- cypherpunks-legacy - lists.cpunks.org

The Online Medical Records Trap
by Lauren Weinstein 06 Jul '18

06 Jul '18

The Online Medical Records Trap http://lauren.vortex.com/archive/000306.html Greetings. Microsoft is rolling out their centralized medical records project ( http://www.nytimes.com/2007/10/04/technology/04nd-soft.html ) -- with the somewhat misleading name "HealthVault" -- and it's time for consumers to start paying attention to what's going on in this sector -- Google is working along similar lines as well. (Why do I call the HealthVault moniker misleading? Keep reading.) There is a vast market assumed for centralized recording of every aspect of your medical life, initially through free accounts where you would input the data yourself, but as quickly as possible the intention is to move toward having doctors, hospitals, pharmacies, and everyone else involved in your medical treatment entering the data directly. The federal government is also a big booster of the centralized medical data idea -- a fact that might be enough to give one pause in and of itself. The selling points for such projects seem obvious enough. Instant access to your medical data for emergencies or other purposes, ease of seeing test results and (in theory) correcting errors, and so on. All good stuff. But what's not obvious from the sales pitches are the downsides, and they could be serious indeed. The term HealthVault is misleading because we know by definition that such services will be anything but a vault when it comes to privacy. You can almost hear the conversations at Microsoft where they tried to come up with a name that gave the impression of security, Fort Knox, and impenetrability. And of course, Microsoft is making all the usual claims about encryption, safety, and the same promises we always hear about centralized data systems. But the big risk in centralized medical data -- arguably the most personal data about any of us -- isn't about whether the servers can be hacked or the communications eavesdropped (though these are real issues, to be sure). The most serious problem is that once medical data is in a centralized environment, there are essentially no limits to who can come along with a court order (or in the case of the government, as we know, secret orders or illegal demands that can't usually be resisted) for access to that data. Service providers typically have no choice but to comply. The only way to prevent this is for the data to be encrypted in such a way that even the service provider cannot access it without your permission, even with a court order staring them in the face. As far as I know, none of the systems currently in development or deployment take that approach to encryption -- but I'd love to have someone inform me that such techniques would be used. That would change the equation considerably. Who might want access to your medical data? Insurance companies obviously, and one might expect them to lobby hard for such access, in the name of "reducing fraud and insurance costs" of course. Many employers would also love to get access, to help weed out medically expensive employees and applicants. Perhaps more ominously, broad "fishing expeditions" by the government -- both for research, investigative, and other purposes -- become far easier when medical records are centralized. It's very difficult to abusively search or gather such data in a broad manner when it consists mainly of manila folders in cabinets at your doctors' offices. But once this data goes online centrally, it's one of those "bingo!" moments for those who would just love to pry into the medical histories of consumers and citizens. Frankly, if people want to use such centralized systems voluntarily I have no serious objection. However, my gut feeling is that most people signing up won't have a clue about the negative ramifications of these services -- certainly the services themselves won't be trumpeting such shortcomings and risks. And worse, over time it seems likely that the service providers -- possibly in conjunction with government agencies at various levels, will move to make such use a default condition (that is, it applies unless you opt-out), and ultimately pressure everyone toward a mandatory approach. There could be a useful role for such centralized medical records services, but only in an environment of laws and related broad privacy protections that simply don't exist now, and don't appear to be forthcoming anytime soon. In their absence, using centralized medical records services at this time, except in very special and limited circumstances, would appear to be unwise and is not recommended. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] The Online Medical Records Trap
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[liberationtech] A tool for encrypted laptops
by Tom Ritter 06 Jul '18

06 Jul '18

Hi all - at the risk of shilling, my company has released an Open Source tool called "You'll Never Take Me Alive". If your encrypted laptop has its screen locked, and is plugged into power or ethernet, the tool will hibernate your laptop if either of those plugs are removed. So if you run out for lunch, or leave it unattended (but plugged in) at starbucks, and someone grabs your laptop and runs, it'll hibernate to try to thwart memory attacks to retrieve the disk encryption key. Not foolproof, but something simple and easy. It the moment it only supports Bitlocker, but support for Truecrypt is coming[0]. If you have suggestions - add them to the github issues page. https://isecpartners.com/news-events/news/2013/march/yontma.aspx https://github.com/iSECPartners/yontma -tom [0] https://github.com/iSECPartners/yontma/issues/5 -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Cellphone carriers can listen in through your phone
by David Farber 06 Jul '18

