- cypherpunks-legacy - lists.cpunks.org

Re: anonymous IRC project needs new home...
by Poindexter＠SAFe-mail.net 09 May '04

09 May '04

At 07:07 AM 5/9/2004 -0400, Adam Back wrote: >The anonymous IRC project (IIP -- http://www.invisiblenet.net/iip/) provides encrypted anonymous IRC chat. > >Haven't looked in the protocol in detail to see how they get their anonymity, but the guy seemed aware of Chaum etc and they have crypto protocols document up there. > >They have resource problems in continuing to run it, and so have announced end-of-life for the project, but source etc is available, and they are calling for interest in taking over the project. > >Anyone with a bit of bandwidth and interest in preserving anonymity of IRC want to help them out? Despite supposedly being an "open source" project, "nop", the lead developers/project manager, has kept some of the source/procedures necessary to run iip rather closed (e.g., the server configuration and the source code for the public relay 'harvester'). There were quite a few iip users who expressed interest in helping out or taking over when iip's problems first became painful about six-nine months ago. Now many iip users may have left, and a non-public project with much grander ambitions and truly open source is well along in development (spurred on in good part because of nop's lack of communication with the iip community). This call for help may be a bit too late.

1 0

anonymous IRC project needs new home...
by Adam Back 09 May '04

09 May '04

The anonymous IRC project (IIP -- http://www.invisiblenet.net/iip/) provides encrypted anonymous IRC chat. Haven't looked in the protocol in detail to see how they get their anonymity, but the guy seemed aware of Chaum etc and they have crypto protocols document up there. They have resource problems in continuing to run it, and so have announced end-of-life for the project, but source etc is available, and they are calling for interest in taking over the project. Anyone with a bit of bandwidth and interest in preserving anonymity of IRC want to help them out? (The way I first heard about the project is that they use hashcash to throttle nym registration abuse -- before that people were creating 1000s of handles through it.) Adam

1 0

No stinkin' constitution here
by Major Variola (ret) 09 May '04

09 May '04

"Material-witness warrants are used by the government to hold people suspected of having direct knowledge about a crime or to give agents more time to investigate." http://www.latimes.com/news/nationworld/world/la-na-madrid7may07,1,303922.s… ALOHA, Ore. A Portland lawyer was detained Thursday by the FBI after federal officials linked his fingerprint to bomb-related evidence associated with the Madrid railway attacks that killed 191 people in March, a federal law enforcement official said. The arrest of Brandon Mayfield, 37, raises the possibility of a U.S. connection to the March 11 bombings, which Spanish authorities have blamed on Islamic extremists. The former Army officer, a Muslim convert, was held on a material-witness warrant after the FBI searched his home in the Portland suburb of Aloha. Mayfield's arrest was first reported Thursday on Newsweek magazine's website. He has not been charged with any crime, and the federal official stressed that the investigation was continuing and is in many ways preliminary. Spanish officials cautioned earlier this week that they did not consider the fingerprint evidence to be conclusive. Material-witness warrants are used by the government to hold people suspected of having direct knowledge about a crime or to give agents more time to investigate. <snip>

2 1

iTunes 4.5: "24 hours after I downloaded it... I've broken it"
by R. A. Hettinga 08 May '04

08 May '04

<http://craz.net/programs/itunes/> crazney.net - iTunes stuff Welcome to my iTunes stuff website, here you will find various things relating to iTunes hacking that I have written. Last updated:April 29, 2004 iTunes 4.5: iTunes 4.5 uses a new authentication algorithm. However, not even 24 hours after I downloaded it, and that includes a little sleep and lots of uni time, I've broken it. Hah. Anyhow, libopendaap 0.2.0 and tunesbrowser 0.1.4 are now available. <crazney> brb have to shut chooks in. <Fryboy> "I have just deconstructed the encryption protocol designed by Apple's finest enginee..ah fuck the chicken has escaped" Pages here: * libopendaap: A library for connecting to iTunes shares and streaming audio files. * tunesbrowser: An application, built on top of libopendaap in GTK for browsing and playing the songs in various iTunes shares. * authentication: A page describing the authentication procedure used by the latest iTunes programs in order to lock out third party applications. * iTunes Music Store authentication: A page describing the authentication packets used by the iTMS. This complements Jason Rohrers iTMS-4-ALL project. Say no to the AUS-FTA! Contact info: See the front page for contact details. Please let me know if you use and enjoy (or hate) this software! Apple and iTunes are registered trademarks of Apple Computer, Inc. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

