- cypherpunks-legacy - lists.cpunks.org

[IP] Arrests key win for NSA hackers (fwd from dave@farber.net)
by Eugen Leitl 08 Apr '04

08 Apr '04

----- Forwarded message from Dave Farber <dave(a)farber.net> -----

1 0

Passive E-Mail Monitoring Leads To Arrest
by Poindexter＠SAFe-mail.net 07 Apr '04

07 Apr '04

www.2advanced.net writes "The world's first arrest resulting from passive monitoring of electronic communications is being reported by Globe Technology. In the article, sources reveal that 'an e-mail message intercepted by NSA spies precipitated a massive investigation by intelligence officials in several countries that culminated in the arrest of nine men in Britain and one in suburban Orleans, Ont. -- 24-year-old software developer Mohammed Momin Khawaja, who has since been charged with facilitating a terrorist act and being part of a terrorist group.'" http://slashdot.org/articles/04/04/07/1450230.shtml?tid=137&tid=158&tid=215… JP

1 0

Some more anarchy and capitalism -- Fwd: [dgc.chat] Starving the Bastards in Bolivia
by Steve Schear 07 Apr '04

07 Apr '04

>Bolivia is a poor country. Nevertheless, no one, however poor, ever >starves in Bolivia: food is dirt cheap and readily available. > >In contrast, the government is starving to death. What joy! It is >desperate for increased revenue and is preoccupied with schemes for >new taxes etc. You may recall that last year the president, Gonzalo >Sanchez de Lozada, was driven out of the country because he tried to >impose an income tax. The new president, Carlos Mesa, has proposed >3 (three!) separate programs in the last few months for various new >kinds of taxes to raise revenue. And he has been forced to withdraw >all of them. > >The bureacrats' whining is getting deafening. > >http://www.el-deber.net/20040317/nacional_3.html > >Mesa negocia fondos externos para salarios >Mesa seeks external fund for salaries > >El Presidente insistis ayer en Cochabamba en la necesidad de mejorar >la situacisn financiera del Estado >Yesterday in Cochabamba, the president urged the necessity of >improving the >financial situation of the State. > >El gobierno teme un colapso fiscal. Ya no hay dinero para pagarles a los >funcionarios >pzblicos y por ello apela a un pacto para salir de la crisis. >The government is afraid of a fiscal collapse. There is now no money to >pay the public >servants and for that it appeals for an agreement for escaping the crisis. > >Tras alertar sobre la posibilidad de un colapso fiscal del pams, el >presidente Carlos Mesa >revels ayer que su gobierno negocia con la comunidad internacional fondos >para el pago >de salarios en el sector pzblico. >Announcing the possibility of a fiscal collapse of the country, the >president Carlos >Mesa revealed yesterday that his government is negotiating with the IMF in >order >to pay the salaries of the public sector. > >Note that he says there might be a fiscal collapse of the *country* when >it is not >the country but the government that might collapse. There is no chance of >the civil >society collapsing. We can only hope that the government does so the >society will >be freed from it. Also note what foreign aid is sought for: not to aid >the people of >Bolivia but to prop up the apparatus of the State. > > >Best, > >CCS > > >------------------------------------------------------ Anarchy may not be a better form of government, but it's better than no government at all.

1 0

RE: Firm invites experts to punch holes in ballot software
by Trei, Peter 07 Apr '04

07 Apr '04

> Michael_Heyman@NAI.com[SMTP:Michael_Heyman@NAI.com] wrote: > Peter Trei wrote: > > > > Frankly, the whole online-verification step seems like an > > unnecessary complication. > > > Except to those of us who don't trust the system. > > Implemented correctly it could be cheap and complications could be > hidden from the voter. It could be cheaper - no need to pay people to do > an audit when "the people" will do it for you. You only need a small > fraction of "the people" to verify their votes to get a high level of > confidence that the election is valid. You only need one failure to cast > doubt on the election. This requires an un-forgeable receipt that cannot > be used for coercion. Un-forgeable we have been doing for a while now > with lots of different PK options. A receipt that cannot be used for > coercion cannot give any indication to others of who you voted for. > Right now this is a big complication (at least to me - I don't know how > to create such a receipt that doesn't require mental gymnastics on the > part of the voter). > As Ian has noted, self-auditability and uncoercibility seem to be to be mutually exclusive requirements. If you're going to assume that the whole system is untrustworthy, you're still screwed despite the receipts - if the website says that yes, your vote counted in the final total, that still does not tell you that the right candidate was declared the winner. That would only happen if enough voters pooled their verifications to show that that had to be the case (this is equivalent to a recount). In a close-run two candidate race, if a number of voters equal to half the gap between the the candidate's totals failed to verify and report that their vote was recorded correctly, the result is still untrustworthy. ....and any system which relies on advanced mathematics will be unintelligible and mistrusted by the average voter. Peter

