- cypherpunks-legacy - lists.cpunks.org

Re: [IP] Cell phones for eavesdropping
by Major Variola (ret) 30 Dec '04

30 Dec '04

>From: Gadi Evron <ge(a)linuxbox.org> >Subject: Cell phones for eavesdropping - finally some public "chatter" Of course, the low-budget govt snoops go for the basestations and landline links. The pending cell phone virus which calls 911 should be a real hoot. I wonder if cell virii can carry a voice payload which they can inject as well. Or do we have to wait a few (viral) generations for that?

1 0

Re: [CYBERIA] On-line Purchase Denied
by R.A. Hettinga 30 Dec '04

30 Dec '04

--- begin forwarded text

1 0

Dept Homeland Security Research Conference in Boston, April 27-28
by Bill Stewart 30 Dec '04

30 Dec '04

Not sure what mailing list this came from, but the DHS is running a shindig in Boston in April, if anybody wants to drop by. I've de-MIME-ified it, so it may be a bit harder to read. From: DHS Homeland Security Conference [mailto:anzentech@app.topica.com] Sent: Wednesday, December 29, 2004 5:45 PM Subject: Conference for Public/Private R&D Partnerships in Homeland Security, CFP Dear Colleague, You are invited to participate in this inaugural, must-attend, national event, sponsored by the U.S. Department of Homeland Security, Science and Technology Directorate, scheduled for April 27 & 28, 2005 in Boston, to encourage public-private partnering among scientists and engineers from government, national laboratories, universities, research institutes, and private sector firms investing in R&D. Private sector and university-based scientists can benefit from the technologies and technical approaches developed and deployed by the national and DHS labs. The laboratories in turn can explore leveraging opportunities with leading private sector and university-based research programs. Please take a moment to consider submitting a paper presenting your research at this conference. If you cannot submit a paper, attend and learn what others are doing and how you can work with them. We are also seeking conference cosponsors and exhibitors from both public and private sector organizations. Visit the conference web site, www.homelandsecurityresearchconference.org <http://anzentech.c.topica.com/maac1jvabcT5eaIcCidcadIdN1/> , for more details often. It is constantly being updated. Working Together: Conference on Public/Private R&D Partnerships in Homeland Security Sponsored by the U.S. Department of Homeland Security, Science & Technology Directorate April 27 & 28, 2005 The Seaport Hotel and World Trade Center Boston, Massachusetts, USA Call for Technical Papers The First Annual Working Together: Conference on Public/Private Research & Development (R&D) Partnerships in Homeland Security This two-day Conference will focus on state-of-the-art science and technology to anticipate, prevent, respond to, and recover from high-consequence chemical, biological, radiological, nuclear, explosives and cyber terrorist threats. The conference will also address protection of the nation's critical infrastructure, and the harnessing of science and intelligence to reduce threat and risk. The objectives of this inaugural event are to encourage public-private partnering among scientists and engineers from government, national laboratories, universities and research institutes, and private sector firms investing in R&D, to address the collective science and technology research goals of the U.S. homeland security community. Private sector and university-based scientists can benefit from the technologies and technical approaches developed and deployed by the national and DHS labs. The laboratories in turn can explore leveraging opportunities with leading private sector and university-based research programs. Through plenary and breakout sessions, posters and a companion Exhibition Conference Participants will: 7 learn about DHS awareness, countermeasures and response and recovery goals; 7 address the most pressing technical challenges; 7 identify the most critical knowledge gaps; 7 be introduced to the core capabilities of national and DHS laboratories, and the Departments university-based homeland security centers; and Background DHS is committed to science and technology leadership, and the creation of an enduring national capability for homeland security. Toward this end, the DHS S&T Directorate supports and recognizes technical excellence in research, development, testing and evaluation (RDT&E) of homeland security technologies; encourages collaborations and partnerships among RDT&E performers across the homeland security science and technology complex; actively disseminates knowledge generated through the execution of RDT&E programs and university-based homeland security centers; and to the greatest extent practical, enhances visibility and recognition of scientists and engineers dedicated to homeland security missions. Technical Topics We are seeking papers on the following topics: 7 Threat Characterization for: Chemical, Biological, Radiological / Nuclear, Conventional Explosives (CBRNE) 7 Threat and Vulnerability Assessment including: Knowledge Discovery (Semantic Graphs), Technology-based Emerging Threats (e.g., terrorist exploitation of advances in nanotechnology and biotechnology), Advanced Risk Modeling, Simulation and Analysis for Decision Support, Modeling and Simulation (Cognition and Behavior), Discrete Sciences, Visual Analytics 7 Sensors including: Performance Improvement, Next-Generation Designs, and Architecture for Devices and Systems 7 Forensics and Attribution for Chemical and Biological Events 7 Chemical Countermeasures Including: Detection (TICs and TIMs), Surveillance/Detection (Low Volatility/Chemical Warfare Agents) 7 Biological Countermeasures including: Agricultural Security, Surveillance (Situational Awareness) 7 Radiological/Nuclear Countermeasures including: Passive and Active Detection 7 Explosives Detection including: Bulk and Trace Detection and Nanosensors 7 Methods to Disarm/Defeat Conventional Explosives 7 Critical Infrastructure Protection and Cyber Security including: Addressing Insider Threat, Large Scale Situational Awareness 7 Post-Event Recovery and Restoration from events involving the use of chemical and biological agents and nuclear and radioactive materials (e.g., improvised nuclear devices and radiological dispersion devices). Information and Important Dates Abstracts should be submitted in MS Word and limited to a maximum of 250 words. On the same page, the author(s) title, name, address, phone, fax, email and organization affiliation must be submitted. In addition, a maximum of 100-word biography of the presenting author is required on a separate page. Electronic versions of abstracts and papers should be submitted via the conference website. Detailed instructions about the electronic submission process will be published on the website. All electronic submissions will be acknowledged via email. Abstract deadline: February 7, 2005 Speaker Notification: March 1, 2005 Final Paper Deadline: At the Conference For more information on the First Annual National Homeland Security R&D Conference, please refer to website: www.homelandsecurityresearchconference.org Call for Sponsors and Exhibitors We are seeking conference cosponsors and exhibitors from public and private sector organizations. For more information on sponsorship opportunities, please email: dhsconferencesponsorships(a)anzentechpartners.com <mailto:dhsconferencesponsorships@anzentechpartners.com> . For more information on exhibit opportunities, please email dhsconferenceexhibits(a)anzentechpartners.com <mailto:dhsconferenceexhibits@anzentechpartners.com> . Call for Preliminary Registration If you are interested in attending this conference, please email us at dhsconference(a)anzentechpartners.com <mailto:dhsconference@anzentechpartners.com> . To make sure you receive our notices, please configure your spam filter to accept this email address. Conference Organizer DHS S&T - The Department of Homeland Securitys Science and Technology Directorate is the primary research and development arm of the Department. It provides Federal, state, and local officials with the technology and capabilities to protect the homeland. You are subscribed as billstewart(a)att.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ---- Bill Stewart bill.stewart(a)pobox.com

