- cypherpunks-legacy - lists.cpunks.org

US airport fake ID study 'was found in al-Qaida cave'
by R. A. Hettinga 21 May '04

21 May '04

<http://www.theregister.co.uk/2004/05/20/us_airport_id_security/print.html> The Register Original URL: http://www.theregister.co.uk/2004/05/20/us_airport_id_security/ US airport fake ID study 'was found in al-Qaida cave' By John Lettice (john.lettice(a)theregister.co.uk) Published Thursday 20th May 2004 21:47 GMT The US House Aviation Subcommittee yesterday heard how congressional investigators used false IDs to gain access to a series of federal buildings and two commercial airports, and how a copy of the report detailing their success was later found in an al-Qaida cave in Afghanistan. The investigators were 100 per cent successful in getting past security, but apparently less so in the case of their own report's security. Subcommittee Chairman John Mica told a hearing (http://www.winonadailynews.com/articles/2004/05/20/ap/HiTech/d82lr3m00.txt) on biometric ID in aviation that the deployment of more secure ID needed to be accelerated, given that terrorists are interested in gaining access to restricted airport areas. The congressional investigators had made their fake IDs using software downloaded from the Internet, and apparently this passed muster. Documentation presented to the hearing however included even more comforting information about the security of the US aviation industry. If you look down near the bottom of this document, (http://www.house.gov/transportation/aviation/05-19-04/05-19-04memo.html) in the section covering the Registered Traveler program you will find a subsection dealing with Law Enforcement Officer (LEO) Credentials. As you see, it says: "Currently, Federal LEO's can fly armed at any time, simply by presenting their agency's credential. In addition, LEO's from 18,000 separate State and local law enforcement agencies may fly armed if they present their agency's credential and a letter on their agency's letterhead stating that they have an official, work-related reason to fly armed. The use of so many different types of law enforcement credentials increases the risk that an unauthorized person could use a forged credential to carry a gun on-board." Under the Registered Traveler Pilot program LEOs wishing to fly armed will have biometric ID issued by the Transportation Security Administration saying so, but it's not clear to us whether this will mean LEOs from the 18,000 non-Federal agencies will have to have this if they want to fly armed, or whether the letterhead will still be enough. The pilot program starts at five airports next month, and one would hope that the authorities elsewhere will be taking extra special care in scrutinising LEO credentials pending a wider rollout. . -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "Several times a week, to enter a TV studio say, or to board a plane, I have to produce a tiny picture of my face." -- Christopher Hitchens

1 0

[IP] Microsoft told to explain e-mail deletion memos
by R. A. Hettinga 21 May '04

