July 2018 - cypherpunks-legacy

FC: U.K. may order firms to record Net-traffic, ban anon remaiers?
by Declan McCullagh 06 Jul '18

06 Jul '18

It's a little unclear from Statewatch's website what the status of this bill is, but I gather it's been introduced in Parliament as recently as this week. You can find the text here: http://www.statewatch.org/news/2001/nov/08terrorbill.htm Here's the section on data retention: >The Secretary of State shall issue, and may from time to time revise, a >code of practice relating to the retention by communications providers of >communications data obtained by or held by them... It shall be the duty of >a communications provider to comply with any direction... the Secretary of >State may give such directions as he considers appropriate about the >retention of communications data (a) to communications providers >generally; (b) to communications providers of a description specified in >the direction; or (c) to any particular communications providers or provider. If I may, permit me to pose a question to the U.K. lawyers on this list: Does this give the Secretary of State the power to ban anonymous remailers operating inside the U.K.? (Or, more precisely, limit their utility by requiring record-keeping, identity escrow.) I'm not saying, of course, that the secretary would choose to exercise that authority -- at least not right away. The question is whether that authority would exist. Seems to me that "communications providers" may be defined broadly enough for that to be the case. See also: "Europe set to nix Bush request, not require ISP data retention" http://www.politechbot.com/p-02789.html -Declan ---

1 0

Re: [ZS] Re: Culture of envy & the societal value of free citizen
by Bryce Lynch 06 Jul '18

06 Jul '18

On Sun, Dec 2, 2012 at 4:11 PM, Lodewijk andri de la porte <l(a)odewijk.nl>wrote: > 2012/12/2 R|diger Koch <rudiger.koch(a)gmail.com>: > > People actually believe that you need a bank account, for example. > Good luck receiving your paycheck without one. > Unemployment is distributed in several areas in the United States (Maryland, Pennsylvania, Washington state that I know of) in the form of pre-paid debit cards (through Mastercard). There aren't many reasons that other sources of payment might follow that path. Don't expect them to be so easy to get hold of and use for much longer. They're already considered unusual and worthy of further scrutiny: http://www.huffingtonpost.com/2011/05/23/prepaid-cards-being-used-to-launde… http://www.forbes.com/sites/jonmatonis/2012/11/07/department-of-homeland-se… http://openchannel.nbcnews.com/_news/2011/09/01/7526748-us-aims-to-track-un… -- The Doctor [412/724/301/703] [ZS (MED)] https://drwho.virtadpt.net/ "I am everywhere." -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [Users] Announce: FreeS/WAN Project Ending
by Eugen Leitl 06 Jul '18

06 Jul '18

On Tue, Mar 02, 2004 at 03:49:47AM +0100, Thomas Shaddack wrote: > I maintain a small conglomerate of private and corporate networks. We use > FreeS/WAN quite extensively, with great success - in last 2 years we had > no drop-out caused by the crypto infrastructure fault. No attempt for > opportunistic crypto on the IP level, though, at least not yet. What sank FreeS/WAN for me (as compared to StarTLS for opportunistic email encryption) is requirement to publish DNS records and KLIPS always failing on next kernel upgrades. Opportunistic encryption suffers from fax effect; FreeS/WAN made things unnecessarilly difficult. We have KAME/Racoon support in OS X, and IPsec seem to have been present in Windows since NT, OpenBSD has support, and now we see 2.6 kernels becoming available (Knoppix, Fedora Core 2 test1 and Mandrake seem to have it). What's needed is a good OE patch for 2.6.x which is activated and shipped in mainstream Linux distros as default (fallback to plain will probably produce visible delays). Until that happens, OE in IPsec will remind largely a pipe dream, and only grow very slowly among the early adopters. > It was a good project. Hope somebody picks up the torch and keeps it > burning, possibly even brighter. Is there a protocol flaw in IPsec which prevents it from going OE as StartTLS does? -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net

