- cypherpunks-legacy - lists.cpunks.org

my periodic rant on quantum crypto
by Perry E. Metzger 06 Jul '18

06 Jul '18

/. is running yet another story on quantum cryptography today, with the usual breathless hype: http://science.slashdot.org/article.pl?sid=04/04/12/133623 I'm especially unimpressed with the "Does this spell the end of the field of cryptography?" comment. For those who don't know much about what it is, "Quantum Cryptography" is a very expensive way of producing an unauthenticated link encryption device. It is useless for any application other than link encryption over a short distance and requires a dedicated optical fiber to work. QC has no properties that render it especially better for link encryption than, say, a box from one of several vendors running AES on the link instead. It is perhaps theoretically safer, but in practice no one is going to break AES either -- they're going to bribe the minimum wage guard at your colo to have 20 minutes alone with your box while they install a tap on the clear side of it (or worse, they'll slip in while the guard is asleep at his desk.) QC still requires link authentication (lest someone else other than the people you think you're talking to terminate your fiber instead). As a result of this, you can't really get rid of key management, so QC isn't going to buy you freedom from that. QC can only run over a dedicated fiber over a short run, where more normal mechanisms can work fine over any sort of medium -- copper, the PSTN, the internet, etc, and can operate without distance limitation. QC is fiendishly costly -- orders of magnitude more expensive than an AES based link encryption box. QC is extremely hard to test to assure there are no hardware or other failures -- given the key in use, I can use intercepted traffic to assure my AES link encryption box is working correctly, but I have no such mechanism for a QC box. On top of all of this, the real problems in computer security these days have nothing to do with stuff like how your link encryption box works and everything to do with stuff like buffer overflows, bad network architecture, etc. Given that what we're dealing with is a very limited technology that for a very high price will render you security that is at best not particularly better than what much more economical solutions will yield, why do people keep hyping this? Indeed, why do people buy these boxes, if indeed anyone is buying them? It is stunning that a lab curiosity continues to be mentioned over and over again, not to mention to see venture capitalists dump money after it. BTW, none of this has anything to do with "Quantum Computing", which may indeed yield breakthroughs someday in areas such as factoring but which is totally unrelated... Perry --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] NORAD orders Web deletion of transcript]
by David Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: NORAD orders Web deletion of transcript Date: Thu, 09 Mar 2006 23:43:53 -0500 From: Richard Forno <rforno(a)infowarrior.org> To: Dave Farber <dave(a)farber.net> NORAD orders Web deletion of transcript By Declan McCullagh http://news.com.com/NORAD+orders+Web+deletion+of+transcript/2100-1028_3-6048 254.html Story last modified Thu Mar 09 19:07:01 PST 2006 In an unusual follow-up to a public event, the Defense Department and the Transportation Security Administration have ordered that a transcript of an open hearing on aviation restrictions be yanked from the Web. Maj. Gen. M. Scott Mayes, the head of the North American air defense command, ordered the internal review that flagged the hearing's transcript as problematic and led to its deletion from a government Web site, CNET News.com has learned. The public hearing was held Jan. 18 at the Airport Marriott in Dulles, Va., and was discussed in local news reports. Its purpose was to ask for public opinions about recent airspace security restrictions near the nation's capital, which have cost local businesses some $45 million a year in lost revenue and have even prompted some general aviation pilots to move elsewhere. One of the pilots who testified was Lt. Cmdr. Tom Bush, a U.S. Navy F-18 Hornet pilot who also flies a small civilian plane and said he was speaking as a private individual. "Freedom and security are polar opposites, and I am not willing to give up my freedom for the sake of terrorists," Bush said during the hearing, according to a report at AviationNow.com. The report also said Bush suggested the airspace restrictions were irrational because a terrorist could pretend to fly through the Air Defense Identification Zone (ADIZ) to nearby Dulles airport, make a right-hand turn at the last minute, and be over downtown Washington, D.C., in four minutes. The ADIZ is a ring stretching almost 40 miles around Washington, D.C. "There may be some operational security concerns with the time line he laid out," Michael Kucharek, the chief of media relations for the North American Aerospace Defense Command, said in a telephone interview Thursday. Kucharek said that "there were some operational security concerns revealed by this person who had knowledge but appeared as a public citizen, which we think was out of line. The disclosure of that information could go directly to national security concerns." The Bush administration has been criticized in the past by open government advocates for its aggressive efforts to avoid the disclosure of information that historically has been public. In 2003, the U.S. Army surreptitiously pulled the plug on one of its more popular Web sites after a report embarrassing to the military appeared on it. In another example, the names of the members of the Defense Science Board--an obscure but influential advisory body that influences military policy and had a budget of $3.6 million a year--have vanished from the group's public Web site. The 369-page transcript of the event (part 1 and part 2), previously posted on the Federal Aviation Administration's Web site, has been replaced with a notice saying it is "presently unavailable." Lt. Cmdr. Bush could not be reached for comment. One pilot who was at the hearing reported that Bush said that Americans kicked out the British, tamed the West, won two World Wars, put a man on the moon--and should start acting like it. Some pilots expressed skepticism that Bush disclosed anything sensitive and suggested that the deletion was because he criticized the government's security apparatus. Representatives from NORAD, TSA, FAA, the Department of Homeland Security, the Secret Service, and Customs and Border Protection were on the panel hearing testimony and remained silent during Bush's testimony. "The fact that TSA is an out of control dysfunctional agency is a given, so it may be just another example of their ongoing buffoonery," wrote Lee Schiek, the manager of Maryland's College Park Airport, in an e-mail message on Thursday. "On the other hand, this could be an attempt to rewrite history to minimize the public record sentiment regarding the ADIZ. In any event, since its inception, TSA has consistently demonstrated their inability to do the right thing, and this latest example should not go unchallenged." The ADIZ is opposed by general aviation pilots--that is, pilots who fly smaller aircraft such as a Cessna, Mooney or Piper--because it imposes strict security rules that increase bureaucracy and can overload air traffic controllers. It was created as a supposedly temporary measure after Sept. 11, 2001, but the Bush administration has suggested that it become permanent. Over 21,300 comments, almost entirely critical of the ADIZ, were filed in the FAA proceeding that led to January's public hearing in Virginia. Many comments said that a terrorist could easily defeat the purpose of the ADIZ by filing the paperwork, talking to air traffic controllers, and then turning toward Washington, D.C. at the last moment. Others said it was odd to worry about general aviation aircraft that typically have two to six seats and can carry less than most SUVs. The FAA said Thursday the transcript might be restored soon. It is being reviewed "and no final decisions have been made," FAA spokeswoman Laura Brown said. "I think that you'll see virtually all of that reposted fairly quickly." ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [IP] Cold Boot Attacks on Disk Encryption
by Declan McCullagh 06 Jul '18