When It Comes to Selling Virtual Property, PayPal Isn't Always Your Pal
by R. A. Hettinga 07 May '04

07 May '04

<http://www.pbs.org/cringely/pulpit/pulpit20040506.html> PBS: I, Cringely -- The Pulpit MAY 6, 2004 PayAcquaintance When It Comes to Selling Virtual Property, PayPal Isn't Always Your Pal By Robert X. Cringely Games are make believe, their rules have to be only internally consistent, not consistent with any laws of man or nature. And that is probably the reason we like them, because in the game, whether played in my garden or in your computer, we can be warriors or wizards, men or mice, we can carry on our belts the scalps of our enemies and nobody is really hurt, no laws are broken. But games are also big business, which means they inevitably intersect with the real world. And when that point of intersection is through PayPal, some game players believe they are being robbed. This story was brought to my attention by players of EverQuest, Sony's incredibly successful and incredibly complex fantasy role-playing game, but I am sure it applies to similar games. Understand, I am not a gamer, and have not a chromosome of gamer DNA in me, so if you are a gamer and feel that I am mischaracterizing an activity that occupies, say, a third of your waking hours, just pity me and hold the complaints, okay? EverQuest and most other multiplayer online games like it are subscription-based. You pay Sony a monthly fee to be allowed to be a character in the game. Some of your character attributes are personal choices made when you set up the account, but many are earned, given, or even just discovered as you make your way through the many levels of the game, gaining powers and weapons and even money. Yes, money. The currency in EverQuest is platinum, and it can be used to buy many things, including sometimes buying your way out of trouble. Sony's view of its game is that everything takes place in the server and nothing in the real world. Characters can give things or sell things to each other in the game (weapons, magical abilities, platinum, etc.), but in Sony's view, it is all supposed to take place in the game. Avid gamers, however, came to see a real market in these things, selling them primarily to players who wanted to buy their way higher in the game. So there developed a secondary market in virtual goods, first on eBay, then on specialized game auction sites, and there are online stores where you can buy this stuff outright. Sony doesn't specifically allow it, but Sony also doesn't do much to prevent it, so the practice is widespread. The arbitrage opportunity here is based on skill and knowledge of the game. If I am some kind of EverQuest god having made it the old fashion way to the top of the game, it is much easier for me to acquire these goodies than it might be for a beginner. Or maybe I have found a bug in the program that allows me to exploit over and over again some action that yields platinum, for example. Once I have enough valuable stuff worth selling, I would typically give it to a second character (not my most powerful performer -- I need to keep him/her/it apparently untainted by commercialism). Then I find a buyer through an auction site, or I just sell the stuff to a wholesaler like Internet Gaming Entertainment, the Big Kahuna in the buying and selling of this stuff. How the actual transfer of goods takes place is very interesting. Once a deal is struck, the characters of the buyer and seller have to meet at an agreed place in the game where the hand over (no hands are actually involved of course) takes place. Either one character just gives this big load of platinum to the other or they give it in exchange for some game item of much less value. This latter technique is the pure play because it complies best with Sony rules that allow bad bargaining and character stupidity. "Manhattan for $24 in beads? Sure!" Meanwhile, back in the real world, real money is changing hands, typically through PayPal transfers. The transfer is done first, then the property is exchanged. Only it doesn't always work that way. Sometimes the buyer retracts the payment saying that a transfer never took place at all. After all, there is no receipt. Sounds a bit like the Diebold e-voting scandal, eh? PayPal yanks the money back out of the seller's account EVEN IF IT HAS ALREADY BEEN TRANSFERRED TO A BANK ACCOUNT. One minute the money is there, the next minute it isn't, and the seller has almost no recourse at all. The specific