July 2018 - cypherpunks-legacy

RE: [IP] FBI plans new Net-tapping push
by Bob Frankston 06 Jul '18

06 Jul '18

Doest his meant hat if I use a generic Linux box to write some routing or NAT software I must include an FBI module? Is it illegal for Cisco to provide open source LinkSys boxes? Given the attitude that the unexamined conversation is treason shouldnbt the FBI be looking into all calls made using walkie- talkies, between cordless phones, between extension phones? Are corporate PBXes exempted? Good thing that Bombay is now called Mumbai b otherwise think of all the conversations that would be flagged as dangerous. -----Original Message----- From: David Farber [mailto:dave@farber.net] Sent: Saturday, July 08, 2006 08:00 To: ip(a)v2.listbox.com Subject: [IP] FBI plans new Net-tapping push Begin forwarded message: From: Richard Forno <rforno(a)infowarrior.org> Date: July 8, 2006 2:22:38 AM EDT To: Blaster <rforno(a)infowarrior.org> Cc: Dave Farber <dave(a)farber.net> Subject: FBI plans new Net-tapping push FBI plans new Net-tapping push By Declan McCullagh http://news.com.com/FBI+plans+new+Net-tapping+push/ 2100-1028_3-6091942.html Story last modified Fri Jul 07 18:55:01 PDT 2006 The FBI has drafted sweeping legislation that would require Internet service providers to create wiretapping hubs for police surveillance and force makers of networking gear to build in backdoors for eavesdropping, CNET News.com has learned. FBI Agent Barry Smith distributed the proposal at a private meeting last Friday with industry representatives and indicated it would be introduced by Sen. Mike DeWine, an Ohio Republican, according to two sources familiar with the meeting. The draft bill would place the FBIbs Net-surveillance push on solid legal footing. At the moment, itbs ensnared in a legal challenge from universities and some technology companies that claim the Federal Communications Commissionbs broadband surveillance directives exceed what Congress has authorized. The FBI claims that expanding the 1994 Communications Assistance for Law Enforcement Act is necessary to thwart criminals and terrorists who have turned to technologies like voice over Internet Protocol, or VoIP. b The complexity and variety of communications technologies have dramatically increased in recent years, and the lawful intercept capabilities of the federal, state and local law enforcement community have been under continual stress, and in many cases have decreased or become impossible,b according to a summary accompanying the draft bill. Complicating the political outlook for the legislation is an ongoing debate over allegedly illegal surveillance by the National Security Administrationbpunctuated by several lawsuits challenging it on constitutional grounds and an unrelated proposal to force Internet service providers to record what Americans are doing online. One source, who asked not to be identified because of the sensitive nature of last Fridaybs meeting, said the FBI viewed this as a top congressional priority for 2007. Breaking the legislation down The 27-page proposed CALEA amendments seen by CNET News.com would: B7 Require any manufacturer of b routingb and b addressingb hardware to offer upgrades or other b modificationsb that are needed to support Internet wiretapping. Current law does require that of telephone switch manufacturersbbut not makers of routers and network address translation hardware like Cisco Systems and 2Wire. B7 Authorize the expansion of wiretapping requirements to b commercialb Internet services including instant messaging if the FCC deems it to be in the b public interest.b That would likely sweep in services such as in- game chats offered by Microsoftbs Xbox 360 gaming system as well. B7 Force Internet service providers to sift through their customersb communications to identify, for instance, only VoIP calls. (The language requires companies to adhere to b processing or filtering methods or procedures applied by a law enforcement agency.b) That means police could simply ask broadband providers like AT&T, Comcast or Verizon for wiretap infobinstead of having to figure out what VoIP service was being used. B7 Eliminate the current legal requirement saying the Justice Department must publish a public b notice of the actual number of communications interceptionsb every year. That notice currently also must disclose the b maximum capacityb required to accommodate all of the legally authorized taps that government agencies will b conduct and use simultaneously.b Jim Harper, a policy analyst at the free-market Cato Institute and member of a Homeland Security advisory board, said the proposal would b have a negative impact on Internet usersb privacy.b b People expect their information to be private unless the government meets certain legal standards,b Harper said. b Right now the Department of Justice is pushing the wrong way on all this.b Neither the FBI nor DeWinebs office responded to a request for comment Friday afternoon. DeWine has relatively low approval ratings--47 percent, according to SurveyUSA.comband is enmeshed in a fierce battle with a Democratic challenger to retain his Senate seat in the November elections. DeWine is a member of a Senate Judiciary subcommittee charged with overseeing electronic privacy and antiterrorism enforcement and is a former prosecutor in Ohio. A panel of the U.S. Court of Appeals in Washington, D.C., decided 2-1 last month to uphold the FCCbs extension of CALEA to broadband providers, and itbs not clear what will happen next with the lawsuit. Judge Harry Edwards wrote in his dissent that the majoritybs logic gave the FCC b unlimited authority to regulate every telecommunications service that might conceivably be used to assist law enforcement.b The organizations behind the lawsuit say Congress never intended CALEA to force broadband providersband networks at corporations and universitiesbto build in central surveillance hubs for the police. The list of organizations includes Sun Microsystems, Pulver.com, the American Association of Community Colleges, the Association of American Universities and the American Library Association. If the FBIbs legislation becomes law, it would derail the lawsuit because there would no longer be any question that Congress intended CALEA to apply to the Internet. You are subscribed as BobIP(a)Bobf.Frankston.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting- people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on fbi plans new Net-tapping push
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[liberationtech] New Satphone Safety Guide
by Brian Conley 06 Jul '18

