July 2018 - cypherpunks-legacy

[IP] BBC News: ID cards are of 'limited value'
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[liberationtech] Mechanical Turk is not anonymous
by Yosem Companys 06 Jul '18

06 Jul '18

From: Matt Lease ml(a)ischool.utexas.edu via asis.org This may be of interest to those in community using Amazon's Mechanical Turk platform for research, as well as those more generally interested in how online data can be linked in ways that can be surprising to people in practice and compromise their privacy in a manner they didn't expect. Several collaborators and I have just announced discovery of a vulnerability on Amazon's Mechanical Turk platform, with potential implications for IRB governance of human subjects research using AMT at US universities. In particular, this vulnerability can be exploited to obtain personally identifying information (PII) and other private information of some workers, who may have shared this information online in a way they did not recognize could be linked to their WorkerIDs. This may impact IRB oversight of research conducted at UT with AMT, as well as what research is classified as human research and subject to IRB governance. I am just starting to follow up on this now with our IRB coordinator here at UT Austin. The announcement of our finding is below: Blog post: http://crowdresearch.org/blog/?p=5177 Paper: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2228728 We are now trying to get the word out to be AMT workers, as well as researchers whose might be impacted or who may have posted WorkerIDs online which could be compromised via this vulnerability. We would appreciate your help with this. We are also specifically advocating *against* online posting of WorkerIDs due to the risk of workers not having realized that information they have shared could be linked with their worker accounts. Regardless of the vulnerability, we have also found explicit requests from workers to not post such uniquely identifying information. Thanks, Matt -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[ISN] Wireless LANs: Trouble in the Air
by InfoSec News 06 Jul '18

06 Jul '18

http://www.computerworld.com/cwi/story/0,1199,NAV47_STO67344,00.html By BOB BREWIN, DAN VERTON AND JENNIFER DISABATINO January 14, 2002 As the airline industry scrambles to meet a Jan. 18 deadline to screen every checked bag for explosives, security experts, analysts and government officials are raising serious concerns about the security of wireless technology that's integral to the effort. At issue is the adoption by airlines of industry-standard 802.11b, or WiFi, wireless LANs operating in the 2.4-GHz band. These systems, which are widely viewed as inherently insecure, are being used to support such applications as bag matching and curbside and roving-agent check-in. The concerns appear to be justified, based on two investigations that were conducted last week by professional security firms that analyzed airline wireless LAN systems at Denver International Airport and San Jose International Airport. The analysis in Denver was conducted Jan. 9 by White Hat Technologies Inc., a Westminster, Colo.-based security firm. It revealed that American Airlines Inc. operated wireless LANs totally in the clear without any encryption in its portion of the DIA terminal. The vulnerability of the American Airlines wireless LAN networks was highlighted by the fact that the security specialists witnessed an intrusion while conducting their monitoring. According to a report furnished to Computerworld, security of the wireless LANs supporting Fort Worth, Texas-based American's curbside check-in stands was further compromised by the fact that the IP address of the curbside terminal was prominently pasted on the monitor. Except for an administrative network operated by the Denver International Airport authority itself, none of the networks monitored by the security specialists had turned on even the simplest form of encryption: the 40-bit Wired Equivalent Privacy encryption algorithm. Thubten Comerford, CEO of White Hat Technologies, said airlines that operate unprotected 802.11b wireless networks "are putting themselves and our nation's security at risk." Even when encryption is enabled, wireless LANs "are a serious liability," Comerford added. A scan of wireless networks at San Jose International Airport on Jan. 10 produced similar results. Jonas Luster, co-founder of D-fensive Networks Inc. in Campbell, Calif., which conducted the analysis in San Jose, said the wireless LANs there had few safeguards against intruders. Luster said he was easily able to pick up signals and sensitive network information emanating from the wireless LANs belonging to American Airlines and Dallas-based Southwest Airlines Co. American's curbside check-in operations could be monitored, Luster said, and Southwest's networks were issuing information from back-end systems, including at least three Unix servers running the Solaris operating system. RIP Weakness "In a matter of minutes, you could sniff out whatever you wanted," said Luster, who added that the routing infrastructure at both airlines was open to exploitation. Routing Information Protocol (RIP), a high-level language that transmits routing updates at regular intervals, can be modified easily to assist a hacker, said Luster. "By injecting a wrong RIP response, I could declare myself a legitimate, authoritative, powerful node on the network," said Luster. Although American acknowledged the vulnerability of the 802.11b standard, it downplayed the seriousness of the situation. "This particular issue is a very temporary one and a very noncompromising one," said American CIO Monte Ford. American is already on track to roll out a proprietary security system to replace 802.11b well before an industry-standard improvement is adopted, Ford said. And he added that even if a hacker was able