- cypherpunks-legacy - lists.cpunks.org

U.S. Funds Chat-Room Surveillance Study
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://www.washingtonpost.com/ac2/wp-dyn/A25272-2004Oct11?language=printer> The Washington Post washingtonpost.com U.S. Funds Chat-Room Surveillance Study By Michael Hill The Associated Press Monday, October 11, 2004; 8:31 PM TROY, N.Y. -- Amid the torrent of jabber in Internet chat rooms - flirting by QTpie and BoogieBoy, arguments about politics and horror flicks - are terrorists plotting their next move? The government certainly isn't discounting the possibility. It's taking the idea seriously enough to fund a yearlong study on chat room surveillance under an anti-terrorism program. A Rensselaer Polytechnic Institute computer science professor hopes to develop mathematical models that can uncover structure within the scattershot traffic of online public forums. Chat rooms are the highly popular and freewheeling areas on the Internet where people with self-created nicknames discuss just about anything: teachers, Kafka, cute boys, politics, love, root canal. They are also places where malicious hackers have been known to trade software tools, stolen passwords and credit card numbers. The Pew Internet & American Life Project estimates that 28 million Americans have visited Internet chat rooms. Trying to monitor the sea of traffic on all the chat channels would be like assigning a police officer to listen in on every conversation on the sidewalk - virtually impossible. Instead of rummaging through megabytes of messages, RPI professor Bulent Yener will use mathematical models in search of patterns in the chatter. Downloading data from selected chat rooms, Yener will track the times that messages were sent, creating a statistical profile of the traffic. If, for instance, RatBoi and bowler1 consistently send messages within seconds of each other in a crowded chat room, you could infer that they were speaking to one another amid the "noise" of the chat room. "For us, the challenge is to be able to determine, without reading the messages, who is talking to whom," Yener said. In search of "hidden communities," Yener also wants to check messages for certain keywords that could reveal something about what's being discussed in groups. The $157,673 grant comes from the National Science Foundation's Approaches to Combat Terrorism program. It was selected in coordination with the nation's intelligence agencies. The NSF's Leland Jameson said the foundation judged the proposal strictly on its broader scientific merit, leaving it to the intelligence community to determine its national security value. Neither the CIA nor the FBI would comment on the grant, with a CIA spokeswoman citing the confidentiality of sources and methods. Security officials know al-Qaida and other terrorist groups use the Internet for everything from propaganda to offering tips on kidnapping. But it's not clear if terrorists rely much on chat rooms for planning and coordination. Michael Vatis, founding director of the National Infrastructure Protection Center and now a consultant, said he had heard of terrorists using chat rooms, which he said offer some security as long as code phrases are used. Other cybersecurity experts doubted chat rooms' usefulness to terrorists given the other current options, from Web mail to hiding messages on designated Web pages that can only be seen by those who know where to look. "In a world in which you can embed your message in a pixel on a picture on a home page about tea cozies, I don't know whether if you're any better if you think chat would be any particular magnet," Jonathan Zittrain, an Internet scholar at Harvard Law School. Since they are focusing on public chat rooms, authorities are not violating constitutional rights to privacy when they keep an eye on the traffic, experts said. Law enforcement agents have trolled chat rooms for years in search of pedophiles, sometimes adopting profiles making it look like they are young teens. But the idea of the government reviewing massive amounts of public communications still raises some concerns. Mark Rasch, a former head of the Justice Department's computer crimes unit, said such a system would bring the country one step closer to the Pentagon's much-maligned Terrorism Information Awareness program. Research on that massive data-mining project was halted after an uproar over its impact on privacy. "It's the ability to gather and analyze massive amounts of data that creates the privacy problem," Rasch said, "even though no individual bit of data is particularly private." ) 2004 The Asso -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Airline ID requirement faces legal challenge
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://www.usatoday.com/tech/news/surveillance/2004-10-10-privacy_x.htm> USA Today Airline ID requirement faces legal challenge By Richard Willing, USA TODAY At a time when Americans have come to expect tight security for air travel, it might seem to be an odd question: Does requiring airline passengers to show identification before they board domestic flights amount to an "unreasonable search" under the Constitution? John Gilmore is challenging the federal domestic airline ID requirement, saying it violates his right to travel in the USA anonymously. File photo Yes, says John Gilmore, a computer whiz who made a fortune as an early employee of Sun Microsystems. His challenge of the federal ID requirement, which soon could get a hearing before a U.S. appeals court in San Francisco, is one of the latest court battles to test the balance between security concerns and civil liberties. At issue is Gilmore's claim that checking the IDs of passengers on domestic flights violates his right to travel throughout the USA anonymously, without the government monitoring him. Lawyers involved in the case say it apparently is the first such challenge to the federal rules that require airline passengers to provide identification. In a similar case, two peace activists are suing the U.S. government to determine how their names came to be placed on a federal "no-fly list." Rebecca Gordon and Janet Adams were not allowed to board a San Francisco to Boston flight in August 2002 after they were told that their names were on a "secret FBI" list of potential security threats, their court filing says. "I believe I have a right to travel in my own country without presenting what amounts to an internal passport," Gilmore, 49, said in an interview. "I have a right to be anonymous, (to not) be tracked by my government for no good reason." Gilmore said he has no problem with security checks that focus on passengers' luggage. He says he also does not object to having to present a passport to board flights to other countries. Some privacy groups say Gilmore has a point. But others who support the ID requirement have cast the San Francisco resident as being out of touch with the realities of air travel since the Sept. 11 attacks. Kent Scheidegger, counsel for the Criminal Justice Legal Foundation, a conservative group in Sacramento, says the ID requirement is good policy and "eminently constitutional." "The Fourth Amendment forbids not searches that you don't like, it forbids unreasonable searches," he says. "Nothing could be more reasonable at this time than to know who you're flying with." The Justice Department is fighting Gilmore's claim. Acting on the department's motion, a U.S. district court judge in San Francisco dismissed the suit last March. Gilmore has appealed; a hearing before the 9th Circuit Court of Appeals is likely to be scheduled after briefs are filed next month. In court papers, the Justice Department has not defended the ID policy, or even acknowledged it exists. It has said national security law requires that this aspect of the case be argued in a courtroom closed to the public, including Gilmore. The appeals court denied the government's secrecy request Sept. 20, and the government has asked the court to reconsider. Rules on the Transportation Security Administration's Web site say passengers 18 and older need one form of government-issued photo identification or two forms of non-photo identification to board domestic flights. Airlines adopted such a policy on their own after terrorists bombed an international flight over Lockerbie, Scotland, in December 1988. The bomb that killed all 270 passengers on the jet was said to have been placed in a passenger's luggage by a terrorist who got into a restricted area. The airlines say checking IDs against luggage and passenger information is a way to deny terrorists access to flights. The TSA, formed two years ago in the wake of the Sept. 11 attacks, checks IDs to verify passenger identities and to check them against "watch lists" of known or suspected terrorists. Gilmore's suit says the requirement amounts to an unreasonable search, a "burden" on the right to travel and a form of self-incrimination because it singles out "anonymous travelers" for searching. Gilmore said the ID requirement does little to ensure security. "Ordinary citizens may show correct identification, but do we really think that someone who is willing to commit a terrorist act won't also be willing to present false identification?" Gilmore's suit was filed in 2002, after he was denied seats on two flights at the airport in Oakland. It was his first domestic flight since the 9/11 attacks. Before then, Gilmore said, he was permitted to board flights after presenting a Federal Aviation Administration document that said showing IDs was optional. In 1982, Gilmore, a computer programmer, was the first person hired by the founders of what became Sun Microsystems. He retired eight years ago with what his publicist, Bill Scannell, calls "multiples" of millions of dollars. Since then, Gilmore said, he has worked to promote "individual rights," in part by sponsoring a foundation that is critical of travel restrictions and what he considers violations of speech and privacy rights. Last year, before taking off on a British Airways flight from San Francisco to London, Gilmore angered fellow travelers by refusing to remove a blue button on his lapel that had the words "suspected terrorist" imposed over the picture of an airliner. After a delay, the pilot went back to the gate and ordered Gilmore off the jet. While his case moves through court, Gilmore has remained grounded when it comes to domestic travel. He hired friends to drive him to San Diego and across the country to attend board meetings of corporate and non-profit groups. He took a driving vacation to Oregon. Invited to a family reunion in Massachusetts, he thought of chartering a private plane but balked at the $33,000 price. "Yes, it can be inconvenient at times," Gilmore said of his fight against the ID requirement. "But I believe I'm right." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