1 0

Anarchy and Capitalism in Africa of all places...
by Gabriel Rocha 07 Apr '04

07 Apr '04

http://www.economist.com/World/africa/PrinterFriendly.cfm?Story_ID=2559183 (it requires a login... article pasted below) I specially like the part about taxation and the difficulties of implementing it... Somalia Coke and al-Qaeda Apr 1st 2004 | MOGADISHU >From The Economist print edition Reuters Africa's most chaotic country is a bit calmer, but probably still home to anti-western terrorists Get article background THERE are two ways to run a business in Somalia. You can pay off the local warlord, not always the most trustworthy of chaps, and hope he will stop his militiamen from murdering your staff. Or you can tell him to get stuffed and hire your own militia. After 13 years of civil war, businessmen are increasingly plumping for the latter option, and their defiance has been rewarded. A veneer of normality is returning to the world's most chaotic country. An economy, of sorts, is beginning to thrive. Somalia's first Coca-Cola bottling plant opened in the capital, Mogadishu, last month. That its carbon dioxide chambers are encased in mortar-proof reinforced concrete is almost beside the point. Somalis now have the opportunity to rot their teeth like anyone else, and that feels good. Countrywide distribution will be smoothed by the presence of hundreds of experienced security guards, who are also responsible for protecting the odd foreign expert who drops in. Newcomers are encouraged to calm their nerves by firing off a few rounds or lobbing a hand-grenade shortly after arrival. It really works, enthuses a visiting Kenyan engineer. Perversely, this renaissance has been made possible by Somalia's continuing fragmentation. There is still no proper central government but, where once there was only a handful of warlords, there are now at least 24, and that is only the serious ones. With smaller fiefs to pillage, few can now afford the $100,000 or more that it costs to wage a six-hour battle, so such battles are less common. This is what passes for peace in Somalia, and it is enough to tempt many homesick exiles to return. They bring money as well as skills and contacts. In the past few years, hospitals, schools, businesses and even a university have appeared. In some ways, anarchy makes doing business easier. There are no formal taxesgiven how heavily-armed the average Somali is, these would be hard to collectand no regulation whatsoever. But the costs of chaos outweigh the benefits. You can roar through a warlord's road block unmolested if you have ten gunmen in the back of your pickup, but you have to pay your gunmen. Nationlink, one of the country's three mobile-phone operators, employs 300 guards to protect 500 staff. Everyone yearns for a restoration of stability and a proper government. A dozen attempts at negotiating a formal peace have failed. But since September 11th 2001, western governments, anxious to prevent al-Qaeda from using Somalia as a base, have pressed the warlords to make peace. On January 29th, after talks in Kenya, they were rewarded with a power-sharing agreement providing for a 275-strong parliament that is meant to represent all the country's main clans and minorities. Somalis are sceptical, however. Under the accord, warlords will choose the MPs, whose appointment will be confirmed by traditional elders. Who will pick the elders? Many worry that the warlords will. Some even argue that western support for the peace process encourages violence, by rewarding thugs with a share of power. Businessmen and other non-violent types have been excluded from the talks. We have built schools, repaired hospitals and rebuilt roads. Yet no one is asking us what we think, says Nationlink's managing director, Ahmed Abdi Dini. Since the power-sharing agreement, the talks have stalled. Amid the acrimony, consensus was reached on one issue: the warlords, many of them barely literate, unanimously agreed to abolish a clause barring those without a secondary education from parliament. Meanwhile, a decade after its botched intervention to protect food-aid deliveries in Somalia, the United States is back; this time, hunting for terrorists. American intelligence officers are working with two warlords to gather information about suspected al-Qaeda people in Somalia. Last year, an American commando raid on a Mogadishu hospital netted a Yemeni terrorist suspect, now in Guantanamo Bay. Hussein Aideed, son of the warlord whom American troops tried but failed spectacularly to capture in 1993, was apparently paid $500,000 for 41 Strela missiles to ensure they did not fall into bin Ladenite hands. It is rumoured that other warlords have also been paid: enough, possibly, to restock dwindling weapons supplies. Your correspondent saw some impressive hardware, including four gleaming Howitzers, at the base of one of the warlords, Mohamed Qanyare Afrah. Short tempers, tall stories President George Bush's war on terror has won him few friends in Somalia. In 2001, America forced the closure of Somalia's biggest remittance bank, on the ground that it was used to launder terrorist funds, and froze the assets of al-Haramain, a Saudi charity with alleged terrorist links. This may have made life harder for al-Qaeda, but it also made it harder for expatriate Somalis to send money to their relatives back home, and led, among other things, to the recent closure of Somalia's biggest orphanage. Since America is offering Somalis nothing by way of compensation, they are furious. We must become terrorists, says Abdulkadir Ahmed, a militiaman who claims to be training to fight America. With typical Somali bravado, he adds that: Palestinians who do suicide bombings and just kill a few people are stupid. If I had to sacrifice my life, I would take between 1,000 and 7,000 Americans with me. Copyright ) 2004 The Economist Newspaper and The Economist Group. All rights reserved.