1 0

None
by Tim Meehan 06 Jul '18

06 Jul '18

<ccc-members(a)yahoogroups.com>, Declan <declan(a)well.com>, dave(a)farber.net Subject: OT: Canada: Sweeping new surveillance bill to criminalize investigative journalism http://www.canada.com/ottawa/ottawacitizen/news/story.html?id=0a3f8b88-8c82… 0d9-ad56-917d1af35e76 Pubdate: Wednesday, September 21, 2005 Source: Ottawa Citizen (CN ON) Contact: letters(a)thecitizen.canwest.com Sweeping new surveillance bill to criminalize investigative journalism, 'nanny cams,' critics say Bill makes it illegal to monitor children, document corrupt acts Cristin Schmitz The Ottawa Citizen Big Brother wants expanded powers to watch over you and yours, but Canadians who use their video cameras to conduct their own "surveillance" could risk prison under legislative measures the Liberal government is considering for this fall. As part of a planned bill that will hand sweeping new electronic surveillance powers to police, the federal government is also contemplating the creation of one or more new offences that would turn into criminals anyone who wilfully makes surreptitious "visual recordings" of "private activity." The government is also looking at criminalizing any such activity that is done "maliciously" or "for gain." Among those who could find themselves exposed to criminal jeopardy for currently legal activities are investigative videojournalists, parents who rely on hidden "nanny cams" to monitor their infants, the paparazzi and private investigators. The possible measures were unveiled earlier this year by government officials during closed-door discussions with selected groups and individuals. But the proposal has caused a stir among civil libertarian and legal groups who say the government has failed to provide evidence that such a broad new offence is needed, particularly in the wake of the new "criminal voyeurism" offence created by Parliament in the summer. Voyeurs are now liable to up to five years in prison if they surreptitiously visually record a person who is in a state of nudity or engaged in sexual activity in situations where there is a reasonable expectation of privacy. Toronto media lawyer Bert Bruser, a member of the Canadian Media Lawyers' Association, said his group was not consulted on the proposal for an additional new "visual recording" offence, even though it could have a dramatic impact on those investigative journalists who, for example, stake out politicians or other public figures to see if they are engaged in wrongdoing. "I don't think anybody has thought about this proposal, I think it's hideous," Mr. Bruser remarked. He rejected the government's argument that because surreptitious wiretapping of private telephone conversations is illegal without a court order, Canadians should be similarly barred from surreptitiously capturing electronic images. "The problem with legislation like that is when it uses terms like 'private activity' it creates a meaningless sort of phrase and nobody knows what it means," Mr. Bruser observed. "Everybody wants to protect people's privacy these days, but I think that's far too broad and would very seriously hamper all sorts of journalism that is in the public interest, and that goes on all the time." Justice Department lawyer Normand Wong emphasized if the government moves ahead with a new visual recording offence, it will endeavour to craft "an offence that isn't overly broad, but protects those principles that Canadians want to protect, and that's personal privacy, without interfering with legitimate practices like investigative journalism." But Bill Joynt, president of the Council of Private Investigators of Ontario, who also chairs a national umbrella group, complained the government has failed to consult with his membership. "I haven't even heard of this. We haven't been consulted and we would like to be," he said. "If there is not an exemption for private investigators, this would put us all out of business. Any surveillance we do is documented with video, and that includes insurance claims, Workers Safety and Insurance Board claims, both directly for the WSIB and employers, plus domestic investigations, and intelligence-gathering for corporate or criminal defence investigations." Mr. Joynt said private detectives already steer clear of surveillance in residences and other private places. "What we would be concerned about is the definition of 'private activity,' " he stressed. "We are aware that there are certain things that are kind of sacrosanct and that we wouldn't videotape, such as people changing their clothes or going to the bathroom. But if it was a spousal domestic investigation, for example, and somebody was having sex in the front seat of a car, we would be videotaping it." Mr. Joynt also argued that parents should be entitled to install a hidden video camera in their kitchen, for example, if they are suspicious about how a child-care giver is interacting with their helpless infant. "If they become suspicious about the quality or the level of that care, they should be able to check it out and I don't think that employee's right to privacy supercedes the right of the child to a safe environment," Mr. Joynt said. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] OT: Canada: Sweeping new surveillance bill to criminalize
by David Farber 06 Jul '18

06 Jul '18

investigative journalism X-Mailer: Apple Mail (2.734) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

"Live Tracking of Mobile Phones Prompts Court Fights on Privacy"
by John Gilmore 06 Jul '18