event that led to this column was the failed sale of $2,300 in platinum by a group of EverQuest fanatics who wanted to use the money to pay their way to a big EverQuest convention. It is their contention (not mine, I'm just the reporter here, remember) that the bad guy in this deal is either Jonathan Yantis or an associate of his. Jonathan Yantis runs Yantis Enterprises, which was until recently the big competitor to IGE for the buying and selling of this stuff that isn't real. Yantis is in San Diego, IGE is in Florida, and earlier this year they merged with IGE buying Yantis, though the web sites (they are both in this week's links) remain separate. The players who came to me sold their platinum through a game-specific auction site. The deal went forward exactly as described above, and they suddenly had no platinum and no money. Wily hackers that they are, they tracked the mail records of the only trail that did exist, the e-mails arranging the exchange, and claim to have found that the buyer's IP address was from the same range used by Yantis Enterprises. Further, they explored the qualifications of the "PayPal Verified" buyer and claim that most of the positive feedback came from Jonathan Yantis. Finally, they claim that the day after the transaction, the Yantis price to sell platinum on their EverQuest server suddenly dropped as though there was suddenly a larger supply acquired at little or no cost. These players are fervent and angry and they have some real data so what happens now? Not much, and that is probably the real topic of this column. Yantis Enterprises has no telephone number and doesn't respond to e-mail from me. IGE also has no telephone number but they do have a PR firm that doesn't call me back. These are companies apparently doing millions per year in business, yet they effectively don't have a physical existence. PayPal certainly has a physical existence and they DO return my calls and tried hard to be helpful, but the story there isn't very encouraging, either. For one thing, PayPal can't figure out how to handle payments for such virtual goods, so they rely on the good will of the buyers and sellers involved. If a buyer backs out, PayPal has no recourse but to reverse the charge (called a chargeback) or take the loss itself, which it is unwilling to do. This applies to game goods, but it also applies to ANY virtual goods, so if you are planning to sell software or music or video this way, you might have to think a bit harder. PayPal is not built to reliably support a peer-to-peer economy. What about feedback? Isn't the great enforcement mechanism of eBay and PayPal supposed to be feedback from other users? Here is where it gets REALLY interesting. The essence of feedback is that you can run, but you can't hide, and PayPal enforces that by limiting each user to a single account. But how do they make that stick? They don't. PayPal asked ME to help them find Jonathan Yantis, for example. Here is a guy who has participated in more than 10,000 PayPal transfers and they don't know how to reach him. That 10,000 plus PayPal number is a big part of his marketing. But PayPal also told me that part of their difficulty finding him is that they have DOZENS of accounts under the name Jonathan Yantis. Their assumption is that these are all different people. So I went to the People Search section of Yahoo and looked for everyone in America named J, Jonathan, John, or Jack Yantis and found 35 people. Say there are another 35 with unlisted numbers, that's 70 people, tops. If there are 300 million Americans and PayPal has 40 million users then no more than 14 of those users ought to be named J, Jonathan, John, or Jack Yantis. So it is easy to have multiple PayPal accounts and if you have multiple accounts you can give yourself lots of positive feedback, so the system can be played. I am not saying that Jonathan Yantis or IGE did any of this. I'm just reporting what I was told and what I discovered. I can't understand why someone would threaten a 10,000 plus PayPal score by trying to corner the EverQuest platinum market. I'm also quite concerned over the lack of safety measures PayPal has in place to protect buyers and sellers. I DO see here a wonderful business opportunity, though, for someone to come up with a reliable way to handle payments for virtual goods. That would be worth its weight in gold, 'er platinum. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: AP is back...
by Tyler Durden 07 May '04

