- cypherpunks-legacy - lists.cpunks.org

[Politech] A criticism of Gmail and a call for encryption everywhere [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: Opposing view of Gmail issues (Cypherpunk tie in) Date: Sun, 25 Apr 2004 13:11:53 -0500 (CDT) From: J.A. Terranson <measl(a)mfn.org> To: Declan McCullagh <declan(a)well.com> References: <4087CD30.5020800(a)well.com> Good Afternoon Declan, As with much of the online community, I have been discussing this topic since it was announced by Google, and until recently, I was also of the opinion that this was a simple contractual choice between the user of Gmail and Google. My opinion was altered by a gentleman in England, who used the following story to illustrate his point: When Google released their toolbar, he, like most of us, installed it. What was different was that he installed it with all of the advanced features (including the tracking options, which Google goes out of their way to make crystal clear *is* tracking software). He reasoning was similar to the thoughts you expressed below: he had nothing to hide, he believed Google really was stripping identity data from their observations of his browsing habits, and he did not mind having them "watch". One day he had a firewall issue when trying to retrieve a file, and the person who was hosting it offered to put it on a "private" (i.e., unlinked) page for him to grab over HTTP. He accepted, downloaded the document, and promptly forgot about it - until this document, which had extremely personal information on it (personal to the person *hosting* it, not the person retrieving it) showed up on Google a short time later. You see, the toolbar had seen him go to a web page that Google did not have, and so they indexed it right away. Without meaning to, the user of the toolbar had helped Google to violate the privacy of the person who went out of his way to keep this document private. This person knew nothing of the toolbar, and had no agreement with Google, yet he became the unwilling participant in Google's web cache. The senders of email to users of Gmail are in the very same position as our friend above: they know nothing of the agreement, they are not participants in the Gmail program - they have never agreed to allow a third party to access *their* private thoughts and utterances, yet they too are caught in the middle. As much as it goes against my gut reaction, I must admit that Gmail has some very serious privacy implications, some of which almost definitely fall under EU privacy laws. The ultimate solution to the problem is close to what was suggested in the essay below: encryption. But not by Google. Encryption by the senders. The Cypherpunk cries of "Encryption Everywhere" lands smack dab in the middle of the plate here - email stays private, regardless of Google indexing, government snooping, or end user negligence. Pity that people will spend thousands of hours, and millions of dollars arguing over the best way to protect us from ourselves, but that we won't spend five minutes learning to use a simple encryption system that could completely erase these very issues. Yours, Alif Terranson sysadmin(a)mfn.org On Thu, 22 Apr 2004, Declan McCullagh wrote: > [It seems to me that Brad is being kind here by not denouncing the > privacy fundamentalists for trying to ban Google's Gmail in its current > form. It is true that there are potential costs of using Gmail for email > storage (just as there are costs of using your own laptop for that > purpose). The question is whether consumers should have the right to > make that choice and balance the tradeoffs, or whether it will be > preemptively denied to them by privacy fundamentalists out to deny > consumers that choice. --Declan] > _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [tor-talk] remailers
by Karsten N. 06 Jul '18

06 Jul '18

Am 30.12.2011 23:48, schrieb cmeclax-sazri: > I used to run a remailer and would like to again. There is a Mixminion > package, so I installed it and tried to join the group. What's going on these > days with remailers? Should we design a remailer that uses Tor in some way? Mixminion is dead. Only less than 10 Mixminion remailers are running: http://www.noreply.org/mixminion-nodes/ For Mixmaster up to 20 remailers are running. http://pinger.mixmin.net/mlist2.html Best regards Karsten N. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: PeerPoint Discussion - please don't use for other topics
by Poor Richard 06 Jul '18