06 Jul '18

Dave, The paper published today makes some pretty strong claims about the vulnerabilities of Microsoft's BitLocker, Apple's FileVault, TrueCrypt, Linux's dm-crypt subsystem, and similar products. So I put the folks behind it to a test. I gave them my MacBook laptop with FileVault turned on, powered up, encrypted swap enabled, and the screen saver locked. They were in fact able to extract the 128-bit AES key; I've put screen snapshots of their FileVault bypass process here: http://www.news.com/2300-1029_3-6230933-1.html And my article with responses from Microsoft, Apple, and PGP is here: http://www.news.com/8301-13578_3-9876060-38.html Bottom line? This is a very nicely done attack. It's going to make us rethink how we handle laptops in sleep mode and servers that use encrypted filesystems (a mail server, for instance). -Declan Jacob Appelbaum wrote: > With all of the discussions that take place daily about laptop > seizures, > data breech laws and how crypto can often come to the rescue, I > thought > the readers of IP might be interested in a research project that was > released today. We've been working on this for quite some time and are > quite proud of the results. > Ed Felten wrote about it on Freedom To Tinker this morning: > http://www.freedom-to-tinker.com/?p=1257 ------------------------------------------- Archives: http://www.listbox.com/member/archive/247/=now RSS Feed: http://www.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ------------------------------------------- Archives: http://www.listbox.com/member/archive/247/=now RSS Feed: http://www.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] been there -- Cold Boot Attacks on Disk Encryption -- report on
by David Farber 06 Jul '18