to locate passwords, he would still be unable to access applications and databases. "A password is not a free ticket to our network, by any stretch of the imagination," he said. "They can just see points on the network. They can't get into applications." Ford said American doesn't plan to use positive bag matching to meet the Jan. 18 deadline Congress has set for the airlines to implement some means of screening all checked baggage. It does plan to start using a bag-matching system later this year, Ford added. American Airlines' visibility is at least partly attributable to the fact that it has been ahead of the curve in wireless LAN deployment. Delta Air Lines Inc., United Air Lines Inc. and Southwest Airlines all declined to comment for this story, citing security concerns. Northwest Airlines Inc. and Continental Airlines Inc. didn't return calls seeking comment by deadline. In any case, there appears to be no coordinated effort among the airlines to address wireless security issues. For its part, American currently uses its wireless LANs only for curbside check-in and roving agents, and Ford said that even if intruders penetrated the network, they could do little damage. That's because American's core systems are hosted by Fort Worth, Texas-based Sabre Inc. on an IBM transaction processing facility (TPF) system that's generally viewed as extremely difficult to hack because of the rigid and arcane structure of TPF. "It's not possible that you could get into the kinds of things that could do damage," said Richard Eastman, an airline industry consultant at Newport Beach, Calif.-based The Eastman Group. The TPF-based reservation system is a deep matrix, with passwords embedded in each level, explained Michael Anderson, director of airport systems at Sabre. But that doesn't satisfy Joe Weiss, vice president of the network applications division at Annapolis, Md.-based Aeronautical Radio Inc. (Arinc), a communications services provider owned by a consortium of airlines. Weiss said he's concerned that a hacker could use an unprotected wireless LAN to hop into core airline operational systems. These systems include flight operations, bag matching and passenger reservations. Flight operations systems manage such vital functions as refueling, maintenance and flight dispatch, Weiss said. Weiss expressed concern that access to a bag-matching system could allow an attacker to manipulate the system to show that luggage belonged to a boarded passenger when in fact it did not. This concern is one reason Arinc plans to abandon the 802.11b-based bag-matching system it operates as a shared resource system for all carriers with international flights at San Francisco International Airport. Arinc said it will switch to a private wireless system operating in the 800-MHz band. That system will be based on Integrated Digital Enhanced Network (IDEN) voice and data terminals developed by Schaumburg, Ill.-based Motorola Inc. IDEN provides more robust security than wireless LANs, Weiss said, including software keys for each terminal. Arinc plans to encrypt the network traffic as well. Presidential Concerns The security weakness of wireless LANs used throughout the nation's critical industries, including airlines, hasn't gone unnoticed at high levels of the Bush administration. A senior White House official said wireless security initiatives are at the top of the 2002 agenda for the president's newly established Critical Infrastructure Protection Board. At least one white paper is in development that will examine wireless LANs and the interconnections between wireless devices and critical infrastructure systems, such as Federal Aviation Administration networks. The U.S. Department of Transportation (DOT) and two of its key agenciesthe FAA and the newly formed Transportation Security Agency (TSA)plan to take a critical look at wireless LAN security over the next year. Mike Brown, director of information security at the FAA, said that in this new security-conscious era, airline wireless systems are subject to increased scrutiny. The DOT has formed a "go team," led by Associate CIO Lisa Schlosser, that will examine existing airline wireless systems, including LANs. In partnership with the FAA, the TSA and private industry, it will develop security standards and define a general wireless architecture, Brown said. Though American Airlines downplayed the vulnerability of its wireless networks in San Jose and Denver, some security analysts viewed the potential threat as significant and symptomatic of the airline industry's failure to properly address network security. James Foster, a senior consultant and researcher at Guardent Inc., a security firm in Waltham, Mass., has conducted several wireless security audits during the past year that have uncovered significant vulnerabilities in and around major airport facilities, including John F. Kennedy International Airport in New York and Boston's Logan International Airport. "Possible baggage system vulnerabilities do not surprise me," said Foster. "This is a serious problem that puts lives and the U.S. infrastructure at risk." Although he wouldn't provide details about specific airlines, Foster's wireless security audits have shown that a skilled hacker with the right software tools would need only seconds to conduct a detailed reconnaissance of an airline's wireless network. "Most of the time these [wireless systems] are tied to back-end systems," Foster said. Regardless of how arcane or proprietary those networks may be, "it's only a matter of time until somebody figures out how it works, how it communicates and how people authenticate," he said. "It would take no more than an hour to figure out how the system worked." - ISN is currently hosted by Attrition.org To unsubscribe email majordomo(a)attrition.org with 'unsubscribe isn' in the BODY of the mail. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