06 Jul '18

I'm disappointed but not surprised that the PeerPoint project is viewed with scorn by old-guard digital libertarians and anarchists. I am accused of being naive--they've seen everything and done everything and they have a superior, smug outlook. They argue that what works is more of what they are accustomed to. But it is exactly that approach that resulted in the present state of affairs in which the internet is colonized and dominated by large corporate actors. Anarchists and libertarians are the unwitting pawns of the powerful actors they mean to resist. I've been around IT since long before the internet, since it was called data processing. Since before email and electronic bulletin boards and USENET. And I've been involved in every aspect of it since we operated mainframes with teletype terminals and punched tape right through until today. I was old guard once, very old guard. I've also been a political, social, and environmental activist since the sixties, witnessing the horrifying failure of almost all our movements from the inside. But recently I woke up to the fact that it was on our watch--MY watch--that the world went to hell in a handbasket. My confederates and I all screwed up. We all get a big-assed #FAIL. Einstein's definition of insanity is doing the same thing over and over and expecting different results. By that definition anybody who thinks that libertarian and anarchist business-as-usual is going to pull us through the crises and threats we now face is not just naive--they are burried inside a mystery wrapped in a conundrum, locked within an enigma. They are lost in space. The threats to privacy, liberty, democracy, and equality have steadily grown despite all our BRILLIANT efforts up to now, so only a new strategy can be expected to reverse that trend. That strategy is not a continued, exclusive reliance on slef-organizing, emergent systems. That by itself has not worked. We need to try something else. That something else might even be something that was tried in the past and discredited because it was impractical then. It might be large-scale collective organization and design. In the past large-scale collective design failed because it was forced to adopt centralized, top-down planning and organization. Now we can do it in a much more distributed, horizontal, and agile manner. It failed because it adopted organizational structures and created designs that were monolithic. Now we can do organizations and designs that are modular and composable. *Wikipedia: Composability* <http://en.wikipedia.org/wiki/Composability> is a system design <http://en.wikipedia.org/wiki/System_design> principle that deals with the inter-relationships of components. A highly composable system provides recombinant components that can be selected and assembled in various combinations to satisfy specific user requirements. In information systems, the essential features that make a component composable are that it be: - self-contained (modular<http://en.wikipedia.org/wiki/Modular_programming>): it can be deployed independently - note that it may cooperate with other components, but dependent components are replaceable - stateless <http://en.wikipedia.org/wiki/Stateless_server>: it treats each request as an independent transaction, unrelated to any previous request. *Stateless* is just one technique; *managed state* and * transactional* systems can also be composable, but with greater difficulty. Finally, many past revolutions have failed or succeeded upon their access to technology. Somehow ignoring the story of "guns, germs, and steel" the old guard now wants to say that revolutions are not about tools or technology, they are just about people and social relations. They pontificate that technology doesn't make revolutions, people make revolutions. Tell that to an Afghan tribesman and see if he will discard his AK-47 or his satellite phone. As I wrote in PeerPoint, I thought quite plainly and clearly, PeerPoint is a non-violent weapon of revolution. Let those who don't think we need a revolution shut the hell up and get out of the way. Poor Richard On Monday, June 18, 2012 9:14:27 AM UTC-5, Poor Richard wrote: > > *Welcome to the PeerPoint Discussion Thread* > > PeerPoint Design Specifications<https://docs.google.com/document/d/1TkAUpUxdfKGr_5Qio2SlZcnBu_sgnZWdoVTZuD_…> > > PeerPoint is an evolving crowdsourced design specification for a suite of > integrated peer-to-peer applications to include (but not limited to) social > networking, real-time project collaboration, content management, database > management, voting, trust/reputation metrics, complementary currency, crowd > funding, etc. This specification overlaps with several existing p2p > infrastructure and social networking projects but also goes substantially > beyond anything yet existing. > > Members of p2p projects, interested programmers and designers, power > users, and others are encouraged to participate in the collaborative > development of the open PeerPoint specs and to adopt any part of the specs > they can use in their own work. To participate, please read the PeerPoint > Design Specifications<https://docs.google.com/document/d/1TkAUpUxdfKGr_5Qio2SlZcnBu_sgnZWdoVTZuD_…>. > If you then wish to edit the PeerPoint document you will need to join this > Next Net Group. > > In the near future we will have a PeerPoint repository and wiki at GitHub. > > Poor Richard > > > <https://groups.google.com/d/msg/building-a-distributed-decentralized-intern…> > > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] Drones y Mixico
by Gregory Foster 06 Jul '18