06 Jul '18

________________________________________ From: Paul E. Robichaux [paul(a)robichaux.net] Sent: Thursday, February 21, 2008 7:51 PM To: David Farber; ip Subject: Re: [IP] Cold Boot Attacks on Disk Encryption -- report on I want to point out that this class of attacks (generically known as b Freon attacksb) have been known for some time, although the Princeton team has done great work in making the attack more practical. BitLocker offers operating modes that mitigate the risk of these attacks; for more details, check out the Microsoft Data Encryption Toolkit for Mobile PCs at <http://www.microsoft.com/technet/security/guidance/clientsecurity/dataencry…><http://www.microsoft.com/technet/security/guidance/clientsecurity/dataencry…>. It details the various BitLocker operating modes and the specific threats that they do, and do not, protect against. Disclaimer: I was the lead author for the Data Encryption Toolkit documents. Cheers, -Paul On 2/21/08 4:25 PM, "David Farber" <dave(a)farber.net> wrote: Begin forwarded message:

1 0

Re: [IP] Cold Boot Attacks on Disk Encryption
by Declan McCullagh 06 Jul '18

06 Jul '18

Dave, The paper published today makes some pretty strong claims about the vulnerabilities of Microsoft's BitLocker, Apple's FileVault, TrueCrypt, Linux's dm-crypt subsystem, and similar products. So I put the folks behind it to a test. I gave them my MacBook laptop with FileVault turned on, powered up, encrypted swap enabled, and the screen saver locked. They were in fact able to extract the 128-bit AES key; I've put screen snapshots of their FileVault bypass process here: http://www.news.com/2300-1029_3-6230933-1.html And my article with responses from Microsoft, Apple, and PGP is here: http://www.news.com/8301-13578_3-9876060-38.html Bottom line? This is a very nicely done attack. It's going to make us rethink how we handle laptops in sleep mode and servers that use encrypted filesystems (a mail server, for instance). -Declan Jacob Appelbaum wrote: > With all of the discussions that take place daily about laptop > seizures, > data breech laws and how crypto can often come to the rescue, I > thought > the readers of IP might be interested in a research project that was > released today. We've been working on this for quite some time and are > quite proud of the results. > Ed Felten wrote about it on Freedom To Tinker this morning: > http://www.freedom-to-tinker.com/?p=1257 ------------------------------------------- Archives: http://www.listbox.com/member/archive/247/=now RSS Feed: http://www.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ------------------------------------------- Archives: http://www.listbox.com/member/archive/247/=now RSS Feed: http://www.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] been there -- Cold Boot Attacks on Disk Encryption -- report on
by David Farber 06 Jul '18

06 Jul '18

________________________________________ From: Paul E. Robichaux [paul(a)robichaux.net] Sent: Thursday, February 21, 2008 7:51 PM To: David Farber; ip Subject: Re: [IP] Cold Boot Attacks on Disk Encryption -- report on I want to point out that this class of attacks (generically known as b Freon attacksb) have been known for some time, although the Princeton team has done great work in making the attack more practical. BitLocker offers operating modes that mitigate the risk of these attacks; for more details, check out the Microsoft Data Encryption Toolkit for Mobile PCs at <http://www.microsoft.com/technet/security/guidance/clientsecurity/dataencry…><http://www.microsoft.com/technet/security/guidance/clientsecurity/dataencry…>. It details the various BitLocker operating modes and the specific threats that they do, and do not, protect against. Disclaimer: I was the lead author for the Data Encryption Toolkit documents. Cheers, -Paul On 2/21/08 4:25 PM, "David Farber" <dave(a)farber.net> wrote: Begin forwarded message:

