July 2018 - cypherpunks-legacy

Re: Weekend Gedankenexperiment - The Kill Switch
by Valdis.Kletnieks＠vt.edu 06 Jul '18

06 Jul '18

On Mon, 07 Feb 2011 17:49:36 EST, Josh Smith said: > even if it was I suspect any service available via satellite might > suffer from similar problems if the methods used to disrupt > connectivity in Egypt were employed here. The real question isn't "If they shut you down, can you restart?". The real question is "If they shut you down, can you restart in a way that avoids them attempting a second shutdown with a bullet?" ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Details of Unlisted Number Address "Exploit" Revealed
by Lauren Weinstein 06 Jul '18

06 Jul '18

Details of Unlisted Number Address "Exploit" Revealed http://lauren.vortex.com/archive/000347.html Greetings. After due consideration, some expert advice, and since the firm involved obviously feels that they're not doing anything wrong (will everyone else agree?), I've decided to release the details of the unlisted number to address lookup "exploit" I outlined in "Psst! Wanna Know the Street Address for an Unlisted Number?" ( http://lauren.vortex.com/archive/000346.html ) -- please see that entry for the background on this situation. This "exploit" is still up and running as of a few minutes ago. As noted previously, this technique is extremely successful at revealing the street addresses for U.S. landline (non-mobile) telephone numbers, including those aforementioned unlisted numbers. The returned information isn't 100% accurate for all queries and some numbers are missing -- I suspect stale data in certain situations -- but it's very "good" overall. Also, the full text of a response I received from the company's (apparent) public relations firm is available for your perusal and amusement ( http://lauren.vortex.com/acceller-rocket-response.txt ). Calling this procedure an "exploit" is actually a misnomer as you'll see, since it's simple and direct to access once you know where it lives -- and even that is unfortunately relatively obvious, so it seems very likely that it's already being used for "unintended" purposes. My hope is that broader knowledge of this matter may lead to a more rapid resolution of the situation, since the firm chose not to limit this data after I called their attention to the privacy issues involved. As you probably know, various large cable television and other service firms (e.g. Time Warner, Comcast, etc.) offer an array of Web-based offers via their Web sites. The most typical means for a new customer to query these sites about available offers at their location is via their phone number. And as it turns out, a major provider of back-end database and related operations provides various functional aspects of many related Web sites. Enter a phone number at the Time Warner offers site, for example, and it's likely to actually be processed by this back-end service (sometimes in a quite obvious manner). It is also apparently possible to make similar queries via voice calls to a toll-free number at the back-end services firm's call center, but I have not explored the non-Web aspects of this operation in detail. Rather than worry about the cable firms in this example (though we could go through their sites as well when they link to this company) we might as well go directly to the back-end operation that's providing the information, since their own site apparently gives access to exactly the same data. Here we go ... The company under discussion is Acceller, Inc., and you can visit their services access page at: http://digitallanding.com In the upper right-hand corner of the page, you'll find a "Search For Offers" form where a phone number may be entered. It's that simple. (Note: You may need to have cookies enabled for this to work, and Internet Explorer may perform better than other browsers in some cases for these queries.) Enter a phone number, watch the bouncing ball for 10 seconds or so, and then you stand an excellent chance of seeing a street address revealed for U.S. non-mobile numbers (along with the various service offerings available at that address, of course). The "geniuses" who programmed that site probably won't be getting any job offers from Google anytime soon. The implementation error is serious and obvious. The proper procedure to avoid revealing private information about unlisted numbers would be to have the user enter their address -- not reveal it from the database based on phone number -- and then verify it yes or no against the database (even this suggested technique has some privacy issues, but they are relatively less serious and could be minimized in various ways). By taking the "helpful shortcut" of revealing the address, the system is putting at risk -- for free and unlimited access by anyone at any time -- the private address information for unlisted numbers. I'm afraid that's really all there is to it. Simple, clean, and neat, to be sure. If you've been paying your local phone company every month for an unlisted number and are upset by this situation, I urge you to contact your telephone company, Acceller, and -- who knows? -- perhaps even your legislative representatives might be intrigued, among other persons and groups. Unfortunately, this isn't the sort of Christmas present that most people probably would wish for. But it appears to be Acceller that's doing all of the ho-ho-hoing. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Details of Unlisted Number Address "Exploit" Revealed
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

EDRi-gram newsletter - Number 7.17, 9 September 2009
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 7.17, 9 September 2009 ============================================================ Contents ============================================================ 1. European Commission hearing on Google Books Settlement 2. Stockholm Programme moves quickly towards adoption 3. A new SWIFT agreement under negotiation between EU and USA 4. Google News investigated for alleged discrimination in Italy 5. Telecom Package - All sides poised for the final battles 6. Consultation on how to operate EU's digital library 7. ICO takes action against personal data losses in UK 8. Recommended Action 9. Recommended Reading 10. Agenda 11. About ============================================================ 1. European Commission hearing on Google Books Settlement ============================================================ The EU Google Books hearing highlighted some very serious concerns with the settlement, but mainly from a rights holder point of view. The hearing itself addressed two quite distinct sets of issues; firstly concerns of EU rights holders with the USA agreement, and how they feel their rights are affected by that agreement. The aim for these speakers was to push the EU to uphold their exclusive rights under copyright, which they feel have been infringed, particularly by scanning and also by making works available without prior consent. Works where EU rights holders are not found may fall into this category. The second set of issues however should be more important for EU legislators: how to make books available for search and sale in Europe. The paths forward on this are less easy, but it appears that some sort of reform to allow the exploitation of 'orphan works' is seen as a strong likelihood. What seems less likely is an exception for scanning, search and indexing of published copyright content. Yet this may be the best answer to competition questions, by allowing a clearer path for new services to use copyright content, perhaps including video, audio and music in the future. Similar questions may be raised around collective licensing agreements. Very little was said about the national nature of copyright, or about attempting to allow pan-European licensing, which has been a severe barrier to music services in the EU. Competition was raised as a concern, but genuine changes that might allow competitors to develop were not discussed in depth compared with the many voices from rights holders with varying levels of concern about loss of control, and violation of international copyright. On the wider questions of academic use, many questions were not answered. There was a similar story with privacy issues. These are social questions, which need the application of social values from civil society and politicians. Privacy for the data produced by such a fundamental service may need to be better defined in law. From that point of view, the number of MEPs attending was disappointing low, as was the number of consumer groups speaking. The major civil society voice was that of librarians, who had important points to make. Worries were raised about preservation of content in the event of Google's demise and the current ability of researchers to analyse the data that Google has collected. They argued that copyright limitations must stand above contracts. Librarians made strong points about the need for reading habits to be kept private. They argued for the need of developing countries to be able to access the information that has been accumulated. While Google Books is very contentious between those whose rights are affected, the wider questions of availability and access to knowledge were only really addressed by librarians and ORG in the hearing. It was apparent that some changes to copyright law may be sought, but they are likely to be the minimum needed to allow this particular type of service to develop, rather than something wide enough to liberate a fuller range of opportunities for people wanting to use copyright works and contribute to the EU's economy. Open Rights Group's speech on to European Commission hearing on Google Books Settlement (7.09.2009) http://www.openrightsgroup.org/ourwork/speeches/google-books-hearing "It is time for Europe to turn over a new e-leaf on digital books and copyright". Joint Statement of EU Commissioners Reding and McCreevy on the occasion of this week's Google Books meetings in Brussels (7.09.2009) http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/09/376&format=… Bringing the world's lost books back to life (7.09.2009) http://googlepolicyeurope.blogspot.com/2009/09/bringing-worlds-lost-books-b… (Contribution by Jim Killock - Executive Director EDRi-member ORG) ============================================================ 2. Stockholm Programme moves quickly towards adoption ============================================================ The timetables for the Stockholm Programme have become a great deal clearer since the return of the Parliament following the summer break and the communication between the Swedish Presidency and relevant parliamentary committees. The Programme aims to set the priorities for a variety of justice issues (including criminal and civil law enforcement cooperation) for the period 2010-2014 and beyond. This initiative takes over from the 2004-2009 Hague Programme. Little new information about the potential content of the final document has been communicated so far, despite the fact that the broad direction of the document is expected to be finalised by the end of October. How any subsequent proposals will be scrutinised by the EU institutions will depend heavily on the outcome of the Irish referendum on the Lisbon Treaty. Beatrice Ask, Swedish Minister for Justice, presented the plans of the Presidency to the European Parliament Civil Liberties Committee on 2 September and focused on the Stockholm Programme. Minister Ask made great efforts to assuage fears regarding the scope and balance of the Programme, repeatedly referring to the need to place the rights of the citizen at the centre of all decision-making on this issue and to ensure that measures that are proposed are properly justified. MEP Sophie In't Veld (ALDE, Netherlands) was very sceptical about the assurances given by the minister. In particular, she said that such an approach would be a break with tradition and that experience to date on SWIFT, ACTA, CIA renditions and that the evaluation of current anti-terrorism policies suggested that little has changed. At the meeting, Minister Ask said that the incoming Spanish Presidency would be relied upon to propose concrete projects on the basis of the priorities in the Programme. Spanish MEP De Mera (EPP, Spain) offered the full and unequivocal support of the largest political group in the Parliament. There were various interventions regarding the status of Europol and whether it should become an EU agency. The Minister was clear in her answer, stating that Europol was and would remain intergovernmental. As regards ACTA, she was surprisingly direct, criticising the lack of transparency of negotiations and stating that border searches of MP3 players would not take place as a result of this planned agreement. She appeared to imply that fears concerning ACTA are unfounded and caused by lack of transparency. It is expected that the bulk of discussions in the Council will be completed in late October, with an informal adoption by Justice Ministers in November and a formal adoption by the Council in December. The Civil Liberties Committee, with input from the Constitutional Affairs and Legal Affairs Committees, will produce an own-initiative report on the Declaration. It is expected that this will be adopted in Committee in November and in Plenary in December, although this is highly likely to change. There will be an inter-parliamentary hearing in the Parliament in October, involving representatives of the European Parliament and national Parliaments. The Green Group in the European Parliament will also hold a hearing, probably in October. Commission Communication on "An Area of Freedom, Security and Justice Serving the Citizen" (10.06.2009) http://ec.europa.eu/commission_barroso/barrot/archive/Programme%20Stockholm… UK written comments on the European Commission's Communication on the Stockholm Programme (27.08.2009) http://www.statewatch.org/news/2009/sep/stockholm-uk-comments-27-08-09.pdf EDRi-gram: Stockholm programme - the new EU dangerous surveillance system (17.07.2009) http://www.edri.org/edri-gram/number7.12/stockholm-programme-eu-surveillance (contribution by Joe McNamee - EDRi) ============================================================ 3. A new SWIFT agreement under negotiation between EU and USA ============================================================ On 1 September 2009, the Civil Liberties Committee of the European Parliament (LIBE) held a hearing on the renewal of the agreement which is now under negotiations between the EU and the USA on data transfers via the SWIFT financial data network. LIBE members have shown concern about the legal basis for the agreement and about that fact that the European Parliament has been kept out of the negotiations, and are asking to be involved in the drafting of the agreement. SWIFT case started in 2006 when it came out that US administrative authorities were accessing data held on European citizens on the SWIFT financial network based in Belgium without the knowledge of the European authorities. Under the pressure of European Parliament and some Member States, measures were taken to ensure some privacy guarantees and the USA had to ensure that the collected data was used solely for anti-terrorist purposes. The new agreement under discussion follows a change in the architectural structure of SWIFT which, according to head of SWIFT Lazaro Campos, "is a key factor in the security of our clients". The system is to have a storage centre for the European data in Switzerland. The change of structure was encouraged by Peter Hustinx, the European Data Protection Supervisor who believes such a change would mean that the data would be stored in Europe. However, he expressed his concern regarding the necessity and proportionality of and interim agreement with the USA and called for the European data to be placed under the European data protections regulations. During the hearing on Monday, Gilles de Kerchove, the European anti-terrorism coordinator, said that the Terrorist Finance Tracking Program, which is based on the SWIFT network, "is a very precious instrument in Europe too. It is of benefit to our Member States". Also, according to Jonathan Faull, European Commission DG Justice director-general, an agreement is necessary "so that SWIFT can operate in a legal framework. A number of negotiating criteria have therefore been proposed to reach a temporary accord, which will apply until a definitive agreement comes in under the Lisbon Treaty". Several MEPs expressed their concerns related to the interim agreement especially regarding the lack of involvement of the European parliament and asked for the details on the SWIFT case to be made public. Austrian MEP Ernst Strasser considers that the European data should be processed according to European standards. In his opinion companies and citizens must have legal certainty. "It is important to conclude an agreement quickly, involving the European Parliament closely, then to renegotiate with a new mandate after Lisbon" he concluded. European Parliament agenda (2.09.2009) http://www.europarl.europa.eu/meetdocs/2009_2014/organes/libe/libe_20090902… SWIFT: European bank data transfers must comply with European standards, say MEPs (3.09.2009) http://www.europarl.europa.eu/news/expert/infopress_page/019-60174-246-09-3… European Parliament: MEPs voice concerns over SWIFT payment agreement between EU and the US (4.09.2009) http://www.egovmonitor.com/node/27708 EDRi-gram: EU wants to share more bank details with the US authorities (29.07.2009) http://www.edri.org/edri-gram/number7.15/new-swift-problems-us-eu ============================================================ 4. Google News investigated for alleged discrimination in Italy ============================================================ The Italian Competition Authority opened an investigation on 27 August 2009 in relation to Google News after the Italian Editors Association (FIEG) claimed Google was discriminating those publishers choosing not to appear on the Italian version of Google News, by automatically excluding them from its primary search engine as well. Various Italian newspapers consider they are deprived of attracting users and advertisers to their own web sites when their stories turn up on Google News. However, they have no problem in appearing on Google search engine. The strongest argument of the investigation is the alleged Google "dominant position" in internet searches, making things difficult for Italian publishers who decide not to appear in Google News. But, although it is obvious that Google is largely preferred by Italian users as a search engine, this is mainly due to its efficiency. As Andrea Monti from EDRi-member ALCEI points out, "dominant position is a concept belonging to the Antitrust law and depicts a situation where a company stays in its market in a fair stronger position then its competitors, thus setting the rules for competition. Oddly enough, this is the first time, at least in Italy, where Google is "charged" of not making contents available, while in the past its management has been accused of not removing 'disturbing contents' from its indexes". One characteristic feature of the dominant position is the customer's so-called "locked-in syndrome" which means that when a user buys a product, certain technological characteristics make it impossible for the buyer to switch to another similar competing product as it was in Microsoft's case. With Google, users can buy advertising services wherever they like, and use other search-engines if they so want. There is nothing that Google can do but to continuously improve its services in order to preserve its users. "We don't display the news stories in their entirety. Rather, our approach is akin to that of web search: we simply show the headlines, a line or two of text and a link to the site - just enough information to make the user want to read the full story. Once a user clicks through to the article, it's up to the news publisher to decide how to profit from this free traffic" is Google's statement in this matter. Also Google stated that it already had a meeting this year with FIEG where it explained that all its over 25 000 sources from all over the world are in complete control in relation to whether they want to be found on Google services. "So if a news publisher doesn't want to be found on Google.com, Google.it or any other reputable search engines, it can prevent indexation automatically via a universally accepted Internet