- cypherpunks-legacy - lists.cpunks.org

NAS Inducts Four MIT Faculty
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://www-tech.mit.edu/V124/N22/22briefs.22n.html> NAS Inducts Four MIT Faculty Four MIT faculty are among the 72 recently-elected members of the National Academy of Sciences. Professors Shafrira Goldwasser, Nancy H. Hopkins, Ronald L. Rivest, and Maria Zuber were selected for their achievements in original research. They join 55 other current MIT faculty as members of the prestigious group. A professor in Course VI (Electrical Engineering and Computer Science), Goldwasser leads the Cryptography and Information Security Group in the Computer Science and Artificial Intelligence Laboratory, where her research is focused on complexity theory. Hopkins, the Course VII (Biology) Amgen Professor, studies the genes necessary for early development in zebrafish and the role of these genes in the predisposition to cancer of adult zebrafish. Rivest, the reason for the 'R' in RSA, was an inventor of the RSA public-key cryptosystem. Like Goldwasser, he is a founding member of the Cryptography and Information Security Group in CSAIL. He has done extensive work in cryptography and algorithmic research. Zuber is the department head for Course XII (Earth, Atmospheric, and Planetary Sciences). Her research ranges from the modeling of geophysical processes to the development and implementation of space-based laser ranging systems. Including the newly elected members, 123 members of the NAS have had affiliations with MIT. Also newly elected to the NAS are 18 foreign associates, including former MIT Dean of Science Robert J. Birgeneau, who is now the president of the University of Toronto. Hopkins, the chair of the School of Science committee that released a 1999 report on the status of women faculty at MIT, commented on the large number of women faculty selected for the NAS. "It's a fluke of small numbers, but it's a pretty spectacular fluke," Hopkins said. She added that this was the "result of hiring terrific women and giving them the resources to do science." According to the NAS web site, the NAS is a private group that was chartered by Congress in 1863 with a mandate to advise the federal government on scientific issues. -- Kelley Rivoire MIT Undergrad Robbed Near Sidney-Pacific An MIT undergraduate was the victim of an unarmed robbery outside the Sidney-Pacific Graduate Residence early on Friday morning, according to an MIT Police report. The victim, who wished to remain anonymous, said that he noticed five black males following him as he walked home from Central Square. He said he ran towards the dormitory, where he is not a resident, but was kicked by the suspects before he was able to get there. The victim gave the suspects ten dollars on demand, after which the suspects took his wallet. The police report said that the victim's credit cards and an additional $13 were taken. The victim said that he was bumped on his head and suffered a bruise to his face, though he does not remember being hit. He said that he pressed the blue emergency call button outside Sidney-Pacific, summoning the MIT Police. He was taken to MIT Medical, and medical tests did not find any serious injuries. John Di Fava, director of office security and campus police services, said that the installation of additional lighting near Sidney Pacific is an ongoing project. He also said he hopes to move an ATM into the dormitory. Di Fava recommends that residents use common sense when going out at night. He said that the Cambridge Police has been cooperative with MIT Police efforts to lower crime in the area, allowing MIT Police to share data with the Cambridge Police and having additional patrols in the Central Square area. Residents of Sidney-Pacific were concerned about the robbery, but said that the robbery did not cause changes in their daily activities. Adrian K. C. Lee G said that he has the Cambridge Police phone number stored in his cell phone and arranges his schedule to avoid walking alone late at night. Benjamin Estevez G said that though he was surprised by the robbery, he was "not really worried." Anthony H. Kim G said "I don't pay much attention" to the crime in the area, but added that he tries to be careful when out in the area. -- Kelley Rivoire This story was published on Tuesday, April 27, 2004. Volume 124, Number 22 Copyright and distribution information Other options: Read other stories in this issue. Return to our home page. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Driver's certificates: Logic meets the streets
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://www.nashvillecitypaper.com/index.cfm?section=38&screen=newsprint&new…> Nashville City Paper Driver's certificates: Logic meets the streets April 27, 2004 Gov. Phil Bredesen split the difference on allowing illegal aliens to get driver's licenses, and his solution is a good one. Bredesen is proposing legislation that will allow only U.S. citizens and lawful permanent residents of the United States to get Tennessee driver's licenses. The administration says it will be the toughest driver's license policy in the nation. It's nice to finally be first in something desirable. But the Bredesen administration has also answered the question of what to do with illegal aliens working in Tennessee who operate motor vehicles. The argument for issuing them driver's licenses has always been that at least the state can be sure they know our rules of the road which are so often completely different from their countries of origin. Bredesen has proposed that the state issue a "certificate of driving" to those who either have temporary, legal documents to work or go to school here or to those who can prove their identity and residence in Tennessee. The certificates cannot be used as legal identification so, for example, the bearer of a certificate could not use it to board a plane or rent a car. Toughening up our driver's license requirements and finding a way to accommodate those who don't meet requirements for citizenship is a good compromise. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Computer Student on Trial for Aid to Muslim Web Sites