21 May '04

--- begin forwarded text

1 0

Science: throttling computer viruses
by Major Variola (ret) 21 May '04

21 May '04

Gist: they can spread too fast to deal with unless you throttle all connections. Science, Vol 304, Issue 5670, 527-529 , 23 April 2004 COMPUTER SCIENCE: Technological Networks and the Spread of Computer Viruses Justin Balthrop, Stephanie Forrest, M. E. J. Newman, Matthew M. Williamson* Computer viruses and worms are an increasing problem throughout the world. By some estimates 2003 was the worst year yet: Viruses halted or hindered operations at numerous businesses and other organizations, disrupted cash-dispensing machines, delayed airline flights, and even affected emergency call centers. The Sobig virus alone is said to have caused more than $30 billion in damage (1). And most experts agree that the damage could easily have been much worse. For example, Staniford et al. describe a worm that could infect the entire Internet in about 30 s (2). A worm of this scale and speed could bring the entire network to a halt, or worse. The term virus refers to malicious software that requires help from computer users to spread to other computers. E-mail viruses, for instance, require someone to read an e-mail message or open an attached file in order to spread. The term worm refers to infections that spread without user intervention. Because they spread unaided, worms can often spread much faster than viruses. Computer infections such as viruses and worms spread over networks of contacts between computers, with different types of networks being exploited by different types of infections. The structure of contact networks affects the rate and extent of spreading of computer infections, just as it does for human diseases (3-7); understanding this structure is thus a key element in the control of infection. Both traditional and network-based epidemiological models have been applied to computer contagion (3-5). Recent work has emphasized the effects of a network's degree distribution. A network consists of nodes or vertices connected by lines or edges, and the number of edges connected to a vertex is called its degree. Of particular interest are scale-free networks, in which the degree distribution follows a power law, where the fraction pk of vertices with degree k falls off with increasing k as k- for some constant . This structure has been reported for several technological networks, including the Internet (8) and the World Wide Web (9, 10). Infections spreading over scale-free networks are highly resilient to control strategies based on randomly vaccinating or otherwise disabling vertices. This is bad news for traditional computer virus prevention efforts, which use roughly this strategy. On the other hand, targeted vaccination, in which one immunizes the highest degree vertices, can be very effective (11, 12). These results rely crucially on the assumption that the degree distribution follows a power law, and also that the contact pattern is static. Many technological networks relevant to the spread of viruses, however, are not scale-free. Vaccination strategies focusing on highly connected network nodes are unlikely to be effective in such cases. Furthermore, network topology is not necessarily constant. In many cases the topology depends on the replication mechanism used by a virus and can be manipulated by virus writers to circumvent particular control strategies that we attempt. If, for instance, targeted vaccination strategies were found to be effective against viruses spreading over scale-free networks, viruses might be rewritten so as to change the structure of the network to some non-scale-free form instead. To make these ideas more concrete, we consider four illustrative networks, each of which is vulnerable to attack: (A) the network of possible connections between computers using the Internet Protocol (IP), (B) a network of shared administrator accounts for desktop computers, (C) a network of e-mail address books, and (D) a network of e-mail messages passed between users. In network A, each computer has a 32-bit IP address and there is a routing infrastructure that supports communication between any two addresses. We consider the network in which the nodes are IP addresses and two nodes are connected if communication is possible between the corresponding computers. Many epidemics spread over such an IP network. Notable examples include the Nimda and SQLSlammer worms. Network B is a product of the