- cypherpunks-legacy - lists.cpunks.org

Best-Kept Secrets
by R.A. Hettinga 20 Dec '04

20 Dec '04

<http://www.sciam.com/print_version.cfm?articleID=000479CD-F58C-11BE-AD06834…> Scientific American: December 20, 2004 Best-Kept Secrets Quantum cryptography has marched from theory to laboratory to real products By Gary Stix At the IBM Thomas J. Watson Research Laboratory, Charles Bennett is known as a brilliant theoretician--one of the fathers of the emerging field of quantum computing. Like many theorists, he has not logged much experience in the laboratory. His absentmindedness in relation to the physical world once transformed the color of a teapot from green to red when he left it on a double boiler too long. But in 1989 Bennett and colleagues John A. Smolin and Gilles Brassard cast caution aside and undertook a groundbreaking experiment that would demonstrate a new cryptography based on the principles of quantum mechanics. The team put together an experiment in which photons moved down a 30-centimeter channel in a light-tight box called "Aunt Martha's coffin." The direction in which the photons oscillated, their polarization, represented the 0s or 1s of a series of quantum bits, or qubits. The qubits constituted a cryptographic "key" that could be used to encrypt or decipher a message. What kept the key from prying eavesdroppers was Heisenberg's uncertainty principle--a foundation of quantum physics that dictates that the measurement of one property in a quantum state will perturb another. In a quantum cryptographic system, any interloper tapping into the stream of photons will alter them in a way that is detectable to the sender and the receiver. In principle, the technique provides the makings of an unbreakable cryptographic key. Today quantum cryptography has come a long way from the jury-rigged project assembled on a table in Bennett's office. The National Security Agency or one of the Federal Reserve banks can now buy a quantum-cryptographic system from two small companies--and more products are on the way. This new method of encryption represents the first major commercial implementation for what has become known as quantum information science, which blends quantum mechanics and information theory. The ultimate technology to emerge from the field may be a quantum computer so powerful that the only way to protect against its prodigious code-breaking capability may be to deploy quantum-cryptographic techniques. The arrival of the quantum computer may portend the eventual demise of ciphers based on factorization. The challenge modern cryptographers face is for sender and receiver to share a key while ensuring that no one has filched a copy. A method called public-key cryptography is often used to distribute the secret keys for encryption and decoding of a full-length message. The security of public-key cryptography depends on factorization or other difficult mathematical problems. It is easy to compute the product of two large numbers but extremely hard to factor it back into the primes. The popular RSA cipher algorithm, widely deployed in public-key cryptography, relies on factorization. The secret key being transferred between sender and receiver is encrypted with a publicly available key, say, a large number such as 408,508,091 (in practice, the number would be much larger). It can be decrypted only with a private key owned by the recipient of the data, made up of two factors, in this case 18,313 and 22,307. The difficulty of overcoming a public-key cipher may hold secret keys secure for a decade or more. But the advent of the quantum information era--and, in particular, the capability of quantum computers to rapidly perform monstrously challenging factorizations--may portend the eventual demise of RSA and other cryptographic schemes. "If quantum computers become a reality, the whole game changes," says John Rarity, a professor in the department of electrical and electronics engineering at the University of Bristol in England. Unlike public-key cryptography, quantum cryptography should remain secure when quantum computers arrive on the scene. One way of sending a quantum-cryptographic key between sender and receiver requires that a laser transmit single photons that are polarized in one of two modes. In the first, photons are positioned vertically or horizontally (rectilinear mode); in the second, they are oriented 45 degrees to the left or right of vertical (diagonal mode). In either mode, the opposing positions of the photons represent either a digital 0 or a 1. The sender, whom cryptographers by convention call Alice, sends a string of bits, choosing randomly to send photons in either the rectilinear or the diagonal modes. The receiver, known as Bob in crypto-speak, makes a similarly random decision about which mode to measure the incoming bits. The Heisenberg uncertainty principle dictates that he can measure the bits in only one mode, not both. Only the bits that Bob measured in the same mode as sent by Alice are guaranteed to be in the correct orientation, thus retaining the proper value. After transmission, Bob then communicates with Alice, an exchange that need not remain secret, to tell her which of the two modes he used to receive each photon. He does not, however, reveal the 0- or 1-bit value represented by each photon. Alice then tells Bob which of the modes were measured correctly. They both ignore photons that were not observed in the right mode. The modes measured correctly constitute the key that serves as an input for an algorithm used to encrypt or decipher a message. If someone tries to intercept this stream of photons--call her Eve--she cannot measure both modes, thanks to Heisenberg. If she makes the measurements in the wrong mode, even if she resends the bits to Bob in the same way she measured them, she will inevitably introduce errors. Alice and Bob can detect the presence of the eavesdropper by comparing selected bits and checking for errors. Beginning in 2003, two companies--id Quantique in Geneva and MagiQ Technologies in New York City--introduced commercial products that send a quantum-cryptographic key beyond the 30 centimeters traversed in Bennett's experiment. And, after demonstrating a record transmission distance of 150 kilometers, NEC is to come to market with a product at the earliest next year. Others, such as IBM, Fujitsu and Toshiba, have active research efforts. The products on the market can send keys over individual optical-fiber links for multiple tens of kilometers. A system from MagiQ costs $70,000 to $100,000. "A small number of customers are using and testing the system, but it's not widely deployed in any network," comments Robert Gelfond, a former Wall Street quantitative trader who in 1999 founded MagiQ Technologies. Some government agencies and financial institutions are afraid that an encrypted message could be captured today and stored for a decade or more--at which time a quantum computer might decipher it. Richard J. Hughes, a researcher in quantum cryptography at Los Alamos National Laboratory, cites other examples of information that must remain confidential for a long time: raw census data, the formula for Coca-Cola or the commands for a commercial satellite. (Remember Captain Midnight, who took over HBO for more than four minutes in 1986.) Among the prospective customers for quantum-cryptographic systems are telecommunications providers that foresee offering customers an ultrasecure service. The first attempts to incorporate