVIGE 2.0) and then withdrawn in December 2008. Although it makes some significant progress, the text of the new law is still not good enough in respecting the human rights, as underlined by a common press release of several unions and civil society groups, among which the EDRi-member IRIS. One of the major concerns that the press release highlights is the generic global tendency that wants to extend the methods and tools used for serious crimes and terrorism acts to the "small delinquency". The main step forward is that according to the new text every new Police file needs to be stipulated by law. At the same time the "No to EDVIGE" group considers that the law should go much further, including a better democratic character of the CNIL (French Data Protection) by the inclusion of some members proposed by the human rights activists. Also, the new draft laws which receive a negative opinion from the CNIL should get an opinion from the State Council (Conseil d'Itat) and all these opinions need to be made public. The new law proposal also includes new provisions for EDVIGE 3.0 which is still covers all the children above13 years old. But this proposal goes even further than the two earlier versions. The definitions suggested in the new draft proposal introduce dangerous provisions. Thus, the very large definitions of the attacks on the people's security or goods cover activities of the police which are already supported by other existing databases. The "No to EDVIGE" group asks for a limitation of the acts of attacks to the State security and public security committed with violence. Also the new file should not include minors. The French organisations also criticized the qualification given to other files, such as STIC (Systhme de traitement des infractions constaties - Recorded offences treatment system), a huge police database, which records also data on minors, without any age limitation. Law proposal on Police Files: EDVIGE 3.0, still NO (only in French, 19.06.2009) http://www.iris.sgdg.org/info-debat/comm-fichierspolice0609.html Law proposal on Police Files (only in French, 7.05.2009) http://www.assemblee-nationale.fr/13/propositions/pion1659.asp The deputies want to frame the creation of police files (only in French, 18.06.2009) http://www.lesechos.fr/info/france/4876857-les-deputes-veulent-encadrer-la-… EDRi-gram: ENDitorial: Massive mobilization against EDVIGE, the new French database (16.07.2008) http://www.edri.org/edrigram/number6.14/edvige-french-database EDRi-gram: French EDVIGE decree withdrawn (4.12.2008) http://www.edri.org/edri-gram/number6.23/edvige-retired ============================================================ 7. Swedish court: IP addresses are personal data ============================================================ The Swedish Supreme Administrative Court ruled on 18 June that the IP addresses are personal data in a case regarding APB (the Swedish Anti-Piracy Bureau, Antipiratbyren), a lobby group representing copyright owners. However, from the comments following the judgement, it became clear that this ruling will not stop the implementation of the Swedish IPRED Directive or the way the copyright holder representatives record and keep IP addresses in order to identify alleged file-shares. Although the ruling means that APB's methods for chasing filesharers by logging their IP addresses was in violation of the Personal Data Act, the new IPRED law changed the situation. A policy adviser at the Swedish Ministry of Justice explained to The Register: "The rumours that this decision will kill off IPRED are wrong, because the bill creating the law includes an exemption for rights holders - they may request and keep IP numbers for this purpose." Jonas Agnvall, a legal adviser with the Swedish Data Inspection Board, says that the new IPRED law specifically allows the activities of IP logging of the APB: "I have not scrutinised the directive in detail, but as I understand do they no longer need the legal exception whit the implementation of the IPRED-law", Jonas Agnvall says to Computer Sweden. He also added: "During the autumn we will inquire this and how these lobby groups of copyright holders use the personal records. This we can do now when it stands clear that IP addresses' really are personal records". A week later, on the 25 June 2009, a first ruling on the new IPRED law was given by the Solna District Court which decided that an ISP must hand information revealing its customers based on the IP addresses given by five publishers of audiobooks who were trying to identify some alleged copyright offenders. In this case, the Swedish broadband service provider Ephone was asked by the five publishers to reveal who owned a server suspected of containing some several hundred audio book titles. The ISP refused to say who was behind the IP address, questioning if the matter was indeed a copyright infringement since the FTP server was not publicly available and the access to it was possible only to the persons that knew the password to access it. In the decision of the Solna District Court, the judges ordered Ephone to reveal the information regarding the customers that are using several IP addresses under a penalty of 750 000 Swedish crowns fine (approx. 