standard called robots.txt. Publishers also have a range of other ways of controlling how their content appears (or doesn't). One such option is for a publisher to continue to appear in Google web search, but not in Google News. In that case, all they need to do is contact us to be removed. In fact, we met with several Italian publishers and representatives of FIEG just this summer to explain these options," said Google in the comment published on their blog. As regarding Google News, Google says there are more requests for inclusion than for removal because "publishers understand that the traffic generated by Google News, and services like it, provide valuable traffic: Google News sends over 1 billion clicks per month to news publishers." Italian Antitrust to storm on Google News? (28.08.2009) http://blog.andreamonti.eu/?p=180 More on the Italian Antitrust investigation upon Google News (1.09.2009) http://blog.andreamonti.eu/?p=190 Google probed by Italy's anti-trust arm (27.08.2009) http://www.theregister.co.uk/2009/08/27/google_italian_probe/ About Google News In Italy (27.08.2009) http://googlepolicyeurope.blogspot.com/2009/08/about-google-news-in-italy.h… Google abuses the news ? (only in Italian, 27.08.2009) http://punto-informatico.it/2698711/PI/News/google-abusa-delle-news.aspx ============================================================ 5. Telecom Package - All sides poised for the final battles ============================================================ Preparations are being made in the EU institutions for the expected third reading of the Telecom Package. The timescale for the remainder of the legislative process will be determined by the official communication of the Council Common Positions to the Parliament. In theory, this can happen as late as mid-October, meaning that the final agreement could happen as late as the end of November or early December. In the absence of official finalised documents from the Council, work on the dossier is focusing at the moment on procedural aspects of the negotiations. The negotiation takes place between representatives of the 27 Member States and 27 Members of the European Parliament (with the balance between political groups in the Parliament overall reflected in the political allegiances of the 27 MEPs). Representatives of EU Member States have informally stated that they believe that Amendment 138 is the only controversial issue and a significant number of Council Members wish to restrict discussions to this issue. Without new information from the Council, discussions in the European Parliament's Industry Committee on 2 September 2009 generated far more heat than light. Catherine Trautmann (S&D, France) proposed moving the debate forward by suggesting that the incoming Commissioner be asked to start work on net neutrality from scratch. Pilar Del Castillo (EPP, Spain) (rapporteur for the creation of a European Communications Market Authority) lamented the lack of communication from the Council and the fact that so much effort had achieved so little for the citizens of Europe. A hearing organised by the Green Group in the European Parliament produced a general discussion on issues related to copyright and net neutrality. In the absence of clarity regarding what specifically will be in the Council texts and insight into what issues may be subject to renewed debate in conciliation, no discussion on the detail of the telecom packet was possible. As regards the procedure that will be followed, while the range of options for tabling amendments is greatly restricted for the second reading, these restrictions are eased in the current conciliation phase. In reality however, it is more a question of what unravels when a particular thread is pulled. For example, if the famous Amendment 138 is adopted, negotiators might argue that it is appropriate to fix the related text. The Member States can be expected to push for as much of the Common Position as possible to be retained and to push again for the "compromise" that was agreed with the Parliament negotiators on Amendment 138 in the first reading (but not adopted). EDRi-gram: The telecoms ministers rejected the telecom package as adopted by the EP (17.06.2009) http://www.edri.org/edri-gram/number7.12/telecom-ministers-reject-package EDRi-gram: European Parliament votes against the 3 strikes. Again (6.05.2009) http://www.edri.org/edri-gram/number7.9/ep-plenary-votes-against-3-strikes (contribution by Joe McNamee - EDRi) ============================================================ 6. Consultation on how to operate EU's digital library ============================================================ The European Commission launched a consultation on 28 August 2009 on EU's digital library project Europeana, set up in November 2008, in order to find the best way to make the project work. Differently from the controversial Google's Book project having scanned about 10 million books, many of which are still copyrighted based on Google's agreement with the US Author's Guild allowing the company to scan copyrighted material in the US, Europeana has scanned about 4.6 million works including books, photos, films and maps which are not covered by copyright and has not yet included orphaned copyrighted works. The project has met difficulties in developing and in competing with Google's initiative because of the current legal framework. "Europeana includes, for legal reasons, neither out-of print works (some 90% of the books in Europe's national libraries), nor orphan works (estimated at 10 - 20% of in-copyright collections) which are still in copyright but where the author cannot be identified," says the recent European Commission statement. Viviane Reding, EU Commissioner for Information Society and Media, who is very strongly supporting the project, considers alarming the fact that "only 5% of all digitised books in the EU are available on Europeana." She also observed that "almost half of Europeana's digitised works have come from one country alone, while all other Member States continue to under-perform dramatically. To me this shows, above all, that Member States must stop envying progress made in other continents and finally do their own homework. It also shows that Europeana alone will not suffice to put Europe on the digital map of the world. We need to work better together to make Europe's copyright framework fit for the digital age." The Commission declared its target to reach 10 million digitised objects by 2010 and wants to get opinions from the industry and the public on how it should operate the Europeana project which costs 3 million euro per year. "How can it be ensured that digitised material can be made available to consumers EU-wide? Should there be better cooperation with publishers with regard to in-copyright material? Would it be a good idea to create European registries for orphan and out-of print works? How should Europeana be financed in the long term?" are some of the questions asked by the Commission in the statement announcing the consultation. The consultation runs until 15 November 2009. EU consults on copyright problems of digitising libraries (1.09.2009) http://www.out-law.com/page-10340 Commission of the European Communities - Europeana - next steps (28.08.2009) http://ec.europa.eu/information_society/activities/digital_libraries/doc/co… Questions for the public consultation "Europeana - next steps" http://ec.europa.eu/information_society/activities/digital_libraries/doc/co… i2010: Digital Libraries Initiative http://ec.europa.eu/information_society/activities/digital_libraries/index_… Europeana - Europe's digital library http://www.europeana.eu/ Digital libraries initiative of the European Union: http://ec.europa.eu/information_society/activities/digital_libraries/index_… Europe's Digital Library doubles in size but also shows EU's lack of common web copyright solution (28.08.2009) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/09/1257&format=H… ============================================================ 7. ICO takes action against personal data losses in UK ============================================================ After UK Information Commissioner's Office (ICO) has found Wigan schools in breach of the Data Protection Act following a theft of a laptop with personal information on about 43 000 children and young people, the Wigan council has agreed to sign an Undertaking to take the necessary measures to comply with the law. The stolen laptop was stored in a locked office but it was not encrypted and the data on it was not protected. By signing the Undertaking, the Wigan Council has agreed to ensure the encryption of all portable and mobile devices, including laptops used to store and transmit personal data. The commitment includes the training of the staff regarding the data storing policy and the obligation of the staff to adhere to that policy. Additional appropriate data protection measures will also be implemented. This is just one of the many cases of personal data losses during the last few years in UK and Ireland. In the case of August 2008 of the loss by PA Consulting of a memory stick containing personal data on prison population and offenders, it has come out that the amount of lost data was much higher than first stated. Through its Resource Account for 2008-2009, the Home Office has admitted the lost device was not containing data on 127 000 people as initially believed but actually it contained data on about 377 000 people, the additional 250 000 being data on users of the Drug Interventions Programme. These users are recorded only by their initials, rather than their full names, thus the personal data being limited in nature. The Information Commissioner Christopher Graham has also expressed his opinion that the courts and the Parliament are to blame for the leakage of personal information that was discovered during an investigation carried out by ICO's Motorman into the activities a private investigator's activities. The investigation has revealed 17 500 requests from about 400 journalists to the private investigator for private information on political personalities, celebrities or security personnel. The information thus obtained was used by the journalists to publish various articles based on it. Graham