July 2018 - cypherpunks-legacy

NIST optimized AES hardware...
by Perry E. Metzger 06 Jul '18

06 Jul '18

Apparently, NIST has produced an interestingly optimized design for AES S-box hardware implementations: http://cryptome.org/0001/nist062309.htm Perry -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] The Stop Online Piracy Act
by Jim 06 Jul '18

06 Jul '18

I haven't seen this brought up on this list yet, so I thought I would mention it. Tech Dirt (among others) are reporting on yet another round of misguided (U.S.) legislation supposedly targeting copyright infringement. Part of this legislation involves attempting to prevent DNS from resolving "offensive" domain names. The part that seems like it could potentially affect Tor (in my non-lawyer) mind is: "To ensure compliance with orders issued pursuant to this section, the Attorney General may bring an action for injunctive relief.... against any entity that knowingly and willfully provides or offers to provide a product or service designed or marketed for the circumvention or bypassing of measures described in paragraph (2) and taken in response to a court order issued pursuant to this subsection, to enjoin such entity from interfering with the order by continuing to provide or offer to provide such product or service." http://www.techdirt.com/articles/20111026/12130616523/protect-ip-renamed-e-… Jim _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Steve Gibson: MS WMF is a Backdoor, Not a Coding Mistake
by Matt Manor 06 Jul '18

06 Jul '18

Steve Gibson: MS WMF is a Backdoor, Not a Coding Mistake http://www.groklaw.net/article.php?story=20060113111825193 http://www.grc.com/sn/SN-022.htm Those of you using Microsoft Windows 2000 or XP will want to follow this story: Steve Gibson has examined WMF and he now believes it was deliberately coded. It looks to him that Microsoft put a backdoor into Windows, which can be triggered even if Active X is turned off and security is at high. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Steve Gibson: MS WMF is a Backdoor, Not a Coding Mistake
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[tor-talk] The Stop Online Piracy Act
by Jim 06 Jul '18

06 Jul '18

I haven't seen this brought up on this list yet, so I thought I would mention it. Tech Dirt (among others) are reporting on yet another round of misguided (U.S.) legislation supposedly targeting copyright infringement. Part of this legislation involves attempting to prevent DNS from resolving "offensive" domain names. The part that seems like it could potentially affect Tor (in my non-lawyer) mind is: "To ensure compliance with orders issued pursuant to this section, the Attorney General may bring an action for injunctive relief.... against any entity that knowingly and willfully provides or offers to provide a product or service designed or marketed for the circumvention or bypassing of measures described in paragraph (2) and taken in response to a court order issued pursuant to this subsection, to enjoin such entity from interfering with the order by continuing to provide or offer to provide such product or service." http://www.techdirt.com/articles/20111026/12130616523/protect-ip-renamed-e-… Jim _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] Leave Your Cellphone at Home
by grarpamp 06 Jul '18

06 Jul '18

> Very interesting read. """"" Resnick: The recent article in Wired describes where and how the NSA plans to store its share of collected data. But as the article explains, the Utah facility will have another important function: cryptanalysis, or code-breaking, as much of the data cycling through will be heavily encrypted. It also suggests that the Advanced Encryption Standard (AES), expected to remain durable for at least another decade, may be cracked by the NSA in a much shorter time if theybve built a secret computer that is considerably faster than any of the machines we know about. But more to the pointbis encryption safe? """"" > I'm not sure I buy the theories for the new data centre. Drive capacity Guessing it's pretty much as on the wrapper. In another interview Binney speaks of a cryptographic breakthrough. If you look at the physical size of the datacenters, you can easily envision massive index tables, rainbow or otherwise, for storing shortcuts to various projects. Note that ever since MySpace, network analysis has been the rage. Combine that with 15-20 years of public datamining and 10-15 years of easily tappable fiber and datacenters. Toss in some really smart people and PhD's and sure, there are bound to be some big and secret advances in data processing and even crypto in play here. > specifically the insider threat You don't need big DC's for that, just better software and human checks and balances. > I think cryptography will depend more and more on steganography [...] > and the message is encoded in the inter-packet timing noise. ;) Moot when you suck up and process everything to extract the crypto. Steg is nothing more than crypto with a pretty wrapper meant to get past the drunk guards, not specialized sieves sifting through your garbage. There are better lists for these topics so I'll step out. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: <nettime> subjective math .
by brian carroll 06 Jul '18