[IP] more on WORTH READING "Total Information Awareness" - secretly funded in defiance of Congress]]]
by Dave Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: Re: [IP] WORTH READING "Total Information Awareness" - secretly funded in defiance of Congress]] Date: Sat, 25 Feb 2006 14:41:51 -0800 From: Lee Tien <tien(a)eff.org> To: dave(a)farber.net References: <43FFBB04.9070108(a)farber.net> Dave, The problem IMHO is that killed programs can be and are reanimated in this secret, black-budget, nudge-wink underground out of public view, not that privacy advocates sought to stop TIA. The "you naive fools drove it underground" attitude is a bit like blaming the Supreme Court, Congress, and the Constitution for the president's warrantless surveillance program: "You really shouldn't have insisted on procedural/substantive restraints and accountability, because you're just forcing me to do it secretly." (Would that privacy advocates had a tiny fraction of the power implied here!) Put another way, the programs' proponents don't seem to like meaningful civil-liberties accountability and have institutional escape hatches for avoiding such. Accordingly, I think it's dumb to criticize privacy advocates in this or other similar contexts. --Why not blame those who resurrected or permitted the resurrection of the "more potentially nefarious bits"? --Why not blame those who didn't continue to fund the privacy and security research?* More important, how do we create truly workable public accountability/oversight mechanisms for a politically powerful, extremely secretive executive branch? Sadly, I no longer believe that congressional intelligence committees provide meaningful oversight on civil-liberties issues. Lee *My recollection is that the "privacy appliance" (Genisys Privacy Protection, Teresa Lunt) either wasn't part of the original TIA portfolio (see http://www.eff.org/Privacy/TIA/overview.php, where we presented the TIA program as it was when we first learned about it) or was buried inside Genisys and then trotted out in response to privacy concerns. Also see Poindexter's presentation at DARPAtech 2002 near the bottom of http://www.eff.org/Privacy/TIA/, which mentions Genisys but not Genisys Privacy Protection. At 9:03 PM -0500 2/24/06, Dave Farber wrote: >-------- Original Message -------- >Subject: Re: [IP] "Total Information Awareness" - secretly funded in >defiance of Congress] >Date: Fri, 24 Feb 2006 20:02:20 -0500 >From: Peter Harsha <harsha(a)cra.org> >To: dave(a)farber.net >References: <43FF92D2.1050908(a)farber.net> > >Hi Dave, > >I blogged a bit about this way back in April 2004, noting some of my >frustration that the rush to kill TIA would kill the privacy and >security research that was underway and drive the more potentially >nefarious bits of the program deeper into the black, hidden from view. > >http://www.cra.org/govaffairs/blog/archives/000069.html > >The post was in the context of a review of some of the interesting >sessions I'd attended at the Computers Freedom and Privacy conference >that year, but here's the relevant bit about TIA (see the blog for >all the embedded links): > >A number of speakers made the point (though Doug Tygar probably made >it most emphatically) that the government spends a disproportionate >amount of its IT privacy and security research funding on security >rather than privacy. Given the current state of funding for federal >cyber security R&D (see previous blog entry), that's a sobering >thought. But the frustrating part for me is that many of the same >people at CFP who are now clamoring for more federal R&D for privacy >related research were among the loudest voices calling for >cancellation of DARPA's TIA project (I'm not including Tygar in this, >as I don't know where he stood on TIA). Let me explain. > >DARPA's Total Information Awareness (pdf) project was an attempt to >"design a prototype network that integrates innovative information >technologies for detecting and preempting foreign terrorist >activities against Americans." In order to do this, DARPA was funding >research into a range of technologies including real-time translation >tools, data mining applications, and "privacy enhancing technologies" >including development of a "privacy appliance" that would protect the >identities of all individuals within any of the databases being >searched until the government had the appropriate court order to >reveal them. At CFP, Philippe Golle, from Xerox's Palo Alto Research >Center, described one such project at PARC (led by Teresa Lunt), that >DARPA agreed to fund for 3 years as part of TIA. The plan was to >create a "privacy appliance" that owners of commercial databases of >interest to the government could deploy that would control government >access to the databases using inference control (deciding what types >of queries -- individually or in aggregate -- might divulge >identifying information), access control and an immutable audit trail >to protect individual privacy. Really neat stuff. > >Anyway, the idea that the government might one day deploy a TIA-like >system before all of the privacy and security challenges had been >sorted out and thereby imperil American civil liberties and security >was worrying to a great many people and organizations, including CRA. >However, there seemed to be a number of different approaches among >the various people and organizations to deal with the concerns. There >was a vocal contingent that believed Congress should cancel TIA >outright -- the threat the research posed was greater than any >possible good. CFP participant Jim Harper, of Privacilla.org, >addressed this approach directly at the conference, saying the reason >groups like his try to kill government programs when they're still in >R&D and small is because they're too hard to kill when they get big. > >CRA had a more nuanced view, I believe, that argued that the >challenges that needed to be overcome before any TIA-esque system >would ever be fit for deployment were large and that CRA would oppose >any deployment until concerns about privacy and security were met. >However, we also argued that the research required to address those >concerns was worthy of continued support -- the problems of privacy >and security (as well as the challenge of ever making something like >TIA actually work) were truly difficult research problems..."DARPA >hard" problems -- and so we opposed any research moratorium. > >Unsurprisingly, the "nuanced" position failed to carry the day once >Congress got involved. At about the same time Congress was deciding >TIA's fate, stories broke in the press about DARPA's FutureMAP >project -- which attempted to harness the predictive nature of >markets to glean information about possible terrorist activities -- >and JetBlue airline's release of customer data to the Defense >Department (in violation