07 May '04

"Terrorists in Fallujah claim they'll give $15 million each for the heads of Defense Secretary Donald Rumsfeld, Lt. Gen. Ricardo Sanchez and Brig. Gen. Mark Kimmit." Well, does the actual HEAD have to be delivered? That might reduce the options considerably... -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: AP is back... >Date: Fri, 07 May 2004 08:38:20 -0700 > >We in al Qaeda organization are committed to a prize of 10,000 grams of >gold to whoever kills Bremer, >his deputy, the commander of American forces or his deputy in Iraq," the >voice said. > >Bin Laden also offers 1kg of gold for killing a US >soldier or civilians, and 500 grams for killing an allied >civilian or soldier. > >Terrorists in Fallujah claim they'll >give $15 million each for the heads of >Defense Secretary Donald Rumsfeld, Lt. Gen. >Ricardo Sanchez and Brig. Gen. Mark Kimmit. > > >------- >How do you declare this on your 1040? >Can Americans involved in friendly-fire incidents collect? > > > _________________________________________________________________ Check out the coupons and bargains on MSN Offers! http://youroffers.msn.com

1 0

AP is back...
by Major Variola (ret) 07 May '04

07 May '04

We in al Qaeda organization are committed to a prize of 10,000 grams of gold to whoever kills Bremer, his deputy, the commander of American forces or his deputy in Iraq," the voice said. Bin Laden also offers 1kg of gold for killing a US soldier or civilians, and 500 grams for killing an allied civilian or soldier. Terrorists in Fallujah claim they'll give $15 million each for the heads of Defense Secretary Donald Rumsfeld, Lt. Gen. Ricardo Sanchez and Brig. Gen. Mark Kimmit. ------- How do you declare this on your 1040? Can Americans involved in friendly-fire incidents collect?

1 0

Explosive Debate: Should U.S. Check Up On Model Rockets?
by R. A. Hettinga 07 May '04