06 Jul '18

Hello St=E9phane > The point is : "To increase freedom, I thought about a system that =20 > allow me to share my voice between the different possibilities in =20 > the proportion I want." I visited your project page and while I could not get the javascript example to function the basic idea is there and it is quite interesting to consider in terms of voting. At first my impression was of tiered access to concepts, how a young student may interact with a shared model of events in a simpler framework than others who may mediate more of its related and foundational structure, as an idea. Such that a child may reference 'house' and it may involve a certain framework, whereas an adult could reference house in terms of its management or an architect in terms of its construction, though these are not necessarily clear-cut views and could overlap. Thus an accurate modeling of 'house' could provide different layers of contextual access for perspective so if a child referenced its maintenance it could also be validated via the tiered model for use in reasoning, not denied as irrelevant in terms of its perspective. When I saw your javascript example it shifted this view of proportionality into the context of governance, voting, the state, and representational 'democracy'. The vote symbolic of its legitimacy, as if about error-correction and guiding the state via some kind of active foresight. If the world were ungrounded this mechanism could be turned-inside out, voting legitimating a fixed idea about how the deterministic state will function into the future, voting a ritual signing-off on its predetermined course. In the sense that what guides the actions of the state may not be informed by the vote, that it is an illusion. In terms of governing the state, the individual voter is to me similar to a person who stands behind one of those scenic or iconic paintings with a hole in it, for a person to poke through and smile for the camera, shooting them as if the person is a part of its scene, say American Gothic or a Wild West shootout, and then getting the photograph as a souvenir. It is a capturing of 'I was here - though not really' moment. Voting in Democracy, at least the U.S. today, is like this, though with the American Stars & Stripes as its scenery, perhaps iconic government buildings and then the temporary symbolic citizen, a smiling voter, if not holding a painted copy of the U.S. Constitution or flag along with a ballot stub in the photograph. In this way a citizen could function as a stand-in, cast in the role of 'active citizen' within political scenery. Yet in the reality - outside this painted image of the state - perhaps it is different than the given signage. What's represented versus what's actually going on. And representation can be controlled through both language and imagery, yet also through logic.* Your demonstration shows this situation quite specifically. It has been so long since I voted I forget how it works in terms of 'neutral' or abstaining from casting a vote, though it is assumed these remain "unaccounted" and are not tallied in relation to the outcome else perhaps other options would exist in the politics of today. If voting were modeled as you have it, into 3-values of [ yes / neither / no ] as the available options, then there would be a way of tallying 'dissent' from voting itself, versus a decision having to go into a yes or no category by default. This happens with voting systems yet it is a question of whether or not they are tallied, and so tallying the proportion of such dissents to that of a binary [ yes | no ] could at some point begin to challenge the legitimacy of the yes/no vote count, if the proportion of 'neutral' or neither was the greatest proportion. And so it is a question of what would the threshold be for determining legitimacy of the vote, especially if it is reliant upon a majority framework... If there are 100 people who vote, and 99 choose to vote 'neither' or 'neutral', and only 1 person votes on the issue [yes], does that legitimate the decision for the other 99 people, such that it represents 'yes' for all of them? This instead seems like an inversion of representation, proportionally, because 99% would be the majority, not the 'yes' viewpoint. Which by a binary determinism is the only valid response if it is not evaluated in the 3-value logic the situation exists within. Thus voting itself is 2-value if not accounting for the dissent of the vote itself. In this way it cannot be invalidated by voting, it becomes a faithful activity that accurate representation occurs within a binary viewpoint, ignoring the 99%. How few voters would it take to call into question the legitimacy of the vote. Any number of a population could be taken and used to represent 100% of the population, even if only say 10 million were to vote for 300 million people, it likely would still be a 49% to 51% race, given mass media and the horserace, as it relates with winning odds. (Feasibly 1% could win the vote yet not 'represent' the goals of existing populations, only those tallied within the binary viewpoint, forcing such an approximation. Thus the biased, warped, distorted viewpoint could be normalized via mass media yet be quite unreal.) The mechanism self-reinforcing, not self-questioning, it cannot allow self-awareness or self reflection for it cannot mediate the truth, control the outcome of the reasoning process if allowing for such representation (in this case, meaning truth outside biased functioning) so the 'image' must be maintained as a limit, boundary or threshold and this is why 2-value logic is required, to invalidate everything outside its controlled domain. It occurs and can occur because there is no actual accounting for truth within society, beyond language. A citizen who references their Constitutional Rights in a real contest of power is more likely to end up in a psychiatric ward filled to the brim with mind-boggling chemicals, if not wrongly incarcerated if not murdered, than find 'representation' within the legal system at any level that would take on the state in its operating falsity. If you can prove via logic the state in its functioning is unconstitutional, it is simply ignored and disregarded. This is to say, the Constitution itself is being ignored. The status quo is government beyond its own laws while at the same time denying these for its citizens. Ungrounded language (and lawyers) allows this. In voting, those who _are represented by this system are encouraged by the status quo, signing-off on this. It's an inversion of principles, truth and falsity switched due to the logic, its biasing and lack of accountability. The image is everything, based on ungrounded beliefs or beliefs opposite what the words supposedly are saying. *(logic is also at the foundation of language/imagery.) Brian Carroll - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >From mgoldh(a)well.com Fri Sep 7 10:22:45 2012 Cc: "nettime-l(a)kein.org" <nettime-l(a)kein.org> From: Michael H Goldhaber <mgoldh(a)well.com> Subject: Re: <nettime> subjective math. Date: Fri, 7 Sep 2012 01:22:27 -0700 To: brian carroll <nulltangent(a)gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=us-ascii Status: RO X-Status: F Content-Length: 34148 Lines: 711 Brian, How does your approach relate to or differ from Lotfi Zadeh's "fuzzy logic?" Best, Michael On Sep 5, 2012, at 5:46 PM, brian carroll <nulltangent(a)gmail.com> wrote: >> Brian: >> >> The severe limitations of "logic" have been long recognized -- which is why >> "real life" doesn't much rely on it. <...> > Hello Mark, > > The prevailing view of logic appears to consider it 'optional' and apart from > the normal reasoning process. Perhaps this view is equivalent to equating it > with the abstract level mathematic computations and equations for data that > derive answers from computer processors, that thought would begin and > function in terms of logical operators. A robot likely would be capable of <...> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org

