- cypherpunks-legacy - lists.cpunks.org

[IP] Re: Attack on CS research by Chronicle for Higher Edu cation
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[silk] India's Electronic Voting Machines Have Security Problems
by Biju Chacko 06 Jul '18

06 Jul '18

http://www.freedom-to-tinker.com/blog/felten/indias-electronic-voting-machi… A team led by Hari Prasad, Alex Halderman, and Rop Gonggrijp released today a technical paper detailing serious security problems with the electronic voting machines (EVMs) used in India. The independent Electoral Commission of India, which is generally well respected, has dealt poorly with previous questions about EVM security. The chair of the Electoral Commission has called the machines "infallible" and "perfect" and has rejected any suggestion that security improvements are even possible. I hope the new study will cause the EC to take a more realistic approach to EVM security. The researchers got their hands on a real Indian EVM which they were able to examine and analyze. They were unable to extract the software running in the machine (because that would have required rendering the machine unusable for elections, which they had agreed not to do) so their analysis focused on the hardware. They were able to identify several attacks that manipulated the hardware, either by replacing components or by clamping something on to a chip on the motherboard to modify votes. They implemented demonstration attacks, actually building proof-of-concept substitute hardware and vote-manipulation devices. Perhaps the most interesting aspect of India's EVMs is how simple they are. Simplicity is a virtue in security as in engineering generally, and researchers (including me) who have studied US voting machines have advocated simplifying their design. India's EVMs show that while simplicity is good, it's not enough. Unless there is some way to audit or verify the votes, even a simple system is subject to manipulation. If you're interested in the details, please read the team's paper. The ball is now in the Election Commission's court. Let's hope that they take steps to address the EVM problems, to give the citizens of the world's largest democracy the transparent and accurate elections they deserve. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