07 May '04

<http://online.wsj.com/article_print/0,,SB108388303399504572,00.html> The Wall Street Journal May 7, 2004 PAGE ONE Explosive Debate: Should U.S. Check Up On Model Rockets? Under 9/11 Law, ATF Keeps Tabs on Propellant Buyers; Feds Visit Al's Hobby Shop By ROBERT BLOCK Staff Reporter of THE WALL STREET JOURNAL May 7, 2004; Page A1 ELMHURST, Ill. -- Al's Hobby Shop in this leafy corner of suburban Chicago is always packed with mothers looking for Cub Scout badges, teenagers ogling imported slot cars and grown men playing with model trains. But to federal law-enforcement officials, Al's is also a possible terrorist supply depot. And so, last October, a special agent from the Bureau of Alcohol, Tobacco, Firearms and Explosives was sent to Al's from Washington to buy $1,700 in model rocket motors. "The guy told me that the government wanted to do some tests," recalls Tim Lehr, who sold the agent 40 motors containing almost 60 pounds of propellant. "He wouldn't say what the tests were for, but I could guess: The government wanted to ruin my hobby." Since the passage of the initial post-9/11 antiterrorism laws in October 2001, hobby rocketry has been struggling to avoid regulation that enthusiasts say will destroy their sport, deter youngsters from pursuing an interest in science and waste the nation's limited law-enforcement resources. The Department of Justice says that federal agents need to keep an eye on who is buying model rockets because the toys are potentially dangerous and could be adapted by terrorists to attack airplanes and American soldiers. At the heart of the problem is a long-running dispute between hobbyists and the ATF, which is part of the Justice Department, over how to legally classify the chemicals used to propel rockets. Ammonium perchlorate composite propellant, better known as APCP, is a rubbery mixture of resins, powdered metals and salts that ignites at 500 degrees Fahrenheit and burns like a road flare on steroids. It's the same fuel that the National Aeronautics and Space Administration uses in the solid rocket boosters on the space shuttle. For hobby rockets, APCP comes in the form of pellets wrapped in cardboard about an inch in diameter and three inches long. The cylinders, which start at $12.50 apiece and can go up into the hundreds of dollars, can be stacked in reusable aluminum casings to power larger rockets. Rocketeers have always maintained that APCP doesn't detonate, it deflagrates. That is, it burns intensely at a controlled rate. Since 1971, however, the ATF has branded APCP as a "low explosive" subject to regulation and licensing by the bureau. In practice, the ATF largely ignored the rocketeers as long as they weren't selling or buying APCP across state lines. With new fears about national security after 9/11, President Bush signed the Safe Explosives Act, an antiterrorism law contained in the bill that created the Department of Homeland Security. In effect for a year, the law now requires permits for all purchases of rocket motors and all explosives, including APCP. Suddenly, hobbyists who had been freely purchasing such motors for years had to be fingerprinted and to submit to background checks. They had to pay $25 for ATF low-explosive-user permits to purchase more than 2.5 ounces of APCP and allow local and federal inspectors onto their property anytime to check for proper storage of the propellant. The government insists it is trying to balance civil liberties with homeland safety. But federal investigators say that since terrorists showed they could level skyscrapers with boxcutters, no potentially suspicious activity can be ignored. "Most of the people involved in these activities are harmless fanatics and nerds," says one federal law-enforcement official. "But since 9/11, we have a responsibility to make sure the nerds are not terrorists." Other hobbyist have also come under federal scrutiny, including bird watchers on the Canadian border and operators of radio-controlled airplanes. But this does little to console the rocketeers. Terry McCreary, associate professor of analytical chemistry at Murray State University in western Kentucky and a hobby-rocket guru, says sport rocketry helps kids by interesting them in wonders of chemistry, physics, astronomy and aerodynamics. "If you look deeply into the background of our top mathematicians and scientists, you will find a kid with a model rocket." Pointing at a troop of about 15 Boy Scouts at a recent launch in The Plains, Va., Doug Pratt, who runs his own hobby-rocket business out of his basement in Herndon, asked: "Does that look like a group of terrorists to you?" Faced with the prospect of being fingerprinted and having agents poking around their past, many rocketeers are leaving the hobby. The rocket club at Kettering University in Michigan has closed down because of the new regulatory requirements. Looking for help, rocket groups have turned to Republican Sen. Mike Enzi of Wyoming, an avid fan of hobby rockets and model airplanes. In May last year, Senator Enzi sponsored a bill to exempt hobby rockets from government regulation. The Department of Justice, which oversees the ATF, then wrote him a letter saying that "large rocket motors could be adapted by terrorists for use in surface-to-air missiles capable of intercepting commercial and military airplanes at cruise level and for use in 'light antitank' weapons capable of hitting targets from a range of nearly five miles." Mr. Enzi wrote back to Attorney General Ashcroft, asking to see the results of the tests that led his department to its conclusions. Within weeks, an agent from the ATF was sent to Al's Hobby Shop outside Chicago to buy the first rocket motors for testing. Over the past six months, according to ATF officials, agents and private contractors have been working at Air Force bases in Utah and Florida firing model rockets at drones, vehicles and simulated crowds of people. The tests are classified. Some rocketeers have hit upon another solution: They make their own fuel. They get together on weekends with pizza, beer and jars of precursor chemicals for "cooking parties" in their homes and apartments or in the back rooms of their businesses. "It's legal and completely safe," says Jerry O'Sullivan, an insurance agent who cooks fuel with his friends in suburban Washington. Mr. O'Sullivan, who is a member of the Maryland Delaware Rocketry Association Inc., is taking advantage of a loophole in explosives legislation exempting anyone who mixes an explosive for his own "personal" use from having to get a permit. The exemption was created mainly for farmers who mix fertilizers and fuel oil to blast their own irrigation ditches. One oddity of the government crackdown is the focus on rockets and not guidance systems. "The secret is in the guidance systems," says Arthur "Trip" Barber, a former captain of a U.S. navy guided missile destroyer, who is now vice president of the National Association of Rocketry. "I can build a rocket overnight but I couldn't build a guidance system in a lifetime." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Acoustic Cryptanalysis
by John Young 07 May '04