quantum cryptography into actual networks--rather than just point-to-point connections--have begun. The Defense Advanced Research Projects Agency has funded a project to connect six network nodes that stretch among Harvard University, Boston University and BBN Technologies in Cambridge, Mass., a company that played a critical role in establishing the Internet. The encryption keys are sent over dedicated links, and the messages ciphered with those keys are transmitted over the Internet. "This is the first continuously running operational quantum-cryptography network outside a laboratory," notes Chip Elliott of BBN, who heads the project. The network, designed to merely show that the technology works, transfers ordinary unclassified Internet traffic. "The only secrets I can possibly think of here are where the parking spaces are," Elliott says. Last fall, id Quantique and a partner, the Geneva-based Internet services provider Deckpoint, put on display a network that allowed a cluster of servers in Geneva to have its data backed up at a site 10 kilometers away, with new keys being distributed frequently through a quantum-encrypted link. The current uses for quantum cryptography are in networks of limited geographic reach. The strength of the technique--that anyone who spies on a key transmittal will change it unalterably--also means that the signals that carry quantum keys cannot be amplified by network equipment that restores a weakening signal and allows it to be relayed along to the next repeater. An optical amplifier would corrupt qubits. To extend the distance of these links, researchers are looking beyond optical fibers as the medium to distribute quantum keys. Scientists have trekked to mountaintops--where the altitude minimizes atmospheric turbulence--to prove the feasibility of sending quantum keys through the air. One experiment in 2002 at Los Alamos National Laboratory created a 10-kilometer link. Another, performed that same year by QinetiQ, based in Farnborough, England, and Ludwig Maximilian University in Munich, stretched 23 kilometers between two mountaintops in the southern Alps. By optimizing this technology--using bigger telescopes for detection, better filters and antireflective coatings--it might be possible to build a system that could transmit and receive signals over more than 1,000 kilometers, sufficient to reach satellites in low earth orbit. A network of satellites would allow for worldwide coverage. The European Space Agency is in the early stages of putting together a plan for an earth-to-satellite experiment. (The European Union also launched an effort in April to develop quantum encryption over communications networks, an effort spurred in part by a desire to prevent eavesdropping by Echelon, a system that intercepts electronic messages for the intelligence services of the U.S., Britain and other nations.) Ultimately cryptographers want some form of quantum repeater--in essence, an elementary form of quantum computer that would overcome distance limitations. A repeater would work through what Albert Einstein famously called "spukhafte Fernwirkungen," spooky action at a distance. Anton Zeilinger and his colleagues at the Institute of Experimental Physics in Vienna, Austria, took an early step toward a repeater when they reported in the August 19, 2004, issue of Nature that their group had strung an optical-fiber cable in a sewer tunnel under the Danube River and stationed an "entangled" photon at each end. The measurement of the state of polarization in one photon (horizontal, vertical, and so on) establishes immediately an identical polarization that can be measured in the other. Entanglement spooked Einstein, but Zeilinger and his team took advantage of a link between two entangled photons to "teleport" the information carried by a third photon a distance of 600 meters across the Danube. Such a system might be extended in multiple relays, so that the qubits in a key could be transmitted across continents or oceans. To make this a reality will require development of esoteric components, such as a quantum memory capable of actually storing qubits without corrupting them before they are sent along to a subsequent link. "This is still very much in its infancy. It's still in the hands of physics laboratories," notes Nicolas Gisin, a professor at the University of Geneva, who helped to found id Quantique and who has also done experiments on long-distance entanglement. A quantum memory might be best implemented with atoms, not photons. An experiment published in the October 22 issue of Science showed how this might work. Building on ideas of researchers from the University of Innsbruck in Austria, a group at the Georgia Institute of Technology detailed in the paper how two clouds of ultracold rubidium atoms could be entangled and, because of the quantum linkage, could be inscribed with a qubit, the clouds storing the qubit for much longer than a photon can. The experiment then transferred the quantum state of the atoms, their qubit, onto a photon, constituting information transfer from matter to light and showing how a quantum memory might output a bit. By entangling clouds, Alex Kuzmich and Dzmitry Matsukevich of Georgia Tech hope to create repeaters that can transfer qubits over long distances. Entanglement spooked Einstein, but researchers have used the phenomenon to "teleport" quantum information. The supposed inviolability of quantum cryptography rests on a set of assumptions that do not necessarily carry over into the real world. One of those assumptions is that only a single photon represents each qubit. Quantum cryptography works by taking a pulsed laser and diminishing its intensity to such an extent that typically it becomes unlikely that any more than one in 10 pulses contains a photon--the rest are dark--one reason that the data transfer rate is so low. But this is only a statistical likelihood. The pulse may have more than one photon. An eavesdropper could, in theory, steal an extra photon and use it to help decode a message. A software algorithm, known as privacy amplification, helps to guard against this possibility by masking the values of the qubits. But cryptographers would like to have better photon sources and detectors. The National Institute of Standards and Technology (NIST) is one of many groups laboring on these devices. "One very interesting area is the development of detectors that can tell the difference between one, two or more photons arriving at the same time," says Alan Migdall of NIST. Researchers there have also tried to address the problem of slow transmission speed by generating quantum keys at a rate of one megabit per second--100 times faster than any previous efforts and enough to distribute keys for video applications. Quantum cryptography may still prove vulnerable to some unorthodox attacks. An eavesdropper might sabotage a receiver's detector, causing qubits received from a sender to leak back into a fiber and be intercepted. And an inside job will always prove unstoppable. "Treachery is the primary way," observes Seth Lloyd, an expert in quantum computation at the Massachusetts Institute of Technology. "There's nothing quantum mechanics can do about that." Still, in the emerging quantum information age, these new ways of keeping secrets may be better than any others in the codebooks. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Paging Black Unicorn, Part 2: Money Laundering in the Geodesic Economy
by R.A. Hettinga 20 Dec '04