UK ID cards to be issued with first biometric passports
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://www.theregister.co.uk/2004/10/11/new_passport_equals_new_id_card/pri…> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2004/10/11/new_passport_equals_new_id_card/ UK ID cards to be issued with first biometric passports By John Lettice (john.lettice at theregister.co.uk) Published Monday 11th October 2004 07:35 GMT What's left of the 'voluntary' figleaf to the UK's ID scheme will erode in the next few months, when Home Secretary David Blunkett introduces legislation that will allow implementation of the scheme and include provision for a rolling programme to issue ID cards along with passport renewals. The new model passports are closely linked to the scheme anyway, so even without the ID card, being issued one would mean you were added to the national identity register, but the arrival of an actual card along with the new passport will make its presence far more visible, far earlier, to the general public. Previously the Home Office had said it would designate passports and driving licences as ID documents, but hadn't mentioned issuing actual ID cards with them. Blunkett announced the move some considerable way into his speech to the Labour Party Conference ten days ago. Reporting of the speech at the time concentrated on anti-crime measures and more funding for counter-terrorism, and the full text of the speech was mysteriously unavailable until a few days ago. According to this text: "... we will legislate this winter to upgrade our secure passport system, to create a new, clean database on which we will understand and know who is in or country, who is entitled to work, to services, to the something for something society which we value. As people renew their passports, they will receive their new identity card. The cost of biometrics and the card will be added to the total of passports." The increased cost of the new model passport has previously been justified on the basis that the biometrics will be needed in order for the passport to conform to new international standards. Adding the cost of the "voluntary" ID card to the passport is therefore a novel innovation. A similar approach could be adopted as the ID system rolls out to driving licences, with the licence-renewing public having no choice but to accept the ID card if they want a licence, and no choice then but to pay for it. Blunkett did not cover this in his speech, but it may be covered in the forthcoming legislation, and once these two key ID document areas are covered, the rest of the population can be slowly mopped up. The David Blunkett who announced this effectively compulsory ID regime is, strange but true, the very same David Blunkett who, in his introduction to "Legislation on Identity Cards - A Consultation" (CM6178, presented to Parliament in April 2004) said: "...we would proceed by incremental steps, building first on existing, widely held voluntary identity documents, and only taking a final decision later to move to compulsion. Eventually everyone lawfully resident in the UK would be required to register for a card - but there would be no compulsion to carry the card or to produce it without good reason. This move to compulsion would only happen once the initial stage of the scheme had proved to be successful and following a further debate and the approval of both Houses of Parliament." This is actually a pretty useful way to put it, because it allows MPs to kid themselves that we have here an incremental scheme that Parliament will have the final say-so on while giving Blunkett the freedom to crash along as fast as he likes without having actually told a flat-out lie. In this picture compulsion comes in two flavours, compulsion to register for a card and compulsion to carry one. It will not - at least in the current rounds of legislation - be compulsory to carry a card, so Parliament's approval of the move towards compulsion covers compulsion to register. The fact that people who want passports, then probably driving licences (then benefits and healthcare, as indicated in the "consultation") will have no choice but to be registered need not be viewed as tripping the compulsion switch, because within a steadily shrinking service-free pen it will be possible for people to exist without being registered. The draft bill does however include powers "to set a date when it would become compulsory to register and be issued with a card" and "This provision could only be brought in once the initial stage of the identity cards scheme was in place and following a vote in both Houses of Parliament on a detailed report which sets out all the reasons for the proposed move to compulsion." We think we can save the Home Office some money here. The report should say: "We might as well because nearly everyone has a card already." And, Blunkett hopes, because it's loved. In his speech he went on to say: "We will have, for the first time, an opportunity to use the card not simply in terms of protection, but to promote our citizenship, to value the fact that being a citizen, taking on citizenship is a tremendous step as part of our mutuality, as communities and a nation." So once we've all been compelled to register for it and pay for it, we'll rejoice over it, and the ID card will become a symbol of national pride, social cohesion and unity. Nice hive you've got there, David... Blunkett's speech also mentioned Tony Blair's electronic border surveillance announcement, made the previous day with considerably more fanfare. This meant, he said: "In two years time we will have up and running the most sophisticated system in the world." Which, as we pointed out here, (http://www.theregister.co.uk/2004/09/29/uk_intros_semaphore_capps_uk/) is tripe. It checks the lists of passengers bound for the UK against "databases of individuals who pose a security risk," and if this counts as sophistication round at the Home Office we're in just as bad a mess as we think we're in. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Cash, Credit -- or Prints?
by Tyler Durden 12 Oct '04