EDRI-gram newsletter - Number 6.1, 16 January 2008
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 6.1, 16 January 2008 ============================================================ Contents ============================================================ 1. German data retention act challenged 2. EC public consultation of Creative Content Online 3. European Data Protection Supervisor's opinion on RFID 4. UK MPs want tough data protection 5. PI: Leading surveillance societies in the EU and the World 2007 6. Inclusive E-government in Western Balkans 7. UK Government continues to pressure ISPs for Internet filtering 8. ELOI - a French database to manage the expulsion of illegal migrants 9. European Commission closes enquiry on Apple 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. German data retention act challenged ============================================================ Just five days after the German President Horst Kvhler approved the German data retention law that entered into force on 1 January 2008, the German Working group on data retention (Arbeitskreis Vorratsdatenspeicherung) challenged the law in the Federal German Constitutional Court. The complaint was filed with the Court on 31 December 2007 and, for the first time in the German history, it was backed by 30 000 complainants. The 150-page notice of appeal requested an immediate suspension of the law on the grounds of "apparent unconstitutionality". The Working Group explains that the appeal is substantiated by the fear that general data retention might severely disrupt free communication in Germany by treating each and every citizen as a potential delinquent. "According to the complaint, the pervasive logging of communication patterns without reasonable suspicion resembled a serious encroachment upon the basic values of constitutional legality. On the other hand, it would compromise the working basis of professionals such as journalists and criminal prosecutors as well as that of charitable services like crisis lines - all of which relied greatly on the anonymity of both whistle-blowers and people in need. In the future, sensitive contacts and communication would either have to be conducted in person and face-to-face or would have to be abandoned altogether." The Group is also publishing guidelines and recommendations for safeguarding individuals against the obligatory logging of all telecommunications effective as of 2008. The constitutional action was backed by protests in several cities in Germany on 31 December 2007 against the new data retention legislation. In Hamburg the critics held a mock funeral for "the death of privacy." Some of the German ISPs that need to comply with the law by 2009, are also relying of the constitutional challenge to succeed. Frank Simon, managing director of Oldburg-based Ecce Terram explained to Heise: "I reckon the Federal Constitutional Court will overturn the law this year or ask the criminal prosecution authority to suspend it because the music and film industries will overload them with so many complaints that the hunt for terrorists and child pornographers will be seriously hampered." Constitutional complaint filed against German Telecomms Data Retention Act (31.12.2007) http://www.vorratsdatenspeicherung.de/content/view/184/79/lang,en/ In German http://www.vorratsdatenspeicherung.de/content/blogcategory/27/79/lang,de/ Germans File Mass Lawsuit Against Sweeping Data Retention Law (31.12.2007) http://www.dw-world.de/dw/article/0,2144,3025009,00.html Data retention: ISPs rely on constitutional appeals and exception rules (10.01.2008) http://www.heise.de/english/newsticker/news/101624/ EDRi-gram: German Parliament adopted the data retention law (21.11.2007) http://www.edri.org/edrigram/number5.22/german-retention-law EDRi-gram: Largest anti-surveillance street protest in Germany for 20 years (26.09.2007) http://www.edri.org/edrigram/number5.18/liberty-instead-of-fear ============================================================ 2. EC public consultation of Creative Content Online ============================================================ On 3 January 2008, the European Commission (EC) launched a public consultation for the preparation of a recommendation on Creative Content Online to be adopted by the European Parliament and Council that calls for a common legal environment for online content, proposing multi-territory licences. In the opinion of the European Commission, EU policies should support the rapid implementation of "new services and related business models for the creation and circulation of European content and knowledge online." As a result of the public consultation on "Content Online in the Single Market" launched by the EC in July 2006, there were several calls for the encouragement of the cooperation between industry, right holders and consumers on issues such as DRMs or Content Online as well as for financial support and promotion of DRMs interoperability standards. An independent study "Interactive Content and Convergence" that followed the consultation in 2006 gave an overview of the issues to be addressed for the development of new content services in the EU. Based on the results of the consultation and of the study, the Commission proposes in the newly launched consultation four main horizontal directions of action at EU-level: availability of creative content; multi-territory licensing for creative content; interoperability and transparency of DRMs; and legal offers and piracy. Some concerns have been expressed by digital media rights activists such as the EDRI-member Open Rights Group (ORG) who believe that the EC plan goes beyond copyright, and that consumer rights could be affected by it. "Looking at some of the details of the European Commission consultation document it seems to be that they are proposing a lot more than just a cross Europe licensing scheme. (...) There is stuff here about transparency and interoperability in digital rights management systems, there is stuff about codes of conduct between internet service providers and rights holders to encourage legal access and discourage unauthorised file sharing." stated Becky Hogg, executive director of ORG. However, the EC opinion is that all the different national copyright laws and other intellectual property rights are holding back the film, music and game industries. "Europe's content sector is suffering under its regulatory fragmentation, under its lack of clear, consumer-friendly rules for accessing copyright-protected online content, and serious disagreements between stakeholders about fundamental issues such as levies and private copying," was the EU Commissioner for the Information Society and Media,Viviane Reding's statement. DRM seems to fade out, after Sony BMG announced at the beginning of 2008 that it plans to give up to DRM for its music, thus becoming the last of the top four music labels to