06 Jul '18

[See the details at EFF: http://www.eff.org/legal/cases/USA_v_PenRegister/ including the three court orders, and EFF's argument to the first court. The real story is that for years prosecutors have been asking magistrates to issue court orders to track cellphones in real time WITHOUT WARRANTS. They're tracking people for whom they can't get warrants because they have no probable cause to believe there's any crime. They're fishing. The public never knew, because it all happens under seal. One judge who had previously issued such orders got an attack of conscience, and surprisingly PUBLISHED a decision against such a secret DoJ request. EFF noticed and offered legal analysis, and that judge and two others started publicly refusing such requests. DoJ won't appeal, because without an appeals court precedent against them, they can keep secretly pulling the wool over the eyes of other magistrates, and keep tapping the locations of ordinary people in realtime without warrants. --gnu] No cookies or login required: http://www.theledger.com/apps/pbcs.dll/article?AID=/20051210/ZNYT01/5121004… /1001/BUSINESS Published Saturday, December 10, 2005 Live Tracking of Mobile Phones Prompts Court Fights on Privacy By MATT RICHTEL New York Times Most Americans carry cellphones, but many may not know that government agencies can track their movements through the signals emanating from the handset. In recent years, law enforcement officials have turned to cellular technology as a tool for easily and secretly monitoring the movements of suspects as they occur. But this kind of surveillance - which investigators have been able to conduct with easily obtained court orders - has now come under tougher legal scrutiny. In the last four months, three federal judges have denied prosecutors the right to get cellphone tracking information from wireless companies without first showing "probable cause" to believe that a crime has been or is being committed. That is the same standard applied to requests for search warrants. The rulings, issued by magistrate judges in New York, Texas and Maryland, underscore the growing debate over privacy rights and government surveillance in the digital age. With mobile phones becoming as prevalent as conventional phones (there are 195 million cellular subscribers in this country), wireless companies are starting to exploit the phones' tracking abilities. For example, companies are marketing services that turn phones into even more precise global positioning devices for driving or allowing parents to track the whereabouts of their children through the handsets. Not surprisingly, law enforcement agencies want to exploit this technology, too - which means more courts are bound to wrestle with what legal standard applies when government agents ask to conduct such surveillance. Cellular operators like Verizon Wireless and Cingular Wireless know, within about 300 yards, the location of their subscribers whenever a phone is turned on. Even if the phone is not in use it is communicating with cellphone tower sites, and the wireless provider keeps track of the phone's position as it travels. The operators have said that they turn over location information when presented with a court order to do so. The recent rulings by the magistrates, who are appointed by a majority of the federal district judges in a given court, do not bind other courts. But they could significantly curtail access to cell location data if other jurisdictions adopt the same reasoning. (The government's requests in the three cases, with their details, were sealed because they involve investigations still under way.) "It can have a major negative impact," said Clifford S. Fishman, a former prosecutor in the Manhattan district attorney's office and a professor at the Catholic University of America's law school in Washington. "If I'm on an investigation and I need to know where somebody is located who might be committing a crime, or, worse, might have a hostage, real-time knowledge of where this person is could be a matter of life or death." Prosecutors argue that having such information is crucial to finding suspects, corroborating their whereabouts with witness accounts, or helping build a case for a wiretap on the phone - especially now that technology gives criminals greater tools for evading law enforcement. The government has routinely used records of cellphone calls and caller locations to show where a suspect was at a particular time, with access to those records obtainable under a lower legal standard. (Wireless operators keep cellphone location records for varying lengths of time, from several months to years.) But it is unclear how often prosecutors have asked courts for the right to obtain cell-tracking data as a suspect is moving. And the government is not required to report publicly when it makes such requests. Legal experts say that such live tracking