1 0

[HacDC:Byzantium] USAID Tech Challenge
by Urbanus Z 06 Jul '18

06 Jul '18

Greetings, It's been a while since I've checked back in with HacDc, and I'm impressed with the progress Byzantium has made. There's a tech challenge <http://thetechchallenge.org/#!inflow> from www.humanityunited.org. and USAID opening in Feburary that a few of you might be interested in. Here's the problem description.: During acute crises, vulnerable populations are often *cut off from > critical information* and *have limited, if any, ability to communicate*inside or outside of their communities. While there are a number of > existing efforts aimed at *improving information flow* in these contexts, > many focus on the *outflow of information* from communities or rely too > heavily on *existing communications infrastructure* or *basic literacy*. > Which basically sounds close enough to Byzantium to be worth applying for. Let me know if anyone has interest. Some side questions for the tech folks: Does Byzantium work across non WiFi IP stacks? Would it be reasonable to attach it to Packet Radio over HAM radio? Sincerely, Urbanus -- You received this message because you are subscribed to the Google Groups "Project Byzantium (Emergency Mesh Networking)" group. To view this discussion on the web visit https://groups.google.com/a/hacdc.org/d/msg/Byzantium/-/Gz0wUKNBphsJ. To post to this group, send email to Byzantium(a)hacdc.org. To unsubscribe from this group, send email to Byzantium+unsubscribe(a)hacdc.org. For more options, visit this group at http://groups.google.com/a/hacdc.org/group/Byzantium/?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