throw the towel on this subject. But the EC consultation paper wants to put it back in business, planning "a framework for DRM transparency concerning, amongst others, the interoperability of different DRMs, and ensuring that consumers are properly informed of any usage restrictions placed on downloaded content, as well as of the interoperability of related online services." The consultation closes on 29 February 2008 following which, by the middle of 2008, Reding will make formal recommendations on new ways to achieve a single online content market for 500 million potential consumers, predicted to be worth 8.3 billion euros by 2010 by the study on "Interactive content and convergence" commissioned by Information Society and Media Directorate-General of the European Commission and published on 25 January 2007. Commission consultation: the need for pan-European copyright licences (9.01.2008) http://www.out-law.com/page-8784 Single European market plan for creative online content (4.01.2008) http://informitv.com/articles/2008/01/04/singleeuropeanmarket/ Communication from the Commission on Creative Content Online in the Single Market (3.01.2008) http://ec.europa.eu/avpolicy/docs/other_actions/col_en.pdf Commission adopts strategy for "Creative Content Online" (3.01.2008) http://ec.europa.eu/avpolicy/other_actions/content_online/index_en.htm Sony BMG Plans to Drop DRM (4.01.2008) http://www.businessweek.com/technology/content/jan2008/tc2008013_398775.htm EDRi-gram: Creative content online - main topic in new EC documents (19.12.2007) http://www.edri.org/edrigram/number5.24/creative-content ============================================================ 3. European Data Protection Supervisor's opinion on RFID ============================================================ In the context of increasing debates in the European Union over the RFID policy, Peter Hustinx, the European Data Protection Supevisor (EDPS), published on 20 December 2007 his opinion on the growing use of RFID chips in consumer products and other new applications affecting individuals. EDPS published this opinion as a response to the European Commission's communication on Radio Frequency Identification (RFID) in Europe that was released in March 2007, but taking into consideration other actions, such as the creation by the EC of the RFID expert group, where EDRi is a member. Peter Hustinx, explained the role of RFID and its relation with the privacy issues: "RFID systems could play a key role in the development of the European Information Society but the wide acceptance of RFID technologies should be facilitated by the benefits of consistent data protection safeguards. Self-regulation alone may not be enough to meet the challenge. Legal instruments may therefore be required to guarantee that the technical solutions to minimise the risks for data protection and privacy are in place." EDPS confirms that the wide use of RFID-technology is fundamentally new and may have a fundamental impact on our society and on the protection of fundamental rights in our society, such as privacy and data protection. He underlined the basic five privacy and security issues that can be distinguished in this respect: the identification of the data subject, the identification of the data controller, the decrease meaning of the traditional distinction between the personal and the public sphere, the consequences of the size and physical properties of RFID-tags and the lack of transparency of the processing. The Opinion has highlighted several direct recommendations to the Commission including the provision of a clear guidance on how to apply the current legal framework to the RFID environment and the identification of "Best Available Techniques" which will play a decisive role in the early adoption of the privacy-by-design principle. EDPS also tackled the issue of a specific legislation for the main issues of RFID-usage in relevant sectors and considered that such legislation would be needed if the proper implementation of the existing legal framework failed. Such a legislation "must be considered as a 'lex specialis' vis-a-vis the general data protection framework. This legislative measure should also address the privacy and data protection concerns that arise in certain RFID applications, such as item level tagging before the point of sale, which may not necessarily involve the processing of personal data." In any event, EDPS emphasised the need to lay down "the opt-in principle at the point of sale as a precise and undeniable legal obligation, also for RFID applications that fall outside of the scope of the Data protection Directive and to ensure the mandatory deployment of RFID applications with the appropriate technical features or 'privacy by design'." EDPS opinion on the communication from the Commission on Radio Frequency Identification in Europe: steps towards a policy framework (20.12.2007) http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consu… EDPS Opinion on RFID: major opportunities for Information Society but privacy issues need to be addressed with more ambition (20.12.2007) http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/… EDRi-gram: RFID Expert Group - Kick Off (6.06.2007) http://www.edri.org/edrigram/number5.11/rfid-workgroup EDRi-gram: RFID and Informed Consent - Using and removing of RFID functionality (5.12.2007) http://www.edri.org/edrigram/number5.23/rfid-informed-consent ============================================================ 4. New data protection rules asked by UK MPs ============================================================ The Justice Committee of the UK House of Commons issued on 3 January 2008 a report on public data protection summarising the status and development of the topic, especially since the November 2007 Chancellor's announcement to the Parliament related to the loss of confidential data records of 25 million people by HM Revenue and Customs. The report that recommends a data breach notification law, criminal penalties for data controllers that are found responsible for breaching security, greater powers and financing for the Information Commissioner's Office, follows the line of the recommendations made by the House of Lords Science and Technology Committee in August 2007 that were rejected at that time by the government. The present report emphasises the risk involved by large databases that are accessible by many licensed users, making particular reference to ContactPoint, the children's database that will come into being this year and the National Identity Register, also planned to be gathered in 2008. It also draws the attention on the risk related to the obligation to share data with the other EU member states. "If data held by the Government is available for inspection outside the jurisdiction, then the importance of restricting the amount of data held, as well as proper policing of who had access