July 2018 - cypherpunks-legacy

Re: [p2p-hackers] what would you like to see most in a p2p social network?
by Renato Figueiredo 06 Jul '18

06 Jul '18

David, In addition to STUN, we also have a decentralized mechanism to select 1-hop relays in the overlay when NAT traversal fails. We have done simulation-based studies and our empirical evidence from the deployed SocialVPN/Brunet systems is that these approaches work pretty well, but we don't have a study of the system "in the wild" with large numbers of real users behind NATs. We are planning to reach to a reasonably large number of users to use the software to collect this among other kinds of data; any suggestions/ideas on how to reach out to potential users for an experiment would be welcome. Thanks! --rf On Tue, Jan 18, 2011 at 2:58 AM, David Barrett <dbarrett(a)quinthar.com>wrote: > Oh, is it possible to connect to the SocialVPN overlay on PlanetLab via > the Internet? Neat! As for the STUN approach, that sounds about right > -- have you measured the actual success rate of peers attempting to > connect with it? I know a few people on the list (including me) have > spent *A LOT* of energy on this topic, and it's really freakin' hard, > but super awesome. > > -david > > On 01/17/2011 11:49 PM, Pierre St Juste wrote: > > Here's some explanation about distributed NAT traversal. > > > > We currently run a structured P2P overlay on Planetlab, when you run > > SocialVPN you join that structured overlay, we usually have about 500 - > > 600 nodes running. If node A wants to connect to node B, the following > > happens: > > > > 1 - node A sends a ConnectToMe (CTM) message to node B by using node B's > > P2P address (160-bit randomly chosen address). > > > > 2 - The CTM message contains node A's public IP and UDP port. > > > > 3 - Node B replies through the overlay with his public IP and UDP port > > and simultaneous sends a UDP packet to node A's public IP and port. > > > > 4. When node A receives the reply with node B's IP and UDP port, node A > > sends a UDP packet to node B's public IP and UDP port. > > > > 5. If you have a friendly NAT (not symmetric), then node A's packet will > > make it to node B's machine since node B has already sent a packet to > > that IP and port. > > > > We call it a distributed STUN server because the Brunet P2P library > > allows for discovery of one's public IP address and port and it also > > provides an all-to-all messaging layer needed to signal the start of UDP > > hole punching. > > > > As we all know, direct P2P communication is not always possible, in this > > case, a node that is reachable by both parties is chosen as the relay > > nodes and peers communicate through that. > > > > Finally our NAT traversal is a bit slower than regular STUN because the > > initial message is routed through a structured overlay that takes log(N) > > hops on average, but you may have dropped UDP packets and retries, so it > > may take milliseconds or a few seconds to set up direct P2P connection. > > > > These papers explain in more detail > > > > http://byron.acis.ufl.edu/papers/ipdps06ipop.pdf > > > > http://byron.acis.ufl.edu/papers/hpdc145-ganguly.pdf > > > > http://byron.acis.ufl.edu/papers/cops08.pdf > > > > Hope this helps. I encourage anyone interesting to download SocialVPN > > and try it out, there is windows installer and debian package. It > > currently works with GoogleChat or by emailing each other your P2P > address. > > > > On Tue, Jan 18, 2011 at 12:49 AM, David Barrett <dbarrett(a)quinthar.com > > <mailto:dbarrett@quinthar.com>> wrote: > > > > Wow, this looks really fantastic. I hadn't followed its progress but > it > > sounds like it's come a long way really fast. I'd love to hear more > > about its distributed STUN service and NAT traversal. Do you have > any > > data on its effectiveness, perhaps expressed as the likelihood that > two > > arbitrary nodes will be able to connect directly via the internet? > Is > > there a TURN or other relay service available as a fallback? Thanks! > > > > -david > > > > On 01/17/2011 08:13 PM, Pierre St Juste wrote: > > > I would like to point out the SocialVPN project > > > > > > http://socialvpn.org > > > > > > It is basically a P2P VPN which creates direct encrypted tunnels > to > > > friends. It currently uses the XMPP protocol for friend discovery > and > > > public key exchange. This VPN thus creates a social graph where > edges > > > are IP links. This infrastructure can be used as an enabler for > many > > > other social services. Here are a few examples > > > > > > 1 - Instead of using Skype, you can use Ekiga with Avahi, Avahi > > > extension for Ekiga will discover online friends through > > multicast over > > > the social virtual private network, you can then place SIP call > > directly > > > over IP link. > > > > > > 2. For instant messaging, you can use Empathy or Pidgin with > > > Bonjour/Avahi support, as concept as above. > > > > > > 3. For video stream, you can stream a video over HTTP or RTP > > using VLC > > > and your friends can connect directly. > > > > > > 4. For social networking, you can run a wordpress blog locally > > and have > > > your friends connect to that, or you can write an social > networking > > > application that communicates with friends over SocialVPN using > > Berkeley > > > sockets API instead of having to deal with building P2P library > that > > > deals with NAT traversal, peer search and so on. > > > > > > 5. All data sent between peers is encrypted and authenticated, > > basically > > > the same idea behind IPSec if you support PKI certificate > exchanges. > > > > > > One of the hardest thing about building social P2P systems is > having > > > with a user-friendly way to bootstrap these social links (or > > Darknets). > > > SocialVPN makes that step trivial so that developers can focus > > more on > > > making cool apps versus figuring out how to traverse NATs. > > > > > > I hope this helps. > > > > > > On Mon, 2011-01-17 at 18:57 -0800, David Barrett wrote: > > >> I'd suggest first figuring out why someone would pick a P2P > social > > >> network over Facebook, from a perspective of legitimate > > functionality > > >> rather than just privacy (which as Facebook has demonstrated, > > isn't a > > >> killer feature). I'd suggest really emphasizing the fact that > with > > >> P2P-Book, there is no "uploading" photos or videos: you can > > share entire > > >> folders of files, videos, documents, or whatever and their > instantly > > >> available to your friends -- without first uploading them > > somewhere else. > > >> > > >> Furthermore, emphasize that you're not sharing *copies* of the > > videos, > > >> songs, and photos -- you're sharing the originals: change the > > original > > >> (crop, reorient, touch up, tag with metadata, etc) and its > > automatically > > >> updated. > > >> > > >> -david > > >> > > >> On 01/17/2011 12:51 PM, Jan DomaEski wrote: > > >>> Hey Michael, > > >>> > > >>> Thanks for the comments, they're helpful. > > >>> > > >>> A lot of this boils down to having two (or more) 'sides' of > > self. One > > >>> for general public, others for the rest; this is doable. > > >>> > > >>> Grudge-friendly and jackboot resistant, in ideal world, comes > > with the > > >>> 'distributed' and 'secure+encrypted'. But sure, seems to have > > been lost > > >>> in the implementation of at least one social network i can > > think of. > > >>> > > >>> As to the grandmother compatibility, at least to me, this is not > > >>> absolutely essential at first. > > >>> > > >>> Cherio, Jan > > >>> > > >>> 2011/1/16 Michael Rogers<m--(a)gmx.com > > <mailto:m--@gmx.com><mailto:m--@gmx.com <mailto:m--@gmx.com>>> > > >>> > > >>> Hi Jan, > > >>> > > >>> Here's a quick list of features I'd like to see in any > > social network > > >>> (not just P2P ones): > > >>> > > >>> * Grandmother-compatible. It should be possible to be > > friends with my > > >>> grandmother without her seeing the photo of the time I did > > that thing > > >>> with the grapes. > > >>> > > >>> * Alcohol-compatible. There should be something as easy to > > remember as > > >>> an email address that I can give to random people I > > befriend while > > >>> drunk. And if they look me up the next day, there should > > be a polite way > > >>> of not responding. > > >>> > > >>> * Schoolproof. People should not be able to find my > > profile just because > > >>> we went to school together 20 years ago. Similarly, people > > should not be > > >>> able to find my profile just because I applied for a job > > at their > > >>> company (or at least, they shouldn't be able to see the > > photo of the > > >>> thing with the grapes). > > >>> > > >>> * Grudge-friendly. It should be possible to move my data > > from one > > >>> provider to another when the current provider accuses me > > of lacking > > >>> integrity because I don't want my grandmother to see the > > photo etc etc. > > >>> > > >>> * Jackboot-resistant. The Tunisian government should not > > be able to > > >>> steal my password by setting up a fake login page. > > >>> > > >>> Cheers, > > >>> Michael > > >>> > > >>> On 15/01/11 20:35, Jan DomaEski wrote: > > >>> > Hello everybody out there interested in p2p social > networking, > > >>> > > > >>> > I'm doing a (free) p2p social network (just a hobby, wonbt > > be big and > > >>> > professional like diaspora). It has been in the works since > > >>> summer, and > > >>> > begins to get some shape. I'd like any feedback on things > people > > >>> > like/dislike in the idea of a p2p social network and how this > is > > >>> solved > > >>> > by the little toy. > > >>> > > > >>> > I've currently written it in java, netty handles the > networking, > > >>> Qt is > > >>> > used for GUI. Some yml for configs and db4o for storage. > > Non-blocking > > >>> > xml (XMPP) parser is a missing puzzle. The app has been run > > only on a > > >>> > single machine, but it's already practical and I'd like to > > know what > > >>> > features most people would want. Any suggestions are > > welcome, but I > > >>> > wonbt promise Ibll implement them :] > > >>> > > > >>> > Two demos (the top one is new) below, gitorious and blog > > links inside > > >>> > http://www.youtube.com/watch?v=0rAwCsYt16w > > >>> > http://www.youtube.com/watch?v=K1dujrhGvBQ > > >>> > > > >>> > Jan (jan.domanski(a)new.ox.ac.uk > > <mailto:jan.domanski@new.ox.ac.uk><mailto:jan.domanski@new.ox.ac.uk > > <mailto:jan.domanski@new.ox.ac.uk>> > > >>> <mailto:jan.domanski@new.ox.ac.uk > > <mailto:jan.domanski@new.ox.ac.uk><mailto:jan.domanski@new.ox.ac.uk > > <mailto:jan.domanski@new.ox.ac.uk>>>) > > >>> > > > >>> > PS. Yes - it's all my own work and done as a scientist not a > > >>> programmer, > > >>> > which has terrible implications for code ;) > > >>> > > > >>> > > > >>> > > > >>> > _______________________________________________ > > >>> > p2p-hackers mailing list > > >>> > p2p-hackers(a)lists.zooko.com > > <mailto:p2p-hackers@lists.zooko.com><mailto: > p2p-hackers(a)lists.zooko.com > > <mailto:p2p-hackers@lists.zooko.com>> > > >>> > http://lists.zooko.com/mailman/listinfo/p2p-hackers > > >>> > > >>> > > >>> > > >>> > > >>> _______________________________________________ > > >>> p2p-hackers mailing list > > >>> p2p-hackers(a)lists.zooko.com <mailto:p2p-hackers@lists.zooko.com > > > > >>> http://lists.zooko.com/mailman/listinfo/p2p-hackers > > >> _______________________________________________ > > >> p2p-hackers mailing list > > >> p2p-hackers(a)lists.zooko.com <mailto:p2p-hackers@lists.zooko.com> > > >> http://lists.zooko.com/mailman/listinfo/p2p-hackers > > > > > > > > > _______________________________________________ > > > p2p-hackers mailing list > > > p2p-hackers(a)lists.zooko.com <mailto:p2p-hackers@lists.zooko.com> > > > http://lists.zooko.com/mailman/listinfo/p2p-hackers > > _______________________________________________ > > p2p-hackers mailing list > > p2p-hackers(a)lists.zooko.com <mailto:p2p-hackers@lists.zooko.com> > > http://lists.zooko.com/mailman/listinfo/p2p-hackers > > > > > > > > > > -- > > Pierre St Juste > > > > > > > > _______________________________________________ > > p2p-hackers mailing list > > p2p-hackers(a)lists.zooko.com > > http://lists.zooko.com/mailman/listinfo/p2p-hackers > _______________________________________________ > p2p-hackers mailing list > p2p-hackers(a)lists.zooko.com > http://lists.zooko.com/mailman/listinfo/p2p-hackers > -- Dr. Renato J. Figueiredo Associate Professor ACIS Lab - ECE - University of Florida UF Site Director, Center for Autonomic Computing http://byron.acis.ufl.edu ph: 352-392-6430 _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Bush declares war on freedom of the press
by David Farber 06 Jul '18