EDRI-gram newsletter - Number 6.1, 16 January 2008
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 6.1, 16 January 2008 ============================================================ Contents ============================================================ 1. German data retention act challenged 2. EC public consultation of Creative Content Online 3. European Data Protection Supervisor's opinion on RFID 4. UK MPs want tough data protection 5. PI: Leading surveillance societies in the EU and the World 2007 6. Inclusive E-government in Western Balkans 7. UK Government continues to pressure ISPs for Internet filtering 8. ELOI - a French database to manage the expulsion of illegal migrants 9. European Commission closes enquiry on Apple 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. German data retention act challenged ============================================================ Just five days after the German President Horst Kvhler approved the German data retention law that entered into force on 1 January 2008, the German Working group on data retention (Arbeitskreis Vorratsdatenspeicherung) challenged the law in the Federal German Constitutional Court. The complaint was filed with the Court on 31 December 2007 and, for the first time in the German history, it was backed by 30 000 complainants. The 150-page notice of appeal requested an immediate suspension of the law on the grounds of "apparent unconstitutionality". The Working Group explains that the appeal is substantiated by the fear that general data retention might severely disrupt free communication in Germany by treating each and every citizen as a potential delinquent. "According to the complaint, the pervasive logging of communication patterns without reasonable suspicion resembled a serious encroachment upon the basic values of constitutional legality. On the other hand, it would compromise the working basis of professionals such as journalists and criminal prosecutors as well as that of charitable services like crisis lines - all of which relied greatly on the anonymity of both whistle-blowers and people in need. In the future, sensitive contacts and communication would either have to be conducted in person and face-to-face or would have to be abandoned altogether." The Group is also publishing guidelines and recommendations for safeguarding individuals against the obligatory logging of all telecommunications effective as of 2008. The constitutional action was backed by protests in several cities in Germany on 31 December 2007 against the new data retention legislation. In Hamburg the critics held a mock funeral for "the death of privacy." Some of the German ISPs that need to comply with the law by 2009, are also relying of the constitutional challenge to succeed. Frank Simon, managing director of Oldburg-based Ecce Terram explained to Heise: "I reckon the Federal Constitutional Court will overturn the law this year or ask the criminal prosecution authority to suspend it because the music and film industries will overload them with so many complaints that the hunt for terrorists and child pornographers will be seriously hampered." Constitutional complaint filed against German Telecomms Data Retention Act (31.12.2007) http://www.vorratsdatenspeicherung.de/content/view/184/79/lang,en/ In German http://www.vorratsdatenspeicherung.de/content/blogcategory/27/79/lang,de/ Germans File Mass Lawsuit Against Sweeping Data Retention Law (31.12.2007) http://www.dw-world.de/dw/article/0,2144,3025009,00.html Data retention: ISPs rely on constitutional appeals and exception rules (10.01.2008) http://www.heise.de/english/newsticker/news/101624/ EDRi-gram: German Parliament adopted the data retention law (21.11.2007) http://www.edri.org/edrigram/number5.22/german-retention-law EDRi-gram: Largest anti-surveillance street protest in Germany for 20 years (26.09.2007) http://www.edri.org/edrigram/number5.18/liberty-instead-of-fear ============================================================ 2. EC public consultation of Creative Content Online ============================================================ On 3 January 2008, the European Commission (EC) launched a public consultation for the preparation of a recommendation on Creative Content Online to be adopted by the European Parliament and Council that calls for a common legal environment for online content, proposing multi-territory licences. In the opinion of the European Commission, EU policies should support the rapid implementation of "new services and related business models for the creation and circulation of European content and knowledge online." As a result of the public consultation on "Content Online in the Single Market" launched by the EC in July 2006, there were several calls for the encouragement of the cooperation between industry, right holders and consumers on issues such as DRMs or Content Online as well as for financial support and promotion of DRMs interoperability standards. An independent study "Interactive Content and Convergence" that followed the consultation in 2006 gave an overview of the issues to be addressed for the development of new content services in the EU. Based on the results of the consultation and of the study, the Commission proposes in the newly launched consultation four main horizontal directions of action at EU-level: availability of creative content; multi-territory licensing for creative content; interoperability and transparency of DRMs; and legal offers and piracy. Some concerns have been expressed by digital media rights activists such as the EDRI-member Open Rights Group (ORG) who believe that the EC plan goes beyond copyright, and that consumer rights could be affected by it. "Looking at some of the details of the European Commission consultation document it seems to be that they are proposing a lot more than just a cross Europe licensing scheme. (...) There is stuff here about transparency and interoperability in digital rights management systems, there is stuff about codes of conduct between internet service providers and rights holders to encourage legal access and discourage unauthorised file sharing." stated Becky Hogg, executive director of ORG. However, the EC opinion is that all the different national copyright laws and other intellectual property rights are holding back the film, music and game industries. "Europe's content sector is suffering under its regulatory fragmentation, under its lack of clear, consumer-friendly rules for accessing copyright-protected online content, and serious disagreements between stakeholders about fundamental issues such as levies and private copying," was the EU Commissioner for the Information Society and Media,Viviane Reding's statement. DRM seems to fade out, after Sony BMG announced at the beginning of 2008 that it plans to give up to DRM for its music, thus becoming the last of the top four music labels to throw the towel on this subject. But the EC consultation paper wants to put it back in business, planning "a framework for DRM transparency concerning, amongst others, the interoperability of different DRMs, and ensuring that consumers are properly informed of any usage restrictions placed on downloaded content, as well as of the interoperability of related online services." The consultation closes on 29 February 2008 following which, by the middle of 2008, Reding will make formal recommendations on new ways to achieve a single online content market for 500 million potential consumers, predicted to be worth 8.3 billion euros by 2010 by the study on "Interactive content and convergence" commissioned by Information Society and Media Directorate-General of the European Commission and published on 25 January 2007. Commission consultation: the need for pan-European copyright licences (9.01.2008) http://www.out-law.com/page-8784 Single European market plan for creative online content (4.01.2008) http://informitv.com/articles/2008/01/04/singleeuropeanmarket/ Communication from the Commission on Creative Content Online in the Single Market (3.01.2008) http://ec.europa.eu/avpolicy/docs/other_actions/col_en.pdf Commission adopts strategy for "Creative Content Online" (3.01.2008) http://ec.europa.eu/avpolicy/other_actions/content_online/index_en.htm Sony BMG Plans to Drop DRM (4.01.2008) http://www.businessweek.com/technology/content/jan2008/tc2008013_398775.htm EDRi-gram: Creative content online - main topic in new EC documents (19.12.2007) http://www.edri.org/edrigram/number5.24/creative-content ============================================================ 3. European Data Protection Supervisor's