06 Jul '18

Hi all, I'm pleased to announce that we have released our newest guide, focusing on increasing satphone safety through best practices. You can find the guide here: http://smallworldnews.tv/Guide/Guide_SatPhone_English.pdf comments, questions, and critiques much appreciated! I will be writing a longer blog about the motivations and timeliness later this week. Also you can see Frank Smyth's comments here at CPJ.org: http://cpj.org/blog/2012/03/from-small-world-timely-advice-on-safe-satphone… -- Brian Conley Director, Small World News http://smallworldnews.tv m: 646.285.2046 Skype: brianjoelconley public key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xCEEF938A1DBDD587<http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE827FACCB139C9F0> _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by None 06 Jul '18

06 Jul '18

1 0

[Politech] SMS 007 aims to protect cell phone SMS messages [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

[Thanks for sending this along, Marian! It looks like a useful project. --Declan] -------- Original Message -------- Subject: Politech submission Date: Mon, 06 Mar 2006 17:00:00 +0100 From: Marian Kechlibar <marian.kechlibar(a)circletech.net> To: declan(a)well.com Hello Declan, I have some news that could be interesting for you and for your readers. It is about software that can protect wireless messaging from wiretap / eavesdrop etc. Its name is SMS 007 and it has been developed by Czech company CircleTech, s.r.o. (I am one of the two co-founders). It is a Java (J2ME) software which runs on almost all current phone models. It uses AES symmetric cipher and user-chosen keys to encrypt the SMS messages. It also has some other security features, like a secret contact list, which cannot be viewed from the outside of the application. The encryption used ensures that wiretapping entities (operators, law enforcement, maffia, anyone) cannot get to the plaintext of the message. Also data stored by the program in the phone are protected by encryption, so stealing the phone and examining it for data does not help the adversary either - unless the user selects a bad main password. SMS 007 has been available to Czech customers for 5 months, but has gone international only very recently (February 24, 2006), when Nokia Softwaremarket agreed to resell it online. Links: http://www.sms007.cz - the product webpages http://www.circletech.net - the corporate webpages http://www.praguepost.com/P03/2005/Art/1201/news2.php - an article in The Prague Post by Kristina Alda http://www.softwaremarket.nokia.com/?product_detail_s60.html&itmId=1612&pID… 102&pmsid=33 - Nokia Softwaremarket, including the Users manual Yours Marian _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

