- cypherpunks-legacy - lists.cpunks.org

EDRI-gram newsletter - Number 5.23, 5 December 2007
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 5.23, 5 December 2007 ============================================================ Contents ============================================================ 1. New agreement between the French ISPs and record industries 2. RFID and Informed Consent - Using and removing of RFID functionality 3. Public letter on data security sent by MEPs to Frattini 4. UK DNA database errors raise concerns 5. IP rules to be changed to give access to environmental technology 6. UK Retailers blow the whistle on DRM 7. European scientific information - too late on open access? 8. Third international conference e-Society.Mk 2007 9. Progress in the European Digital Libraries EU Initiative 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. New agreement between the French ISPs and record industries ============================================================ Under the patronage of the French President Nicolas Sarkozy, an agreement was signed on 23 November 2007 between some French ISPs and the music and movie representatives in order to act directly against the big illegal file-sharers. These could be warned in the first stage and then their connection could be even cut-off.. The agreement was struck under the supervision of the Olivennes Commission, named after its chairman Denis Olivennes who is also the President-Director General of FNAC, the largest French retailer of cultural and consumer electronics products. According to this convention and as already announced by EDRI-gram one month ago, the French ISPs will spy on their users to see if they are big file-sharers. Those who are identified could get first a formal warning, but then they could be even cut-off or suspended. The agreement foresees also the possibility to have a national register of the subscribers that were suspended, but it is doubtful that such a register will be accepted by the French Data Protection Authority - CNIL. As a "compensation", the movie industry has agreed to release the DVD movies just six months after the cinema run and the music industry to offer DRM-free songs for legal download. But the agreement is not applicable yet, since there is no authority created to apply the agreement. The present authority created by the DADVSI law for the regulation of DRMs and other technical measures does not have attributions in these sense. The administrative sanctions could be applied also to the ISPs that didn't sign the agreement if they don't collaborate with the new authority. Another problem of the new agreement is the open support to the filtering technologies, that should be "tested" by the ISPs for maximum 2 years and then implemented if they are "realistic from a financial and technical point of view." Nicolas Sarkozy used the opportunity to boast himself fro having respected his presidential campaign commitments, and to first make such a type of agreement in France, considering it as the "future of a civilised internet." The deal was praised by the International Federation of the Phonographic Industry (IFPI) that consider it as the single most important initiative to help win the war on online piracy that we have seen so far." But colleagues of Mr. Sarkozy from the same party, such as Marc Le Fur and Alain Suguenot, argued against it because it "creates a truly exceptional jurisdiction for downloaders, contravening the principle of equality before the law". Even the chair of the commission, Denis Olivennes, admitted that the current penalties were "totally disproportionate" for those young people who could be engaged in illegal file-sharing. French consumer NGO UFC Que Choisir described the agreement as "very tough, potentially destructive of freedom, anti-economic and against digital history". A response to the agreement was seen a few days later, when several major web 2.0 actors such as AOL, Dailymotion, Google, PriceMinister and Yahoo announced the creation of a French NGO called Association of Community Internet Services ( L'Association des services internet communautaires - ASIC) that wants to present the "opportunities that the web 2.0 offers for the French economy and culture." Unfortunately, the French bad example was quickly picked up and used in other countries as a positive example. As EDRI-member Open Rights Group reports, during an event in UK last week organised by the Social Market Foundation with the title "Intellectual Property Rights and Consumer Rights", the minister responsible for UK-Intellectual Property Office spoke of the need for balance in reforming Britain intellectual property regulation but the Government's actions do not yet evidence this commitment. Richard Mollett from the British Phonographic Industry (BPI) flagged moves