20 Dec '04

Here's the article in question... Cheers, RAH ------- <http://www.arraydev.com/commerce/JIBC/9703-12.htm> JIBC Hettinga's Best of the Month Money Laundering in the Geodesic Economy From Robert Hettinga Email:rah@shipwright.com URL: http://www.shipwright.com Robert Hettinga is a financial cryptography strategy and policy consultant in Boston. He is founder of the First International Conference on Financial Cryptography (FC97), the International Financial Cryptography Association, the Digital Commerce Society of Boston, and the e$ and e$pam mail lists. He is also financial cryptography editor of JIBC. From: Black Unicorn <unicorn(a)schloss.li> To: Multiple recipients of <e$(a)thumper.vmeng.com> On Fri, 13 Jun 1997 mfarncombe(a)cc.ernsty.co.uk wrote: > Hi all, > > I suspect that one of the principal things that the Feds are > worried about is the potential for money-laundering. This is a loaded statement. Money laundering is only a concern in so far as it means government control over the economy is diminished. (And to the extent that it allows one to seize the funds a their title converts the to United States at the instant of commission). Money laundering is a "tack on" offense. (Much like, say, mail fraud). The number of original cases which derive from actual money laundering investigation is vanishingly small. Instead it is usually added on to an indictment when the defendant is or has been under investigation for something else. Because money laundering statutes are generally phrased something like "knowingly concealing the proceeds of a criminal act," usually you find the criminal act first and then look to see if attempts were made to conceal the funds. Professional money launderers are rarely caught. > At the moment, conversion of money from illegal sources (drug > sales, extortion by terrorists, major theft etc) into the legal > economy (equities, bonds, property etc) is difficult because > any financial institution is obliged, in most parts of the > world, to obtain proof of identity of its clients and toreport > suspicions of wrongdoing. I disagree rather strongly. Currently the favorate method is to hand the cash, in bulk, to the professional money launderer who, on the spot, cuts a clean bank check (perhaps from a reputable import/export or realestate company) for the cash amount minus fee (5-20% usually). The launderer takes all the risk in the process, including smuggling the funds out, hashing them through iterations and (usually) returning them right back into the United States as legitimate overseas investment. It's like the separation of capital and management skill. The money launderer is free to concentrate 100% of his time to managing his extensive laundering empire, the hundreds or thousands of shells and webs of accounts and maintains the liquidity to drop 5 million on the notice of a phone call. > Hence, I suspect, the $750 limit. > The reason for this check is that it is otherwise very easy to > shuffle funds back and forth between financial instruments to > confuse the trail and defeat the cops. The $750 limit is going to do about nothing for the problem of money money laundering. It will inconvenience the casual launderer, and that is about all. What it will do is put a significant cost on the head of the consumer. A CTR costs a bank between $5 and $15 to file today (according to the ABA). $17 if you listen to the Report of the Financial Action Task Force on Money Laundering. In 1993 the 368 largest banks (assets over $1 billion) filed 4.5 million CTRs. The cost was estimated at $72 million dollars. (John Byrne, General Counsel, American Bankers Association). 10,765,000 CTRs were filed in 1994. About .5% are marked "suspicious." Now the $750 limit? The number of reports to be filed is staggering and .5% is beyond government to police properly without 5,000 new hires. No, clearly the $750 limit is not to catch money launderers, but to create and perpetuate detailed transactions record keeping. FinCEN is much more useful to link transactions to defendents in non-money laundering cases. "What do you mean you weren't in California in May? Our records show you accepted two wire transfers there on the 15th and the 16th." And consider this. If I build a machine which has a 95% accuracy rate in detecting money laundering, that is to say that it will identify a given transaction as money laundering or legitimate with 95% accuracy, I still have a serious problem. Given 10,000 transactions, with .2% (20) representing money laundering we find the following figures: 19 (95% of 20) money laundering transactions will be flagged as illegal 1 (5% of 20) laundering transaction will be incorrectly flagged as legal. 500 (5% of 10,000) legitimate transactions will be incorrectly flagged as illegal. For every one money laundering transaction flagged there will be 26 legitimate transactions flagged and only about 3.6% of all the flagged transactions will actually be illegitimate. Now consider all this in context. There are over 700,000 wire transfers a day amounting to over $2 trillion. About half go through FedWIRE and CHIPS. SWIFT is harder to count. The most pro-government figures have somewhere on the order of $400bln a YEAR being laundered. The figure I used above (.2% of transactions are money laundering) is high by orders of magnitude. Depending on who's figures you use it's more like 0.008%. > I can't subscribe to the full libertarian view that there's no > such thing as right and wrong, only freedoms and restrictions. > Because of this, I think we have to accept that the Feds have a > valid concern, as instant and frequent movement of large sums > of untraceable, impersonal e-cash would mean that the only way > to stop money laundering would be to check the identity of > anyone converting real-cash into e-cash. Now that does perturb > me... What you do not address is what is wrong with money laundering. Money laundering was never a crime until 1986 in the United States, [Money Laundering Control Act of 1986 (Codified @ sections 1956 and 1957 of Title 17 of the U.S. Code)] and then only made so because it fit in the "war on drugs." The result: Total financial transparency in the U.S. Money laundering is a created offense. Also consider that becuase current efforts to curb money laundering are basically useless, you may see identity checking anyhow. (The $750 limit is basicially an identity checking provision already). Money laundering is a crime because the drug market in the United States is so substantial it is impossible to police it without following the money. You can't do that unless you have near financial transparency. > Given the response of governments to anything untaxed (eg > running drugs that aren't tobacco), these regulations could > stay with us for years to come. Has anyone got another > foolproof scheme to foil e$-laundering? Deep down even you seem to recognize that Money Laundering has nothing to do with catching criminals. It's all about control and revenue. The feds would do better to concentrate intelligence assets (more so than now) on counter narcotics and do their best to schedule raids to seize cash when it's sitting around than to track every transaction on the planet. I don't have it here, but if anyone is interested I had a report on the costs of Money Laundering enforcement I can try and dig up. One of the interesting figures was the number of dollars spent to stop one dollar from being laundered (Around $35,000 as I recall) and the number spent to seize one dollar of laundered money (Around $110,000). > Martin Farncombe,Ernst & Young UK > (views represented are personal, not corporate) -- -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Paging Black Unicorn (was RE: Costs of Money Laundering Enforcement)
by R.A. Hettinga 20 Dec '04

