- cypherpunks-legacy - lists.cpunks.org

Report: Govt secrecy hurting warfighters
by R.A. Hettinga 17 Dec '04

17 Dec '04

<http://www.upi.com/view.cfm?StoryID=20041215-075709-5911r> United Press International: Report: Govt secrecy hurting warfighters By Shaun Waterman UPI Homeland and National Security Editor Published 12/15/2004 8:19 PM WASHINGTON, Dec. 15 (UPI) -- The current system for protecting government information is outdated, almost unworkable and makes the "information flow to the war fighter ... excessively constricted," according to a report prepared for the Department of Defense by a secretive scientific advisory panel. The panel, known as the Jason Group, reviewed the system used to classify sensitive government information at the request of the Office of Defense Research and Engineering in the Pentagon. The group concluded that the classification system is so unwieldy -- especially in battlefield situations -- that it is often bypassed altogether by frustrated military personnel and "ought to be radically changed." "Users," the report stated, "see an overly rigid, out of date, bureaucratic structure of information classification ... and an individual clearance process that is glacially slow, and under which large numbers of fighting men and women are, in practical terms, unclearable." As a result, the report said, "under-classification of documents -- often quietly justified as necessary for ease in transporting documents between meeting sites -- is a well known practice." For example, the report said that imagery from the top-secret Predator unmanned aerial reconnaissance vehicle is unclassified, with troops relying on "an ad hoc system of operational practices" to protect it. "The current situation of out of date or operationally unimplementable rules, combined with widespread violation of those rules, is a bad place to be," concludes the report, a copy of which was obtained by United Press International from the Federation of American Scientist's Project on Government Secrecy. J. William Leonard, the federal government's secrecy watchdog, agreed in broad terms with the report's critique. "I drawn a vast distinction between the tactical military environment and the bureaucracy here in Washington," Leonard, who runs the Information Security Oversight Office, told UPI. "Under certain circumstances," like an imminent threat of terrorism, or on the battlefield, "there can be greater damage caused by classifying and not sharing information." Leonard said that amendments to the classification system after Sept. 11, 2001, had given more flexibility to agencies to share classified information -- even with people not authorized to see it -- under such emergency circumstances. Even in day-to-day operations, he said, "The system provides a degree of flexibility to agencies. But," he added, "there is very little realization of this. I'm concerned that not enough use is made of this flexibility." But the report pointed out that this flexibility is very hard to calibrate. "In the present system there is no way to turn up or down the knob that governs the tradeoff between security and operational needs. There is no way, in time of war or in a particular area of operations, to 'moderately increase' all players' access to secret information ... there are too few steps between highly secret and totally open," it stated. The report pointed out that the current system was devised in the 1940s and has remained basically unchanged since, despite the enormous revolution in information wrought by the advent of personal computers and the Internet. "The classification system is a product of the industrial age, not the information age we live in now," Leonard said. "It is a document-centered system," Leonard continued. "We need a new framework for guarding national security information that is more suited to the information age and accounts for the huge changes there have been in the last 60 years." The Jason Group report concluded with a call for just such a system, one based on transactional risk -- that is the chance that any given transaction will be compromised, rather than on assigning a level of classification to a document based on the potential damage caused by disclosure. "It is obvious that the one-time display of a classified document on a (secure) computer terminal to a (cleared) individual -- which we can call 'soft access' -- is inherently less risky than providing that same individual with a paper copy of the same document -- 'hard access.'" But Leonard pointed out that the current government rules only tell agencies what they can classify, not what they must keep secret. Each government agency uses the rules as the basis for its own classification guidance. "A lot of the concepts and recommendations of the report could be implemented to some extent under the current system, if agencies issued new classification guidance that took more account of the changed circumstances we now find," he said. Such calls may fall on more fertile ground than they have in the past. Porter Goss, now the director of the central intelligence and the man charged with managing the whole classification system, told UPI last year that over-classification was a persistent problem in U.S. intelligence agencies. "The problem is, it's a ratchet," he said. "It only turns one way. There are very serious consequences for failure to classify sensitive information. There tend to be no adverse consequences -- at least not to someone's career -- of classifying something that doesn't need to be classified." The Jason Group report is the latest in a series of recent critiques of the classification system, but the first to identify under-classification as a problem. Most previous critiques have focused on the reverse problem. For instance, the Sept. 11 commission found in its final report that "current security requirements nurture over-classification" -- making documents secret when they do not really need to be -- and found that, in turn, to be a barrier to the information sharing between agencies and with local law enforcement that is vital to the fight against terrorism. The commission's Chairman Tom Kean, the former GOP governor of New Jersey, has said that one of the great surprises of the unprecedented access he and his fellow commissioners were given to highly classified government documents was finding out how much of it he already knew from reading the newspapers. In a similar vein, the official in charge of information security at the Pentagon told a congressional panel Aug. 24 that at least half of the information the U.S. government classifies every year should not be kept secret. Deputy Undersecretary of Defense for Counter Intelligence and Security Carol Haave testified before a House panel led by Rep. Chris Shays, R-Conn. Shays called the system for safeguarding the nation's secrets "incomprehensibly complex" and "so bloated it often does not distinguish between the critically important and the comically irrelevant." The panel heard examples of information that was classified by one agency, then released by another; information that was redacted from one part of a document by an agency, but published in another part of the same document; and information that an agency insisted should be classified until it was pointed out it was available on the agency's own Web site. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Get the mads you need now fast shjppijng! tape
by Millicent Broussard 17 Dec '04