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://www.nytimes.com/2004/04/27/national/27BOIS.html?th=&pagewanted=print…> The New York Times April 27, 2004 Computer Student on Trial for Aid to Muslim Web Sites By TIMOTHY EGAN OISE, Idaho, April 23 - Not long after the terrorist attacks of Sept. 11, 2001, a group of Muslim students led by a Saudi Arabian doctoral candidate held a candlelight vigil in the small college town of Moscow, Idaho, and condemned the attacks as an affront to Islam. Today, that graduate student, Sami Omar al-Hussayen, is on trial in a heavily guarded courtroom here, accused of plotting to aid and to maintain Islamic Web sites that promote jihad. As a Web master to several Islamic organizations, Mr. Hussayen helped to maintain Internet sites with links to groups that praised suicide bombings in Chechnya and in Israel. But he himself does not hold those views, his lawyers said. His role was like that of a technical editor, they said, arguing that he could not be held criminally liable for what others wrote. Civil libertarians say the case poses a landmark test of what people can do or whom they can associate with in the age of terror alerts. It is one of the few times anyone has been prosecuted under language in the antiterrorism law known as the USA Patriot Act, which makes it a crime to provide "expert guidance or assistance" to groups deemed terrorist. "Somebody who fixes a fax machine that is owned by a group that may advocate terrorism could be liable," said David Cole, a Georgetown University law professor who argued against the expert guidance part of the antiterrorism law this year, in a case where it was struck down by a federal judge. Mr. Hussayen, 34, a father of three who was pursuing a doctorate in computer sciences at the University of Idaho, is charged with three counts of conspiracy to support terrorism and 11 counts of visa and immigration fraud. His trial opened on April 14 and is expected to last until June. The trial offers conflicting views of Mr. Hussayen, a son of the Saudi middle class. Defense lawyers have portrayed him as a loving family man who embraces Western values while holding to his Islamic faith; the prosecution team has presented him as a secret conspirator, aiding the cause of terrorism through his computer skills. [In a ruling that bolstered Mr. Hussayen's case on Monday, Judge Edward J. Lodge of Federal District Court in Idaho would not let prosecutors show the jury a Web page that encourages suicide bombings. The judge said the government must prove that Mr. Hussayen created the page or endorsed its contents.] Earlier this year, Judge Audrey B. Collins of the Federal District Court in Los Angeles, struck down a part of the antiterrorism law being used in this trial, ruling that it was overly broad and vague. But Judge Collins did not extend her ruling beyond the one case in California. President Bush made several recent campaign-style stops on behalf of the antiterrorism law, saying it is an essential tool for law enforcement. "The Patriot Act defends our liberty, is what it does, under the Constitution of the United States," Mr. Bush said in Buffalo on Tuesday. Idaho, one of the most Republican states, has become an unlikely home of opposition to the act. The state's senior senator, the Republican Larry E. Craig, and Representative C. L. Otter, also a Republican, have sponsored bills to amend the act, which they have called a threat to civil liberties. Mr. Hussayen's lead lawyer, David Nevin, is best known for his defense in 1993 of Kevin Harris, who was involved in a standoff with government agents at a cabin in Ruby Ridge, Idaho, along with Randall C. Weaver. That case, in which Mr. Weaver's wife and teenage son were shot and killed by government agents, is a cause cilebre among mainly right-leaning civil libertarians. Some of Mr. Hussayen's supporters say they see a similar kind of government abuse in his trial. "It's an illustration of how much power the government can bring against somebody," said John Dickinson, a retired professor of computer sciences who was Mr. Hussayen's doctoral adviser at the University of Idaho. "It should scare anybody." Mr. Dickinson said he was interviewed by the F.B.I. for several hours after Mr. Hussayen's arrest in February 2003. "They kept saying his Ph.D. program was a front and that the person I knew was only the tip of this monstrous iceberg," he said. "But I've yet to hear one thing the government has said since then that has made me question his innocence." Justice Department officials and prosecutors refused to comment on the broader implications of the case, citing the trial. But in court documents, the government makes a case that Mr. Hussayen funneled money to Islamic charities with terrorist ties and that he posted calls for jihad by different Saudi sheiks. In the indictment, the government charged that Mr. Hussayen provided "computer advice and assistance, communications facilities, and financial instruments and services that assisted in the creation and maintenance of Internet Web sites and other Internet medium intended to recruit and raise funds for violent jihad, particularly in Palestine and Chechnya." And they have argued that Mr. Hussayen's technical assistance, even if he did not share the beliefs of the groups he helped, were like providing a gun to an armed robber. Most of the facts are not in dispute. Mr. Hussayen's lawyers said that he gave money to legitimate Islamic charities and that his Web site work was protected by the First Amendment. The Web sites he maintained also posted views opposing jihad, they said. The government has argued that Mr. Hussayen, a Saudi citizen who is the son of a retired Saudi minister of education, does not have all the protections of an American citizen. They said he abused his privilege as a student by working for computer sites that advocate terror. His friends in the Idaho college town may have known one side of him, the prosecutor, Kim Lindquist, said in his opening remarks to the jury, but they seldom saw "the private face of extreme jihad." The Saudi government is paying for the defense of Mr. Hussayen, his family said. One of the charities that Mr. Hussayen supported, Islamic Assembly of North America, still operates out of Ann Arbor, Mich. On its Web site, the group says its mission is to promote the spread of Islam, and the group solicits money from the public. Mr. Nevin said the charity has never been classified as terrorist by the government. But the government said the Michigan charity was one of the Web sites that "accommodated materials that advocated violence against the United States." Both sides in this case are looking to appeals that will probably turn on the part of the antiterrorism law thrown out by Judge Collins in January. In that case, the judge ruled on behalf of several humanitarian groups that wanted to provide support to the nonviolent arms of two organizations designated as terrorist in Turkey and Sri Lanka. Judge Collins wrote that "a woman who buys cookies at a bake sale outside her grocery store to support displaced Kurdish refugees to find new homes could be held liable" if the sale was sponsored by a group designated terrorist. The American Civil Liberties Union, which is trying to overturn the antiterrorism law in court, tried to join the Idaho case but was rebuffed by Judge Lodge. "We very much wanted to be involved in this case because it is by far the most radical prosecution we've seen under the Patriot Act," said Ann Beeson, associate legal director of the national A.C.L.U. "You shouldn't be held liable for what somebody else said. Under this theory, you could charge the electrician who services the wrong client." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Mathematicians From Around the World Collaborate to Solve Latest RSA Factoring Challenge
by R. A. Hettinga 27 Apr '04