common operating system feature that allows computer system administrators to read and write data on the disks of networked machines. Some worms, including Nimda and Bugbear, can spread by copying themselves from disk to disk over this network. Network C has nodes representing users and a connection from user i to user j if j's e-mail address appears in i's address book. Many e-mail viruses use address books to spread (for example, ILoveYou). A closely related network is network D, in which the nodes represent computer users, and two users are connected if they have recently exchanged e-mail. Viruses such as Klez spread over this network. Degree distributions have been measured for examples of each of the four networks (see the figure). In network A, all vertices have the same degree, so the distribution has a single peak at this value (blue histogram). In network B, the distribution consists of four discrete peaks, presumably corresponding to different classes of computers, administrators, or administration strategies (red histogram). Infectious connections. (Left) Degree distributions for the IP (blue) and administrator (red) networks. The administrator network data were collected on a system of 518 users of 382 machines at a large corporation. Computers in this network are connected if any user has administrative privileges on both computers. (Right) Cumulative degree distributions for the e-mail address book (blue) and e-mail traffic (red) networks. The e-mail address book data were collected from a large university (7). The e-mail traffic data were collected for complete e-mail activity of a large corporate department over a 4-month period (18). The two e-mail networks have more continuous distributions and are shown as cumulative histograms. Although neither network has a power-law degree distribution, both have moderately long tails, which suggests that targeted vaccination strategies might be effective. However, calculations show that for network C, about 10% of the highest degree nodes would need to be vaccinated to prevent an epidemic from spreading (7), whereas network D would require about 80%. The first of these figures is probably too high for an effective targeted vaccination strategy, and the second is clearly far too high. (Targeted vaccination would be entirely ineffective in the other two networks as well, because the nodes are much more highly connected.) The two e-mail networks illustrate the ways in which different virus replication strategies can lead to different network topologies. An e-mail virus could look for addresses in address books, thereby spreading over a network with a topology like that of network C, or it could search through other files or folders on the machine for addresses of senders and recipients of archived e-mail messages, giving a topology more like network D. Another example is provided by the Nimda virus, which infects Web servers by targeting random IP addresses, producing a network like network A. However, if the virus had a more intelligent way of selecting IP addresses to attack (e.g., by inspecting hyperlinks), then it might spread over a topology more like that of the Web, which is believed to have a power-law degree distribution (9, 10). A control strategy is needed that is immune to changes in network topology and that does not require us to know the mechanisms of infections before an outbreak. A number of methods have been proposed (13). One such strategy is throttling, first introduced for the control of misbehaving programs (14) and recently extended to computer network connections (15). In this context, throttling limits the number of new connections a computer can make to other machines in a given time period. Because it works by limiting spreading rates rather than stopping spread altogether, the method does not completely eliminate infections but only slows them down. Frequently, however, this is all that is necessary to render a virus harmless or easily controllable by other means (16). Throttling is most effective when viruses generate traffic at a rate significantly higher than normal network communications. Luckily this is true for many common protocols and the viruses that exploit them (15, 17). For a virus to spread, it needs to propagate itself to many different machines; to spread quickly, it must do so at a high rate. For example, the Nimda worm attempts to infect Web servers at a rate of around 400 new machines per second, which greatly exceeds the