06 Jul '18

The Mexico Federal Police parade their drones: https://twitter.com/EstadoMayor_MX/status/247392289574486017/photo/1 Worth remembering that a contingent of the Mexico Federal Police (FP) ambushed an American embassy vehicle carrying two CIA operatives a few weeks ago. It's been suggested that the FP are well infiltrated by the drug cartels: http://www.reuters.com/article/2012/08/30/us-mexico-shooting-idUSBRE87S19K2… Congressional Unmanned Systems Caucus Co-Chair Henry Cuellar (D-TX) suggested "using UAS to help Mexico fight drug cartels" at the Congressional Unmanned Systems Caucus Technology & Science Fair this past week: https://twitter.com/AUVSI/status/246272339183009793 Congressman Cuellar's brother happens to be the Sheriff of Laredo, which is situated on the Texas border with Mexico. The Cuellars hosted a demonstration of the Vanguard Defense Industries Shadowhawk in July. http://www.texasobserver.org/lalinea/now-laredo-wants-a-drone-too Montgomery County-based Vanguard is the only company I've observed that is actively working on a less-lethal weapons package for domestic use of their drone. That came to light after Montgomery County Sheriffs acquired a $300K Shadowhawk through a federal grant. According to the Texas Observer article, the name of that grant program is Operation Stonegarden (OPSG). http://www.fema.gov/fy-2012-homeland-security-grant-program#3 OPSG is funded to the tune of $46M in FY2012, down from $60M in 2009, and is part of the $831M FY2012 Homeland Security Grant Program: http://www.fema.gov/pdf/government/grant/2012/fy12_hsgp_foa.pdf gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Question regarding common modulus on elliptic curve cryptosystems AND E-CASH
by Sergio Lerner 06 Jul '18

06 Jul '18

I've read some papers, not that much. But I don't mind reinventing the wheel, as long as the new protocol is simpler to explain. Reading the literature, I couldn't find a e-cash protocol which : - Hides the destination / source of payments. - Hides the amount of money transferred. - Hides the account balance of each person from the bank. - Allows off-line payments. - Avoids giving the same "bill" to two different people by design. This means that the protocol does not need to detect the use of cloned "bills". - Gives each person a cryptographic proof of owning the money they have in case of dispute. I someone points me out a protocol that manages to fulfill this requirements, I'd be delighted. I think I can do it with a commutative signing primitive, and a special zero-proof of knowledge. Regards, Sergio Lerner. On 22/03/2010 10:25 a.m., Jonathan Katz wrote: >That paper was from 1980. A few things have changed since then. =) > >In any case, my point still stands: what you actually want is some >e-cash system with some special properties. Commutative encryption is >neither necessary nor (probably) sufficient for what you want. Have >you at least looked at the literature (which must be well over 100 >papers) on e-cash? > >On Mon, 22 Mar 2010, Sergio Lerner wrote: > >>Commutativity is a beautiful and powerful property. See "On the power >>of Commutativity in Cryptography" by Adi Shamir. >>Semantic security is great and has given a new provable sense of >>security, but commutative building blocks can be combined to build >>the strangest protocols without going into deep mathematics, are >>better suited for teaching crypto and for high-level protocol design. >>They are like the "Lego" blocks of cryptography! >> >>Now I'm working on an new untraceable e-cash protocol which has some >>additional properties. And I'm searching for a secure commutable >>signing primitive. >> >>Best regards, >>Sergio Lerner. >> >> >>On 22/03/2010 09:56 a.m., Jonathan Katz wrote: >>>Sounds like a bad idea -- at a minimum, your encryption will be >>>deterministic. >>> >>>What are you actually trying to achieve? Usually once you understand >>>that, you can find a protocol solving your problem already in the >>>crypto literature. >>> >>>On Sun, 21 Mar 2010, Sergio Lerner wrote: >>> >>>> >>>>I looking for a public-key cryptosystem that allows commutation of >>>>the operations of encription/decryption for different users keys >>>>( Ek(Es(m)) = Es(Ek(m)) ). >>>>I haven't found a simple cryptosystem in Zp or Z/nZ. >>>> >>>>I think the solution may be something like the RSA analogs in >>>>elliptic curves. Maybe a scheme that allows the use of a common >>>>modulus for all users (RSA does not). >>>>I've read on some factoring-based cryptosystem (like Meyer-Muller >>>>or Koyama-Maurer-Okamoto-Vantone) but the cryptosystem authors say >>>>nothing about the possibility of using a common modulus, neither >>>>for good nor for bad. >>>> >>>>Anyone has a deeper knowledge on this crypto to help me? --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Question regarding common modulus on elliptic curve cryptosystems AND E-CASH
by Sergio Lerner 06 Jul '18