27 Apr '04

Duelling crypto-crack press-releases this morning. Ford vs. GM, er, Certicom vs. RSA... Cheers, RAH ------- <http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=SVBIZINK3.story&STORY=/ww…> Silicon Valley Biz Ink :: The voice of the valley economy April 27, 2004 Computers/Electronics News Press release distributed by PR Newswire Mathematicians From Around the World Collaborate to Solve Latest RSA Factoring Challenge < back Contest provides practical gauge of current cryptographic research and encourages development of higher standards of security for organizations BEDFORD, Mass., April 27 /PRNewswire-FirstCall/ -- RSA Laboratories, the research center of RSA Security Inc. (Nasdaq: RSAS) today announced that a team from the Scientific Computing Institute and the Pure Mathematics Institute in Germany, along with the National Research Institute for Mathematics and Computer Science in the Netherlands and several other organizations, has solved the RSA-576 Factoring Challenge. The worldwide team of eight solved the challenge using approximately 100 workstations in a little more than three months, and earned a cash prize of $10,000 from RSA Security for their efforts. Originally started in 1991 and relaunched with its current set of challenge numbers in 2001, RSA Laboratories' Factoring Challenge was established to encourage research into computational number theory and the practical difficulty of factoring large integers. "The information received during these challenges is a valuable resource to the cryptographic community and can be helpful for organizations in choosing appropriate cryptographic measures for a desired level of security," said Burt Kaliski, chief scientist and director at RSA Laboratories. To solve the factoring challenge, the consortium leveraged resources from around the world, including hardware from the Experimental Mathematics Institute in Essen, Germany, from the Bundesamt fur Sicherheit in der Informationstechnologie (BSI), and experts from the Number Field Sieve network of mathematicians throughout Canada, the United States and the United Kingdom. The factoring of RSA-576 was completed using the general number field sieve factoring algorithm (GNFS) to gather data, find dependencies among the data and ultimately leverage those dependencies to factor the number. "I'm very proud of all these individuals from around the world and their efforts to solve this first factoring challenge," said Jens Franke of the Pure Mathematics Institute at Bonn University. "The collaborative efforts of everyone involved in this accomplishment are indicative of the achievements in mathematics, and cryptography on a greater scale, that can be realized and applied to protect the data of businesses around the world. We are excited to continue working on such projects that will assist in cryptographic research to build stronger algorithms in an effort to ensure the integrity of sensitive corporate information." RSA Laboratories sponsors a series of cryptographic challenges that allow individuals or groups to attempt to solve various encryption "puzzles" for cash prizes. The RSA-576 Factoring Challenge is one of a series of factoring challenges set forth by the research arm of RSA Security to determine the difficulty of customizing algorithms for factoring and assessing the strength of larger key sizes. RSA-576 is a smaller-scale example of the types of cryptographic keys that are recommended to secure Internet and wireless transactions. Typical keys are at least 1024 bits (310 decimal digits); RSA-576 is 576 bits (174 decimal digits). Larger numbers are considered to provide significantly greater security. The next challenge number in the series is RSA-640. "RSA Security extends our congratulations to the team for their efforts," said Kaliski. "This challenge demonstrates how the work of a few can have a broad impact on the development of the critical nature of cryptography. Their work reflects the kind of expertise and resources needed to factor large numbers. Such challenges are designed to track the evolution of cryptographic research and ensure businesses are protecting their intellectual property and critical data with the right levels of security." About RSA Security Inc. RSA Security Inc. helps organizations protect private information and manage the identities of people and applications accessing and exchanging that information. RSA Security's portfolio of solutions -- including identity & access management, secure mobile & remote access, secure enterprise access and secure transactions -- are all designed to provide the most seamless e- security experience in the market. Our strong reputation is built on our history of ingenuity, leadership, proven technologies and our more than 14,000 customers around the globe. Together with more than 1,000 technology and integration partners, RSA Security inspires confidence in everyone to experience the power and promise of the Internet. For more information, please visit http://www.rsasecurity.com. RSA is a trademark of RSA Security Inc. in the United States and/or other countries. All other products and services mentioned are trademarks of their respective companies. For more information: Roger Fortier Tim Powers McGrath/Power Public Relations RSA Security Inc. (408) 727-0351 (781) 515-6212 rogerf(a)mcgrathpower.com tpowers(a)rsasecurity.com -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