of their privacy policies) that helped >cement opinion that DARPA was out of control. It also didn't help >that the TIA program resided in DARPA's Information Assurance Office, >headed by the controversial Adm. John Poindexter. TIA's fate was >sealed. Congress voted to cut all funding for the program and >eliminate the IAO office at DARPA that housed it. > >However, Congress also recognized that some of the technologies under >development might have a role to play in the war against terrorism. >They included language in the appropriations bill (Sec 8131(a)) that >allowed work on the technologies to continue at unspecified >intelligence agencies, provided that work was focused on non-US >citizens. As a result, much of the research that had been funded by >DARPA has been taken up by the Advanced Research Development Agency, >the research arm of the intelligence agencies. Because it's >classified, we have no way of knowing how much of TIA has been >resurrected under ARDA. We also have no way of overseeing the >research, no way of questioning the approach or implementation, no >way of questioning the security or privacy protections (if any) >included. In short, those who argued in support of a research >moratorium just succeeded in driving the research underground. > >Finally, one thing we do know about current TIA-related research >efforts is that PARC's work on privacy-enhancing technologies is no >longer being funded. > >--- > >I'm glad to see the National Journal article has the specifics on >where much of that research actually went.... > >-Peter > >-- >Peter Harsha >Director of Government Affairs >Computing Research Association >1100 17th St. NW, Suite 507 >Washington, DC 20036 >p: 202.234.2111 ext 106 >c: 202.256.8271 >CRA's Computing Research Policy Blog: http://www.cra.org/govaffairs/blog > > >On Feb 24, 2006, at 6:12 PM, Dave Farber wrote: > >> >> >> -------- Original Message -------- >> Subject: Fwd: [sv4dean] "Total Information Awareness" - secretly >> funded >> in defiance of Congress >> Date: Fri, 24 Feb 2006 14:55:06 -0800 >> From: Hasan Diwan <hasan.diwan(a)gmail.com> >> To: dave(a)farber.net >> References: <a1.70dbecb5.312ff09a(a)aol.com> >> >> For IP, if you wish. >> >> ---------- Forwarded message ---------- >> From: Chinarock(a)aol.com <Chinarock(a)aol.com> >> Date: 23-Feb-2006 21:16 >> Subject: [sv4dean] "Total Information Awareness" - secretly funded in >> defiance of Congress >> To: sv4dean(a)yahoogroups.com >> >> *http://nationaljournal.com/about/njweekly/stories/2006/0223nj1.htm* >> >> *TIA Lives On * >> >> By Shane Harris <sharris(a)nationaljournal.com>, *National Journal* >> (c) National Journal Group Inc. >> Thursday, Feb. 23, 2006 >> >> A controversial counter-terrorism program, which lawmakers halted >> more than >> two years ago amid outcries from privacy advocates, was stopped in >> name only >> and has quietly continued within the intelligence agency now >> fending off >> charges that it has violated the privacy of U.S. citizens. >> >> Research under the Defense Department's Total Information Awareness >> program >> -- which developed technologies to predict terrorist attacks by >> mining >> government databases and the personal records of people in the >> United States >> -- was moved from the Pentagon's research-and-development agency to >> another >> group, which builds technologies primarily for the National >> Security Agency, >> according to documents obtained by *National Journal* and to >> intelligence >> sources familiar with the move. The names of key projects were >> changed, >> apparently to conceal their identities, but their funding remained >> intact, >> often under the same contracts. >> >> It is no secret that some parts of TIA lived on behind the veil of the >> classified intelligence budget. However, the projects that moved, >> their new >> code names, and the agencies that took them over haven't previously >> been >> disclosed. Sources aware of the transfers declined to speak on the >> record >> for this story because, they said, the identities of the specific >> programs >> are classified. >> >> Two of the most important components of the TIA program were moved >> to the >> Advanced Research and Development Activity, housed at NSA >> headquarters in >> Fort Meade, Md., documents and sources confirm. One piece was the >> Information Awareness Prototype System, the core architecture that >> tied >> together numerous information extraction, analysis, and >> dissemination tools >> developed under TIA. The prototype system included privacy-protection >> technologies that may have been discontinued or scaled back >> following the >> move to ARDA. ..... >> >> Sharkey played a key role in TIA's birth, when he and a close friend, >> retired Navy Vice Adm. *John Poindexter*, *President Reagan*'s >> national >> security adviser, brought the idea to Defense officials shortly >> after the >> 9/11 attacks. The men had teamed earlier on intelligence-technology >> programs >> for the Defense Advanced Research Projects Agency, which agreed to >> host TIA >> and hired Poindexter to run it in 2002. In August 2003, Poindexter was >> forced to resign >> <http://www.washingtonpost.com/ac2/wp-dyn/A51578-2003Aug12>as TIA >> chief amid howls that his central role in the Iran-Contra scandal of >> the mid-1980s made him unfit to run a sensitive intelligence program. >> ....etc. >> >> >> Links to Democracy for America... >> <http://www.democracyforamerica.com/> >> <http://www.dfa.meetup.com/> >> <http://dfasv.org/> >> >> >> >> SPONSORED LINKS >> Presidential >> election<http://groups.yahoo.com/gads?t=ms&k=Presidential >> +election&w1=Presidential+election&w2=Silicon >> +valley&c=2&s=47&.sig=XVKuwwahoV8Hm_1e5O_oIw> >> Silicon >> valley<http://groups.yahoo.com/gads?t=ms&k=Silicon >> +valley&w1=Presidential+election&w2=Silicon >> +valley&c=2&s=47&.sig=pIWbpNAt6BNx-rmFh-brVg> >> ------------------------------ >> YAHOO! GROUPS LINKS >> >> >> - Visit your group "sv4dean <http://groups.yahoo.com/group/ >> sv4dean>" >> on the web. >> >> - To unsubscribe from this group, send an email to: >> >> sv4dean-unsubscribe(a)yahoogroups.com<sv4dean- >> unsubscribe(a)yahoogroups.com?subject=Unsubscribe> >> >> - Your use of Yahoo! Groups is subject to the Yahoo! Terms of >> Service<http://docs.yahoo.com/info/terms/> >> . >> >> >> ------------------------------ >> >> >> >> -- >> Cheers, >> Hasan Diwan <hasan.diwan(a)gmail.com> >> > >------------------------------------- >You are subscribed as harsha(a)cra.org >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting- >people/ > > > > > >------------------------------------- >You are subscribed as tien(a)well.sf.ca.us >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting-people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[ISN] Wireless LANs: Trouble in the Air
by InfoSec News 06 Jul '18