to it, takes on even greater importance." reads the report. The report recommends that personal data should be held only where there are proper safeguards for the protection of the respective data, which, in the Justice Committee's opinion will become ever more difficult as data can be easily shared within the country as well as between countries. A greater role in the data protection should be played by the Information Commissioner who should receive adequate support in this sense. "We note that he already considers that his resources are at a minimum" is the report statement. It also calls for a legal obligation to notify the Commissioner as well as the affected parties on significant data losses and for penalties for those who disclose personal data. A Ministry of Justice spokeswoman said: "Parliament is currently considering proposals to amend section 60 of the Data Protection Act through the Criminal Justice and Immigration Bill (...) This will provide a custodial sanction as well as the existing fines for those found guilty of unlawfully obtaining or disclosing personal data." MPs call for tougher data protection regime (3.01.2008) http://www.openrightsgroup.org/2008/01/03/mps-call-for-tougher-data-protect… House of Commons Justice - First Report (3.01.2008) http://www.publications.parliament.uk/pa/cm200708/cmselect/cmjust/154/15402… HMRC loses confidential details of 5 million benefit recipients (20.11.2007) http://www.openrightsgroup.org/2007/11/20/hmrc-loses-confidential-details-o… Government ignores Personal Internet Security (29.10.2007) http://www.lightbluetouchpaper.org/2007/10/29/government-ignores-personal-i… Tougher data laws needed, say MPs (3.01.2008) http://news.bbc.co.uk/1/hi/uk_politics/7168588.stm EDRi-gram: UK government loses personal data on 25 million citizens (1.11.2007) http://www.edri.org/edrigram/number5.22/personal-data-lost-uk ============================================================ 5. PI: Leading surveillance societies in the EU and the World 2007 ============================================================ UK-based human rights group Privacy International (PI) published at the end of last year the 2007 ranking assessment of the state of privacy in 47 countries, including all European Union member states. The raking is based on the Privacy & Human Rights reports produced since 1997 by PI together with US-based Electronic Privacy Information Center and is taking into consideration several criteria such as constitutional & statutory protection and privacy enforcement, biometric ID cards, data-sharing, video surveillance, communication interceptions and data retention. According to the authors, the project wants to "recognize countries in which privacy protection and respect for privacy is nurtured. This is done in the hope that others can learn from their example" but also "to identify countries in which governments and privacy regulators have failed to create a healthy privacy environment. The aim is not to humiliate the worst ranking nations, but to demonstrate that it is possible to maintain a healthy respect for privacy within a secure and fully functional democracy." The main findings of the study that includes a world map of the surveillance societies, show an overall worsening of privacy protection across the world, reflecting an increase in surveillance and a declining performance of privacy safeguards. The rankings for 2007 prove a disturbing and increasing trend amongst governments to archive data on the geographic, communications and financial records of all their citizens and residents. This trend leads to the conclusion that all citizens, regardless of their legal status, are under suspicion. The privacy trends have been fueled by the emergence of a profitable surveillance industry dominated by global IT companies and the creation of numerous international treaties that frequently operate outside judicial or democratic processes. PI also claims that "surveillance initiatives initiated by Brussels have caused a substantial decline in privacy across Europe, eroding protections even in those countries that have shown a traditionally high regard for privacy." The general trend is the failure of the privacy performance for older democracies in Europe, while the performance of newer democracies is becoming generally stronger. It is worth noting also that the worst ranking EU country is the United Kingdom, which again fell into the "black" category along with Russia and Singapore. However for the first time Scotland has been given its own ranking score and performed significantly better than England & Wales. The 2006 leader, Germany, slipped significantly in the 2007 rankings, dropping from 1st to 7th place behind Portugal and Slovenia. Leading surveillance societies in the EU and the World 2007 (28.12.2007) http://www.privacyinternational.org/article.shtml?cmd[347]=x-347-559597 Global Privacy Index Criticizes Falling Standards in Germany (7.01.2008) http://www.dw-world.de/dw/article/0,2144,3036544,00.html ============================================================ 6. Inclusive E-government in Western Balkans ============================================================ Most of the participants in the workshops on inclusive e-government that took place in the capitals of six Western Balkan countries, considered that their countries have established very few mechanisms for e-inclusion and interoperability, even though the interest in e-Government development is high. The workshops took place within the framework of the project "Western Balkans Network for Inclusive e-Government" and were meant to present the draft research on the levels of sophistication and inclusiveness of e-gov services conducted by project partners using the EU-level Capgemini methodology, with a goal to develop Regional eGovernment Roadmap to facilitate joint efforts by the countries aspiring to soon join the EU. The six workshops on inclusive e-government were organized by national project partners, and had as targets the review of draft research results, awareness raising and networking between stakeholders including government officials, IT and human rights experts, as well as representatives of NGOs dealing with issues of inclusion of disadvantaged groups such as people with disabilities from both the host countries and the neighborhood. Each workshop was organized by project partners from the respective countries, and they took place in: a. Skopje, Macedonia (23 November 2007) - organized by EDRi-member Metamorphosis Foundation b. Tirana, Albania (26 November 2007) - organized by Comport c. Belgrade, Serbia (11 December 2007) - organized by Belgrade Open School d. Zagreb, Croatia (13 December 2007) - organized by ZaMirNet e. Sarajevo, Bosnia and Herzegovina (13 December 2007) - organized by OneWorld SEE f. Podgorica, Montenegro (20 December 2007) - organized by the Institute for