- cypherpunks-legacy - lists.cpunks.org

From high-tech driver's licenses to national ID cards?
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://news.com.com/2102-1028_3-5573414.html?tag=st.util.print> CNET News From high-tech driver's licenses to national ID cards? By Declan McCullagh Story last modified Mon Feb 14 04:00:00 PST 2005 A recent vote in Congress endorsing standardized, electronically readable driver's licenses has raised fears about whether the proposal would usher in what amounts to a national ID card. In a vote that largely divided along party lines, the U.S. House of Representatives approved a Republican-backed measure that would compel states to design their driver's licenses by 2008 to comply with federal antiterrorist standards. Federal employees would reject licenses or identity cards that don't comply, which could curb Americans' access to everything from airplanes to national parks and some courthouses. The congressional maneuvering takes place as governments are growing more interested in implanting technology in ID cards to make them smarter and more secure. The U.S. State Department soon will begin issuing passports with radio frequency identification, or RFID, chips embedded in them, and Virginia may become the first state to glue RFID tags into all its driver's licenses. News.context What's new: A recent vote in Congress endorsing standardized, electronically readable driver's licenses has raised fears about whether the proposal would usher in what amounts to a national ID card. Bottom line:Proponents of the Real ID Act say it's needed to frustrate both terrorists and illegal immigrants. Critics say it imposes more requirements for identity documents on states, and gives the Department of Homeland Security carte blanche to do nearly anything else "to protect the national security interests of the United States." More stories on privacy and national security "Supporters claim it is not a national ID because it is voluntary," Rep. Ron Paul of Texas, one of the eight Republicans to object to the measure, said during the floor debate this week. "However, any state that opts out will automatically make nonpersons out of its citizens. They will not be able to fly or to take a train." Paul warned that the legislation, called the Real ID Act, gives unfettered authority to the Department of Homeland Security to design state ID cards and driver's licenses. Among the possibilities: biometric information such as retinal scans, fingerprints, DNA data and RFID tracking technology. Proponents of the Real ID Act say it adheres to the recommendations of the 9/11 Commission and is needed to frustrate both terrorists and illegal immigrants. Only a portion of the legislation regulates ID cards; the rest deals with immigration law and asylum requests. "American citizens have the right to know who is in their country, that people are who they say they are, and that the name on the driver's license is the real holder's name, not some alias," F. James Sensenbrenner, R-Wisc., said last week. "If these commonsense reforms had been in place in 2001, they would have hindered the efforts of the 9/11 terrorists, and they will go a long way toward helping us prevent another tragedy like 9/11," said House Majority Leader Tom DeLay, R-Texas. Now the Real ID Act heads to the Senate, where its future is less certain. Senate rules make it easier for politicians to derail legislation, and an aide said Friday that Sen. Patrick Leahy, the top Democrat on the Judiciary Committee, was concerned about portions of the bill. Sen. Dianne Feinstein of California, the top Democrat on a terrorism subcommittee, said "I basically support the thrust of the bill" in an e-mail to CNET News.com on Friday. "The federal government should have the ability to issue standards that all driver's licenses and identification documents should meet." "Spy-D" cards? National ID cards are nothing new, of course. Many European, Asian and South American countries require their citizens to carry such documents at all times, with legal punishments in place for people caught without them. Other nations that share the English common law tradition, including Australia and New Zealand, have rejected such schemes. A host of political, cultural and even religious concerns has prevented a national ID from being adopted in the United States, even during the tumultuous days after the Sept. 11, 2001, attacks that ushered in the Patriot Act. Conservatives and libertarians typically argue that a national ID card will increase the power of the government, and they fear the dehumanizing effects of laws enacted as a result. Civil liberties groups tend to worry about the administrative problems, the opportunities for criminal mischief, and the potential irreversibility of such a system. Some evangelical Christians have likened such a proposal to language in the Bible warning "that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name." That mark is the sign of the "end times," according to evangelical thinking, which predicts that anyone who accepts the mark will be doomed to eternal torment. Those long-standing concerns have become more pointed recently, thanks to the opportunity for greater tracking--as well as potentially greater security for ID documents--that technologies such as RFID provide. Though the Real ID act does not specify RFID or biometric technology, it requires that the Department of Homeland Security adopt "machine-readable technology" standards and provides broad discretion in how to do it. An ad hoc alliance of privacy groups and technologists recently has been fighting proposals from the International Civil Aviation Organization to require that passports and other travel documents be outfitted with biometrics and remotely readable RFID-type "contact-less integrated circuits." The ICAO, a United Nations organization, argues the measures are necessary to reduce fraud, combat terrorism and improve airline security. But its critics have raised questions about how the technology could be misused by identity thieves with RFID readers, and they say it would "promote irresponsible national behavior." In the United States, the federal government is planning to embed RFID chips in all U.S. passports and some foreign visitor's documents. The U.S. State Department is now evaluating so-called e-passport technology from eight different companies. The agency plans to select a supplier and issue the first e-passports this spring, starting in Los Angeles, and predicts that all U.S. passport agencies will be issuing them within a year. The high-tech passports are supposed to deter theft and forgeries, as well as accelerating immigration checks at airports and borders. They'll contain within their covers a miniscule microchip that stores basic data, including the passport holder's name, date of birth and place of birth. The chip, which can transmit information through a tiny included antenna, also has enough room to store biometric data such as digitized fingerprints, photographs and iris scans. Border officials can compare the information on the chip to that on the rest of the passport and to the person actually carrying it. Discrepancies could signal foul play. In a separate program, the Department of Homeland Security plans to issue RFID devices to foreign visitors that enter the country at the Mexican and Canadian borders. The agency plans to start a yearlong test of the technology in July at checkpoints in Arizona, New York and Washington state. The idea is to aid immigration officials in tracking visitors' arrivals and departures and snare those who overstay their visas. Similar to e-passports, the new system should speed up inspection procedures. It's part of the US-VISIT program, a federal initiative designed to capture and share data such as fingerprints and photographs of foreign visitors. A "Trojan horse" The legislation approved by the House last Thursday follows a related measure President Bush signed into law in December. That law gives the Transportation Department two years to devise standard rules for state licenses, requires information to be stored in "machine-readable" format, and says noncompliant ID cards won't be accepted by federal agencies. But critics fret that the new bill goes even further. It shifts authority to the Department of Homeland Security, imposes more requirements for identity documents on states, and gives the department carte blanche to do nearly anything else "to protect the national security interests of the United States." "In reality, this bill is a Trojan horse," said Paul, the Republican congressman. "It pretends to offer desperately needed border control in order to stampede Americans into sacrificing what is uniquely American: our constitutionally protected liberty." Unlike last year's measure, the Real ID Act "doesn't even mention the word 'privacy,'" said Marv Johnson, a lobbyist for the American Civil Liberties Union. "What I think the House is planning on doing is attaching this bill to tsunami relief or money to the troops," Johnson says. "When they send it to the Senate, the Senate will have to either fish or cut bait. They can approve it or ask for a conference committee, at which point the House can say 'they're playing games with national security.'" In response to a question about a national ID card, White House spokesman Scott McClellan told reporters on Friday that "the president supports the legislation that just passed the House." McClellan pointed to a statement from the White House earlier in the week that endorsed it. Another section of the Real ID Act that has raised alarms is the linking of state Department of Motor Vehicles databases, which was not part of last year's law. Among the information that must be shared: "All data fields printed on drivers' licenses and identification cards" and complete drivers' histories, including motor vehicle violations, suspensions and points on licenses. Some senators have indicated they may rewrite part of the measure once they begin deliberations. Sen. Jon Kyl, R-Ariz., chairman of a terrorism subcommittee, is readying his own bill that will be introduced within a few weeks, spokesman Andrew Wilder said on Friday. "He has been at work on his own version of things," Wilder said. "Senator Kyl does support biometric identifiers." CNET News.com's Alorie Gilbert contributed to this report. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

