- cypherpunks-legacy - lists.cpunks.org

FEC May Tighten Restrictions On Internet Political Activity
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://www.drudgereport.com/flash3fec.htm> The Drudge Report FEC May Tighten Restrictions On Internet Political Activity Mon Feb 14 2005 10:38:41 ET The Federal Election Commission next month will begin looking at tightening restrictions on political activities on the Internet, ROLL CALL reports Monday. The FEC is planning to examine the question of how Internet activities, when coordinated with candidates' campaigns, fit into the definition of 'public communications. Specifically, the FEC is planning to examine the question of how Internet activities, when coordinated with candidates' campaigns, fit into the definition of "public communications." While coordinated communications are considered campaign contributions and therefore subject to strict contribution limits, current FEC regulations adopted in 2002 carve out an exemption for coordinated political communications that are transmitted over the Internet. Developing... -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

J.P. Morgan Paying $2.1M in Settlement
by R.A. Hettinga 15 Feb '05

15 Feb '05

<http://www.forbes.com/home/feeds/ap/2005/02/14/ap1826161.html> Forbes Associated Press Update 1: J.P. Morgan Paying $2.1M in Settlement 02.14.2005, 06:02 PM The securities arm of J.P. Morgan Chase & Co. has agreed to pay $2.1 million to settle regulators' charges that it failed to preserve e-mails sought by the authorities in their 2002-2003 investigation of alleged conflicts of interest at Wall Street investment houses. J.P. Morgan Securities Inc. is paying $700,000 in civil fines in each of three separate settlements with the Securities and Exchange Commission, the New York Stock Exchange and the National Association of Securities Dealers, which is the brokerage industry's self-policing organization. The investment firm neither admitted nor denied the allegations of violating record-keeping rules. J.P. Morgan spokesmen declined comment. J.P. Morgan was among ten of Wall Street's biggest firms that paid a total $1.4 billion and adopted reforms as a result of the investigation, in which regulators found that they issued biased ratings on stocks to lure investment-banking business. J.P. Morgan's share of the industrywide settlement, reached in April 2003, was $80 million. In the course of the investigation, begun in April 2002, J.P. Morgan told the regulators that all the relevant e-mails had been provided, the SEC said. In fact, the agency, said, the firm's systems and procedures for retaining e-mails "were inadequate to ensure that all electronic communications relating to (its) business were preserved for three years and for the first two years in an easily accessible place" as required by the rules. Companies' retention of internal documents took on new importance after the Enron scandal, in which key papers were shredded, and the landmark anti-fraud law enacted in July 2002 created new penalties for document destruction. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Don't Trust Your Eyes or URLs (was Re: TidBITS#766/14-Feb-05)
by R.A. Hettinga 15 Feb '05

15 Feb '05

At 6:21 PM -0800 2/14/05, TidBITS Editors wrote: >Don't Trust Your Eyes or URLs >----------------------------- > by Glenn Fleishman <glenn(a)tidbits.com> > > The clever folks at the Shmoo Group, a bunch of interesting > security folks who punch holes in assumptions about what's > secure on the Internet, have discovered a simple way to fool > most browsers into believing that they've connected to a secure > Web site when they've been spoofed into connecting to a rogue > location with a different name. It's ironic, but Internet Explorer > is entirely exempt from this spoof. Opera, Safari and KHTML-based > browsers, and all Mozilla and Firefox browsers suffer from this > weakness on all platforms. > ><http://www.shmoo.com/> ><http://www.shmoo.com/idn/homograph.txt> > > In brief, the Shmoos found that a poorly implemented method > of allowing international language encoding within domain names, > called International Domain Name (IDN) support, allows a malicious > party to display what appears to be one domain name in the > Location field of a browser while connecting you to another. > Phishing scams have just become more difficult to identify. > > This exploit is made possible by a system called "punycode," > which has been widely adopted according to the Shmoo Group. > Domain names that use characters outside of unaccented Western > alphabet letters via Unicode/UTF-8 are converted into a string > of Roman letters (see Matt Neuburg's "Two Bytes of the Cherry: > Unicode and Mac OS X" for more information on Unicode). This > conversion isn't a problem, per se: it means that domain names > outside of the English character set can be used freely without > confusing browsers and can be registered using simple English > characters for backwards compatibility within the domain naming > infrastructure. > ><http://db.tidbits.com/getbits.acgi?tbser=1217> > > The flaw is twofold: first, affected browsers display whatever the > encoded version of the character is, which might look identical to > another language's character. For