06 Jul '18

-----Original Message----- From: "Glenn Tenney" <gt_IP060107(a)think.org> To: "Dave Farber" <dave(a)farber.net> Sent: 3/10/06 13:41 Subject: Bush declares war on freedom of the press (for IP if you wish) http://www.capitolhillblue.com/blog/2006/03/bush_declares_war_on_freedom_o.… ml Bush declares war on freedom of the press March 6, 2006 07:44 AM / The Rant . By DOUG THOMPSON Using many of the questionable surveillance and monitoring techniques that brought both questions and criticism to his administration, President George W. Bush has launched a war against reporters who write stories unfavorable to his actions and is planning to prosecute journalists to make examples of them in his "war on terrorism." Bush recently directed Attorney General Alberto Gonzales to use "whatever means at your disposal" to wiretap, follow, harass and investigate journalists who have published stories about the administration's illegal use of warrantless wiretaps, use of faulty intelligence and anything else he deems "detrimental to the war on terror." Reporters for The New York Times, which along with Capitol Hill Blue revealed use of the National Security Agency to monitor phone calls and emails of Americans, say FBI agents have interviewed them and criminal prosecutors at the Justice Department admit they are laying "the groundwork for a grand jury that could lead to criminal charges," CIA Director Porter Goss told Congress recently that "it is my aim and it is my hope that we will witness a grand jury investigation with reporters present being asked to reveal who is leaking this information. I believe the safety of this nation and the people of this country deserve nothing less." As part of the investigation, the Justice Department, Department of Homeland Security and the National Security Agency are wiretapping reporters' phones, following journalists on a daily basis, searching their homes and offices under a USA Patriot Act provision that allows "secret and undisclosed searches" and pouring over financial and travel records of hundreds of Washington-based reporters. Spokesmen for the Justice Department and Department of Homeland Security admit there are "ongoing investigations" regarding publication of stories "involving threats to national security" but will not reveal what those investigations include. In addition to using the USA Patriot Act to pry into the lives of journalists, the Justice Department has also dusted off a pre-World War I law to prosecute people who receive classified information, although the law was aimed at military personnel not civilians. "This is the first administration that I can remember, including Nixon's, that said we need to think about a law that would put journalists who print national security things up in front of grand juries and put them in jail if they don't reveal their sources," says David Gergen, who served as President Regan's director of communication and also worked in the Nixon and Ford White Houses. Political scientist George Harleigh, who worked in the Nixon administration, says such use of federal law enforcement authority was illegal when Nixon tried it and still so today. "We're talking about a basic violation of the Constitutional guarantee of a free press as well as a violation of the rights of privacy of American citizens," Harleigh says. "I had hoped we would have learned our lessons from the Nixon era. Sadly, it appears we have not." In recent weeks, the FBI has issued hundreds of "National Security Letters," directing employers, banks, credit card companies, libraries and other entities to turn over records on reporters. Under the USA Patriot Act, those who must turn over the records are also prohibited from revealing they have done so to the subject of the federal probes. "The significance of this cannot be overstated," says prominent New York litigator Glenn Greenwald. "In essence, while the President sits in the White House undisturbed after proudly announcing that he has been breaking the law and will continue to do so, his slavish political appointees at the Justice Department are using the mammoth law enforcement powers of the federal government to find and criminally prosecute those who brought this illegal conduct to light. "This flamboyant use of the forces of criminal prosecution to threaten whistle-blowers and intimidate journalists are nothing more than the naked tactics of street thugs and authoritarian juntas." Just how widespread, and uncontrolled, this latest government assault has become hit close to home last week when one of the FBI's National Security Letters arrived at the company that hosts the servers for this web site, Capitol Hill Blue. The letter demanded traffic data, payment records and other information about the web site along with information on me, the publisher. Now that's a problem. I own the company that hosts Capitol Hill Blue. So, in effect, the feds want me to turn over information on myself and not tell myself that I'm doing it. You'd think they'd know better. I turned the letter over to my lawyer and told him to send the following message to the feds: Fuck you. Strong letter to follow. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