07 May '04

http://www.wisdom.weizmann.ac.il/~tromer/acoustic/ Acoustic Cryptanalysis: On nosy people and noisy machines Adi Shamir and Eran Tromer A powerful method for extracting information from supposedly secure systems is side-channel attacks, i.e., cryptanalytic techniques that rely on information unintentionally leaked by computing devices. Most attention has been focused on electromagnetic emanations, power consumption and, recently, diffuse visible light from CRT displays. The oldest eavesdropping channel, namely acoustic emanations, has received little attention. The following demonstrates some preliminary results in the analysis of acoustic emanations from personal computers, showing them to be a surprisingly rich source of information on CPU activity. May 7, 2004

1 0

E-Voting Commission Gets Earful
by R. A. Hettinga 06 May '04

06 May '04

<http://www.wired.com/news/print/0,1294,63349,00.html> Wired News E-Voting Commission Gets Earful By Michael Grebb? Story location: http://www.wired.com/news/evote/0,2645,63349,00.html 02:00 AM May. 06, 2004 PT WASHINGTON -- Passions ran high Wednesday at the first public hearing of the Election Assistance Commission, where activists and manufacturers of electronic voting machines clashed over whether new e-voting systems should include a voter-verifiable paper trail that auditors could use to recount votes if necessary. The newly formed commission, which is just beginning to oversee the certification of voting systems and the standardization of elections across the country, held its first meeting to examine the state of elections and voting systems. The commissioners were collecting testimony from special-interest groups, election officials, computer scientists and voting-machine makers. But the commission's chairman said he didn't expect the bipartisan panel would issue national standards requiring paper receipts when it makes preliminary recommendations next week, followed by more detailed guidelines next month. "We will not decide on what machines people will buy," said the chairman, Republican DeForest B. Soaries Jr., saying it wasn't the panel's role to tell states what to do. "We will say, if California wants to have a backup paper system, what national standards it should follow." At least 20 states are considering legislation to require a paper record of every vote cast after rushing to get ATM-like voting machines to replace paper ballots in the wake of Florida's fiasco with hanging chads in the 2000 presidential election. About 50 million people, or 29 percent of voters, are expected to vote electronically in November's election. Representatives from the machine makers tried to convince commissioners that paperless e-voting systems are not only safe and accurate, but more so than paper-based systems. Mark Radke, director of marketing at Diebold Election Systems, said Diebold's touch-screen voting systems experienced "zero security problems" during the November 2002 elections, pointing out that its "voice guidance" audio feature allowed blind voters "to vote in private for the very first time." (With paper-only systems, blind voters historically have needed to recite their ballot choices to a poll worker or friend, who would then mark the ballot for them.) Radke also said Diebold's machines outperformed other systems during the California recall elections in October. He claimed that under-counted votes were the lowest on Diebold touch screens, at 0.73 percent, compared with 2.86 percent for optical-scan systems, 4.6 percent for other electronic systems and 6.32 percent for paper-only systems. Alfie Charles, spokesman for Sequoia Voting Systems, said the "sensationalized concerns" of paper-trail advocates aren't grounded in reality. "The evidence is pretty clear," he said. "Electronic systems help prevent disenfranchisement." Several panelists also pointed out that the pool of people able to hack into an e-voting system is far smaller than those able to steal ballots, stuff the ballot box or punch holes in voting cards to change or nullify votes. Under that theory, electronic systems would increase security. "We would reduce the number of people capable of committing fraud," Charles said. But Avi Rubin, a Johns Hopkins University computer scientist who helped author a report last July about security vulnerabilities in Diebold's touch-screen voting system, warned that paperless systems could allow savvy intruders to rig an election. He said corporations supporting a particular presidential candidate who is friendly to their needs would have billions at stake to make sure their candidate won. "We've got very well-funded and bad-intentioned adversaries to worry about," he said. Rubin said while paper trails are needed for the November election, "in the long, long