instance, the Shmoos use the > Russian lower-case letter A, which is encoded as "&1072;" in UTF-8 > using decimal (base 10) notation, and displays in browsers that > support IDN as a lower-case A indistinguishable from a Roman > lowercase A. > ><http://www.fileformat.info/info/unicode/char/0430/> > > The second problem leads from the first: it's possible > to have a legitimate SSL (Secure Sockets Layer) digital > certificate for the punycode-based domain name. Thus, in > an example that the Schmoos posted for a while (now replaced), > you see "https://www.paypal.com/" in your browser URL field, > and the SSL signals are all there - you get no warnings, the > lock icon is present, and Firefox's Security tab in the Page > Info window says the Web site's identity is verified. > > Click View in that same tab in Firefox, and you'll see > the full punycode name of the Web site, however, which is > "www.xn--pypal-4ve.com". Copy the URL from the Location > field and paste it into Terminal, and you'll see the encoded > version in standard UTF-8 format, too, which looks like > "www.p&1072;ypal.com". > > I don't know that there's an easy solution to this problem. > It's the result of choice by the developers of the various > browsers to display precisely what a Unicode character looks > like, which is reasonable enough. But at the same time they > use a kludgy, opaque hack in the background to map that Unicode > character to an English character to provide full backwards > compatibility with what was once a U.S.-centric domain naming > system, one that retains substantial vestiges of that history. > > If you're a Firefox user, I recommend obtaining and installing > a utility called SpoofStick, which alerts you to what is being > called "homograph" spoofing; that is, the character or glyph looks > like another, unrelated glyph. If you visit the Shmoo site with > SpoofStick installed, you get a big lovely warning. > ><http://www.corestreet.com/spoofstick/> > > Trust has gone out the window when you follow links in email or > on Web sites. There's no longer a way to be sure that the domain > name you're visiting is the one you think you are unless you check > the URL out in Terminal or have SpoofStick installed. > > Realistically, the upshot of this situation is that you must be > even more careful about following links you receive in email to > sites that ask for sensitive information. A message that purports > to be from PayPal customer service, for instance, may look right > and even use URLs that appear to connect to PayPal's site, but > could in fact be taking you to another site designed to capture > your username and password. The likelihood of falling victim to > a spoofed URL on the Web itself is less likely, assuming you start > from a site that's a relatively trusted source. When in doubt, > fall back on common sense and check the URL by pasting suspect > URLs into Terminal to see if they're concealing any unusual > Unicode characters. Hopefully we'll see browser fixes soon: > simply displaying the full punycode-based domain name alongside > its actual representation would at least highlight what's > happening behind the scenes without interfering with navigation > or Web pages. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Making your IM secure--and deniable
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://news.com.com/2102-7355_3-5576246.html?tag=st.util.print> CNET News Making your IM secure--and deniable By Robert Lemos Story last modified Mon Feb 14 17:05:00 PST 2005 SAN FRANCISCO--When you hit the Send button on an instant message, do you really know who is on the other end? Two researchers at the University of California at Berkeley have created an add-on to instant messaging that they claim will enable the participants to identify each other and have a secure conversation without leaving any proof that the chat occurred. The result, dubbed off-the-record (OTR) messaging by security researchers Ian Goldberg and Nikita Borisov, is a plug-in for the Gaim instant-messaging client that enables encrypted messages sans leaving a key--a sequence of characters--that could be used to verify that the conversation happened. That attribute, known in cryptography as perfect forward security, also prevents snoopers from reading any copies of the conversation. "If tomorrow, my computer is broken into and the encryption key is stolen, the attacker can't read future messages," said Goldberg, a graduate of Berkeley. In order for a secure and deniable IM conversation to occur, both parties need to have the off-the-record program installed on Gaim or use America Online's Instant Messenger with a server set up to be a proxy with software also developed by Goldberg and Borisov, the researchers said. When a previously unregistered user wants to have an OTC conversation, a dialog box will appear with a digital key, identifying the sender. If the user accepts the credentials of the person contacting him, the key will be stored on his computer so that in the future, the sender is considered to be trusted. After that, the two participants can chat securely; the conversation is encoded so that others cannot intercept and read it. Goldberg and Borisov presented their program at the annual CodeCon