EDRi-gram - Number 6.20, 22 October 2008
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 6.20, 22 October 2008 ============================================================ Contents ============================================================ 1. Some amendments of the EP voted Telecom package still worrying 2. The PNR scheme entirely changed by the European Council 3. International Action Day "Freedom not Fear" - 11.10.2008 4. Freedom not Fear Prague: Do It Yourself Carnival burst in the city center 5. New Dutch Notice-and-Take-Down Code Raises Questions 6. Protests in France against the Edvige file on St. Edwige day 7. German court says ISPs do not violate the law by storing IP addresses 8. British court: people are bound to reveal computer encryption key 9. ENDitorial: Seizures and other abuses - from bad to worse 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. Some amendments of the EP voted Telecom package still worrying ============================================================ Some of the amendments passed by the European Parliament (EP) on the Telecom package are still worrying the civil rights groups, both on data retention and IP issues. Also, the fact that some amendments of the EP do not appear in the new document of the European Council working party on Telecommunications and the Information Society creates more confusion. According to information from Patrick Breyer from the German Working Group on Data Retention, amendment 181 passed by the European Parliament regarding directive 2002/58/EC could be read to legalise "voluntary" blanket data retention practices as currently practised in the US. The amendment would make the entire regulation of traffic data in Article 6 of the directive meaningless. It is not restricted to times when an actual network error occurs but would allow a general collection of traffic data on the grounds of them being useful for "security purposes". It does not set a time limit, either. Amendment 181 added in the Article 6 the following text: " Without prejudice to compliance with the provisions other than Article 7 of Directive 95/46/EC and Article 5 of this Directive, traffic data may be processed for the legitimate interest of the data controller for the purpose of implementing technical measures to ensure the network and information security, as defined by Article 4 (c) of Regulation (EC) 460/2004 of the European Parliament and of the Council of 10 March 2004 establishing the European Network and Information Security Agency, of a public electronic communication service, a public or private electronic communications network, an information society service or related terminal and electronic communication equipment, except where such interests are overridden by the interests for the fundamental rights and freedoms of the data subject. Such processing must be restricted to that which is strictly necessary for the purposes of such security activity." It seems that a majority of the EU member states are already critical to this amendment. But other amendments on the 3 strikes approach have come back on the agenda. On 14 October 2008, the European Council Working Party on Telecommunications and the Information Society issued a document that eliminated, without any explanation or justification, the pro-Bono amendment 166 (Article 32a) of the Universal Access directive (Harbour report) in the Telecoms Package reiterating the European Parliament's opposition to the 3-strikes measures system. The article in question that said: "Article 32a Access to content, services and applications Member States shall ensure that any restrictions to users' rights to access content, services and applications, if they are necessary, shall be implemented by appropriate measures, in accordance with the principles of proportionality, effectiveness and dissuasiveness. These measures shall not have the effect of hindering the development of the information society, in compliance with Directive 2000/31/EC, and shall not conflict with citizens' fundamental rights, including the right to privacy and the right to due process" and which was voted by a clear majority in the Parliament, simply lacks from the recent European Council document without any explanation whatsoever. The document includes some other amendments which pave the way for the 3-strike system, imposing costs on ISPs and removing the oversight by the European Commission and national Regulators meant to protect users from content filtering. At the same time, the article designed to support the French graduated response measures, (the co-operation Amendment 112 - Article 33 (2a) is kept. Some of the state members, such as UK, Ireland, Germany, Austria and Hungary have reserves concerning the European Council document but the French government is pushing to see its system imposed on all EU members. In an attempt to influence the German government's position, a seminar, "on the development of Creative content online" was organized by the French embassy in Berlin with the title "Can the Olivennes agreement set the course for the digital future?". During the seminar, German MEP Ruth Hieronymi clearly stated that co-operation amendment 112 of the Harbour report in the Telecoms Package provided the basis for the graduated response in EU law. "I am absolutely convinced, that the legal framework is there, to fashion a model like Olivennes that is compatible with European law" she stated in relation to the Telecoms Package. The MEP also claimed personal responsibility for the withdrawal of Amendment 132 in the Framework directive which opposed graduated response, and was in direct conflict with Amendment 112 and the other pro-Olivennes measures. Hieronymi's comments show that the attempt to insert graduated response and copyright enforcement measures into the Harbour report was deliberate. Which means that a vote for the directive as it is now, will clearly be a vote for graduated response. Unless there is no opposition form the governments having shown some reserves, the law imposing the graduated response will be passed to all EU countries by December, as the Council seems to have decided to negotiate the document and not send it back to the EP for a second reading. European Council set to overturn Parliament on 3-strikes (15.10.2008) http://www.iptegrity.com/index.php?option=com_content&task=view&id=181&Item… Working Party on Telecommunications and Information Society - Compromise Proposal for the consolidated version of the proposal amending directive 2002/22/EC (10.10.2008) http://www.iptegrity.com/pdf/European.Council.Universal.Service.Directive.p… "Co-operation" amendment WAS designed to support 3-strikes (17.10.2008) http://www.iptegrity.com/index.php?option=com_content&task=view&id=183&Item… EDRIgram: EP votes Telecoms Package (8.10.2008) http://www.edri.org/edrigram/number6.19/ep-votes-telecom-package ============================================================ 2. The PNR scheme entirely changed by the European Council ============================================================ The European Council has started re-writing from scratch the European Commission's proposal for an EU-PNR scheme as a result of several EU governments' intention to go further in this matter. Some European governments, with the UK in the lead, want to extend the PNR scheme used now under the US-EU agreement to all types of travel (air, land and sea), not only in and out the EU borders but between EU countries and even within each country. They also want the data and information gathered to be used not just for entry-exit, but also for any law enforcement purpose. The declared purpose of collecting the data is "the prevention, detection, investigation, prosecution and punishment of terrorism and a group of other serious offences, defined by reference to the list in the Framework Decision on the European Arrest Warrant." However, there is an additional statement which gives more freedom to control: "The instrument would of course cover the reporting and prosecution of other offences brought to light during controls." While the PIUs (Passenger Information Units) collect the data from airlines and assess the passengers, "competent national authorities" (i.e. police, security agencies) would be allowed to use the data for other purposes than for assessing security risks for flights. The list of data to be collected practically covers the same 19 sets of data under the US-EU PNR agreement. Also, there will be two transmissions of the data, one 48 hours before the flight take off and one when the flight is all boarded. The procedure for analysing the "terrorist or criminal threat" will include a first analysis "based on risk indicators" (such as source country or destination) "pre-established by the competent (national) authorities" and a second one based on "national, international and European files". However, the issue here is that the 27 EU countries have watch lists which are extremely different. Hence, the proposal suggests the necessity of developing "common methods and indicators". As some of the State Members do not wish to extend the scheme to flights inside the EU space, the text proposes that the choice of individual states to take the measure at the national level should be "explicitly recognised". This means that actually the PNR will be collected by all Member States on all flights in and out of the EU and if a Member State wants to survey intra-community flights as well, it can very well do it. EU-PNR scheme being re-written by the Council (4.10.2008) http://www.statewatch.org/news/2008/oct/04eu-pnr-rewrite.htm EDRIgram - Dispute between UK government and EU over the use of PNR (27.08.2008) http://www.edri.org/edrigram/number6.16/uk-eu-pnr Observatory: EU surveillance of passengers (PNR) http://www.statewatch.org/eu-pnrobservatory.htm ============================================================ 3. International Action Day "Freedom not Fear" - 11.10.2008 ============================================================ The first worldwide protests against surveillance measures such as the collection of all telecommunications data, the surveillance of air travellers and the biometric registration of citizens were held on 11 October 2008 under the motto "Freedom not Fear - Stop the surveillance mania!". In at least 15 countries citizens demanded a cutback on surveillance, a moratorium on new surveillance powers and an independent evaluation of existing surveillance powers. "A free and open society cannot exist without unconditionally private spaces and communications", explains an international memorandum. The greatest protest march against surveillance in Germany's history took place in Berlin. Participants in the 2 km long peaceful protest march carried signs reading "You are Germany, you are a suspect", "No Stasi 2.0 - Constitution applicable here", "Fear of Freedom?" and "Glass citizens, brittle democracy". Apart from related music tracks, loud chants of "Belittle it today, be under surveillance tomorrow" or "We are here and we are loud because they are stealing our data" could be heard. During the protests, which were supported by more than 100 civil liberties groups, professional associations, unions, political parties and other organisations, artists played parodies on surveillance society. In their final speeches in front of the Brandenburg Gate, the organisers called for political consequences: padeluun of civil liberties group FoeBuD said that in view of the mass protests politicians needed to react now and repeal the blanket retention of all telecommunications data introduced in 2006. Patrick Breyer of German Working Group on Data Retention (AK Vorrat) presented a five point plan according to which surveillance should be reduced, existing laws should be evaluated and plans for new surveillance measures should be halted. In the course of a "new, freedom-loving security policy" specific preventive measures such as youth projects should be invested in and the "real problems" of people such as poverty and education should be focused on. Ricardo Cristof Remmert-Fontes of AK Vorrat announced further action and invited participants to join parties held in seven participating clubs in Berlin under the motto "The long night of surveillance". In other countries, the following events took place in the course of yesterday's "Freedom not Fear" day: Protest event with music and several art performances in Den Haag, lectures in Rome, surveillance camera mapping in Madrid, art performances in front of Parliament in Vienna, protest rallies in Paris, Prague, Sofia and Stockholm, the distribution of privacy software in Copenhagen, informative events in Guatemala City and Buenos Aires as well as a projection of light onto Toronto's Town Hall. In London, the construction of a surveillance state was opposed by creating a massive collage of photos on Parliament Square showing the prime minister and the action day's motto "Freedom not Fear". Before the action day, Arbeitskreis Vorratsdatenspeicherung had warned of a "surveillance avalanche in Germany": According to the group, the German Parliament has tightened surveillance and control over citizens at least 21 times in the past 10 years. At least 18 more surveillance proposals are presently on the political agenda, for example the blanket collection of air travellers' data and the transfer of personal data to the US. In an opinion published on 14 October 2008, the competent Advocate General at the European Court of Justice considered that the EU directive on data retention was enacted on the correct legal basis. The German Working Group on Data Retention pointed out that the Advocate General's opinion only concerns the action brought by the Irish government which is limited to formal issues. It is not concerned with the fact that registering the telecommunications behaviour and movements of the entire EU population in the absence of any reasonable suspicion is clearly disproportionate and violates human rights. If the Court follows the Advocate General's opinion and dismisses Ireland's suit, it will need to consider the compatibility with human rights in a second proceeding. This second proceeding is likely to be initiated by the German Federal Constitutional Court where a suit of more than 34 000 citizens against data retention is pending. In another case, The German Federal Constitutional Court is expected to decide shortly on an application for a preliminary injunction against the German law on data retention. The application is directed mainly against the retention of Internet access, anonymizing services and e-mail data which is to become effective on 1 January 2009. The Constitutional Court's final judgement will probably be passed after the European Court of Justice has decided on the human rights issues. International Action Day "Freedom not fear - Stop the surveillance mania!" on 11 October 2008 http://www.vorratsdatenspeicherung.de/content/view/242/144/lang,en/ Freedom Not Fear: the Big Picture unveiled on Parliament Square (11.10.2008) http://www.openrightsgroup.org/2008/10/11/freedom-not-fear-the-big-picture-… Advocate General Bot considets that the directive on data retention is founded on an appropriate legal basis (14.10.2008) http://curia.europa.eu/en/actu/communiques/cp08/aff/cp080070en.pdf Constitutional complaint filed against German Telecomms Data Retention Act http://www.vorratsdatenspeicherung.de/content/view/184/79/lang,en/ (contribution by German Working Group on Data Retention) ============================================================ 4. Freedom not Fear Prague: Do It Yourself Carnival burst in the city center ============================================================ On 11 October 2008 Prague hosted the DIY Carnival which marched through the city centre in the name of the worldwide initiative "Freedom not Fear". Starting with a concert of several music groups on the river island Stvanice, more than 1000 people wearing masks outnumbered crowds of tourists on the fancy streets of the Old Town and protested against increasing surveillance within the society. The colourful parade ended up at sunset, but some of the participants reunited later that night on the occasion of Big Brother Awards benefit concert which was organized by EDRi member Iuridicum Remedium. "The recent level of restrictions which criminalize majority of our society is alarming. It is another step towards state where police is competent to arbitrary bully people on the streets," said Jan Nemec, the spokesman of the Freedom not Fear initiative in Prague, in his public speech. "Let your voices be heard and express your resolute protest against these oppressive measures," called Jan Nemec on the participants. However, the organization of the DIY Carnival did not go that smoothly as might be observed from its results. The parade had to take an alternative route, because the municipal authorities banned the original one on the bases of their fear that the carnival could turn into a street party. Subsequently, the organizers have lodged an appeal with the court that was later dismissed. The final decision is still pending, though. "The hearing on the ban took place on Friday, just one day after we received an email notification, while the rules of the administrative court grant at least ten days for preparation," commented the first instance decision Helena Svatosova, lawyer from the NGO Iuridicum Remedium, who initiated proceedings in this matter before the Highest Administrative Court. (contribution by Vaclav Mlynarik - EDRi-member Iuridicum Remedium) ============================================================ 5. New Dutch Notice-and-Take-Down Code raises questions ============================================================ Dutch government and leading market participants have adopted a new Notice-and-Take-Down Code of Conduct. The Code seeks to clarify the responsibilities of internet intermediaries (hosting providers in particular) when confronted with a notice that online information is punishable (under Dutch penal law) or unlawful. Reactions to the code are mixed. Many hosting providers have not signed the Code. Others have called it symbolic. In fact, the Code seems to obscure the current legal obligations of internet service providers with regard to punishable and unlawful material. Unfortunately, the Code does not even mention the right to freedom of expression and the issue of censorship. Although the code has no legal status, it goes further than the Dutch law in a number of ways. The Code states that a notice of a public prosecutor that material is punishable cannot be questioned by a provider, because the public prosecutor has already established its illegal character. However, a recent academic study of the Centre for Cybercrime Studies (Cycris), commissioned by the Dutch government, revealed the inadequacy of Dutch laws concerning