20 Dec '04

Contact him directly, please... Cheers, RAH -------- --- begin forwarded text

1 0

All Horsemen, All the Time: On the Open Internet, a Web of Dark Alleys
by R.A. Hettinga 20 Dec '04

20 Dec '04

Horsemen of the Infocalypse, that is... Cheers, RAH ------- <http://www.nytimes.com/2004/12/20/technology/20covert.html?th=&pagewanted=p…> The New York Times December 20, 2004 On the Open Internet, a Web of Dark Alleys By TOM ZELLER Jr. The indictment early this month of Mark Robert Walker by a federal grand jury in Texas might have seemed a coup for the government in its efforts to police terrorist communications online. Mr. Walker, a 19-year-old student, is accused, among other things, of using his roommate's computer to communicate with - and offer aid to - a federally designated terrorist group in Somalia and with helping to run a jihadist Web site. "I hate the U.S. government," is among the statements Mr. Walker is said to have posted online. "I wish I could have been flying one of the planes on Sept. 11." By international terror standards, it was an extremely low-level bust. But the case, which was supposedly broken only after Mr. Walker's roommate tipped off the police, highlights the near impossibility of tracking terrorist communications online. Even George J. Tenet, the former director of central intelligence, speaking on the vulnerabilities of the nation's computer networks at a technology security conference on Dec. 1, noted the ability of terrorists to "work anonymously and remotely to inflict enormous damage at little cost or risk to themselves." He called for a wholesale taming of cyberspace. "I know that these actions would be controversial in this age where we still think the Internet is a free and open society with no control or accountability," Mr. Tenet said, "But, ultimately, the Wild West must give way to governance and control." Even if the government is able to shore up its networks against attack - one of many goals set forth by the intelligence reform bill passed last week - the ability of terrorists and other dark elements to engage in covert communications online remains a daunting security problem, and one that may prove impossible to solve. Late last month, an Internet privacy watchdog group revealed that the Central Intelligence Agency had contributed money for a counterterrorism project that promised, among other things, an automated surveillance system to monitor conversations on Internet chat rooms. Developed by two computer scientists at Rensselaer Polytechnic Institute in Troy, N.Y., as part of a National Science Foundation program called Approaches to Combat Terrorism, the chat room project takes aim at the possibility that terrorists could communicate through crowded public chat channels, where the flurry of disconnected, scrolling messages makes it difficult to know who is talking to whom. The automated software would monitor both the content and timing of messages to help isolate and identify conversations. Putting privacy concerns aside, some Internet specialists wonder whether such projects, even if successful, fail to acknowledge the myriad other ways terrorists can plot and communicate online. From free e-mail accounts and unsecured wireless networks to online programs that can shield Internet addresses and hide data, the opportunities to communicate covertly are utterly available and seemingly endless. Even after the Sept. 11 attacks, "the mass media, policy makers, and even security agencies have tended to focus on the exaggerated threat of cyberterrorism and paid insufficient attention to the more routine uses made of the Internet," Gabriel Weimann, a professor of communication at Haifa University in Israel, wrote in a report for the United States Institute of Peace this year. "Those uses are numerous and, from the terrorists' perspective, invaluable." Todd M. Hinnen, a trial attorney with the United States Justice Department's computer crime division, wrote an article on terrorists' use of the Internet for Columbia Science and Technology Law Review earlier this year. "There's no panacea," Mr. Hinnen said in an interview. "There has always been the possibility of meeting in dark alleys, and that was hard for law enforcement to detect." Now, every computer terminal with an Internet connection has the potential to become a dark alley. Shortly after Sept. 11, questions swirled around steganography, the age-old technique of hiding one piece of information within another. A digital image of a sailboat, for instance, might also invisibly hold a communiqui, a map or some other hidden data. A digital song file might contain blueprints for a desired target. But the troubling truth is that terrorists rarely have to be technically savvy to cloak their conversations. Even simple, prearranged code words can do the job when the authorities do not know whose e-mail to monitor or which Web sites to watch. Interviews conducted by Al Jazeera, the Arab television network, with the terror suspects Khalid Shaikh Mohammed and Ramzi bin al-Shibh two years ago (both have since been arrested), suggested that the Sept. 11 attackers communicated openly using prearranged code words. The "faculty of urban planning," for instance, referred to the World Trade Center. The Pentagon was the "faculty of fine arts." Other reports have suggested that Mohammed Atta, suspected of being the leader