RE: [IP] FBI plans new Net-tapping push
by Bob Frankston 06 Jul '18

06 Jul '18

Doest his meant hat if I use a generic Linux box to write some routing or NAT software I must include an FBI module? Is it illegal for Cisco to provide open source LinkSys boxes? Given the attitude that the unexamined conversation is treason shouldnbt the FBI be looking into all calls made using walkie- talkies, between cordless phones, between extension phones? Are corporate PBXes exempted? Good thing that Bombay is now called Mumbai b otherwise think of all the conversations that would be flagged as dangerous. -----Original Message----- From: David Farber [mailto:dave@farber.net] Sent: Saturday, July 08, 2006 08:00 To: ip(a)v2.listbox.com Subject: [IP] FBI plans new Net-tapping push Begin forwarded message: From: Richard Forno <rforno(a)infowarrior.org> Date: July 8, 2006 2:22:38 AM EDT To: Blaster <rforno(a)infowarrior.org> Cc: Dave Farber <dave(a)farber.net> Subject: FBI plans new Net-tapping push FBI plans new Net-tapping push By Declan McCullagh http://news.com.com/FBI+plans+new+Net-tapping+push/ 2100-1028_3-6091942.html Story last modified Fri Jul 07 18:55:01 PDT 2006 The FBI has drafted sweeping legislation that would require Internet service providers to create wiretapping hubs for police surveillance and force makers of networking gear to build in backdoors for eavesdropping, CNET News.com has learned. FBI Agent Barry Smith distributed the proposal at a private meeting last Friday with industry representatives and indicated it would be introduced by Sen. Mike DeWine, an Ohio Republican, according to two sources familiar with the meeting. The draft bill would place the FBIbs Net-surveillance push on solid legal footing. At the moment, itbs ensnared in a legal challenge from universities and some technology companies that claim the Federal Communications Commissionbs broadband surveillance directives exceed what Congress has authorized. The FBI claims that expanding the 1994 Communications Assistance for Law Enforcement Act is necessary to thwart criminals and terrorists who have turned to technologies like voice over Internet Protocol, or VoIP. b The complexity and variety of communications technologies have dramatically increased in recent years, and the lawful intercept capabilities of the federal, state and local law enforcement community have been under continual stress, and in many cases have decreased or become impossible,b according to a summary accompanying the draft bill. Complicating the political outlook for the legislation is an ongoing debate over allegedly illegal surveillance by the National Security Administrationbpunctuated by several lawsuits challenging it on constitutional grounds and an unrelated proposal to force Internet service providers to record what Americans are doing online. One source, who asked not to be identified because of the sensitive nature of last Fridaybs meeting, said the FBI viewed this as a top congressional priority for 2007. Breaking the legislation down The 27-page proposed CALEA amendments seen by CNET News.com would: B7 Require any manufacturer of b routingb and b addressingb hardware to offer upgrades or other b modificationsb that are needed to support Internet wiretapping. Current law does require that of telephone switch manufacturersbbut not makers of routers and network address translation hardware like Cisco Systems and 2Wire. B7 Authorize the expansion of wiretapping requirements to b commercialb Internet services including instant messaging if the FCC deems it to be in the b public interest.b That would likely sweep in services such as in- game chats offered by Microsoftbs Xbox 360 gaming system as well. B7 Force Internet service providers to sift through their customersb communications to identify, for instance, only VoIP calls. (The language requires companies to adhere to b processing or filtering methods or procedures applied by a law enforcement agency.b) That means police could simply ask broadband providers like AT&T, Comcast or Verizon for wiretap infobinstead of having to figure out what VoIP service was being used. B7 Eliminate the current legal requirement saying the Justice Department must publish a public b notice of the actual number of communications interceptionsb every year. That notice currently also must disclose the b maximum capacityb required to accommodate all of the legally authorized taps that government agencies will b conduct and use simultaneously.b Jim Harper, a policy analyst at the free-market Cato Institute and member of a Homeland Security advisory board, said the proposal would b have a negative impact on Internet usersb privacy.b b People expect their information to be private unless the government meets certain legal standards,b Harper said. b Right now the Department of Justice is pushing the wrong way on all this.b Neither the FBI nor DeWinebs office responded to a request for comment Friday afternoon. DeWine has relatively low approval ratings--47 percent, according to SurveyUSA.comband is enmeshed in a fierce battle with a Democratic challenger to retain his Senate seat in the November elections. DeWine is a member of a Senate Judiciary subcommittee charged with overseeing electronic privacy and antiterrorism enforcement and is a former prosecutor in Ohio. A panel of the U.S. Court of Appeals in Washington, D.C., decided 2-1 last month to uphold the FCCbs extension of CALEA to broadband providers, and itbs not clear what will happen next with the lawsuit. Judge Harry Edwards wrote in his dissent that the majoritybs logic gave the FCC b unlimited authority to regulate every telecommunications service that might conceivably be used to assist law enforcement.b The organizations behind the lawsuit say Congress never intended CALEA to force broadband providersband networks at corporations and universitiesbto build in central surveillance hubs for the police. The list of organizations includes Sun Microsystems, Pulver.com, the American Association of Community Colleges, the Association of American Universities and the American Library Association. If the FBIbs legislation becomes law, it would derail the lawsuit because there would no longer be any question that Congress intended CALEA to apply to the Internet. You are subscribed as BobIP(a)Bobf.Frankston.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting- people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on fbi plans new Net-tapping push
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[liberationtech] New Satphone Safety Guide
by Brian Conley 06 Jul '18