opinion on RFID ============================================================ In the context of increasing debates in the European Union over the RFID policy, Peter Hustinx, the European Data Protection Supevisor (EDPS), published on 20 December 2007 his opinion on the growing use of RFID chips in consumer products and other new applications affecting individuals. EDPS published this opinion as a response to the European Commission's communication on Radio Frequency Identification (RFID) in Europe that was released in March 2007, but taking into consideration other actions, such as the creation by the EC of the RFID expert group, where EDRi is a member. Peter Hustinx, explained the role of RFID and its relation with the privacy issues: "RFID systems could play a key role in the development of the European Information Society but the wide acceptance of RFID technologies should be facilitated by the benefits of consistent data protection safeguards. Self-regulation alone may not be enough to meet the challenge. Legal instruments may therefore be required to guarantee that the technical solutions to minimise the risks for data protection and privacy are in place." EDPS confirms that the wide use of RFID-technology is fundamentally new and may have a fundamental impact on our society and on the protection of fundamental rights in our society, such as privacy and data protection. He underlined the basic five privacy and security issues that can be distinguished in this respect: the identification of the data subject, the identification of the data controller, the decrease meaning of the traditional distinction between the personal and the public sphere, the consequences of the size and physical properties of RFID-tags and the lack of transparency of the processing. The Opinion has highlighted several direct recommendations to the Commission including the provision of a clear guidance on how to apply the current legal framework to the RFID environment and the identification of "Best Available Techniques" which will play a decisive role in the early adoption of the privacy-by-design principle. EDPS also tackled the issue of a specific legislation for the main issues of RFID-usage in relevant sectors and considered that such legislation would be needed if the proper implementation of the existing legal framework failed. Such a legislation "must be considered as a 'lex specialis' vis-a-vis the general data protection framework. This legislative measure should also address the privacy and data protection concerns that arise in certain RFID applications, such as item level tagging before the point of sale, which may not necessarily involve the processing of personal data." In any event, EDPS emphasised the need to lay down "the opt-in principle at the point of sale as a precise and undeniable legal obligation, also for RFID applications that fall outside of the scope of the Data protection Directive and to ensure the mandatory deployment of RFID applications with the appropriate technical features or 'privacy by design'." EDPS opinion on the communication from the Commission on Radio Frequency Identification in Europe: steps towards a policy framework (20.12.2007) http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consu… EDPS Opinion on RFID: major opportunities for Information Society but privacy issues need to be addressed with more ambition (20.12.2007) http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/… EDRi-gram: RFID Expert Group - Kick Off (6.06.2007) http://www.edri.org/edrigram/number5.11/rfid-workgroup EDRi-gram: RFID and Informed Consent - Using and removing of RFID functionality (5.12.2007) http://www.edri.org/edrigram/number5.23/rfid-informed-consent ============================================================ 4. New data protection rules asked by UK MPs ============================================================ The Justice Committee of the UK House of Commons issued on 3 January 2008 a report on public data protection summarising the status and development of the topic, especially since the November 2007 Chancellor's announcement to the Parliament related to the loss of confidential data records of 25 million people by HM Revenue and Customs. The report that recommends a data breach notification law, criminal penalties for data controllers that are found responsible for breaching security, greater powers and financing for the Information Commissioner's Office, follows the line of the recommendations made by the House of Lords Science and Technology Committee in August 2007 that were rejected at that time by the government. The present report emphasises the risk involved by large databases that are accessible by many licensed users, making particular reference to ContactPoint, the children's database that will come into being this year and the National Identity Register, also planned to be gathered in 2008. It also draws the attention on the risk related to the obligation to share data with the other EU member states. "If data held by the Government is available for inspection outside the jurisdiction, then the importance of restricting the amount of data held, as well as proper policing of who had access to it, takes on even greater importance." reads the report. The report recommends that personal data should be held only where there are proper safeguards for the protection of the respective data, which, in the Justice Committee's opinion will become ever more difficult as data can be easily shared within the country as well as between countries. A greater role in the data protection should be played by the Information Commissioner who should receive adequate support in this sense. "We note that he already considers that his resources are at a minimum" is the report statement. It also calls for a legal obligation to notify the Commissioner as well as the affected parties on significant data losses and for penalties for those who disclose personal data. A Ministry of Justice spokeswoman said: "Parliament is currently considering proposals to amend section 60 of the Data Protection Act through the Criminal Justice and Immigration Bill (...) This will provide a custodial sanction as well as the existing fines for those found guilty of unlawfully obtaining or disclosing personal data." MPs call for tougher data protection regime (3.01.2008) http://www.openrightsgroup.org/2008/01/03/mps-call-for-tougher-data-protect… House of Commons Justice - First Report (3.01.2008) http://www.publications.parliament.uk/pa/cm200708/cmselect/cmjust/154/15402… HMRC loses confidential details of 5 million benefit recipients (20.11.2007) http://www.openrightsgroup.org/2007/11/20/hmrc-loses-confidential-details-o… Government ignores Personal Internet Security (29.10.2007) http://www.lightbluetouchpaper.org/2007/10/29/government-ignores-personal-i… Tougher data laws needed, say MPs (3.01.2008) http://news.bbc.co.uk/1/hi/uk_politics/7168588.stm EDRi-gram: UK government loses personal data on 25 million citizens (1.11.2007) http://www.edri.org/edrigram/number5.22/personal-data-lost-uk ============================================================ 5. PI: Leading surveillance societies in the EU and the World 2007 ============================================================ UK-based human rights group Privacy International (PI) published at the end of last year the 2007 ranking assessment of the state of privacy in 47 countries, including all European Union member states. The raking is based on the Privacy & Human Rights reports produced since 1997 by PI together with US-based Electronic Privacy Information Center and is taking into consideration several criteria such as constitutional & statutory protection and privacy enforcement, biometric ID cards, data-sharing, video surveillance, communication interceptions and data retention. According to the authors, the project wants to "recognize countries in which privacy protection and respect for privacy is nurtured. This is done in the hope that others can learn from their example" but also "to identify countries in which governments and privacy regulators have failed to create a healthy privacy environment. The aim is not to humiliate the worst ranking nations, but to demonstrate that it is possible to maintain a healthy respect for privacy within a secure and fully functional democracy." The main findings of the study that includes a world map of the surveillance societies, show an overall worsening of privacy protection across the world, reflecting an increase in surveillance and a declining performance of privacy safeguards. The rankings for 2007 