10 years jail for false ID
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://www.theregister.co.uk/2004/04/25/blunkett_id_fraud_penalties/print.h…> The Register Biting the hand that feeds IT The Register ; Security ; Identity ; Original URL: http://www.theregister.co.uk/2004/04/25/blunkett_id_fraud_penalties/ 10 years jail for false ID - Blunkett PR deploys rattle of shackles By John Lettice (john.lettice(a)theregister.co.uk) Published Sunday 25th April 2004 10:27 GMT UK Home Secretary David Blunkett is set to publish his draft national identity card bill, and according to weekend reports is expected to announce a new offence of possession of a false document, maximum penalty ten years in prison, as he does so. This plugs a major hole in UK law, we are told by the public prints, because "It is currently not an offence to possess a false document unless it has been used in the commission of another crime" (The Guardian (http://www.guardian.co.uk/guardianpolitics/story/0,3605,1202359,00.html)) The Graun goes on to tell us: "Ministers believe it will make it easier for the police to catch criminals at an earlier stage. Someone found at an airport with a suitcase full of forged passports could be prosecuted for that alone", and other papers take a similar line (e.g. The Sun: "Under current laws, prosecutors have to prove those caught with false identity papers were also planning or had committed other crimes.") But exorcise any images you were getting of some weird liberal la-la land where kindly bobbies hand back your fake passport to you, and customs officials close your suitcase full of false passports and wave you through with a cheery smile, because it's not true. A cursory study of the facts leads one almost inescapably to the conclusion that the 'ten years for ID fraud' headlines are being deployed to help Blunkett present a tough on ID fraud, tough on immigration stance in order to improve the reception of his ID bill on Monday. The current position is as follows. If you arrive at Heathrow with a suitcase full of false passports, you will be charged with Having a False Instrument, contrary to Section 5(2) of the Forgery and Counterfeiting Act 1981 (example (http://www.nationalcrimesquad.police.uk/Hot_off_the_press/2003/may/56.html)) Or if you're caught running a passport factory, you will be charged with conspiracy to make forged instruments (example (http://www.nationalcrimesquad.police.uk/Hot_off_the_press/2003/july/85.html)) Penalties are not what you'd call trivial - in our second example, the organiser received five years in prison plus the threat of another three if he did not pay the authorities #200,000. Defendants were (as is usual in these case, subject to a confiscation hearing to identify and seize any ill-gotten gains. The position as regards individuals holding false documentation is particularly interesting, because this is our second draconian crackdown in ten months. Prior to the Criminal Justice Act 2003 fraudulently obtaining a passport was dealt with under the Theft Act 1968, but one problem perceived with this was that although high penalties were available, loss tended to be equated with the value of the document, rather than the potential use to which the document could be put. Provisions increasing the penalty for falsely obtaining a passport or driving licence to a maximum of two years prison came into effect on 29h January 2004 (Home Office circular (http://www.homeoffice.gov.uk/docs3/hoc0704.html)) And when the late Beverley Hughes, a Home Office minister at the time, announced the change at the Combating Identity Fraud Conference in London in June last year, she said: "The new offence will make it much easier and swifter for police to arrest criminals for identity theft as they will be able to arrest the criminals for just possessing fake or stolen documents" (Home Office press release* (http://66.102.9.104/search?q=cache:8G84gJe8OVEJ:www.homeoffice.gov.uk/n_sto…)) Much useful information on the related issues of illegal immigration and people trafficking is available from the Metropolitan Police Authority, which reports that "as the Home Office have become more concerned about immigration and introduced more controls, so the opportunities for serious and organised criminals to profit from would-be migrants by providing them with fraudulently obtained, forged or stolen travel documentation, or secure means of transportation across borders, have increased" (performance report, 8th May 2003 (http://www.mpa.gov.uk/committees/ppr/2003/030508/09.htm)) The MPA says that numbers trafficked "rather than facilitated" are relatively small, that London is the principal target for organised crime and illegal immigration, and that 75 per cent of failed asylum seekers live in London. Joint operations with the Immigration Service had a target of the removal of 350 failed asylum seekers per month last May, and it was intended to ramp this to 800 a month by March 2004. Actions supporting this ramp include "a 'walk up' at identified locations throughout London with a focus that includes car washes and other similar activity." So clearly, even under the grotesquely inadequate laws of 2003, the police do not seem to have been significantly impeded in their ability to spot-check ID and nick people. A more recent MPA report (http://www.mpa.gov.uk/committees/ppr/2004/040212/11.htm) gives an indication of what happens to people carrying false ID, and indicates what the Home Office is doing to in the fight against organised crime (er, it's impeding it). Says the report: "It is evident, though, that UKIS and UKPS [Immigration Service and Passport Service respectively] are working to a different set of objectives to Operation MAXIM [the Met task force dealing with organised immigration-related crime]. From an enforcement perspective, UKIS is focused on meeting Government targets for removals and... considers identifying and tackling organised immigration crime networks as a secondary issue, potentially best addressed by police resources." So in chasing their failed asylum removal targets, IKIS and UKPS are whipping detainees out of the country so fast that police chances of tracking the origins of their false documentation are substantially reduced. The report continues: "This is leading to a number of missed opportunities where linked offences, such as forged passports coming from the same source, are not being followed up, because the focus is on removing the holder of the forged passport and not expanding the investigation to include identifying the network that supplied it and others in the series." So shall we recap? We will have a new, stiffer penalty for an offence that gained a new, stiffer penalty just last year. A large proportion of those caught carrying false ID will, as previously, be swiftly ejected from the country, and will therefore not be going to prison anyway. The Metropolitan Police is meanwhile is "negotiating" with the Immigration Service in order to agree procedures that will give it data on false identity documents that will actually stand up in court. Should UKIS be able to tear itself away from its Home Office targets for long enough to do this, then the police will be rather better equipped to target organised crime's production of false identity documents. . * Our apologies for the Google cache link. At time of writing great swathes of the UK government's documentation, including select committee reports, had been offline for several days. As the provision of information to the citizenry is merely a key component of the democratic process in the electronic age, we accept that this probably doesn't count as mission-critical. Related stories: UK public wants ID cards, and thinks we'll screw up the IT (http://www.theregister.co.uk/2004/04/22/id_cards/) Fingerprints as ID - good, bad, ugly? (http://www.theregister.co.uk/2004/04/19/biometrics/) Draft ID card Bill one month away - Blunkett (http://www.theregister.co.uk/2004/04/07/id_cards/) ) Copyright 2004 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