1 0

RE: Firm invites experts to punch holes in ballot software
by Trei, Peter 07 Apr '04

07 Apr '04

> Ian Grigg[SMTP:iang@systemics.com] wrote: > > Trei, Peter wrote: > > Frankly, the whole online-verification step seems like an > > unneccesary complication. > > It seems to me that the requirement for after-the-vote > verification ("to prove your vote was counted") clashes > rather directly with the requirement to protect voters > from coercion ("I can't prove I voted in a particular > way.") or other incentives-based attacks. > > You can have one, or the other, but not both, right? > > It would seem that the former must give way to the latter, > at least in political voting. I.e., no verification after > the vote. > > iang > Yes, that seems to be the case. Note that in the current (non computer) systems, we have no way to assure that our votes actually contributed to the total, but the procedural stuff of having mutually hostile observers to the counting process makes deliberate discarding of one side's votes less likely. (Non-deliberate losses - such as the recent failure to record cards marked with the wrong kind of pen - can still happen). VoteHere, while they seem to be well-meaning, have not solved the problem. Mercuri & Rivest have described how to do it right; we just need someone to buld or retrofit the machines appropriately. Peter Trei

1 0

The wrong stuff: what it takes to be a TSA terror suspect
by R. A. Hettinga 07 Apr '04

07 Apr '04

<http://www.theregister.co.uk/2004/04/07/aclu-suit/print.html> The Register Biting the hand that feeds IT The Register ; Internet and Law ; Original URL: http://www.theregister.co.uk/2004/04/07/aclu-suit/ The wrong stuff: what it takes to be a TSA terror suspect By John Lettice (john.lettice(a)theregister.co.uk) Published Wednesday 7th April 2004 17:47 GMT The plaintiffs' statements in an American Civil Liberties Union lawsuit against the Department of Homeland Security and the Transport Security Administration provides some useful clues about what it takes to make the grade as a dangerous terror suspect. Career USAF Master Sergeant and mother of three? Retired Presbyterian Minister? ACLU special projects co-ordinator with Pakistani-type name? Well yes, that last one might not have come entirely as a surprise to you, but the ACLU has chosen its sample plaintiffs well. They are all American citizens who've experienced repeated delays and embarrassments because they are on the shady 'no fly' list distributed to US airlines by the TSA. No reason for their presence on this list is obtainable, and there would appear to be no easy mechanism for getting off it. According to the statement of Rev John F Shaw (71), when he complained to the TSA's Ombudsman's office a TSA agent explained "that the list is computer-generated and linked to another database known as CAPPS." The CAPPS link is a strong signal that the no fly list will in the future be substantially expanded as the TSA expands its use of airline passenger data. The statements also indicate that the TSA itself has no ready mechanism for getting people off the list. It seems to agree with some of the plaintiffs that they're false positives, but they keep getting the treatment on subsequent flights anyway. Two of the plaintiffs have actually been given letters from the TSA verifying their identity, but one of these still experiences problems. The second, student Alexandra Hay, was given a personal escort through Philadelphia Airport by the TSA along with the letter after the ACLU threatened to sue on her behalf. Attorney David Nelson meanwhile reports he has been stopped over 40 times, and that other people called David Nelson, including the one who's a sitcom star, have had similar problems. The ACLU is asking that the court declare that the no-fly list violates passengers' constitutional rights to freedom from unreasonable search and seizure and due process of law under the Fourth and Fifth Amendments. . Related link ACLU launches suit (http://www.aclu.org/SafeandFree/SafeandFree.cfm?ID=15430&c=272) -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Utah vs. first amendment, global 'net, cookies
by Major Variola (ret.) 07 Apr '04

07 Apr '04

(I'm not defending hostile spyware but there are problems with the law..) http://www.pcworld.com/news/article/0,aid,115527,00.asp Tom Spring, PC World Friday, April 02, 2004 Utah has become the first state to make spyware a crime, passing a law that makes it illegal to install such programs on a PC without approval. Starting in early May, violators face a fine of $10,000 per incident, under the new Spyware Control Act. The Utah law aims to regulate the use of spyware and other advertising software, which is infamous for annoying computer users by tracking and reporting their Web whereabouts and displaying ads. A software company that wants to load a surveillance program onto a Utah user's PC must make full disclosure, under the law. It must reveal what user behavior its software records, what information goes back to a central server, how often ads will appear, and how the ads look. Vendors must also clearly state the purpose of the downloaded software and any changes it makes to a PC's system. <snip> Opponents say the Spyware Control Act is a legal threat to a technology company's right to innovate. Hackett says the Utah law could be interpreted to ban free ad-sponsored software, and perhaps even threaten common e-mail programs that track when and which messages are delivered. State Rep. Urquhart says the law will let a Utah firm sue a spyware company that doesn't follow the Spyware Control Act, when its program displays ads on the Web site of a Utah-based business. He also says the act will help protect consumers by forcing spyware companies to be more upfront about their software.