normal rate of connections to new Web servers of about one per second or slower (15). A throttling mechanism that limited connections to new Web servers to about one per second would slow Nimda by a factor of 400 without affecting typical legitimate traffic. This could easily be enough to change a serious infection into a minor annoyance, which could then be eliminated by traditional means. Slowing the spread of Nimda by a factor of 400 (from a day to more than a year) would have allowed plenty of time to develop and deploy signatures and prophylactic software patches. (Of course, if throttling were implemented on only a subset of the nodes in a network, then infections could spread more easily.) In addition to reducing virus spread, throttling has the practical benefit of reducing the amount of traffic generated by an epidemic, thus reducing demand on networking equipment--often the primary symptom of an attack. Targeted vaccination strategies for the control of computer viruses are unlikely to be generally effective because the networks over which viruses spread are not sufficiently dominated by highly connected nodes, and because network topology can be influenced strongly by the way in which a virus is written. Throttling provides a promising alternative strategy that works with any network topology and can greatly reduce viruses' impact by slowing their spread to the point where they can be treated by conventional means. The disparity between the speed of computer attacks (machine and network speed) and the speed of manual response (human speed) has increased in recent years. If this trend continues, automated mechanisms like throttling will likely become an essential tool, complementing the largely manual approach of software patching in use today. The idea of rate limits is not specific to viruses, and could be applied to many situations in which an attack or cascading failure occurs faster than possible human response. References and Notes 1.Citations documenting these events are listed on www.cs.unm.edu/~judd/virus.html, as are citations to each of the viruses and worms mentioned above. 2.S. Staniford, V. Paxson, N. Weaver, in Proceedings of the USENIX Security Symposium (USENIX Association, Berkeley, CA, 2002), pp. 149-167. 3.J. O. Kephart, S. R. White, in Proceedings of the 1991 IEEE Computer Society Symposium on Research in Security and Privacy (IEEE Computer Society, Los Alamitos, CA, 1991), pp. 343-359. 4.R. Pastor-Satorras, A. Vespignani, Phys. Rev. Lett. 86, 3200 (2001) [APS]. 5.A. L. Lloyd, R. M. May, Science 292, 1316 (2001). 6.H. Ebel, L.-I. Mielsch, S. Bornholdt, Phys. Rev. E 66, 035103 (2002) [APS]. 7.M. E. J. Newman, S. Forrest, J. Balthrop, Phys. Rev. E 66, 035101 (2002) [APS]. 8.M. Faloutsos, P. Faloutsos, C. Faloutsos, Comput. Commun. Rev. 29, 251 (1999). 9.R. Albert, H. Jeong, A.-L. Barabasi, Nature 401, 130 (1999) [Abstract]. 10.J. M. Kleinberg, S. R. Kumar, P. Raghavan, S. Rajagopalan, A. Tomkins, in Proceedings of the International Conference on Combinatorics and Computing, vol. 1627 of Lecture Notes in Computer Science (Springer, Berlin, 1999), pp. 1-18. 11.R. Albert, H. Jeong, A.-L. Barabasi, Nature 406, 378 (2000) [Medline]. 12.D. S. Callaway, M. E. J. Newman, S. H. Strogatz, D. J. Watts, Phys. Rev. Lett. 85, 5468 (2000) [APS]. 13.D. Moore, C. Shannon, G. Voelker, S. Savage, in Proceedings of the 22nd Annual Joint Conference of IEEE Computer and Communication Societies (INFOCOM) (IEEE Communications Society, New York, 2003), pp. 1901-1910. 14.A. Somayaji, S. Forrest, in Proceedings of the 9th USENIX Security Symposium (USENIX Association, Berkeley, CA, 2000), pp. 185-197. 15.M. M. Williamson, in Proceedings of ACSAC Security Conference (IEEE Computer Society, Los Alamitos, CA, 2002), pp. 61-68. 16.M. M. Williamson, Complexity 9, 34 (November- December 2003) [Abstract]. 17.M. M. Williamson, in Proceedings of ACSAC Security Conference (IEEE Computer Society, Los Alamitos, CA, 2003), pp. 76-85. 18.J. R. Tyler, D. M. Wilkinson, B. A. Huberman, in Communities and Technologies, M. Huysman, E. Wenger, V. Wulf, Eds. (Kluwer, Dordrecht, Netherlands, 2003), pp. 81-95 [publisher's information]. 19.We thank J. Gassaway for help collecting the e-mail address book data set, C. Hickman for the administrator data set, and J. Tyler and B. Huberman for the e-mail traffic data set. Supported by the James S. McDonnell Foundation, NSF, Defense Advanced Research Projects Agency, Intel Corp., and Santa Fe Institute.