06 Jul '18

I've read some papers, not that much. But I don't mind reinventing the wheel, as long as the new protocol is simpler to explain. Reading the literature, I couldn't find a e-cash protocol which : - Hides the destination / source of payments. - Hides the amount of money transferred. - Hides the account balance of each person from the bank. - Allows off-line payments. - Avoids giving the same "bill" to two different people by design. This means that the protocol does not need to detect the use of cloned "bills". - Gives each person a cryptographic proof of owning the money they have in case of dispute. I someone points me out a protocol that manages to fulfill this requirements, I'd be delighted. I think I can do it with a commutative signing primitive, and a special zero-proof of knowledge. Regards, Sergio Lerner. On 22/03/2010 10:25 a.m., Jonathan Katz wrote: >That paper was from 1980. A few things have changed since then. =) > >In any case, my point still stands: what you actually want is some >e-cash system with some special properties. Commutative encryption is >neither necessary nor (probably) sufficient for what you want. Have >you at least looked at the literature (which must be well over 100 >papers) on e-cash? > >On Mon, 22 Mar 2010, Sergio Lerner wrote: > >>Commutativity is a beautiful and powerful property. See "On the power >>of Commutativity in Cryptography" by Adi Shamir. >>Semantic security is great and has given a new provable sense of >>security, but commutative building blocks can be combined to build >>the strangest protocols without going into deep mathematics, are >>better suited for teaching crypto and for high-level protocol design. >>They are like the "Lego" blocks of cryptography! >> >>Now I'm working on an new untraceable e-cash protocol which has some >>additional properties. And I'm searching for a secure commutable >>signing primitive. >> >>Best regards, >>Sergio Lerner. >> >> >>On 22/03/2010 09:56 a.m., Jonathan Katz wrote: >>>Sounds like a bad idea -- at a minimum, your encryption will be >>>deterministic. >>> >>>What are you actually trying to achieve? Usually once you understand >>>that, you can find a protocol solving your problem already in the >>>crypto literature. >>> >>>On Sun, 21 Mar 2010, Sergio Lerner wrote: >>> >>>> >>>>I looking for a public-key cryptosystem that allows commutation of >>>>the operations of encription/decryption for different users keys >>>>( Ek(Es(m)) = Es(Ek(m)) ). >>>>I haven't found a simple cryptosystem in Zp or Z/nZ. >>>> >>>>I think the solution may be something like the RSA analogs in >>>>elliptic curves. Maybe a scheme that allows the use of a common >>>>modulus for all users (RSA does not). >>>>I've read on some factoring-based cryptosystem (like Meyer-Muller >>>>or Koyama-Maurer-Okamoto-Vantone) but the cryptosystem authors say >>>>nothing about the possibility of using a common modulus, neither >>>>for good nor for bad. >>>> >>>>Anyone has a deeper knowledge on this crypto to help me? --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: how bad is IPETEE?
by Ivan KrstiD 06 Jul '18

06 Jul '18

On Jul 15, 2008, at 6:33 PM, Leichter, Jerry wrote: >www.educatedguesswork.org/moveabletype/archives/2008/07/ipetee.html There's a typo in the link; the correct one is: <http://www.educatedguesswork.org/movabletype/archives/2008/07/ipetee.html > There's also a followup: <http://www.educatedguesswork.org/movabletype/archives/2008/07/more_on_ipete… > -- Ivan KrstiD <krstic(a)solarsail.hcs.harvard.edu> | http://radian.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: how bad is IPETEE?
by Ivan KrstiD 06 Jul '18