17 Dec '04

1 0

Re: Gait advances in emerging biometrics
by Major Variola (ret) 17 Dec '04

17 Dec '04

At 12:28 PM 12/16/04 +0100, Eugen Leitl wrote: > >Anyone who owns that infrastructure is even more dangerous than who 0wns the >voting machines. Very nice quote. Can I get an insurance policy on you, with me as beneficiary?

2 1

pgp "global directory" bugged instructions
by Adam Back 16 Dec '04

16 Dec '04

So PGP are now running a pgp key server which attempts to consilidate the inforamtion from the existing key servers, but screen it by ability to receive email at the address. So they send you an email with a link in it and you go there and it displays your key userid, keyid, fingerprint and email address. Then it says: | Please verify that the email address on this key, adam(a)hashcash.org, | is your email address, and is properly configured to send and | receive PGP secured email. | | If the information is correct, click 'Accept'. By clicking 'Accept', | your key will be published to the directory, where other PGP users | will be able to retrieve it in order to encrypt messages to you and | verify signed messages from you. | | If this information is incorrect, click 'Cancel'. By clicking | 'Cancel', this key will not be published. You may then submit | another key with the correct information. So here's the problem: it does not mention anything about checking that this is your fingerprint. If it's not your fingerprint but it is your email address you could end up DoSing yourself, or at least perpetuating a imposter key into the new supposedly email validated keyserver db. (For example on some key servers there are keys with my name and email that are nothing to do with me -- they are pure forgeries). Suggest they add something to say in red letters check the fingerprint AND keyid matches your key. Adam

2 1

USPS Service Kiosks Taking Pictures of Customers
by Eugen Leitl 16 Dec '04

16 Dec '04

Link: http://slashdot.org/article.pl?sid=04/12/16/1418246 Posted by: michael, on 2004-12-16 15:11:00 from the say-cheese dept. [1]NW writes "According to [2]FOIA documents obtained by EPIC new Postal Service self-service postage machines take portrait-style photographs of customers and retain them for 30 days." IBM is the [3]contractor behind the kiosks. Note that the kiosk is supposed to not complete the transaction if it determines the photograph has been compromised, so simply covering the camera is unlikely to work. As the cost of cameras and digital storage approaches zero, is it inevitable that every machine you interact with will take your photograph and store it? [4]Click Here References 1. http://www.shaftek.org/blog/ 2. http://www.epic.org/privacy/postal/ 3. http://www-1.ibm.com/kiosk/government.html 4. http://ads.osdn.com/?ad_id=5717&alloc_id=12468&site_id=1&request_id=5057586… p=click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: Off-the-Record Messaging (IM plugin)
by hal＠finney.org 16 Dec '04

16 Dec '04

> Nikita Borisov and Ian Goldberg have released > Off-the-Record Messaging (http://www.xelerance.com/mirror/otr/) It looks like Ian Goldberg's site might be a more authoritative source, http://www.cypherpunks.ca/otr/ . One interesting feature is authentication + deniability. You know who you are talking to, but afterwards anyone who captured a transcript can't prove who said it. Usually we do authentication with digital signatures, but the problem is that binds you to what you say and it can be used against you afterwards. OTR does it by signing the key exchange which creates a MAC key for each direction. (A MAC is a keyed hash which is then applied to each message.) Each message gets MAC'd and this way you know that the messages are authentic and untampered. This already protects you against your conversant; both of you know the MAC keys in each direction (one knows them in order to MAC new messages; the other knows them in order to verify the MAC), so each guy can forge messages created by the other guy and create a bogus transcript. That means that neither person can publish a transcript and credibly claim that it authentically represents what was said. Then, there's another trick: when you are through with them you publish your MAC keys, in the clear. This does not compromise secrecy; all of the data is encrypted with a different key. But it means that now, anyone could in retrospect forge a transcript showing you saying anything at all. And that of course means that no such transcript has any credibility in terms of providing cryptographic evidence of what you said. Hal