term we should explore other cryptographic options and other electronic techniques" to someday run secure, paperless elections. At a press conference and rally outside the hearing, a crowd of supporters cheered when California Secretary of State Kevin Shelley took the podium. On Friday, Shelley banned the use of one model of Diebold's voting machines in four California counties, and decertified all touch-screen systems unless counties that own them implement 23 security requirements. At least one county is filing suit against Shelley for his actions, and others may follow. Supervisors in Riverside County voted unanimously Tuesday to sue Shelley, California's top election official, to remove the ban on their machines, saying his ruling would harm disabled and visually impaired voters who have been able to vote unassisted for the first time using touch-screen machines that guide them through the ballot with audio directions. Shelley charged that Diebold aggressively marketed its TSx system to voting officials in the four counties, even though the systems were not fully tested, qualified by federal officials or certified at the state level. Diebold finally finished federal testing of the TSx on April 21. Still, Shelley told supporters that he worries most about unsecured systems vulnerable to hackers. "We have seen that a bunch of high-school students can hack in and change thousands of votes," he said. "We cannot have that." He said he had received several reports of high-school hackers attempting to penetrate e-voting systems, but didn't give specific examples. One of his representatives also cited an incident in which touch-screen systems went down in a few jurisdictions during the October recall election. Elderly poll workers at one location didn't know what to do, so they asked some teenagers who happened to be there to reboot the machines for them -- an obvious opportunity to commit mischief under the right circumstances. Several witnesses at the hearing, including Shelley, recommended better training for poll workers, who may need basic computer skills to fix technical problems on Election Day. Brit Williams, a computer science professor and election expert at Kennesaw State University near Atlanta, advocated adopting a single national standard for voting software to ensure security and ease training for poll workers. Other commissioners seemed worried that poll workers would become too reliant on vendors to fix Election Day snafus. Some experts have said that the most likely hacking scenario for machines would be inside jobs from system programmers or the vendors themselves. But Denise Lamb, director of elections in New Mexico, told the panel that any polling place that experienced a severe software or hardware problem would most likely shut down rather than call in a vendor to fix the problem. For minor glitches, she said most vendors provide telephone support. Activists outside the hearing, however, were not reassured. "This is a high-stakes election, and we have to get it right," said Linda Schade, director of Campaign for Verifiable Voting in Maryland, a group that advocates a voter-verified paper trail for electronic systems rather than "rickety, backward new voting machines." The group has already sued the state of Maryland in an effort to decertify the Diebold touch-screen machines that officials implemented statewide last year. Rep. Rush Holt (D-New Jersey) took the podium to drum up support for his Voter Confidence and Increased Accessibility Act (HR2239), which would require all voting machines to produce a paper record. "(Paperless e-voting machines) are in principle unverifiable," he said. "Your intentions cannot be recovered." As Holt wrapped up his comments, Jim Dickson, spokesman for the American Association of People With Disabilities, stepped forward and complained that Holt's bill would threaten to undo protections for disabled voters contained in the Help America Vote Act of 2002. Dickson, who is blind, said that voting with assistance can be a humiliating experience, particularly when the poll worker helping you doesn't agree with your choices. "They have said, 'You're voting for who?'" he said, mimicking the sarcastic voice of a poll worker. He charged that Holt's bill -- by not setting a deadline for new e-voting machines to accommodate disabled voters -- would put off those protections indefinitely. Holt quickly clarified that his bill wouldn't take away such protections. While the sides squared off in Washington, D.C., senators in California approved a bill to ban all e-voting in the state in November. The bipartisan bill passed the state Senate Committee on Elections and Reapportionment with a 3-1 vote and will now go to the Senate floor. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0