Strategic Studies and Projections The level of online sophistication of e-government services in all countries where research has been completed so far are similar (Albania 33%, Serbia 40%, Montenegro 45%, Macedonia 50%, Croatia 57%) and most of them need to develop under similar circumstances and face similar obstacles, lagging 5-7 years behind the levels of EU. The potential benefit from mutual cooperation is great, both to the states-which have so far mostly invested in revenue-generating services such as e-taxes-and their citizens who need more efficient and transparent governance. The "Western Balkans Network for Inclusive e-Government" project is supported by the East East: Partnership Beyond Borders Program of the Open Society Institute and led by the Metamorphosis Foundation. Alongside the workshops, the project activities included the Third International Conference e-Society.Mk (29-30 November 2007 in Skopje) which facilitated exchange of know-how and experiences both between stakeholders from the region and from the European Union. Project website http://www.e-society.org.mk (Contribution by Filip Stojanovski, EDRI-member Metamorphosis - Macedonia ) ============================================================ 7. UK Government continues to pressure ISPs for Internet filtering ============================================================ On 8 January 2008, at the launching of the government consultation on new copyright exceptions, Lord Triesman, the UK minister for intellectual property, threatened the ISPs with the introduction of new legislation to force them to block illegal filesharing in case they cannot find a voluntary agreement together with the music and film industries by the end of summer. Referring to the Government's attitude towards illegal filesharing, Triesman said "We're not prepared to see the kinds of damage that will be done to the creative economy," and regarding the ISPs he added in an interview for The Register "There is no objective reason why they (rights holders and ISPs) cannot arrive at an agreement. Whether they have the will to do so is another matter." According to a spokesman for ISPA, the Internet providers' trade association, some "good meetings" have taken place between the association and film rights owners, but he did not give any specific details on the results. Triesman also declared that the UK government was collaborating with the French Government on the anti-infringement legislation that proposes the creation of an enforcement body to which the French ISPs will hand over filesharing data. "The French are plainly very serious about this, it's really interesting. We will actually do quite a lot of work alongside them - not necessarily to reach exactly the same objective, but I think we've got a desire to share evidence and analyses. There's no point repeating each other's research." said the minister. The consultation launched on 8 January introduced five recommendations proposing a relaxing copyright enforcement for research and education purposes, to enable distance learning and whiteboard tuition, to allow libraries to make a copy for archive purposes where the copyright holder can't be found and to allow an exemption for the purposes of "caricature, parody or pastiche". The UK Government also proposes a "format shifting right" meaning that the consumers should be allowed to make copies of copyright material they've already bought, but puts a limit to DRM circumvention which should be permitted only for academic and research purposes, but not for the general public for entertainment. Among other comments during the launching, a member of the International Music Managers Forum emphasised the fact that DRM on music is almost dead and is hated by consumers. The first stage of the consultation is open until 8 April 2008. Government piles filesharing pressure on UK ISPs (8.01.2008) http://www.theregister.co.uk/2008/01/08/triesman_isps_legislation_timetable/ Consultation on proposed changes to copyright exceptions launched (8.01.2008) http://www.openrightsgroup.org/2008/01/08/consultation-on-proposed-changes-… CD copying OK, DRM circumvention not OK (8.01.2008) http://www.theregister.co.uk/2008/01/08/copyright_reform/ EDRi-gram: Filtering the Internet - new request of music and film industry (19.12.2007) http://www.edri.org/edrigram/number5.24/internet-filtering-music ============================================================ 8. ELOI - a French database to manage the expulsion of illegal migrants ============================================================ On 26 December 2007, the French government published a decree creating the ELOI file, a database aimed at facilitating the expulsion of illegal migrants. In March 2007, the French highest administrative court cancelled a first attempt by the government to create this file, after 4 French NGOs, among which EDRI member IRIS, filed a case against the Interior ministry. While the March text was cancelled by the Conseil d'Etat for procedural reasons only, the new version shows some important progress related to concerns raised by the NGOS. The main changes are that no data will be kept on visitors of illegal migrants in retention centres, and that personal data of citizens with which illegal immigrants are staying, when not in retention centres are kept for 3 months rather than 3 years. While this step backwards from the government side is a direct result of the French NGOs action, the ELOI database remains unacceptable, according to the authors of the former complaint, with regards to the migrants themselves and their families. The duration of the retention of their data remains 3 years for most of the data, and data on their children are still kept in the ELOI file. Last but not least, the database still contains data on "the need for specific surveillance (of the migrant) with regards to the public order'. According to the NGOs, this demonstrates that the government makes a direct association between immigration and criminality. Moreover, the decree contains new provisions, adding to the ELOI database an impressive amount of administrative and judicial data dealing with all aspects of the expulsion process, most of them to be retained for 3 years. In addition, a new purpose has been set to this file, which is to produce statistics on expulsion decisions and their actual executions. These problems, as well as the Sarkozy administration setting up quantitative objectives - a minimum of 25000 expulsions targeted in 2008 - have made the French NGOs declare that the actual meaning of this file is the government willingness to manage the expulsion of migrants at an unprecedented level. They consider that with the ELOI database, this expulsion policy has reached an industrial level. Decree n. 2007-1890 creating the ELOI database (only in French, 26.12.2007) http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=IMID0759221D