towards a voluntary agreement between the BPI and ISPs to reduce copyright-infringing traffic, similar to French model. He expects "an initial warning from the ISP that infringing traffic is associated with a particular account will halt 75% of infringers. If suspicious activity continues then account suspension is the next step, before the final sanction of account termination." But "(...) fortunately this point was recognised by all parties to the discussion, cutting off internet access is very much the 'nuclear option'." In the US, the Motion Picture Association of America Chairman Dan Glickman confirmed this trend at a UBS AG media conference in New York, stating that: "Within the next few years all the major ISPs will be much more aggressive monitoring for people who use their Internet connections" for illegal file-sharing, Agreement for the development and protection of cultural works and programs in the new networks (only in French, 23.11.2007) http://www.culture.gouv.fr/culture/actualites/index-olivennes231107.htm Mission assigned to Denis Olivennes in the fight against illegal downloading and the drafting of legal offers of music, audiovisual and cinema works (only in French, 23.11.2007) http://www.culture.gouv.fr/culture/actualites/index-olivennes231107.htm France unveils anti-piracy plan (23.11.2007) http://news.bbc.co.uk/2/hi/technology/7110024.stm French record industry, ISPs in entente to boot off file-sharers (23.11.2007) http://www.theregister.co.uk/2007/11/23/france_isps_record/ Olivennes Agreement: Ratiatum decripts the measures - item by item (only in French, 26.11.2007) http://www.ratiatum.com/news6105_Accord_Olivennes_Ratiatum_decrypte_point_p… AOL, Dailymotion, Google, Yahoo and PriceMinister are organizing to defend their position (only in French, 3.12.2007) http://www.zdnet.fr/actualites/internet/0,39020774,39376103,00.htm?xtor=EPR… "3 steps and you're terminated" (2.12.2007) http://www.openrightsgroup.org/2007/12/02/3-steps-and-youre-terminated/ ISPs to monitor Piracy (5.12.2007) http://www.nypost.com/seven/12052007/business/isps_to_monitor_piracy_208853… EDRI-gram: French ruling against video-sharing platform DailyMotion (18.07.2007) http://www.edri.org/edrigram/number5.14/dailymotion-decision EDRI-gram: French ISPs agree to spy on Internet users to stop online piracy (10.10.2007) http://www.edri.org/edrigram/number5.19/french-isp-piracy ============================================================ 2. RFID and Informed Consent - Using and removing of RFID functionality ============================================================ Following the the EDRi statements on RFID Privacy Issues and RFID Security Issues published earlier this year, EDRi recently contributed with a third written statement to the European Commission's RFID Expert Group focusing on RFID and Informed Consent. In this paper, EDRi deals with the possibilities of informing individuals about RFID use and strongly asks for a strict opt-in regime for RFID usage. Furthermore various mechanisms for removing, altering or disabling RFID functionality are discussed and evaluated with respect to the protection of personal data. Finally, EDRi suggests a concept of responsibilities to ensure that RFID technology is only disseminated to organisations that explicitly consented to the use of RFIDs and that are able to take appropriate measures to protect individuals' privacy. EDRi's statement on RFID and Informed Consent is now publicly available. http://www.edri.org/docs/EDRi_RFID_Informed_Consent_published.pdf RFID Privacy Issues (10.07.2007) http://www.edri.org/docs/EDRi_RFID_Privacy_Issues_published.pdf RFID Security Issues (07.2007) http://www.edri.org/docs/EDRi_RFID_Security_Issues.pdf (Contribution by Andreas Krisch - EDRi) ============================================================ 3. Public letter on data security sent by MEPs to Frattini ============================================================ Two members of the European Parliament (MEPs), rapporteurs on the European huge biometric databases Visa Information System (VIS) and the Schengen Information System II (SIS II), have addressed a public letter to commissioner Frattini asking for effective data protection and data security provisions and thus excluding the copying or storage of sensitive data in mobile formats such as, for instance, diskettes or CD-ROMs. This letter comes as a reaction to the UK government data protection security problems, after two CDs containing the personal data of 25 million citizens were lost in the post. The two MEPs - Baroness Sarah Ludford MEP, Liberal Democrat European justice spokeswoman and European Parliament rapporteur on the VIS and Carlos Coelho, responsible for the Schengen Information System - have reminded Commissioner Frattini and the Portuguese Presidency that during the negotiations