said that to obtain and sell personal data without permission as well as to publish stories based on the data obtained by deception was in breach of the Data Protection Act which says that organisations must guard against unlawful data processing. He reminded the House of Commons Select Committee on Culture, Media and Sport, that the ICO already revealed the problems of the trade in personal data in 2006, in a report "What Price Privacy Now?", but that no action had been taken by the authorities. "We were let down by the courts, who didn't seem to be interested in levying even the pathetic fines they had at their disposal; we were rather let down by parliament in the end, with no legislation; and we were let down by the newspaper groups, which didn't take it seriously," said Graham. ICO Press Release - Wigan Council improves security after details on most school children are stolen (2.09.2009) http://www.ico.gov.uk/upload/documents/pressreleases/wigan_020909_final.pdf Home Office coughs to larger data loss (28.08.2009) http://www.theregister.co.uk/2009/08/28/home_office_data_loss/ Drug records added to data loss (26.08.2009) http://www.kable.co.uk/home-office-data-loss-26aug09 Courts and Parliament 'let us down' on personal data trade, says privacy watchdog (2.09.2008) http://www.out-law.com/page-10349 Data Protection Act 1998 - Undertaking by Wigan Council as data controller http://www.ico.gov.uk/upload/documents/library/data_protection/notices/wiga… Home Office Resource Accounts 2008-09 (21.07.2009) http://www.official-documents.gov.uk/document/hc0809/hc04/0466/0466.pdf EDRI-gram: UK Watchdog asks the European Commission to adopt security breach law (10.09.2008) http://www.edri.org/edrigram/number6.17/ncc-security-breach-law ============================================================ 8. Recommended Action ============================================================ It is crucial to save Net Neutrality ! http://www.laquadrature.net/en/it-is-crucial-to-save-net-neutrality ============================================================ 9. Recommended Reading ============================================================ In Russia, there is nothing that bloggers can't spin (3.09.2009) http://neteffect.foreignpolicy.com/posts/2009/09/03/in_russia_there_is_noth… State 2.0: a new front end? (7.09.2009) http://www.opendemocracy.net/article/state-2-0-a-new-front-end ============================================================ 10. Agenda ============================================================ 10-12 September 2009, Potsdam, Germany 5th ECPR General Conference, Potsdam Section: Protest Politics Panel: The Contentious Politics of Intellectual Property http://www.ecpr.org.uk/potsdam/default.asp 12 September 2009, Worldwide 2nd International Action Day "Freedom not Fear - Stop the Surveillance Mania" Demonstrations, Events, Privacy Parties etc. in many countries http://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2009 14-15 September 2009, Grand-Saconnex, Switzerland EuroDIG 2009 http://www.eurodig.org/ 16-18 September 2009, Crete, Greece World Summit on the Knowledge Society WSKS 2009 http://www.open-knowledge-society.org/ 17-18 September 2009, Amsterdam, Netherlands Gikii, A Workshop on Law, Technology and Popular Culture Institute for Information Law (IViR) - University of Amsterdam http://www.law.ed.ac.uk/ahrc/gikii/2009.asp 23-24 September 2009, Copenhagen, Denmark The Net will not forget European conference on ICT and Privacy http://www.ict-privacy.dk/ 29-30 September 2009, Warsaw, Poland 3rd International Conference "Keeping Children and Young People Safe Online" http://konferencja.saferinternet.pl/articles-2009/3rd_international_confere… 1-2 October 2009, Barcelona, Spain 6th Communia Workshop: Memory Institutions and Public Domain http://www.communia-project.eu/ws06 16 October 2009, Bielefeld, Germany 10th German Big Brother Awards http://www.bigbrotherawards.de/ 21-23 October 2009, Istanbul, Turkey eChallenges 2009 http://www.echallenges.org/e2009/default.asp 24 October 2009, Zurich, Switzerland Big Brother Awards Switzerland Deadline for nominations: 31 August 2009 http://www.bigbrotherawards.ch/2009/ 25 October 2009, Vienna, Austria Austrian Big Brother Awards Deadline for nominations: 21 September 2009 http://www.bigbrotherawards.at/ 26-27 October 2009, Vienna, Austria 3rd European Privacy Open Space http://www.privacyos.eu 29 October - 1 November 2009, Barcelona, Spain Free Culture Forum: Organization and Action http://fcforum.net/ 3 November 2009, Madrid, Spain Civil Society Conference: "Global Privacy Standards for a Global Economy" Organized by Electronic Privacy Information Center http://www.privacyconference2009.org/privacyconf2009/home/eventos_previos/C… 4-6 November 2009, Madrid, Spain 31st International Conference of Data Protection and Privacy http://www.privacyconference2009.org 13-15 November 2009, Gothenburg, Sweden Free Society Conference and Nordic Summit http://www.fscons.org/ 15-18 November 2009, Sharm El Sheikh, Egypt UN Internet Governance Forum http://www.intgovforum.org/ ============================================================ 11. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Details of Unlisted Number Address "Exploit" Revealed
by Lauren Weinstein 06 Jul '18

06 Jul '18

Details of Unlisted Number Address "Exploit" Revealed http://lauren.vortex.com/archive/000347.html Greetings. After due consideration, some expert advice, and since the firm involved obviously feels that they're not doing anything wrong (will everyone else agree?), I've decided to release the details of the unlisted number to address lookup "exploit" I outlined in "Psst! Wanna Know the Street Address for an Unlisted Number?" ( http://lauren.vortex.com/archive/000346.html ) -- please see that entry for the background on this situation. This "exploit" is still up and running as of a few minutes ago. As noted previously, this technique is extremely successful at revealing the street addresses for U.S. landline (non-mobile) telephone numbers, including those aforementioned unlisted numbers. The returned information isn't 100% accurate for all queries and some numbers are missing -- I suspect stale data in certain situations -- but it's very "good" overall. Also, the full text of a response I received from the company's (apparent) public relations firm is available for your perusal and amusement ( http://lauren.vortex.com/acceller-rocket-response.txt ). Calling this procedure an "exploit" is actually a misnomer as you'll see, since it's simple and direct to access once you know where it lives -- and even that is unfortunately relatively obvious, so it seems very likely that it's already being used for "unintended" purposes. My hope is that broader knowledge of this matter may lead to a more rapid resolution of the situation, since the firm chose not to limit this data after I called their attention to the privacy issues involved. As you probably know, various large cable television and other service firms (e.g. Time Warner, Comcast, etc.) offer an array of Web-based offers via their Web sites. The most typical means for a new customer to query these sites about available offers at their location is via their phone number. And as it turns out, a major provider of back-end database and related operations provides various functional aspects of many related Web sites. Enter a phone number at the Time Warner offers site, for example, and it's likely to actually be processed by this back-end service (sometimes in a quite obvious manner). It is also apparently possible to make similar queries via voice calls to a toll-free number at the back-end services firm's call center, but I have not explored the non-Web aspects of this operation in detail. Rather than worry about the cable firms in this example (though we could go through their sites as well when they link to this company) we might as well go directly to the back-end operation that's providing the information, since their own site apparently gives access to exactly the same data. Here we go ... The company under discussion is Acceller, Inc., and you can visit their services access page at: http://digitallanding.com In the upper right-hand corner of the page, you'll find a "Search For Offers" form where a phone number may be entered. It's that simple. (Note: You may need to have cookies enabled for this to work, and Internet Explorer may perform better than other browsers in some cases for these queries.) Enter a phone number, watch the bouncing ball for 10 seconds or so, and then you stand an excellent chance of seeing a street address revealed for U.S. non-mobile numbers (along with the various service offerings available at that address, of course). The "geniuses" who programmed that site probably won't be getting any job offers from Google anytime soon. The implementation error is serious and obvious. The proper procedure to avoid revealing private information about unlisted numbers would be to have the user enter their address -- not reveal it from the database based on phone number -- and then verify it yes or no against the database (even this suggested technique has some privacy issues, but they are relatively less serious and could be minimized in various ways). By taking the "helpful shortcut" of revealing the address, the system is putting at risk -- for free and unlimited access by anyone at any time -- the private address information for unlisted numbers. I'm afraid that's really all there is to it. Simple, clean, and neat, to be sure. If you've been paying your local phone company every month for an unlisted number and are upset by this situation, I urge you to contact your telephone company, Acceller, and -- who knows? -- perhaps even your legislative representatives might be intrigued, among other persons and groups. Unfortunately, this isn't the sort of Christmas present that most people probably would wish for. But it appears to be Acceller that's doing all of the ho-ho-hoing. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Details of Unlisted Number Address "Exploit" Revealed
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

EDRi-gram newsletter - Number 7.17, 9 September 2009