CNIL's (French DPA) opinion on the draft decree (only in French, 24.05.2007) http://www.legifrance.gouv.fr/WAspad/UnTexteDeJorf?numjo=CNIX0703389X French NGOs (CIMADE, GISTI, IRIS, LDH) joint press release (only in French, 03.01.2008) http://www.iris.sgdg.org/info-debat/comm-eloi0108.html IRIS dossier on foreigners and databases in France (only in French) http://www.iris.sgdg.org/actions/fichiers/index.html EDRI-gram: French high court cancels the creation of illegal migrants database (14.03.2007) http://www.edri.org/edrigram/number5.5/france-cancels-database (Contribution by Meryem Marzouki, EDRI member IRIS - France) ============================================================ 9. European Commission closes enquiry on Apple ============================================================ The European Commission (EC) has closed the enquiry against Apple for charging more UK users than other EU users for downloads of its iTunes music, following the company announcement on 9 January 2008 that it will reduce download prices for UK within 6 months to align them with prices in continental Europe. A formal investigation had been opened by the EC against Apple after 'Which?', a UK consumer protection organisation, filed a complaint in September 2004 against the company who was applying 20% higher prices to British users than for the other European users. The difference has decreased in time reaching down to 6% and, following discussions between Competition Commissioner Neelie Kroes and Apple chief executive Steve Jobs, the company decided to equalise the prices within a 6-month period. "The Commission is very much in favour of solutions which allow consumers to benefit from a truly Single Market for music downloads." was the Competition Commissioner Neelie Kroes's statement. "This is an important step towards a pan-European marketplace for music," said Steve Jobs, Apple's CEO adding: "We hope every major record label will take a pan-European view of pricing". The issue that remains under discussion is that of the geographical restriction; Apple does not allow purchases on iTunes digital stores from a different country than the residence one. A user from France for instance cannot buy from the German iTunes and Apple verifies the user's residence by means of the credit card during the transaction. Apple states that this policy is due to the different music copyright laws and rules of the European countries. The EC agrees with this position stating that the contracts between Apple and the major record companies are not in breach of the current EU legislation. "..the fact that the same content is not available on a pan-European basis is not the result of restrictive business practices between Apple and major record companies. Rather it is the result of the existing state of copyright legislation (...) Some record companies choose not to make available their content on a pan-European basis. They do so in full respect of copyright regulation. There is no violation of antitrust regulation" stated Kroes' spokesman Jonathan Todd, at the daily Commission briefing on 8 January 2008. Unfortunately, the European Commission did not consider the other Apple-related topics revealed by the consumers association in EU: its dominant position in the EU online music market, its DRM-related practises or its lock down problems. But some of these aspects are still under investigation in several European countries by the national Consumer Ombudsman. European Commission welcomes Apple's announcement to equalise prices for music downloads from iTunes in Europe (9.01.2008) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/08/22&format=HTM… EU pressure ends iTunes price unbalance (10.01.2008) http://www.euractiv.com/en/infosociety/eu-pressure-ends-itunes-price-unbala… Apple to Standardize iTunes Music Prices Throughout Europe (9.01.2008) http://www.apple.com/pr/library/2008/01/09itunes.html iTunes announcement is music to Which?'s ears (9.01.2008) https://www.which.co.uk/press/press_topics/campaign_news/other_issues/itune… EDRi-gram: European Commission investigates Apple's European prices (26.09.2007) http://www.edri.org/edrigram/number5.18/ec-apple-prices EDRi-gram: iTunes under continuous attack in Europe (21.01.2007) http://www.edri.org/edrigram/number5.2/itunes ============================================================ 10. Recommended Reading ============================================================ FLOSSMETRICS/OpenTTT guide presents a set of guidelines and suggestions for the adoption of open source software within SMEs, using a ladder model that will guide companies from the initial selection and adoption of FLOSS within the IT infrastructure up to the creation of suitable business models based on open source software. http://guide.conecta.it/ ============================================================ 11. Agenda ============================================================ 17 January 2008, London, UK Nanotechnology for security and the crime prevention III http://www.nano.org.uk/events/ionevents.htm#security 18 January 2008, Torino, Italy COMMUNIA Workshop - Technology and the public domain http://ws1-2008.communia-project.eu 22 January 2008, London, UK Gov 2.0, or Truly Transformative Government http://www.oii.ox.ac.uk/events/details.cfm?id=169 12 February 2008, Brussels, Belgium European ICT standardisation policy at a crossroad: A new direction for global success http://ec.europa.eu/enterprise/ict/policy/standards/cf2008_en.htm 23-24 February 2008, Brussels, Belgium Research Room @ FOSDEM: Libre software communities meet research community - Introducing Research Friendly http://libresoft.es/Activities/Research_activities/fosdem2008 10-12 March 2008, Geneva, Switzerland WIPO Standing Committee on Copyright and Related Rights: Sixteenth Session http://www.wipo.int/meetings/en/details.jsp?meeting_id=14502 15 March 2008, London, UK OKCon 2008 - Open Knowledge: Applications, Tools and Services http://www.okfn.org/okcon/ 2-4 April 2008, Berlin, Germany re:publica - The Critical Mass http://www.re-publica.de 28-29 April 2008, Vienna, Austria PRISE Final Conference -Towards privacy enhancing security technologies - the next steps Call for papers until 1 February 2008 http://www.prise.oeaw.ac.at/conference.htm 30-31 May 2008, Bucharest, Romania eLiberatica 2008 - The benefits of Open and Free Technologies http://www.eliberatica.ro/2008/ 17-18 June 2008, Seoul, Korea The Future of the Internet Economy - OECD Ministerial Meeting http://www.oecd.org/FutureInternet 23-25 July 2008, Leuven, Belgium The 8th Privacy Enhancing Technologies Symposium (PETS 2008) http://petsymposium.org/2008/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 28 members based or with offices in 17 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[silk] India's Electronic Voting Machines Have Security Problems
by Biju Chacko 06 Jul '18