1 0

eBay Dumps Passport, Microsoft Calls It Quits
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://www.techweb.com/article/printableArticle.jhtml;jsessionid=IUVVYXUECE…> eBay Dumps Passport, Microsoft Calls It Quits By TechWeb News December 30, 2004 (12:51 PM EST) URL: http://www.techweb.com/wire/ebiz/56800077 Another Online auction site eBay announced Wednesday that it will soon drop support for Microsoft's Passport for log-in to the site and discontinuing alerts sent via Microsoft's .Net alerts. Microsoft responded by saying that it will stop marketing Passport to sites outside its own stable. As of late January, eBay will no longer display the Passport button on sign-in pages nor allow users to log in using their Passport accounts. Instead, members must log-in directly through eBay. Likewise, eBay's dumping .Net alerts, which means that eBay customers who want to receive alerts -- for such things as auction closings, outbids, and auction wins -- will have to make other arrangements. The free-of-charge eBay Toolbar, for instance, can be used to set up alerts going to the desktop, while alerts to phones, PDAs, or pagers can be created from the user's My eBay page. eBay was one of the first to jump on the Passport bandwagon in 2001, but is only the latest site to leap off. Job search site Monster.com, for instance, dropped Passport in October. Microsoft has decided to stop marketing its sign-on service to other Web sites, the Los Angeles Times confirmed Thursday. The pull-back, which had been long predicted by various analysts, follows a stormy life for Passport, which among other things, suffered a pair of security breakdowns in the summer of 2003 that could have led to hackers stealing users' IDs. Microsoft also pulled its online directory of sites using Passport -- perhaps because the list would have been depressingly short -- stating in the online notice that "We have discontinued our Site Directory, but you'll know when you can use your Passport to make sign-in easier. Just look for the .NET Passport Sign In button!" Passport will continue to be the sign-on service for various Microsoft properties, including the Hotmail e-mail service and MSN.com. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