1 0

Off-the-Record Messaging (IM plugin)
by lcs Mixmaster Remailer 16 Dec '04

16 Dec '04

Nikita Borisov and Ian Goldberg have released Off-the-Record Messaging (http://www.xelerance.com/mirror/otr/) an IM plugin for private communication providing not only the usual encryption and authentication, but also deniability and perfect forward secrecy. Deniability avoids digital signatures on messages (while preserving authenticity and integrity), so there is no hard-to-deny proof you wrote anything in particular; in fact, there is a toolkit to help people forge messages, making it extra-hard to pin things on you. Perfect forward secrecy means that your past messages and conversations remain protected even if your keys are compromised. You can read the OTR protocol description, download the source code for the gaim-otr plugin, or grab a gaim-otr binary package for Debian or Fedora Core.

1 0

[ISN] An Indonesian's Prison Memoir Takes Holy War Into Cyberspace
by R.A. Hettinga 16 Dec '04

16 Dec '04

--- begin forwarded text

1 0

Blunkett hands in cards after prints found on visa
by R.A. Hettinga 16 Dec '04

16 Dec '04

<http://www.theregister.co.uk/2004/12/15/blunkett_checks_out/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2004/12/15/blunkett_checks_out/ Blunkett hands in cards after prints found on visa By John Lettice (john.lettice at theregister.co.uk) Published Wednesday 15th December 2004 23:11 GMT David Blunkett, UK Home Secretary and prime mover behind the British ID card scheme, resigned this evening after further revelations concerning the residency application of his lover's nanny. Emails seen by Sir Alan Budd's enquiry made it clear that - contrary to Home Office denials - the letter to the nanny warning of a possible 12 month delay had been dealt with by his office. This was critical to Blunkett's defence. He had claimed that he merely checked over the initial application, and when over the weekend it was claimed (http://www.theregister.co.uk/2004/12/13/blunkett_bashes_dti/) that he had produced the letter from the immigration service in a meeting with senior civil servants, a Home Office spokesman insisted that he had had "no contact with the letter at all, at any stage." In a statement (http://news.bbc.co.uk/1/hi/uk_politics/4099761.stm) tonight, Blunkett concedes that Budd's enquiry has identified "a fax and an exchange of emails between my office and the Immigration and Nationality Directorate" based on the letter that he had had "no contact" with. He says that he was "always aware"of this letter, "but did not remember holding a copy. I have no recollection of dealing with this in any way... I have no recollection of issuing instructions to deal with the application, but only to continuing the elimination of the backlog in general". The email is reported to have said "no favours but slightly quicker." We at The Register feel that we would have trouble figuring out how that works even if we were sober. Which we are not entirely; but, since you ask, this evening's Privacy International Christmas bash went rather better than one could possibly have expected. Education Secretary Charles Clarke wins the ID scheme poisoned chalice. He commented that there would be continuity between his approach and Blunkett's; the immigration status of any paramours which Clarke may or may not have is not known at time of press. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] An Indonesian's Prison Memoir Takes Holy War Into Cyberspace
by InfoSec News 16 Dec '04