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 7.17, 9 September 2009 ============================================================ Contents ============================================================ 1. European Commission hearing on Google Books Settlement 2. Stockholm Programme moves quickly towards adoption 3. A new SWIFT agreement under negotiation between EU and USA 4. Google News investigated for alleged discrimination in Italy 5. Telecom Package - All sides poised for the final battles 6. Consultation on how to operate EU's digital library 7. ICO takes action against personal data losses in UK 8. Recommended Action 9. Recommended Reading 10. Agenda 11. About ============================================================ 1. European Commission hearing on Google Books Settlement ============================================================ The EU Google Books hearing highlighted some very serious concerns with the settlement, but mainly from a rights holder point of view. The hearing itself addressed two quite distinct sets of issues; firstly concerns of EU rights holders with the USA agreement, and how they feel their rights are affected by that agreement. The aim for these speakers was to push the EU to uphold their exclusive rights under copyright, which they feel have been infringed, particularly by scanning and also by making works available without prior consent. Works where EU rights holders are not found may fall into this category. The second set of issues however should be more important for EU legislators: how to make books available for search and sale in Europe. The paths forward on this are less easy, but it appears that some sort of reform to allow the exploitation of 'orphan works' is seen as a strong likelihood. What seems less likely is an exception for scanning, search and indexing of published copyright content. Yet this may be the best answer to competition questions, by allowing a clearer path for new services to use copyright content, perhaps including video, audio and music in the future. Similar questions may be raised around collective licensing agreements. Very little was said about the national nature of copyright, or about attempting to allow pan-European licensing, which has been a severe barrier to music services in the EU. Competition was raised as a concern, but genuine changes that might allow competitors to develop were not discussed in depth compared with the many voices from rights holders with varying levels of concern about loss of control, and violation of international copyright. On the wider questions of academic use, many questions were not answered. There was a similar story with privacy issues. These are social questions, which need the application of social values from civil society and politicians. Privacy for the data produced by such a fundamental service may need to be better defined in law. From that point of view, the number of MEPs attending was disappointing low, as was the number of consumer groups speaking. The major civil society voice was that of librarians, who had important points to make. Worries were raised about preservation of content in the event of Google's demise and the current ability of researchers to analyse the data that Google has collected. They argued that copyright limitations must stand above contracts. Librarians made strong points about the need for reading habits to be kept private. They argued for the need of developing countries to be able to access the information that has been accumulated. While Google Books is very contentious between those whose rights are affected, the wider questions of availability and access to knowledge were only really addressed by librarians and ORG in the hearing. It was apparent that some changes to copyright law may be sought, but they are likely to be the minimum needed to allow this particular type of service to develop, rather than something wide enough to liberate a fuller range of opportunities for people wanting to use copyright works and contribute to the EU's economy. Open Rights Group's speech on to European Commission hearing on Google Books Settlement (7.09.2009) http://www.openrightsgroup.org/ourwork/speeches/google-books-hearing "It is time for Europe to turn over a new e-leaf on digital books and copyright". Joint Statement of EU Commissioners Reding and McCreevy on the occasion of this week's Google Books meetings in Brussels (7.09.2009) http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/09/376&format=… Bringing the world's lost books back to life (7.09.2009) http://googlepolicyeurope.blogspot.com/2009/09/bringing-worlds-lost-books-b… (Contribution by Jim Killock - Executive Director EDRi-member ORG) ============================================================ 2. Stockholm Programme moves quickly towards adoption ============================================================ The timetables for the Stockholm Programme have become a great deal clearer since the return of the Parliament following the summer break and the communication between the Swedish Presidency and relevant parliamentary committees. The Programme aims to set the priorities for a variety of justice issues (including criminal and civil law enforcement cooperation) for the period 2010-2014 and beyond. This initiative takes over from the 2004-2009 Hague Programme. Little new information about the potential content of the final document has been communicated so far, despite the fact that the broad direction of the document is expected to be finalised by the end of October. How any subsequent proposals will be scrutinised by the EU institutions will depend heavily on the outcome of the Irish referendum on the Lisbon Treaty. Beatrice Ask, Swedish Minister for Justice, presented the plans of the Presidency to the European Parliament Civil Liberties Committee on 2 September and focused on the Stockholm Programme. Minister Ask made great efforts to assuage fears regarding the scope and balance of the Programme, repeatedly referring to the need to place the rights of the citizen at the centre of all decision-making on this issue and to ensure that measures that are proposed are properly justified. MEP Sophie In't Veld (ALDE, Netherlands) was very sceptical about the assurances given by the minister. In particular, she said that such an approach would be a break with tradition and that experience to date on SWIFT, ACTA, CIA renditions and that the evaluation of current anti-terrorism policies suggested that little has changed. At the meeting, Minister Ask said that the incoming Spanish Presidency would be relied upon to propose concrete projects on the basis of the priorities in the Programme. Spanish MEP De Mera (EPP, Spain) offered the full and unequivocal support of the largest political group in the Parliament. There were various interventions regarding the status of Europol and whether it should become an EU agency. The Minister was clear in her answer, stating that Europol was and would remain intergovernmental. As regards ACTA, she was surprisingly direct, criticising the lack of transparency of negotiations and stating that border searches of MP3 players would not take place as a result of this planned agreement. She appeared to imply that fears concerning ACTA are unfounded and caused by lack of transparency. It is expected that the bulk of discussions in the Council will be completed in late October, with an informal adoption by Justice Ministers in November and a formal adoption by the Council in December. The Civil Liberties Committee, with input from the Constitutional Affairs and Legal Affairs Committees, will produce an own-initiative report on the Declaration. It is expected that this will be adopted in Committee in November and in Plenary in December, although this is highly likely to change. There will be an inter-parliamentary hearing in the Parliament in October, involving representatives of the European Parliament and national Parliaments. The Green Group in the European Parliament will also hold a hearing, probably in October. Commission Communication on "An Area of Freedom, Security and Justice Serving the Citizen" (10.06.2009) http://ec.europa.eu/commission_barroso/barrot/archive/Programme%20Stockholm… UK written comments on the European Commission's Communication on the Stockholm Programme (27.08.2009) http://www.statewatch.org/news/2009/sep/stockholm-uk-comments-27-08-09.pdf EDRi-gram: Stockholm programme - the new EU dangerous surveillance system (17.07.2009) http://www.edri.org/edri-gram/number7.12/stockholm-programme-eu-surveillance (contribution by Joe McNamee - EDRi) ============================================================ 3. A new SWIFT agreement under negotiation between EU and USA ============================================================ On 1 September 2009, the Civil Liberties Committee of the European Parliament (LIBE) held a hearing on the renewal of the agreement which is now under negotiations between the EU and the USA on data transfers via the SWIFT financial data network. LIBE members have shown concern about the legal basis for the agreement and about that fact that the European Parliament has been kept out of the negotiations, and are asking to be involved in the drafting of the agreement. SWIFT case started in 2006 when it came out that US administrative authorities were accessing data held on European citizens on the SWIFT financial network based in Belgium without the knowledge of the European authorities. Under the pressure of European Parliament and some Member States, measures were taken to ensure some privacy guarantees and the USA had to ensure that the collected data was used solely for anti-terrorist purposes. The new agreement under discussion follows a change in the architectural structure of SWIFT which, according to head of SWIFT Lazaro Campos, "is a key factor in the security of our clients". The system is to have a storage centre for the European data in Switzerland. The change of structure was encouraged by Peter Hustinx, the European Data Protection Supervisor who believes such a change would mean that the data would be stored in Europe. However, he expressed his concern regarding the necessity and proportionality of and interim agreement with the USA and called for the European data to be placed under the European data protections regulations. During the hearing on