12 Oct '04

Very interesting question. I'd bet almost any amount of money that it's fairly trivial to simply alligator-clip-out the fingerprint's file from almost any of the cheaper devices. Hell, I'd bet that's true even of more expensive "secure" devices as well. -TD >From: Frank Siebenlist <franks(a)mcs.anl.gov> >To: "R.A. Hettinga" <rah(a)shipwright.com> >CC: cryptography(a)metzdowd.com, cypherpunks(a)al-qaeda.net >Subject: Re: Cash, Credit -- or Prints? >Date: Mon, 11 Oct 2004 17:34:19 -0700 > >Can anyone explain how sophisticated those fingerprint readers are? > >Are there readers out there that by themselves are secure devices and >essentially are able to talk with their servers thru the PCs/workstations >over a protocol such that any man-in-the-middle, like a driver, can not >learn anything from the traffic? >(...and all that for less than $40, of course...) > >If not, would a trojan then be able to capture your fingerprint's >digital-fingerprint, and impersonate you from any other node on the >network? > >-Frank. > > > >R.A. Hettinga wrote: > >><http://online.wsj.com/article_print/0,,SB109744462285841431,00.html> >> >>The Wall Street Journal >> >> >>October 11, 2004 >> >> >>Cash, Credit -- or Prints? >>Fingerprints May Replace >>Money, Passwords and Keys; >>One Downside: Gummi Fakes >> >>By WILLIAM M. BULKELEY >>Staff Reporter of THE WALL STREET JOURNAL >>October 11, 2004; Page B1 >> >> >>Fingerprints aren't just for criminals anymore. Increasingly, they are for >>customers. >> >>Fingerprint identification is being used to speed up checkouts at Piggly >>Wiggly supermarkets in South Carolina, and to open storage lockers at the >>Statue of Liberty. Fingerprints are also being used as password >>substitutes >>in cellphones and laptop computers, and in place of combinations to open >>up >>safes. >> >>But these aren't the fingerprints of yore, in which the person placed his >>hand on an ink pad, then on paper. Instead, the user sets his hand on a >>computerized device topped with a plate of glass, and an optical reader >>and >>special software and chips identify the ridges and valleys of the >>fingertips. >> >>Fingerprint technology seems to be reaching critical mass and is spreading >>faster than other widely promoted "biometric" identification methods, such >>as eyeball scanning, handprint-geometry reading and facial recognition. >>Interest in these and other new security systems was heightened by the >>September 2001 terror attacks. >> >>"Fingerprints will be dominant for the foreseeable future," says Don >>McKeon, the product manager for biometric security at International >>Business Machines Corp. >> >>One reason fingerprint-security is spreading is that technological >>advances >>are bringing the cost down. Microsoft Corp. recently introduced a >>stand-alone fingerprint reader for $54, and a keyboard and a mouse with >>fingerprint readers. Last week, IBM said it would start selling laptop >>computers with fingerprint readers built in. These products reduce the >>need >>for personal-computer users to remember passwords. >> >>A customer uses a fingerprint reader to pay at a Piggly Wiggly store, >>cutting his checkout time. >> >> >> >>Earlier this year, American Power Conversion Corp., a Rhode Island company >>that makes backup computer batteries, started selling a fingerprint reader >>for PCs with a street price of $45 -- less than half the price of >>competitors at the time. American Power says it has sold tens of thousands >>of the devices since. >> >>Korea's LG Electronics Inc. has introduced a cellphone with a silicon chip >>at its base that requires the owner's finger to be swiped across its >>surface before the phone can be used. This summer, NTT DoCoMo Inc. started >>selling a similar phone reader that is being used on Japanese trains as an >>electronic wallet to pay fares or to activate withdrawals from on-board >>cash machines. >> >>Proponents have never had trouble explaining the benefits of fingerprints >>as payment-and-password alternatives: Each person has a unique set, and >>their use is established in the legal system as an authoritative means of >>identification. But some people are uneasy about registering their >>fingerprints because of the association with criminality and the potential >>that such a universal identifier linked to all personal information would >>reduce privacy. >> >>Moreover, numerous businesses and governments have tested fingerprint >>systems in the past only to rip them out when the hype failed to match >>reality. That's partly because the optical readers have had problems with >>certain people's fingers. Elderly people with dry skin, children who >>pressed down too hard, even women with smaller fingers -- including many >>Asians -- were often rejected as unreadable. >> >>Security experts also have successfully fooled some systems by making >>plaster molds of fingers and then creating fake fingers by filling the >>molds with Silly-Putty-type plasticizers or gelatin similar to that used >>in >>candy Gummi Bears. >> >>But advocates say the rate of false rejections of legitimate users has >>been >>greatly reduced by improved software. "I'd say 99% of people can register" >>their fingers, says Brad Hill, who installed fingerprint-controlled >>lockers >>at his souvenir store at the Statue of Liberty this summer when the >>National Park Service forbade tourists from entering the statue while >>carrying packages. Mr. Hill was worried that tourists would lose locker >>keys when security screeners forced them to empty their pockets. >> >>Some makers of readers also say their technology can solve the fake-finger >>problem by taking readings from below the surface skin layer. Or they >>suggest combining four-digit ID codes with fingerprint scanning to >>virtually eliminate false readings. >> >>Makers of fingerprint readers acknowledge the privacy concerns. But they >>maintain that the threat of personal invasion is minimized because most >>systems don't store the actual print, but instead use it to generate a >>unique series of numbers that can't be reverse-engineered to re-create the >>print. And public willingness to submit to fingerprint readers has soared >>since the 2001 terrorist attacks, as the need for security overcomes >>worries about unwarranted intrusion. >> >>While the market for fingerprint readers is small, it is growing fast. >>International Biometric Group, a New York market-research firm, predicts >>that sales will rise 86% to $368 million this year from $198 million last >>year. AuthenTec Inc., of Melbourne, Fla., which makes the >>fingerprint-reading chips used in the LG cellphone, expects to ship more >>than three million of them this year, triple the level of 2003. Their >>price >>has fallen below $6 apiece, and Scott Moody, AuthenTec's chief executive, >>sees that dropping below $4 next year. >> >>Ubiquitous use of fingerprints could eliminate a huge consumer headache: >>remembering passwords for various Web sites. With American Power's >>fingerprint reader, users register all of their passwords online, along >>with the associated Web sites. Then they never have to type in a password >>again. >> >>"Our parents didn't deal with the problem of remembering 20 passwords, and >>our grandkids won't even know what they are," says IBM's Mr. McKeon. >> >>Potentially, fingerprint readers also could replace credit and debit >>cards. >>Pay by Touch Co., a closely held San Francisco company that is working >>with >>IBM, installs fingerprint readers in retail stores where customers can >>register their fingers by touching the pad five times. Then they can >>register supermarket loyalty cards and several credit card-numbers. They >>even can use the fingerprint reader to withdraw money from a checking >>account at the cash register. >> >>Another use: A consumer could register a driver's license and his or her >>age with the system, so clerks won't have to examine identification cards >>for purchases of beer or cigarettes. The next time the customer checks >>out, >>he or she just touches the pad, enters his or her phone number and selects >>from the list of payment options. Pay by Touch, which charges retailers 5 >>to 10 cents per transaction, claims the system reduces checkout time by >>30%. >> >>One early user of Pay by Touch are a handful of Piggly Wiggly >>supermarkets. >>After installing the system in four stores in July, "a good, strong >>percentage of our transactions are done by touch" already, says David >>Schools, senior vice president of Piggly Wiggly Carolina Inc., based in >>Charleston. He declined to be more specific. The chain hopes that >>customers >>will register checking accounts and make electronic withdrawals via >>fingerprint ID to pay for purchases, which would save the grocer steep >>credit-card or debit-card fees. >> >>IBM says that convenience stores are experimenting with fingerprints as an >>alternative to radio-frequency identification cards like Exxon Mobil >>Corp.'s Speedpass, to deal with the "sweaty jogger problem" -- cashless >>runners coming in for coffee or Gatorade. The problem with RFID cards is >>that anyone can use one that is lost or stolen. Not so with fingerprints. >> >>Jeff Baughan, vice president of information technology at Catholic Health >>Systems in Buffalo, N.Y., says he anticipates some day installing wireless >>readers on the carts used by nursers that would read patients' fingers, to >>double-check that the right patient gets the right medicine. Currently, >>the >>health-care system is installing Ultra-Scan Corp. devices that read >>fingers >>to register incoming patients and make sure that different people aren't >>using the same insurance card. >> >>Fingerprint-scanner authorization also is being used by business owners as >>a replacement for lock combinations on safes. "Traditionally, two people >>are given the same combination, and if there's a loss, how can you figure >>out who took it?" says Edward McGunn, president of Corporate Safe >>Specialists Inc., of Posen, Ill. He predicts that within two years, 80% of >>his sales will be fingerprint safes, partly because it's much simpler to >>train an unskilled manager to open one. "This is the most exciting time to >>be in the safe business in my lifetime," says Mr. McGunn, a >>third-generation safe maker. >> >> > >-- >Frank Siebenlist franks(a)mcs.anl.gov >The Globus Alliance - Argonne National Laboratory > >--------------------------------------------------------------------- >The Cryptography Mailing List >Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement

1 0

Re: Congress Close to Establishing Rules for Driver's Licenses
by Tyler Durden 12 Oct '04

12 Oct '04

Can't specifically confirm that, but this last summer I traveled to several countries (and back into the US) using an expired passport as ID (and no, they didn't just forget to read the date, the expired passport was officially acceptable). -TD >From: "Riad S. Wahby" <rsw(a)jfet.org> >To: Cypherpunks <cypherpunks(a)al-qaeda.net> >Subject: Re: Congress Close to Establishing Rules for Driver's Licenses >Date: Tue, 12 Oct 2004 10:09:26 -0500 > >Dave Howe <DaveHowe(a)gmx.co.uk> wrote: > > And how many americans have a passport,and carry one for identification > > purposes? > >Probably not all that many. > >Tangentially, I was once told that, at least in Massachusetts liquor >stores, even an _expired_ passport was useful identification. Can >anyone confirm that this is true other than at Sav-Mor Liquors? > >-- >Riad S. Wahby >rsw(a)jfet.org _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

1 0

Cash, Credit -- or Prints?
by R.A. Hettinga 12 Oct '04

12 Oct '04

<http://online.wsj.com/article_print/0,,SB109744462285841431,00.html> The Wall Street Journal October 11, 2004 Cash, Credit -- or Prints? Fingerprints May Replace Money, Passwords and Keys; One Downside: Gummi Fakes By WILLIAM M. BULKELEY Staff Reporter of THE WALL STREET JOURNAL October 11, 2004; Page B1 Fingerprints aren't just for criminals anymore. Increasingly, they are for customers. Fingerprint identification is being used to speed up checkouts at Piggly Wiggly supermarkets in South Carolina, and to open storage lockers at the Statue of Liberty. Fingerprints are also being used as password substitutes in cellphones and laptop computers, and in place of combinations to open up safes. But these aren't the fingerprints of yore, in which the person placed his hand on an ink pad, then on paper. Instead, the user sets his hand on a computerized device topped with a plate of glass, and an optical reader and special software and chips identify the ridges and valleys of the fingertips. Fingerprint technology seems to be reaching critical mass and is spreading faster than other widely promoted "biometric" identification methods, such as eyeball scanning, handprint-geometry reading and facial recognition. Interest in these and other new security systems was heightened by the September 2001 terror attacks. "Fingerprints will be dominant for the foreseeable future," says Don McKeon, the product manager for biometric security at International Business Machines Corp. One reason fingerprint-security is spreading is that technological advances are bringing the cost down. Microsoft Corp. recently introduced a stand-alone fingerprint reader for $54, and a keyboard and a mouse with fingerprint readers. Last week, IBM said it would start selling laptop computers with fingerprint readers built in. These products reduce the need for personal-computer users to remember passwords. A customer uses a fingerprint reader to pay at a Piggly Wiggly store, cutting his checkout time. Earlier this year, American Power Conversion Corp., a Rhode Island company that makes backup computer batteries, started selling a fingerprint reader for PCs with a street price of $45 -- less than half the price of competitors at the time. American Power says it has sold tens of thousands of the devices since. Korea's LG Electronics Inc. has introduced a cellphone with a silicon chip at its base that requires the owner's finger to be swiped across its surface before the phone can be used. This summer, NTT DoCoMo Inc. started selling a similar phone reader that is being used on Japanese trains as an electronic wallet to pay fares or to activate withdrawals from on-board cash machines. Proponents have never had trouble explaining the benefits of fingerprints as payment-and-password alternatives: Each person has a unique set, and their use is established in the legal system as an authoritative means of identification. But some people are uneasy about registering their fingerprints because of the association with criminality and the potential that such a universal identifier linked to all personal information would reduce privacy. Moreover, numerous businesses and governments have tested fingerprint systems in the past only to rip them out when the hype failed to match reality. That's partly because the optical readers have had problems with certain people's fingers. Elderly people with dry skin, children who pressed down too hard, even women with smaller fingers -- including many Asians -- were often rejected as unreadable. Security experts also have successfully fooled some systems by making plaster molds of fingers and then creating fake fingers by filling the molds with Silly-Putty-type plasticizers or gelatin similar to that used in candy Gummi Bears. But advocates say the rate of false rejections of legitimate users has been greatly reduced by improved software. "I'd say 99% of people can register" their fingers, says Brad Hill, who installed fingerprint-controlled lockers at his souvenir store at the Statue of Liberty this summer when the National Park Service forbade tourists from entering the statue while carrying packages. Mr. Hill was worried that tourists would lose locker keys when security screeners forced them to empty their pockets. Some makers of readers also say their technology can solve the fake-finger problem by taking readings from below the surface skin layer. Or they suggest combining four-digit ID codes with fingerprint scanning to virtually eliminate false readings. Makers of fingerprint readers acknowledge the privacy concerns. But they maintain that the threat of personal invasion is minimized because most systems don't store the actual print, but instead use it to generate a unique series of numbers that can't be reverse-engineered to re-create the print. And public willingness to submit to fingerprint readers has soared since the 2001 terrorist attacks, as the need for security overcomes worries about unwarranted intrusion. While the market for fingerprint readers is small, it is growing fast. International Biometric Group, a New York market-research firm, predicts that sales will rise 86% to $368 million this year from $198 million last year. AuthenTec Inc., of Melbourne, Fla., which makes the fingerprint-reading chips used in the LG cellphone, expects to ship more than three million of them this year, triple the level of 2003. Their price has fallen below $6 apiece, and Scott Moody, AuthenTec's chief executive, sees that dropping below $4 next year. Ubiquitous use of fingerprints could eliminate a huge consumer headache: remembering passwords for various Web sites. With American Power's fingerprint reader, users register all of their passwords online, along with the associated Web sites. Then they never have to type in a password again. "Our parents didn't deal with the problem of remembering 20 passwords, and our grandkids won't even know what they are," says IBM's Mr. McKeon. Potentially, fingerprint readers also could replace credit and debit cards. Pay by Touch Co., a closely held San Francisco company that is working with IBM, installs fingerprint readers in retail stores where customers can register their fingers by touching the pad five times. Then they can register supermarket loyalty cards and several credit card-numbers. They even can use the fingerprint reader to withdraw money from a checking account at the cash register. Another use: A consumer could register a driver's license and his or her age with the system, so clerks won't have to examine identification cards for purchases of beer or cigarettes. The next time the customer checks out, he or she just touches the pad, enters his or her phone number and selects from the list of payment options. Pay by Touch, which charges retailers 5 to 10 cents per transaction, claims the system reduces checkout time by 30%. One early user of Pay by Touch are a handful of Piggly Wiggly supermarkets. After installing the system in four stores in July, "a good, strong percentage of our transactions are done by touch" already, says David Schools, senior vice president of Piggly Wiggly Carolina Inc., based in Charleston. He declined to be more specific. The chain hopes that customers will register checking accounts and make electronic withdrawals via fingerprint ID to pay for purchases, which would save the grocer steep credit-card or debit-card fees. IBM says that convenience stores are experimenting with fingerprints as an alternative to radio-frequency identification cards like Exxon Mobil Corp.'s Speedpass, to deal with the "sweaty jogger problem" -- cashless runners coming in for coffee or Gatorade. The problem with RFID cards is that anyone can use one that is lost or stolen. Not so with fingerprints. Jeff Baughan, vice president of information technology at Catholic Health Systems in Buffalo, N.Y., says he anticipates some day installing wireless readers on the carts used by nursers that would read patients' fingers, to double-check that the right patient gets the right medicine. Currently, the health-care system is installing Ultra-Scan Corp. devices that read fingers to register incoming patients and make sure that different people aren't using the same insurance card. Fingerprint-scanner authorization also is being used by business owners as a replacement for lock combinations on safes. "Traditionally, two people are given the same combination, and if there's a loss, how can you figure out who took it?" says Edward McGunn, president of Corporate Safe Specialists Inc., of Posen, Ill. He predicts that within two years, 80% of his sales will be fingerprint safes, partly because it's much simpler to train an unskilled manager to open one. "This is the most exciting time to be in the safe business in my lifetime," says Mr. McGunn, a third-generation safe maker. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Re: Implant replaces ID cards for access to restricted areas.
by John Kelsey 12 Oct '04

12 Oct '04

>From: Steve Furlong <sfurlong(a)acmenet.net> >Sent: Oct 9, 2004 7:44 AM >To: cypherpunks(a)al-qaeda.net >Subject: Re: Implant replaces ID cards for access to restricted areas. >On Thu, 2004-10-07 at 02:20, Nomen Nescio wrote: >> Mexican Attorney General, Staff Get Chip Implants >> >> Implant replaces ID cards for access to restricted areas. >I think I'd get the implant under my scalp somewhere. If the implant >gave access to a really critical place, I wouldn't want to risk losing >an arm or whatever. Also, I'd be able to block the implant's signals >with my nifty tinfoil hat. I've been waiting for a use for that thing. Actually, I think the protocol requires that it be placed on your forehead, right under the tattooed sixes. Or maybe I'm getting my protocols mixed up.... --John

1 0

RE: Chance plays a key role in start-up company's success
by Tyler Durden 11 Oct '04

