- cypherpunks-legacy - lists.cpunks.org

:-) (was re: How one can become a terrorist?)
by R. A. Hettinga 20 Sep '04

20 Sep '04

--- begin forwarded text

2 2

Keith Henson Needs Help
by R. A. Hettinga 19 Sep '04

19 Sep '04

<http://www.kuro5hin.org/print/2004/9/14/32340/5809> kuro5hin.org || technology and culture, from the trenches Keith Henson Needs Help (MLP) By Baldrson Wed Sep 15th, 2004 at 07:42:14 AM EST For those who don't know him, Keith Henson co-founded the L5 Society, was President of Xanadu Corporation and was a featured character in The Great Mambo Chicken and the Transhuman Condition: Science Slightly Over the Edge. He's about to be deported from Canada to the United States where he faces time in the infamous California prison system. Recently on the cryonics mailing list Keith Henson issued a plea for help: ... at this point I am a "failed refugee." The only thing that can keep me from being deported to the US on short notice is an appeal to the Minister of Citizenship and Immigration. Her office gets 15,000 letters a week so it takes a well known case to reach the level where it gets attention. What is going on here and why should anyone care? The short story is that Keith has been fighting against Scientology and as a result ended up fleeing the United States to Canada to avoid a misdemeanor conviction brought against him by Scientologists. Here's the prosecuting attorney's speech given the jury on the charges: Now, His Honor read to you in the beginning of the case that the defendant has been charged with three counts. First count is -- now, these are numeric numbers and they mean nothing to you, so I will give you names for what they are. The first one is 422, violation of Penal Code Section 422. And 664/422 and 422.6. Now I'll give them names. 422 is terrorist threats. Now, that conjures up images of Beruit or the Twin Towers bombing, but that's not what it means. It just means a threat that causes someone terror, that frightens people. That's what Count One is. Count two is 664/422, is the attempt, the attempt to do the exact same thing, to cause to threaten, to attempt to threaten and cause terror or frighten someone. And the last count is 422.6. And that's essentially defined as the interference with someone's rights guaranteed by the Constitution, their civil rights, and in this case the right to practice their religion without fear. Essentially 422.6 is a hate crime. Now, let's talk about the first count, and we'll go count by count. The first count, 422, again I told you was just threats that caused people to be afraid. Essentially the elements are these: Number one, there has to be somewhat of a threat. There has to be a threat. The person has to intend there to be a threat. And lastly, that the victims have a reasonable fear. However, the person doesn't have to have to want to carry it out. There has to be no intention to carry out the threat. Keith's been in Canada for a few years and is trying to remain there as a refugee. Well, I'll confess my bias. Although Keith and I have known each other since the early days of the L5 Society, we have serious disagreements on a lot of things -- not the least of which are many opinions about Jews, genes and memes etc. More immediately relevant is the fact that I just don't "get" Keith's fight against Scientology. Scientologists seem like a joke to me and IMHO people who get involved with them suffer about as much but no more than people who get involved with New York City nightlife. Be that as it may, I personally don't like seeing anyone spend time in a US, let alone California, prison system. I once refused to testify against a young Hispanic after he had stolen my car because, despite the fact that he would be more protected than a man of my ethnicity in a California prison, he would nevertheless be subjected to a substantial likelihood of being "punked out". That's not my idea of justice. Keith is an old guy -- unlikely to be punked out despite the fact that he's a non-violent 'white guy' -- but he's the kind of guy who probably wouldn't do well in a California prison. As I said, we have serious differences but I've known him for decades, and his going into a California prison doesn't sit right with me anymore than it does with a young Hispanic kid who I don't know. The US now incarcerates a greater percentage of its population than does any other country. That's quite an accomplishment for a system known world-wide to also be a source of racist sexual sadism. So quite honestly I don't care what Henson has or hasn't done. He doesn't belong in a US prison. No one does. Even the best of US prisons still will extradite to the worst of US prisons. There are precedents for refusing to extradite criminals from Canada due to conditions in the US prison system. For example, assistant U.S. attorney Gordon Zubrod from Harrisburg, PA made the following public statement to 3 suspects who fled to Canada (this statement was captured for the public record during a Canadian Broadcasting Corporation interview): "You're going to be the boyfriend of a very bad man if you wait out your extradition." After that it was very hard for the Canadian authorities to justify extraditing the suspects to the US. Now, agreed, it is rather unusual for a federal official to lose his grip this way, but everyone knows this is exactly the sort of power that "law" enforcement officials wield over criminals in the US. Why does it take a federal official slipping up royally like that to get asylum? To make matters worse, Keith claims he has been threatened with abuse in prison by Scientology zealots: "And cult agents have made fairly clear public threats that I would not survive jail." Is Keith making this up? Not likely. Scientologists aren't known for their tact, any more than are federal attorneys. Anyway, back to the question: Why should you care? Maybe you don't like Scientology. Maybe you like Keith. Maybe you just like to mess with the California government. Whatever, Keith Henson is asking for help and he quite probably actually needs it. Full discussion: http://www.kuro5hin.org/story/2004/9/14/32340/5809 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Time for new hash standard
by R. A. Hettinga 19 Sep '04