06 Jul '18

http://www.freedom-to-tinker.com/blog/felten/indias-electronic-voting-machi… A team led by Hari Prasad, Alex Halderman, and Rop Gonggrijp released today a technical paper detailing serious security problems with the electronic voting machines (EVMs) used in India. The independent Electoral Commission of India, which is generally well respected, has dealt poorly with previous questions about EVM security. The chair of the Electoral Commission has called the machines "infallible" and "perfect" and has rejected any suggestion that security improvements are even possible. I hope the new study will cause the EC to take a more realistic approach to EVM security. The researchers got their hands on a real Indian EVM which they were able to examine and analyze. They were unable to extract the software running in the machine (because that would have required rendering the machine unusable for elections, which they had agreed not to do) so their analysis focused on the hardware. They were able to identify several attacks that manipulated the hardware, either by replacing components or by clamping something on to a chip on the motherboard to modify votes. They implemented demonstration attacks, actually building proof-of-concept substitute hardware and vote-manipulation devices. Perhaps the most interesting aspect of India's EVMs is how simple they are. Simplicity is a virtue in security as in engineering generally, and researchers (including me) who have studied US voting machines have advocated simplifying their design. India's EVMs show that while simplicity is good, it's not enough. Unless there is some way to audit or verify the votes, even a simple system is subject to manipulation. If you're interested in the details, please read the team's paper. The ball is now in the Election Commission's court. Let's hope that they take steps to address the EVM problems, to give the citizens of the world's largest democracy the transparent and accurate elections they deserve. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

<nettime> [Fwd] A Spit in the Ocean
by Jaromil 06 Jul '18

06 Jul '18

...ripples... ----- Forwarded message from hellekin -----

1 0

None
by Jeremy Epstein 06 Jul '18

06 Jul '18

Neumann (neumann(a)csl.sri.com)" <neumann(a)csl.sri.com>, "Edward W. Felten" <felten(a)CS.Princeton.EDU>, "Gene Spafford (spaf(a)cerias.purdue.edu)" <spaf(a)cerias.purdue.edu> Subject: RE: [IP] Re: Attack on CS research by Chronicle for Higher Edu cation I'm certainly in agreement with Dr. Mercuri et al that this is a lousy story. But what bothers me more as a security professional isn't an undergraduate student calling Dr. Felten names, or Dr. Wilson's concern about the "weird arrangement" between Kennesaw State and the State of Georgia, but rather the modest level of skill exhibited by the team at Kennesaw State. As a member of a Virginia legislative commission, I had the opportunity to question Dr. Brit Williams (the founder of the group at Kennesaw) about his group's processes in approving voting machines. Not only do they make no effort at penetration testing, but according to Dr. Williams' testimony, they have no idea how to do such a test! In other words, they had no ability to even look for the sort of attack that Dr. Felten's team so beautifully demonstrated. For an organization that purports to do approvals of software-based voting machines, the lack of this skill is pretty appalling. Also not noted in the article, but critically important is that the Dr. Williams (and, I presume the Kennesaw State team) are responsible not only for reviewing voting machines for Georgia, but also Maryland and Virginia, and perhaps other states that I don't know about. If there's going to be such a concentration of influence in equipment approval, one would hope for a higher degree of competence and professionalism than is displayed in the article. And if the Chronicle is going to publish such an article, I'd think they'd make an effort to truly "see both sides". --Jeremy ------------------------------------------- ----------------------------------------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: Archives: http://archives.listbox.com/247/ Modify Your Subscription: http://v2.listbox.com/member/?member_id=125019&user_secret=59fc1126 Unsubscribe: http://v2.listbox.com/unsubscribe/?id=125019-59fc1126-jnmsh2hs Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Re: Attack on CS research by Chronicle for Higher Edu cation
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