06 Jul '18

http://www.computerworld.com/cwi/story/0,1199,NAV47_STO67344,00.html By BOB BREWIN, DAN VERTON AND JENNIFER DISABATINO January 14, 2002 As the airline industry scrambles to meet a Jan. 18 deadline to screen every checked bag for explosives, security experts, analysts and government officials are raising serious concerns about the security of wireless technology that's integral to the effort. At issue is the adoption by airlines of industry-standard 802.11b, or WiFi, wireless LANs operating in the 2.4-GHz band. These systems, which are widely viewed as inherently insecure, are being used to support such applications as bag matching and curbside and roving-agent check-in. The concerns appear to be justified, based on two investigations that were conducted last week by professional security firms that analyzed airline wireless LAN systems at Denver International Airport and San Jose International Airport. The analysis in Denver was conducted Jan. 9 by White Hat Technologies Inc., a Westminster, Colo.-based security firm. It revealed that American Airlines Inc. operated wireless LANs totally in the clear without any encryption in its portion of the DIA terminal. The vulnerability of the American Airlines wireless LAN networks was highlighted by the fact that the security specialists witnessed an intrusion while conducting their monitoring. According to a report furnished to Computerworld, security of the wireless LANs supporting Fort Worth, Texas-based American's curbside check-in stands was further compromised by the fact that the IP address of the curbside terminal was prominently pasted on the monitor. Except for an administrative network operated by the Denver International Airport authority itself, none of the networks monitored by the security specialists had turned on even the simplest form of encryption: the 40-bit Wired Equivalent Privacy encryption algorithm. Thubten Comerford, CEO of White Hat Technologies, said airlines that operate unprotected 802.11b wireless networks "are putting themselves and our nation's security at risk." Even when encryption is enabled, wireless LANs "are a serious liability," Comerford added. A scan of wireless networks at San Jose International Airport on Jan. 10 produced similar results. Jonas Luster, co-founder of D-fensive Networks Inc. in Campbell, Calif., which conducted the analysis in San Jose, said the wireless LANs there had few safeguards against intruders. Luster said he was easily able to pick up signals and sensitive network information emanating from the wireless LANs belonging to American Airlines and Dallas-based Southwest Airlines Co. American's curbside check-in operations could be monitored, Luster said, and Southwest's networks were issuing information from back-end systems, including at least three Unix servers running the Solaris operating system. RIP Weakness "In a matter of minutes, you could sniff out whatever you wanted," said Luster, who added that the routing infrastructure at both airlines was open to exploitation. Routing Information Protocol (RIP), a high-level language that transmits routing updates at regular intervals, can be modified easily to assist a hacker, said Luster. "By injecting a wrong RIP response, I could declare myself a legitimate, authoritative, powerful node on the network," said Luster. Although American acknowledged the vulnerability of the 802.11b standard, it downplayed the seriousness of the situation. "This particular issue is a very temporary one and a very noncompromising one," said American CIO Monte Ford. American is already on track to roll out a proprietary security system to replace 802.11b well before an industry-standard improvement is adopted, Ford said. And he added that even if a hacker was able to locate passwords, he would still be unable to access applications and databases. "A password is not a free ticket to our network, by any stretch of the imagination," he said. "They can just see points on the network. They can't get into applications." Ford said American doesn't plan to use positive bag matching to meet the Jan. 18 deadline Congress has set for the airlines to implement some means of screening all checked baggage. It does plan to start using a bag-matching system later this year, Ford added. American Airlines' visibility is at least partly attributable to the fact that it has been ahead of the curve in wireless LAN deployment. Delta Air Lines Inc., United Air Lines Inc. and Southwest Airlines all declined to comment for this story, citing security concerns. Northwest Airlines Inc. and Continental Airlines Inc. didn't return calls seeking comment by deadline. In any case, there appears to be no coordinated effort among the airlines to address wireless security issues. For its part, American currently uses its wireless LANs only for curbside check-in and roving agents, and Ford said that even if intruders penetrated the network, they could do little damage. That's because American's core systems are hosted by Fort Worth, Texas-based Sabre Inc. on an IBM transaction processing facility (TPF) system that's generally viewed as extremely difficult to hack because of the rigid and arcane structure of TPF. "It's not possible that you could get into the kinds of things that could do damage," said Richard Eastman, an airline industry consultant at Newport Beach, Calif.-based The Eastman Group. The TPF-based reservation system is a deep matrix, with passwords embedded in each level, explained Michael Anderson, director of airport systems at Sabre. But that doesn't satisfy Joe Weiss, vice president of the network applications division at Annapolis, Md.-based Aeronautical Radio Inc. (Arinc), a communications services provider owned by a consortium of airlines. Weiss said he's concerned that a hacker could use an unprotected wireless LAN to hop into core airline operational systems. These systems include flight operations, bag matching and passenger reservations. Flight operations systems manage such vital functions as refueling, maintenance and flight dispatch, Weiss said. Weiss expressed concern that access to a bag-matching system could allow an attacker to manipulate the system to show that luggage belonged to a boarded passenger when in fact it did not. This concern is one reason Arinc plans to abandon the 802.11b-based bag-matching system it operates as a shared resource system for all carriers with international flights at San Francisco International Airport. Arinc said it will switch to a private wireless system operating in the 800-MHz band. That system will be based on Integrated Digital Enhanced Network (IDEN) voice and data terminals developed by Schaumburg, Ill.-based Motorola Inc. IDEN provides more robust security than wireless LANs, Weiss said, including software keys for each terminal. Arinc plans to encrypt the network traffic as well. Presidential Concerns The security weakness of wireless LANs used throughout the nation's critical industries, including airlines, hasn't gone unnoticed at high levels of the Bush administration. A senior White House official said wireless security initiatives are at the top of the 2002 agenda for the president's newly established Critical Infrastructure Protection Board. At least one white paper is in development that will examine wireless LANs and the interconnections between wireless devices and critical infrastructure systems, such as Federal Aviation Administration networks. The U.S. Department of Transportation (DOT) and two of its key agenciesthe FAA and the newly formed Transportation Security Agency (TSA)plan to take a critical look at wireless LAN security over the next year. Mike Brown, director of information security at the FAA, said that in this new security-conscious era, airline wireless systems are subject to increased scrutiny. The DOT has formed a "go team," led by Associate CIO Lisa Schlosser, that will examine existing airline wireless systems, including LANs. In partnership with the FAA, the TSA and private industry, it will develop security standards and define a general wireless architecture, Brown said. Though American Airlines downplayed the vulnerability of its wireless networks in San Jose and Denver, some security analysts viewed the potential threat as significant and symptomatic of the airline industry's failure to properly address network security. James Foster, a senior consultant and researcher at Guardent Inc., a security firm in Waltham, Mass., has conducted several wireless security audits during the past year that have uncovered significant vulnerabilities in and around major airport facilities, including John F. Kennedy International Airport in New York and Boston's Logan International Airport. "Possible baggage system vulnerabilities do not surprise me," said Foster. "This is a serious problem that puts lives and the U.S. infrastructure at risk." Although he wouldn't provide details about specific airlines, Foster's wireless security audits have shown that a skilled hacker with the right software tools would need only seconds to conduct a detailed reconnaissance of an airline's wireless network. "Most of the time these [wireless systems] are tied to back-end systems," Foster said. Regardless of how arcane or proprietary those networks may be, "it's only a matter of time until somebody figures out how it works, how it communicates and how people authenticate," he said. "It would take no more than an hour to figure out how the system worked." - ISN is currently hosted by Attrition.org To unsubscribe email majordomo(a)attrition.org with 'unsubscribe isn' in the BODY of the mail. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