19 Sep '04

<http://smh.com.au/cgi-bin/common/popupPrintArticle.pl?path=/articles/2004/0…> Sydney Morning Herald Time for new hash standard By Bruce Schneier Comment September 20, 2004 - 9:09AM At the CRYPTO conference in Santa Barbara, CA, last month, researchers announced several weaknesses in common hash functions. These results, while mathematically significant, aren't cause for alarm. But even so, it's probably time for the cryptography community to get together and create a new hash standard. One-way hash functions are a cryptographic construct used in many applications. They are used in conjunction with public-key algorithms for both encryption and digital signatures. They are used in integrity checking. They are used in authentication. They have all sorts of applications in a great many different protocols. Much more than encryption algorithms, one-way hash functions are the workhorses of modern cryptography. In 1990, Ron Rivest invented the hash function MD4. In 1992, he improved on MD4 and developed another hash function: MD5. In 1993, the National Security Agency published a hash function very similar to MD5, called SHA (Secure Hash Algorithm). Then, in 1995, citing a newly discovered weakness that it refused to elaborate on, the NSA made a change to SHA. The new algorithm was called SHA-1. Today, the most popular hash function is SHA-1, with MD5 still being used in older applications. One-way hash functions are supposed to have two properties. One, they're one way. This means that it is easy to take a message and compute the hash value, but it's impossible to take a hash value and recreate the original message. (By "impossible" I mean "can't be done in any reasonable amount of time.") Two, they're collision free. This means that it is impossible to find two messages that hash to the same hash value. The cryptographic reasoning behind these two properties is subtle, and I invite curious readers to learn more in my book "Applied Cryptography." Breaking a hash function means showing that either - or both - of those properties are not true. Cryptanalysis of the MD4 family of hash functions has proceeded in fits and starts over the last decade or so, with results against simplified versions of the algorithms and partial results against the whole algorithms. This year, Eli Biham and Rafi Chen, and separately Antoine Joux, announced some pretty impressive cryptographic results against MD5 and SHA. Collisions have been demonstrated in SHA. And there are rumors, unconfirmed at this writing, of results against SHA-1. The magnitude of these results depends on who you are. If you're a cryptographer, this is a huge deal. While not revolutionary, these results are substantial advances in the field. The techniques described by the researchers are likely to have other applications, and we'll be better able to design secure systems as a result. This is how the science of cryptography advances: we learn how to design new algorithms by breaking other algorithms. Additionally, algorithms from the NSA are considered a sort of alien technology: they come from a superior race with no explanations. Any successful cryptanalysis against an NSA algorithm is an interesting data point in the eternal question of how good they really are in there. To a user of cryptographic systems - as I assume most readers are - this news is important, but not particularly worrisome. MD5 and SHA aren't suddenly insecure. No one is going to be breaking digital signatures or reading encrypted messages anytime soon with these techniques. The electronic world is no less secure after these announcements than it was before. But there's an old saying inside the NSA: "Attacks always get better; they never get worse." These techniques will continue to improve, and probably someday there will be practical attacks based on these techniques. It's time for us all to migrate away from SHA-1. Luckily, there are alternatives. The National Institute of Standards and Technology already has standards for longer - and harder to break - hash functions: SHA-224, SHA-256, SHA-384, and SHA-512. They're already government standards, and can already be used. This is a good stopgap, but I'd like to see more. I'd like to see NIST orchestrate a worldwide competition for a new hash function, like they did for the new encryption algorithm, AES, to replace DES. NIST should issue a call for algorithms, and conduct a series of analysis rounds, where the community analyzes the various proposals with the intent of establishing a new standard. Most of the hash functions we have, and all the ones in widespread use, are based on the general principles of MD4. Clearly we've learned a lot about hash functions in the past decade, and I think we can start applying that knowledge to create something even more secure. Better to do it now, when there's no reason to panic, than years from now, when there might be. Bruce Schneier is a world-renowned security technologist. His latest book is Beyond Fear: Thinking Sensibly About Security in an Uncertain World. He can be reached at www.schneier.com. This article first appeared in his monthly newsletter Crypto-Gram and is reproduced with permission. Copyright rests with the author. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

voting: economics of paper trails
by Major Variola (ret) 19 Sep '04

19 Sep '04

Isn't it *cheaper* (as well as more accurate) to have preprinted ballots, optically scanned, then to have an embedded computer print out a paper trail? Ie, don't the benefits of volume printing beat the cheapest printing tech? Besides the other advantages of being self-verifiable, more accurate, intuitive, unhackable, not having to be destroyed or randomized (as with serial polling-place-kept paper trails), etc? Methinks the printing press / optical scanner industry is not resisting the Diebold/tech-fetishist whores adequately... I think Ben Franklin would agree.