China shut down 12,000 Internet bars in 2004
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://uk.news.yahoo.com/050213/323/fce29.html> Yahoo! Sunday February 13, 10:35 PM China shut down 12,000 Internet bars in 2004 Click to enlarge photo BEIJING (AFP) - Chinese authorities shut down more than 12,000 Internet bars last year, state media said. As part of moves to "create a safer environment for young people," the government in 2004 closed 12,575 illegal Internet bars, 2,861 dance clubs, and 3,434 video halls, Xinhua news agency said. According to several government ministries, Chinese parents had complained that the businesses, mainly located near schools, had "severely affected students' cultural lives," it said. China has an Internet population of 87 million with about half of the web users under the age of 24. China welcomes the Internet, as it helps the economy leapfrog into the 21st century, but at the same time it is worried about the way it enables people to access information that is considered subversive. In reaction, the government has cracked down hard on Internet cafes, closing down many, and is also monitoring online traffic for content that might be deemed politically sensitive. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cryptography Research Security Experts to Speak at RSA Conference 2005
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/02-1…> Cryptography Research Security Experts to Speak at RSA Conference 2005 Company's Security Experts Chosen to Participate in Conference SAN FRANCISCO, Feb. 14 /PRNewswire/ -- RSA CONFERENCE 2005 -- Strengthening its reputation within the security industry, Cryptography Research, Inc. today detailed its participation in the RSA Conference 2005 program being held here this week in the Moscone Convention Center. Security experts Paul Kocher, Benjamin Jun, Nate Lawson and Carter Laren are scheduled to speak in various lecture sessions and panel discussions over the course of the largest and most comprehensive event created for information security professionals. Paul Kocher joins industry notables Whitfield Diffie, Burt Kaliski, Ronald Rivest and Adi Shamir in "The Cryptographers' Panel," one of the most widely attended and eagerly awaited sessions during the RSA Conference. Representing some of the leading minds in the field, this panel will look back at past panel predictions and how they turned out, and again look ahead at the future of cryptography and information security. In another panel discussion, "Inside-Out Security Strategy - Architecting an Effective Defense for Vulnerabilities in the Stored Data Environment," Kocher and the panel will look at a new, inside-out security architecture that protects valuable information by focusing on the stored data itself. The panel will look at common vulnerabilities and innovative approaches to securing data throughout the IT environment. In "Stalemate Security Problems," Kocher considers the perpetual arms race between attackers and defenders, where frequent updates are required to guard against network attacks, fraud, piracy, spam and other security problems. Kocher will explore challenges, successes, catastrophic failures and open problems in managing these stalemates. Carter Laren joins senior executives from major Hollywood studios, Fox and Warner Bros., in a roundtable discussion of new strategies and weapons in the war against next-generation digital piracy. Moderated by Newsweek reporter, Steven Levy, "Hollywood's Last Chance - Getting it Right on Digital Piracy" will highlight the threat sophisticated digital pirates present to the movie industry's economic viability and how Hollywood executives are fighting to make tomorrow's high-definition content safe from the piracy that has devastated the music industry. From CSS to credit card fraud and P2P to Y2K, Benjamin Jun exposes "Ten Bugs That Cost Our Customers Billions." This fascinating look into security blunders will reveal how these bugs happened, why they caused serious problems and what could have been done to prevent them. Jun also explores the nature of high-threat systems protecting digital content, cash and access privileges in his session, "Fragile Secrets - Handle with Care!" Jun will show how smart cards, content protection systems and trusted computing environments protect secrets against motivated attackers - often the very users and device holders they serve - and why it is important for developers to consider real-world attacks, design principles for tamper resistance and validation strategies. Nate Lawson will be leading a discussion titled "Open-Source Security Tools," focusing on the design, use and customization of tools for evaluating and improving system security. Topics will include the benefits and challenges of open vs. closed source, current maturity levels and customization approaches. About the Presenters Paul Kocher, president and chief scientist, has gained an international reputation for his consulting work and academic research in cryptography. An active contributor to major conferences and standards bodies, Paul has designed many cryptographic applications and protocols, including SSL v3.0. His development of timing attacks to break RSA and other algorithms received front-page coverage in several major publications. More recently he has led research to develop Differential Power Analysis and designs for securing smart cards and other devices against these attacks, as well as to design a record- breaking DES Key Search machine. Paul holds a B.S. degree from Stanford University. Benjamin Jun, vice president, heads the consulting practice and the company's Content Security Research