11 Oct '04

Well, as a research toy QC seems gee-wiz super cool. I'm still not super-impressed by the current set of applications. In particular, consider that random number generator. Although QM does indeed predict that experimental outcomes will be 'random', they are random within the weightings imposed by the measuring apparatus. In a sense, this is the perfect analog to the notion that, "Your crypto algorithm may be unbreakable, but your hard/software ain't." Consider...I set up my random number generator to spit out a 1 every time a photon passes through a half-silvered mirror, and a 0 every time it reflects. Over time the silvering on the mirror is going to degrade, or perhaps it's already not perfect but you need a large number of 'measurements' and/or analysis to begin to see it. In any event, your probabilities are going to shift over time, yielding an imperfect distribution of 0s/1s. Sure, it's still "random", but the probability density function is no longer useful for many applications. Right now I can't see why this would be any more desirable than, for instance, grabbing the outcome of some distinctly nonlinear process, or perhaps many other approaches to RNG. The only thing this does is allow users/buyers to think their system is now free of any deep technical issues that may make classical systems insecure. -TD >From: "R.A. Hettinga" <rah(a)shipwright.com> >To: cryptography(a)metzdowd.com, cypherpunks(a)al-qaeda.net >Subject: Chance plays a key role in start-up company's success >Date: Mon, 11 Oct 2004 11:09:03 -0400 > ><http://istresults.cordis.lu/popup.cfm?section=news&tpl=article&ID=70263&Aut…> > > IST Results > >Chance plays a key role in start-up company's success > >Using randomly generated numbers to ensure the security of encryption >applications seems counter-intuitive but is a fundamental part of quantum >cryptography. Pioneering the approach is an award-winning Swiss start-up >company, id Quantique, that launched the world's first commercial quantum >random number generator and quantum cryptography system. > > In fact, numerous applications require random numbers. Besides potential >quantum cryptographic applications, such as bank transfers and e-voting, >further examples include scientific calculations and games involving chance >such as national lotteries. Initially though, id Quantique's products >mainly target demand from customers of high security encryption systems >such as financial, government and military institutions. > > id Quantique was founded in October 2001 as a spin-off from the >University >of Geneva by four researchers from the University's Applied Physics >Department - Grigoire Ribordy, Olivier Guinnard, Nicolas Gisin and Hugo >Zbinden. December 2003 marked a milestone in the company's evolution: the >entrepreneurs successfully raised 1 million euros from the Luxemburg-based >i2i venture capital fund in a first round of funding and they concluded a >worldwide exclusivity agreement with the University of Geneva regarding two >important quantum cryptography patents. > > Over a short period of time, the fledgling company and its founders have >won several prestigious prizes. The company was a recipient of the European >Innovation Awards from the Wall Street Journal Europe in 2001; Olivier >Guinnard and Grigoire Ribordy were winners of the de Vigier's prize for >Swiss entrepreneurs in 2002; and this year the company was a winner of the >annual Swiss Technology Award. > > id Quantique supplies three products. Firstly, a physical random number >generator, Quantis, which relies on an elementary quantum optical process - >namely the perfectly random reflection or transmission of a photon, or >light particle, on a semi-transparent mirror - in order to produce binary >random numbers. Next, a quantum key distribution (QKD) system that enables >cryptographic keys, which are required for encrypting and decrypting >information, to be securely transmitted over standard optical fibres >between two parties. Finally, a Single Photon Detection Module (SPDM), id >200, which is a photon counter used in quantum cryptography and other >quantum optical applications. > > In March 2004, id Quantique and the University of Geneva launched the >first ever website offering perfectly random numbers created by the Quantis >generator. Grigoire Ribordy, id Quantique's CEO, remarks, "We launched the >www.randomnumbers.info website to promote our new quantum random number >generator and to provide a service to the scientific community. In the long >term, we would like it to become the reference point for random numbers." > > Despite the demand for perfectly random numbers, their generation remains >a difficult task. Conventional computers use a rule to produce >pseudo-random numbers, which can sometimes introduce unwanted bias. >"Quantum physics is the only physical theory predicting that the outcome of >certain phenomena is random," emphasises Nicolas Gisin, Professor at the >University of Geneva. "It is thus a natural choice to use it to generate >true random numbers." > > id Quantique is a partner in the IST project SECOQC which began in April >2004 under the Sixth Framework Programme. The project is focused on >evaluating quantum cryptography technology as well as developing standard >specifications for secure global digital communication systems. > > Recently, the project consortium performed the world's first ever bank >transfer using quantum cryptography by sending $3000 over a 1.45 km link >between Vienna City Hall and the headquarters of Bank-Austria >Creditanstalt. "The SECOQC project makes it possible for id Quantique's >engineers to interact with some of the best groups worldwide in the field >of quantum cryptography," observes Ribordy. "And because of the >multidisciplinary nature of this project, it is an extremely enriching >platform to exchange ideas and find new ways to solve problems." > > More recently, id Quantique has teamed up with the Deckpoint, a Swiss >Internet Service Provider, to develop and implement the world's first data >archiving network secured using quantum cryptography. The official opening >of the new archiving network took place on 29 September 2004 in the >presence of Carlo Lamprecht, the Minister of Economy, Labour and Foreign >Affairs of the Republic and Canton of Geneva. Data stored on a farm of 30 >servers at Deckpoint Housing Centre, in the middle of Geneva, was backed up >to servers located at the Cern Internet Exchange Point, in the city suburbs >some 10 kms away. "This world premiere is an excellent illustration of the >of the potential of this technology " says Ribordy. "We are convinced that >security has become critical, in particular with the implementation of the >Basel II standards in the banking industry as of 2006," adds Dominique >Perisset, Director of Deckpoint. "The economic world cannot afford anymore >not to have a complete information security strategy." > > Contact: >Grigoire Ribordy >Chief Executive Officer >id Quantique SA >Chemin de la Marbrerie, 3 >CH-1227 Carouge / Geneva >Switzerland >Tel: + 41-22-3018371/2 >Fax: + 41-22-3018379 >Email: gregoire.ribordy(a)idquantique.com > >Sources: Based on information from id Quantique > > > > > > >Information : > >DATE : >11 Oct 2004 > >TECHNOLOGY AREA: > > Trust/security > > >MARKET APPLICATION: > >Electronics/IT manuf > > >USEFUL LINKS: >id Quantique website >SECOQC project >SECOQC factsheet on CORDIS >www.randomnumbers.info website > > > >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

1 0

Chance plays a key role in start-up company's success
by R.A. Hettinga 11 Oct '04