1 0

Re: Geopolitical Darwin Awards
by Tyler Durden 19 Sep '04

19 Sep '04

A solid post. In this context I'd drill down a bit to the idea of "fanaticism"... > > And if you ask me, fanaticism never lasts very long > > anywhere, only for about a generation during turbulent times. > >That is what King George and his redcoats said about the >ragtag colonials, American as well as those who suffered the >king's abuse into the 20th Centruty. My running, personal theory is that Muslim fundamentalism (and in general, most fundamentalisms) get going when the locals gain a persistent sense that they're gettin' screwed over, and that their current government ain't helping a whole lot. It's kind of a devil's bargain to obtain a source of strength. By necessity it needs to reject a lot of the local culture, otherwise there isn't sufficient motivation to fight. In general, it's probably on many levels predictable and even reasonable. Of course, this can boil over into bizarre, "fanatical" behavior, but then again as Mr Young so aptly put it, "fanatical" is what the screw-ers normally call mass behavior they don't like. In the case of Nukes, I'd point out that the nuclear nations have a distinct advantage at the UN or any other bargaining table, so if I were Iranian I'd be working pretty hard to get something quasi-viable together that could be called a "nuke". Of course, the few truly "fanatical" members of the local nuke-wannabees might get a hold of the block box and, well, that sucks. -TD _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

Disowned spooks get to be Mohommad's boyfriend for 10 yrs
by Major Variola (ret) 18 Sep '04

18 Sep '04

http://rdu.news14.com/content/headlines/?ArID=55256&SecID=2 ---- Soviets:Chechnya::US:?

1 0

Classified papers up in cost, number
by R. A. Hettinga 18 Sep '04

18 Sep '04

<http://www.washingtontimes.com/functions/print.php?StoryID=20040917-115320-…> The Washington Times www.washingtontimes.com Classified papers up in cost, number By Audrey Hudson THE WASHINGTON TIMES Published September 18, 2004 The federal government last year spent $6.5 billion to create 14 million new classified documents, a 60 percent increase over 2001 that has alarmed government watchdog groups, according to a report by openthegovernment.com. "While some increase in classification is to be expected in wartime, this dramatic rise runs counter to recommendations by the 911 Commission and the congressional joint inquiry into 9/11, both of which recommended reforms to reduce unnecessary secrets," says the report by the group of journalists and consumer and government watchdogs. Federal officials have used the September 11 terrorist attacks to turn the public's right to know into the government's right not to tell, said Steven Aftergood, director of the project on government secrecy at the Federation of American Scientists, a national security watchdog group. "This is what happens when you give government agencies unlimited authority to control information; they are going to abuse it. That doesn't mean though there should not be restrictions. Everyone agrees all kinds of things need to be protected, but they are going overboard and no one seems to be in a position to stop them," Mr. Aftergood said. The National Commission on Terrorist Attacks Upon the United States cited "overclassification" of documents as a barrier to information sharing among agencies needed to fight terrorism, and legislators have discussed the issue at hearings held in response to the commission's report. Carol Haave, deputy undersecretary of defense for counterintelligence and security, last month told a House subcommittee on national security and emerging threats that as many as 50 percent of classified documents don't warrant the classification. She said there is a tendency at the Defense Department to "err on the side of caution." A portion of the $6.5 billion also was used to secure existing secrets, which typically are never unsealed for public consumption, even when their information really doesn't need to be protected, experts agree. Only 43,000 documents were declassified last year at a cost of nearly $54,000 compared to more than 100,000 documents declassified in 2001 prior to the September 11 terrorist attacks at a cost of $232,000, according to openthegovernment.com, whose analysis focused on pre- and post-attack numbers. A Congressional Research Service report released in June recommends placing time restrictions on the classification of documents, establishing an oversight board to review such classifications and holding periodic congressional briefings on them. It says that, historically, making information public is a primary way to expose and eliminate fraud and abuse in government. As the number of classified documents continues to rise, so do public requests to disclose government information under the Freedom of Information Act (FOIA). Such requests have tripled over the past six years. There were more than 3 million FOIA requests from federal agencies last year, up from 2.4 million in 2002. There also is a proliferation of ad hoc policies to restrict public access to information that is not classified, but still hidden from the public, legislators and experts say. For example, documents inside the Homeland Security Department are increasingly being labeled "For Official Use Only," "Sensitive Security Information," "Sensitive Homeland Security Information," and "Sensitive but Unclassified," the congressional report said. The report said the use of such terminology is dangerous because it prevents the disclosure of information and questionable policy, which, if seen by the public, could spur change. "There recently has been a dramatic upturn in the number of documents that have either been stamped SSI or 'Official Use Only,' including examples of activities that apparently were of a social orientation, and are clearly not of official nature, let alone of a classified matter," said Bob Flamm, executive director of the Federal Air Marshal Association. "It's being abused on a regular basis," Mr. Flamm said. However, Dave Adams, spokesman for the U.S. Federal Air Marshal Service, disputes that assertion and says that the SSI stamp is "not just automatically" being stamped on every document unless it is "sensitive." "Official Use Only" which is described by a Homeland Security directive as unclassified but sensitive information, would include threat assessment information, security plans, and financial information or information that could threaten security operations. Federal air marshals (FAM) say e-mail from management is automatically being stamped "Official Use Only" stating that "no portion of any document can be released to the media, the general public ... release of any FAM Service document, correspondence or law enforcement sensitive material could adversely affect our mission or jeopardize investigative activities." E-mail with the stamps describe medical checkup procedures, vacancy announcements that are also posted on the Internet, and one announced a going-away party for a colleague inviting co-workers "for Krispy Kremes and coffee" for the employee's farewell. "That sounds amazing," Mr. Aftergood said. "It is simply arbitrary. They make it up as they go along, and it's hard to take seriously." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Barbarians at the Digital Gate
by R. A. Hettinga 18 Sep '04