[IP] more on WORTH READING "Total Information Awareness" - secretly funded in defiance of Congress]]]
by Dave Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: Re: [IP] WORTH READING "Total Information Awareness" - secretly funded in defiance of Congress]] Date: Sat, 25 Feb 2006 14:41:51 -0800 From: Lee Tien <tien(a)eff.org> To: dave(a)farber.net References: <43FFBB04.9070108(a)farber.net> Dave, The problem IMHO is that killed programs can be and are reanimated in this secret, black-budget, nudge-wink underground out of public view, not that privacy advocates sought to stop TIA. The "you naive fools drove it underground" attitude is a bit like blaming the Supreme Court, Congress, and the Constitution for the president's warrantless surveillance program: "You really shouldn't have insisted on procedural/substantive restraints and accountability, because you're just forcing me to do it secretly." (Would that privacy advocates had a tiny fraction of the power implied here!) Put another way, the programs' proponents don't seem to like meaningful civil-liberties accountability and have institutional escape hatches for avoiding such. Accordingly, I think it's dumb to criticize privacy advocates in this or other similar contexts. --Why not blame those who resurrected or permitted the resurrection of the "more potentially nefarious bits"? --Why not blame those who didn't continue to fund the privacy and security research?* More important, how do we create truly workable public accountability/oversight mechanisms for a politically powerful, extremely secretive executive branch? Sadly, I no longer believe that congressional intelligence committees provide meaningful oversight on civil-liberties issues. Lee *My recollection is that the "privacy appliance" (Genisys Privacy Protection, Teresa Lunt) either wasn't part of the original TIA portfolio (see http://www.eff.org/Privacy/TIA/overview.php, where we presented the TIA program as it was when we first learned about it) or was buried inside Genisys and then trotted out in response to privacy concerns. Also see Poindexter's presentation at DARPAtech 2002 near the bottom of http://www.eff.org/Privacy/TIA/, which mentions Genisys but not Genisys Privacy Protection. At 9:03 PM -0500 2/24/06, Dave Farber wrote: >-------- Original Message -------- >Subject: Re: [IP] "Total Information Awareness" - secretly funded in >defiance of Congress] >Date: Fri, 24 Feb 2006 20:02:20 -0500 >From: Peter Harsha <harsha(a)cra.org> >To: dave(a)farber.net >References: <43FF92D2.1050908(a)farber.net> > >Hi Dave, > >I blogged a bit about this way back in April 2004, noting some of my >frustration that the rush to kill TIA would kill the privacy and >security research that was underway and drive the more potentially >nefarious bits of the program deeper into the black, hidden from view. > >http://www.cra.org/govaffairs/blog/archives/000069.html > >The post was in the context of a review of some of the interesting >sessions I'd attended at the Computers Freedom and Privacy conference >that year, but here's the relevant bit about TIA (see the blog for >all the embedded links): > >A number of speakers made the point (though Doug Tygar probably made >it most emphatically) that the government spends a disproportionate >amount of its IT privacy and security research funding on security >rather than privacy. Given the current state of funding for federal >cyber security R&D (see previous blog entry), that's a sobering >thought. But the frustrating part for me is that many of the same >people at CFP who are now clamoring for more federal R&D for privacy >related research were among the loudest voices calling for >cancellation of DARPA's TIA project (I'm not including Tygar in this, >as I don't know where he stood on TIA). Let me explain. > >DARPA's Total Information Awareness (pdf) project was an attempt to >"design a prototype network that integrates innovative information >technologies for detecting and preempting foreign terrorist >activities against Americans." In order to do this, DARPA was funding >research into a range of technologies including real-time translation >tools, data mining applications, and "privacy enhancing technologies" >including development of a "privacy appliance" that would protect the >identities of all individuals within any of the databases being >searched until the government had the appropriate court order to >reveal them. At CFP, Philippe Golle, from Xerox's Palo Alto Research >Center, described one such project at PARC (led by Teresa Lunt), that >DARPA agreed to fund for 3 years as part of TIA. The plan was to >create a "privacy appliance" that owners of commercial databases of >interest to the government could deploy that would control government >access to the databases using inference control (deciding what types >of queries -- individually or in aggregate -- might divulge >identifying information), access control and an immutable audit trail >to protect individual privacy. Really neat stuff. > >Anyway, the idea that the government might one day deploy a TIA-like >system before all of the privacy and security challenges had been >sorted out and thereby imperil American civil liberties and security >was worrying to a great many people and organizations, including CRA. >However, there seemed to be a number of different approaches among >the various people and organizations to deal with the concerns. There >was a vocal contingent that believed Congress should cancel TIA >outright -- the threat the research posed was greater than any >possible good. CFP participant Jim Harper, of Privacilla.org, >addressed this approach directly at the conference, saying the reason >groups like his try to kill government programs when they're still in >R&D and small is because they're too hard to kill when they get big. > >CRA had a more nuanced view, I believe, that argued that the >challenges that needed to be overcome before any TIA-esque system >would ever be fit for deployment were large and that CRA would oppose >any deployment until concerns about privacy and security were met. >However, we also argued that the research required to address those >concerns was worthy of continued support -- the problems of privacy >and security (as well as the challenge of ever making something like >TIA actually work) were truly difficult research problems..."DARPA >hard" problems -- and so we opposed any research moratorium. > >Unsurprisingly, the "nuanced" position failed to carry the day once >Congress got involved. At about the same time Congress was deciding >TIA's fate, stories broke in the press about DARPA's FutureMAP >project -- which attempted to harness the predictive nature of >markets to glean information about possible terrorist activities -- >and JetBlue airline's release of customer data to the Defense >Department (in violation of