has tended to happen in drug-trafficking cases. In a 2003 Ohio case, for example, federal drug agents used cell tracking data to arrest and convict two men on drug charges. Mr. Fishman said he believed that the number of requests had become more prevalent in the last two years - and the requests have often been granted with a stroke of a magistrate's pen. Prosecutors, while acknowledging that they have to get a court order before obtaining real-time cell-site data, argue that the relevant standard is found in a 1994 amendment to the 1986 Stored Communications Act, a law that governs some aspects of cellphone surveillance. The standard calls for the government to show "specific and articulable facts" that demonstrate that the records sought are "relevant and material to an ongoing investigation" - a standard lower than the probable-cause hurdle. The magistrate judges, however, ruled that surveillance by cellphone - because it acts like an electronic tracking device that can follow people into homes and other personal spaces - must meet the same high legal standard required to obtain a search warrant to enter private places. "Permitting surreptitious conversion of a cellphone into a tracking device without probable cause raises serious Fourth Amendment concerns, especially when the phone is monitored in the home or other places where privacy is reasonably expected," wrote Stephen W. Smith, a magistrate in Federal District Court in the Southern District of Texas, in his ruling. "The distinction between cell site data and information gathered by a tracking device has practically vanished," wrote Judge Smith. He added that when a phone is monitored, the process is usually "unknown to the phone users, who may not even be on the phone." Prosecutors in the recent cases also unsuccessfully argued that the expanded police powers under the USA Patriot Act could be read as allowing cellphone tracking under a standard lower than probable cause. As Judge Smith noted in his 31-page opinion, the debate goes beyond a question of legal standard. In fact, the nature of digital communications makes it difficult to distinguish between content that is clearly private and information that is public. When information is communicated on paper, for instance, it is relatively clear that information written on an envelope deserves a different kind of protection than the contents of the letter inside. But in a digital era, the stream of data that carries a telephone conversation or an e-mail message contains a great deal of information - like when and where the communications originated. In the digital era, what's on the envelope and what's inside of it, "have absolutely blurred," said Marc Rotenberg, executive director of the Electronic Privacy Information Center, a privacy advocacy group. And that makes it harder for courts to determine whether a certain digital surveillance method invokes Fourth Amendment protections against unreasonable searches. In the cellular-tracking cases, some legal experts say that the Store Communications Act refers only to records of where a person has been, i.e. historical location data, but does not address live tracking. Kevin Bankston, a lawyer for the Electronic Frontier Foundation, a privacy advocacy group that has filed briefs in the case in the Eastern District of New York, said the law did not speak to that use. James Orenstein, the magistrate in the New York case, reached the same conclusion, as did Judge Smith in Houston and James Bredar, a magistrate judge in the Federal District Court in Maryland. Orin S. Kerr, a professor at the George Washington School of Law and a former trial attorney in the Justice Department specializing in computer law, said the major problem for prosecutors was Congress did not appear to have directly addressed the question of what standard prosecutors must meet to obtain cell-site information as it occurs. "There's no easy answer," Mr. Kerr said. "The law is pretty uncertain here." Absent a Congressional directive, he said, it is reasonable for magistrates to require prosecutors to meet the probable-cause standard. Mr. Fishman of Catholic University said that such a requirement could hamper law enforcement's ability to act quickly because of the paperwork required to show probable cause. But Mr. Fishman said he also believed that the current law was unclear on the issue. Judge Smith "has written a very, very persuasive opinion," Mr. Fishman said. "The government's argument has been based on some tenuous premises." He added that he sympathized with prosecutors' fears. "Something that they've been able to use quite successfully and usefully is being taken away from them or made harder to get," Mr. Fishman said. "I'd be very, very frustrated." --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [p2p-hackers] Whistle-blower site platform design
by joss-p2phackers＠pseudonymity.net 06 Jul '18