The story of Aldrich Ames and Robert Hanssen--from the KGB's point of view.
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://www.opinionjournal.com/la/?id=110006088> OpinionJournal WSJ Online BOOKSHELF The Man Who Stole the Secrets The story of Aldrich Ames and Robert Hanssen--from the KGB's point of view. BY EDWARD JAY EPSTEIN Thursday, December 30, 2004 12:01 a.m. EST Recently a number of former CIA officers received an invitation from the Spy Museum in Washington to attend a luncheon for former KGB Col. Victor Cherkashin. The event, as the invitation said, would afford "a once-in-a-lifetime opportunity to dine and dish with an extraordinary spymaster." In the heyday of the Cold War, such an offer, delivered with slightly more discretion, might have been the prelude to a KGB recruitment operation. Now it's merely the notice for a book party celebrating yet another memoir by a former KGB officer recounting how the KGB duped the CIA. In this case, there is a great deal to tell. Victor Cherkashin served in the KGB from 1952, when Stalin was still in power, until the Soviet Union disintegrated in 1991. During most of that time his mission was to organize KGB operations aimed at undermining the integrity, confidence and morale of the CIA. He seems to have been good at his job. His big opportunity came when he was the deputy KGB chief at the Soviet Embassy in Washington between 1979 and 1985. Those years were the height of a ferocious spy war within the Cold War. In "Spy Handler," Mr. Cherkashin describes in detail how he helped convert two American counterintelligence officers--one well-placed in the CIA's Soviet Russia Division, the other in the FBI--into moles. Their names are notorious now, but over the course of a decade Aldrich Ames and Robert Hanssen operated with anonymous stealth, compromising most of the CIA's and FBI's espionage efforts in the Soviet Union. But that wasn't the end of Mr. Cherkashin's glory. Returning to Moscow, he helped run "dangle" operations in which KGB-controlled diplomats feigned a willingness to be recruited by their American counterparts, only to hand over disinformation when they were finally "recruited." Thus when the CIA came around to investigating why its agents were being compromised in Russia, the KGB sent the CIA a disinformation agent, for example, to paint false tracks away from its moles. This agent--"Mr. X"--offered to betray the Soviet Union for $5,000. When the CIA snapped up the bait, Mr. X pointed it to its own secret communication center in Warrenton, Va., falsely claiming that the KGB was electronically intercepting data from its computers. The purpose, of course, was to divert the agency away from the mole, who continued betraying CIA secrets for eight more years. Told from the KGB's vantage point, Mr. Cherkashin's story provides a gripping account of its successes in the spy war. He shows Mr. Hanssen to have been an easily managed and highly productive "penetration" who operated via the unusual tradecraft of dead drops, leaving material at designated locations where it could be transferred without spy and handler ever meeting. (Indeed, the KGB never knew Mr. Hanssen's identity.) Mr. Ames, for his part, was a more complex case, since he had come under suspicion and the KGB had to concern itself with throwing the CIA off his trail. That America's counterespionage apparatus allowed both men to operate as long as they did is a testament to its complacency as much as to the KGB's cleverness. And indeed, Mr. Cherkashin skillfully torments his former adversary, the CIA, by attributing a large part of the KGB's success to the incompetence of the CIA leadership, or its madness. He asserts, in particular, that the CIA had been "all but paralyzed" by the "paranoia" of James Jesus Angleton, the CIA's longtime counterintelligence chief, who suspected that the KGB had planted a mole in the CIA's Soviet Russia division. Mr. Cherkashin is right that Mr. Angleton's concern retarded, if not "paralyzed," CIA operations in Russia. After all, if the CIA was indeed vulnerable to KGB penetration, as Mr. Angleton believed, it had to assume that its agents in Russia would be compromised and used for disinformation. This suspicion would recommend a certain caution or tentativeness, to say the least. Mr. Cherkashin's taunt about Mr. Angleton's "paranoia" echoed what was said by Mr. Angleton's critics in the CIA, who resented his influence, believing that polygraph tests and other security measures immunized the CIA against such long-term penetration. But of course Mr. Angleton was right, too. On Feb. 21, 1994, Mr. Ames, the CIA officer who had served in the Soviet Russia division, was arrested by the FBI. He confessed that he had been a KGB mole for almost a decade and had provided the KGB with secrets that compromised more than 100 CIA operations in Russia. Mr. Hanssen was caught seven years later. Since Mr. Cherkashin had managed the recruitment of Mr. Ames and helped with that of Mr. Hanssen, his accusation that Mr. Angleton was paranoid for suspecting the possibility of a mole has the exquisite irony of a stalker following his victim in order to tell him that he is not being followed. Mr. Cherkashin adds a further twist by suggesting that Mr. Angleton's "paranoia" made it easier for the KGB to recruit demoralized CIA officers as moles. According to this tortured logic, if the CIA--and its counterintelligence staff--had acted more ostrich-like, by denying the existence of moles in its ranks, the KGB would never have found Aldrich Ames or penetrated the agency in other ways. Mr. Cherkashin, who received the Order of Lenin for his work against the CIA, now runs a security company in Moscow. Because his side lost the Cold War, he is free to travel to Washington to toast his former adversaries (and present them with autographed copies of "Spy Handler"). The unauthorized revealing of KGB secrets is against the law in Vladimir Putin's Russia, and Mr. Cherkashin says that he does not plan to bring out an edition there. But why not? It's hard to imagine that the authorities would find much to object to. Mr. Epstein's "The Big Picture: The New Logic of Money and Power in Hollywood" will be published in February. You can buy "Spy Handler" from the OpinionJournal bookstore. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