Notice and Takedown. In particular, it found that the public prosecutor does not have an adequate legal instrument to order material to be taken down. The study concluded that "there are insufficient guarantees built into the process to protect the interests of Internet users and the information freedoms". The Dutch government has responded that it is reviewing the relevant laws, but it has completely ignored the problem in the context of this new Code. In the case of notices of punishable and unlawful material from others than the public prosecutor the Code provides that an intermediary will remove the material if it is 'unequivocally' punishable or unlawful. If not, the party seeking removal can either seek involvement of law enforcement agencies or start a civil procedure. There is no explicit mention of a put-back procedure. The Code does state that intermediaries have to be careful not to remove more content than the notice points to. The Code does not change the circumstances under which rights holders can retrieve identifying data of alleged infringers of copyright. For this reason, BREIN, the representative of the rights holders in the Netherlands, has made clear it sees the current Code as unsatisfactory. To complicate matters, the Code introduces the concept of 'undesirable' or 'harmful' material. It defines this as material that is not illegal or unlawful under Dutch law, but material that a provider itself does not want to host, because of its 'undesirable' or 'harmful' character. The Code states that the provider is free to develop such criteria and treat notices of 'undesirable' or 'harmful' material the same way as notices of illegal material. Clearly, government involvement in this part of the Code of Practice is problematic from the perspective of freedom of expression. The Code does not clarify which categories of content can legitimately be considered as 'undesirable' or 'harmful' by an intermediary. And unfortunately, the Code does not explicitly forbid law enforcement agencies to send notices of 'undesirable' or 'harmful' material, whereas such notices would seem to be illegal. The Code was adopted in the context of the National Infrastructure Cybercrime, a public private partnership, which includes several branches of the Dutch Government, major broadband providers such as KPN, XS4all, and cable providers. There is no official list of participants in the Code. Notice-And-Take-Down Code of Conduct (9.10.2008) http://www.samentegencybercrime.nl/UserFiles/File/NTD_Gedragscode_Opmaak_En… Dutch 'Notice-and-Take-Down' Code of Conduct issued (14.10.2008) http://www.saferinternet.org/ww/en/pub/insafe/news/articles/1108/notice_and… Cycris Research on art. 54a of the Dutch Penal Code (13.05.2008) http://www.cycris.nl/news/7/39 Hosters en Brein sluiten piraterij-compromis (In Dutch only) (9.10.2008) http://webwereld.nl/articles/53058/hosters-en-brein-sluiten-piraterij-compr… (Contribution by Joris van Hoboken - EDRi-member Bits of Freedom -Netherlands) ============================================================ 6. Protests in France against the Edvige file on St. Edwige day ============================================================ As previously announced in EDRi-gram, St. Edwige day in France was a day of protests against the file project called Edvige, a file that would gather information on any person, including minors, considered by the police as a "suspect" capable of disrupting the public order. On 16 October, on St. Edwige day, demonstrations against the introduction of the Edvige file were organised in Paris, Agen, Bordeaux, Strasbourg, Saint-Etienne, Lyon and other big cities in France by the "Non ` Edvige" group that included La Ligue des Droits de L'Hommes (The League of Human Rights), FSU, CGT, CFDT, Aides and French EDRi-member IRIS. The project had already been modified in September into the so called EDVIRSP file. However, even the new version was considered unacceptable by the opponents of the project especially because it involves gathering data on minors who are considered by the police a public threat. The "Non ` Edvige" petition is asking for the cancellation of the entire project. It remains to be seen if the demonstrations that took place on 16 October will find any echo with the French authorities. On Saint Edwige, the anti-Edvige march on the streets (only in French, 16.10.2008) http://www.lemonde.fr/web/son/0,54-0@2-3224,63-1107874@51-1090646,0.html Saint Edwige: the anti-Edvige in the street (only in French,17.10.2008) http://www.top-logiciel.net/news-article.storyid-3044.htm On Saint Edwidge: I don't want Edvige ! (only in French, 17.10.2008) http://www.youtube.com/watch?v=94hUZr6FxLc&feature=user EDRIgram - French file EDVIGE revised after huge civil society mobilization (only in French, 24.09.2008) http://www.edri.org/edrigram/number6.18/edvige-revised ============================================================ 7. German court says ISPs do not violate the law by storing IP addresses ============================================================ On 30 September 2008, the Munich District Court decided in a provisional ruling that website operators were not violating the data protection legislation when storing IP addresses of their visitors as IP addresses alone are not considered personal data. The case was brought to the court by an individual who argued that storing IP addresses in log files by a web publisher represents a privacy violation because the information could be used to identify him and relate his identity to his web surfing activity. The court dismissed his arguments and ruled against his claim. The court considers IP addresses are not personal data under the German Privacy Act because the information cannot be easily used to determine a person's identity and an ISP could not tell a third party who was using a particular IP address at a particular time without a legal basis. Such information is provided by ISPs only when ordered by a court. The ruling also said that IP addresses lacked the necessary quality of "determinability" to be personal data, meaning the identity of the person behind the information cannot be established without a significant effort and by using "normally available knowledge and tools." However, we should not over-estimate the relevance of this decision.It was taken by a local court with no IT experts and the judge did not discuss the dissenting decisions from higher level Berlin courts. The decision only applies to dynamic IP addresses. Privacy activists have argued that IP addresses should count as personal data under data protection legislation. The Article 29 Working Party has also said that IP addresses should be treated as personal data by ISPs and search engines, even if they are not always personal data. "Unless the Internet Service Provider is in a position to distinguish with absolute certainty that the data correspond to users that cannot be identified, it will have to treat all IP information as personal data, to be on the safe side. These considerations will apply equally to search engine operators," said a report issued by the Article 29 Working Party in April. Regarding the fact that IP addresses are not considered personal data by some, in an interview given to EurActiv on the data protection rules, the European Data Protection Supervisor Peter Hustinx explained : "As of today there is some uncertainty, and this is why we will probably see a study from the Commission to shed light on this. But the common view of the data protection specialists is that in many situations IP addresses are personal data. Therefore websites, Internet Service Providers and other parties should ensure data protection compliance. This is an important thing to emphasise." He also believes that The European Commission should clarify the application of existing data protection rules in relation to RFID in order to avoid "big social dangers". German court says IP addresses in server logs are not personal data (14.10.2008) http://www.out-law.com/page-9505 Hustinx: Tracking people 'easier' with RFID (3.10.2008) http://www.euractiv.com/en/infosociety/hustinx-tracking-people-easier-rfid/… AG, Munich: IP addresses may be used by Web site operators are stored (only in German, 7.10.2008) http://www.kremer-legal.com/2008/10/07/ag-munchen-ip-adressen-durfen-von-we… ============================================================ 8. British court: people are bound to reveal computer encryption key ============================================================ Two persons were denied by the court the right to silence in relation to the encryption key they were asked to reveal to the police. The men had brought as argument to the court that handing over the encrypted key for the data in their computers would mean forcing them to incriminate themselves. Defendants have a right to silence and to refuse to divulge information that could be used as evidence against them. The Court of Appeal however considered that an encryption password is not incriminating information in itself and that the key as well as the information in the computers existed independently from the men just like any key to a drawer and its content. Therefore, the men had no right to deny the police the encryption keys. The two men had been arrested the police for having been involved with a person who was subject to a control order under anti-terrorism legislation and their computers had been seized. The police had sent notices ordering the men to disclose the passwords in the interest of national security and the prevention or detection of crime. The authorities can ask disclosure of such keys because, in terms of the law, the information on the computers is already in the possession of the police and an order for password disclosure can be made, if "no alternative, reasonable method of gaining access to it or making it intelligible is available" as expressed by Mr Justice Penry-Davey in the Court of Appeal. According to the Regulation of Investigatory Powers Act (RIPA), the refusal to reveal a decryption key can be punished with imprisonment up to 5 years. The clause covering this measure has been included in RIPA act since 2007 but has not been activated until 1 October 2008 because, last year, the Home Office considered that the encryption was not as popular as it had been predicted. Part III of RIPA was activated after a period of consultation. People receiving notice from the police are bound to reveal the encryption keys or render the requested material intelligible by authorities. The clause has been criticised by civil liberties activists and security experts who consider that the measure affects privacy and can lead to persons being forced to incriminate themselves. An argument against the action is also that passwords can be forgotten and people may pretend to have forgotten or really forget them. According to the Home Office, the process will be overseen by the Interception of Communications Commissioner, the Intelligence Services Commissioner and the Chief Surveillance Commissioner and complaints about demands for information will be made by the Investigatory Powers Tribunal. The Home Office considers that the actions are consistent with the European Convention on Human Rights and the UK Human Rights Act as long as the demand for decryption is "both necessary and proportionate". "The measures in Part III are intended to ensure that the ability of public authorities to protect the public and the effectiveness of their other statutory powers are not undermined by the use of technologies to protect electronic information," stated the Home Office. But besides the concerns raised by civil liberties activists, there are also voices that warn the measure may even lead to hiding more material from the Police. "I think putting the powers on the statute book will make it more, not less, likely that police will encounter encrypted material because people will become aware of dual key systems and see how easy they are to use," commented security expert Dr Richard Clayton. Court of Appeal orders men to disclose encryption keys (16.10.2008) http://www.out-law.com//default.aspx?page=9514 England and Wales Court of Appeal (Criminal Division) Decisions (9.10.2008) http://www.bailii.org/ew/cases/EWCA/Crim/2008/2177.html RIPA could be challenged on human rights (24.01.2008) http://www.out-law.com/page-8826 Law requiring disclosure of decryption keys in force (2.10.2007) http://www.out-law.com/page-8515 ============================================================ 9. ENDitorial: Seizures and other abuses - from bad to worse ============================================================ Two recent episodes (that are not "isolated cases") show, again, how distortions in Italian laws and in their application can lead to all sorts of abuses - as discussed before. The problem is that these abuses are not only continuing, but getting worse. One is explained in a recent article and is obviously (no matter how it's disguised) a case of censorship. The other case we are discussing here, if taken as a single episode, could be seen as a comedy of errors. A website for the exchange of music was "seized" - that is to say, access was blocked. It was soon moved to another address, and later the "seizure" was revoked. So it didn't suffer any serious damage and it may have gained some publicity as a result of the protest in Italy and elsewhere caused by the attempt to choke it. The instigators of the repression (as usual, the lobbies of music majors) were (in this case and so far) defeated and ridiculed. But the procedures in this grotesque affair reveal several alarming abuses. Many problems, for many years, have been caused by an awkward peculiarity of the Italian legislation, that treats copyright infringement as a criminal offence. And it has always been an awful abuse to seize computers, servers etcetera with a brutal procedure that is useless for investigation purposes and dramatically harmful not only for suspects who are "innocent until proven guilty", but also for people and organizations who are not involved in the facts (or assumptions) being investigated. In recent years this abuse has taken a new twist, that queerly extends the "seizure" concept to the suppression of a website or if, as in this case, the website isn't in Italy, to force Italian internet providers to block access (or even, as in this example, to arbitrarily re-route the "traffic" to another foreign website, dedicated to persecuting people who are trying to access the blacklisted source). It would be dangerous to underestimate the implications of these behaviors, too easily supported by internet providers, who care about their selfish interests above the rights of their customers. They go far beyond the consequences of individual episodes, suggesting criteria and procedures that can be extended to the repression of any unwelcome opinion or information, as well as of enterprises competing with "favored" interests. To make things even worse, in this case the attack was on a site that doesn't offer file sharing, but information on where resources can be found. This could lead to the absurdity of turning not only connection providers, but also search engines, into censors, spies and "sheriffs" of the net for inquiries and prohibitions originating in any country and extending beyond its borders. In a "package of rules" recently approved (September 24, 2008) by the European Union Parliament "measures that would have allowed a control on internet users were rejected." Specifically, "the MEPs rejected the idea that ISPs should filter all downloads and punish the infringers of copyright rules, being thus transformed into a sort of online police." Of course it remains to be seen if and how "good intentions" will be applied, but in the meantime Italian authorities, once again, appear to be peculiarly prone in obeying the whims and wishes of the "owners of ideas" and not as careful as they should in ensuring freedom of opinion and civil rights. An update on the Italian PirateBay case (8.10.2008) http://www.edri.org/edrigram/number6.19/update-piratebay-italy The European Parliament voted the Telecoms Package (8.10.2008) http://www.edri.org/edrigram/number6.19/ep-votes-telecom-package ENDitorial: A stupid law and a perverse "criminal" sentence (24.09.2008) http://www.edri.org/edrigram/number6.18/stupid-law-italy (contribution by Giancarlo Livraghi - EDRi-member ALCEI - Italy) ============================================================ 10. Recommended Reading ============================================================ The Council of Europe launched, in close cooperation with European online game designers and publishers and with Internet service providers, two sets of guidelines which aim to encourage respect and promote privacy, security and freedom of expression. Human Right Guidelines for Online games providers http://www.coe.int/t/dghl/standardsetting/media/Doc/H-Inf(2008)008_en.pdf Human Right Guidelines for Internet service providers http://www.coe.int/t/dghl/standardsetting/media/Doc/H-Inf(2008)009_en.pdf ============================================================ 11. Agenda ============================================================ 24 October 2008, Bielefeld, Germany Big Brother Awards Germany 2008 http://www.BigBrotherAwards.de/ 25 October 2008, Vienna, Austria Big Brother Awards Austria 2008 http://www.BigBrotherAwards.at/ 3-7 November 2008, Geneva, Switzerland Standing Committee on Copyright and Related Rights : Seventeeth Session http://www.wipo.int/meetings/en/details.jsp?meeting_id=16828 13-14 November 2008, Chisinau, Moldova IFLA/EBLIDA/eIFL Conference on copyright and libraries Copyright: Enabling Access or Creating Roadblocks for Libraries? Registration by 1 November 2008 http://www.eblida.org/index.php?page=draft-programme-2 25-26 November 2008, Brussels, Belgium World e-Parliament Conference 2008 http://www.ictparliament.org/worldeparliamentconference2008/ 3-6 December 2008, Hyderabad, India Third Internet Governance Forum http://www.intgovforum.org 9-10 December 2008, Madrid, Spain Future Internet Assembly http://www.future-internet.eu/home/future-internet-assembly/madrid-dec-2008… http://www.fi-madrid.eu/ 10-11 December 2008: Tilburg, Netherlands Tilting perspectives on regulating technologies, Tilburg Institute for Law and Technology and Society, Tilburg University http://www.tilburguniversity.nl/tilt/conference 27-30 December 2008 Berlin, Germany 25C3: Nothing to hide The 25th Chaos Communication Congress http://events.ccc.de/congress/2008/ 18-20 March 2009, Athens, Greece WebSci'09: Society On-Line http://www.websci09.org/ 1-4 June 2009, Washington, DC, USA Computers Freedom and Privacy 2009 http://www.cfp2009.org/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 28 members based or with offices in 17 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