Monday, Gilles de Kerchove, the European anti-terrorism coordinator, said that the Terrorist Finance Tracking Program, which is based on the SWIFT network, "is a very precious instrument in Europe too. It is of benefit to our Member States". Also, according to Jonathan Faull, European Commission DG Justice director-general, an agreement is necessary "so that SWIFT can operate in a legal framework. A number of negotiating criteria have therefore been proposed to reach a temporary accord, which will apply until a definitive agreement comes in under the Lisbon Treaty". Several MEPs expressed their concerns related to the interim agreement especially regarding the lack of involvement of the European parliament and asked for the details on the SWIFT case to be made public. Austrian MEP Ernst Strasser considers that the European data should be processed according to European standards. In his opinion companies and citizens must have legal certainty. "It is important to conclude an agreement quickly, involving the European Parliament closely, then to renegotiate with a new mandate after Lisbon" he concluded. European Parliament agenda (2.09.2009) http://www.europarl.europa.eu/meetdocs/2009_2014/organes/libe/libe_20090902… SWIFT: European bank data transfers must comply with European standards, say MEPs (3.09.2009) http://www.europarl.europa.eu/news/expert/infopress_page/019-60174-246-09-3… European Parliament: MEPs voice concerns over SWIFT payment agreement between EU and the US (4.09.2009) http://www.egovmonitor.com/node/27708 EDRi-gram: EU wants to share more bank details with the US authorities (29.07.2009) http://www.edri.org/edri-gram/number7.15/new-swift-problems-us-eu ============================================================ 4. Google News investigated for alleged discrimination in Italy ============================================================ The Italian Competition Authority opened an investigation on 27 August 2009 in relation to Google News after the Italian Editors Association (FIEG) claimed Google was discriminating those publishers choosing not to appear on the Italian version of Google News, by automatically excluding them from its primary search engine as well. Various Italian newspapers consider they are deprived of attracting users and advertisers to their own web sites when their stories turn up on Google News. However, they have no problem in appearing on Google search engine. The strongest argument of the investigation is the alleged Google "dominant position" in internet searches, making things difficult for Italian publishers who decide not to appear in Google News. But, although it is obvious that Google is largely preferred by Italian users as a search engine, this is mainly due to its efficiency. As Andrea Monti from EDRi-member ALCEI points out, "dominant position is a concept belonging to the Antitrust law and depicts a situation where a company stays in its market in a fair stronger position then its competitors, thus setting the rules for competition. Oddly enough, this is the first time, at least in Italy, where Google is "charged" of not making contents available, while in the past its management has been accused of not removing 'disturbing contents' from its indexes". One characteristic feature of the dominant position is the customer's so-called "locked-in syndrome" which means that when a user buys a product, certain technological characteristics make it impossible for the buyer to switch to another similar competing product as it was in Microsoft's case. With Google, users can buy advertising services wherever they like, and use other search-engines if they so want. There is nothing that Google can do but to continuously improve its services in order to preserve its users. "We don't display the news stories in their entirety. Rather, our approach is akin to that of web search: we simply show the headlines, a line or two of text and a link to the site - just enough information to make the user want to read the full story. Once a user clicks through to the article, it's up to the news publisher to decide how to profit from this free traffic" is Google's statement in this matter. Also Google stated that it already had a meeting this year with FIEG where it explained that all its over 25 000 sources from all over the world are in complete control in relation to whether they want to be found on Google services. "So if a news publisher doesn't want to be found on Google.com, Google.it or any other reputable search engines, it can prevent indexation automatically via a universally accepted Internet standard called robots.txt. Publishers also have a range of other ways of controlling how their content appears (or doesn't). One such option is for a publisher to continue to appear in Google web search, but not in Google News. In that case, all they need to do is contact us to be removed. In fact, we met with several Italian publishers and representatives of FIEG just this summer to explain these options," said Google in the comment published on their blog. As regarding Google News, Google says there are more requests for inclusion than for removal because "publishers understand that the traffic generated by Google News, and services like it, provide valuable traffic: Google News sends over 1 billion clicks per month to news publishers." Italian Antitrust to storm on Google News? (28.08.2009) http://blog.andreamonti.eu/?p=180 More on the Italian Antitrust investigation upon Google News (1.09.2009) http://blog.andreamonti.eu/?p=190 Google probed by Italy's anti-trust arm (27.08.2009) http://www.theregister.co.uk/2009/08/27/google_italian_probe/ About Google News In Italy (27.08.2009) http://googlepolicyeurope.blogspot.com/2009/08/about-google-news-in-italy.h… Google abuses the news ? (only in Italian, 27.08.2009) http://punto-informatico.it/2698711/PI/News/google-abusa-delle-news.aspx ============================================================ 5. Telecom Package - All sides poised for the final battles ============================================================ Preparations are being made in the EU institutions for the expected third reading of the Telecom Package. The timescale for the remainder of the legislative process will be determined by the official communication of the Council Common Positions to the Parliament. In theory, this can happen as late as mid-October, meaning that the final agreement could happen as late as the end of November or early December. In the absence of official finalised documents from the Council, work on the dossier is focusing at the moment on procedural aspects of the negotiations. The negotiation takes place between representatives of the 27 Member States and 27 Members of the European Parliament (with the balance between political groups in the Parliament overall reflected in the political allegiances of the 27 MEPs). Representatives of EU Member States have informally stated that they believe that Amendment 138 is the only controversial issue and a significant number of Council Members wish to restrict discussions to this issue. Without new information from the Council, discussions in the European Parliament's Industry Committee on 2 September 2009 generated far more heat than light. Catherine Trautmann (S&D, France) proposed moving the debate forward by suggesting that the incoming Commissioner be asked to start work on net neutrality from scratch. Pilar Del Castillo (EPP, Spain) (rapporteur for the creation of a European Communications Market Authority) lamented the lack of communication from the Council and the fact that so much effort had achieved so little for the citizens of Europe. A hearing organised by the Green Group in the European Parliament produced a general discussion on issues related to copyright and net neutrality. In the absence of clarity regarding what specifically will be in the Council texts and insight into what issues may be subject to renewed debate in conciliation, no discussion on the detail of the telecom packet was possible. As regards the procedure that will be followed, while the range of options for tabling amendments is greatly restricted for the second reading, these restrictions are eased in the current conciliation phase. In reality however, it is more a question of what unravels when a particular thread is pulled. For example, if the famous Amendment 138 is adopted, negotiators might argue that it is appropriate to fix the related text. The Member States can be expected to push for as much of the Common Position as possible to be retained and to push again for the "compromise" that was agreed with the Parliament negotiators on Amendment 138 in the first reading (but not adopted). EDRi-gram: The telecoms ministers rejected the telecom package as adopted by the EP (17.06.2009) http://www.edri.org/edri-gram/number7.12/telecom-ministers-reject-package EDRi-gram: European Parliament votes against the 3 strikes. Again (6.05.2009) http://www.edri.org/edri-gram/number7.9/ep-plenary-votes-against-3-strikes (contribution by Joe McNamee - EDRi) ============================================================ 6. Consultation on how to operate EU's digital library ============================================================ The European Commission launched a consultation on 28 August 2009 on EU's digital library project Europeana, set up in November 2008, in order to find the best way to make the project work. Differently from the controversial Google's Book project having scanned about 10 million books, many of which are still copyrighted based on Google's agreement with the US Author's Guild allowing the company to scan copyrighted material in the US, Europeana has scanned about 4.6 million works including books, photos, films and maps which are not covered by copyright and has not yet included orphaned copyrighted works. The project has met difficulties in developing and in competing with Google's initiative because of the current legal framework. "Europeana includes, for legal reasons, neither out-of print works (some 90% of the books in Europe's national libraries), nor orphan works (estimated at 10 - 20% of in-copyright collections) which are still in copyright but where the author cannot be identified," says the recent European Commission statement. Viviane