As Investigations Proliferate, Big Banks Feel Under the Gun
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://online.wsj.com/article_print/0,,SB110436575482112446,00.html> The Wall Street Journal December 30, 2004 PAGE ONE Checking Accounts As Investigations Proliferate, Big Banks Feel Under the Gun Links to Cash-Transfer Firms Raise Troubling Questions About Money Laundering A Probe of Bank of America By GLENN R. SIMPSON Staff Reporter of THE WALL STREET JOURNAL December 30, 2004; Page A1 NEW YORK -- Until last year, federal prosecutors say, a tiny Brooklyn ice-cream shop was a vital cog in al Qaeda's global fund-raising operation. Carnival French Ice Cream sold only the occasional cone from its ground-floor nook in a four-story walk-up in the Park Slope neighborhood. Its real function, according to the government, was to move money. The shop took in $22 million between 1997 and 2003, the Justice Department alleges in federal court filings in New York. Prosecutors believe that Carnival diverted much of that money to a radical sheik in Yemen working with Osama bin Laden. The funds departed New York via the most modern and efficient method the American financial-services industry has to offer: an account at J.P. Morgan Chase & Co. The Carnival case, according to prosecutors, illustrates how since the late 1990s, major U.S. banks doing business with suspect money-transfer outfits like the Brooklyn shop have wired billions of dollars into and out of New York for suspected terrorist and criminal organizations. One Yemeni-American man has been convicted of lying to the Federal Bureau of Investigation in the Carnival probe, and three others await trial on money-laundering and related charges. Prosecutors haven't accused J.P. Morgan Chase of wrongdoing related to Carnival. But the bank and some of its major rivals now find themselves in law enforcement's cross hairs, as regulators and prosecutors crack down on what they say is widespread abuse in the $50 billion international money-transfer industry. Bank executives say they are being asked to bear a heavy burden in seeking to root out criminals who use them to move money. The executives say they are avidly trying to comply, but the authorities counter that the industry must do even more. One unintended consequence of this friction is that banks are simply dropping many small money-transfer businesses as clients, a move that could hurt millions of poor immigrants who send cash to relatives overseas. All of this activity is taking place in the shadow of sensational revelations earlier this year about how Riggs National Corp., a storied institution in Washington, for years failed to make required reports to regulators about hundreds of millions of dollars in suspicious transactions. The Riggs affair involved transactions by foreign officials. But as with some cases involving storefront money-transmitters, Riggs was shown to have failed to sound an alarm over large and seemingly dubious money movements. Now, Robert Morgenthau, the local district attorney in Manhattan, has threatened to indict Bank of America Corp. on money-laundering charges related to a suspect Latin American firm, according to federal law-enforcement officials who have been briefed on the matter. Mr. Morgenthau, in an interview, acknowledges that he is talking with the bank over how to resolve allegations that it transferred hundreds of millions of dollars for a Uruguayan money-transmitting business linked to drug trafficking, tax fraud and other financial crimes. Bank of America spokeswoman Shirley Norton says it "does not comment on its relations with customers or communications with regulators and law enforcement." She adds that the bank takes its anti-money-laundering responsibilities "extremely seriously," and is "routinely cooperating and partnering with law enforcement to investigate and help prosecute any individuals who might attempt to misuse our banking operations." Shortly after the Sept. 11, 2001, terrorist attacks, Congress toughened requirements on banks to investigate their own customers and alert the government to fishy activity. But a spate of recent fines, criminal investigations and prosecutions is raising questions about how effectively banks are fulfilling their role as front-line cops in the offensive against financial impropriety. In May, regulators imposed a $25 million fine on Riggs for its lapses; a federal criminal investigation is pending. In October, AmSouth Bancorp. of Birmingham, Ala., agreed to a pay $50 million in penalties for what federal banking regulators and prosecutors say was a breakdown in its money-laundering controls. And in November, The Wall Street Journal reported that Bank of New York Co. is negotiating with federal prosecutors to pay a fine of perhaps $24 million to avert a potential criminal indictment on charges that it failed to report suspicious activity at one of its branches. Bank of New York escaped criminal penalty in 2000 when a former executive and her husband pleaded guilty to laundering as much as $5 billion in suspect funds from Russia in the 1990s. Some banking executives say that the government underestimated the challenges of outsourcing to the industry so much of an expensive and unpopular task. Simultaneously executing and scrutinizing trillions of dollars in daily transactions, the executives argue, is a profound logistical challenge. By analogy, says William McDavid, general counsel at J.P. Morgan Chase, "think if you're running a railroad, and we say to you, 'We want you to monitor everyone who takes your train and see if their trip is legitimate.' " Still, he says J.P. Morgan Chase is spending tens of millions of dollars to comply with the law, adding in-house lawyers and accountants and new computer software for self-monitoring. Regulators say they appreciate the logistical challenges banks face, but they note that this year's big cases aren't instances of banks missing an occasional check. Rather, banks seem to have ignored