06 Jul '18

Hi Len, I think that it's worth re-emphasising what you say in your second point: an idea like this is not going to succeed if it relies too heavily on solving the fun technical problems. Creating a theoretically nice leak submission/distribution system is definitely fun work, and I'd love to come and play, but if it were to be truly applicable then there is probably going to have to be serious compromise made in the security/usability stakes. (On that point: does Wikileaks' submission system rely on a Tor hidden service, or is there one running that you can use if you jump through the right hoops?) A website seems necessarily the right model for access and submissions, or at least for kicking off a submissions process. Computer = Internet = web (and maybe email) for most people, and breaking that assumption is counterproductive. No-one reading non-existent submissions isn't the goal. A threat model for source protection is surely going to be sender anonymity against the standard global passive attacker. How you bootstrap that from a "click here to submit" button will be interesting. As you point out, though, we aren't seeing a great deal of technical attacks against source anonymity. While it's definitely a real threat, I'd say it's lower on the list of priorities than the availability problems. I think the more interesting problem, then, is in your third set of points. The major issue seems to be distributed hosting, again accessed without requiring users to jump through technical hoops. It seems to me that the most significant problems that Wikileaks has had has been the result of the DNS system allowing the pointer to the information to be removed while the information remains. (Especially when you throw BitTorrent into the mix.) At the same time, people rarely type in an actual URL (see, for example, http://rww.to/a4egy9 ). The real-world net censorship we see is akin to censoring a library by burning the catalogue. The critical Eternity Service (and Freenet) issue of hosts being ignorant of the data that they carry will be important in resisting more legal attacks. Corruption of the leaks via injection of false documents seems an orthogonal problem, and I'm not sure how you'd automate that. Anonymous access to the data seems to fit very neatly into Tor's use-case, with the assumption that you mainly want a web interface. For large chunks of data you might want something able to handle that kind of load, and could probably tolerate higher latencies, but again you'd probably want to start looking at building on a BitTorrent-style approach. There are a lot more fun issues here, but I should sleep before I start writing total gibberish. Joss _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] Whistle-blower site platform design
by joss-p2phackers＠pseudonymity.net 06 Jul '18

06 Jul '18

Hi Len, I think that it's worth re-emphasising what you say in your second point: an idea like this is not going to succeed if it relies too heavily on solving the fun technical problems. Creating a theoretically nice leak submission/distribution system is definitely fun work, and I'd love to come and play, but if it were to be truly applicable then there is probably going to have to be serious compromise made in the security/usability stakes. (On that point: does Wikileaks' submission system rely on a Tor hidden service, or is there one running that you can use if you jump through the right hoops?) A website seems necessarily the right model for access and submissions, or at least for kicking off a submissions process. Computer = Internet = web (and maybe email) for most people, and breaking that assumption is counterproductive. No-one reading non-existent submissions isn't the goal. A threat model for source protection is surely going to be sender anonymity against the standard global passive attacker. How you bootstrap that from a "click here to submit" button will be interesting. As you point out, though, we aren't seeing a great deal of technical attacks against source anonymity. While it's definitely a real threat, I'd say it's lower on the list of priorities than the availability problems. I think the more interesting problem, then, is in your third set of points. The major issue seems to be distributed hosting, again accessed without requiring users to jump through technical hoops. It seems to me that the most significant problems that Wikileaks has had has been the result of the DNS system allowing the pointer to the information to be removed while the information remains. (Especially when you throw BitTorrent into the mix.) At the same time, people rarely type in an actual URL (see, for example, http://rww.to/a4egy9 ). The real-world net censorship we see is akin to censoring a library by burning the catalogue. The critical Eternity Service (and Freenet) issue of hosts being ignorant of the data that they carry will be important in resisting more legal attacks. Corruption of the leaks via injection of false documents seems an orthogonal problem, and I'm not sure how you'd automate that. Anonymous access to the data seems to fit very neatly into Tor's use-case, with the assumption that you mainly want a web interface. For large chunks of data you might want something able to handle that kind of load, and could probably tolerate higher latencies, but again you'd probably want to start looking at building on a BitTorrent-style approach. There are a lot more fun issues here, but I should sleep before I start writing total gibberish. Joss _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] OneSwarm
by Jan Reister 06 Jul '18

06 Jul '18

OneSwarm is ap2p application and protocol designed with anonimity, privacy, adoption (it is also a vanilla BT client) and user control in mind. The protocol paper (pdf) has a great amount of detail, it also explicitly compares OneSwarm performance to BT over Tor. I think the relevance for Tor and this list ends here: it's a very interesting project, it "works" since a coupple of years, has a sizeable user base. Further discussion should go to the 1S forums. Jan _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] OneSwarm
by Jan Reister 06 Jul '18

06 Jul '18

OneSwarm is ap2p application and protocol designed with anonimity, privacy, adoption (it is also a vanilla BT client) and user control in mind. The protocol paper (pdf) has a great amount of detail, it also explicitly compares OneSwarm performance to BT over Tor. I think the relevance for Tor and this list ends here: it's a very interesting project, it "works" since a coupple of years, has a sizeable user base. Further discussion should go to the 1S forums. Jan _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0