1 0

VoteHere Release Audit Trail Code
by R. A. Hettinga 07 Apr '04

07 Apr '04

<http://www.internetnews.com/dev-news/print.php/3336851> Internetnews.com VoteHere Release Audit Trail Code By Jim Wagner April 7, 2004 E-voting software developer VoteHere made its audit checking source code available for download Tuesday in a bid to prove its software does what it promises: provide a verifiable audit trail over every citizen's vote. Much of the debate surrounding the electronic tabulation of votes has centered on the machines' ability (or inability in this case) to record votes and then let voters and election officials verify the correct vote was entered and stored in the central repository. Jim Adler, VoteHere founder, said the source code makes good on its promise back in August 2003 when the company announced a partnership with e-voting machine manufacturer Sequoia, to release the code for all to see. "We're a bunch of cryptographers and as students of cryptography, we know there's no real security in obscurity and feel that openness and transparency are an important part of the process, especially with technology that is used to audit an e-voting machine," he told internetnews.com. To date, attempts by e-voting opponents to get software makers to release their code for public scrutiny have met with failure. The most notable case dealt with manufacturer Diebold Election Systems, which filed cease-and-desist orders against a group of college students who discovered vulnerabilities in its machines and posted their findings on the Internet, as well as anyone who put links to the vulnerabilities on their Web site and their Internet service providers (ISP). In December 2003, the company withdrew the orders after the college students, through the Electronic Frontier Foundation (EFF) filed suit against them. Eight days later, Diebold and five other manufacturers banded together under the Information Technology Association of America to "identify and address security concerns" and "raise the profile of electronic voting." VoteHere officials expect the open-sourcing of its audit trail will close the debate on its area of security, at least. Though it's software only runs on Sequoia's machines, Adler said the manufacturer makes up 20 to 30 percent of the industry's market share. The company paid Dr. Robert Baldwin, co-founder of California-based Plus Five Consulting and former technical director of RSA Security, to conduct an independent analysis of its code, who said he was in no way affiliated with VoteHere. "We actually found fewer types of problems than we normally find when we look at other people's code," he told internetnews.com. "I think they definitely had an eye towards producing higher-quality code because they knew somebody was going to go looking at it. The software could easily look at 100 million-person audit trail and verify it within an hour." Individuals who want to review the code can download it here: <http://www.votehere.com/downloads.html> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

RE: Firm invites experts to punch holes in ballot software
by Major Variola (ret) 07 Apr '04

07 Apr '04

Peter, what would be wrong with having a machine in the booth that prints any valid receipt BUT is not connected to the voting system. "To vote use the red machine; if you're being coerced you can use the blue machine to print as many receipts as intimidators." A trade off between (mild) user complexity and the desire for receipts (without coercion). At 10:17 AM 4/7/04 -0400, Trei, Peter wrote: >This is kind of broken. Allowing the voter to get a receipt which >they take away with them for verification may allow the voter to verify >that their vote was recorded as cast, but also allows coercion and >vote buying. > >To their credit, the creators thought of this, and suggest a >partial procedural fix in the threat analysis document: > > P4. Let voters discard verification receipts in poll site trash > can and let any voter take them > Result: Buyer/coercer can't be sure voter generated verification >receipt > > P5. Have stacks of random printed codebooks freely available in poll >site > Result: Vote buyer/coercer can't be sure captured codebook was used > > P6. Have photos of on-screen codebooks freely available on-line > Result: Vote buyer/coercer can't be sure captured codebook was used > >The first problem, or course, is that a person under threat of >coercion will need to present the coercer with a receipt showing >exactly the mix of votes the coercer required. This is leads >to a combinatorial explosion of fake receipts that need to be available. > >Having only one vote on each receipt might mitigate this, but it still >gets really messy. > >Second, it's not clear how this protects against the coercer checking the >ballot online - will every fake also be recorded in the system, so >it passes the online check? Having both real and fake ballots in >the verification server makes me very nervous. > >Its possible I've missed something - this is based on a quick glance >through the online documents, but I don't see any advantage this >system has over the much more discussed one where the reciept is >printed in a human readable way, shown to the voter, but retained >inside the machine as a backup for recounts. > >Just my private, personal opinion. > >Peter Trei

1 0