NIST announces SHA-3 round 2 candidates
by Jack Lloyd 06 Jul '18

06 Jul '18

http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/submissions_rnd2.html """ A report summarizing NIST's selection of these candidates will be forthcoming. A year is allocated for the public review of these algorithms, and the Second SHA-3 Candidate Conference is being planned for August 23-24, 2010, after Crypto 2010. """ Making the cut: BLAKE Blue Midnight Wish CubeHash ECHO Fugue Grostl Hamsi JH Keccak Luffa Shabal SHAvite-3 SIMD Skein --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

EDRi-gram - Number 6.20, 22 October 2008
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 6.20, 22 October 2008 ============================================================ Contents ============================================================ 1. Some amendments of the EP voted Telecom package still worrying 2. The PNR scheme entirely changed by the European Council 3. International Action Day "Freedom not Fear" - 11.10.2008 4. Freedom not Fear Prague: Do It Yourself Carnival burst in the city center 5. New Dutch Notice-and-Take-Down Code Raises Questions 6. Protests in France against the Edvige file on St. Edwige day 7. German court says ISPs do not violate the law by storing IP addresses 8. British court: people are bound to reveal computer encryption key 9. ENDitorial: Seizures and other abuses - from bad to worse 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. Some amendments of the EP voted Telecom package still worrying ============================================================ Some of the amendments passed by the European Parliament (EP) on the Telecom package are still worrying the civil rights groups, both on data retention and IP issues. Also, the fact that some amendments of the EP do not appear in the new document of the European Council working party on Telecommunications and the Information Society creates more confusion. According to information from Patrick Breyer from the German Working Group on Data Retention, amendment 181 passed by the European Parliament regarding directive 2002/58/EC could be read to legalise "voluntary" blanket data retention practices as currently practised in the US. The amendment would make the entire regulation of traffic data in Article 6 of the directive meaningless. It is not restricted to times when an actual network error occurs but would allow a general collection of traffic data on the grounds of them being useful for "security purposes". It does not set a time limit, either. Amendment 181 added in the Article 6 the following text: " Without prejudice to compliance with the provisions other than Article 7 of Directive 95/46/EC and Article 5 of this Directive, traffic data may be processed for the legitimate interest of the data controller for the purpose of implementing technical measures to ensure the network and information security, as defined by Article 4 (c) of Regulation (EC) 460/2004 of the European Parliament and of the Council of 10 March 2004 establishing the European Network and Information Security Agency, of a public electronic communication service, a public or private electronic communications network, an information society service or related terminal and electronic communication equipment, except where such interests are overridden by the interests for the fundamental rights and freedoms of the data subject. Such processing must be restricted to that which is strictly necessary for the purposes of such security activity." It seems that a majority of the EU member states are already critical to this amendment. But other amendments on the 3 strikes approach have come back on the agenda. On 14 October 2008, the European Council Working Party on Telecommunications and the Information Society issued a document that eliminated, without any explanation or justification, the pro-Bono amendment 166 (Article 32a) of the Universal Access directive (Harbour report) in the Telecoms Package reiterating the European Parliament's opposition to the 3-strikes measures system. The article in question that said: "Article 32a Access to content, services and applications Member States shall ensure that any restrictions to users' rights to access content, services and applications, if they are necessary, shall be implemented by appropriate measures, in accordance with the principles of proportionality, effectiveness and dissuasiveness. These measures shall not have the effect of hindering the development of the information society, in compliance with Directive 2000/31/EC, and shall not conflict with citizens' fundamental rights, including the right to privacy and the right to due process" and which was voted by a clear majority in the Parliament, simply lacks from the recent European Council document without any explanation whatsoever. The document includes some other amendments which pave the way for the 3-strike system, imposing costs on ISPs and removing the oversight by the European Commission and national Regulators meant to protect users from content filtering. At the same time, the article designed to support the French graduated response measures, (the co-operation Amendment 112 - Article 33 (2a) is kept. Some of the state members, such as UK, Ireland, Germany, Austria and Hungary have reserves concerning the European Council document but the French government is pushing to see its system imposed on all EU members. In an attempt to influence the German government's position, a seminar, "on the development of Creative content online" was organized by the French embassy in Berlin with the title "Can the Olivennes agreement set the course for the digital future?". During the seminar, German MEP Ruth Hieronymi clearly stated that co-operation amendment 112 of the Harbour report in the Telecoms Package provided the basis for the graduated response in EU law. "I am absolutely convinced, that the legal framework is there, to fashion a model like Olivennes that is compatible with European law" she stated in relation to the Telecoms Package. The MEP also claimed personal responsibility for the withdrawal of Amendment 132 in the Framework directive which opposed graduated response, and was in direct conflict with Amendment 112 and the other pro-Olivennes measures. Hieronymi's comments show that the attempt to insert graduated response and copyright enforcement measures into the Harbour report was deliberate. Which means that a vote for the directive as it is now, will clearly be a vote for graduated response. Unless there is no opposition form the governments having shown some reserves, the law imposing the graduated response will be passed to all EU countries by December, as the Council seems to have decided to negotiate the document and not send it back to the EP for a second reading. European Council set to overturn Parliament on 3-strikes (15.10.2008) http://www.iptegrity.com/index.php?option=com_content&task=view&id=181&Item… Working Party on Telecommunications and Information Society - Compromise Proposal for the consolidated version of the proposal amending directive 2002/22/EC (10.10.2008) http://www.iptegrity.com/pdf/European.Council.Universal.Service.Directive.p… "Co-operation" amendment WAS designed to support 3-strikes (17.10.2008) http://www.iptegrity.com/index.php?option=com_content&task=view&id=183&Item… EDRIgram: EP votes Telecoms Package (8.10.2008) http://www.edri.org/edrigram/number6.19/ep-votes-telecom-package ============================================================ 2. The PNR scheme entirely changed by the European Council ============================================================ The European Council has started re-writing from scratch the European Commission's proposal for an EU-PNR scheme as a result of several EU governments' intention to go further in this matter. Some European governments, with the UK in the lead, want to extend the PNR scheme used now under the US-EU agreement to all types of travel (air, land and sea), not only in and out the EU borders but between EU countries and even within each country. They also want the data and information gathered to be used not just for entry-exit, but also for any law enforcement purpose. The declared purpose of collecting the data is "the prevention, detection, investigation, prosecution and punishment of terrorism and a group of other serious offences, defined by reference to the list in the Framework Decision on the European Arrest Warrant." However, there is an additional statement which gives more freedom to control: "The instrument would of course cover the reporting and prosecution of other offences brought to light during controls." While the PIUs (Passenger Information Units) collect the data from airlines and assess the passengers, "competent national authorities" (i.e. police, security agencies) would be allowed to use the data for other purposes than for assessing security risks for flights. The list of data to be collected practically covers the same 19 sets of data under the US-EU PNR agreement. Also, there will be two transmissions of the data, one 48 hours before the flight take off and one when the flight is all boarded. The procedure for analysing the "terrorist or criminal threat" will include a first analysis "based on risk indicators" (such as source country or destination) "pre-established by the competent (national) authorities" and a second one based on "national, international and European files". However, the issue here is that the 27 EU countries have watch lists which are extremely different. Hence, the proposal suggests the necessity of developing "common methods and indicators". As some of the State Members do not wish to extend the scheme to flights inside the EU space, the text proposes that the choice of individual states to take the measure at the national level should be "explicitly recognised". This means that actually the PNR will be collected by all Member States on all flights in and out of the EU and if a Member State wants to survey intra-community flights as well, it can very well do it. EU-PNR scheme being re-written by the Council (4.10.2008) http://www.statewatch.org/news/2008/oct/04eu-pnr-rewrite.htm EDRIgram - Dispute between UK government and EU over the use of PNR (27.08.2008) http://www.edri.org/edrigram/number6.16/uk-eu-pnr Observatory: EU surveillance of passengers (PNR) http://www.statewatch.org/eu-pnrobservatory.htm ============================================================ 3. International Action Day "Freedom not Fear" - 11.10.2008 ============================================================ The first worldwide protests against surveillance measures such as the collection of all telecommunications data, the surveillance of air travellers and the biometric registration of citizens were held on 11 October 2008 under the motto "Freedom not Fear - Stop the surveillance mania!". In at least 15 countries citizens demanded a cutback on surveillance, a moratorium on new surveillance powers and an independent evaluation of existing surveillance powers. "A free and open society cannot exist without unconditionally private spaces and communications", explains an international memorandum. The greatest protest march against surveillance in Germany's history took place in Berlin. Participants in the 2 km long peaceful protest march carried signs reading "You are Germany, you are a suspect", "No Stasi 2.0 - Constitution applicable here", "Fear of Freedom?" and "Glass citizens, brittle democracy". Apart from related music tracks, loud chants of "Belittle it today, be under surveillance tomorrow" or "We are here and we are loud because they are stealing our data" could be heard. During the protests, which were supported by more than 100 civil liberties groups, professional associations, unions, political parties and other organisations, artists played parodies on surveillance society. In their final speeches in front of the Brandenburg Gate, the organisers called for political consequences: padeluun of civil liberties group FoeBuD said that in view of the mass protests politicians needed to react now and repeal the blanket retention of all telecommunications data introduced in 2006. Patrick Breyer of German Working Group on Data Retention (AK Vorrat) presented a five point plan according to which surveillance should be reduced, existing laws should be evaluated and plans for new surveillance measures should be halted. In the course of a "new, freedom-loving security policy" specific preventive measures such as youth projects should be invested in and the "real problems" of people such as poverty and education should be focused on. Ricardo Cristof Remmert-Fontes of AK Vorrat announced further action and invited participants to join parties held in seven participating clubs