18 Sep '04

<http://nytimes.com/2004/09/19/business/yourmoney/19gator.html?pagewanted=pr…> The New York Times September 19, 2004 Barbarians at the Digital Gate By TIMOTHY L. O'BRIEN and SAUL HANSELL ARSTEN M. SELF, who oversees a children's computer lab at a youth center in Napa, Calif., spends about a half-hour each morning electronically scanning 10 PC's. He is searching for files and traces of code that threaten to hijack the computers by silently monitoring the children's online activities or by plastering their screens with dizzying - and nearly unstoppable - onslaughts of pop-up advertisements. To safeguard the children's computers, Mr. Self has installed a battery of protective software products and new Web browsers. That has kept some - but by no means all - of the youth center's digital intruders at bay. "You would expect that you could use these systems in a safe and sane way, but the fact of the matter is that you can't unless you have a fair amount of knowledge, time to fix the problems and paranoia," he said. The parasitic files that have beset Mr. Self and other frustrated computer users are known, in tech argot, as spyware and adware. The rapid proliferation of such programs has brought Internet use to a stark crossroads, as many consumers now see the Web as a battlefield strewn with land mines. At the same time, major advertisers and big Internet sites are increasingly tempted by adware's singular ability to display pop-up ads exactly when a user has shown interest in a particular service or product. "Adware has its place, but to grab market share I think a lot of companies are doing things that make consumers feel betrayed," said Wayne Porter, co-founder of Spyware-Guide.com, a Web site that tracks adware and spyware abuses. "I think we're at a very important inflection point that is going to decide how the Internet operates." The exact definitions of spyware and adware, like many things in the ever-changing world of the Internet, remain open to debate. But spyware generally refers to programs that reside in hidden corners of a computer's hard drive and record confidential information like keystrokes, passwords and the user's history of Web site visits. Some of the most insidious versions have to be installed on a computer by someone other than the user - maybe a jealous spouse or lover. Adware, for its part, marries old-fashioned highway billboard pitches to online distribution and the possibility of immediate response. Adware vendors range from fly-by-night operators who hawk pornography and gambling, wherever they can, to more legitimate companies like the Claria Corporation, which tries to aim its ads at the consumers deemed most likely to respond, based on their surfing habits. Claria alone has about 29 million users running its adware products on their computers, according to comScore MediaMetrix, an Internet research firm. That compares with 1.5 million users in early 2000, according to the company. Some spyware creeps onto a computer's hard drive unannounced, often by piggybacking onto other software programs that people download or by sneaking through backdoor security gaps in Web browsers when consumers visit certain sites. In other cases, consumers technically agree to download the software, but critics say that the disclosures are hard to find. FOR all the differences between spyware and adware, their impact on computers is pretty much the same: screens transformed into digital versions of Times Square, and overburdened PC's that operate much more slowly as they struggle with random and uncontrollable processes prompted by the hard drive. Small wonder that consumers are throwing up their hands in despair. "From what consumers are telling us, they feel like their computers are being taken away from them," Mr. Porter said. "We have some consumers saying it makes them hesitant to use the Internet at all because of what an annoyance it has become." Reliable data about the booming adware market is scant, but consumer complaints have become frequent and vociferous. Privacy watchdogs like the Center for Technology and Democracy in Washington have called for closer regulatory scrutiny of the industry. Legislation seeking to protect consumers from abusive adware and spyware has been introduced in Congress. One state, Utah, has even outlawed the installation of any software without users' consent. Consumers can use some tools to fight adware and spyware themselves. Software products like Spybot-Search & Destroy, Spy Sweeper and Adaware can zap some intrusive programs on a hard drive and block attempts to trespass onto a PC. And many analysts like Mr. Porter recommend that consumers switch from Microsoft's Internet Explorer to Mozilla Firefox, a free browser that they say has fewer security vulnerabilities. (Microsoft has issued software patches for Explorer and released an update to Windows XP that makes it harder for consumers to download software unknowingly.) But critics of the adware industry say solutions to the problems ultimately must come from vendors themselves. Against this landscape, companies that still hope to mine the lucrative promises of adware have choices to make: to abandon the pop-up promotions that consumers find so annoying or to overhaul their practices so thoroughly that they are seen as responsible online citizens. Some companies seem unlikely to follow the second path. Perhaps the most infamous adware purveyor is an elusive enterprise alternately known as CoolWWWSearch or CoolWebSearch. The company operates from computer servers in the United States as well as far-flung places like Russia, Britain, the Virgin Islands and Spain. It has developed adware that can change its name and its location on a hijacked computer several times a day - making it virtually impossible to track. The company did not reply to an e-mail message seeking comment. Spyware Labs Inc., a Hawaiian company, promotes itself as a vendor of anti-spyware tools but peddles a product called Virtual Bouncer that experts like Mr. Porter say functions as spyware and adware once it is installed on a computer. Spyware Labs also did not answer an e-mail message seeking comment. Spyware companies are considered some of the most disreputable players in the industry, because their products can be used for illicit purposes. While many adware companies engage in some of the same practices as spyware companies - both track users' browsing habits, for example - adware tends to occupy a less nefarious position. In the realm of more mainstream adware vendors stands Claria, based in Redwood City, Calif. The company, founded as Gator in 1998, is trying to recast adware as a more consumer-friendly addition to computers. Smart minds and smart money surrounded Claria from the beginning. It was founded by Denis Coleman, a Silicon Valley entrepreneur who was a co-founder of the company that became Symantec. Among Claria's earliest investors were Scott D. Cook, founder of Intuit Inc.; Andy Bechtolsheim, a co-founder of Sun Microsystems; and Philip M. Young, an investor with U.S. Venture Partners, a venture capital firm in Menlo Park, Calif. Claria piggybacks its adware on popular programs like Kazaa, the music file-sharing service, and has a lucrative partnership with