06 Jul '18

Hi all, I'm pleased to announce that we have released our newest guide, focusing on increasing satphone safety through best practices. You can find the guide here: http://smallworldnews.tv/Guide/Guide_SatPhone_English.pdf comments, questions, and critiques much appreciated! I will be writing a longer blog about the motivations and timeliness later this week. Also you can see Frank Smyth's comments here at CPJ.org: http://cpj.org/blog/2012/03/from-small-world-timely-advice-on-safe-satphone… -- Brian Conley Director, Small World News http://smallworldnews.tv m: 646.285.2046 Skype: brianjoelconley public key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xCEEF938A1DBDD587<http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE827FACCB139C9F0> _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[ZS] Re: [liberationtech] Looking for collaborators for free-range voting project at Knight?News Challenge:
by Eugen Leitl 06 Jul '18

06 Jul '18

I already mentioned that online voting is dangerous, hence this is apropos. The best way to deal with compromisability long-term is to issue paying, voting ZS members a smartcard (and probably a matching reader, probably USB). The user then generates a secret onboard, and submits the fingerprint out of band (i.e. not via his computer) so that it can be validated. This can be combined with the CAcert way of doing things. While smartcard secrets are extractable/cloneable in principle, this attack is very expensive for decent hardware designs, and doesn't scale. Before, things like surveymonkey and liquid feedback can be only used to gauge public sentiment, not being tools trusted enough to result in actual vote-taking, or even reflect accurate sentiments. All voting for persons should not be electronic, until a useful system is established. Distributed P2P data structures, very similiar to the BitCoin blockchain can act as tamper-proof public ledgers. There are ways to upgrade these to anonymous, traceable and recept-free votes. Such doesn't work for the general public, but should work for ZS, given we have the talent to get it implemented and reviewed. ----- Forwarded message from Rich Kulawiec <rsk(a)gsp.org> -----

1 0

Re: [liberationtech] Looking for collaborators for free-range voting project at Knight News Challenge:
by Rich Kulawiec 06 Jul '18

06 Jul '18

It won't work. Until the bot/zombie is solved, online voting is a non-starter, since any election worthy of being stolen can be. It doesn't matter what you do on the server side: you can construct as elaborate and clever and secure an infrastructure as you wish...because on the client side, there is no way to ensure that what the user sees is what's actually happening. (After all: it's not *their* computer any more. Its new owners can, if they wish, cause a vote for candidate A to be sent as a vote for candidate B, and they can prevent the user from knowing that's happened.) And given that (a) we're now about a decade into the zombie problem (b) no significant effort against them has ever been attempted, let alone completed [1] and (c) the problem is already epidemic and continues to get worse [2] [3], there is no reason whatsoever to think it will be mitigated, let alone solved, in the forseeable future. This doesn't just apply to your proposal: it applies to *all* of them. Unless you can propose and execute a viable plan for solving the zombie problem, then whatever you design/build can be undercut whenever someone chooses to make the effort. (And provided they're not foolishly heavy-handed about it, it's unlikely you would be able to detect this. [4]) ---rsk [1] Botnet "takedowns" are unimportant and irrelevant; their only purpose is to provide a forum for the spokesliars at Microsoft et.al. to trumpet their prowess while a gullible press and public overlook that they *created* this problem. Merely removing C&C networks does nothing to remediate the individual members of the botnets, which are still compromised, still vulnerable, and likely to be conscripted into other botnets before the day is out. [2] We're now seeing portable devices zombie'd: phones, tablets, etc. [3] Estimates of zombie population vary, of course, but clearly, any estimate under 100M should be laughed out of the room. Vint Cerf gave an estimate of 150M just about six years ago, and based on my own work as well as that of others in the anti-spam/abuse area, I thought that was on the high side at the time...but it's most certainly not now. I think the number's probably in the 200-300M range at this point. See: http://arstechnica.com/news.ars/post/20070125-8707.html for Cerf's comments. [4] See Schneier's insightful and chilling piece on this here: https://www.schneier.com/crypto-gram-0404.html#4 That piece should be absolutely mandatory reading for anyone even considering voting systems. It not only provides a method for estimating attacker budgets, but it correctly points out that attackers quite often could tip the balance of an election by manipulating a rather small number of votes -- with a corresponding reduction in the probability that the manipulation will be detected. Note that Schneier wrote that in 2004. If you repeat his analysis with numbers from the 2012 election cycle you'll end up with *much* large attacker budgets. For example, Schneier says that in 2002, Congressional candidates raised over 500M. But https://www.opensecrets.org/news/2012/10/2012-election-spending-will-reach-… says that in 2012, they spent about $1.82B. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero --- You received this message because you are subscribed to the Google Groups "Doctrine Zero" group. To unsubscribe from this group and stop receiving emails from it, send an email to DoctrineZero+unsubscribe(a)googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0