gathering of developers Saturday. People worried about instant-messaging security can download the software from the duo's site. Goldberg said current messaging is insecure and criticized other solutions for leaving around logs and encryption keys that could be used as proof that a conversation happened. He said OTR messaging would give the participants the security without leaving any more trace of the conversation than today's instant-messaging clients--a worry for the privacy-centric security community. "I would like to see this on by default," Goldberg said. "When you chat today, the messages are going through the clear, and there is no proof of who you are talking to." While both the OTR messaging plug-ins and today's instant-messaging clients enable either participant to record logs of a conversation, those logs mean little after the conversation, Goldberg argued. The logs could be edited to add content. That's why the two researchers avoided using digital signatures, Goldberg said. That technology for encrypting messages would have also acted as a digital signature and left a signed record of the conversation. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Alleged mobsters guilty in vast Net, phone fraud
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://www.msnbc.msn.com/id/6928696/print/1/displaymode/1098/> MSNBC.com Alleged mobsters guilty in vast Net, phone fraud Mafia scheme said to have netted $659 million over 7 years By Mike Brunker Reporter MSNBC Updated: 8:22 p.m. ET Feb. 14, 2005 Writing a sudden ending to what authorities say is one of the biggest consumer fraud cases ever prosecuted, alleged members of one of New York's most notorious Mafia families pleaded guilty Monday to conspiracy and fraud charges stemming from an Internet and phone billing caper that bilked consumers out of more than $650 million. Prosecutors say the principals of the scheme, which ran from 1996 to 2003, are members of the Gambino crime family, an outfit better known for such muscle-and-blood criminal enterprises as gambling, loan sharking, protection rackets and creative bookkeeping for construction projects and garbage collection. But in this case, prosecutors said, the hoods targeted phone customers and Internet users, tricking them into responding to too-good-to-be-true offers of free porn, psychic readings, dating services and sports picks, and then putting the hurt on their pocketbooks with a series of unauthorized credit card and telephone charges. The mobsters also ripped off two federally supervised funds that subsidize rural phone companies through another billing scam. Alleged mastermind, Gambino 'capo' enter pleas Among those who entered guilty pleas Monday in U.S. District Court in Brooklyn - on the day jury selection was to have begun - were the alleged mastermind of the scheme, Richard Martino, 45, known in the New York tabloids as the "X-rated mobster," and 45-year-old Salvatore Locascio, described by authorities as a Gambino "capo," or captain. Under the plea bargain, Martino pleaded guilty to one count of conspiracy to commit mail and wire fraud and one count of extortion for forcefully trying to extract a $1 million payment from a porn industry rival. Martino faces up to 10 years in prison and agreed to forfeit $15 million under the deal. Locascio entered a guilty plea to a single count of money laundering and also faces up to 10 years in prison and forfeiture of $4.7 million. Three other alleged mob associates - Dennis Martino, brother of Richard Martino, Thomas Pugliese and Andrew Campos - pleaded guilty to a count of conspiracy to commit mail and wire fraud. A fourth man, Zev Mustafa, pleaded guilty to money laundering in connection with the scheme. Daniel Martino, Pugliese and Campos each face up to five years in prison and agreed to forfeit a total of $2.1 million, while Mustafa faces up to 10 years in prison and will forfeit $1.7 million. Prosecutors allege that Richard Martino, a Gambino "soldier," directed the scheme and paid $8 million of the proceeds directly to Locascio, the leader of his "crew," and funneled at least $40 million more into Gambino family coffers. Bank, phone company purchased The elaborate scheme brought in so much money that the defendants and various co-conspirators were able to purchase a telephone company and bank in Missouri, according to court documents. They also created at least 64 shell companies and opened a host of foreign bank accounts through which to pass their ill-gotten gains, the documents said. In an indictment returned in March 2003, prosecutors alleged a two-headed scheme: People who called 1-800 phone numbers advertising free samples of phone sex, psychic hot lines and dating services unwittingly triggered recurring monthly charges that appeared on their phone bills as "voice-mail services" and other innocuous services. At the same time, the scheme trapped Web surfers seeking adult content on the Internet by enticing them to enter their credit card information for "free" tours, only to begin billing them between $20 and $90 a month. The defendants routinely changed corporate billing names and merchant banks to stay one step ahead of authorities and foil Visa USA's fraud-detection system, according to court documents. In 