prove a disturbing and increasing trend amongst governments to archive data on the geographic, communications and financial records of all their citizens and residents. This trend leads to the conclusion that all citizens, regardless of their legal status, are under suspicion. The privacy trends have been fueled by the emergence of a profitable surveillance industry dominated by global IT companies and the creation of numerous international treaties that frequently operate outside judicial or democratic processes. PI also claims that "surveillance initiatives initiated by Brussels have caused a substantial decline in privacy across Europe, eroding protections even in those countries that have shown a traditionally high regard for privacy." The general trend is the failure of the privacy performance for older democracies in Europe, while the performance of newer democracies is becoming generally stronger. It is worth noting also that the worst ranking EU country is the United Kingdom, which again fell into the "black" category along with Russia and Singapore. However for the first time Scotland has been given its own ranking score and performed significantly better than England & Wales. The 2006 leader, Germany, slipped significantly in the 2007 rankings, dropping from 1st to 7th place behind Portugal and Slovenia. Leading surveillance societies in the EU and the World 2007 (28.12.2007) http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-559597 Global Privacy Index Criticizes Falling Standards in Germany (7.01.2008) http://www.dw-world.de/dw/article/0,2144,3036544,00.html ============================================================ 6. Inclusive E-government in Western Balkans ============================================================ Most of the participants in the workshops on inclusive e-government that took place in the capitals of six Western Balkan countries, considered that their countries have established very few mechanisms for e-inclusion and interoperability, even though the interest in e-Government development is high. The workshops took place within the framework of the project "Western Balkans Network for Inclusive e-Government" and were meant to present the draft research on the levels of sophistication and inclusiveness of e-gov services conducted by project partners using the EU-level Capgemini methodology, with a goal to develop Regional eGovernment Roadmap to facilitate joint efforts by the countries aspiring to soon join the EU. The six workshops on inclusive e-government were organized by national project partners, and had as targets the review of draft research results, awareness raising and networking between stakeholders including government officials, IT and human rights experts, as well as representatives of NGOs dealing with issues of inclusion of disadvantaged groups such as people with disabilities from both the host countries and the neighborhood. Each workshop was organized by project partners from the respective countries, and they took place in: a. Skopje, Macedonia (23 November 2007) - organized by EDRi-member Metamorphosis Foundation b. Tirana, Albania (26 November 2007) - organized by Comport c. Belgrade, Serbia (11 December 2007) - organized by Belgrade Open School d. Zagreb, Croatia (13 December 2007) - organized by ZaMirNet e. Sarajevo, Bosnia and Herzegovina (13 December 2007) - organized by OneWorld SEE f. Podgorica, Montenegro (20 December 2007) - organized by the Institute for Strategic Studies and Projections The level of online sophistication of e-government services in all countries where research has been completed so far are similar (Albania 33%, Serbia 40%, Montenegro 45%, Macedonia 50%, Croatia 57%) and most of them need to develop under similar circumstances and face similar obstacles, lagging 5-7 years behind the levels of EU. The potential benefit from mutual cooperation is great, both to the states-which have so far mostly invested in revenue-generating services such as e-taxes-and their citizens who need more efficient and transparent governance. The "Western Balkans Network for Inclusive e-Government" project is supported by the East East: Partnership Beyond Borders Program of the Open Society Institute and led by the Metamorphosis Foundation. Alongside the workshops, the project activities included the Third International Conference e-Society.Mk (29-30 November 2007 in Skopje) which facilitated exchange of know-how and experiences both between stakeholders from the region and from the European Union. Project website http://www.e-society.org.mk (Contribution by Filip Stojanovski, EDRI-member Metamorphosis - Macedonia ) ============================================================ 7. UK Government continues to pressure ISPs for Internet filtering ============================================================ On 8 January 2008, at the launching of the government consultation on new copyright exceptions, Lord Triesman, the UK minister for intellectual property, threatened the ISPs with the introduction of new legislation to force them to block illegal filesharing in case they cannot find a voluntary agreement together with the music and film industries by the end of summer. Referring to the Government's attitude towards illegal filesharing, Triesman said "We're not prepared to see the kinds of damage that will be done to the creative economy," and regarding the ISPs he added in an interview for The Register "There is no objective reason why they (rights holders and ISPs) cannot arrive at an agreement. Whether they have the will to do so is another matter." According to a spokesman for ISPA, the Internet providers' trade association, some "good meetings" have taken place between the association and film rights owners, but he did not give any specific details on the results. Triesman also declared that the UK government was collaborating with the French Government on the anti-infringement legislation that proposes the creation of an enforcement body to which the French ISPs will hand over filesharing data. "The French are plainly very serious about this, it's really interesting. We will actually do quite a lot of work alongside them - not necessarily to reach exactly the same objective, but I think we've got a desire to share evidence and analyses. There's no point repeating each other's research." said the minister. The consultation launched on 8 January introduced five recommendations proposing a relaxing copyright enforcement for research and education purposes, to enable distance learning and whiteboard tuition, to allow libraries to make a copy for archive purposes where the copyright holder can't be found and to allow an exemption for the purposes of "caricature, parody or pastiche". The UK Government also proposes a "format shifting right" meaning that the consumers should be allowed to make copies of copyright material they've already bought, but puts a limit to DRM circumvention which should be permitted only for academic and research purposes, but not for the general public for entertainment. Among other comments during the launching, a member of the International Music Managers Forum emphasised the fact that DRM on music is almost dead and is hated by consumers. The first stage of the consultation is open until 8 April 2008. Government piles filesharing pressure on UK ISPs (8.01.2008) http://www.theregister.co.uk/2008/01/08/triesman_isps_legislation_timetable/ Consultation on proposed changes to copyright exceptions launched (8.01.2008) http://www.openrightsgroup.org/2008/01/08/consultation-on-proposed-changes-… CD copying OK, DRM circumvention not OK (8.01.2008) http://www.theregister.co.uk/2008/01/08/copyright_reform/ EDRi-gram: Filtering the Internet - new request of music and film industry (19.12.2007) http://www.edri.org/edrigram/number5.24/internet-filtering-music ============================================================ 8. ELOI - a French database to manage the expulsion of illegal migrants ============================================================ On 26 December 2007, the French government published a decree creating the ELOI file, a database aimed at facilitating the expulsion of illegal migrants. In March 2007, the French highest administrative court cancelled a first attempt by the government to create this file, after 4 French NGOs, among which EDRI member IRIS, filed a case against the Interior ministry. While the March text was cancelled by the Conseil d'Etat for procedural reasons only, the new version shows some important progress related to concerns raised by the NGOS. The main changes are that