Initiative. He leads engineering groups in the design, evaluation and repair of high-assurance security modules for software, ASIC and embedded systems. Ben holds B.S. and M.S. degrees from Stanford University, where he is a Mayfield Entrepreneurship Fellow. Carter Laren is Cryptography Research's technical liaison to Hollywood studios, content owners and consumer electronics manufacturers. Known as the "Anti-Pirate," he has extensive experience designing and evaluating secure communication and pay-television systems, tamper-resistant devices and content protection technology. Carter holds a B.S. degree in electrical engineering from the University of Pittsburgh, where he was awarded the elite Chancellor's Scholarship. Nate Lawson, senior security engineer at Cryptography Research, is focused on the design and analysis of network security devices. He is the original developer of ISS's RealSecure and the first version of Decru's fibre channel appliance. Nate holds a B.S. computer science degree from Cal Poly and is a member of USENIX and SMPTE. Cryptography Research Conference Talk Schedule Tuesday, February 15, 2005 11:10 a.m. - The Cryptographers' Panel, Paul Kocher Thursday, February 17, 2005 7:00 a.m. - Open Source Security Tools, Nate Lawson 8:00 a.m. - Hollywood's Last Chance - Getting it Right on Digital Piracy, Carter Laren 2:00 p.m. - Inside-Out Security Strategy - Architecting an Effective Defense for Vulnerabilities in the Stored Data Environment, Paul Kocher 3:25 p.m. - Stalemate Security Problems, Paul Kocher 4:50 p.m. - Ten Bugs That Cost Our Customers Billions, Benjamin Jun Friday, February 18, 2005 11:10 a.m. - Fragile Secrets - Handle with Care!, Benjamin Jun About Cryptography Research, Inc. Cryptography Research, Inc. provides consulting services and technology to solve complex security problems. In addition to security evaluation and applied engineering work, CRI is actively involved in long-term research in areas including tamper resistance, content protection, network security and financial services. The company has a broad portfolio of patents covering countermeasures to differential power analysis and other vulnerabilities, and is committed to helping companies produce secure smart cards and other tamper resistant devices. Security systems designed by Cryptography Research engineers annually protect more than $100 billion of commerce for wireless, telecommunications, financial, digital television and Internet industries. For additional information or to arrange a consultation with a member of the technical staff, please contact Jen Craft at 415-397-0123, ext. 329 or visit http://www.cryptography.com. SOURCE Cryptography Research, Inc. Web Site: http://www.cryptography.com More news from PR Newswire... Issuers of news releases and not PR Newswire are solely responsible for the accuracy of the content. Terms and conditions, including restrictions on redistribution, apply. Copyright ) 1996-2004 PR Newswire Association LLC. All Rights Reserved. A United Business Media company. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RSA(R) Conference 2005 Commences In San Francisco With Record Attendance And Keynotes By Bill Gates, John Chambers And John Thompson - Attendee Number Expected To Exceed 11,000
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/02-1…> RSA(R) Conference 2005 Commences In San Francisco With Record Attendance And Keynotes By Bill Gates, John Chambers And John Thompson - Attendee Number Expected To Exceed 11,000 14th Annual Event Kicks-Off With Second Annual Executive Security Action Forum and Town Hall Meetings Featuring 9/11 Commissioner Jamie Gorelick and U.S. Secret Service Director Ralph Basham SAN FRANCISCO, Feb 14 /PRNewswire/ -- RSA(R) CONFERENCE -- The 14th annual RSA(R) Conference 2005, the world's leading information security event, opened today at San Francisco's Moscone Center to an expected record attendance of over 11,000. Attendees include security practitioners, academics, developers, IT professionals, industry leaders, and policy makers discussing the latest developments in technology, mathematics, public policy, and best practices in information security. The Conference keynotes will commence with featured speakers Bill Gates, chairman and chief software architect of Microsoft; followed by John Chambers, president and chief executive officer of Cisco Systems, Inc.; and John Thompson, chairman and chief executive officer of Symantec Corporation. This year's event features over 275 vendors demonstrating the latest technologies in more than 162,000 square feet of exhibit space. Monday's agenda kicks-off with the Second Annual Executive Security Action Forum, followed by four days of over 200 conference sessions including enterprise and common criteria tutorials and the Town Hall Meetings. "Over the past year information security has been elevated on the priority list of professionals, government officials and corporations alike, as a result of advanced threats, issues of liability and new regulations that require compliance," said Sandra Toms LaPedis, area vice president and general manager of the RSA Conferences. "The solid increase in our registration numbers compared to the last few years continues to show that RSA Conference is a valuable forum for balanced discussions and priceless networking opportunities for all attendees across the board. This year's event offers one of the most prestigious line-ups in Conference history as well as new events including Town Hall meetings that will cover critical trends and world issues on the minds of our attendees." Information security has grown to become a critical issue for both enterprises