Yahoo, one of the Internet's busiest sites. Claria's investors and executives say the company has been unfairly grouped with shadier operators and that its goal was never to spy on computer users or to gather personal information surreptitiously. Instead, they say, the aim is to offer useful ads tailored to consumers' real interests and needs, derived from careful monitoring of their Web use. "A technique that provided much more relevant information and advertising to a computer user seemed like a powerful concept," Mr. Young said. "Claria has demonstrated how much more powerful a message is when it's delivered to the right user, and Claria's only scratched the surface of what they're capable of doing when they deploy their software." CLARIA recently canceled plans to take itself public, citing changing business circumstances; it declined to offer a more detailed explanation. But the company's public filings offer evidence of its financial potential. After a few years of losses, the company earned $91,000 in 2002 on $40.5 million in revenue. Last year, it earned about $35 million on $90.5 million in revenue - an enviable profit margin. "At the end of the day it's real simple," said Jeffrey McFadden, a former executive at the Internet portal Excite who is now Claria's chief executive. "Consumers find value in relevant advertising." Advertisers find value in the model, too. Mainstream companies like Verizon, Panasonic and Priceline rely on adware programs because of their power to address people's individual interests. Claria said 425 advertisers - including Cendant, FTD, Netflix and Orbitz - use its adware. Nonetheless, Claria has drawn its share of barbs. Several companies, including The New York Times, have sued Claria, arguing that its pop-up ads violate trademark protections when they appear on the companies' Web sites. Claria has settled most of those suits, including with The Times, but declined to discuss the terms. Claria has also drawn the ire of advocacy groups, partly because of its ubiquity and its role as an industry pioneer. Critics also denounce some of its business practices, particularly the way it bundles its software with other programs and the stealth it has used to land on users' hard drives. "They were very aggressive for a long time, and they turned off a lot of people," said Ari Schwartz, associate director of the Center for Democracy and Technology. "That said, they seem now to be moving in the direction of trying to take steps to make their business more legitimate." It won't be easy, he added: "They still have a long way to go to make their product something people want to have rather than something they're stuck with." Mr. Schwartz said that he believed that Claria's products were not easy to remove from a computer. Claria executives dispute that computer users are "stuck with" their products. They say they have worked closely with Mr. Schwartz and other critics to make their ad programs more visible and palatable to computer users. Scott Eagle, Claria's chief marketing officer, said the company downloads its adware to a user's hard drive only with permission, makes the adware easy to remove and clearly identifies its products. He also says Claria does not collect personal information like last names, phone numbers or e-mail, Internet and home addresses. "We would rather not show you an ad that's not going to be relevant to you, because that doesn't add any value to you or the advertiser," Mr. Eagle said. "The big question is, 'Where does this all go?' Pop-ups and pop-unders are not wildly accepted by consumers." As a result, Mr. Eagle said, Claria will move away from providing pop-ups and will offer more static banner ads on some Web sites. Others in the Internet advertising industry also say that negative reaction has persuaded them to forgo the pop-up route. "Everyone is searching for the magic bullet where the consumer will say yes to pop-ups," said David J. Moore, the chief executive of 24/7 Real Media, a large Internet advertising company. "The average consumer will end up with a few of these adware programs, and it sours them on the entire experience." Mr. Moore said 24/7 had considered buying an adware company but had passed. "We were nervous about the long-term business prospects," he said. "There seems to be a fairly strong groundswell to limit how they do business." WhenU.com, another prominent adware company, began as a comparison-shopping service founded by consultants at the Boston Consulting Group. But the company, based in New York, discovered that comparison-shopping was an unprofitable service, and it, like Claria, began bundling adware with a number of file-sharing companies including, briefly, Kazaa. WhenU, like Claria, uses display ads called sliders - because they slide up from the bottom of the screen. The ads are generated by WhenU's software and can be launched even when a browser is not open - meaning they cannot be stopped by software that blocks pop-up ads. Other WhenU ads appear in front of an open application, interrupting the user, while others hide behind the application until the user closes it. Avi Naider, WhenU's chief executive, says he believes that pop-ups and related intrusive advertising will continue to be viable even if some consumers try to avoid them. "The business spent four years educating advertisers about the performance you can get from these type of ads, and we didn't spend much time educating consumers," Mr. Naider said. "We never talked to consumers about the benefits of software-based advertising." Mr. Naider says WhenU does not keep user information. Instead, he says, the software his company installs on users' machines tracks the Web sites that users have visited and displays relevant advertising. "This is a healthy direction for advertising to go, with a strong set of standards," he said. But he conceded it would be "a battle to transcend the simplistic perception that most consumers have about adware." THE question remains whether a legitimate business can be built on the back of an industry that has annoyed consumers so deeply and has been linked to truly illegitimate practices. "The adware industry has grown so quickly because it works," said Gary A. Kibel, a lawyer in New York who specializes in new media and advertising law. "I'm sure 80 percent of consumers don't want advertising on television, but if you get rid of advertising on television there'd be no more free TV." Mr. Kibel said federal legislation could help formalize and sanitize the business. But some computer users remain unswayed. "Adware and spyware and all the other malwares that are out there just waste a lot of time and make the whole Internet experience a lot less enjoyable," said Orion E. Hill, president of the Napa Valley Personal Computer Users Group, a nonprofit group that educates consumers about PC's. "It's intrusive into your life, and I don't think that's going to change. "The current Internet model is just too wide open, and I don't have any confidence that any of the new models are going to be any better," Mr. Hill added. "The Internet is just too accessible, and it's too easy for people to make anything they want out of it." Copyrigh -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