in Berlin under the motto "The long night of surveillance". In other countries, the following events took place in the course of yesterday's "Freedom not Fear" day: Protest event with music and several art performances in Den Haag, lectures in Rome, surveillance camera mapping in Madrid, art performances in front of Parliament in Vienna, protest rallies in Paris, Prague, Sofia and Stockholm, the distribution of privacy software in Copenhagen, informative events in Guatemala City and Buenos Aires as well as a projection of light onto Toronto's Town Hall. In London, the construction of a surveillance state was opposed by creating a massive collage of photos on Parliament Square showing the prime minister and the action day's motto "Freedom not Fear". Before the action day, Arbeitskreis Vorratsdatenspeicherung had warned of a "surveillance avalanche in Germany": According to the group, the German Parliament has tightened surveillance and control over citizens at least 21 times in the past 10 years. At least 18 more surveillance proposals are presently on the political agenda, for example the blanket collection of air travellers' data and the transfer of personal data to the US. In an opinion published on 14 October 2008, the competent Advocate General at the European Court of Justice considered that the EU directive on data retention was enacted on the correct legal basis. The German Working Group on Data Retention pointed out that the Advocate General's opinion only concerns the action brought by the Irish government which is limited to formal issues. It is not concerned with the fact that registering the telecommunications behaviour and movements of the entire EU population in the absence of any reasonable suspicion is clearly disproportionate and violates human rights. If the Court follows the Advocate General's opinion and dismisses Ireland's suit, it will need to consider the compatibility with human rights in a second proceeding. This second proceeding is likely to be initiated by the German Federal Constitutional Court where a suit of more than 34 000 citizens against data retention is pending. In another case, The German Federal Constitutional Court is expected to decide shortly on an application for a preliminary injunction against the German law on data retention. The application is directed mainly against the retention of Internet access, anonymizing services and e-mail data which is to become effective on 1 January 2009. The Constitutional Court's final judgement will probably be passed after the European Court of Justice has decided on the human rights issues. International Action Day "Freedom not fear - Stop the surveillance mania!" on 11 October 2008 http://www.vorratsdatenspeicherung.de/content/view/242/144/lang,en/ Freedom Not Fear: the Big Picture unveiled on Parliament Square (11.10.2008) http://www.openrightsgroup.org/2008/10/11/freedom-not-fear-the-big-picture-… Advocate General Bot considets that the directive on data retention is founded on an appropriate legal basis (14.10.2008) http://curia.europa.eu/en/actu/communiques/cp08/aff/cp080070en.pdf Constitutional complaint filed against German Telecomms Data Retention Act http://www.vorratsdatenspeicherung.de/content/view/184/79/lang,en/ (contribution by German Working Group on Data Retention) ============================================================ 4. Freedom not Fear Prague: Do It Yourself Carnival burst in the city center ============================================================ On 11 October 2008 Prague hosted the DIY Carnival which marched through the city centre in the name of the worldwide initiative "Freedom not Fear". Starting with a concert of several music groups on the river island Stvanice, more than 1000 people wearing masks outnumbered crowds of tourists on the fancy streets of the Old Town and protested against increasing surveillance within the society. The colourful parade ended up at sunset, but some of the participants reunited later that night on the occasion of Big Brother Awards benefit concert which was organized by EDRi member Iuridicum Remedium. "The recent level of restrictions which criminalize majority of our society is alarming. It is another step towards state where police is competent to arbitrary bully people on the streets," said Jan Nemec, the spokesman of the Freedom not Fear initiative in Prague, in his public speech. "Let your voices be heard and express your resolute protest against these oppressive measures," called Jan Nemec on the participants. However, the organization of the DIY Carnival did not go that smoothly as might be observed from its results. The parade had to take an alternative route, because the municipal authorities banned the original one on the bases of their fear that the carnival could turn into a street party. Subsequently, the organizers have lodged an appeal with the court that was later dismissed. The final decision is still pending, though. "The hearing on the ban took place on Friday, just one day after we received an email notification, while the rules of the administrative court grant at least ten days for preparation," commented the first instance decision Helena Svatosova, lawyer from the NGO Iuridicum Remedium, who initiated proceedings in this matter before the Highest Administrative Court. (contribution by Vaclav Mlynarik - EDRi-member Iuridicum Remedium) ============================================================ 5. New Dutch Notice-and-Take-Down Code raises questions ============================================================ Dutch government and leading market participants have adopted a new Notice-and-Take-Down Code of Conduct. The Code seeks to clarify the responsibilities of internet intermediaries (hosting providers in particular) when confronted with a notice that online information is punishable (under Dutch penal law) or unlawful. Reactions to the code are mixed. Many hosting providers have not signed the Code. Others have called it symbolic. In fact, the Code seems to obscure the current legal obligations of internet service providers with regard to punishable and unlawful material. Unfortunately, the Code does not even mention the right to freedom of expression and the issue of censorship. Although the code has no legal status, it goes further than the Dutch law in a number of ways. The Code states that a notice of a public prosecutor that material is punishable cannot be questioned by a provider, because the public prosecutor has already established its illegal character. However, a recent academic study of the Centre for Cybercrime Studies (Cycris), commissioned by the Dutch government, revealed the inadequacy of Dutch laws concerning Notice and Takedown. In particular, it found that the public prosecutor does not have an adequate legal instrument to order material to be taken down. The study concluded that "there are insufficient guarantees built into the process to protect the interests of Internet users and the information freedoms". The Dutch government has responded that it is reviewing the relevant laws, but it has completely ignored the problem in the context of this new Code. In the case of notices of punishable and unlawful material from others than the public prosecutor the Code provides that an intermediary will remove the material if it is 'unequivocally' punishable or unlawful. If not, the party seeking removal can either seek involvement of law enforcement agencies or start a civil procedure. There is no explicit mention of a put-back procedure. The Code does state that intermediaries have to be careful not to remove more content than the notice points to. The Code does not change the circumstances under which rights holders can retrieve identifying data of alleged infringers of copyright. For this reason, BREIN, the representative of the rights holders in the Netherlands, has made clear it sees the current Code as unsatisfactory. To complicate matters, the Code introduces the concept of 'undesirable' or 'harmful' material. It defines this as material that is not illegal or unlawful under Dutch law, but material that a provider itself does not want to host, because of its 'undesirable' or 'harmful' character. The Code states that the provider is free to develop such criteria and treat notices of 'undesirable' or 'harmful' material the same way as notices of illegal material. Clearly, government involvement in this part of the Code of Practice is problematic from the perspective of freedom of expression. The Code does not clarify which categories of content can legitimately be considered as 'undesirable' or 'harmful' by an intermediary. And unfortunately, the Code does not explicitly forbid law enforcement agencies to send notices of 'undesirable' or 'harmful' material, whereas such notices would seem to be illegal. The Code was adopted in the context of the National Infrastructure Cybercrime, a public private partnership, which includes several branches of the Dutch Government, major broadband providers such as KPN, XS4all, and cable providers. There is no official list of participants in the Code. Notice-And-Take-Down Code of Conduct (9.10.2008) http://www.samentegencybercrime.nl/UserFiles/File/NTD_Gedragscode_Opmaak_En… Dutch 'Notice-and-Take-Down' Code of Conduct issued (14.10.2008) http://www.saferinternet.org/ww/en/pub/insafe/news/articles/1108/notice_and… Cycris Research on art. 54a of the Dutch Penal Code (13.05.2008) http://www.cycris.nl/news/7/39 Hosters en Brein sluiten piraterij-compromis (In Dutch only) (9.10.2008) http://webwereld.nl/articles/53058/hosters-en-brein-sluiten-piraterij-compr… (Contribution by Joris van Hoboken - EDRi-member Bits of Freedom -Netherlands) ============================================================ 6. Protests in France against the Edvige file on St. Edwige day ============================================================ As previously announced in EDRi-gram, St. Edwige day in France was a day of protests against the file project called Edvige, a file that would gather information on any person, including minors, considered by the police as a "suspect" capable of disrupting the public order. On 16 October, on St. Edwige day, demonstrations against the introduction of the Edvige file were organised in Paris, Agen, Bordeaux, Strasbourg, Saint-Etienne, Lyon and other big cities in France by the "Non ` Edvige" group that included La Ligue des Droits de L'Hommes (The League of Human Rights), FSU, CGT, CFDT, Aides and French EDRi-member IRIS. The project had already been modified in September into the so called EDVIRSP file. However, even the new version was considered unacceptable by the opponents of the project especially because it involves gathering data on minors who are considered by the police a public threat. The "Non ` Edvige" petition is asking for the cancellation of the entire project. It remains to be seen if the demonstrations that took place on 16 October will find any echo with the French authorities. On Saint Edwige, the anti-Edvige march on the streets (only in French, 16.10.2008) http://www.lemonde.fr/web/son/0,54-0@2-3224,63-1107874@51-1090646,0.html Saint Edwige: the anti-Edvige in the street (only in French,17.10.2008) http://www.top-logiciel.net/news-article.storyid-3044.htm On Saint Edwidge: I don't want Edvige ! (only in French, 17.10.2008) http://www.youtube.com/watch?v=94hUZr6FxLc&feature=user EDRIgram - French file EDVIGE revised after huge civil society mobilization (only in French, 24.09.2008) http://www.edri.org/edrigram/number6.18/edvige-revised ============================================================ 7. German court says ISPs do not violate the law by storing IP addresses ============================================================ On 30 September 2008, the Munich District Court decided in a provisional ruling that website operators were not violating the data protection legislation when storing IP addresses of their visitors as IP addresses alone are not considered personal data. The case was brought to the court by an individual who argued that storing IP addresses in log files by a web publisher represents a privacy violation because the information could be used to identify him and relate his identity to his web surfing activity. The court dismissed his arguments and ruled against his claim. The court considers IP addresses are not personal data under the German Privacy Act because the information cannot be easily used to determine a person's identity and an ISP could not tell a third party who was using a particular IP address at a particular time without a legal basis. Such information is provided by ISPs only when ordered by a court. The ruling also said that IP addresses lacked the necessary quality of "determinability" to be personal data, meaning the identity of