and individuals. Conference attendees gain vital information with their access to more than 200 educational presentations and class sessions throughout the week. The conference will conclude Friday, February 18th with a presentation by Frank Abagnale, industry consultant and best-selling author of "Catch Me If You Can." Other highlights include: Executive Security Action Forum The Executive Security Action Forum will be held on Monday, February 14, prior to the start of RSA(R) Conference 2005. The Forum is a continuous, independent commission that includes key business and government security policy and technology implementers - as well as security industry executives. Members of the Forum include CIOs, CSOs and CISOs from Fortune 500 companies such as Bank of America, eBay, Ford, Microsoft, Motorola, Pepsico, Safeway, Wachovia and Washington Mutual. During the forum, executives discussed ideas to improve information security in the private and public sectors. Other topics included the best practices and issues with funding of information security, enforcing security with outsourcers, balancing security and privacy, product liability, legislation and public policy and how to connect business, government and technology. Town Hall Meetings The Cyber Security Industry Alliance (CSIA) will host a Town Hall Meeting to discuss homeland security, critical infrastructure protection, and cyber security in the post-9/11 era, and what steps are being taken to enhance security measures. Featured speakers include: 9/11 Commissioner Jamie Gorelick and Dick Clarke, former US cyber security czar. This session will take place on Wednesday, February 16, 12:45 p.m. - 1:45 p.m., Gateway 104 Attendees interested in attending must RSVP for this session to csiatownhall(a)csialliance.org. Business Software Alliance (BSA) will sponsor the second Town Hall Meeting scheduled for Thursday, February 17, noon - 1:30 p.m., Gateway 104.BSA President and CEO, Robert Holleyman will host this session. The U.S. Secret Service Director, Ralph Basham, will open the discussion on the emergence of modern day "rum runners." The session will be moderated by Jon Swartz, USA TODAY technology reporter, who will focus on the threat of organized crime on the Internet along with a prestigious panel of experts on the forefront of this emerging criminal phenomenon. Attendees interested in attending must RSVP for this session at townhallrsvp(a)bsa.org. RSA Conference First Time Attendee Briefing RSA Conference first time attendees are invited to the Conference First Time Attendee Briefing to hear from past attendees on planning agendas and sessions to attend and to gain general information. This session takes place in Esplanade 302 on Monday from 6-7 p.m. Cryptographers' Panel The Cryptographers' Panel is one of the most widely attended and eagerly awaited sessions during the RSA Conference. Burt Kaliski, vice president of research at RSA Security and chief scientist of RSA Laboratories, will moderate this year's cryptographers' panel, which will look at past panel predictions and how they turned out, as well as looking ahead at the future of cryptography and information security. Other participants providing insights into future information security developments include: Dr. Whitfield Diffie, Sun Microsystems; Paul Kocher, Cryptography Research; Professor Ronald Rivest, MIT Laboratory for Computer Science; and Professor Adi Shamir, Weizmann Institute. This panel is scheduled for Tuesday, February 15 at 11:10 a.m. Sponsors, Registration and Attendance Platinum Sponsors exhibiting at the conference include: Cisco Systems, Computer Associates, Microsoft, Qualys, RSA Security, Sun Microsystems, Symantec, Tipping Point and VeriSign. Full Conference fees include access to all four days of general sessions and class tracks, exhibits, evening receptions and giveaways. Qualified members of the media receive complimentary admission. A list of confirmed exhibitors is available at http://www.rsaconference.com. For more information about RSA Conference 2005 or to register, visit the web site at http://www.rsaconference.com or call 1-866-518-2076. About the RSA Conference Now in its 14th year, the RSA Conference brings together decision-makers and influencers from all major markets, including consumer, education, financial, government, computer networking, telecommunications, Wall Street and the media for one of the industry's premier e-security and cryptography events. Later in the year, RSA Conference 2005 continues in Japan and in Europe. RSA Conference will also be holding one-day regional events throughout the year including: September 13, 2005 in Chicago and September 15, 2005 in New York. For more information, visit http://www.rsaconference.com. RSA is a registered trademark or trademark of RSA Security Inc. in the United States and/or other countries. All other products and services mentioned are trademarks of their respective companies. Media Contact: Sponsor & Exhibit Contact: Tamara Burnett Don Rosette McGrath Power Nth Degree 408-375-7190 617-848-8766 tamarac(a)mcgrathpower.com drosette(a)nthdegree.com SOURCE RSA Conference Web Site: http://www.rsasecurity.com More news from PR Newswire... Issuers of news releases and not PR Newswire are solely responsible for the accuracy of the content. Terms and conditions, including restrictions on redistribution, apply. Copyright ) 1996-2004 PR Newswire Association LLC. All Rights Reserved. A United Business Media company. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Fighting Net crime with code / Surge in phishing e-mails to take spotlight at cryptography conference
by R.A. Hettinga 14 Feb '05