ID cards to use 'key database' of personal info
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://www.theregister.co.uk/2004/04/26/id_card_draft_published/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; Original URL: http://www.theregister.co.uk/2004/04/26/id_card_draft_published/ ID cards to use 'key database' of personal info By John Lettice (john.lettice(a)theregister.co.uk) Published Monday 26th April 2004 15:34 GMT David Blunkett today published his draft bill paving the way for a compulsory UK ID card, and reports over the weekend claimed that cabinet opposition had drawn some of the scheme's fangs, the draft suggests that it will be more extensive than expected in several key areas. According to the Sunday Times, (http://www.timesonline.co.uk/article/0,,2087-1086784,00.html) Foreign Secretary Jack Straw has secured agreement that it will never be mandatory to carry a card, that a Commons vote will be required before police can require a card's production, and that it will not be necessary to produce a card in order to obtain hospital treatment or welfare benefits. Speaking this morning however Blunkett disputed this, pointing to sections 15-18 of the draft as giving the necessary clearances. This section indeed makes provision for public services to hinge on ID cards, but specifically rules out the compulsion to carry it at all times or produce it for police. How long this will last is perhaps another matter. Blunkett is however pitching the scheme far more widely than simply as an entitlement, immigration, crime or terror control mechanism. Rather, it is intended as the cornerstone of identity and identity-management in the UK. The draft bill covers the setting up of a national identity register, which is described as "the key database of personal information which the biometric cards would link to," and envisages the creation of "a 'family' of ID cards, based on designated existing and new documents." This suggests far broader purposes than simply identifying individuals, and the Home Office announcement makes no bones about this: "ID cards will help tackle the type of serious and organised crime which depends on being able to use false identities - terrorism, drug trafficking, money laundering, fraud through ID theft, and illegal working and immigration. They will also enable people to access services more easily, and prevent access to those with no entitlement. And crucially, the cards will help people live their everyday lives more easily, giving them a watertight proof of identity for use in daily transactions and travel." The extent of the ID card's utility in dealing with false identity is at the very least somewhat slighter than Blunkett would have us believe, and its usefulness in dealing with ID fraud in commercial areas is dependent on whether or not it is used as strong ID there, and on the necessary equipment to validate the ID being present. An ID card with your fingerprints on it, for example, is of no protection to you in cases of 'cardholder not present' fraud (and it certainly useless in the Internet), and doesn't stop someone intercepting your mail and signing up for credit cards in your name. If we were just talking about a piece of government ID issued for government purposes only, then that would be OK - but here we're talking about "watertight proof of identity for use in daily transactions and travel." So we're not - Blunkett is really talking about something that will need substantially more networked checking points than something that was just 'son of passport', and about a lot more data, accessed by a lot more different government and non-government organisations, held centrally. And if it leads to more data on the card itself that can be used without further and/or biometric validation, then the cards themselves will tend to become more worth stealing. This is surely recklessly ambitious. More so because Blunkett still shows little sign of having a sound grasp of the actual capabilities of ID systems. This morning, for example, he told Today that ID cards "couldn't solve Madrid [the bombings] because nobody has biotechnology today." In the cases of both 9/11 and Madrid the attackers appear to have had valid ID, so biometric valid ID is neither here nor there, but despite having had this put to him by numerous interviewers Blunkett seems unable to stop presenting biometrics as some kind of magic. He went on to explain the situation of countries who didn't have biometric ID: "Those without biometrics will be known as the easiest touch. That's why we need to be ahead." The logic of this situation, that those countries where it is easier to obtain ID can be used by terrorists to establish valid ID which can then be used to visit and bomb the UK, seems to elude him. The Home Office does have schemes for biometric ID for non-UK passport holders in the UK, and is already fingeprinting asylum seekers and some visa applicants, but the scheme as announced today actually rules out biometrics for visitors who are staying less than three months. Which would seem to suggest that terrorists on an awayday are entirely immune to the #3.1 billion biometric checking regime. The roadmap as presented by Blunkett yesterday is as follows. Following the publication of the