of the Sept. 11 hijackers, transmitted a final cryptic message to his co-conspirators over the Internet: "The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts, and the faculty of engineering." And increasingly, new tools used to hide messages can quickly be found with a simple Web search. Dozens of free or inexpensive steganography programs are available for download. And there is ample evidence that terrorists have made use of encryption technologies, which are difficult to break. The arrest in Pakistan in July of Muhammad Naeem Noor Khan, thought to be an Al Qaeda communications specialist, for instance, yielded a trove of ciphered messages from his computers. Still, the mere act of encrypting a message could draw attention, so numerous software programs have been developed to hide messages in other ways. At one Web site, spammimic.com, a user can type in a phrase like "Meet me at Joe's" and have that message automatically converted into a lengthy bit of prose that reads like a spam message: "Dear Decision maker; Your e-mail address has been submitted to us indicating your interest in our briefing! This is a one-time mailing there is no need to request removal if you won't want any more," and so forth. The prose is then pasted into an e-mail message and sent. A recipient expecting the fake spam message can then paste it into the site's decoder and read the original message. Another free program will convert short messages into fake dialogue for a play. And still simpler schemes require no special software at all - or even the need to send anything. In one plan envisioned by Mr. Hinnen in his law review article, a group need only provide the same user name and password to all of its members, granting them all access to a single Web-based e-mail account. One member simply logs on and writes, but does not send, an e-mail message. Later, a co-conspirator, perhaps on the other side of the globe, logs on, reads the unsent message and then deletes it. "Because the draft was never sent," Mr. Hinnen wrote, the Internet service provider "does not retain a copy of it and there is no record of it traversing the Internet - it never went anywhere." The message would be essentially untraceable. Michael Caloyannides, a computer forensics specialist and a senior fellow at Mitretek Systems, a nonprofit scientific research organization based in Falls Church, Va., said the nature of a networked universe made it possible for just about anyone to communicate secretly. Conspirators do not even need to rely on code-hiding programs, because even automated teller machines can be used to send signals, Dr. Caloyannides explained, A simple withdrawal of $20 from an account in New York might serve as an instant message to an accomplice monitoring the account electronically from halfway around the world, for example. Dr. Caloyannides, who will conduct a workshop next May for government officials and others trying to track terrorist communications, also pointed to hundreds of digitally encrypted messages daily on public Usenet newsgroups. The messages often come from faked e-mail accounts; the intended recipients are often unknown. But a covert correspondent expecting a secret communiqui at a particular newsgroup need only download a batch of messages and then use an encryption key on one with some prearranged subject line, "like 'chocolate cake,' " Dr. Caloyannides said. Lt. Col. Timothy L. Thomas, an analyst at the United States Army's Foreign Military Studies Office at Fort Leavenworth, Kan., wrote last year in the journal Parameters, the U.S. Army War College quarterly, that the threat of cyberplanning may be graver than the threat of terrorist attacks on the world's networks. "We used to talk about the intent of a tank," Colonel Thomas explained in an interview. "If you saw one, you knew what it was for. But the intent of electrons - to deliver a message, deliver a virus, or pass covert information - is much harder to figure." This has long frustrated intelligence analysts, according to James Bamford, an author and a specialist on the National Security Agency. "In the cold war days, you knew which communications circuits to watch," he said. "We knew that most of it was high-frequency anyway, so we had the place surrounded by high-frequency intercepts. Those frequencies weren't going anywhere, so you just sat there with the headphones on and listened." The problem now, Mr. Bamford said, is that the corridors for communication have become infinite and accessible to everyone. "You just don't sit and listen to a particular channel," he said. "It's all over the place. It's a 'needle in the haystack' problem that you have." Russ Rogers, a former Arab linguist with the National Security Agency and the Defense Information Systems Agency, said he feared security agencies might not realize how dense the haystack has become. "We've become a little bit arrogant," said Mr. Rogers, the author of a new book, "Hacking a Terror Network: The Silent Threat of Covert Channels," which uses fictional situations to highlight the ways terrorists can communicate secretly online. "We feel like we created the Internet, that we've mastered the network," Mr. Rogers said. "But we're not paying attention to how it's being used to work against us." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Clarke faces ID cards rebellion
by R.A. Hettinga 19 Dec '04