70 000 euros). The company also needed to pay the publishers' court costs. Collecting IP Addresses Illegal in Sweden (18.06.2009) http://torrentfreak.com/collecting-ip-addresses-illegal-sweden-090618/ Favorable court ruling do not save file-sharing (18.06.2009) http://www.stockholmnews.com/more.aspx?NID=3440 Sweden: IP numbers are personal...unless you're a pirate (18.06.2009) http://www.theregister.co.uk/2009/06/18/sweden_ip_law/ Publishers win anti-piracy law test case (25.06.2009) http://www.thelocal.se/20274/20090625/ First IPRED case settled (only in Swedish, 25.06.2009) http://www.svd.se/naringsliv/it/artikel_3115633.svd ============================================================ 8. The French Government acts like a bulldog with its three strikes law ============================================================ Nicolas Sarkozy and the French Government want to go on with the new three strikes draft law (called also Hadopi 2) which was presented to the Council of Ministers on 24 June 2009. The emergency procedure has been initiated and therefore the two chambers will have only one reading for the text. The new text will be first presented to the Senate on 8 and 9 July to be further on examined by the deputies, presumably starting with 22 July. The draft law including now five articles stipulates, besides the disconnection of the alleged infringer which has to be decided by the court, fines that can amount to 1 500 euros or 3 000 euros in case of repeated offences. The new version has reintroduced an extension previously rejected by the deputies in the first text: a user can be condemned not only for "piracy" through an online public communication service, but also for "piracy" by any electronic communication means. This means that the judges will be able to sanction "piracy" that was performed also by instant messaging services or e-mails. And, in order to soften the censure imposed by the Constitutional Council, the new text introduces a legal instrument that would allow the justice system to use simplified procedures in applying sanctions "against the authors of illegal downloading. A fast and efficient treatment of the cases will thus be ensured by means of penal ordinances". So, the court can decide, by penal ordinance, to condemn an alleged infringer to pay a fine in his absence. The text thus includes "Internet piracy" on the same list of infringements with the use of hallucinogenic drugs or violations of the traffic code. The infringement is established by Hadopi authority officers who then notify the police. Their reports are considered "truthful until proven otherwise" which actually implies there is no presumption of innocence. Unfortunately, the Constitutional Court seems to have left an open door for the culpability presumption by saying that the legislator can exceptionally establish such presumptions under certain conditions such as the respect of the defense right. The file is then sent to the public ministry which can choose the simplified procedure and sends it to the president of the court who establishes without prior debate a penal ordinance applying or not a fine. The subject of the fine is never heard. The procedure gives the court president the possibility to ask for a contradictory debate in which case the file is sent back to the public ministry. The penal ordinance is given by a sole judge, which is the president of the court and includes the names and coordinates of the alleged infringer, the date and place of the alleged infringement and the sanctions. The sanctions are then carried out by the public ministry within a period of 10 days. The user can make an appeal within 45 days and present himself in front of a magistrate for a new judgment but the risk is that, in case the user is found guilty, the sanction can be aggravated up to a maximum of 3 years in prison and 300 000 euros of fine. Actually, the new text introduces the three-strikes in an even harder version: warning, fine and then disconnection. The only improvement is that the disconnection can be decided only by the court and that is also shadowed by the simplified procedure allowing for the penal ordinance. Hadopi 2 starting on 8 July in the Senate (only in French, 26.06.2009) http://www.numerama.com/magazine/13283-Hadopi-2-des-le-8-juillet-au-Senat.h… Hadopi 2: the surveillance of e-mails is back (only in French, 