06 Jul '18

On Jul 15, 2008, at 6:33 PM, Leichter, Jerry wrote: >www.educatedguesswork.org/moveabletype/archives/2008/07/ipetee.html There's a typo in the link; the correct one is: <http://www.educatedguesswork.org/movabletype/archives/2008/07/ipetee.html > There's also a followup: <http://www.educatedguesswork.org/movabletype/archives/2008/07/more_on_ipete… > -- Ivan KrstiD <krstic(a)solarsail.hcs.harvard.edu> | http://radian.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

<nettime> Richard Waters: Counter-terrorism (tech)tools used to spot fraud at JPMorgan (FT)
by Patrice Riemens 06 Jul '18

06 Jul '18

Convergence, anyone? Original to: http://www.ft.com/intl/cms/s/0/796b412a-4513-11e2-838f-00144feabdc0.html#ax… Counter-terrorism tools used to spot fraud By Richard Waters in London (Dec 13, 2012) JPMorgan Chase has turned to technology used for countering terrorism to spot fraud risk among its own employees and to tackle problems such as deciding how much to charge when selling property behind troubled mortgages. The technology involves crunching vast amounts of data to identify hard-to-detect patterns in markets or individual behaviour that could reveal risks or openings to make money. Other banks are also turning to b big datab, the name given to using large bodies of information, to identify potential rogue traders who might land them with massive losses, according to experts in the field. b Theybre trying to mine not just trading data, but also emails [and] phone calls,b said David Wallace, an executive at SAS, a US data analysis company. b Theybre trying to find the needle in the haystack.b Guy Chiarello, JPMorganbs chief information officer, said the bank was mining massive bodies of data in b a couple of dozen projectsb that promised to have a significant effect on its business, although he refused to give further details. According to three people familiar with its activities, JPMorgan has used Palantir Technologies, a Silicon Valley company whose technology was honed while working for the US intelligence services, for part of its effort. It first used the technology to spot fraudsters trying to hack into client accounts or ATMs, but has recently started to turn it on its own 250,000-strong staff. In another aspect of its big data work, the bank is drawing on large amounts of highly diverse information about local economies where it has troubled real estate loans, two of these people said. The information is being used to set prices for property sold before a loan goes into default, in an attempt to reduce the social disruption caused by the troubled loans. Other technology companies are also finding new purposes for number-crunching techniques used in intelligence to bring new data-intensive approaches to risk management, credit assessment and marketing activities. Quantifind, a tech start-up that has worked with the CIA to identify aliases used by terrorists, was called in by JPMorgan to explain how its technology could be applied to its credit card business, said Ari Tuchman, chief executive. Some of the same technologies revolutionising risk-management in banks, meanwhile, are being used to break down barriers in the financial services business and let start-ups compete head-on with large institutions. Larry Summers, former US Treasury secretary, predicted that this would lead to a wave of new technology-based companies in the consumer lending and investment fields. b Webve had a generation where financial innovation was found in large institutions for the benefit of large pools of capital,b he told the FT. b I think the next generation of innovation will be more for consumers.b Mr Summers on Thursday joined the board of Lending Club, a Silicon Valley start-up that lets individuals invest directly in pools of consumer loans it generates over the internet. The company has been able to take a large slice out of the funding and operating costs of a traditional bank and offer better terms to borrowers and lenders, said RenaudLaPlanche, Lending Clubbs chief executive. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Azerbaijan wants to register mobile phones
by Katrin Verclas 06 Jul '18