3 2

[David_Heinrich@urmc.rochester.edu: [mises] praxeology and game theory]
by Gabriel Rocha 21 May '04

21 May '04

Possibly of interest to some here... ----- Forwarded message from Pro-Choice <David_Heinrich(a)urmc.rochester.edu> -----

2 1

Database Measured 'Terrorism Quotient'
by R. A. Hettinga 20 May '04

20 May '04

<http://apnews.myway.com/article/20040520/D82M9B400.html> AP: Database Measured 'Terrorism Quotient' Email this Story May 20, 7:25 AM (ET) By BRIAN BERGSTEIN sponsored links Voice Your Opinion - Take today's My Way Poll, featuring a new topic daily. http://poll.myway.com Play Free Online Games - Collapse, Bounce Out, Jigsaw, Crossword, Mah Jong and tons more. http://games.myway.com NEW YORK (AP) - Before helping to launch the criminal information project known as Matrix, a database contractor gave U.S. and Florida authorities the names of 120,000 people who showed a statistical likelihood of being terrorists - sparking some investigations and arrests. The "high terrorism factor" scoring system also became a key selling point for the involvement of the database company, Seisint Inc., in the Matrix project. Public records obtained by The Associated Press from several states show that Justice Department officials cited the scoring technology in appointing Seisint sole contractor on the federally funded, $12 million project. Seisint and the law enforcement officials who oversee Matrix insist that the terrorism scoring system ultimately was kept out of the project, largely because of privacy concerns. However, new details about Seisint's development of the "terrorism quotient," including the revelation that authorities apparently acted on the list of 120,000, are renewing privacy activists' suspicions about Matrix's potential power. "Assuming they have in fact abandoned the terrorist quotient, there's nothing that stops them from bringing it back," said Barry Steinhardt, director of the technology and liberty program at the American Civil Liberties Union, which learned about the list of 120,000 through its own records request in Utah. Matrix - short for Multistate Anti-Terrorism Information Exchange - combines state records and data culled by Seisint to give investigators fast access to information on crime and terrorism suspects. It was launched in 2002. Because the system includes information on people with no criminal record as well as known criminals, Matrix has drawn objections from liberal and conservative privacy groups. Utah and at least eight other states have pulled out, leaving Florida, Connecticut, Ohio, Michigan and Pennsylvania. The AP has received thousands of pages of Matrix documents in records requests this year, including meeting minutes and presentation materials that discuss the project in detail. Not one indicates that Matrix planners decided against using the statistical method of determining an individual's propensity for terrorism. When the AP specifically requested documents indicating the scoring system was scrapped, the general counsel's office for Florida state police said it could not uncover any. Even so, people involved with Matrix pledge that the statistical method was removed from the final product. "I'll put my 26 years of law enforcement experience on the line. It is not in there," said Mark Zadra, chief investigator for the Florida Department of Law Enforcement. He said Matrix, which has 4 billion records, merely speeds access to material that police have always been able to get from disparate sources, and does not automatically or proactively finger suspects. Bill Shrewsbury, a Seisint executive and former federal drug agent, said the terrorism scoring algorithm that produced the list of 120,000 names was "put on the shelf" after it was demonstrated immediately following Sept. 11, 2001. He said the scoring system requires intelligence data that was fed into the software for the initial demonstration but is not commonly available. "Nor are we interested in pursuing that," he said. The Utah documents included a Seisint presentation saying the scoring system was developed by the company and law enforcement officials by reverse engineering an unnamed "Terrorist Handbook" that reveals how terrorists "penetrate and in live our society." The scoring incorporated such factors as age, gender, ethnicity, credit history, "investigational data," information about pilot and driver licenses, and connections to "dirty" addresses known to have been used by other suspects. According to Seisint's presentation, dated January 2003 and marked confidential, the 120,000 names with the highest scores were given to the Immigration and Naturalization Service, FBI, Secret Service and Florida state police. (Later, those agencies would help craft the software that queries Matrix.) Of the people with the 80 highest scores, five were among the Sept. 11 hijackers, Seisint's presentation said. Forty-five were identified as being or possibly being under existing investigations, while 30 others "were unknown to FBI." "Investigations were triggered and arrests were made by INS and other agencies," the presentation added. Two bullet points stated: "Several arrests within one week" and "Scores of other arrests." It does not provide details of when and where the investigations and arrests took place. Phil Ramer, who heads Florida state police's intelligence division, said his agency found the list a useful starting point for some investigations, though he said he could not recall how many. He stressed that the list was not used as the sole evidence to make arrests. "What we did with the list is we went back and found out how they got on the list," Ramer said. Dean Boyd, a spokesman for U.S. Immigration and Customs Enforcement, a descendant of INS in the Department of Homeland Security, said he could not confirm that INS used or was given the list. Although Seisint says it shelved the scoring system - known as high terrorist factor, or HTF - after the original demonstrations in the wake of Sept. 11, 2001, the algorithm was touted well into 2003. A records request by the AP in Florida turned up "briefing points," dated January 2003, for a presentation on Matrix to Vice President Dick Cheney and other top federal officials delivered jointly by Seisint, Florida Gov. Jeb Bush and Florida's top police official. One of the items on Seisint's agenda: "Demonstrate HTF with mapping." Matrix meeting minutes from February 2003 say Cheney was briefed along with Homeland Security Director Tom Ridge and FBI Director Robert Mueller. In May 2003, the Justice Department approved Seisint as sole data contractor on the project, citing the company's "technical qualifications," including software "applying the 'terrorism quotient' in all cases." "The quotient identifies a set of criteria which accurately singled out characteristics related to the perpetrators of the 9-11 attacks and other terrorist events," said a memo from an Office of Justice Programs policy adviser, Bruce Edwards. "This process produced a scoring mechanism (that), when applied to the general criminal population, yields other people that may have similar motives." A spokeswoman for the Office of Justice Programs declined to comment. Ramer, the Florida agent, said the scoring system was scrapped because it was "really specific to 9/11," and not applicable for everyday use. Also, he said, "we didn't want anybody abusing it." Seisint Inc., is a Boca Raton, Fla., company founded by a millionaire, Hank Asher, who stepped down from its board of directors last year after revelations of past ties to drug smugglers. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Paying through the mouse
by R. A. Hettinga 20 May '04