1999, they began processing credit transactions in Guatemala to further muddy the waters, the documents said. Prosecutors charged that the Web sites used in the Internet scam were part of a joint venture formed in 1996 between Crescent Publishing Group Inc., a Manhattan company that published such high-profile adult magazines as Playgirl and High Society, and Lexitrans Inc. of Overland Park, Kan., a Web hosting company that they said was secretly controlled by Richard Martino. Surprise guilty pleas The surprise guilty pleas on Monday, following negotiations that lasted through the weekend, pre-empted what would have been one of the most closely watched mob trials in years. Using the power of plea bargains, prosecutors already had peeled off a number of alleged co-conspirators who were expected to testify against Martino and Locascio, including: Norman Chanes, a 58-year-old millionaire advertising executive and movie producer (co-producer of the 2000 film "Blue Moon," starring Ben Gazzara, Rita Moreno and "Sopranos" cast member Vincent Pastore), who allegedly advertised the 1-800 phone numbers used in the telephone fraud in magazines and newspapers around the country. Bruce Chew, 57, who was CEO of Crescent Publishing Co. Chew was a defendant in a Federal Trade Commission lawsuit against Crescent Publishing that led to a $30 million settlement in November 2001. Kenneth Matzdorff, a 48-year-old Missouri businessman who allegedly acted as a front man to purchase the Cass County Telephone Co. in Peculiar, Mo., and the Garden City Bank in Garden City, Mo., on behalf of Richard Martino and others. Matzdorff pleaded guilty in January to conspiracy to commit mail and wire fraud charges under a plea agreement. Another figure in the case who might have been called to testify is Carl Ruderman, a 60-something-year-old publisher and philanthropist who reportedly was the secret owner of Crescent Publishing. 'The invisible man' of porn Ruderman, dubbed "the invisible man" of porn by fellow skin magazine publisher Al Goldstein in 1989 for his low profile, was never charged with any crime, reportedly because he told authorities that he delegated responsibility for day-to-day operations of Crescent Publishing to Chew and had no knowledge of the billing scam. One former Crescent employee said that Ruderman certainly lived up to the "invisible man" sobriquet at the company's Manhattan offices. "We used to call him the Wizard of Oz, because you never saw the guy," said the employee, who spoke with MSNBC.com on condition of anonymity. "I saw him twice the whole time I worked for him." Former Gambino crime boss John Gotti Sr., forever known as the "Dapper Don," also had been expected to testify from the grave. Longtime New York newspaper crime reporter Jerry Capeci, who now publishes his work on the Ganglandnews.com Web site, said prosecutors had planned to play a tape of a wiretapped conversation from January 1990 in which Gotti sings the praises of newly minted mobsters Martino and Locascio, who had just been inducted into the Gambino family. 'I like the Richies' "I want guys that done more than killing," Capeci quotes Gotti as saying on the tape, obtained from a listening device planted in an apartment above the Ravenite Social Club in Manhattan's Little Italy. "I like the Richies. They're young - twenty-something, thirty-something -- They're beautiful guys. Ten years from now, these young guys we straightened out, they're going to be really proud of them." Gotti died in prison at the age of 61 on June 10, 2002, from complications of head and neck cancer while serving a sentence of life without parole for murder and racketeering. The criminal case was filed more than three years after the FTC announced that it had filed suit, along with the New York attorney general's office, to stop Crescent Publishing from "illegally billing thousands of consumers for services that were advertised as 'free,' and for billing other consumers who never visited the Web sites at all." The suit did not address the phone billing portion of the scam. In announcing the suit in August 2000, the FTC estimated that the "free tour Web sites" had generated income of $188 million between 1997 and October 1999, including $141 million in the first 10 months of 1999 alone. According to Luke Ford, a pioneer blogger and keen observer of the Internet porn scene, the scheme was able to roll up such huge numbers because of deals Crescent made with two Internet traffic brokers - Serge Birbrair and Yishai Habari - that resulted in millions of porn-seeking surfers a day being directed to the sites. Traffic brokers allegedly 'made millions' "Yishai and Serge made millions off the scam and escaped FTC prosecution because they only functioned as traffic brokers," Ford wrote on his Web site. Neither Birbrair nor Habari responded to e-mail requests for comment. In November 2001, the FTC announced that Crescent Publishing and the company's principal officers, Chew and David Bernstein, had agreed to pay $30 million to settle the suit. The settlement also barred the company from "charging, debiting or billing consumers" for any Web site services without first obtaining a $10 million bond that could be used "to satisfy any judgment entered against the