no data will be kept on visitors of illegal migrants in retention centres, and that personal data of citizens with which illegal immigrants are staying, when not in retention centres are kept for 3 months rather than 3 years. While this step backwards from the government side is a direct result of the French NGOs action, the ELOI database remains unacceptable, according to the authors of the former complaint, with regards to the migrants themselves and their families. The duration of the retention of their data remains 3 years for most of the data, and data on their children are still kept in the ELOI file. Last but not least, the database still contains data on "the need for specific surveillance (of the migrant) with regards to the public order'. According to the NGOs, this demonstrates that the government makes a direct association between immigration and criminality. Moreover, the decree contains new provisions, adding to the ELOI database an impressive amount of administrative and judicial data dealing with all aspects of the expulsion process, most of them to be retained for 3 years. In addition, a new purpose has been set to this file, which is to produce statistics on expulsion decisions and their actual executions. These problems, as well as the Sarkozy administration setting up quantitative objectives - a minimum of 25000 expulsions targeted in 2008 - have made the French NGOs declare that the actual meaning of this file is the government willingness to manage the expulsion of migrants at an unprecedented level. They consider that with the ELOI database, this expulsion policy has reached an industrial level. Decree n. 2007-1890 creating the ELOI database (only in French, 26.12.2007) http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=IMID0759221D CNIL's (French DPA) opinion on the draft decree (only in French, 24.05.2007) http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=CNIX0703389X French NGOs (CIMADE, GISTI, IRIS, LDH) joint press release (only in French, 03.01.2008) http://www.iris.sgdg.org/info-debat/comm-eloi0108.html IRIS dossier on foreigners and databases in France (only in French) http://www.iris.sgdg.org/actions/fichiers/index.html EDRI-gram: French high court cancels the creation of illegal migrants database (14.03.2007) http://www.edri.org/edrigram/number5.5/france-cancels-database (Contribution by Meryem Marzouki, EDRI member IRIS - France) ============================================================ 9. European Commission closes enquiry on Apple ============================================================ The European Commission (EC) has closed the enquiry against Apple for charging more UK users than other EU users for downloads of its iTunes music, following the company announcement on 9 January 2008 that it will reduce download prices for UK within 6 months to align them with prices in continental Europe. A formal investigation had been opened by the EC against Apple after 'Which?', a UK consumer protection organisation, filed a complaint in September 2004 against the company who was applying 20% higher prices to British users than for the other European users. The difference has decreased in time reaching down to 6% and, following discussions between Competition Commissioner Neelie Kroes and Apple chief executive Steve Jobs, the company decided to equalise the prices within a 6-month period. "The Commission is very much in favour of solutions which allow consumers to benefit from a truly Single Market for music downloads." was the Competition Commissioner Neelie Kroes's statement. "This is an important step towards a pan-European marketplace for music," said Steve Jobs, Apple's CEO adding: "We hope every major record label will take a pan-European view of pricing". The issue that remains under discussion is that of the geographical restriction; Apple does not allow purchases on iTunes digital stores from a different country than the residence one. A user from France for instance cannot buy from the German iTunes and Apple verifies the user's residence by means of the credit card during the transaction. Apple states that this policy is due to the different music copyright laws and rules of the European countries. The EC agrees with this position stating that the contracts between Apple and the major record companies are not in breach of the current EU legislation. "..the fact that the same content is not available on a pan-European basis is not the result of restrictive business practices between Apple and major record companies. Rather it is the result of the existing state of copyright legislation (...) Some record companies choose not to make available their content on a pan-European basis. They do so in full respect of copyright regulation. There is no violation of antitrust regulation" stated Kroes' spokesman Jonathan Todd, at the daily Commission briefing on 8 January 2008. Unfortunately, the European Commission did not consider the other Apple-related topics revealed by the consumers association in EU: its dominant position in the EU online music market, its DRM-related practises or its lock down problems. But some of these aspects are still under investigation in several European countries by the national Consumer Ombudsman. European Commission welcomes Apple's announcement to equalise prices for music downloads from iTunes in Europe (9.01.2008) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/08/22&format=HTM… EU pressure ends iTunes price unbalance (10.01.2008) http://www.euractiv.com/en/infosociety/eu-pressure-ends-itunes-price-unbala… Apple to Standardize iTunes Music Prices Throughout Europe (9.01.2008) http://www.apple.com/pr/library/2008/01/09itunes.html iTunes announcement is music to Which?'s ears (9.01.2008) https://www.which.co.uk/press/press_topics/campaign_news/other_issues/itune… EDRi-gram: European Commission investigates Apple's European prices (26.09.2007) http://www.edri.org/edrigram/number5.18/ec-apple-prices EDRi-gram: iTunes under continuous attack in Europe (21.01.2007) http://www.edri.org/edrigram/number5.2/itunes ============================================================ 10. Recommended Reading ============================================================ FLOSSMETRICS/OpenTTT guide presents a set of guidelines and suggestions for the adoption of open source software within SMEs, using a ladder model that will guide companies from the initial selection and adoption of FLOSS within the IT infrastructure up to the creation of suitable business models based on open source software. http://guide.conecta.it/ ============================================================ 11. Agenda ============================================================ 17 January 2008, London, UK Nanotechnology for security and the crime prevention III http://www.nano.org.uk/events/ionevents.htm#security 18 January 2008, Torino, Italy COMMUNIA Workshop - Technology and the public domain http://ws1-2008.communia-project.eu 22 January 2008, London, UK Gov 2.0, or Truly Transformative Government http://www.oii.ox.ac.uk/events/details.cfm?id=169 12 February 2008, Brussels, Belgium European ICT standardisation policy at a crossroad: A new direction for global success http://ec.europa.eu/enterprise/ict/policy/standards/cf2008_en.htm 23-24 February 2008, Brussels, Belgium Research Room @ FOSDEM: Libre software communities meet research community - Introducing Research Friendly http://libresoft.es/Activities/Research_activities/fosdem2008 10-12 March 2008, Geneva, Switzerland WIPO Standing Committee on Copyright and Related Rights: Sixteenth Session http://www.wipo.int/meetings/en/details.jsp?meeting_id=14502 15 March 2008, London, UK OKCon 2008 - Open Knowledge: Applications, Tools and Services http://www.okfn.org/okcon/ 2-4 April 2008, Berlin, Germany re:publica - The Critical Mass http://www.re-publica.de 28-29 April 2008, Vienna, Austria PRISE Final Conference -Towards privacy enhancing security technologies - the next steps Call for papers until 1 February 2008 http://www.prise.oeaw.ac.at/conference.htm 30-31 May 2008, Bucharest, Romania eLiberatica 2008 - The benefits of Open and Free Technologies http://www.eliberatica.ro/2008/ 17-18 June 2008, Seoul, Korea The Future of the Internet Economy - OECD Ministerial Meeting http://www.oecd.org/FutureInternet 23-25 July 2008, Leuven, Belgium The 8th Privacy Enhancing Technologies Symposium (PETS 2008) http://petsymposium.org/2008/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 28 members based or with offices in 17 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Jeremy Epstein 06 Jul '18