their privacy policies) that helped >cement opinion that DARPA was out of control. It also didn't help >that the TIA program resided in DARPA's Information Assurance Office, >headed by the controversial Adm. John Poindexter. TIA's fate was >sealed. Congress voted to cut all funding for the program and >eliminate the IAO office at DARPA that housed it. > >However, Congress also recognized that some of the technologies under >development might have a role to play in the war against terrorism. >They included language in the appropriations bill (Sec 8131(a)) that >allowed work on the technologies to continue at unspecified >intelligence agencies, provided that work was focused on non-US >citizens. As a result, much of the research that had been funded by >DARPA has been taken up by the Advanced Research Development Agency, >the research arm of the intelligence agencies. Because it's >classified, we have no way of knowing how much of TIA has been >resurrected under ARDA. We also have no way of overseeing the >research, no way of questioning the approach or implementation, no >way of questioning the security or privacy protections (if any) >included. In short, those who argued in support of a research >moratorium just succeeded in driving the research underground. > >Finally, one thing we do know about current TIA-related research >efforts is that PARC's work on privacy-enhancing technologies is no >longer being funded. > >--- > >I'm glad to see the National Journal article has the specifics on >where much of that research actually went.... > >-Peter > >-- >Peter Harsha >Director of Government Affairs >Computing Research Association >1100 17th St. NW, Suite 507 >Washington, DC 20036 >p: 202.234.2111 ext 106 >c: 202.256.8271 >CRA's Computing Research Policy Blog: http://www.cra.org/govaffairs/blog > > >On Feb 24, 2006, at 6:12 PM, Dave Farber wrote: > >> >> >> -------- Original Message -------- >> Subject: Fwd: [sv4dean] "Total Information Awareness" - secretly >> funded >> in defiance of Congress >> Date: Fri, 24 Feb 2006 14:55:06 -0800 >> From: Hasan Diwan <hasan.diwan(a)gmail.com> >> To: dave(a)farber.net >> References: <a1.70dbecb5.312ff09a(a)aol.com> >> >> For IP, if you wish. >> >> ---------- Forwarded message ---------- >> From: Chinarock(a)aol.com <Chinarock(a)aol.com> >> Date: 23-Feb-2006 21:16 >> Subject: [sv4dean] "Total Information Awareness" - secretly funded in >> defiance of Congress >> To: sv4dean(a)yahoogroups.com >> >> *http://nationaljournal.com/about/njweekly/stories/2006/0223nj1.htm* >> >> *TIA Lives On * >> >> By Shane Harris <sharris(a)nationaljournal.com>, *National Journal* >> (c) National Journal Group Inc. >> Thursday, Feb. 23, 2006 >> >> A controversial counter-terrorism program, which lawmakers halted >> more than >> two years ago amid outcries from privacy advocates, was stopped in >> name only >> and has quietly continued within the intelligence agency now >> fending off >> charges that it has violated the privacy of U.S. citizens. >> >> Research under the Defense Department's Total Information Awareness >> program >> -- which developed technologies to predict terrorist attacks by >> mining >> government databases and the personal records of people in the >> United States >> -- was moved from the Pentagon's research-and-development agency to >> another >> group, which builds technologies primarily for the National >> Security Agency, >> according to documents obtained by *National Journal* and to >> intelligence >> sources familiar with the move. The names of key projects were >> changed, >> apparently to conceal their identities, but their funding remained >> intact, >> often under the same contracts. >> >> It is no secret that some parts of TIA lived on behind the veil of the >> classified intelligence budget. However, the projects that moved, >> their new >> code names, and the agencies that took them over haven't previously >> been >> disclosed. Sources aware of the transfers declined to speak on the >> record >> for this story because, they said, the identities of the specific >> programs >> are classified. >> >> Two of the most important components of the TIA program were moved >> to the >> Advanced Research and Development Activity, housed at NSA >> headquarters in >> Fort Meade, Md., documents and sources confirm. One piece was the >> Information Awareness Prototype System, the core architecture that >> tied >> together numerous information extraction, analysis, and >> dissemination tools >> developed under TIA. The prototype system included privacy-protection >> technologies that may have been discontinued or scaled back >> following the >> move to ARDA. ..... >> >> Sharkey played a key role in TIA's birth, when he and a close friend, >> retired Navy Vice Adm. *John Poindexter*, *President Reagan*'s >> national >> security adviser, brought the idea to Defense officials shortly >> after the >> 9/11 attacks. The men had teamed earlier on intelligence-technology >> programs >> for the Defense Advanced Research Projects Agency, which agreed to >> host TIA >> and hired Poindexter to run it in 2002. In August 2003, Poindexter was >> forced to resign >> <http://www.washingtonpost.com/ac2/wp-dyn/A51578-2003Aug12>as TIA >> chief amid howls that his central role in the Iran-Contra scandal of >> the mid-1980s made him unfit to run a sensitive intelligence program. >> ....etc. >> >> >> Links to Democracy for America... >> <http://www.democracyforamerica.com/> >> <http://www.dfa.meetup.com/> >> <http://dfasv.org/> >> >> >> >> SPONSORED LINKS >> Presidential >> election<http://groups.yahoo.com/gads?t=ms&k=Presidential >> +election&w1=Presidential+election&w2=Silicon >> +valley&c=2&s=47&.sig=XVKuwwahoV8Hm_1e5O_oIw> >> Silicon >> valley<http://groups.yahoo.com/gads?t=ms&k=Silicon >> +valley&w1=Presidential+election&w2=Silicon >> +valley&c=2&s=47&.sig=pIWbpNAt6BNx-rmFh-brVg> >> ------------------------------ >> YAHOO! GROUPS LINKS >> >> >> - Visit your group "sv4dean <http://groups.yahoo.com/group/ >> sv4dean>" >> on the web. >> >> - To unsubscribe from this group, send an email to: >> >> sv4dean-unsubscribe(a)yahoogroups.com<sv4dean- >> unsubscribe(a)yahoogroups.com?subject=Unsubscribe> >> >> - Your use of Yahoo! Groups is subject to the Yahoo! Terms of >> Service<http://docs.yahoo.com/info/terms/> >> . >> >> >> ------------------------------ >> >> >> >> -- >> Cheers, >> Hasan Diwan <hasan.diwan(a)gmail.com> >> > >------------------------------------- >You are subscribed as harsha(a)cra.org >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting- >people/ > > > > > >------------------------------------- >You are subscribed as tien(a)well.sf.ca.us >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting-people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Cato TechKnowledge: The Feds Want To Write Your Software
by Wayne Crews 06 Jul '18