25.06.2009) http://www.numerama.com/magazine/13273-Hadopi-2-la-surveillance-des-e-mails… Fine for illegal downloading, how does it work ? (only in French, 25.06.2009) http://www.01net.com/editorial/503828/amende-pour-telechargement-illegal-co… Hadopi: and now, the fines... (MAJ) (only in French, 24.06.2009) http://www.01net.com/editorial/503668/hadopi-et-maintenant-les-amendes-(maj… Draft law on the legal protection of literary and artistic copyright on the Internet (only in French, 29.06.2009) http://www.legifrance.gouv.fr/html/actualite/actualite_legislative/pl_prote… The French Constitutional Council censures the 3 strikes law (17.06.2009) http://www.edri.org/edri-gram/number7.12/3-strikes-censured-council-constit… ============================================================ 9. ENDitorial: EU DP - state of the play, potential for enhancements ============================================================ With the title "Personal data - more use, more protection?" the European Commission organised on 19 and 20 May 2009 a data protection (DP) conference in Brussels. The purpose of the conference was to look for new challenges for privacy and to kick off a process towards a new quality of data protection for the European Union. On invitation of the European Commission, Andreas Krisch participated on behalf of EDRi. The topics of the one and a half day conference included a wide range of areas related to data protection. Amongst them: data protection in the area of law enforcement, data retention, the role of businesses as well as supervisory authorities and consumer protection. Following the presentations on data retention by Kurt Alavaara (National Police Board, Sweden) and Francis Stoliaroff (Ministry of Justice, France) a long debate on the legitimacy of the data retention directive took place. Spiros Simits (Goethe-University Frankfurt am Main) argued that data retention not only is in violation of fundamental rights and against the German constitution but also violates the fundamental principles of data protection, especially the principle of purpose limitation. Panellist Douwe Korff (London Metropolitan University) concured by saying that for vague purpose specifications the interpretation is different in the member states. While some countries differentiate between the purposes of prevention and prosecution of crimes others simply subsume these with the term "police purposes" with huge implications regarding the access to retained data. Furthermore, he made clear that communication traffic data is personal data. Finally Waltraud Kotschy (Austrian Data Protection Commission) joined the discussion and stated that, in her view, it will be impossible to keep the access to retained data restricted to cases of terrorism and organised crime. Already now there are discussions in Austria on access to data for purposes of copyright enforcement. These and similar discussions will gain momentum once data retention is in place. For all presentations and discussions of the first day of the conference a webcast of 15 minutes of discussion with English, German and French translations is available on the EC website and definitely worth viewing. The role of business and personal data protection was the title of my presentation. Starting with a general overview of commercial data collection on shopping and communication habits, financial, location and movement information, I argued that in many cases commercial data collection leads to the use of these data by the state. Examples for this include but are not limited to the SWIFT case where US authorities accessed data on EU financial transactions, PNR data where the EU grants the US access to passenger information and plans to access these data as well, and the mandatory data retention where EU member states retain and access data on communications of 490 million people. Given these practices, the significance of commercial data collection cannot be overestimated and the 1983 ruling of the German Constitutional Court reasoning that "... an as such inconsequential date can get a new significance;" and that "insofar there is no 'inconsequential' date anymore under the conditions of modern data processing", has more relevance today than ever before. At the same time, we see significant weaknesses at the counterparts of these data controllers, the data protection authorities. On the one hand, they are often confronted with very limited financial and personal resources and therefore are also limited in their possibilities to enforce data protection legislation. On the other hand, we also see problematic decisions - or at least problematic reasoning - of data protection authorities (see Privacy International on the UK Information Commissioner). In addition, it is also clear that traditional means of oversight will be unable to cope with the immense increase of the