14 Feb '05

<http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2005/02/1…> www.sfgate.com Return to regular view Fighting Net crime with code Surge in phishing e-mails to take spotlight at cryptography conference - Carrie Kirby, Chronicle Staff Writer Monday, February 14, 2005 Every year, a bunch of cryptographers throw a big party, business mixer and study session in the Bay Area. In their effort to make the world love the science of code making and breaking as much as they do, they invoke dramatic historical uses of cryptography: the etchings of the ancient Maya, the Navajo code talkers of World War II. This time, the RSA Conference, opening today at Moscone Center in San Francisco, has crime as its theme. The 11,000 attendees will hear the tale of how federal agent Elizebeth Smith Friedman brought down a major ring of rum runners by cracking their sophisticated codes. The timing couldn't be more apt. More people than ever are not just shopping but conducting their finances online, with 45 percent of Americans paying bills over the Internet in 2004, according to research group Gartner. That's a 70 percent increase from 2003, a shift that is making the Internet more attractive than ever to criminals. "Crime on the Internet is probably the fastest-growing business there," said Ken Silva, vice president of networking and information security at VeriSign, the Mountain View company that secures Web sites and Internet transactions. Phishing e-mails -- those little fraudulent notes asking you to "confirm" your bank account number, credit card number, ATM password or locker combination -- have been growing by 38 percent a month on average, according to the industry's Anti-Phishing Working Group. Gartner warns that phishing will erode the growth of e-commerce if nothing is done. The folks gathering at the Moscone Center this week are the ones who do battle with all that, using -- you guessed it -- cryptography. They're software developers, marketers, academics, business leaders -- including conference speakers Bill Gates of Microsoft, John Chambers of Cisco, Symantec's John Thompson and VeriSign's Stratton Sclavos -- and a few current and former government officials, such as Amit Yoran, who resigned in October after one year as the nation's top cyber security official. Because phishing has shown the downside of using just a user name and password to access an online bank account, a panel featuring Yoran and other experts will look at safer ways for consumers to identify themselves on the Internet. Another panel will address businesses' fear that adding more security could make e-commerce and e-banking sites too cumbersome for consumers to use. Another topic will be whether software companies should be held liable when bugs in their products allow theft to happen and whether the government should regulate software safety as the Federal Aviation Administration regulates airline safety. Because most hackers and viruses get into computers through holes in Microsoft's nearly ubiquitous Windows software, Microsoft is always central in such discussions. But that is not a favorite topic for Microsoft leaders, and the preview blurb for Gates' speech, scheduled for Tuesday morning, makes no mention of that controversy. Instead, Gates is to discuss "his perspective on the state of security today, the importance of continued innovation, and advances in Microsoft's platform, products and technologies designed to better protect customers." The conference is run by Bedford, Mass., cryptography company RSA Security, which also has an office in San Mateo. E-mail Carrie Kirby at ckirby(a)sfchronicle.com. Page E - 2 URL: http://sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2005/02/14/BU… )2005 San Francisco Chronicle | Feedback | FAQ -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