draft there will be "further consultation including opening up technical issues and inviting a development partner from the private sector", then a full bill will be introduced in the autumn session. Biometric passports will appear within three years, and "as we're putting this on a clean database this will not be forgeable." Foreign nationals will be brought into the scheme "as quickly as possible" and "we're hoping people will want voluntarily to renew their passport early" (not at those prices mate, so we can expect some special incentive discounts on the #73 for a passport), "so within seven years we will start to move to the position where people across the population have got an ID card." The Home Office itself today published a target of 80 per cent of the economically active population by 2013. Privacy International described the scheme as "draconian and dangerous," pointing out that the draft gave the Home Secretary wide powers to disclose identity-related information to a range of authorities, including police, Inland Revenue and Customs & Excise, can order a person to register for an ID card, and can even have them registered against their will if the necessary data is already known. A range of new offences including failure to notify of a damaged or defective card, and failure to report a change of address, is also introduced. The home Secretary (i.e. Blunkett) "has the power to make Orders to change almost every element of the proposed system." It is, says Privacy International director Simon Davies, "a disgrace to democracy." Related links: Draft bill and consultation (http://www.homeoffice.gov.uk/docs3/identitycardsconsult.pdf) Privacy International release (http://www.privacyinternational.org/issues/idcard/uk/pi-id-card-4-04.html) UK public wants ID cards, and thinks we'll screw up the IT (http://www.theregister.co.uk/2004/04/22/id_cards/) Fingerprints as ID - good, bad, ugly? (http://www.theregister.co.uk/2004/04/19/biometrics/) ID cards: a guide for technically-challenged PMs (http://www.theregister.co.uk/2004/04/05/uk_id_cards/) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Airport security failures justify CAPPS-II snoop system
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://www.theregister.co.uk/2004/04/26/airport_security_failures/print.html> The Register Biting the hand that feeds IT The Register ; Security ; Identity ; Original URL: http://www.theregister.co.uk/2004/04/26/airport_security_failures/ Airport security failures justify CAPPS-II snoop system By Thomas C Greene (thomas.greene(a)theregister.co.uk) Published Monday 26th April 2004 20:21 GMT Recent government reports on the failure of American airport screeners to detect threat objects at security checkpoints may provide ammunition for proponents of the controversial Computer Assisted Passenger Prescreening System (CAPPS II) database solution, which is currently stalled by myriad snafus too numerous to mention. Human error The Department of Homeland Security (DHS) Inspector General and the Congressional General Accounting Office (GAO) have both submitted reports on the competence of airport passenger and baggage screeners, and found, not surprisingly, that they are no more effective today than they were before the security frenzy brought about by the 11 September atrocities. In testimony before the House Aviation Subcommittee (http://www.house.gov/transportation/aviation/04-22-04/04-22-04memo.html) Inspector General for Homeland Security Clark Ervin and GAO Managing Director Norman Rabkin said that the Transportation Security Administration's (TSA's) well-paid screening personnel are no more effective than the inexpensive rent-a-cops provided by private contractors. A comparison between federal screeners and those participating in a pilot program for private contractors called the PP5 Program. According to Ervin, federal and private screeners "performed about the same, which is to say, equally poorly." He added that "this result was not unexpected, considering the degree of TSA involvement in hiring, deploying, and training the [private sector] screeners." It's believed that TSA's interference in the PP5 Program and its bureaucratic inertia are important reasons why the private-sector screeners failed to outdo their civil-service counterparts. Both reports are biased against the TSA. They assume that TSA is a lost cause, although, ironically, it had originally been touted as a much-needed fix for the incompetence of private contractors, upon whom blame for the 9/11 atrocity was conveniently fixed in the immediate aftermath. It now appears that TSA is seen as the chief source of security incompetence and failure. "TSA's tight controls over the pilot program restricted flexibility and innovation that the contractors may have implemented to perform at levels exceeding that of the federal workforce. TSA needs to establish a more robust pilot program that allows greater flexibility to test new innovations and approaches," Ervin said. Defective detectives Indeed, passenger screening is no better than it was 17 years ago. Covert testing conducted in 1978 - back when screeners were reasonably polite and quick and unobtrusive about their business - found that 13 per cent of threat objects passed undetected. Today, in