06 Jul '18

The Feds Want To Write Your Software Issue #15 August 6, 2001 by D. T. Armentano In Ayn Rand's famous 1957 novel, Atlas Shrugged, unconstrained politicians end up destroying the U.S. economy by regulating (among other things) invention and product innovation. In that vision, new products that would revolutionize an industry-and put less efficient competitors out of business-have to be controlled and even suppressed by government so that no company has an "unfair" advantage and everyone has an equal chance to compete. Critics savaged Rand's thesis arguing that she had portrayed regulators as political lunatics. The critics opined smugly that this sort of innovation regulation could never happen here. Well, tell that to Microsoft. For almost a decade, Microsoft has battled federal and state antitrust authorities over its right to freely innovate in the marketplace by integrating its Web browser, Internet Explorer, with its proprietary Windows operating system. Microsoft claimed that consumers wanted integrated functionality because it was easier and cheaper to use, while the feds maintained that competitors (such as Netscape) were put at a competitive disadvantage by integration and could be injured by it. After a contentious trial and a recent appellate court decision, the basic antitrust issues are still unresolved. The current innovation controversy is over Microsoft's soon-to-be introduced operating system, Windows XP, which has features that will steer consumers to Microsoft's own proprietary products and allegedly injure rivals such as America Online and Eastman Kodak, among others. The Senate Judiciary Committee has already scheduled hearings in September to consider, as committee member Charles Schumer (D-N.Y.) recently put it, whether the design of Windows XP could cause "great harm to consumers, as well as competing companies." Never mind that no one (including the government's expert witnesses at the antitrust trial) produced a shred of evidence that any of Microsoft's previous innovations injured consumers. And never mind that the antitrust laws are not intended to protect competitors from consumer-friendly innovation, and that to do so would betray any alleged consumer-protection mission. Never even mind that no law in the U.S. mandates that a firm must structure its innovation to make competitive life easier for its rivals. Put aside all of that and consider the following: Do you really want the likes of Sen. Schumer and Senate Judiciary Committee chairman Herb Kohl (D-Wis.) writing your future computer software? There are several reasons why the answer to that question must be an emphatic "no." The first is that the new Microsoft XP operating system is Microsoft's property; Microsoft invented it, owns it, and has a moral as well as legal right to it. That right allows Microsoft to determine what the software will do and who will use (license) it and on what terms. Any government regulation of a company's right to use its own property in a peaceful manner-and trade with consumers is entirely peaceful-is an illegitimate taking and a violation of the company's property rights. Second, political control over product innovation is monstrously inefficient, as Ayn Rand illustrated in her novel. Sen. Schumer is concerned about AOL and Kodak only because those firms (and jobs and votes) are in his political district demanding "protection" from Microsoft's newest innovation. The implication is that any time competitors feel threatened by a rival's innovation, the politicians will hold hearings and threaten to regulate the offending innovator. Under those terms, future productivity and growth in the U.S. economy will be held hostage to pandering politicians and politically connected corporations seeking shelter from the process of creative destruction-to advance an absurd politically correct notion of competition. Microsoft's representatives have already been invited to appear before the Judiciary Committee hearings in the fall. As Ayn Rand would say, the government needs Microsoft's expertise and cooperation to help lend credibility to the regulation of Windows XP, a "sanction of the victim" so to speak. To assert its rights, Microsoft should boycott the hearings and deny the feds any legitimate sanction. Let's get the true nature of the "hearings" out in the open. Innovation regulation is a counterproductive and immoral high-tech intrusion. Those about to be targeted need not cooperate. D. T. Armentano (ArmentaD(a)irene.net) is professor emeritus in economics at the University of Hartford (Connecticut) and an adjunct scholar at the Cato Institute. He is the author of Antitrust and Monopoly (Independent Institute, 1998) and Antitrust: The Case for Repeal (Mises Institute, 1999). To subscribe, or to see a list of all previous TechKnowledge articles, visit http://www.cato.org/tech/tk-index.html (Additional Cato analyses of the Microsoft case include Robert Levy, "Microsoft Redux: Anatomy of a Baseless Lawsuit," September 30, 1999, http://www.cato.org/pubs/pas/pa352.pdf ; and Robert Levy and Alan Reynolds, "Microsoft's Appealing Case," November 9, 2000, http://www.cato.org/pubs/pas/pa385.pdf. ************************************************************************** Subscribe to Freematt's Alerts: Pro-Individual Rights Issues Send a blank message to: freematt(a)coil.com with the words subscribe FA on the subject line. List is private and moderated (7-30 messages per week) Matthew Gaylor, (614) 313-5722 ICQ: 106212065 Archived at http://groups.yahoo.com/group/fa/ **************************************************************************

1 0

Re: Random chaff [was: more work for Grobbages]
by grarpamp 06 Jul '18

06 Jul '18

I was thinking solely of taps capable of observing user1, user2... usern. If user1 injects 1.21 MB of data on one side, and 1.21 MB of data pops out the other side at injection time + network delay, the users are made. Regardless of whether the observer can see inside the network/crypto or operate in the network. And especially if the net or users are quiet at that time. But if there's chaff present, chaff that is only known to be chaff by the network, or minimally by the recipient and generator, then the game becomes harder. User1 and user2's pipes are always independantly full of cap = ( chaff + wheat). Chaff is requested from the network by the user's node to fill the cap during idle times. The cap could be optional random dynamic, perhaps shrink after some time of no wheat nearing the cap so as to not be needless waste. Users's nodes make [close?] peers just for traffic generation. Tagged and controlled out of band. Involve the client's knowledge that its socks or hidden service ports are generating n kbit/sec of wheat. Middle node link traffic could be similarly managed, albeit without socks/hs knowledge, just bandwidth. Any intelligent cell based clocking or committed rate management within seem very hard when riding on the public internet. So it would just be shoving bits into a hungry mouth until a gag message comes back. Maybe the problem with this idea is that the chaff generation system might not be able to react fast enough when the real wheat travels the pipes. So a 1.21 MB injection might still create some sort of observable ripple at start and end times. The only way it might not is if the pipes are oversubscribed _and_ packet lossy by design, not just having the usual TCP congestion managed slowness. But that would be terrible bad for most user facing applications and stacks. Maybe it is the ripples that need hidden or randomized instead of just filling pipes. > If it turns out that correlation attacks are far more difficult > than the research community thinks It seems safe to presume that near global passive adversaries exist. And certainly ones cabaple of covering various regions. And that offline processing of the mesh of flow information from them is probably within current capabilities. I'm actually amazed we're not seeing canaries kicking off all over the place. Particularly ones involving exits. The advice to run a relay while using the client seems sound due to whatever free chaff it brings. Who knows. Thanks for the links to the anonbib and wiki. I want to read more in the some free time. *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0