06 Jul '18

Neumann (neumann(a)csl.sri.com)" <neumann(a)csl.sri.com>, "Edward W. Felten" <felten(a)CS.Princeton.EDU>, "Gene Spafford (spaf(a)cerias.purdue.edu)" <spaf(a)cerias.purdue.edu> Subject: RE: [IP] Re: Attack on CS research by Chronicle for Higher Edu cation I'm certainly in agreement with Dr. Mercuri et al that this is a lousy story. But what bothers me more as a security professional isn't an undergraduate student calling Dr. Felten names, or Dr. Wilson's concern about the "weird arrangement" between Kennesaw State and the State of Georgia, but rather the modest level of skill exhibited by the team at Kennesaw State. As a member of a Virginia legislative commission, I had the opportunity to question Dr. Brit Williams (the founder of the group at Kennesaw) about his group's processes in approving voting machines. Not only do they make no effort at penetration testing, but according to Dr. Williams' testimony, they have no idea how to do such a test! In other words, they had no ability to even look for the sort of attack that Dr. Felten's team so beautifully demonstrated. For an organization that purports to do approvals of software-based voting machines, the lack of this skill is pretty appalling. Also not noted in the article, but critically important is that the Dr. Williams (and, I presume the Kennesaw State team) are responsible not only for reviewing voting machines for Georgia, but also Maryland and Virginia, and perhaps other states that I don't know about. If there's going to be such a concentration of influence in equipment approval, one would hope for a higher degree of competence and professionalism than is displayed in the article. And if the Chronicle is going to publish such an article, I'd think they'd make an effort to truly "see both sides". --Jeremy ------------------------------------------- ----------------------------------------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: Archives: http://archives.listbox.com/247/ Modify Your Subscription: http://v2.listbox.com/member/?member_id=125019&user_secret=59fc1126 Unsubscribe: http://v2.listbox.com/unsubscribe/?id=125019-59fc1126-jnmsh2hs Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0