amount of data being processed. Present means for individual data protection are also limited and often impose relatively high financial risks for legal procedures in combination with relatively little potential gains in individual cases. Improvements of data protection and data protection legislation can therefore be achieved by expanding the possibilities for individual data (self-)protection (e.g. easier and less risky legal procedures; evaluation of current practices regarding "informed consent" of data subjects), the introduction of mandatory data breach notifications and punitive damages on a per data basis in cases of data leaks. With regard to the area of Radio Frequency Identification and the Internet of Things it will be necessary to follow the developments carefully and to evaluate if current data protection concepts still provide sufficient means to address the data protection challenges introduced by these technologies. Additionally, positive measures need to be also taken. Tools and mechanisms that help businesses to prove and publicly communicate their compliance with data protection legislation, like the European Privacy Seal (EuroPriSe), should get a strong foundation in the European data protection legislation. The introduction of mandatory data protection officers for companies would not only help companies to establish data protection mechanisms in their organisations and to work internally on improvements but would also bring positive effects for the relationship between companies and their customers by providing a competent contact person for questions related to data protection. Finally, better educational information on data protection is needed to ensure that young people have access to relevant first hand information on data protection and their possibilities to protect their privacy. The future will show what this process towards a new quality of data protection for the European Union brings. For the time being, it is to say that the European Union has at least two faces when it comes to data protection. On the one hand, important steps towards data protection in the area of RFID and the Internet of Things are taken, but on the other hand, the planned Stockholm Programme on Justice and Home Affairs policy for the next five years describes the way towards a surveillance society in which the floods of the digital tsunami threaten to overwhelm the data protection rights of individuals in Europe. Conference "Personal data - more use, more protection?" (19-20.05.2009) http://ec.europa.eu/justice_home/news/events/news_events_en.htm#dp_conferen… Conference Programme "Personal data - more use, more protection?"(19-20.05.2009) http://ec.europa.eu/justice_home/news/events/conference_dp_2009/programme_e… Webcast of the discussion on data retention (Simits, Korff, Kotschy and others) at the conference http://webcast.ec.europa.eu/eutv/portal/jsf/_vi_fl_300_en/player/index_play… Webcast of the presentation by Andreas Krisch "The Role of Business and Personal Data Protection" http://webcast.ec.europa.eu/eutv/portal/jsf/_vi_fl_300_en/player/index_play… PI calls for review of UK privacy regulator following series of failed judgements (23.04.2009) http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-564402 European Privacy Seal (EuroPriSe) https://www.european-privacy-seal.eu/ EDRi-gram: Stockholm programme - the new EU dangerous surveillance system (17.06.2009) http://www.edri.org/edri-gram/number7.12/stockholm-programme-eu-surveillance EDRi-gram: EU supports RFID with proper protection of consumers' privacy (20.05.2009) http://www.edri.org/edri-gram/number7.10/rfid-european-commission-recommand… EDRi-gram: 'Right to the silence of the chips' in the new EC Communication (1.07.2009) http://www.edri.org/edri-gram/number7.13/right-silence-of-the-chips (Contribution by Andreas Krisch - EDRi) ============================================================ 10. Recommended Reading ============================================================ Briefing on the Interception Modernisation Programme by the LSE Policy Engagement Network http://www.lse.ac.uk/collections/informationSystems/research/policyEngageme… Deep Packet Inspection and Internet Censorship: International Convergence on an 'Integrated Technology of Control' http://advocacy.globalvoicesonline.org/wp-content/plugins/download-monitor/… http://advocacy.globalvoicesonline.org/2009/06/25/study-deep-packet-inspect… Final Report on the Content Online Platform http://ec.europa.eu/avpolicy/docs/other_actions/col_platform_report.pdf http://ec.europa.eu/avpolicy/other_actions/content_online/index_en.htm ============================================================ 11. Agenda ============================================================ 2-3 July 2009, Padova, Italy 3rd FLOSS International Workshop on Free/Libre