The Hand-Marked Ballot Wins for Accuracy
by R. A. Hettinga 18 Sep '04

18 Sep '04

<http://nytimes.com/2004/09/19/politics/campaign/19ballot.html?pagewanted=pr…> The New York Times September 19, 2004 The Hand-Marked Ballot Wins for Accuracy By TOM ZELLER Jr. fter the pandemonium over dimpled and pregnant chads in the 2000 election, nearly everyone agreed it was time to rethink old vote-counting ways. But the stampede to touch-screen voting was not inevitable. Another, demonstrably more reliable technology was already on the rise: optical scan voting, introduced in some parts of the country in the late 1970's. By the 2000 election, optical scanning - which involves marking a paper ballot that is ultimately read and counted by a computer - had overtaken all other voting methods as the most common way to vote in the United States. This year, optical scan systems will be used in more than 45 percent of all counties, according to Election Data Services, a political consulting firm in Washington. After the 2000 election, a study by the Voting Technology Project, a joint effort by the California Institute of Technology and the Massachusetts Institute of Technology, took a hard look at the nation's voting systems. Using a measure of what they called "residual votes" - overcounting, undercounting or not counting votes for any reason - researchers found that two existing voting methods had produced relatively low error rates in the last four presidential elections: old-fashioned hand-counted paper ballots and optical scan systems. The study found that the mechanical lever system, which dominated the market in 1980 and has been in decline ever since, performed considerably worse. In overall performance, electronic voting - both the older push-button variety and the newer touch-screen units - performed scarcely better than punch cards. "The immediate implication of our analysis is that the U.S. can lower the number of lost votes in 2004 by replacing punch cards and lever machines with optical scanning," the report said. "Touch screens are, in our opinion, still unproven." But election officials who decided to change systems overwhelmingly went for the touch screens. Compared with about 13 percent of registered voters in 2000, this year roughly 30 percent of those registered will be asked to vote on electronic systems. Optical scan systems grew as well, although at a much slower pace: from about 30 percent of registered voters in 2000 to just under 35 percent this year, according to Election Data Services. The Caltech/M.I.T. study said that the newest electronic systems had great potential, but were plagued by a variety of problems, like loose cables and confusing interfaces. Change is natural, said Stephen Ansolabehere, a political science professor at M.I.T. and a member of the study team. But "optical scanning is a pretty good interim solution for the next five or 10 years,'' he said. And then what? Litigators, start your engines: the Internet. Professor Ansolabehere is among those who predict that myriad security obstacles will one day be overcome and votes will be cast from the nation's living rooms. "I think it's inevitable," he said. Copyrigh -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Ready or Not (and Maybe Not), Electronic Voting Goes National
by R. A. Hettinga 18 Sep '04