11 Oct '04

<http://istresults.cordis.lu/popup.cfm?section=news&tpl=article&ID=70263&Aut…> IST Results Chance plays a key role in start-up company's success Using randomly generated numbers to ensure the security of encryption applications seems counter-intuitive but is a fundamental part of quantum cryptography. Pioneering the approach is an award-winning Swiss start-up company, id Quantique, that launched the world's first commercial quantum random number generator and quantum cryptography system. In fact, numerous applications require random numbers. Besides potential quantum cryptographic applications, such as bank transfers and e-voting, further examples include scientific calculations and games involving chance such as national lotteries. Initially though, id Quantique's products mainly target demand from customers of high security encryption systems such as financial, government and military institutions. id Quantique was founded in October 2001 as a spin-off from the University of Geneva by four researchers from the University's Applied Physics Department - Grigoire Ribordy, Olivier Guinnard, Nicolas Gisin and Hugo Zbinden. December 2003 marked a milestone in the company's evolution: the entrepreneurs successfully raised 1 million euros from the Luxemburg-based i2i venture capital fund in a first round of funding and they concluded a worldwide exclusivity agreement with the University of Geneva regarding two important quantum cryptography patents. Over a short period of time, the fledgling company and its founders have won several prestigious prizes. The company was a recipient of the European Innovation Awards from the Wall Street Journal Europe in 2001; Olivier Guinnard and Grigoire Ribordy were winners of the de Vigier's prize for Swiss entrepreneurs in 2002; and this year the company was a winner of the annual Swiss Technology Award. id Quantique supplies three products. Firstly, a physical random number generator, Quantis, which relies on an elementary quantum optical process - namely the perfectly random reflection or transmission of a photon, or light particle, on a semi-transparent mirror - in order to produce binary random numbers. Next, a quantum key distribution (QKD) system that enables cryptographic keys, which are required for encrypting and decrypting information, to be securely transmitted over standard optical fibres between two parties. Finally, a Single Photon Detection Module (SPDM), id 200, which is a photon counter used in quantum cryptography and other quantum optical applications. In March 2004, id Quantique and the University of Geneva launched the first ever website offering perfectly random numbers created by the Quantis generator. Grigoire Ribordy, id Quantique's CEO, remarks, "We launched the www.randomnumbers.info website to promote our new quantum random number generator and to provide a service to the scientific community. In the long term, we would like it to become the reference point for random numbers." Despite the demand for perfectly random numbers, their generation remains a difficult task. Conventional computers use a rule to produce pseudo-random numbers, which can sometimes introduce unwanted bias. "Quantum physics is the only physical theory predicting that the outcome of certain phenomena is random," emphasises Nicolas Gisin, Professor at the University of Geneva. "It is thus a natural choice to use it to generate true random numbers." id Quantique is a partner in the IST project SECOQC which began in April 2004 under the Sixth Framework Programme. The project is focused on evaluating quantum cryptography technology as well as developing standard specifications for secure global digital communication systems. Recently, the project consortium performed the world's first ever bank transfer using quantum cryptography by sending $3000 over a 1.45 km link between Vienna City Hall and the headquarters of Bank-Austria Creditanstalt. "The SECOQC project makes it possible for id Quantique's engineers to interact with some of the best groups worldwide in the field of quantum cryptography," observes Ribordy. "And because of the multidisciplinary nature of this project, it is an extremely enriching platform to exchange ideas and find new ways to solve problems." More recently, id Quantique has teamed up with the Deckpoint, a Swiss Internet Service Provider, to develop and implement the world's first data archiving network secured using quantum cryptography. The official opening of the new archiving network took place on 29 September 2004 in the presence of Carlo Lamprecht, the Minister of Economy, Labour and Foreign Affairs of the Republic and Canton of Geneva. Data stored on a farm of 30 servers at Deckpoint Housing Centre, in the middle of Geneva, was backed up to servers located at the Cern Internet Exchange Point, in the city suburbs some 10 kms away. "This world premiere is an excellent illustration of the of the potential of this technology " says Ribordy. "We are convinced that security has become critical, in particular with the implementation of the Basel II standards in the banking industry as of 2006," adds Dominique Perisset, Director of Deckpoint. "The economic world cannot afford anymore not to have a complete information security strategy." Contact: Grigoire Ribordy Chief Executive Officer id Quantique SA Chemin de la Marbrerie, 3 CH-1227 Carouge / Geneva Switzerland Tel: + 41-22-3018371/2 Fax: + 41-22-3018379 Email: gregoire.ribordy(a)idquantique.com Sources: Based on information from id Quantique Information : DATE : 11 Oct 2004 TECHNOLOGY AREA: Trust/security MARKET APPLICATION: Electronics/IT manuf USEFUL LINKS: id Quantique website SECOQC project SECOQC factsheet on CORDIS www.randomnumbers.info website -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Financial identity is *dangerous*? (was re: Fake companies, real money)
by Tyler Durden 11 Oct '04