defendants" following trial. Doug Wolfe, an FTC attorney who worked on the case, said that despite the settlement, many victims never received compensation. "Our biggest problem was we had to rely on the company's data to link individuals to cards," he said. As of late 2004, the redress center established to administer claims had issued refund checks to 189,646 accounts but had been unable to match names and credit card information for 887,793 others, he said. Wolfe said the agency never uncovered any link between Crescent and organized crime, but there were signs that this wasn't your run-of-the-mill Internet fraud case. "It certainly was unique in my experience in terms of the number of entities through which the money appeared to be moving," Wolfe told MSNBC.com. "At the same time there were some unusual legal maneuvers. Individuals on the eve of testifying would suddenly fire their lawyers and there was a general reluctance on the other side to engage in civil discovery." Phone bill 'cramming' comes under scrutiny While the Internet operation was taking a hit, the scheme in which consumers' phone bills were being improperly charged - a practice known as "cramming" - also was coming under scrutiny. Martino et al bought the Cass County Telephone Co.,or CassTel, a county telephone company in Peculiar, Mo., (pop. 2,600) with 8,000 customers, using Matzdorff as a front man and hiring him to run the company, according to the indictment. Martino also gave Matzdorff $3 million in February 2001 to buy the Garden City Bank in Garden City, Mo., for purposes of credit card processing, it said. At the same time, prosecutors say Martino also formed a billing company called USP&C to place the bogus charges on customers' phone bills and charge the credit cards of surfers who visited Crescent Publishing's porn sites. Matzdorff told prosecutors in New York that USP&C set up a call center to handle complaints from outraged customers that handled an average of 17,000 calls a week at the height of the scheme. Though USP&C billed telephone customers on behalf of numerous companies and gave varying descriptions of the services allegedly provided, the billing agent's high charge-back rate began to attract attention from phone regulators. Complaints prompted wave of refunds In 1999, the California Public Utilities Commission investigated USP&C's business conduct and found that of $51.5 million in billings to California customers over the previous 18 months, 52 percent were refunded after customers complained. The PUC eventually fined USP&C $1.75 million for improper billing, but it was never able to collect it. Estimates of the amount netted by the scam have grown steadily since the March 2003 indictment was unsealed, when prosecutors estimated that the Internet end of the operation netted $230 million while the phone scam brought in approximately $200 million in revenue. Later, federal charges filed in Kansas added $9 million to that tally, money that prosecutors said the mob-run companies stole by overbilling two federally supervised telecommunications funds - the Universal Service Administrative Co. and the National Exchange Carriers Association. But sources familiar with the case told MSNBC.com that the estimate swelled recently when prosecutors obtained more information indicating that the phone "cramming" actually generated at least $420 million, bringing the overall total to $659 million. Given the riches the Gambino family allegedly struck in what experts say apparently was its first major foray into Internet crime, it is surprising that authorities say the Crescent Publishing case is still the exception to the Cosa Nostra rule. Dave Thomas, chief of the FBI's Computer Intrusion Section, said in an interview published Nov. 29, 2004, by the trade publication Network World Fusion that there is no evidence indicating that the Mafia has moved into Internet crime in a big way. No 'big move' to Internet "We haven't seen a big move with the traditional Italian-based Mafia groups to the Internet ... not like we have with the Eastern European hacking groups," he said. "But as the money (to be made) becomes more and more widely publicized, they probably will." Capeci, the crime reporter who specializes in the mob, said there should be no doubt about that. "There's no question Locascio's crew is a bit more advanced or sophisticated than many other mob families, but the trend among the gangsters is to move away from the stuff that the law enforcement community is well aware of and to move into new things," he said. "And there's nothing they won't do if they can figure out how to do it." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

J.P. Morgan Paying $2.1M in Settlement