1 0

Re: [cryptography] really sub-CAs for MitM deep packet inspectors? (Re: Auditable CAs)
by Adam Back 06 Jul '18

06 Jul '18

Well I was aware of RA things where you do your own RA and on the CA side they limit you to issuing certs belonging to you, if I recall thawte was selling those. (They pre-vet your ownership of some domains foocorp.com, foocorpinc.com etc, and then you can issue www.foocorp.com, *.foocorp.com .. however you dont get a CA private key, you get web integration with the RA so you dont have to do the email verification dance for each cert you create). Handing over a signed sub-CA is a much higher level of risk, unless perhaps it has a constraint on the domain names of certs it can sign baked into it, which is possible. To hand over a blank cheque sub-CA cert that could sign gmail.com is somewhat dangerous. But you notice that geotrust require it to be in a hardware token, and some audits blah blah, AND more importantly that you agree not to create certs for domains you dont own. Start of the thread was that Greg and maybe others claim they've seen a cert in the wild doing MitM on domains the definitionally do NOT own. (The windows 2k box sounds scary for sure, and you better hope that's not a general unrestricted sub-CA cert, but even then you could admit its similar to the security practices of diginotar.) Secure as the weakest link, and the weakest link just keeps getting lower. It would be interesting to know if there really are CAs lax enough to issue a sub-CA cert to a windows box with no hardware container for the private key. (Not that it makes that much difference... hack the RA and the private key doesnt matter so much). The real question again is can we catch a boingo or corp lan or government using a MitM sub-CA cert, and then we'll know which CA is complicit in issuing it, and delist them. Adam On Fri, Dec 02, 2011 at 07:07:19PM +1300, Peter Gutmann wrote: > Ben Laurie <ben(a)links.org> writes: > >> They appear to actually be selling sub-RA functionality, but very hard to >> tell from the press release. > > OK, so it does appear that people seem genuinely unaware of both the fact that > this goes on, and the scale at which it happens. Here's how it works: > > 1. Your company or organisation is concerned about the fact that when people > go to their site (even if it's an internal, company-only one), they get scary > warnings. > > 2. Your IT people go to a commercial CA and say "we would like to buy the > ability to issue padlocks ourselves rather than having to buy them all off > you". > > 3. The CA goes through an extensive consulting exercise (billed to the > company), after which they sell the company a padlock-issuing license, also > billed to the company. The company is expected to keep records for how many > padlocks they issue, and pay the CA a further fee based on this. > > 4. Security is done via the honour system, the CA assumes the company won't do > anything bad with their padlock-issuing capability (or at least I've never > seen any evidence of a CA doing any checking apart from for the fact that > they're not getting short-changed). > > This is why in the past I've repeatedly referred to "unknown numbers of > unknown private-label CAs", we have absolutely no idea how many of these > private-label CAs are out there or who they are or who controls them, but > they're probably in the tens, if not hundreds, of thousands, and many are > little more than a Windows server on a corporate LAN somewhere (and I mean > that literally, it was odd to sit in front of a Windows 2000 box built from > spare parts located in what used to be some sort of supplies closet and think > "I can issue certs that chain to $famous_ca_name from this thing" :-). > > Going through the process is like getting a BS 7799 FIPS 140 certification, > you pay the company doing the work to get you through the process, and you > keep paying them until eventually you pass. The only difference is that while > I've heard of rare cases of companies failing BS 7799, I've never heard of > anyone failing to get a padlock-issuing license. > > Are people really not aware of this? I thought it was common knowledge. If > it isn't, I'll have to adapt a writeup I've done on it, which assumes that > this is common knowledge. > > Peter. > > _______________________________________________ > cryptography mailing list > cryptography(a)randombit.net > http://lists.randombit.net/mailman/listinfo/cryptography _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] really sub-CAs for MitM deep packet inspectors? (Re: Auditable CAs)
by Adam Back 06 Jul '18