06 Jul '18

A few thoughts from here, HQ of SaferMobile: 1. SIM Card Reg Eric says: > the question of whether a SIM was purchased anonymously may be relatively > irrelevant. Many countries already require all SIMs to be identified with an > individual (say, Burma, Belarus, most EU countries (certainly France), or (I > think) the US). (China has, since October 2010, required SIM sales to be > identified with a person, but the rulebs observed in the breach.) We did, for the first time ever that we are aware of, a comprehensive assessment of SIM card registration requirements for the 47 least free countries and 63 partially countries as defined by Freedom House's Freedom of the World Index. 45 out of the 47 countries require a combination of ID, photo, and fingerprint to activate a SIM card. Of course, it is possible to get a 'gray' card in those countries which may work for a while without being ID'ed with your identity. Of course, Eric's precautions are all still valid - more on that below. As far as the regulatory context of AZ is concerned, here is what we got (all of this is going live, by the way, in the next week or so) 4 Azerbaijan Ministry of Communications and Information Technologies of the Republic of Azerbaijan http://www.mincom.gov.az/en/main.html http://www.mincom.gov.az/en/telecom.html The Law of the Republic of Azerbaijan on Telecommunications was enacted in 2005. It sets out general legal framework for telecommunication networks and services, and includes provisions on numbering, licensing, tariffs, interconnection, rights and duties of operators and subscribers, international cooperation and dispute resolution. What provisions, if any, are contained in the telecommunications regulations regarding the government's ability to conduct surveillance or monitoring of mobile technology? There are no explicit provisions authorizing surveillance. However, article 39 of the Law of the Republic of Azerbaijan on Telecommunications states that operators "must promote in proper legal manner implementation of search actions, supply telecommunication [networks] with extra technical devices according to terms set by corresponding executive power body for this goal, solve organizational issues and keep methods used in implementation of these actions as secret." Article 38 states that the law guarantees confidentiality of communication except as provided by law. What provisions are contained in the law regarding the government's ability to request disclosure of subscriber information? To the extent allowed by the vagueness of article 39. Are there any emergency or national security laws that allow the government to gain control of mobile network (e.g. suspend network, conduct interception, etc)? Article 16 entitles the government during times of martial law and state of emergency "to preference in use of necessary telecommunication nets, units and means and can stop, limit their use or apply special rules for use of communication." New rules require all operational mobile devices (cell phones) in the territory of Azerbaijan to be registered at Mobile Devices Registration System (MDRS). MDRS is not ready yet and is to be set up by the Ministry of Communication and IT. All cell phone carriers will have to connect their networks to MDRS. Information required for the system will include cell phone's IMEI code, a number associated with that phone and serial number of the SIM card. A cell phone will work only with a number associated with it and registered at MDRS. Otherwise, cell phone operators will have to block it.In practice, it means the government will be able to switch off every phone in the country. Are there any restrictions on encryption, including on VoIP? Is encryption allowed or forbidden? The telecom law does not specify any restrictions on encryption. VoIP service is considered a form of communication and requires a license (source: http://news.day.az/hitech/69561.html) Is there intermediary liability for content distributed over the network? Internet is considered "mass media" under Azerbaijan law and is governed by the 1999 legislation "On mass media." Under that law a publisher may face liability for publishing information which incites "violent overthrow of an existing constitutional state formation, attempt on integrity of the state, propagation of war, violence and cruelty, national, racial, social hate or intolerance, printing under cover of a title of an authoritative source of hearings, lie also of prejudiced publications humiliating honor and a dignity of the citizens, pornographic materials, slander or undertaking of other unlawful operating." (Full text of the law is available at: http://www.mincom.gov.az/en/main.html, under legal documents/laws). Is the operator's ability to provide services in the region conditioned on disclosure of subscriber information in any way? Article 39 of the telecom law requires cooperation of the telecommunications sector with law enforcement. Has there been a revocation or threat to revoke a license, if so, why? No instances found. Are there any provisions in the licensing agreement explicitly authorizing interception or surveillance? To the extent allowed by article 39 2. Mobile security While I could not agree more with Eric on all he is saying below, but that said, fact is activists, rights defenders and journalists DO use phones, even