numerous transactions that should have raised red flags. Senior executives of Riggs, for instance, overlooked huge cash transactions by Saudi diplomats whom American law enforcement suspects of channeling money to extremist Islamic causes. The Bank Secrecy Act requires banks to keep basic data on account holders -- such as the identities of all beneficial owners and their sources of income -- and to file reports with the government when they do anything defined by federal regulators as inherently "suspicious," such as the wiring of large sums by obscure companies in jurisdictions with notoriously weak regulation. The act also requires banks to report any cash transaction of $10,000 or more. Even after Congress toughened the law, ambiguities remain. The USA Patriot Act, enacted in late 2001, added a new requirement that banks give more scrutiny to "high risk" customers. But it is unclear precisely what that term means. Similarly, the law was changed to require banks to conduct "special due diligence" on certain foreign financial firms with which they do business. But it isn't clear, American banks say, whether that applies only to foreign banks or also to overseas money-transfer companies. Morgenthau Probe INDUSTRY UNDER SCRUTINY Some major cases from 2004 that raise questions about banks' self-policing: * Riggs: Fined $25 million for failing to alert regulators to hundreds of millions of dollars of suspicious transfers involving foreign officials; a criminal investigation is pending. * J.P. Morgan Chase: Transferred millions of dollars for a Brooklyn ice-cream shop that allegedly sent money to an al Qaeda ally in Yemen; the bank wasn't prosecuted. * Bank of America: Under investigation in New York for its alleged role in transferring funds for a money transmitter in Uruguay purportedly tied to the narcotics trade; other major banks could be drawn into the case. * Bank of New York: Negotiating with federal prosecutors to pay a fine of perhaps $24 million to avert a potential criminal indictment on charges that it failed to report suspicious activity at one of its branches. * AmSouth: Agreed to pay $50 million in penalties for what federal banking regulators and prosecutors say was a breakdown in its money-laundering controls. * ABN Amro: New York branch of Dutch banking giant reached an agreement with the Federal Reserve in July to overhaul its compliance operation and shed its ties to banks in Eastern Europe and Russia; Treasury and Justice department inquiries are pending. Source: WSJ research In the Bank of America investigation, Mr. Morgenthau, the veteran Manhattan district attorney, says the bank has transferred hundreds of millions of dollars for a money transmitter in Uruguay called Lespan SA and its affiliates. The prosecutor and federal officials familiar with the matter say they suspect the money has come from Colombian drug trafficking and other criminal activity. Alvaro Barriero, an official at Lespan subsidiary Gales Casa Cambio in Montevideo, says Lespan hasn't engaged in any illegal activity. The firm has a very active legal-compliance department, he says. The Bank of America investigation could get much broader and sweep in other major banks as well. A related local prosecution earlier this year -- in which Mr. Morgenthau's office obtained the conviction of a New York money transmitter operating without a license -- yielded a mountain of data about wire transfers involving Lespan by Bank of America, J.P. Morgan Chase, Citigroup Inc. and Wachovia Corp. Mr. Morgenthau's staff is now reviewing transactions related to all four banks. At The Wall Street Journal's request, the data-analysis firm I2 Inc. examined the wire transfers from the New York case, more than 300,000 transactions between 1997 and early 2003. The analysis found that the four banks, among others, moved hundreds of millions of dollars between New York and Uruguay, Paraguay and Brazil at the behest of obscure firms in the British Virgin Islands, a well-known financial-secrecy haven. "It's a matter of major concern that there was this gap in our supervision and control" of the financial system, Mr. Morgenthau says. According to American and Brazilian officials, much of the money appears to have come from a lawless enclave known as the Tri-Border Area, a free-trade zone on the borders of Argentina, Brazil and Paraguay. The officials say the area is dominated by organized criminal groups, including narcotics traffickers and people raising money -- by means of smuggling and copyright piracy -- for the Lebanese terrorist group Hezbollah. American and Brazilian investigators are looking at whether the big banks made an effort to determine how small firms in Uruguay and Paraguay could possibly have taken in so much cash from legitimate commerce. The investigators are also examining whether the banks inquired into the ownership of the British Virgin Islands companies. Brazilian Investigation The Brazilian government jointly is investigating political corruption, tax evasion and other alleged financial crimes involving Lespan. In connection with its probe, Brazilian officials have sent a 100-page document to the U.S. Justice Department, seeking assistance from American investigators. The Brazilian document confirms major aspects of the Journal's computer analysis of the more than 300,000 wire transfers that came to light in the local New York case. The Brazilian document, which became publicly available through filings in U.S. federal courts, names Wachovia and several other banks as conduits for Lespan. The Journal's analysis of the evidence introduced in the local New York case provides only a sampling of this complex set of bank relationships with Lespan. The analysis shows that Lespan used Citigroup's Citibank unit to move nearly $142 million to New York. Wachovia wired at least $38 million into and out of Lespan's operations in South America. Lespan relied on Bank of America to move at least $8.8 million, the records show. All told, the analysis