06 Jul '18

Well I was aware of RA things where you do your own RA and on the CA side they limit you to issuing certs belonging to you, if I recall thawte was selling those. (They pre-vet your ownership of some domains foocorp.com, foocorpinc.com etc, and then you can issue www.foocorp.com, *.foocorp.com .. however you dont get a CA private key, you get web integration with the RA so you dont have to do the email verification dance for each cert you create). Handing over a signed sub-CA is a much higher level of risk, unless perhaps it has a constraint on the domain names of certs it can sign baked into it, which is possible. To hand over a blank cheque sub-CA cert that could sign gmail.com is somewhat dangerous. But you notice that geotrust require it to be in a hardware token, and some audits blah blah, AND more importantly that you agree not to create certs for domains you dont own. Start of the thread was that Greg and maybe others claim they've seen a cert in the wild doing MitM on domains the definitionally do NOT own. (The windows 2k box sounds scary for sure, and you better hope that's not a general unrestricted sub-CA cert, but even then you could admit its similar to the security practices of diginotar.) Secure as the weakest link, and the weakest link just keeps getting lower. It would be interesting to know if there really are CAs lax enough to issue a sub-CA cert to a windows box with no hardware container for the private key. (Not that it makes that much difference... hack the RA and the private key doesnt matter so much). The real question again is can we catch a boingo or corp lan or government using a MitM sub-CA cert, and then we'll know which CA is complicit in issuing it, and delist them. Adam On Fri, Dec 02, 2011 at 07:07:19PM +1300, Peter Gutmann wrote: > Ben Laurie <ben(a)links.org> writes: > >> They appear to actually be selling sub-RA functionality, but very hard to >> tell from the press release. > > OK, so it does appear that people seem genuinely unaware of both the fact that > this goes on, and the scale at which it happens. Here's how it works: > > 1. Your company or organisation is concerned about the fact that when people > go to their site (even if it's an internal, company-only one), they get scary > warnings. > > 2. Your IT people go to a commercial CA and say "we would like to buy the > ability to issue padlocks ourselves rather than having to buy them all off > you". > > 3. The CA goes through an extensive consulting exercise (billed to the > company), after which they sell the company a padlock-issuing license, also > billed to the company. The company is expected to keep records for how many > padlocks they issue, and pay the CA a further fee based on this. > > 4. Security is done via the honour system, the CA assumes the company won't do > anything bad with their padlock-issuing capability (or at least I've never > seen any evidence of a CA doing any checking apart from for the fact that > they're not getting short-changed). > > This is why in the past I've repeatedly referred to "unknown numbers of > unknown private-label CAs", we have absolutely no idea how many of these > private-label CAs are out there or who they are or who controls them, but > they're probably in the tens, if not hundreds, of thousands, and many are > little more than a Windows server on a corporate LAN somewhere (and I mean > that literally, it was odd to sit in front of a Windows 2000 box built from > spare parts located in what used to be some sort of supplies closet and think > "I can issue certs that chain to $famous_ca_name from this thing" :-). > > Going through the process is like getting a BS 7799 FIPS 140 certification, > you pay the company doing the work to get you through the process, and you > keep paying them until eventually you pass. The only difference is that while > I've heard of rare cases of companies failing BS 7799, I've never heard of > anyone failing to get a padlock-issuing license. > > Are people really not aware of this? I thought it was common knowledge. If > it isn't, I'll have to adapt a writeup I've done on it, which assumes that > this is common knowledge. > > Peter. > > _______________________________________________ > cryptography mailing list > cryptography(a)randombit.net > http://lists.randombit.net/mailman/listinfo/cryptography _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[silk] Fwd: Role of the US Tech Companies in Government Surveillance: A Lecture by Christopher Soghoian b Centre for Internet and Society
by Udhay Shankar N 06 Jul '18