Open Source Software http://www.decon.unipd.it/personale/curri/manenti/floss/floss09.html 6-7 July 2009, Barcelona, Spain Fifth Internet Law & Politics Conference organized by the Law and Political Science Department of the Universitat Oberta de Catalunya The Pros and Cons of Social Networking Sites. http://www.uoc.edu/symposia/idp2009/engl/index.html 13-16 August 2009, Vierhouten, The Netherlands Hacking at Random http://www.har2009.org/ 23-27 August 2009, Milan, Italy World Library and Information Congress: 75th IFLA General Conference and Council: "Libraries create futures: Building on cultural heritage" http://www.ifla.org/IV/ifla75/index.htm 10-12 September 2009, Potsdam, Germany 5th ECPR General Conference, Potsdam Section: Protest Politics Panel: The Contentious Politics of Intellectual Property http://www.ecpr.org.uk/potsdam/default.asp 16-18 September 2009, Crete, Greece World Summit on the Knowledge Society WSKS 2009 http://www.open-knowledge-society.org/ 17-18 September 2009, Amsterdam, Netherlands Gikii, A Workshop on Law, Technology and Popular Culture Institute for Information Law (IViR) - University of Amsterdam http://www.law.ed.ac.uk/ahrc/gikii/2009.asp 21-23 October 2009, Istanbul, Turkey eChallenges 2009 http://www.echallenges.org/e2009/default.asp 24-25 October 2009, Vienna, Austria 3rd European Privacy Open Space http://www.privacyos.eu 25 October 2009, Vienna, Austria Austrian Big Brother Awards Deadline for nominations: 21 September 2009 http://www.bigbrotherawards.at/ 16 October 2009, Bielefeld, Germany 10th German Big Brother Awards Deadline for nominations: 15 July 2009 http://www.bigbrotherawards.de/ 13-15 November 2009, Gothenburg, Sweden Free Society Conference and Nordic Summit http://www.fscons.org/ 15-18 November 2009, Sharm El Sheikh, Egypt UN Internet Governance Forum http://www.intgovforum.org/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Passport RFID tracking: a between-the-lines read [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: Your RFID passport tracker is ready... Date: Mon, 2 May 2005 15:24:03 -0500 From: Parks <parks(a)uhibpd.phys.uh.edu> To: Declan McCullagh <declan(a)well.com>, politech(a)politechbot.com Declan, I think you might find this interesting. I confirms my vision of a future where entry points are wired and read your ID and identify your possessions through wireless RFID transmitters built into everything from passports, ID cards, credit cards, and products we buy off the shelves. - Drew >From the EE-Times, a between the lines look at the future of RFID tracking: re: E-passport makers hail U.S. retreat Junko Yoshida [FAIR USE] EE Times (04/29/2005 1:38 PM EDT) PARIS - Global electronic passports suppliers hailed a decision by the U.S. State Department to drop a requirement for additional security measures in next-generation U.S. passports. The specifications have yet to be finalized. Neville Pattinson, director of technology development and government affairs for smart card provider Axalto Americas, said Friday (April 29) that adding security measures such as "Basic Access Control" and a metallic shield cover to U.S. passports could "completely make the information [stored in the e-passport] undetectable." ME> They can be read from an RFID reader while your passport is in your pocket by stealthy information miners. These RFID chips are the same kind that the stores are putting on products and they all may be read as you pass through an entry or exit point. The point is that THEY want to use these as tracking devices. Note the comment about metallic shields. You can put your future drivers license (when they put RFID in them too) or passport in tin foil or a metallic case. Pattison originally disclosed the results of a National Institute of Standards and Technology e-passport trial held last summer in which he said NIST testers were able to lift "an exact copy of digitally signed private data" from a contactless e-passport chip 30 feet away. A State Department official earlier this week acknowledged for the first time that information stored inside an e-passport chip could be read at a distance beyond 10 centimeters. ME> Bull - they know its range is METERS not centimeters!!! ME> GO TO EE-TIMES for the entire article but this should be proof enough.... ....Barry Steinhardt, director of the Technology & Liberty Program at the American Civil Liberties Union, asked, "Why do we need to have a contactless circuit at all in an identity document?" ...e-passport chips provide a digital data payload,...basic information such as a digital photo is stored electronically, technologies like ***facial recognition*** can be used... ME> Oh yah, get EVERYONES e-mug and store it in Big Brother's database so cameras can track you anywhere you go. _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0