18 Sep '04

<http://nytimes.com/2004/09/19/politics/campaign/19vote.html?hp=&pagewanted=…> The New York Times September 19, 2004 Ready or Not (and Maybe Not), Electronic Voting Goes National By TOM ZELLER Jr. ust over six weeks before the nation holds the first general election in which touch-screen voting will play a major role, specialists agree that whatever the remaining questions about the technology's readiness, it is now too late to make any significant changes. Whether or not the machines are ready for the election - or the electorate ready for the machines - there is no turning back. In what may turn out to be one of the most scrutinized general elections in the country's history, nearly one-third of the more than 150 million registered voters in the United States will be asked to cast their ballots on machines whose accuracy and security against fraud have yet to be tested on such a grand scale. Because of the uncertainties, experts say there is potential for post-election challenges in any precincts where the machines may malfunction, or where the margin of victory is thin. Sorting out such disputes could prove difficult. "The possibility for erroneous votes or malicious programming is not as great as critics would have you believe," said Doug Chapin, the director of Electionline.org, a nonpartisan group tracking election reform. "But it's more than defenders of the technology want to admit. The truth lies somewhere in between." Since the 2000 presidential election and its contentious aftermath, voting systems that record votes directly on a computer - as opposed to those that use mechanical levers or optically scanned paper ballots - have quickly moved to the center of a rancorous debate. The disagreement pits those who see them as unacceptably vulnerable to vote manipulation and fraud against those who see them as an antidote to the wretched hanging chad. Even in the final run-up to November's elections, the issue remains in flux. In California, the machines have been certified, decertified and recertified again. In Ohio, a closely contested state, an electronic upgrade to the state's predominantly punch-card system was halted in July by the secretary of state there, who cited unresolved security concerns. All the while, a vocal mixture of computer scientists, local voting-rights groups and freelance civic gadflies have relentlessly cited security flaws in many of the machines, with some going so far as to say that the flaws could be intentional and accusing the major companies of having ties to conservative political causes. The companies and election officials have fought back bitterly, accusing the activists of being wild-eyed fearmongers. A study released by Electionline.org last month would seem to suggest that partisan politics plays less of a role than critics have claimed. That report found "no industrywide partisan trend to political contributions among the largest election system companies." The leader in the electronic voting machine market, Diebold, and its executives have given more than $400,000 to Republican interests since 2001, the study found. But other large companies, including Election Systems & Software and Sequoia Voting Systems, "gave a slight edge to Democratic candidates and party organizations." Concerns over the security and accuracy of the machines have proved harder to dispel, though, and they have not always come from the fringe. At the end of June, two prestigious groups - the Brennan Center for Justice at New York University School of Law and the Leadership Conference on Civil Rights - issued a set of recommendations for technical upgrades and procedures that they said could help shore up high-tech voting systems in time for the November elections. Nancy Zirkin, the deputy director of the Leadership Conference, said she thought that the report had been taken seriously, but conceded that the group did not know how many states or precincts had actually adopted the recommendations. Other critics say that too little has been done in response to numerous problems - and that it is now too late to do much more before the election, because software and technology have to be tested and "frozen" well ahead of voting to avoid malfunctions and electoral chaos. "Switching now, approximately 40 days before the election, would probably introduce more security problems than it would avoid," said Aviel D. Rubin, a professor of computer science at Johns Hopkins University who brought many of the vulnerabilities in voting systems to light. Senator Barbara Mikulski, a Maryland Democrat, is among those who wonder whether the technology is ready for prime time. As she tried out one of Maryland's new machines at a folk festival last weekend, an apparent slip of her hand generated a "no" vote when she intended to vote "yes," before the error was caught and corrected. By last Monday, Ms. Mikulski had signed on to Senate legislation that would require all electronic voting terminals around the nation to generate a paper record for each vote. But there are no such capabilities in the AccuVote TS touch-screen systems that will be used throughout Maryland and in many other states that have adopted touch screens or other electronic voting devices. And it is too late to add them. The Maryland system is far from foolproof, in the view of Michael Wertheimer, a computer security consultant with RABA Technologies, who was hired by the state of Maryland last year to conduct a mock hacking attack against the Diebold machines. A number of security holes were found, including one in the Microsoft operating system that runs the election software, which did not have up-to-date security patches. The flaws, Mr. Wertheimer said, could allow tampering and skewed election results. He also noted that in the presidential primary election last March, Maryland used software on its