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://www.forbes.com/home/feeds/ap/2005/02/14/ap1826161.html> Forbes Associated Press Update 1: J.P. Morgan Paying $2.1M in Settlement 02.14.2005, 06:02 PM The securities arm of J.P. Morgan Chase & Co. has agreed to pay $2.1 million to settle regulators' charges that it failed to preserve e-mails sought by the authorities in their 2002-2003 investigation of alleged conflicts of interest at Wall Street investment houses. J.P. Morgan Securities Inc. is paying $700,000 in civil fines in each of three separate settlements with the Securities and Exchange Commission, the New York Stock Exchange and the National Association of Securities Dealers, which is the brokerage industry's self-policing organization. The investment firm neither admitted nor denied the allegations of violating record-keeping rules. J.P. Morgan spokesmen declined comment. J.P. Morgan was among ten of Wall Street's biggest firms that paid a total $1.4 billion and adopted reforms as a result of the investigation, in which regulators found that they issued biased ratings on stocks to lure investment-banking business. J.P. Morgan's share of the industrywide settlement, reached in April 2003, was $80 million. In the course of the investigation, begun in April 2002, J.P. Morgan told the regulators that all the relevant e-mails had been provided, the SEC said. In fact, the agency, said, the firm's systems and procedures for retaining e-mails "were inadequate to ensure that all electronic communications relating to (its) business were preserved for three years and for the first two years in an easily accessible place" as required by the rules. Companies' retention of internal documents took on new importance after the Enron scandal, in which key papers were shredded, and the landmark anti-fraud law enacted in July 2002 created new penalties for document destruction. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

FEC May Tighten Restrictions On Internet Political Activity
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://www.drudgereport.com/flash3fec.htm> The Drudge Report FEC May Tighten Restrictions On Internet Political Activity Mon Feb 14 2005 10:38:41 ET The Federal Election Commission next month will begin looking at tightening restrictions on political activities on the Internet, ROLL CALL reports Monday. The FEC is planning to examine the question of how Internet activities, when coordinated with candidates' campaigns, fit into the definition of 'public communications. Specifically, the FEC is planning to examine the question of how Internet activities, when coordinated with candidates' campaigns, fit into the definition of "public communications." While coordinated communications are considered campaign contributions and therefore subject to strict contribution limits, current FEC regulations adopted in 2002 carve out an exemption for coordinated political communications that are transmitted over the Internet. Developing... -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

NSA May Be 'Traffic Cop' for U.S. Networks
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://www.kansascity.com/mld/kansascity/news/politics/10898954.htm?templat…> Posted on Mon, Feb. 14, 2005 NSA May Be 'Traffic Cop' for U.S. Networks TED BRIDIS Associated Press WASHINGTON - The Bush administration is considering making the National Security Agency - famous for eavesdropping and code breaking - its "traffic cop" for ambitious plans to share homeland security information across government computer networks, a senior NSA official says. Such a decision would expand NSA's responsibility to help defend the complex network of data pipelines carrying warnings and other sensitive information. It would also require significantly more money for the ultra-secret spy agency. The NSA's director for information assurance, Daniel G. Wolf, was expected to outline his agency's potential role during a speech Wednesday at the RSA technology conference in San Francisco. In an interview preceding his speech, Wolf told The Associated Press that computer networks at U.S. organizations are like medieval castles, each protected by different-size walls and moats. As the U.S. government moves increasingly to share sensitive security information across agencies, weaknesses inside one department can become opportunities for outsiders to penetrate the entire system, Wolf warned. Attackers could steal sensitive information or deliberately spread false information. "If someone isn't working on being a traffic cop, giving guidance on how secure they need to be, a risk that is taken by one castle is really shared by other castles," Wolf said. "Who's defining the standards? Who says how high the walls should be?" The NSA already helps protect systems deemed vital to the nation's security, such as those involved in intelligence, cryptography and weapons. Wolf said the administration is considering whether to designate its fledgling information-sharing efforts also under the NSA's purview. The White House Office of Management and Budget currently directs efforts by civilian agencies to secure their computer networks. The NSA's information security programs are highly regarded among experts. "Bring it on. This clearly ought to be done," said Paul Kurtz, a former White House cybersecurity adviser and head of the Washington-based Cyber Security Industry Alliance, a trade group. "This will raise the bar across the federal government to a far more secure infrastructure." Congress has directed the NSA and the Department of Homeland Security to study the architecture and policies of computers for sharing sensitive homeland security information. In the latest blueprint for U.S. intelligence spending, lawmakers warned that attackers always search for weak