of the records shows that Lespan used major banks to move at least $265 million between the U.S. and Latin America. J.P. Morgan Chase spokeswoman Judith Miller says, "Preventing money laundering is one of the highest priorities at J.P. Morgan Chase." Citigroup stopped doing business with Lespan in 2001 after detecting possible money-laundering, according to bank records and people familiar with the matter. A spokeswoman for Wachovia, Mary Eshet, says the bank has strong policies to prevent money laundering. She declines to comment further. Dropping Transmitters Big banks are scrambling to beef up their internal compliance staffs and acquire the latest software designed to flag suspicious transactions. One industry reaction that caught the government by surprise is that some banks are hastily ridding themselves of many of their money-transmitter clients. That threatens to hurt the money-transfer industry, which mainly serves the working immigrant poor. In a letter distributed this fall, Citibank informed money transmitters that they are "no longer considered a part of our target market." The letter gave recipients two weeks to find a new bank. Transmitters charge a fee to move funds for people who generally don't have bank accounts. The firms depend upon banks to carry out the transfers -- a mutually lucrative arrangement -- and have long operated with little regulation, making them vulnerable to exploitation by criminals and terrorists. It was only after it became known that the Sept. 11, 2001, plot was financed in large part through such transmitters that they were targeted by regulators. The largest money-transmitting companies, such as Western Union, a unit of First Data Corp., have compliance units and elaborate surveillance systems. Even with those protections, Western Union has come under closer scrutiny by regulators. A majority of the industry consists of small independent outfits that generally don't have much in the way of internal policing. The industry exports a total of more than $20 billion from the U.S. every year. Government officials are worried now that if money transferers can't go to banks, they will only be more likely to seek illegal methods of shipping cash. "It does no one any good if banks refuse to take these businesses -- that just encourages them to go underground," William Fox, the director of the Treasury Department's Financial Crimes Enforcement Network, said in a statement. "A transparent money-services sector is vital to the health of the world's economy." David Landsman, executive director of the National Money Transmitters Association, said in a recent letter to his members that he has warned U.S. officials that up to 75% of the check-cashing and transfer firms in New York could soon go out of business. Mr. Landsman says in an interview that nearly all transmitters are legitimate and that they play a vital role in providing cash to developing economies. Without them, immigrant workers will be forced to pay much higher bank fees to wire money home, he predicts. Yemeni Connection Prosecutors have alleged that Carnival French Ice Cream was primarily an unlicensed money-transmission operation for Yemeni immigrants. Between Sept. 11, 2001, and last year, when it was shut down, the shop allegedly moved at least $5.3 million out of the country through J.P. Morgan Chase. Some of that money came from charitable collections at mosques. Yet, according to J.P. Morgan Chase officials, there was little about Carnival that generated suspicion. In Park Slope, neighbors say the business fit right in with a pizza parlor, a cellphone store, a laundromat and other small shops on an ethnically mixed block. The firm opened its first account in 1982 with Manufacturer's Hanover, which was later acquired by Chase Manhattan, which merged with J.P. Morgan. Over the years, Yemeni immigrants associated with Carnival set up a series of at least 10 other accounts at various other New York banks in the names of other small businesses, such as Prospect Deli in Brooklyn. Funds then flowed among the accounts, creating the appearance of a network of small businesses, perhaps jointly owned by a group of immigrant entrepreneurs, as is common in some big cities. In reality, the government alleges, the other accounts were "feeder accounts" designed to avoid suspiciously large deposits into Carnival's primary Morgan account. These feeder accounts generally made deposits to Carnival's account below the $10,000 level that triggers a report to the federal government. Once channeled into the main Carnival account, the money was wired to Yemen and other countries. But the feeders were a fraud, the FBI alleges in filings in U.S. District Court in Brooklyn. Prospect Deli, the FBI says, pumped some $3.8 million into Carnival's J.P. Morgan Chase account from December 1997 to April 2003, even though the deli went out of business in 2000. While Carnival allegedly tried to hide its activity from the bank, an FBI agent involved in the case described in an arrest-warrant affidavit a number of "suspicious banking activities" for an account controlled by the ice-cream shop. The store's gross receipts from merchandise sales totaled less than $200,000 annually, FBI Agent Sharon Hassell said in the April 2003 sworn statement. Yet millions were wire-transferred out of its J.P Morgan Chase account "to a myriad of individuals, companies and foreign bank accounts, including banks in Saudi Arabia, Yemen, the United Arab Emirates, Canada, Thailand and China." J.P. Morgan Chase officials say they never suspected Carnival. They point out that on an average day, the bank processes more than 320,000 wire payments valued at nearly $2.3 trillion. By the end of 2005, J. P. Morgan Chase says it will have spent more than $20 million on improved transaction-monitoring systems and software. In the future, the bank's new protections will detect and flag customers like Carnival, bank officials say. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