11 Oct '04

OK, I'll bite. Or rather... Well, your initial postulate was stated in such a way as to be fairly unrefutable, the key word being "float". Only companies, etc...provide that by requiring that the transacted funds flow through their coffers for a moment, where they extract their discount revenue. At this stage of the game, nobody when their head screwed on tight would argue that Internet-based businesses don't represent an increase in Risk (whether that increase will eventually make float-based business models impossible is an entirely different matter). Interestingly, the Visa organization recently launched a Purchasing Card platform which merely facilitates EFTs (a step towards your oft-mentioned "Geodesic Society"?)...there's a fixed and small discount revenue touch that's independent of the size of the transaction (and they can afford to do this because there's no float, ergo no risk). In this case, Visa is providing "value added" information systems for the transactions, but in a sense they're allowing their member banks to more or less completely step out of the transaction if they wish. Now of course, Paragraph 2 is only related to Paragraph 1 by the fact that I wrote both of them in one post. To my knowledge, Visa's new PCard platform has nothing to do with Internet-based risk PER SE, but in the long run I'll doubt we'll lable this a coincidence. -TD >From: "R. A. Hettinga" <rah(a)shipwright.com> >To: cryptography(a)metzdowd.com, cypherpunks(a)al-qaeda.net >Subject: Financial identity is *dangerous*? (was re: Fake companies, real >money) >Date: Fri, 8 Oct 2004 19:14:08 -0400 > >Okay. So I'm coming to the conclusion that book-entry settlement, with its >absolute requirement for both "identity" and float between transactions, is >becoming more and more *un*-safe to use as internet ubiquity increases. > >Anyone want to pick up the other side of this and tell me why not? > >No bugbears or horsemen need apply... > >Cheers, >RAH >------- > > ><http://www.msnbc.msn.com/id/6175738/print/1/displaymode/1098/> > MSNBC.com > >Fake companies, real money >Elaborate con wrings cash out of stolen credit cards >By Bob Sullivan >Technology correspondent >MSNBC >Updated: 7:15 p.m. ET Oct. 7, 2004 > > >T-Data, a small New-York based software company, doesn't take credit cards >-- never has in its 20-year history. But a few weeks ago, owner Jeff Duhl >found himself looking over $15,000 worth of credit card charges seemingly >accepted by his store. > >A quick investigation revealed most of the charges had been made using >stolen credit cards. Slowly, he caught on: Someone had stolen a batch of >credit card accounts, then stolen his company's name, set up an imposter >version of T-Data, and rung up thousands of dollars worth of fake >purchases. The "profits" were then desposited into checking accounts >controlled by the imposters. > >"It is ingenious," said Dan Clements, who operates merchant advocacy site >CardCops.com. > >Duhl wasn't the only victim of this new brand of corporate identity theft: >At least 50 other firms apparently also had their identities stolen in the >scheme. For credit card thieves doing their best to wring money out of a >stash of stolen accounts, it seems like the perfect scam. > >How to profit from stolen credit cards >While millions of credit card account numbers are stolen every year -- 60 >million last year, and perhaps 120 million this year, according to one >estimate -- turning them into cash can be tricky. Merchandise ordered with >the card must be delivered somewhere, which is risky. Massive cash >withdrawals are quickly spotted by credit card associations. > > The scheme Duhl's firm was caught up in is a heady, complex alternative: > >First, credit card thieves find a legitimate company unlikely to already be >accepting credit card transactions. They then impersonate that company and >set up accounts with merchant processing providers, whose role it is to >transfer funds between credit card companies and merchants. > > Using stolen credit cards, the thieves then start sending small payments, >usually $498 or $598 at a time, to the fraudulent merchant accounts. The >credit card companies send funds to the processors and they in turn send >the funds off to bank accounts controlled by the criminals. > >"They are flying under the radar on each transaction unless someone does a >whole lot of work," Duhl said. > > A key part of the scheme: The thieves went to the trouble of registering >the domain www.T-datasoftware.com, then set up a fake Web site. The site >looked like a believable business to the merchant processing providers, who >gave the thieves their accounts. > >Duhl's imposters were able to set up accounts at seven different payment >processing firms. When Duhl investigated, he discovered some 50 other Web >sites -- most mere imitations of one another -- all sitting on the same >computer server. > >"They got away with $15,000 (in charges) at my company," Duhl said. >"Multiply that by the number of sites, the number of companies, these folks >could be getting away with millions of dollars," he said. > >It's not clear how much money the criminals really did get away with in the >end. Many of the processing firms interviewed for this article claimed they >caught on to the fraud after the transactions had cleared, but before the >suspects had withdrawn the money from various checking accounts around the >country. One did concede, however, that the scheme has real potential. > >'Hundreds of thousands' over a weekend >"If you don't catch it you could lose hundreds of thousands of dollars over >a weekend," said David Steinberg, chief credit officer at Merchant E >Solutions, one of the processing firms used by the thieves. > > Steinberg said his company had never suffered such a loss, but that