19 Dec '04

<http://news.bbc.co.uk/2/low/uk_news/politics/4109681.stm> The BBC Sunday, 19 December, 2004, 23:41 GMT Clarke faces ID cards rebellion Charles Clarke faces his first real test as home secretary on Monday with a possible backbench rebellion over the controversial ID cards bill. Up to 30 Labour MPs could oppose the scheme during a Commons debate. Mr Clarke, who took on the post on Thursday after David Blunkett quit, has rejected calls to "pause" on the bill. Conservative leader Michael Howard also faces a challenge to his authority as he fights a shadow cabinet battle to get his party to back the measures. Jail terms Senior Tory team members are expected to "go missing" rather than fall into line. " I certainly shall not pause - I will go ahead with the legislation " Home Secretary Charles Clarke Mr Clarke is expected to try and win over opponents to the scheme by saying officials who secretly accessed information they were not allowed to see would face up to two years in jail. He is also expected to announce cut-price ID cards for the elderly and those on lower incomes. But that could push up the estimated #85 price tag, for the card and a passport, for middle class voters. Speaking on his first day in office, Mr Clarke said he would "go ahead" with the legislation. "But the question of how you put it into effect and what you do is a matter of debate," he said. 'Reconsider plans' Critics argue that introducing the cards would be a costly scheme with no specific aim. Ministers say it would help the fight against terrorism, illegal immigration and organised crime. But opponents say that similar schemes in other countries have not prevented attacks like the Madrid rail bombing. Some Labour backbenchers have joined the Liberal Democrats in calling for the plans to be reconsidered. 'Real opportunity' On Sunday, Lib Dem leader Charles Kennedy repeated his call for a "pause" in considering the legislation. " If you were running a family or a business would you have the second reading... tomorrow or would you pause to reflect and see what you might do about it in the New Year " Charles Kennedy He told BBC's Breakfast with Frost programme that Mr Clarke had a "real opportunity" on Monday following the departure of Mr Blunkett. "If you were running a family or a business would you have the second reading of the Identity Cards Bill tomorrow or would you pause to reflect and see what you might do about it in the New Year? "That is the sensible way to go about it but I think this government has got itself so much into tram lines now that it is not behaving sensibly at all." The first cards would be issued in 2008 and, when he was introducing the bill, Mr Blunkett suggested Parliament could decide in 2011 or 2012 whether to make it compulsory for everybody to own the cards, although not to carry them. The new bill would also create new criminal offences on the possession of false identity documents. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [Antisocial] Sept. 11 Conspiracy Theorist
by Major Variola (ret) 19 Dec '04

19 Dec '04

At 06:12 AM 12/19/04 +0100, Anonymous wrote: >Major Variola typed: > >> PS: heard some fedscum mention 'militia and other terrorists' the other >> day, what would Gen George W think? > >which fedscum, do you have a mentionable source, &c.? I haven't found the source, I recall that I heard it. Might have been a quickie comment on eg the Crystal Cathedral shooter. (Their depressed music conductor who alas didn't take Schuller out.) >reminds of the Reno quote, "They have computers and... other weapons of mass >destruction." ..They have computers, they're tappin' phone lines, you know that ain't allowed..

2 1

Identity theft isn't always online crime
by R.A. Hettinga 19 Dec '04

19 Dec '04

<http://www.indystar.com/articles/3/203066-4663-P.html> Color of Money: Michelle Singletary Identity theft isn't always online crime December 19, 2004 Although online shopping has its risks, your credit-card number and other personal information are just as likely to be stolen in a very low-tech way. To identity thieves, a crowded mall is like Chuck E. Cheese is to children -- a paradise of commotion. Criminals are just waiting for you to leave your purse unattended or open as you hustle around looking for holiday gifts. They love men who carry their wallets in easy-to-pick places. According to an American Express study, consumers have a lot to learn about protecting themselves against identity theft. While 77 percent claim they take precautions to secure their information, nearly half still make the mistake of carrying their Social Security numbers in their wallets. Twenty-eight percent of those surveyed don't check to see if a Web site is secure when shopping online. Here are some tips to help you avoid being a victim of holiday identity thieves: * Write "check photo ID" in ink on the back of your credit card near your signature. This is an effective way of getting cashiers to check the credit card against your photo identification. * Michael J. Zmistowski, a financial adviser in Tampa, Fla., sent this tip to his clients: While shopping, watch out for anyone standing nearby who has a cell phone with a camera. Someone can easily take a clear picture of the data on your credit card. * Come January, you may not want to look at your credit-card statements. But you must. Open them immediately and check for unfamiliar purchases. In fact, keep all the receipts from your holiday shopping sprees in one place so you can cross- check them with your statements. * Don't be a victim of "phishing," in which crooks send e-mails that look as if they come from legitimate companies requesting certain information. According to the Anti-Phishing Working Group, phishing e-mails persuade up to 5 percent of recipients to respond. When they do, consumers typically provide information such as credit-card, bank and Social Security numbers or user names and passwords -- resulting in identity theft. Be suspicious of e-mail that is sent to you unsolicited. * Buy a shredder and use it, especially to destroy any store receipts with your full credit-card number. * If you shop online, make sure the site is secure. According to the Better Business Bureau, sites that have technology to secure transactions will have "https" instead of "http" in the Web address of the page that asks for credit-card information. Another indication the site is secure is an icon of a locked padlock. * If you suspect that your identity has been stolen, don't wait until after the holidays to report the crime. You need to contact your creditors and the three major credit bureaus immediately. You need to call only one credit bureau to place fraud alerts on all three of your credit reports. A fraud alert is supposed to result in creditors contacting you before opening any new accounts or making changes to your existing accounts. The Federal Trade Commission has a link on its Web site outlining steps to take if you are a victim of identity theft. Go to www.ftc.gov, and click on the link for consumers. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Militia or other Terrorists?
by Major Variola (ret) 19 Dec '04