MPAA Developing Digital Fingerprinting Technology
by Eugen Leitl 14 Feb '05

14 Feb '05

>From the ha-ha-ha dept. Link: http://slashdot.org/article.pl?sid=05/02/13/229229 Posted by: Zonk, on 2005-02-13 23:42:00 from the following-in-your-tracks dept. Danathar writes "The MPAA is looking to use [1]digital fingerprinting technologies that in conjunction with legislation will enable and force ISPs to look for network traffic that matches the signatures. " From the article: " Once completed, Philips' technology--along with related tools from other companies--could be a powerful weapon in Hollywood's increasingly aggressive attempts to choke off the flood of films being traded online." References 1. http://news.com.com/Movie+blackout+for+P2P+networks/2100-1025_3-5571057.htm… tag=nefd.lede ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Despite Opposition, Might the Web Need New Government Jolt?
by R.A. Hettinga 13 Feb '05

13 Feb '05

"We're from the government, and we're here to..." Cheers, RAH ------- <http://online.wsj.com/article_print/0,,SB110833554526853450,00.html> The Wall Street Journal February 14, 2005 PORTALS By LEE GOMES Despite Opposition, Might the Web Need New Government Jolt? February 14, 2005 The birth of the Internet resulted from a famous example of government involvement in the economy a generation ago, when the Defense Department funded college researchers interested in computer networking. Since then, the Web has been an epic success, and the number of U.S. households connected to it continues to grow. But the speeds at which these houses can link up has plateaued at current DSL and cable rates, badly lagging behind the speeds available in many other countries, notably in Asia. Might it require another bit of government involvement to prod things along? That's one of the questions being raised in connection with the plans of a growing number of American cities to sponsor municipal wireless networks to provide Internet access to residents. Philadelphia, the biggest and best-known of these examples, is in the middle of unveiling such a plan; it hopes to blanket the metropolitan area with a wireless network that will provide speeds of at least one megabit for both uploading and downloading. That's not as fast as what residents of Hong Kong and South Korea enjoy, but it is faster than what many Americans have, especially for uploading data from PCs back to the Internet. Many home connections going in this direction are now just a tenth as fast. There is, however, much less consensus about these sorts of government projects today than there was during the heyday of federal support for high-technology research back in the 1970s and 1980s. The Philadelphia proposal, like other municipal plans, has become controversial -- in large part simply because of the considerable role being played by the city government. Last month, the latest in a series of harshly critical reports about these municipal network proposals was published by the New Millennium Research Council, a Washington, D.C., lobby and policy group. The council has ties to both local phone companies, which view these networks as competition and have lobbied in state legislatures to outlaw them, and conservative Washington think tanks, which tend to oppose activist-government initiatives. These sorts of ideological political tussles over the Web are increasingly common. For example, conservative groups, along with many members of Congress, are working hard to keep the Internet a tax-free zone, whether that involves taxation of Internet telephony or a sales tax for merchants like Amazon. On the opposite side of these disputes one usually finds state and county elected officials -- many of them Republican -- who are trying to provide traditional government services in a new era. When it comes to municipal networks, critics contend that cities will be using scarce tax money to build networks that compete with systems already offered by telephone and cable companies. What's more, they say, any network a city would build will quickly grow outdated because of rapidly changing technology. Philadelphia city officials respond that their network won't require taxpayer funds at all; instead, they say, it will be built and operated by for-profit private companies under a business plan developed by the city and its consultants. The goal, says Dianah Neff, the city's chief information officer, is to offer wireless-based connectivity throughout the city that will be free in some areas and cost roughly $20 a month in others. Ms. Neff says that her city would defer to private enterprise if it could, but that existing cable and phone providers either won't bring connectivity to the city's poorer neighbors at all, or won't do it for the city's $20 target price. The biggest contribution the city will make to the network will be in providing access to city infrastructure, such as utility poles, to house the wireless transmitters needed to bring the network to life. A private company will operate the network once it starts running, Ms. Neff says, and taxpayers won't be on the hook if business doesn't live up to expectations. As envisioned by city planners, the Philadelphia network won't have anything close to the blazing speeds common in Asia, where the Internet is so fast that residents can get their television signals through it. Its main goal, says Ms. Neff, is making a basic level of Web connectivity available to everyone. But because Philadelphia will be able to take advantage of new kinds of wireless technologies like WiMax, it may end up offering faster bandwidth than is enjoyed by many regular cable and DSL subscribers. Because of new technology, these networks can be installed with relatively small capital investments; the estimate for Philadelphia is roughly $10 million. Incumbent players don't usually have an incentive to build these faster new networks because they are tied to their wired networks, which also deliver telephone and television services. And that's one reason that networking speeds in the U.S. are stuck in the rut they are in. It's easy to bash city governments as being full of maladroit bureaucrats eager to manhandle a new technology, and even economists who support municipal networks say cities shouldn't rush into them. But well-thought-out city plans could help everyone by acting as a catalyst and shaking up the status quo. Some might even call that competition. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