Reding, EU Commissioner for Information Society and Media, who is very strongly supporting the project, considers alarming the fact that "only 5% of all digitised books in the EU are available on Europeana." She also observed that "almost half of Europeana's digitised works have come from one country alone, while all other Member States continue to under-perform dramatically. To me this shows, above all, that Member States must stop envying progress made in other continents and finally do their own homework. It also shows that Europeana alone will not suffice to put Europe on the digital map of the world. We need to work better together to make Europe's copyright framework fit for the digital age." The Commission declared its target to reach 10 million digitised objects by 2010 and wants to get opinions from the industry and the public on how it should operate the Europeana project which costs 3 million euro per year. "How can it be ensured that digitised material can be made available to consumers EU-wide? Should there be better cooperation with publishers with regard to in-copyright material? Would it be a good idea to create European registries for orphan and out-of print works? How should Europeana be financed in the long term?" are some of the questions asked by the Commission in the statement announcing the consultation. The consultation runs until 15 November 2009. EU consults on copyright problems of digitising libraries (1.09.2009) http://www.out-law.com/page-10340 Commission of the European Communities - Europeana - next steps (28.08.2009) http://ec.europa.eu/information_society/activities/digital_libraries/doc/co… Questions for the public consultation "Europeana - next steps" http://ec.europa.eu/information_society/activities/digital_libraries/doc/co… i2010: Digital Libraries Initiative http://ec.europa.eu/information_society/activities/digital_libraries/index_… Europeana - Europe's digital library http://www.europeana.eu/ Digital libraries initiative of the European Union: http://ec.europa.eu/information_society/activities/digital_libraries/index_… Europe's Digital Library doubles in size but also shows EU's lack of common web copyright solution (28.08.2009) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/09/1257&format=H… ============================================================ 7. ICO takes action against personal data losses in UK ============================================================ After UK Information Commissioner's Office (ICO) has found Wigan schools in breach of the Data Protection Act following a theft of a laptop with personal information on about 43 000 children and young people, the Wigan council has agreed to sign an Undertaking to take the necessary measures to comply with the law. The stolen laptop was stored in a locked office but it was not encrypted and the data on it was not protected. By signing the Undertaking, the Wigan Council has agreed to ensure the encryption of all portable and mobile devices, including laptops used to store and transmit personal data. The commitment includes the training of the staff regarding the data storing policy and the obligation of the staff to adhere to that policy. Additional appropriate data protection measures will also be implemented. This is just one of the many cases of personal data losses during the last few years in UK and Ireland. In the case of August 2008 of the loss by PA Consulting of a memory stick containing personal data on prison population and offenders, it has come out that the amount of lost data was much higher than first stated. Through its Resource Account for 2008-2009, the Home Office has admitted the lost device was not containing data on 127 000 people as initially believed but actually it contained data on about 377 000 people, the additional 250 000 being data on users of the Drug Interventions Programme. These users are recorded only by their initials, rather than their full names, thus the personal data being limited in nature. The Information Commissioner Christopher Graham has also expressed his opinion that the courts and the Parliament are to blame for the leakage of personal information that was discovered during an investigation carried out by ICO's Motorman into the activities a private investigator's activities. The investigation has revealed 17 500 requests from about 400 journalists to the private investigator for private information on political personalities, celebrities or security personnel. The information thus obtained was used by the journalists to publish various articles based on it. Graham said that to obtain and sell personal data without permission as well as to publish stories based on the data obtained by deception was in breach of the Data Protection Act which says that organisations must guard against unlawful data processing. He reminded the House of Commons Select Committee on Culture, Media and Sport, that the ICO already revealed the problems of the trade in personal data in 2006, in a report "What Price Privacy Now?", but that no action had been taken by the authorities. "We were let down by the courts, who didn't seem to be interested in levying even the pathetic fines they had at their disposal; we were rather let down by parliament in the end, with no legislation; and we were let down by the newspaper groups, which didn't take it seriously," said Graham. ICO Press Release - Wigan Council improves security after details on most school children are stolen (2.09.2009) http://www.ico.gov.uk/upload/documents/pressreleases/wigan_020909_final.pdf Home Office coughs to larger data loss (28.08.2009) http://www.theregister.co.uk/2009/08/28/home_office_data_loss/ Drug records added to data loss (26.08.2009) http://www.kable.co.uk/home-office-data-loss-26aug09 Courts and Parliament 'let us down' on personal data trade, says privacy watchdog (2.09.2008) http://www.out-law.com/page-10349 Data Protection Act 1998 - Undertaking by Wigan Council as data controller http://www.ico.gov.uk/upload/documents/library/data_protection/notices/wiga… Home Office Resource Accounts 2008-09 (21.07.2009) http://www.official-documents.gov.uk/document/hc0809/hc04/0466/0466.pdf EDRI-gram: UK Watchdog asks the European Commission to adopt security breach law (10.09.2008) http://www.edri.org/edrigram/number6.17/ncc-security-breach-law ============================================================ 8. Recommended Action ============================================================ It is crucial to save Net Neutrality ! http://www.laquadrature.net/en/it-is-crucial-to-save-net-neutrality ============================================================ 9. Recommended Reading ============================================================ In Russia, there is nothing that bloggers can't spin (3.09.2009) http://neteffect.foreignpolicy.com/posts/2009/09/03/in_russia_there_is_noth… State 2.0: a new front end? (7.09.2009) http://www.opendemocracy.net/article/state-2-0-a-new-front-end ============================================================ 10. Agenda ============================================================ 10-12 September 2009, Potsdam, Germany 5th ECPR General Conference, Potsdam Section: Protest Politics Panel: The Contentious Politics of Intellectual Property http://www.ecpr.org.uk/potsdam/default.asp 12 September 2009, Worldwide 2nd International Action Day "Freedom not Fear - Stop the Surveillance Mania" Demonstrations, Events, Privacy Parties etc. in many countries http://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2009 14-15 September 2009, Grand-Saconnex, Switzerland EuroDIG 2009 http://www.eurodig.org/ 16-18 September 2009, Crete, Greece World Summit on the Knowledge Society WSKS 2009 http://www.open-knowledge-society.org/ 17-18 September 2009, Amsterdam, Netherlands Gikii, A Workshop on Law, Technology and Popular Culture Institute for Information Law (IViR) - University of Amsterdam http://www.law.ed.ac.uk/ahrc/gikii/2009.asp 23-24 September 2009, Copenhagen, Denmark The Net will not forget European conference on ICT and Privacy http://www.ict-privacy.dk/ 29-30 September 2009, Warsaw, Poland 3rd International Conference "Keeping Children and Young People Safe Online" http://konferencja.saferinternet.pl/articles-2009/3rd_international_confere… 1-2 October 2009, Barcelona, Spain 6th Communia Workshop: Memory Institutions and Public Domain http://www.communia-project.eu/ws06 16 October 2009, Bielefeld, Germany 10th German Big Brother Awards http://www.bigbrotherawards.de/ 21-23 October 2009, Istanbul, Turkey eChallenges 2009 http://www.echallenges.org/e2009/default.asp 24 October 2009, Zurich, Switzerland Big Brother Awards Switzerland Deadline for nominations: 31 August 2009 http://www.bigbrotherawards.ch/2009/ 25 October 2009, Vienna, Austria Austrian Big Brother Awards Deadline for nominations: 21 September 2009 http://www.bigbrotherawards.at/ 26-27 October 2009, Vienna, Austria 3rd European Privacy Open Space http://www.privacyos.eu 29 October - 1 November 2009, Barcelona, Spain Free Culture Forum: Organization and Action http://fcforum.net/ 3 November 2009, Madrid, Spain Civil Society Conference: "Global Privacy Standards for a Global Economy" Organized by Electronic Privacy Information Center http://www.privacyconference2009.org/privacyconf2009/home/eventos_previos/C… 4-6 November 2009, Madrid, Spain 31st International Conference of Data Protection and Privacy http://www.privacyconference2009.org 13-15 November 2009, Gothenburg, Sweden Free Society Conference and Nordic Summit http://www.fscons.org/ 15-18 November 2009, Sharm El Sheikh, Egypt UN Internet Governance Forum http://www.intgovforum.org/ ============================================================ 11. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Face-Recognition Passports
by David Farber 06 Jul '18

06 Jul '18