16 Dec '04

Forwarded from: William Knowles <wk(a)c4i.org> http://www.washingtonpost.com/wp-dyn/articles/A62095-2004Dec13.html By Alan Sipress Washington Post Foreign Service December 14, 2004 JAKARTA, Indonesia -- After Imam Samudra was charged with engineering the devastating Bali nightclub bombings two years ago, he taunted his police accusers in court, then greeted his death sentence with the cry, "Infidels die!" So when Samudra published a jailhouse autobiography this fall, it was not surprising that it contained virulent justifications for the Bali attacks, which killed 202 people, most of them foreign tourists. But tucked into the back of the 280-page book is a chapter of an entirely different cast titled "Hacking, Why Not?" There, Samudra urges fellow Muslim radicals to take the holy war into cyberspace by attacking U.S. computers, with the particular aim of committing credit card fraud, called "carding." The chapter then provides an outline on how to get started. The primer on carding is rudimentary, according to U.S. and Indonesian cybercrime experts, but they said the chapter provides a rare glimpse into the mounting threat posed by terrorists using Internet fraud to finance their operations. "The worry is that an army of people doing cybercrime could raise a great deal of money for other activities that terrorists are carrying out," said Alan Paller, research director of the Sans Institute, a U.S. Internet-security training company. Samudra, 34, is among the most technologically savvy members of Jemaah Islamiah, an underground Islamic radical movement in Southeast Asia that is linked to al Qaeda. He sought to fund the Bali attacks in part through online credit card fraud, according to Indonesian police. They said Samudra's laptop computer revealed an attempt at carding, but it was unclear whether he had succeeded. Internet crime experts said Samudra's book seems unprecedented as a tool for recruiting radical Muslims into a campaign of online fraud and building networks of fundraisers. "This is exactly the kind of advice you would give someone who wanted to get started in cybercrime," said Paller, who reviewed a translation of the chapter. "It doesn't focus on a specific technique, but focuses on how you find techniques and focuses on connecting with other people to act loosely together." Titled "Me Against the Terrorist!" the book depicts Samudra on the cover in a now-classic pose from his trial last year in Bali. He is clad in a white shirt and white Muslim skullcap, with his right arm outstretched and a single finger raised as he lectures the judges. Four thousand copies in Indonesian have been issued by a small publisher and are selling for about $4 each in at least seven cities across the islands of Java and Sumatra, said Achmad Michdan, Samudra's attorney, who wrote the forward. Michdan said the publisher is planning a second run and is considering translating the book into English, French and Arabic. Profits benefit Samudra's wife and children. Samudra remains on death row. Most of the book is a memoir that tracks Samudra from his early schooling in Java, through his arms training in the Afghan mountains, his exile in Malaysia and his return to Indonesia. It includes arguments for killing Western civilians and bitter critiques of U.S. policy in Israel, Afghanistan and Iraq, including photographs of Muslim civilian casualties. Toward the end, Samudra informs readers that the United States is not as invincible as they might think. "It would not be America if the country were secure. It would not be America if its computer network were impenetrable," he writes at the beginning of the hacking chapter. He continues by urging fellow militants to exploit this opening: "Any man-made product contains weakness because man himself is a weak creature. So it is with the Americans, who boast they are a strong nation." The chapter is less a how-to manual than a course of study for aspiring hackers and carders. Samudra directs them to specific Indonesian-language Web sites that provide instruction. For those who find these sites too sophisticated, he counsels first learning computer programming languages, in particular Linux, and suggests several other Web sites, including one run by young Muslims. Then he advises learning about hacking by finding mentors through online chats. He lists six chat rooms as sources. Next, Samudra discusses the process of scanning for Web sites vulnerable to hacking, then moves on to a three-page discussion on the basics of online credit card fraud and money laundering. "This is hacking for dummies," said Evan F. Kohlmann, a U.S. consultant on international terrorism who also reviewed the chapter. "But in this day and age, you don't have to be an expert hacker to have a tremendous impact." Kohlmann and other cyberterrorism experts said the kind of online fraud preached by Samudra is becoming increasingly attractive as a source of funding for al Qaeda operatives in several regions of the world. One of the chief hazards posed by Samudra's book is that it could direct religious extremists into the company of more accomplished hackers. Indonesian police assert their country now has more online credit card fraud than any other in the world. "If you succeed at hacking and get into carding, be ready to make more money within three to six hours than the income of a policeman in six months," Samudra tells his readers. "But don't do it just for the sake of money." He adds, "Remember, the main duty of Muslims is jihad in the name of God, to raise arms against the infidels, especially now the United States and its allies." Samudra had first sought to finance the Bali nightclub attacks by ordering the robbery of a shop selling gold jewelry in western Java. The heist allegedly netted five pounds of gold and $500. Then he turned to more lucrative targets on the Internet, police and prosecutors said. At Samudra's trial, police testified that his computer had been used to communicate in chat rooms with others involved in online credit card fraud and contained information on ways to obtain credit card details. Petrus Reinhard Golose, head of cybercrimes investigations for the Indonesian police, said in an interview that Samudra had asked for religious permission to conduct carding from Abubakar Baasyir, the radical cleric and alleged head of Jemaah Islamiah now on trial in Jakarta in connection with terrorist bombings, including the one in Bali. Golose said police did not know whether Baasyir had blessed Samudra's Internet activities. Special correspondent Noor Huda Ismail contributed to this report. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ---------------------------------------------------------------- C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0