the wake of post-9/11 security hysteria, and its attendant aggressive bullying of the public and punishment-strip searching of anyone daring to pass a sarcastic comment, the figure is 20 per cent. TSA Administrator Admiral David Stone defended his outfit and took issue with the reports. "Testing in the Nineties was in no way even comparable to what we do," he said. While it may be true that today's covert testing is more sophisticated, detection equipment has also improved to make the screeners' jobs easier, though he neglected to emphasize this fact. The red teams and the blue teams have both got better tricks up their sleeves, so there's certainly nothing unfair about the penetration tests, as Stone tried to imply. Still, bad news for human screeners may well be good news for technology. Database Hell Stone showed little enthusiasm for the PP5 Program, but he is a big proponent of CAPPS II, having touted it before the same House committee back in March as a scheme promising to deliver "vital impact ... on aviation security." He has studied the vendor's PR boilerplate with great care. CAPPS II is a "second-generation prescreening system [that] will be a centralized, automated, threat-based, real time, risk assessment platform ... expected to employ technology and data analysis techniques to conduct an information-based identity authentication," he gushed. The system is a product of aviation defense contractor Lockheed Martin Corporation, promoted by US Transportation Secretary and former Lockheed Martin Vice President Norman Mineta, Stone's boss. At present, the grand "risk assessment platform" is mired in failure. What little of it currently works has not been tested adequately because carriers are withholding passenger data in fear of a public backlash on privacy grounds. The accuracy of the many databases that CAPPS II will scour for its incriminating evidence has not yet been established. Procedures for passengers to detect inaccurate data, and get inaccurate data and false positives resolved, have not been implemented. Major privacy threats inherent in the system, particularly those involving restrictions on access, have not been addressed. The potential for malevolent identity thieves to impersonate innocent travelers remains high. False consciousness This is all good, because CAPPS II is one of the worst possible solutions to airport security. It won't prevent terrorists from flying; rather, it will increase the probability of another successful attack using commercial aircraft. The reason is painfully obvious: a group can very conveniently use the system to pre-screen its members and discover which of them have profiles that result in extra scrutiny. Thus CAPPS II is a superb tool for terrorists to use in assessing airport defenses. A group of unarmed terrorists can board two or three flights in succession and observe how the system reacts to them. If, after a few trial runs, they discover that they're allowed to board unchallenged, they can assume that their profiles do not trigger a warning. Armed with that information, they'll stand a good chance of mounting a real attack. CAPPS II is a disaster for two reasons: first, it will create a false sense of security among airline staff and provide further excuses for screeners to perform poorly; and second, it offers terrorists an excellent training device that they can use to assemble a group of people who can get onto airplanes without arousing suspicion. Ironically, the closer CAPPS II comes to achieving its stated goals, the more effective it will become as a terrorist tool. So it is indeed good that its development is going poorly. The problem, however, is that the recently publicized failures among human screeners will provide rationale to rush it into service. CAPPS II may well find itself on a fast track, pushed hard by those who would exploit the popular misconception that computers and other high-tech gizmos can compensate for human fallibility. . Thomas C Greene is the author of Computer Security for the Home and Small Office, a complete guide to system hardening, online anonymity, encryption, and data hygiene for Windows and Linux, available at discount in the USA (http://www.amazon.com/exec/obidos/tg/detail/-/1590593162/) and in the UK (http://www.amazon.co.uk/exec/obidos/ASIN/1590593162/) Related stories American Airlines data used to test passenger snoop system (http://www.theregister.co.uk/2004/04/13/privacy/) The wrong stuff: what it takes to be a TSA terror suspect (http://www.theregister.co.uk/2004/04/07/aclu-suit/) Campaigners fight biometric passports (http://www.theregister.co.uk/2004/03/29/campaigners_fight_biometric_passpor…) Data on 10m Northwest fliers handed to NASA for testing (http://www.theregister.co.uk/2004/01/20/data_on_10m_northwest_fliers/) US using EU airline data to test CAPPS II snoop system (http://www.theregister.co.uk/2004/01/15/us_using_eu_airline_data/) Commission agrees US access to EU citizen personal data (http://www.theregister.co.uk/2003/12/17/commission_agrees_us_access/) Congress threatens two hi-tech Gestapo programs (http://www.theregister.co.uk/2003/07/17/congress_threatens_two_hitech_gesta…) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Fact checking
by R. A. Hettinga 27 Apr '04