links and that connecting distant systems "will further increase the vulnerability of networks that originally were developed to be susbstantially isolated from one another." It's unclear how the NSA's efforts would affect private companies, which own and operate many of the electrical, water, banking and other systems vital to government. Wolf said the agency already works to secure such systems important to military installations, but he denied that NSA would have any new regulatory authority over private computers. "When we talk about being the traffic cop, we're not in charge of these networks," Wolf said. "We're not running these networks." It also was unclear how much the effort might cost. "If you're going to have a network that everyone in government can get into, that means some agencies are going to have to come up to meet new, higher standards, and that's expensive," said James Lewis, director of technology policy at the Center for Strategic and International Studies, a conservative think-tank. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Certicom and Beep Science Partner to Provide Advanced Security for Digital Rights Management
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://biz.yahoo.com/prnews/050214/to126_2.html?printer=1> Yahoo! Finance Press Release Source: Certicom Corp. Certicom and Beep Science Partner to Provide Advanced Security for Digital Rights Management Monday February 14, 7:00 am ET Device manufacturers can implement DRM as part of overall Certicom Security Architecture MISSISSAUGA, ON and OSLO, Norway, Feb. 14 /PRNewswire-FirstCall/ - Certicom Corp. (TSX: CIC - News), the authority for strong, efficient cryptography, and Beep Science, a leading provider of Open Standard DRM technology, today announced a partnership agreement to enable Certicom to integrate and resell Beep Science's digital rights management (DRM) software solution. The move supports Certicom's objective to provide a comprehensive, integrated security platform that addresses the evolving needs of device manufacturers. The robust and secure OMA DRM v2 Agent from Beep Science will become part of the Certicom Security Architecture, which consists of a modular set of security protocol toolkits and software cryptographic providers that are unified by a single, intuitive application programming interface. The Beep Science DRM solution (client- and server-side) is fully compliant with the digital rights management standard from the Open Mobile Alliance (OMA) and supports the distribution of high value content to a wide spectrum of devices, including multimedia capable mobile phones, handheld devices, consumer electronic devices, and set-top boxes. "Certicom is uniquely positioned to address the evolving security needs of device manufacturers. Our focus on strong security, our experience with resource-constrained devices, and now our partnership with Beep Science, the DRM expert, combine to make a powerful offering," said Jim Alfred, director of product management at Certicom. "As devices become more complex, coordinated efforts, such as our partnership with Beep Science, become critical to helping device manufacturers meet the evolving needs of their customers." "For device manufacturers to succeed, they need to consider security at the design stage. It's for this reason that we have chosen to partner with Certicom, a leader and experienced player in embedded security. By working with Certicom, our DRM technology becomes part of comprehensive security architecture," said Markku Mehtala, VP business development at Beep Science. "This agreement represents new opportunities for both companies and a complete solution for device manufacturers." To learn more about the partnership please visit Beep Science at 3GSM World Congress in Cannes, France (stand J5&6 Hall 3,) and Certicom at RSA Conference 2005 in San Francisco (booth No. 430). About Beep Science Beep Science is a leading provider of client and server side Digital Rights Management (DRM) software solutions fully compliant with the Industry Standard from Open Mobile Alliance (OMA). The Beep Science OMA v2 DRM client product for device manufacturers and media player vendors is a total solution that applies to the strict performance and robustness requirements while providing flexible business models and enhanced end-user experience. The Beep Science OMA DRM Server integrates with existing service delivery infrastructure and automates the content protection and license management for digital content providers. The company represents one of the largest specialist resource centers within the field of Mobile Digital Rights Management and has world-class brands as customers. Visit www.beepscience.com About Certicom Certicom Corp. (TSX: CIC - News) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and Unisys. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit www.certicom.com. Certicom, Certicom Security Architecture, Certicom CodeSign, Security Builder, Security Builder Middleware, Security Builder API, Security Builder Crypto, Security Builder SSL, Security Builder PKI, Security Builder NSE and Security Builder GSE are trademarks or registered trademarks of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Team Building?? WIMPS!!