the >industry is bustling with fraud attempts. Some 5 to 10 percent of all >applications his firm receives are turned away as potentially fraudulent, >he said. > >Phyllis McNeill, a spokeswoman for Global Payments, another processing firm >hit in the scam, confirmed a fake account had been set up in T-Data's name >with her company. She said the account was actually set up through a >reseller, and was shut down after eight transactions had been performed. > >Randy Lobban, director of risk management at North American Bancard, said >the con artists were able to open up an account at his firm and pass eight >charges through the system, but the funds were never released. > >"They never got any money," Lobban said. He alerted the U.S. Postal >Inspection Service to the incident. > >Representatives at First Data and Wells Fargo also confirmed that fake >accounts had been opened at their firms. > > An official at Beacon Bank in Minnesota, where one of the checking >accounts used to receive the stolen funds had been set up, confirmed that >he had discussed the situation with Duhl, but would not provide further >comment. > > Corporate ID theft >Whoever impersonated T-Data were clever enough to throw a few monkey >wrenches in the path of anyone trying to detect them. > >When applying for the compulsory credit check needed to obtain the fake >merchant account, for example, the thieves didn't use T-Data's tax ID >number. Instead, they used the name and credit profile of a man unconnected >with the company. Steven Wiencek, who lives on Long Island near the >company, didn't even know his credit had been checked until contacted by >MSNBC.com for this story. > >But the application, which listed Wiencek as company president, gives his >Social Security number and driver's license number, suggesting the people >behind this scheme have access to a wide swath of stolen credit cards and >stolen identities. > >Another attempt at misdirection was foiled by an alert mail carrier. > > The application for the merchant account used a slight variation of >Duhl's >address -- apparently an attempt to ensure that mail to Duhl would be lost. >But a knowledgeable local postal worker recognized the company name anyway, >leading Duhl to discover the dupe. > >"Without that, I may not have found out about this for a long time," he >said. > > The thieves were also persistent. Using one stolen credit card, they >attempted to steal $2,500 through five separate faked merchant accounts, >according to an affidavit of credit card fraud supplied by Duhl. > > Another corporate ID victim, John Bartholomew of Abcom Services, said he >was lucky, because Duhl contacted him just as the scam began. > > "We are a management company in long-term health care. We would have no >reason to use credit cards," he said. The firm had been in business for 21 >years, and never accepted a single charge -- until the criminals stole his >company's name, Bartholomew said. > >True to form, the criminals hijacked his brand name and set up merchants >accounts using his company's name and a similar -- but slightly altered -- >street address. > > The good news is, Bartholomew was able to warn the merchant account >providers soon enough that only about $4,000 in charges were run through >his company's name. The bad news is, some of the providers are still trying >to make him pay the bill for the charges. He figures he's spent about >$5,000 in legal fees trying to clean up the mess. > >Who are they working with? >Rob Douglas, a consultant who operates PrivacyToday.com, blames the >merchant account providers for never checking to see if the name on the >account application actually represented a real person who worked at the >firm. > >"You have to ask what the companies that set up the merchant accounts are >doing?" he said. "Who has the responsibility to do due diligence that they >are in fact working with who they think they are working with when they >open an account?" > >But several of the merchant service providers pointed out the difficulty of >stopping all fraudulent applications in a world where identities are so >easily stolen. > > "For all of us, it's a tough business," Steinberg, of Merchant E >Services, >said. "It's a large, large problem." > >Duhl himself blames the banks where the money was to eventually wind up -- >wondering how the thieves were able to set up accounts in the post-Patriot >Act era. Apparently worried as much about security implications as his >personal loss, Duhl contacted the FBI, the Secret Service and the U.S. >Postal Inspector's Office. None of the agents he spoke to returned phone >calls placed by MSNBC.com. > > He says he is frustrated that none of the agencies seem to have taken any >interest in the incident -- particularly because at least one phone call >was placed to Pakistan using the cell phone purchased in his company's >name, and one of the bank accounts used to funnel money was established by >suspects who presented Russian passports as identification, he says his own >research revealed. > > "No one in the government seems like they are going to get interested in >establishing a case," Duhl said. > > Douglas, who consults with firms trying to deal with the new trend of >corporate identity theft, says there's little small companies like Duhl's >can do to prevent this kind of incident. But one piece of practical advice >he offers larger firms: search the Web once a week for evidence of >impersonation. > >"As strange as it sounds, companies need to have one or more people >assigned to surf the Web and see if there are mirror sites out there, just >like we tell parents to surf for their child's name," he said. > >Bob Sullivan is the author of Your Evil Twin: Behind the Identity Theft >Epidemic > >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

1 0