TI Tackles Need for Secure Wireless Environment
by R.A. Hettinga 12 Feb '05

12 Feb '05

<http://i-newswire.com/goprint6541.html> I-Newswire TI Tackles Need for Secure Wireless Environment with Industry-Leading Security Solution (2005-02-13) Texas Instruments (TI) [NYSE:TXN] today announced it will be demonstrating with Orange and Trusted Logic a wireless security handset mechanism designed to eliminate unauthorized handset use and fraud. The demonstration also features a 128-bit secure contactless payment application and a customer loyalty application, powered by TI-RFidTM technology. As wireless evolves to 3G technology, the need for reliable security around applications handling sensitive high-value data becomes critical; in parallel, consumer demand for convenient transactions also becomes significant. With TI4s security technology at the core of TI4s OMAPTM processors, the solution provides one of the highest levels of handset security in the marketplace today. The first in the industry to provide a hardware-based system-level security solution three years ago, TI continues to address growing security concerns and needs by collaborating with industry leaders such as worldwide mobile operator Orange and Trusted Logic, a leading provider of secure software components for embedded systems. Together with Orange and Trusted Logic, TI will be demonstrating secure mobile payment and secure digital rights management (DRM) at 3GSM World Congress 2005 in Cannes, France, February 14-17. "Typically, mobile phones and user identities are secured by software cryptography. However, with mobile phone hacking and fraud on the rise, and as subscribers increasingly use their mobile phones to conduct wireless transactions and to download high-value multimedia, software security alone is insufficient to protect users and mobile data," said Edgar Auslander, TI general manager of worldwide strategy and corporate development, Wireless Terminals Business Unit. "TI provides a hardware-based security system designed to meet stringent security requirements set by mobile operators and financial services and content providers." "As new applications, business models and revenue opportunities arise in the mobile device market, so do the risks posed by hackers and malicious attacks to handsets to operator and third-party assets," said Laurent Coureau, strategic advisor, Orange. "TI's complete system-level security technology, combined with our standard based security middleware OVM, brings end-to-end security in an open and secure environment, leveraging trusted hardware and software components and building the foundation for new, value-added services based on enhanced customer trust." In the TI booth, Hall 2, Booth E19, TI will showcase consumer value-added secure services, enabled by TI's security technology in OMAP processors, Orange Operator Virtual Machine (OVM) and Trusted Logic Security Module, including contactless financial transactions and a contactless customer relationship management (CRM) application. The demo will use Orange OMA DRM v2.0 compliant secure multimedia contents downloads, rights management, decryption and play, as well as TI-RFid technology secured by 128-bit 3DES cryptography, as the air interface. "Users are growing more comfortable with carrying out transactions wirelessly, hence the need for a secure environment becomes even more critical," said Dominique Bolignano, Trusted Logic president and chief executive officer. "By leveraging each others' features, Trusted Logic's Security Module, which fully complies with the OVM specifications, and TI's security technology work synergistically to exponentially strengthen overall system security. This enables operators in providing consumers with a secure, trusted environment for financial services and protected mobile data." Together, Texas Instruments, Orange and Trusted Logic are working to reduce handset fraud while addressing new security services for the wireless environment, including DRM and verification; music, video, games and other application downloads; remote terminal management; m-commerce transactions; and over-the-air (OTA) provisioning of new services and "bug" fixes using the mobile phone. TI is committed to an open, non-proprietary approach to the wireless marketplace and actively works with technology, applications and security standards bodies to drive open standards and wireless innovation. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Break-In At SAIC Risks ID Theft
by R.A. Hettinga 12 Feb '05