http://www.cnn.com/2004/TECH/06/15/face.passport/index.html Face recognition passports expected by December Yet hurdles could still delay technology >From Mike M. Ahlers CNN Washington Bureau WASHINGTON (CNN) -- The first U.S. passport to feature facial-recognition technology should be produced by December, but the technology won't be widely distributed until late 2005, a State Department official told Congress on Tuesday. Maura Harty, assistant secretary for consular affairs, said the State Department plans to test the high-tech passports by issuing them first to U.S. officials and diplomats. But citing technological hurdles, she repeated a request that Congress postpone a looming deadline requiring 27 close U.S. allies to have similar passports in place by fall. "Given the time that it has taken to resolve these technical, complex issues ... few of the visa waiver countries, if any, will meet the deadline," she said. "It is not a question of ill will. It is very much a question of difficult science." On Monday, the House of Representatives voted to give visa-waiver countries a one-year extension on the deadline. But Harty and Homeland Security Undersecretary Asa Hutchinson testified at a hearing of the Senate Judiciary Committee on Tuesday that it will take two years to perfect the technology. "We have been told by almost all the countries that they cannot get it done within a year," Harty said. Hutchinson said, "We believe that all countries can be compliant on November 30, 2006, and it should be a hard-and-fast deadline. It's important, I believe, for us to get this process right the first time." Members of Congress, meanwhile, questioned the use of facial recognition technology in the passports, saying fingerprints would be a better identifier. The International Civil Aviation Organization chose facial recognition as the international standard for passports. "Every policeman in America can access the fugitive, anybody, and put their fingerprints in the system and on a short notice determine whether or not a warrant is out for their arrest. You can't do that with a face," said Sen. Jeff Sessions, a Republican of Alabama. Hutchinson said the United States believes that fingerprints "should be a significant part" of the system, but "we don't have a consensus in the international community to do that at this time." The computer chip embedded in the new passports will have the capacity to include fingerprint information, he said. Hutchinson acknowledged the shortcomings of the facial recognition technology. He said it is "sufficient" at making one-on-one matches but cannot adequately match a face on a card to large databases of faces. "We're hopeful that the technology improves as time goes on," he said. Another problem is that the computer chips are not as durable as they need to be, he said. "The chips have a life span currently of three to five years, and as you know in many instances the passports are issued for six to 10 years," Hutchinson said. "So right now you'll be adding a chip on there that has a shorter life span than the life of the passport itself." ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Tor 0.0.9pre3 is out
by Roger Dingledine 06 Jul '18

06 Jul '18

Along with the bugfixes from 0.0.8.1, plus more bugfixes, this release makes the dirservers file obsolete (finally) in favor of config option lines to specify the location and fingerprint of each dirserver you want to trust. We also now support the use of an http proxy for fetching directories. tarball: http://freehaven.net/tor/dist/tor-0.0.9pre3.tar.gz signature: http://freehaven.net/tor/dist/tor-0.0.9pre3.tar.gz.asc (use -dPr tor-0_0_9pre3 if you want to check out from cvs) o Bugfixes on 0.0.8.1: - Better torrc example lines for dirbindaddress and orbindaddress. - Improved bounds checking on parsed ints (e.g. config options and the ones we find in directories.) - Better handling of size_t vs int, so we're more robust on 64 bit platforms. - Fix the rest of the bug where a newly started OR would appear as unverified even after we've added his fingerprint and hupped the dirserver. - Fix a bug from 0.0.7: when read() failed on a stream, we would close it without sending back an end. So 'connection refused' would simply be ignored and the user would get no response. o Bugfixes on 0.0.9pre2: - Serving the cached-on-disk directory to people is bad. We now provide no directory until we've fetched a fresh one. - Workaround for bug on windows where cached-directories get crlf corruption. - Make get_default_conf_file() work on older windows too. - If we write a *:* exit policy line in the descriptor, don't write any more exit policy lines. o Features: - Use only 0.0.9pre1 and later servers for resolve cells. - Make the dirservers file obsolete. - Include a dir-signing-key token in directories to tell the parsing entity which key is being used to sign. - Remove the built-in bulky default dirservers string. - New config option "Dirserver %s:%d [fingerprint]", which can be repeated as many times as needed. If no dirservers specified, default to moria1,moria2,tor26. - Make moria2 advertise a dirport of 80, so people behind firewalls will be able to get a directory. - Http proxy support - Dirservers translate requests for http://%s:%d/x to /x - You can specify "HttpProxy %s[:%d]" and all dir fetches will be routed through this host. - Clients ask for /tor/x rather than /x for new enough dirservers. This way we can one day coexist peacefully with apache. - Clients specify a "Host: %s%d" http header, to be compatible with more proxies, and so running squid on an exit node can work. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

WiMax Operator's Manual: Building 802.16 Wireless
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/10/21/1657253 Posted by: timothy, on 2004-10-21 22:00:00 from the beaming-it-out-there dept. [1]Dozix007 (Kurt Kaylor) writes "Daniel Sweeney, a technical writer, business reporter, and industry analyst is coming full circle in his series of wireless related writings with his latest book WiMax Operator's Manual: Building 802.16 Wireless Networks. Sweeney brings the WiMax 802.16 standard into the context of a ISP solution for the masses. WiMax is a recent standard from the IEEE that is similar to conventional wireless technology, however WiMax supports higher data rates and longer distance transmissions than other standards from the IEEE. This book drifts away from the recent flood of wireless books by conveying all needed knowledge to establish, understand, operate and potentially profit from an 802.16 wireless network, rather than a specific look at one aspect of the technology. This book is not only for the business minded, but for a consumer looking to establish a quality long-distance wireless network of their own." Read on for the rest of Kaylor's review. [2]Click Here WiMax Operator's Manual: Building 802.16 Wireless Networks is primarily a utilitarian book rather than conceptual. It provides a background in broadband wireless fundamentals, packet data, and overall network operation and management to enable a network operator to set up a network with standards-based equipment and to run it profitably thereafter. Sweeney notes early in the book : "Nothing is particularly admirable about purism in terms of wireless technology, and if wire line technologies serve the same purpose better over some portion of the network footprint, then wise network operators will avail themselves of them." This theme of realism in relation to the application of a wireless network is prevalent though out the book. Wired networks in the same footprint will almost always beat a wireless network in speed, reliability, and cost. This is primarily due to the previously created infrastructure available to Internet carriers. The goal that Sweeney promotes is to find an ideal region that has not yet been exploited by a wired service provider. These regions are ideal due to the low-cost setup for a wireless network compared to the cost of a wired network. Sweeney describes and informs the user of ways to find and establish these networks in an efficient manner to maximize profitability. Sweeney also discusses network security in the later chapters of his book. He acknowledges the increasing need to secure the network's own infrastructure, the safety of its customers, and a nation itself. In relation to wireless networks, Sweeney notes "[Security] is becoming increasingly important in network operations today and cannot be considered optional at this point." To this end, the network security section is devoted to security policies, secure electrical systems, cyber warfare, and other information on safeguarding your network. Another concern also addressed is the Communications Assistance for Law Enforcement Act. CALEA is a complex piece of federal legislation that expands law enforcement's authority to conduct electronic surveillance, including surveillance over public networks. Sadly, as of yet there is no real way to combat this intrusive act. WiMax Operator's Manual: Building 802.16 Wireless Networks is a great resource for businesses and individuals looking to establish their own 802.16 network. I enjoyed the foresight provided in this book for potential problems faced by network operators. The honesty in the practicality of an 802.16 network as a realistic network solution also made the book a great resource. There was no fantasy scenario or white lies to convince a user of the merit of a 802.16 network beyond what it can do. The gripe I do have with this book is its complete utilitarian nature. A little more theory and insight into the standard itself would have been great. This book stands purely as an Operator's Manual, and not an exploration of WiMax as a standard, but rather a tool. Otherwise, this book was highly enjoyable and well written. I would recommend this book to anyone looking to establish a network beyond the standards commonly available (e.g. 802.11a - 802.11g). This book is unique in its topic and sheer honesty, and is one of the few references available on the specific subject. _________________________________________________________________ You can purchase [3]WiMax Operator's Manual: Building 802.16 Wireless Networks from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the [4]book review guidelines, then visit the [5]submission page. References 1. mailto:dozix007@uberhacker.com 2. http://ads.osdn.com/?ad_id=4826&alloc_id=10297&site_id=1&request_id=7629555… p=click&page=%2farticle%2epl 3. http://service.bfast.com/bfast/click?bfmid=2181&sourceid=39391960&isbn=1590… 357X 4. http://slashdot.org/book.review.guidelines.shtml 5. http://slashdot.org/submit.pl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0