2004: The Year That Promised Email Authentication
by R.A. Hettinga 30 Dec '04

30 Dec '04

<http://www.circleid.com/print/855_0_1_0/> CircleID 2004: The Year That Promised Email Authentication By: Yakov Shafranovich >From CircleID Addressing Spam December 27, 2004 As the year comes to a close, it is important to reflect on what has been one of the major actions in the anti-spam arena this year: the quest for email authentication. With email often called the "killer app" of the Internet, it is important to reflect on any major changes proposed, or implemented that can affect that basic tool that many of us have become to rely on in our daily lives. And, while many of the debates involved myriads of specialized mailing lists, standards organizations, conferences and even some government agencies, it is important for the free and open source software (FOSS) community as well as the Internet community at large, to analyze and learn lessons from the events surrounding email authentication in 2004. "THE GHOST OF CHRISTMAS PAST" The quest for email authentication did not start from scratch. Authentication systems are a well known field in computer security, and have been researched for quite some time. Nevertheless, it is only during this past year that email authentication has gained a prominent push mainly due to the ever increasing spam problem. As well known, the original email architecture and protocols was not designed for an open network such as the Internet. Therefore, the original designers failed to predict the virtual tidal wave of junk email that took advantage of lack of authentication in the Internet email. As the result, a junk email filter is considered one of the essential tools any Internet citizen must have in his toolkit today. The push towards email authentication started in earnest with the publication of a proposal called RMX by a German engineer called Hadmut Danisch in early 2003. While other previous proposals have been published, none have gained any kind of traction. Hadmut's proposal on the other hand coincided with the opening of the Anti-Spam Research Group (ASRG) of the Internet Research Task Force (IRTF), which as an affiliate body of the IETF. The IETF created and currently maintains the Internet email standards, and an IETF affiliate was a logical body to work on addressing the spam problem on the Internet at large. Being that the ASRG brought together a sizable chunk of the anti-spam world, RMX gained more exposure that none of the previous work in the field ever had. What followed was a succession of proposals forked off the original RMX proposal until the spring of 2004 when most of them were basically confined to the dustbin of history together with RMX. In the end, only two proposals with any sizable following were left: Sender Policy Framework (SPF) and Microsoft's Caller-ID. The author of SPF, Meng Wong, managed to attract a large community to his proposal, giving it a much larger deployed base than any competitor. In many ways this effort can be compared to some of the open source projects, except this time this was an open standard rather than a piece of software. On the other side of the ring, so to speak, was Microsoft which surprised the email world with their own proposal called Caller-ID at the RSA conference in early 2004. Eventually, the IETF agreed to consider standardization of email authentication by opening a working group called MARID in March of 2004. With the merger of SPF and Microsoft's new Sender-ID proposal, hopes were running high about the coming success of email authentication and the coming demise of spam. Yet, ironically this working group earned itself a record by being one of the shortest in the existence of the IETF - it has lasted a little over six months until being formally shutdown in September of 2004. "ALL THAT IS GOLD DOES NOT GLITTER" During the work of IETF's MARID group the quest for the email authentication begun to permeate circles outside the usual cadre of anti-spam geeks. Technology publications, and even the mass media have begun to take note of the efforts occurring on an obscure mailing list tucked away among 200 other even more obscure groups, prodded in many cases by the public relations spokesmen of various companies in the anti-spam space, including Microsoft. Yet in many ways that was one of the fatal blows to the group and any hope of a common standard for email authentication. Several major issues arose during the operation of the working group. The first major issue that has been bubbling beneath the surface was technical in nature. SPF has come from a group of proposals that worked with the parts of the email infrastructure that was unseen by most users. This included email servers that exchanged email among ISPs and were unseen. In the technical lingo this type of authentication was known as "path authentication". It focused on authenticating the path the message took place between servers, and dealt with machines instead of end users. Sender-ID approached the problem from a different viewpoint. Prodded by financial companies and the fact that Microsoft itself makes more email client software than server software, Sender-ID dealt with the end user. It focused on "message authentication", based on the path the message took. While the goals make have been admirable, many technical questions arose as to whether Sender-ID would work. Most of them were rooted in the basic differences between path authentication vs. message authentication, and remained unresolved. The second major issue that arose was one of intellectual property rights. Microsoft filed for patents on parts of Sender-ID and was not forthcoming with information during the operation of the MARID WG. While the actual patent application were eventually published towards the end of life of the WG that came too late. The damage to the trust among the group members, and different parts of the community has already been done. The main point of contention was not necessarily the patents applications themselves - rather it was the mandatory patent license that Microsoft had