20 May '04

<http://www.economist.com/finance/PrinterFriendly.cfm?Story_ID=2693526> The Economist Online payments Paying through the mouse May 20th 2004 | SAN JOSE, CALIFORNIA >From The Economist print edition PayPal is turning into a huge online-payments business ONE of the most powerful forces in e-commerce is the "network effect": the more people who flock to a particular website, the greater its appeal. The latest beneficiary of this phenomenon is PayPal, which now handles online payments at an annualised rate of more than $17 billion. PayPal is not a bank, but for online buyers and sellers it performs much the same function. It already has 45m account-holders worldwide, one-quarter of the number of the mighty Citigroup. Next time, online The company began in Silicon Valley in 1998. Its e-mail system for payments became so widespread on internet auction sites that the biggest firm in this business, eBay, set up a rival, Billpoint, in the hope of snaffling for itself some of the value of transactions. But Billpoint never matched PayPal's popularity, so in 2002 eBay bought PayPal for $1.5 billion in shares. PayPal's ambition is to become the global standard for internet payments and it is expanding overseas in eBay's footsteps. In the first quarter of 2004, the value of items sold on eBay was $8 billion, 51% more than a year earlier. Meg Whitman, eBay's chairman, told analysts recently that the company reckons one in three online shoppers in America now has a PayPal account. Although PayPal's customers mostly buy via eBay, usage elsewhere is also growing-estimated at well over $1 billion-worth of transactions in the first quarter of the year. Besides purchasing from other dotcoms, you can pay your taxes in York County, South Carolina or send a donation to the Pat Brody Shelter for Cats in Lunenburg, Massachusetts. PayPal also does gift vouchers. The payment mechanism is simple enough. Newcomers to PayPal provide details of a credit card or bank account. These are verified with a nominal transaction. Thereafter, a buyer can e-mail a payment directly to a seller. This is immediately debited from the buyer's credit card or bank account, and a credit is made to the seller's PayPal account. Money in a PayPal account can be withdrawn by cheque or transferred to a bank account. Individuals and small traders can receive credit-card payments without obtaining a merchant account. PayPal's cut comes from charging recipients between 2.2% and 3.4%, depending on the country, and levying fees for currency conversions. In the first quarter of 2004, PayPal's revenues were $155m, 69% more than a year before. PayPal has helped slash the time internet users spend completing transactions and has greatly increased confidence in trading online, says Matthew Bannick, the company's general manager of global payments. It can take several weeks for cheques to arrive in the post and for payments to clear, but online payments are made instantly, which means goods can be shipped straight away. "It has improved the velocity of trade," adds Mr Bannick. Another benefit, he says, is that buyers do not have to impart banking or credit-card information to merchants. Security remains the prime concern of internet shoppers. An NOP survey that PayPal commissioned in Britain, where the company opened its first overseas site last year, found that more than one-third of internet users are reluctant to spend more than #50 ($90) online. To overcome their concerns, payment protection is now offered in America (up to $500) and in Britain (up to #250) on goods sold by eligible traders (those who have built up good reputations within eBay's ranking system). This now covers more than 60% of all listings on eBay's American site. PayPal wants to expand internationally, to continental Europe and Asia. Although it has not said so, the likeliest next local site is Germany; China, eBay's fastest-growing market, looks like a good long-term possibility. Such growth will bring new challenges. People in different countries favour different ways of making payments offline: the French like cheques, for instance; in Germany, bank transfers are common. This might translate into different online habits. Countries also regulate financial services differently. PayPal has no plans, though, to become a bank, even though it performs some similar functions. Customers in America can earn interest on their PayPal balances by allowing PayPal to place the funds in a pooled savings account or by enrolling into PayPal's money market fund. It has been licensed as a money-transmitter in American states and in Britain. Regulation as a bank would require more costly and complicated compliance. Nevertheless, the company has faced regulatory challenges, not least because it could be used for the illicit transfer of funds. Soon after it acquired PayPal, eBay ended its services to online gambling merchants because of complaints from federal prosecutors that this violated America's Patriot Act, which Congress passed after the September 11th terrorist attacks to harden money-laundering rules. Last year, eBay paid $10m to settle the charges. Because most of its payments are small, big sums stand out. This should help PayPal comply with the authorities. Now it is interested in handling even smaller amounts. Late last year it introduced lower processing fees for micro-payments, to make it more feasible for online merchants to accept tiny payments for digital-music downloads. The success of portable music players, such as Apple's iPod, suggest that this too will be big online business. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Weblinks sponsors the Senior National Cricket Team Uniforms
by R. A. Hettinga 20 May '04