19 Dec '04

>> PS: heard some fedscum mention 'militia and other terrorists' the other >> day, what would Gen George W think? > >which fedscum, do you have a mentionable source, &c.? It was ATF, about some gun-robbers; it seems to be a reply to trollbait by the Faux news channel or spontaneous dreck. http://www.gunmuse.com/News/Are%20they%20Terrorist%20or%20Militia Are they Terrorist or MilitiaBY GunMuse That was the question asked and answered to by Fox News to the ATF in Michigan Gun store robberies. This is a prime example of where we see our gun organizations failing to take action. Those words are not interchangeable. The Clinton administration tried to make it that way while they rewrote the constitution via executive orders, and gave away federal lands and national treasures (Like the liberty bell) to the United Nations. This is a defamation of character to interchange these words. Militias are required to by the constitution to be a citizen protection from government corruption and abuse of power on its own people. Its the very reason that the military can not be used to police US citizens for any reason. More than 300 firearms have been stolen from local dealers in a short period of time. The thieves were caught on film using a shotgun to blast open the front door running to the back display cases and grabbing as many pistols as they could carry and were gone in less than 1 minute and 15 seconds. The ATF said they already had suspects and had issued a federal search warrant in the case and then was asked the question. Are the robbers terrorist or Militia? Lumping American patriots and believers in a strong constitutional government in the same boat as those who attacked New York.

1 0

RE: [Antisocial] Sept. 11 Conspiracy Theorist
by Major Variola (ret) 18 Dec '04

18 Dec '04

At 05:33 PM 12/17/04 -0500, Tyler Durden wrote: >"I am a patriot fighting the real traitors who are destroying our >democracy. I resent it when they call me delusional," he said. > >Tee hee hee... Indeed. The dude shows that 1. ability to inherit $$$ doesn't imply brains 2. he should take a structural engineering class 3. he might appreciate the hubris of Architects (tm) but that requires #2 If he really gave a shat he'd investigate the RDX stored in the Murrah building, next to daycare, but that was just a (.mil trained) 'Merican, not a bunch of specops Ay-rabs. JYA may be Architects (snicker) but methinks he groks structures, and even if not, his cryptome penance absolves him from the sins of the artsy. PS: heard some fedscum mention 'militia and other terrorists' the other day, what would Gen George W think? (Ans: The general would ask, why do we not guillotine the bastards?)

2 1

A.C.L.U.'s Search for Data on Donors Stirs Privacy Fears
by R.A. Hettinga 18 Dec '04