06 Jul '18

For those in Bangalore, this sounds like fun. Udhay http://cis-india.org/internet-governance/role-of-us-tech-companies-in-govt-… Role of the US Tech Companies in Government Surveillance: A Lecture by Christopher Soghoian Christopher Soghoian will deliver a lecture on the role US tech companies play in assisting government surveillance at the Centre for Internet & Society office in Bangalore on August 27, 2012. When Aug 27, 2012 from 05:00 PM to 07:00 PM Where The Centre for Internet & Society, Bangalore Your internet, phone and web application providers are all, for the most part, in bed with US and other foreign government agencies. They all routinely disclose their customers' communications and other private data to law enforcement and intelligence agencies. Worse, firms like Google and Microsoft specifically log data in order to assist the government. How many government requests does your ISP get for its customers' communications each year? How many do they comply with? How many do they fight? How much do they charge for the surveillance assistance they provide? Who knows? Most companies have a strict policy of not discussing such topics. The differences in the privacy practices of the major players in the telecommunications and internet applications market are significant. Some firms retain identifying data for years, while others retain no data at all; some voluntarily provide the government access to user data, while other companies refuse to voluntarily disclose data without a court order; some companies charge government agencies when they request user data, while others disclose it for free. For an individual, later investigated by the police or intelligence services, the data retention practices adopted by their phone company or email provider can significantly impact their freedom. Unfortunately, although many companies claim to care about end-user privacy, and some even that they compete on their privacy features, none seem to be willing to compete on the extent to which they assist or resist the government in its surveillance activities. Because information about each firms' practices is not publicly known, consumers cannot vote with their wallets, and pick service providers that best protect their privacy. This talk will pierce the veil of secrecy surrounding these practices. Based upon a combination of Freedom of Information Act requests, off the record conversations with industry lawyers, and investigative journalism, the practices of many of these firms will be revealed. ________________________________ Christopher's Personal Experience In the year 2006, the Federal Bureau of Investigation (FBI) raided Christopherbs home at 2.00 a.m. seizing his personal documents and computers. Two attorneys, Stephen Braga and Jennifer Granick came to his defence. With their expert assistance, Christopher was able to get back his possessions within three weeks, and FBIbs criminal and TSAbs civil investigations were closed without any charges being filed. Jennifer Granick came to Christopherbs assistance once again (joined by Steve Leckar) in 2010 after the Federal Trade Commissionbs Inspector General investigated Christopher for using his government badge to attend a closed-door surveillance industry conference. It was at that event that Christopher recorded an executive from wireless carrier bSprintb bragging about the eight million times his company had obtained GPS data on its customers for law enforcement agencies in the previous years. To know more, read Christopher Soghoianbs dissertation titled "The Spies We Trust: Third Party Service Providers and Law Enforcement Surveillance". [PDF, 1056 Kb] ________________________________ About Christopher Soghoian Christopher Soghoian is a privacy researcher and activist, working at the intersection of technology, law and policy. He is a Principal Technologist and Senior Policy Analyst at the American Civil Liberties Union and is based in Washington, D.C. Soghoian completed his Ph.D. at Indiana University in 2012, which focused on the role that third party service providers play in facilitating law enforcement surveillance of their customers. In order to gather data, he has made extensive use of the Freedom of Information Act, sued the Department of Justice pro se, and used several other investigative research methods. His research has appeared in publications including the Berkeley Technology Law Journal and been cited by several federal courts, including the Ninth Circuit Court of Appeals. Between the years, 2009-2010, he was the first ever in-house technologist at the Federal Trade Commission's Division of Privacy and Identity Protection, where he worked on investigations of Facebook, Twitter, MySpace and Netflix. Prior to joining the FTC, he co-created the Do Not Track privacy anti-tracking mechanism now adopted by all of the major web browsers. He is a TEDGlobal 2012 Fellow, was an Open Society Foundations Fellow between the years, 2011-2012, and was a Student Fellow at the Berkman Center for Internet & Society, Harvard University between 2008 and 2009. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[CHMINF-L] ANN: Publishing Scientific Papers with Potential Security Risks: Issues for Congress
by Mike Yared 06 Jul '18

06 Jul '18

Publishing Scientific Papers with Potential Security Risks: Issues for Congress, http://www.fas.org/sgp/crs/secrecy/R42606.pdf Mike Mike Yared mike_yared(a)yahoo.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0