20 May '04

<http://www.radioaxa.com/local_news.htm#locnews2> Radio Anguilla Thursday, 20 May, 2004 12:23 PM Weblinks sponsors the Senior National Cricket Team Uniforms Anguilla's newly formed Telecommunications Company Weblinks, has taken the initiative to sponsor a number of uniforms for the Anguilla Senior National Cricket team. The National team will participate in the Leeward Islands Cricket Tournament - slated to begin on May 28. Speaking during a presentation ceremony and cocktail last night at Paradise Cove Resort, President of the Anguilla Cricket Association Mr Gerard Gumbs underscored the importance of the development of society through sports. "I am proud to say that as local Anguillians, they have seen the need to contribute further to the development of the Anguillian society by contributing wholeheartedly to the sponsorship of the uniform for the local Cricket Team. These guys are truly Anguillians at heart who believe they can make a difference in helping to nurture a good society through their contribution to the sport of Cricket. Let us not underestimate the value that playing sports has on the lives of our people, especially our young people. Sports is still today, an aspect of our life that calls for tremendous personal discipline, on and off the field of play. If you check professional sportsmen, most of them talk about being role models within their community and giving back to their communities. It is through efforts such as this sponsorship that we here in Anguilla can mold young people into productive men and women, as interaction through sports helps to build character, respect and discipline." President of the Anguilla Cricket Association Mr Gerard Gumbs. In making the presentation, Weblinks representative, Mr Kennedy Hodge stated that he hopes Weblinks will someday be able to provide sponsorship for all expenses of the National Team. The Company has this year provided team members with three warm up t-shirts, playing shirts, warm up pants and a travelling shirt. Weblinks is a locally owned and based company that has been in operation since late 1999. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: IRS May Help DOD Find Reservists
by Major Variola (ret) 20 May '04

20 May '04

At 04:11 PM 5/18/04 -0700, Bill Stewart wrote: >At 12:49 PM 5/18/2004, R. A. Hettinga wrote: >> >> FORT WORTH, Texas - The Defense Department, strapped for troops for >>missions in Iraq and Afghanistan, has proposed to Congress that it tap the >>Internal Revenue Service to locate out-of-touch reservists. >> > >Wow! It was "EXAMINED BY LAWYERS!" That's almost as reassuring as >saying it was "Generated by a Computer"! :-) >There's a wide range in the types of methods they could use >to find this information, some of which are the camel's nose in the tent >and others of which are half the camel, but all of which are pretty much bad. On the positive side, the inconvenience to the now pudgy, middle-class vets will increase resistance to the colonialism. >I'm *not* a veteran (I was 1H in the last draft lottery), Perhaps you were in those BZ experiments and have forgotten.. >address of my neighbor's legality-challenged son, and getting it wrong, >which led to the police pounding on my door at 6am with a warrant. Good thing that claymore was being rewired, eh? :-)