though they pose considerable risks. From our POV, it's a matter or risk awareness and mitigation, based on specific threat models rather than categorically saying: Don't use phones. Ain't going to happen so we rather work with reality here. By the way, the US does not require any ID for prepaid SIMs for now. These are the burner SIMs/phones we all hold dear.... and pay for in cash. With all of Eric's caveats on location, IMEI, SIM etc tracking and logging. All the best, Katrin On Jan 9, 2012, at 10:16 AM, Katy Pearce ucsb wrote: > Thanks Eric. > > Will pass this to Ali. > > Actually we find that there is cybersurveillance (documented in the > paper that was linked to above) in Azerbaijan. > > I would expect the AZ government to use this new law to engage in more > cybersurveillance... > > On Sun, Jan 8, 2012 at 5:53 AM, Eric S Johnson <crates(a)oneotaslopes.org> wrote: >> Within the context of our technology mentoring in the ISC, we advise folks >> in b riskyb countries that mobile phones are, everywhere and always, a very >> high security risk. To the extent that contemporary software used by law >> enforcement agencies with access to MNOsb log files can relatively easily >> >> B7 know all (turned-on) mobile devices (phones, SIMs)b locations at >> all times, now and in the past, >> >> B7 store, read, and analyse all SMSs ever sent, and >> >> B7 enumerate identities and networks of people by looking at whobs >> talking to whom, >> >> the question of whether a SIM was purchased anonymously may be relatively >> irrelevant. Many countries already require all SIMs to be identified with an >> individual (say, Burma, Belarus, most EU countries (certainly France), or (I >> think) the US). (China has, since October 2010, required SIM sales to be >> identified with a person, but the rulebs observed in the breach.) >> >> >> >> And, to the extent that all MNOsb operation depends on frequency licensing >> from the governments in whose jurisdiction they operate, all MNOs are, by >> definition, totally under those governmentsb control, and will in any case >> eavesdrop on, and/or terminate, any and all clientsb use of their networks, >> upon govbt demand. >> >> >> >> We think the key is to encourage folks to use internet instead of >> calls/SMSs, and to help make sure folksb internet use is, to the maximum >> extent possible, encrypted. Certainly, thatbs my modus operandii when in >> Azerbaijan, Burma, China, or Uzbekistan (all of which Ibve visited in the >> last six months). >> >> >> >> Katy, do you (or Ali) think the new AZ regulation will really materially >> change the degree of risk associated with activistsb use of mobile >> communications technologies? The key issue is probably more one of whether >> the govbt of AZ is using the kinds of the software mentioned above, rather >> than whether SIMs can be procured anonymously. >> >> >> >> For the record, AFAIK, AZ doesnbt censor internet access at all, nor are >> there well-documented cases of cybersurveillance (although activists should >> always assume attempts are being made). However, starting in the second half >> of 2011, major independent Azerbaijani news-providing sites have found >> themselves under occasional DDOS attacks. >> >> >> >> Best, >> >> Eric >> >> >> >> From: liberationtech-bounces(a)lists.stanford.edu >> [mailto:liberationtech-bounces@lists.stanford.edu] On Behalf Of Katy Pearce >> ucsb >> Sent: Saturday, 07 January 2012 02:29 >> To: liberationtech(a)lists.stanford.edu >> Subject: [liberationtech] Azerbaijan wants to register mobile phones >> >> >> >> http://blog.novruzov.az/2012/01/azerbaijan-to-register-all-mobile.html >> >> Blogger (and friend) Ali Zovruzov has translated a new law in Azerbaijan >> where all mobile phones will be registered to the government and the >> government will have the potential to shut off mobile communication. >> >> The measure bypassed the parliament and was approved directly by the Council >> of Ministers (which is sort of like the president's cabinet). >> >> On his blog some commenters don't think that this is a big deal, but... >> >> For some Azerbaijan context - it has been becoming more authoritarian and >> using technology to aid that: >> http://caucasusedition.net/analysis/%E2%80%9Cthis-is-what-can-happen-to-you… >> >> >> _______________________________________________ >> liberationtech mailing list >> liberationtech(a)lists.stanford.edu >> >> Should you need to change your subscription options, please go to: >> >> https://mailman.stanford.edu/mailman/listinfo/liberationtech >> >> If you would like to receive a daily digest, click "yes" (once you click >> above) next to "would you like to receive list mail batched in a daily >> digest?" >> >> You will need the user name and password you receive from the list moderator >> in monthly reminders. >> >> Should you need immediate assistance, please contact the list moderator. >> >> Please don't forget to follow us on http://twitter.com/#!/Liberationtech > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech Katrin Verclas MobileActive.org katrin(a)mobileactive.org skype/twitter: katrinskaya (347) 281-7191 Check out the new Mobile Media Toolkit at http://mobilemediatoolkit.org. To "Making Media Mobile!" A global network of people using mobile technology for social impact http://mobileactive.org _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0