18 Dec '04

<http://www.nytimes.com/2004/12/18/national/18aclu.html?ei=5006&en=1fb103f41…> The New York Times December 18, 2004 A.C.L.U.'s Search for Data on Donors Stirs Privacy Fears By STEPHANIE STROM he American Civil Liberties Union is using sophisticated technology to collect a wide variety of information about its members and donors in a fund-raising effort that has ignited a bitter debate over its leaders' commitment to privacy rights. Some board members say the extensive data collection makes a mockery of the organization's frequent criticism of banks, corporations and government agencies for their practice of accumulating data on people for marketing and other purposes. Daniel S. Lowman, vice president for analytical services at Grenzebach Glier & Associates, the data firm hired by the A.C.L.U., said the software the organization is using, Prospect Explorer, combs a broad range of publicly available data to compile a file with information like an individual's wealth, holdings in public corporations, other assets and philanthropic interests. The issue has attracted the attention of the New York attorney general, who is looking into whether the group violated its promises to protect the privacy of its donors and members. "It is part of the A.C.L.U.'s mandate, part of its mission, to protect consumer privacy," said Wendy Kaminer, a writer and A.C.L.U. board member. "It goes against A.C.L.U. values to engage in data-mining on people without informing them. It's not illegal, but it is a violation of our values. It is hypocrisy." The organization has been shaken by infighting since May, when the board learned that Anthony D. Romero, its executive director, had registered the A.C.L.U. for a federal charity drive that required it to certify that it would not knowingly employ people whose names were on government terrorism watch lists. A day after The New York Times disclosed its participation in late July, the organization withdrew from the charity drive and has since filed a lawsuit with other charities to contest the watch list requirement. The group's new data collection practices were implemented without the board's approval or knowledge, and were in violation of the A.C.L.U.'s privacy policy at the time, said Michael Meyers, vice president of the organization and a frequent and strident internal critic. Mr. Meyers said he learned about the new research by accident Nov. 7 in a meeting of the committee that is organizing the group's Biennial Conference in July. He objected to the practices, and the next day, the privacy policy on the group's Web site was changed. "They took out all the language that would show that they were violating their own policy," he said. "In doing so, they sanctified their procedure while still keeping it secret." Attorney General Eliot Spitzer of New York appears to be asking the same questions. In a Dec. 3 letter, Mr. Spitzer's office informed the A.C.L.U. that it was conducting an inquiry into whether the group had violated its promises to protect the privacy of donors and members. Emily Whitfield, a spokeswoman for the A.C.L.U., said the organization was confident that its efforts to protect donors' and members' privacy would withstand any scrutiny. "The A.C.L.U. certainly feels that data privacy is an extremely important issue, and we will of course work closely with the state attorney general's office to answer any and all questions they may have," she said. Robert B. Remar, a member of the board and its smaller executive committee, said he did not think data collection practices had changed markedly. He recalled that the budget included more money to cultivate donors but said he did not know what specifically was being done. Mr. Remar said he did not know until this week that the organization was using an outside company to collect data or that collection had expanded from major donors to those who contribute as little as $20. "Honestly, I don't know the details of how they do it because that's not something a board member would be involved in," he said. The process is no different than using Google for research, he said, emphasizing that Grenzebach has a contractual obligation to keep information private. The information dispute is just the latest to engulf Mr. Romero. When the organization pulled out of the federal charity drive, it rejected about $500,000 in expected donations. Mr. Romero said that when he signed the enrollment certification, he did not think the A.C.L.U. would have to run potential employees' names through the watch lists to meet requirements. The board's executive committee subsequently learned that Mr. Romero had advised the Ford Foundation, his former employer, to follow the nation's main antiterrorism law, known as the Patriot Act, in composing language for its grant agreements, helping to ensure that none of its money inadvertently underwrites terrorism or other unacceptable activities. The A.C.L.U., which has vigorously contended that the act threatens civil liberties, had accepted $68,000 from Ford under the new terms by then. The board voted in October to return the money and reject further grants from Ford and the Rockefeller Foundation, which uses similar language in its grant agreements. In 2003, Mr. Romero waited several months to inform the board that he had signed an agreement with Mr. Spitzer to settle a complaint related to the security of the A.C.L.U.'s Web site. The settlement, signed in December 2002, required the agreement to be distributed to the board within 30 days, and Mr. Romero did not hand it out until June 2003. He told board members that he had not carefully read the agreement and that he did not believe it required him to distribute it, according to a chronology compiled by Ms. Kaminer. Many nonprofit organizations collect information about their donors to help their fund-raising, using technology to figure out giving patterns, net worth and other details that assist with more targeted pitches. Because of its commitment to privacy rights, however, the A.C.L.U. has avoided the most modern techniques, according to minutes of its executive committee from three years ago. "What we did then wasn't very sophisticated because of our stance on privacy rights," said Ira Glasser, Mr. Romero's predecessor. Mr. Glasser, who resigned in 2001, said the group had collected basic data on major donors and conducted a ZIP code analysis of its membership for an endowment campaign while he was there. He said it had done research on Lexis/Nexis and may have looked at S.E.C. filings. Mr. Meyers said he learned on Nov. 7 that the A.C.L.U.'s data collection practices went far beyond previous efforts. "If I give the A.C.L.U. $20, I have not given them permission to investigate my partners, who I'm married to, what they do, what my real estate holdings are, what my wealth is, and who else I give my money to," he said. On Nov. 8, the privacy statement on the A.C.L.U. Web site was replaced with an "Online Privacy Policy." Until that time, the group had pledged to gather personal information only with the permission of members and donors. It also said it would not sell or transfer information to a third party or use it for marketing. Those explicit guarantees were eliminated from the Web site after Mr. Meyers raised his concerns about the new data-mining program at the Nov. 7 meeting. After learning of Mr. Spitzer's inquiry, the executive committee of the board took up the data-mining issue on Dec. 14. Board members are allowed to listen in on any executive committee meeting, and Mr. Meyers asked the panel to participate in its conference call. The first item on the agenda was whether he could be on the line. The executive committee voted 9 to 1 to bar him and had a staff member inform him that the meeting was of the board of the A.C.L.U. Foundation, not the group's executive committee, and thus he was excluded. Mr. Remar, who has been a board member for 18 years, said board members had been asked to leave executive committee meetings during personnel discussions, but Mr. Meyers said it was a first. Mr. Remar said the data collection efforts were a function of the foundation, and thus the executive committee had met as the foundation board. But Mr. Romero convened a meeting of the executive committee, and Mr. Spitzer's letter was addressed to the A.C.L.U., with no mention of the foundation. Mr. Meyers said his exclusion raises a profound issue for other board members. "Their rationale for excluding me implicitly means that they can't share anything with the board, but the board as a whole has fiduciary responsibilities," he said. "How can board members do their duty if information is withheld from them?" -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0