the person behind the information cannot be established without a significant effort and by using "normally available knowledge and tools." However, we should not over-estimate the relevance of this decision.It was taken by a local court with no IT experts and the judge did not discuss the dissenting decisions from higher level Berlin courts. The decision only applies to dynamic IP addresses. Privacy activists have argued that IP addresses should count as personal data under data protection legislation. The Article 29 Working Party has also said that IP addresses should be treated as personal data by ISPs and search engines, even if they are not always personal data. "Unless the Internet Service Provider is in a position to distinguish with absolute certainty that the data correspond to users that cannot be identified, it will have to treat all IP information as personal data, to be on the safe side. These considerations will apply equally to search engine operators," said a report issued by the Article 29 Working Party in April. Regarding the fact that IP addresses are not considered personal data by some, in an interview given to EurActiv on the data protection rules, the European Data Protection Supervisor Peter Hustinx explained : "As of today there is some uncertainty, and this is why we will probably see a study from the Commission to shed light on this. But the common view of the data protection specialists is that in many situations IP addresses are personal data. Therefore websites, Internet Service Providers and other parties should ensure data protection compliance. This is an important thing to emphasise." He also believes that The European Commission should clarify the application of existing data protection rules in relation to RFID in order to avoid "big social dangers". German court says IP addresses in server logs are not personal data (14.10.2008) http://www.out-law.com/page-9505 Hustinx: Tracking people 'easier' with RFID (3.10.2008) http://www.euractiv.com/en/infosociety/hustinx-tracking-people-easier-rfid/… AG, Munich: IP addresses may be used by Web site operators are stored (only in German, 7.10.2008) http://www.kremer-legal.com/2008/10/07/ag-munchen-ip-adressen-durfen-von-we… ============================================================ 8. British court: people are bound to reveal computer encryption key ============================================================ Two persons were denied by the court the right to silence in relation to the encryption key they were asked to reveal to the police. The men had brought as argument to the court that handing over the encrypted key for the data in their computers would mean forcing them to incriminate themselves. Defendants have a right to silence and to refuse to divulge information that could be used as evidence against them. The Court of Appeal however considered that an encryption password is not incriminating information in itself and that the key as well as the information in the computers existed independently from the men just like any key to a drawer and its content. Therefore, the men had no right to deny the police the encryption keys. The two men had been arrested the police for having been involved with a person who was subject to a control order under anti-terrorism legislation and their computers had been seized. The police had sent notices ordering the men to disclose the passwords in the interest of national security and the prevention or detection of crime. The authorities can ask disclosure of such keys because, in terms of the law, the information on the computers is already in the possession of the police and an order for password disclosure can be made, if "no alternative, reasonable method of gaining access to it or making it intelligible is available" as expressed by Mr Justice Penry-Davey in the Court of Appeal. According to the Regulation of Investigatory Powers Act (RIPA), the refusal to reveal a decryption key can be punished with imprisonment up to 5 years. The clause covering this measure has been included in RIPA act since 2007 but has not been activated until 1 October 2008 because, last year, the Home Office considered that the encryption was not as popular as it had been predicted. Part III of RIPA was activated after a period of consultation. People receiving notice from the police are bound to reveal the encryption keys or render the requested material intelligible by authorities. The clause has been criticised by civil liberties activists and security experts who consider that the measure affects privacy and can lead to persons being forced to incriminate themselves. An argument against the action is also that passwords can be forgotten and people may pretend to have forgotten or really forget them. According to the Home Office, the process will be overseen by the Interception of Communications Commissioner, the Intelligence Services Commissioner and the Chief Surveillance Commissioner and complaints about demands for information will be made by the Investigatory Powers Tribunal. The Home Office considers that the actions are consistent with the European Convention on Human Rights and the UK Human Rights Act as long as the demand for decryption is "both necessary and proportionate". "The measures in Part III are intended to ensure that the ability of public authorities to protect the public and the effectiveness of their other statutory powers are not undermined by the use of technologies to protect electronic information," stated the Home Office. But besides the concerns raised by civil liberties activists, there are also voices that warn the measure may even lead to hiding more material from the Police. "I think putting the powers on the statute book will make it more, not less, likely that police will encounter encrypted material because people will become aware of dual key systems and see how easy they are to use," commented security expert Dr Richard Clayton. Court of Appeal orders men to disclose encryption keys (16.10.2008) http://www.out-law.com//default.aspx?page=9514 England and Wales Court of Appeal (Criminal Division) Decisions (9.10.2008) http://www.bailii.org/ew/cases/EWCA/Crim/2008/2177.html RIPA could be challenged on human rights (24.01.2008) http://www.out-law.com/page-8826 Law requiring disclosure of decryption keys in force (2.10.2007) http://www.out-law.com/page-8515 ============================================================ 9. ENDitorial: Seizures and other abuses - from bad to worse ============================================================ Two recent episodes (that are not "isolated cases") show, again, how distortions in Italian laws and in their application can lead to all sorts of abuses - as discussed before. The problem is that these abuses are not only continuing, but getting worse. One is explained in a recent article and is obviously (no matter how it's disguised) a case of censorship. The other case we are discussing here, if taken as a single episode, could be seen as a comedy of errors. A website for the exchange of music was "seized" - that is to say, access was blocked. It was soon moved to another address, and later the "seizure" was revoked. So it didn't suffer any serious damage and it may have gained some publicity as a result of the protest in Italy and elsewhere caused by the attempt to choke it. The instigators of the repression (as usual, the lobbies of music majors) were (in this case and so far) defeated and ridiculed. But the procedures in this grotesque affair reveal several alarming abuses. Many problems, for many years, have been caused by an awkward peculiarity of the Italian legislation, that treats copyright infringement as a criminal offence. And it has always been an awful abuse to seize computers, servers etcetera with a brutal procedure that is useless for investigation purposes and dramatically harmful not only for suspects who are "innocent until proven guilty", but also for people and organizations who are not involved in the facts (or assumptions) being investigated. In recent years this abuse has taken a new twist, that queerly extends the "seizure" concept to the suppression of a website or if, as in this case, the website isn't in Italy, to force Italian internet providers to block access (or even, as in this example, to arbitrarily re-route the "traffic" to another foreign website, dedicated to persecuting people who are trying to access the blacklisted source). It would be dangerous to underestimate the implications of these behaviors, too easily supported by internet providers, who care about their selfish interests above the rights of their customers. They go far beyond the consequences of individual episodes, suggesting criteria and procedures that can be extended to the repression of any unwelcome opinion or information, as well as of enterprises competing with "favored" interests. To make things even worse, in this case the attack was on a site that doesn't offer file sharing, but information on where resources can be found. This could lead to the absurdity of turning not only connection providers, but also search engines, into censors, spies and "sheriffs" of the net for inquiries and prohibitions originating in any country and extending beyond its borders. In a "package of rules" recently approved (September 24, 2008) by the European Union Parliament "measures that would have allowed a control on internet users were rejected." Specifically, "the MEPs rejected the idea that ISPs should filter all downloads and punish the infringers of copyright rules, being thus transformed into a sort of online police." Of course it remains to be seen if and how "good intentions" will be applied, but in the meantime Italian authorities, once again, appear to be peculiarly prone in obeying the whims and wishes of the "owners of ideas" and not as careful as they should in ensuring freedom of opinion and civil rights. An update on the Italian PirateBay case (8.10.2008) http://www.edri.org/edrigram/number6.19/update-piratebay-italy The European Parliament voted the Telecoms Package (8.10.2008) http://www.edri.org/edrigram/number6.19/ep-votes-telecom-package ENDitorial: A stupid law and a perverse "criminal" sentence (24.09.2008) http://www.edri.org/edrigram/number6.18/stupid-law-italy (contribution by Giancarlo Livraghi - EDRi-member ALCEI - Italy) ============================================================ 10. Recommended Reading ============================================================ The Council of Europe launched, in close cooperation with European online game designers and publishers and with Internet service providers, two sets of guidelines which aim to encourage respect and promote privacy, security and freedom of expression. Human Right Guidelines for Online games providers http://www.coe.int/t/dghl/standardsetting/media/Doc/H-Inf(2008)008_en.pdf Human Right Guidelines for Internet service providers http://www.coe.int/t/dghl/standardsetting/media/Doc/H-Inf(2008)009_en.pdf ============================================================ 11. Agenda ============================================================ 24 October 2008, Bielefeld, Germany Big Brother Awards Germany 2008 http://www.BigBrotherAwards.de/ 25 October 2008, Vienna, Austria Big Brother Awards Austria 2008 http://www.BigBrotherAwards.at/ 3-7 November 2008, Geneva, Switzerland Standing Committee on Copyright and Related Rights : Seventeeth Session http://www.wipo.int/meetings/en/details.jsp?meeting_id=16828 13-14 November 2008, Chisinau, Moldova IFLA/EBLIDA/eIFL Conference on copyright and libraries Copyright: Enabling Access or Creating Roadblocks for Libraries? Registration by 1 November 2008 http://www.eblida.org/index.php?page=draft-programme-2 25-26 November 2008, Brussels, Belgium World e-Parliament Conference 2008 http://www.ictparliament.org/worldeparliamentconference2008/ 3-6 December 2008, Hyderabad, India Third Internet Governance Forum http://www.intgovforum.org 9-10 December 2008, Madrid, Spain Future Internet Assembly http://www.future-internet.eu/home/future-internet-assembly/madrid-dec-2008… http://www.fi-madrid.eu/ 10-11 December 2008: Tilburg, Netherlands Tilting perspectives on regulating technologies, Tilburg Institute for Law and Technology and Society, Tilburg University http://www.tilburguniversity.nl/tilt/conference 27-30 December 2008 Berlin, Germany 25C3: Nothing to hide The 25th Chaos Communication Congress http://events.ccc.de/congress/2008/ 18-20 March 2009, Athens, Greece WebSci'09: Society On-Line http://www.websci09.org/ 1-4 June 2009, Washington, DC, USA Computers Freedom and Privacy 2009 http://www.cfp2009.org/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 28 members based or with offices in 17 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