drawn up. The language in the Sender-ID patent license was construed in a way that prevents use by any software licensed under the General Public License (GPL). Whether that was intentional or not we may never know, but the trust between Microsoft and the FOSS community which was strenuous at best was broken. The third major issue which played itself outside the mailing lists and hallways of the anti-spam world was the media. Given that the spam problem was only increasing, the media pounced on what was seen as the golden grail for stopping spam. Unfortunately, as most reporters are not knowledgeable in either Internet architecture or email protocols, they frequently reported email authentication as the final cure for spam. These created great expectations for email authentication which were blown away once the hard truth settled in: email authentication did not stop spam. Unlike what many had believed, email authentication did not address the spam problem directly. Rather, it was only the first step towards a larger solution with reputation and accreditation systems planned for the future. However, as this truth sunk in, many of the companies and community members were not as positive towards email authentication as before. The various disagreements, technical and non-technical, led some of the group participants to create their own alternatives proposals or look to crypto-solutions such as Yahoo's DomainKeys. As a result, any useful work of the MARID group slowed to a crawl with the IETF eventually shutting down the group. A major factor in that decision was letters from two large members in the FOSS community against Sender-ID: the Apache Foundation and the Debian Project. "LET'S VISIT UNCLE SAM" With the shutdown of MARID WG in September of 2004, both Sender-ID and SPF were left to fend for their own. While some have assumed that Sender-ID was left of the dead after being rejected by the IETF shortly before the closure of MARID, Microsoft was quietly gathering support for Sender-ID among the industry. Microsoft's goals become clear at the FTC's Email Authentication Summit in November of 2004: Sender-ID was pushed as an accepted email authentication standard to be mandated by the FTC. Among the sizable PR gains that Microsoft gained was the endorsement of Sender-ID by AOL, and a letter signed by representatives of 25 major email companies and ISPs, a list which curiously included Meng Wong, the author of SPF. The PR advantage was so great, that SPF was not even listed on the FTC's website for the conference. At the same time, other alternative proposals such as CSV and BATV have begun promulgating among the industry, all of which born during the death throes of MARID. The SPF community being faced with the choice of joining or rejecting Sender-ID, was split. Majority of the community as judging by the mailing list traffic opposed Sender-ID/SPF combination. Nevertheless, some members including Meng Wong, the original author, endorsed Sender-ID. This has led to a lot of infighting with an election of an "SPF Council". At this time, the SPF community is the midst of a political discussion about its future. At the same time, a separate low-key effort in the IETF is taking place to address some of the cryptography solutions for Internet email. Proposals such as Yahoo's DomainKeys, Cisco's IdentifiedMail, etc. seek to achieve "message authentication" promised by Sender-ID but on a much more solid technical ground and with less IPR and PR issues. This effort is purposely left low key with even the mailing list itself hard to find, and certainly no media stories promising the end of spam. The IETF-MAILSIG effort as this is now called seeks to avoid the same problems that doomed MARID with hopes of developing useful technologies to reduce spam. Nevertheless, this effort was high-key enough for some of the companies involved to show case it at the FTC's summit. Needless to say, the FTC is staying silent on its plans. WHAT THE FUTURE HOLDS While we still don't have workable email authentication, the Sender-ID/SPF saga did accomplish a lot in many other ways. These events have shown to the technology community at large that the FOSS world plays an ever increasing role in the Internet as whole. The Apache Foundation and the Debian Project carried enough weight to the IETF to consider their opinion, marking probably the first time that FOSS opinions carried significant weight in the standards process. This debacle has also lead to an increased awareness of the growing problems in the patent system with Sender-ID being cited as a prime example of a patent system gone wrong. While smaller sagas such as PanIP's rampage on small e-businesses, Acacia's assault of video streaming and other similar incidents have been happening for a while, the Sender-ID/IETF story has brought this issue to the forefront of the Internet community for at least a short time. What has followed has been positive developments with governments, corporations and individuals recognizing the increasing problems in today's patent system and some beginning to seek reform. As for spam, Microsoft, Cisco, the SPF community and many others are still working on it. Some of the positive developments coming out of the Sender-ID episode have been an increased awareness of how the email architecture actual works and the increased realization that better coordination among the Internet community is necessary. As for email authentication - there is still 2005... -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

something to test ...
by Joe Schmoe 30 Dec '04

30 Dec '04

A test message. --Josh __________________________________ Do you Yahoo!? Yahoo! Mail - Find what you need with new enhanced search. http://info.mail.yahoo.com/mail_250

1 0

In war on terrorism, U.S. drafts shops to be on guard
by R.A. Hettinga 29 Dec '04

29 Dec '04

--- begin forwarded text

1 0

[IP] Cell phones for eavesdropping - finally some public "chatter" (fwd from dave@farber.net)
by Eugen Leitl 29 Dec '04

29 Dec '04

----- Forwarded message from David Farber <dave(a)farber.net> -----

1 0