<nettime> [Fwd] A Spit in the Ocean
by Jaromil 06 Jul '18

06 Jul '18

...ripples... ----- Forwarded message from hellekin -----

1 0

Certicom Earns FIPS 140-2 Validation on Palm OS
by R. A. Hettinga 06 Jul '18

06 Jul '18

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=SVBIZINK3.story&STORY=/ww…> Nov. 12, 2003 Silicon Valley Biz Ink :: The voice of the valley economy Certicom Earns FIPS 140-2 Validation on Palm OS < back Security Builder GSE enables developers to quickly add a FIPS 140-2 validated cryptographic module to their government solutions MISSISSAUGA, ON, Nov. 12 /PRNewswire-FirstCall/ - Certicom Corp. (TSX: CIC), a leading provider of wireless security solutions, today announced that Security Builder(R) GSE(TM), Certicom's core developer toolkit for government, has earned the Federal Information Processing Standards (FIPS) 140-2 certification for the Palm OS 4.1 platform (certificate No. 351). This makes Security Builder GSE the first developer toolkit to provide a FIPS 140-2 validated module for multiple handheld operating systems. In June, Certicom announced FIPS 140-2 validation on Microsoft Windows and Microsoft Windows CE operating systems. By supporting multiple platforms, Security Builder GSE allows system integrators and original equipment manufacturers to use a common API to quickly and easily embed FIPS validated security into their devices and applications. Security Builder GSE is the core cryptographic module for all Certicom security applications which means movianVPN(TM) GSE for Palm and movianCrypt(TM) GSE for Palm also meet government security requirements. These products are particularly important to government agencies that need to securely extend their networks to wireless handhelds but are required to use only FIPS 140-2 validated applications. FIPS is considered a benchmark for security within U.S. and Canadian government departments and agencies and is becoming a de facto standard internationally. Products must undergo rigorous testing by an accredited independent lab to satisfy the governments' standards. FIPS 140-2 is awarded through the National Institute of Standards and Testing (NIST) and the Canadian Communication Security Establishment (CSE). "We're extremely pleased Certicom has received FIPS 140-2 validation on the Palm platform. This will now make it easier for government workers to better integrate their Palm-powered handhelds into their secure networks," said John Inkley, director of federal sales for palmOne. "Mobile workers want more than just secure access to email. They want access to corporate information and applications too. This validation provides not one, but many alternative solutions for everything from secure push e-mail to backend database access and updates. Now users can do it with the confidence that their security meets the government's most stringent guidelines." Since 1997, Certicom and Palm have worked together to enable mobile workers to protect sensitive information with a high level of security, without compromising the speed and flexibility of wireless devices. "Certicom makes it easy for agencies to adhere to the strict security guidelines mandated by the government while still using the platform of their choice," said Tony Rosati, Certicom's vice-president, marketing and product management. "This certification extends our relationship with Palm and underscores our commitment to provide strong security solutions for multiple platforms without impacting performance." Along with standard cryptography algorithms such as DES, 3DES, AES, SHA-1 and the RSA public key algorithm, Security Builder GSE also includes Elliptic Curve Cryptography (ECC), a public-key cryptography technique approved by the U.S. government and many standards organizations including ANSI, IETF, IEEE and NIST. Last month, the National Security Agency purchased licensing rights to some of Certicom's ECC intellectual property to protect mission critical national security information. Security Builder GSE is available immediately and is priced with a license fee and royalties based on the number of devices. For more information, visit http://www.certicom/gov. About Certicom Certicom is a leading provider of wireless security solutions, enabling developers, governments and enterprises to add strong security to their devices, networks and applications. Designed for constrained devices, Certicom's patented technologies are unsurpassed in delivering the strongest cryptography with the smallest impact on performance and usability. Certicom products are currently licensed to more than 300 customers including Texas Instruments, Palm, Research In Motion, Cisco Systems, Oracle and Motorola. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Herndon, VA; San Mateo, CA; and London, England. Visit http://www.certicom.com. Certicom, Security Builder, Security Builder Crypto, Security Builder SSL, Security Builder PKI, Security Builder GSE, movianVPN, movianCrypt and movianMail are trademarks or registered trademarks of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Neuclear-general] ANNOUNCE: Released version 0.7 of NeuClear Commons
by Pelle Braendgaard 06 Jul '18

06 Jul '18

Panama City, 28 April, 2004. We are happy to announce the 0.7 release of NeuClear Commons. Main goal of this release is to support the 0.9 release of NeuClear ID. Download it today and join in the NeuClear revolution. Major new features are: * New Swing based Passphrase Agent * DefaultSigner is now completely interactive. * SQLSigner stores Public Private Key Pairs in SQL using Hibernate. * Removed all old SQL support code. * Added in memory caching to Public Key Resolver * Added new interactive signing model with the BrowsableSigner interface * New SetPublicKeyCallback method for returning the public key in interactive applications For more information see: http://dev.neuclear.org/commons/ Full Release notes below: Release Notes - NeuClear Commons - Version r_0_7 ** Bug * [COM-13] - Handle Invalid Passphrase in SwingAgent * [COM-14] - Use different screen layout for normal passphrase in SwingAgent * [COM-25] - Remembered passphrase is forgotten if identity is changed * [COM-27] - Loop when JCESigner is loaded with incorrect passphrase * [COM-31] - Remembered passphrase doesnt enable "sign" button * [COM-33] - Signed HTML generated by Identity and subclasses fail verification ** New Feature * [COM-4] - Create Completely Interactive Signing Method * [COM-5] - Support for more advanced passphrase agent * [COM-6] - Set PublicKey Callback Method * [COM-10] - Create Improved GUI Agent * [COM-11] - Add remember Passphrase to SwingAgent * [COM-12] - Add Identity Generator to SwingAgent * [COM-16] - add Password encrypted private key methods to CryptoTools * [COM-17] - Create SQLSigner * [COM-18] - Make DefaultSigner an intelligent wrapper for end user signing front ends * [COM-20] - Add Save Key Store Dialog to InteractiveAgent * [COM-21] - Add Open Key Store Dialog to InteractiveAgent * [COM-22] - Implement Save in SwingAgent ** Task * [COM-15] - Update project.xml with latest dependencies * [COM-32] - Drop all the sql packages as no longer needed ** Improvement * [COM-9] - Add in memory caching to PublicKey Resolver * [COM-19] - Create signing task queue on SwingAgent * [COM-26] - Change to DefaultSigner's method of saving -- http://talk.org + Live and direct from Panama http://neuclear.org + Clear it both ways with NeuClear ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Neuclear-general mailing list Neuclear-general(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/neuclear-general --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0