27 Apr '04

[having problems with an MX record somewhere. Let's see if this works...] At 3:04 PM -0400 4/26/04, Damian Gerow parsed a sentence thusly: >That's not saying that he invented the internet, it's saying that he took >initiative in creating it. Okay. I'll bite. Let's do a Rorschach test. Please parse *this* sentence: "A well regulated militia, being necessary to the security of a free state, the right of the people to keep and bear arms, shall not be infringed." :-) Too hard? How about this one: "Counsel is fully aware that Ms. Lewinsky has filed, has an affidavit which they are in possession of saying that there is absolutely no sex of any kind in any manner, shape or form, with President Clinton..." ;-) YMO"I"MV? Cheers, RAH -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "...if a person can't communicate, the very least he can do is to shut up." -- Tom Lehrer

1 0

U.K. Identity Card Will Make Fraud Easier, Expert Says
by R. A. Hettinga 27 Apr '04

27 Apr '04

<http://quote.bloomberg.com/apps/news?pid=10000102&sid=a7DltmImQUYE&refer=uk> Bloomberg ines Expanding European Union in Economic Competitiveness Study Amvescap, BAE, BP, BAT, Ferraris, Solitaire: U.K., Irish Equity Preview Royal Mail Group Seeking Permission to Price Letters by Size, Not Weight U.K. Identity Card Will Make Fraud Easier, Expert Says April 27 (Bloomberg) -- A U.K. identity card will not prevent terrorism and may make identity fraud easier, a leading security expert says, undermining the case for the cards made by Home Secretary David Blunkett. Blunkett on Monday set out plans for a national identity card featuring ``biometric'' measures such as fingerprints and iris scans to be introduced in 2007. A six-month trial of biometric recording and verification, involving 10,000 volunteers, has just begun. He said an ID card would protect Britain from terrorism, identity fraud and ``benefit tourism'' - people visiting the U.K. to claim welfare payments. ``An ID card makes ID fraud easier because it's a one-stop shop,'' said Bruce Schneier, a security expert and author of Beyond Fear: Thinking Sensibly About Security in an Uncertain World. ``My fear is that once you have a credential that everybody trusts, faking it becomes so much more valuable. There will be a false sense of security and you can abuse that.'' In an interview with the BBC in London on Monday, Blunkett cited information from the security forces that 35 percent of terrorists had used fake IDs. ``How is this going to help?'' said Schneier, who has testified on security before the US congress, from California. ``Let's pretend he's right, and let's pretend the card is 100 percent successful. So now there's no terrorists using fake IDs. Does it reduce the threat of an attack? No. They will just find another way. Any anti-terrorist measure that forces a terrorist to change his tactics in a meaningless way is a waste of money.'' The Home Office said in a statement that because the new cards would use biometric measures, the system would identify people trying to apply for multiple cards under different names. ``Biometrics won't stop me getting a card in your name,'' said Schneier. ``Pictures are a biometric, and we use pictures on cards in the US and fraud happens all the time. What's new is biometrics being checked by computer. Is your computer reliable? Mine isn't. ``The operators who run the computers are bribeable. What does it cost to bribe someone to go into a database and change the fingerprint?'' The plan to introduce a compulsory identity card for the first time since the cards were scrapped after World War II has met resistance from other member's of Prime Minister Tony Blair's government, including Trade and Industry Secretary Patricia Hewitt. Parliament will be given a vote before the cards are made compulsory in 2013. ``The whole point of this trial is to see what glitches we uncover,'' the Home Office said in a statement Replying to Schneier's criticisms. ``We will work to make the system as secure as possible.'' -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

recent node activity
by Riad S. Wahby 27 Apr '04

27 Apr '04

The al-Qaeda.net node was down for about 30 hours or thereabouts. It ought to be back up now. Messages received during that period have been resent. Sorry for the unannounced outage. Things should be better now. -- Riad Wahby rsw(a)jfet.org MIT VI-2 M.Eng

1 0