06 Jul '18

From: Cellphones URL: http://cellphones.engadget.com/entry/1234000563053276/ Sent from: djf (dave(a)farber.net) Sent to: dave(a)farber.net Comments: Cellphone carriers can listen in through your phone?Aug 5, 2005, 10:20 AM ET by Ryan Block We?re always a little wary of that very blurry line between protection of the general public and infringements on basic civil liberties, but it would appear that according to the Financial Times by way of the Guardian, at least one UK cellphone carrier not only has the power (and mandate) to remotely install software over the air to users? handsets that would allow for the kind of monitoring we thought only perverts and paranoiacs had access to: picking up audio from the phone?s mic when the device isn?t on a call. While don?t think the backlash on this one has really gotten underway yet, and though we do hate to rock a clich?, we can?t help but be reminded of that classic Benjamin Franklin quote, ?They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.? What?s worse, a cellphone carrier and The Man are gonna take it from us without our permission on the sly? [Via textually] Related Links ? Page Title ? Permanent Link to this Entry + Send to a Friend + Reader Comments [2] ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: Tor on USB
by Paul Syverson 06 Jul '18

06 Jul '18

You might also see the following commercial distribution that bundles Tor, a tiny linux, and related software on a USB stick http://www.virtualprivacymachine.com/products.html Looks cool and got favorable reviews, but I haven't used or examined it first hand. This is a pointer, not an endorsement. -Paul On Tue, Aug 30, 2005 at 12:47:32AM -0500, Arrakis Tor wrote: > Interesting implementation. You could use it at a public terminal, a > friend's computer, or for plausible deniability on your own computer. > > On 8/29/05, Shatadal <shatadal(a)vfemail.net> wrote: > > Arrakis Tor wrote: > > > Can firefox be installed to run standalone whatsoever? > > > > > > > > > > Yep. Check out http://johnhaller.com/jh/mozilla/portable_firefox/ and > > http://portablefirefox.mozdev.org/ > > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: nym-0.2 released (fwd)
by Adam Langley 06 Jul '18

06 Jul '18

cyphrpunk: > Each link in this chain has to trust all the > others. ... any of these can destroy the security properties > of the system. Dude, we're not launching missiles here, it's just Wikipedia. On 10/2/05, Jason Holt <jason(a)lunkwill.org> wrote: > The reason I have separate token and cert servers is that I want to end up > with a client cert that can be used in unmodified browsers and servers. First, how do you add client certificates in modern browsers? Oh, actually I've just found it in Firefox, but what about IE/Opera/whatever else? Can you do it easily? The blinded signature is just a long bit string and it might well be better from a user's point of view for them to 'login' by pasting the base64 encoded blob into a box. Just a thought (motivated in no small part by my dislike for all things x509ish) > > privacy and is vulnerable to future exposure due to the lack of > > forward secrecy. The lack of forward secrecy is pretty fundamental in a reputation based system. The more you turn up the forward secrecy, the less effective any reputation system is going to be. And I'm also going to say well done to Jason for actually coding something. There do seem to be a lot couch-geeks on or-talk - just look at the S/N ratio on the recent wikipedia threads. It might not work, but it's *something*. No amount of talk is going to suddenly become a solution. AGL -- Adam Langley agl(a)imperialviolet.org http://www.imperialviolet.org (+44) (0)7906 332512 PGP: 9113 256A CC0F 71A6 4C84 5087 CDA5 52DF 2CB6 3D60 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Court Hears Internet Anonymity Case
by Gregory Hicks 06 Jul '18

06 Jul '18

Court Hears Internet Anonymity Case Nov 02 3:19 PM US/Eastern By ALEX DOMINGUEZ Associated Press Writer ANNAPOLIS, Md. The publisher of a financial newsletter told Maryland's second highest court Wednesday that he should not be forced to disclose his subscriber list and other information sought by an Arizona company seeking those it says made defamatory online comments. The publisher, Timothy M. Mulligan, told the judges "almost everything we publish could potentially be subpoenaed," putting him in the position of constantly appearing for depositions if his request to quash a subpoena by the Arizona drug company, Matrixx Initiatives, is denied. The judges, however, appeared to side with Matrixx, repeatedly asking why Mulligan should not appear for the deposition and invoke his right not to reveal his subscribers and sources under Maryland's so-called "Shield Law," which protects the rights of the press. "My sense is it didn't go well," Mulligan said after the hearing. "It's not clear yet, but it will probably be in litigation for years because I have no intention of giving up my sources or subscribers." After the hearing, Matrixx attorney David Tobin said "no one has the right to make defamatory comments. That is not protected speech." Internet postings have become the subject of a number of court battles, especially in cases where they have affected the stock prices of companies. Free speech advocates have also become involved and the issue has even entered the political arena in Maryland. Joseph F. Steffen Jr., a former aide to Republican Gov. Robert L. Ehrlich Jr., resigned last winter after it was revealed that he had posted rumors about Baltimore Mayor Martin O'Malley's personal life on Internet chat sites. O'Malley is seeking the Democratic nomination for governor and would face Ehrlich in the general election if he wins. Tobin told the court it was unclear whether Mulligan could invoke the shield law. "That's the white elephant in the room," the Matrixx attorney told the judges. Mulligan said appearing constantly for depositions could hamper his ability to make a living, especially since his newsletter reports on questionable accounting practices by companies. The judges later asked Tobin how many depositions Mulligan would have to sit through. "Hopefully, one," Tobin responded. In response to the first subpoena by Matrixx, Mulligan two years ago turned over nearly 400 pages of documents, which he said was mainly source material for his report. He has refused to comply with a second subpoena seeking, among other things, his subscriber list and any contacts with an anonymous poster to Internet messages boards known as "TheTruthseeker." However, Montgomery County Circuit Judge Eric M. Johnson denied Mulligan's request to quash the second subpoena and Mulligan appealed to the Court of Special Appeals. Matrixx claims the postings are part of a scheme to drive down the company's stock, benefiting traders who sell short, or borrow shares and repay them at a later time, hopefully when the price has dropped. The company filed a defamation lawsuit in Arizona in 2002, naming two dozen John and Jane Does as defendants. Matrixx has also been battling lawsuits claiming its Zicam Cold Remedy nasal gel causes permanent loss of smell and taste. Mulligan has said he doesn't know the anonymous posters and doesn't think he should answer further questions. He is fighting the subpoena with the help of the American Civil Liberties Union, the Electronic Privacy Information Center, Public Citizen and other advocacy groups Tobin, however, said the issue was merely one of discovery, the legal method of obtaining the facts in a dispute and not a precedent-setting First Amendment case. The company "simply wants to know what Mr. Mulligan might know" about the online postings, Tobin said. http://www.breitbart.com/news/2005/11/02/D8DKHUSG3.html ------------- End Forwarded Message ------------- ------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Court Hears Internet Anonymity Case
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [p2p-hackers] darknet ~= (blacknet, f2f net)
by Ian Clarke 06 Jul '18