12 Feb '05

<http://www.washingtonpost.com/ac2/wp-dyn/A17506-2005Feb11?language=printer> The Washington Post washingtonpost.com Break-In At SAIC Risks ID Theft Computers Held Personal Data on Employee-Owners By Griff Witte Washington Post Staff Writer Saturday, February 12, 2005; Page E01 Some of the nation's most influential former military and intelligence officials have been informed in recent days that they are at risk of identity theft after a break-in at a major government contractor netted computers containing the Social Security numbers and other personal information about tens of thousands of past and present company employees. The contractor, employee-owned Science Applications International Corp. of San Diego, handles sensitive government contracts, including many in information security. It has a reputation for hiring Washington's most powerful figures when they leave the government, and its payroll has been studded with former secretaries of defense, CIA directors and White House counterterrorism advisers. Those former officials -- along with the rest of a 45,000-person workforce in which a significant percentage of employees hold government security clearances -- were informed last week that their private information may have been breached and they need to take steps to protect themselves from fraud. David Kay, who was chief weapons inspector in Iraq after nearly a decade as an executive at SAIC, said he has devoted more than a dozen hours to shutting down accounts and safeguarding his finances. He said the successful theft of personal data, by thieves who smashed windows to gain access, does not speak well of a company that is devoted to keeping the government's secrets secure. "I just find it unexplainable how anyone could be so casual with such vital information. It's not like we're just now learning that identity theft is a problem," said Kay, who lives in Northern Virginia. About 16,000 SAIC employees work in the Washington area. Bobby Ray Inman, former deputy director of the CIA and a former director at SAIC, agreed. "It's worrisome," said Inman, who also received notification of the theft last week. "If the security is sloppy, it raises questions." Ben Haddad, an SAIC spokesman, said yesterday that the Jan. 25 theft, which the company announced last week, occurred in an administrative building where no sensitive contracting work is performed. Haddad said the company does not know whether the thieves targeted specific computers containing employee information or if they were simply after hardware to sell for cash. In either case, the company is taking no chances. "We're taking this extremely seriously," Haddad said. "It's certainly not something that would reflect well on any company, let alone a company that's involved in information security. But what can I say? We're doing everything we can to get to the bottom of it." Gary Hassen of the San Diego Police Department said there are, at the moment, "no leads." Haddad said surveillance cameras are in the building where the theft took place, but he did not know whether they caught the perpetrators on tape. He also did not know whether the information that was on the pilfered computers had been encrypted. The stolen information included names, Social Security numbers, addresses, telephone numbers and records of financial transactions. It was stored in a database of past and present SAIC stockholders. SAIC is one of the nation's largest employee-owned companies, with workers each receiving the option to buy SAIC stock through an internal brokerage division known as Bull Inc. Haddad said the company has been trying through letters and e-mails to get in touch with everyone who has held company stock within the past decade, though he acknowledged that hasn't been easy since many have since left the company. He said the company would take steps to ensure stockholder information is better protected in the future, but he declined to be specific. The theft comes at a time when the company, which depends on the federal government for more than 80 percent of its $7 billion annual revenue, is already under scrutiny for its handling of several contracts. Last week on Capitol Hill, FBI Director Robert S. Mueller III testified that the company had botched an attempt to build software for the bureau's new Virtual Case File system. The $170 million upgrade was supposed to allow agents to sift through different cases electronically, but the FBI has said the new system is so outdated that it will probably be scrapped. In San Antonio, SAIC is fighting the government over charges that the company padded its cost estimates on a $24 million Air Force contract. The case prompted the Air Force to issue an unusual alert to its contracting officials late last year, warning them that "the Department of Justice believes that SAIC is continuing to submit defective cost or pricing data in support of its pricing proposals." SAIC has defended its work for the FBI and the Air Force. Haddad said that criticisms are inevitable for a such a large company and that there is no pattern of poor performance. "I know people will try to jump to that kind of conclusion, but it's not an accurate reflection of how well this company is doing," he said. "This company has always prided itself on strong ethics." The company's alumni list reads like a roll call of the nation's highest-profile former officials, including former defense secretaries William J. Perry and Melvin R. Laird and former CIA director John Deutch. Current directors of the company include former chief counterterrorism adviser Gen. Wayne A. Downing. Founded by a group of scientists in 1969, SAIC has been growing in recent years at a rapid clip, right along with the government's appetite for high-tech services in information technology and national defense. The company named a new chief executive, Kenneth C. Dahlberg, in 2003, and he has set a goal of doubling the company's value within three to five years, Haddad said. Philip Finnegan, director of corporate analysis with the Teal Group Corp., said SAIC is trying to push into the top tier of contractors -- a rarefied club that includes Boeing Co. and Lockheed Martin Corp. -- and that there are bound to be bumps along the way. "It's inevitable that they'll face problems," he said. Others are less sure the company's recent difficulties don't add up to something more. "Is [the break-in] saying something about the quality of the company?" Kay said. "It's hard to say that. It's probably just random luck. But multiple occurrences of bad luck are often more than bad luck." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: [FoRK] Google (fwd from rst@ai.mit.edu)
by Eugen Leitl 12 Feb '05

12 Feb '05

----- Forwarded message from rst(a)ai.mit.edu -----

3 2