machines that had not been certified by independent testing authorities, and thus violated state law. But Linda Lamone, the administrator of the state's election laws, has repeatedly stated that her office has taken the necessary steps to improve the Diebold machines. She says that issues of uncertified software have been corrected and that Maryland's election system is secure. The Maryland Court of Appeals appears to agree. On Tuesday, the court rejected a suit brought by a Maryland voter group, TrueVoteMD, which sought to force the state to further improve security on its machines and offer voters a paper-ballot alternative. Still, as the days dwindle, paper remains at the heart of the debate. Nevada, another state that will make near-universal use of touch-screen voting in November, purchased machines manufactured by Sequoia that produce a paper record - a move that received high marks earlier this month from the Free Congress Foundation, a conservative group in Washington. "Without an actual paper ballot, we are then left with only the computer's word for the election results," the group said in a news release accompanying its informal "Election Preparedness Scorecard" three weeks ago. The group gave grades of F to several states - including Kentucky, Maryland, Delaware and Tennessee - based on their degree of reliance on paperless electronic voting. Florida, whose results will almost certainly receive intense scrutiny, received an F-plus, while Georgia was given an F-minus. New Mexico, a swing state that will rely heavily on touch-screen voting on Nov. 2, received a D-minus. Harris N. Miller, president of the Information Technology Association of America, a trade group that represents many of the voting machine makers, concedes that the industry has probably not been sensitive enough to the political nuances surrounding voting technology - particularly in the aftermath of the 2000 election. But he argued that the fears expressed by many of those opposed to electronic voting are driven as much by ignorance as by passion. "What we're replacing is a system that was broken - so broken that Congress passed a special law," he said, referring to the Help America Vote Act of 2002, which was designed to help overhaul the nation's election system in the aftermath of the 2000 debacle. "It was so broken that Congress appropriated over a billion dollars to fix it," he said. The law, which established the Election Assistance Commission, generally encourages the movement away from punch cards and the exploration of other voting technologies. The law also calls for the federal standards agency, the National Institute for Standards and Technology, to develop universal standards for voting systems. But the agency says the $500,000 Congress appropriated last year for such efforts has been exhausted, and Congress did not provide additional funds for the effort in 2004. As for security concerns, Mr. Miller said that vendors submit their source code - the underlying instructions for the machines' software - for independent inspection, to uncover any hidden programming and to ensure that the machines calculate properly. Critics, however, point out that the labs inspecting the software are typically paid by the vendors themselves, and that they somehow failed to uncover the flaws discovered by Mr. Wertheimer, Professor Rubin, and election officials in Ohio, Maryland and elsewhere. While it is too late in the game to make it possible to produce a paper record for each vote on every machine already deployed, Mr. Miller said that vendors would be willing to include that feature in the future if the market demanded it. Most of the major vendors have models that can supply a printed record, but in most cases, Mr. Miller said, election officials have not required it. Paper receipts are not automatically required because no such universal guideline has ever existed. Mechanical lever machines, for instance, which have been in widespread use since the 1930's - and will still be used by millions of voters this year - have never produced a paper record of each vote. And states have traditionally established their own definitions of what constitutes a ballot. Still, the scrutiny and criticism that have dogged electronic voting machines over the last year all but guarantee that a pall of suspicion and distrust will hang over a technology that awaits approximately 45 million registered voters if they go to the polls. Whether the concerns are justified or overblown, experts say, in the wake of the 2000 election controversy, the mere hint of unreliability this time could turn the electronic vote, should the margin of victory be narrow, into one more tinderbox. "The woods aren't any drier than they were in 2000," Mr. Chapin of Electionline.org is fond of saying, "but there are a lot more people with matches." That is a point that Edward S. Morillo, a representative of the Santa Clara County Registrar of Voters in California, would probably concede. Mr. Morillo travels the county acquainting voters with the Sequoia AVC Edge, the voting machine that will be used there on Nov. 2. On Wednesday afternoon, he stopped by the Indian Health Center in San Jose. As patients and employees took turns poking at the screen, an occasional "What is it?" or "Oops!" seemed to foretell what ballot workers might expect on Election Day. Mr. Morillo said that reactions to the touch screens have generally been mixed, and that Santa Clara County - like every California county where similar electronic voting is in place - would offer a paper ballot alternative for those who, for whatever reason, are not comfortable with the machines. "The thing about the touch screen,'' he said, "is that you either love it or hate it." John Schwartz and Carolyn Marshall contributed reporting for this article. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0