1 0

[David_Heinrich@urmc.rochester.edu: [mises] praxeology and game theory]
by Gabriel Rocha 20 May '04

20 May '04

possibly of interest to some here... ----- Forwarded message from Pro-Choice <David_Heinrich(a)urmc.rochester.edu> -----

1 0

New biometric approach secures ID cards
by R. A. Hettinga 20 May '04

20 May '04

<http://www.newscientist.com/news/print.jsp?id=ns99995010> New Scientist New biometric approach secures ID cards 19:00 19 May 04 Exclusive from New Scientist Print Edition. Subscribe and get 4 free issues. A novel biometric identification system could counter many of the objections to ID card schemes such as the one being proposed by the UK government. The system can unequivocally link a person to a particular ID card without having to match their biometric characteristics to data stored either on the card or on a central database. A biometric is a unique measure of some facet of a person's body - such as a fingerprint or an iris scan. By 2005, the International Civil Aviation Organisation wants such data incorporated in newly issued passports. And the UK government wants it in ID cards from 2007. The information will also be stored on databases. A person enrolling into a biometric scheme based on iris recognition first has to peer into an infrared scanner which records an image of one of their irises. This is then processed to convert it into a string of digits - that person's "biometric reference template". This is obtained by dividing the image into hundreds of squares and measuring the light intensity in each one. This is then stored on a central database, as in the proposed UK system, or on the individual's ID card. Sufficiently similar Later, when that person needs to prove their identity, a fresh scan is taken and processed, and the resulting data is matched to the stored reference template. If the two are sufficiently similar, the ID is authenticated. An exact match is not required, because there are always likely to be some differences between scans, caused by variations in measurement conditions, like lighting. The danger, security experts say, is that if someone's reference template were to be captured it could be used illicitly. For example, a criminal could simply send the template to a service provider such as a bank as if it had originated from a scanner. Now Gavan Duffy of Generics Group, based in Cambridge, UK, has devised a technique that avoids any need to store the biometric reference template. It relies on a statistical trick that removes the variability in the results when an iris or fingerprint is scanned. "We're enhancing its stability," Duffy says. String of digits In conventional systems, when an iris image is divided into a grid and converted into a string of digits, the values stored for the brightness vary within a range. Problems occur when the brightness value falls close to a threshold between two levels. This makes it likelier that during one scan it will fall short of this threshold, while under different lighting conditions it might rise far enough to put it in a different range. For example, if the scale of light intensities is from 0 to 10, a reference reading in a certain grid square might be 3.9. This would normally be rounded down to a 3. But in a later scan, that grid point might be measured as high as 4.1 and so be recorded as a 4, creating a mismatch between the scanned template number and the reference template number. Generics' trick is to remove this uncertainty by providing an "offset" value for each data point in the grid. Each offset value is chosen so as to shift the value of the original scan to the middle of its range. In the above example, the grid square would have an offset of 0.4 assigned to it, to shift the reading of 3.9 to the middle of its range, which is 3.5. If a later scan happened to produce a reading of 4.1, applying the offset it would bring it down to 3.7, which would be recorded as a 3, just as in the reference. "We can, with high reliability, generate the same number," says Duffy. Irreversibly encrypted Because the scan gives the same result time after time, the reference template can be combined with data recorded on the card to create a "digital signature" unique to the user. By irreversibly encrypting this signature it is possible to ensure that the biometric data is unrecoverable and not open to misuse. The offset data is stored on the card, unencrypted, as it is no use to anyone but the owner. When someone needs to prove who they are, a reader combines the scan with the offsets to make a template. This is then combined with the personal data on the card to produce a fresh signature. If the user is genuine, the new signature should be a perfect match for the stored one. Privacy campaigners are guardedly impressed: "This looks like a good solution. They are just storing information that needs the iris or fingerprint to be present for the offset information to be any use," says Ian Brown, of the Foundation for Information Policy Research. Though he stresses FIPR is opposed to ID cards, he says Generic's scheme seems to be a lesser evil. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0