NIST announces SHA-3 round 2 candidates
by Jack Lloyd 06 Jul '18

06 Jul '18

http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/submissions_rnd2.html """ A report summarizing NIST's selection of these candidates will be forthcoming. A year is allocated for the public review of these algorithms, and the Second SHA-3 Candidate Conference is being planned for August 23-24, 2010, after Crypto 2010. """ Making the cut: BLAKE Blue Midnight Wish CubeHash ECHO Fugue Grostl Hamsi JH Keccak Luffa Shabal SHAvite-3 SIMD Skein --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

OT: Mixmaster
by xlon＠Safe-mail.net 06 Jul '18

06 Jul '18

Hello List, I've been mulling over the wisdom of sending this message, finally decided it was the right thing to do. I would like to request that those of you who so generously donate their time and bandwidth running a Tor node to consider also running an instance of that old and venerable ancestor of Tor, mixmaster. With its long and fabled history and stellar record in protecting the anonymity of users, it is a perfect high-latency compliment to Tor's low-latency focus. While development has been negligible over the last few years, the network is still strong and serves the community well. Recently some very simple client software has been developed, making accessibility to the masses much more possible than it has been in the past. If anybody is so inclined, mixmaster may be found at http://sourceforge.net/projects/mixmaster/ Documentation is included, though much more may be found on the Web. A mailing list for mixmaster operators may be found at http://lists.mixmin.net/mailman/listinfo/remops Thank you for your consideration, A Fan of Low-Latency *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

OT: Mixmaster
by xlon＠Safe-mail.net 06 Jul '18

06 Jul '18

Hello List, I've been mulling over the wisdom of sending this message, finally decided it was the right thing to do. I would like to request that those of you who so generously donate their time and bandwidth running a Tor node to consider also running an instance of that old and venerable ancestor of Tor, mixmaster. With its long and fabled history and stellar record in protecting the anonymity of users, it is a perfect high-latency compliment to Tor's low-latency focus. While development has been negligible over the last few years, the network is still strong and serves the community well. Recently some very simple client software has been developed, making accessibility to the masses much more possible than it has been in the past. If anybody is so inclined, mixmaster may be found at http://sourceforge.net/projects/mixmaster/ Documentation is included, though much more may be found on the Web. A mailing list for mixmaster operators may be found at http://lists.mixmin.net/mailman/listinfo/remops Thank you for your consideration, A Fan of Low-Latency *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [ZS] Microsoft Research on Bitcoin
by R|diger Koch 06 Jul '18

06 Jul '18

Moving thread to zs-business: 2012/7/10 Lodewijk andri de la porte <l(a)odewijk.nl> > > I want to do green addresses, addresses from which one can be sure it is a > valid transaction. If an address exists at third parties it is completely > unreliable what happens to the Bitcoins on them. I'm not sure it makes > sense as my service is as safe as it's going to get. Why should I let uses > risk themselves? There's some argument towards additional freedom, I > couldn't completely freeze their accounts. > Precisely. Nor can the government or an intruder, provided the keys are encrypted on disk. I don't see how users risk anything if you provide a "*Print backup"* option - no trojan can steal a letter in the safe. You might be glad one day if you get raided by "authorities" or broken in. Since this'd help only those I'm legally required to blockade it's low > priority if not zero priority. > What I can do is let private keys be submitted and empty them instantly, > towards a safe address. But I don't really see why people wouldn't just > send them towards themselves. > Well, I can. For example users can come to Fikisha office in Lagos and buy a printout of a Mini (Casascius) key for cash, which they can fax to the UK or the EU, for example. At Intersango or MtGox, they can redeem that key. I'd very much like it if those keys can be redeemed in more ways.* > This is how I'd redeem tokens or Casascius coins. It's a low priority > addition compared to some other things I'm doing. > I'd understand it if it were only Casascius coins. After all who in his right mind is buying an expensive coin to redeem it shortly after. If Bitcoin price hike continues, this may also be an interesting feature. Cheers Anu * They'll be able to redeem it at Fikisha, but that only makes sense if they get 2nd thoughts about the transfer -- You received this message because you are subscribed to the Google Groups "zs-business" group. To post to this group, send email to zs-business(a)googlegroups.com. To unsubscribe from this group, send email to zs-business+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/zs-business?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] The Cryptosphere
by Tony Arcieri 06 Jul '18

06 Jul '18

On Sun, Jul 15, 2012 at 5:10 PM, Tony Arcieri <tony.arcieri(a)gmail.com>wrote: > I'm hacking on this regularly enough I'd like to officially announce it > here: > > https://github.com/tarcieri/cryptosphere > I'm not sure if you saw, but the Cryptosphere was linked on both Hacker News and TechCrunch: http://news.ycombinator.com/item?id=4316632 http://techcrunch.com/2012/07/31/new-darknet-wants-to-match-up-cypherpunks-… Most of the discussion centered around child pornography and people being afraid of being party to it even if they have plausible deniability. -- Tony Arcieri _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0