06 Jul '18

On 29/11/05, zooko(a)zooko.com <zooko(a)zooko.com> wrote: > However, the media seems to have started using the word "Darknet" to mean a > friend-to-friend net and/or a blacknet [7, 8], thus simultaneously making it > harder for people to think about blacknets which are based on other than > friend-to-friend architectures and making it harder for people to think about > friend-to-friend networks which are used for other than illegal information > sharing. > > I place some of the blame for this development on the Freenet folks, who may be > the first to promulgate this munging, and if they aren't the first they're > certainly the most effective. As Michael Rogers pointed out, I am not sure this is as clear-cut as you suggest, the goal for Freenet 0.7 is very close to the idea outlined in the caption for Fig. 3 of the Microsoft Darknet paper, which is a friend-to-friend network. That paper may be the first common usage of the term "darknet", but so far as I can see, it contains no concise definition of what a "darknet" is. I would therefore say that there is no authorative basis on which to invalidate any particular definition of the term that is broadly within the area of P2P networks which conceal user activity. As such, defining the term "darknet" as a f2f network that is designed to conceal the activities of its participants (this being, so far as I have seen, one of the main motivations for building an f2f network), is as valid a definition as any other I have seen (and more useful than most). As a side-point, I think it is somewhat pejorative to say that any technology is "designed" for illegal usage, just because it conceals user activity and therefore may be capable of illegal usage. There are many legal reasons why people might wish to preserve their anonymity and privacy. Ian. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Government using call records to go after reporter's sources.
by Perry E. Metzger 06 Jul '18

06 Jul '18

One of ABC News' reporters says that he's been warned that call records, possibly even the ones that the major telecom companies are now routinely turning over to the NSA, are being used to track down the sources for reporters at several major news services. http://blogs.abcnews.com/theblotter/2006/05/federal_source_.html I realize many people might disagree with me, but from my point of view, the use of such heavy-handed counterintelligence tactics against the press is a substantial threat to freedom in this country. John Gilmore long ago warned us that once we'd built the total surveillance state, all that would be needed to build a new totalitarianism would be a change of attitude on the part of the governors. Well, we've built CALEA into everything, and we've built computerized systems for siphoning all call data in existence, and now we have an administration with, to say the least, a serious change in attitude about the law and morality. We have crossed a rubicon. It can be argued by some who do not agree with me that the reporters in question are somehow "helping the terrorists" by revealing things like the fact that the US Government has SigInt operations, but in fact anyone who isn't an idiot already knows we have SigInt operations. What the reporters have done -- heroically, I might add -- is reveal that the government has far exceeded the bounds of legality in performing such operations, even when legal methods existed to gain the same information. Some may call said reporters traitors, but it has become increasingly clear to me that the real traitors are those who do not respect the principles this country was founded on and who would sell our hard won freedom and mortgage the rule of law, not for security but for political gain. The surveillance against reporters is being used not to save lives but to save the administration political embarrassment, and there will be no end to the political uses of surveyance if it is not stopped now. I implore everyone who agrees with me not to be silent. If you do not call your representatives to complain about this, it will eventually be too late to complain. Tell them you want hearings with teeth, tell them that you want a special prosecutor, tell them that you do not want to see them rubber stamp universal surveillance with legal fig leaves, and that you will work to see someone else elected, no matter how much you like them otherwise, if they refuse to do anything about this issue. Tell your friends and family to make those calls as well. I do not know that screaming loudly about this will work, but I know what silence will bring. Perry ----- End forwarded message ----- _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0