by Tyler Durden 14 Feb '05

14 Feb '05

Well, I didn't say it would be easy. We'd definitely need to split up into teams...one to handle the alarm systems, one to handle the landmines, one to somehow fend off May's bullets. And then, even if we somehow capture May, I'd bet he's got all sorts of dead-man stuff like poison gas and whatnot. It'd be like a big game of D&D, not that any Cypehrpunk knows what THAT is! And yeah, there's a good chance someone's not gonna make it. But think of it like this: Those genes were slowing down our species anyway. The only problem is, what do we do once we're in? Throw a big-ass drinking, whoring Shriners-like party? (I say we need a bevvy of black hookers.) Break into May's survivalist supplies? Oh, and we DEFINITELY need video. -TD >From: joe cypherpunk <cypherpunk(a)rxcbc.org> >To: Tyler Durden <camera_lumina(a)hotmail.com>, >cypherpunks-moderated-request(a)minder.net >Subject: Team Building?? WIMPS!! Re: RSA Conference, and BA Cypherpunks >Date: Wed, 09 Feb 2005 17:36:13 -0800 > >Not unless you wish to meet YahWah , Allah, Jesus,Buddha(pick your favorite >deity!) early :) > >Tim is a VERY GOOD shot and the property is watched and alarmed. > > > so My opinion Tyler? > Feel free to win Darwins Award!!.. > > A cypherpunk > >ps. Tim has an Excellent Taxidermist, Your pelt and head will be displayed >in grand fashion:) > > >BTW a spell checker would be a good gift to yourself(think about >thunderbird) > > > ie "Cypherpunk 'team-building' excersize? " > >psps let me know when you plan to try so I can shoot live video of the >Firefight, should be worth at least 1k to the local TV stations :) > >also think about a vest of tubes of tannerite(exploding targets), that way >when Tim scores, the viewers of the video will know you have been hit!! > > > think of it as evolution in action > > > > > >Tyler Durden wrote: > >>How 'bout laying siege to May's compound as a Cypherpunk 'team-building' >>excersize? >> >>-TD >> >> >> >>>From: "J.A. Terranson" <measl(a)mfn.org> >>>To: "Trei, Peter" <ptrei(a)rsasecurity.com> >>>CC: cypherpunks(a)al-qaeda.net, cryptography(a)metzdowd.com >>>Subject: Re: RSA Conference, and BA Cypherpunks >>>Date: Mon, 7 Feb 2005 17:19:30 -0600 (CST) >>> >>>On Mon, 7 Feb 2005, Trei, Peter wrote: >>> >>> > Once again, the RSA Conference is upon us, and many of the >>> > corrospondents on these lists will be in San Francisco. I'd like to >>> > see if anyone is interested in getting together. We've done this >>> > before. >>> >>>Yeah, but can we eat food, drink beer, shoot drugs and screw expensive >>>hookers at Tim May's "compound"? >>> >>> >>>-- >>>Yours, >>> >>>J.A. Terranson >>>sysadmin(a)mfn.org >>>0xBD4A95BF >>> >>>"Quadriplegics think before they write stupid pointless >>>shit...because they have to type everything with their noses." >>> >>> http://www.tshirthell.com/

4 4