on the SIS II one of the major concerns of the Parliament was exactly the problem of the so-called "technical copies" that lead to personal data stored off-line. The compromise with the Council was that all routine technical copies which lead to data stored offline would have to be phased out, and that only in exceptional cases could a copy be made offline if several rigorous criteria were met and they were destroyed after 48 hours. The letter, published by Statewatch, reminds that, in the current discussions on the draft Common Consular Instructions/biometrics collection measure, the European Commission provided the European Parliament with a document in which "offline copies on disc are still presented as a possible means of transfer of visa data, and that in a context in which encryption may be challenged by the host country." This is seen as a major concern by the 2 MEPs that asked the Commission to learn from the UK problems: "Not only the UK government but the EU as a whole need to ensure that lessons are learned from this monumental blunder at HMRC. We cannot allow lax security standards on access or copying of vast centralised databases to imperil the personal security of millions of people", said Sarah Ludford. "EU data protection laws either need to be toughened up or accompanied by a strict training and auditing regime in which data protection supervisors must be given adequate resources and enforcement powers, both hitherto lacking in the UK." They also demand that the European Commission together with the Article 29 Working Party and European Data Protection Supervisor should draw up a green paper on the risks that exist and the safeguards needed to keep data safe. A new draft proposal that needs the ammend the European Privacy and Electronic Communications Directive has been published by the European Commission. One of the important changes will be the obligation of the electronic communication companies to notify its customers when a privacy breach had occurred. Letter to Franco Frattini on data security (22.11.2007) http://www.statewatch.org/news/2007/nov/eu-ep-letter-frattini-data-security… EU must learn database lessons from UK lost records (22.11.2007) http://www.sarahludfordmep.org.uk/news/000951/eu_must_learn_database_lesson… European Commission plans security breach notification law (5.12.2007) http://www.out-law.com/page-8741 EDRI-gram: UK government loses personal data on 25 million citizens (21.11.2007) http://www.edri.org/edrigram/number5.22/personal-data-lost-uk ============================================================ 4. UK DNA database errors raise concerns ============================================================ The largest DNA database in the world covering details on about 4.5 million people including information on every person arrested, convicted or not, and on 900 000 children raises questions as inaccuracies and administrative errors have been found in its records. Incorrect dates, spelling mistakes and duplications have been found by Data Quality and Integrity Team of the DNA database unit. These mistakes can lead to innocent people being accused of crimes and wrongly arrested. Information added to incorrect profiles has also obliged the police to erase affected records. The DNA Database Unit had also admitted in a report in May 2007 that between 1995 and 2005 it failed to load 26 200 records to the DNA database because of errors, which resulted in 183 undetected crimes. In August 2007 statistics released by the Home Office were showing around 550 000 files with wrongly recorded or miss spelt names. This created big concerns among civil rights groups. Shami Chakrabarti, the director of civil rights group Liberty, considered it was already bad that the database included innocent people which had never been charged, many children and a large percentage of ethnic minorities. "Now it turns out we don't know the accuracy of the data. How many Postman Pats and Donald Ducks have entries on a system worthy of the Keystone Cops?" she commented. A spokesman from the National Policing Improvement Agency stated that most of these errors have been corrected but admitted errors are still possible. "Between January and November 1,450 demographic discrepancies have been discovered and rectified. Some of these are spelling errors, date taken amendments and Force code amendments (...) The Custodian Accreditation Service has identified and logged 111 unexpected results - possible errors - for the financial year 2006/07 that have resulted in the deletion of a profile or an amendment to the profile." John Hemming, the Liberal Democrat MP for Birmingham Yardley and an Internet entrepreneur who is investigating the reasons of the occurrence of so many errors stated: "It is important that people recognise Government databases are not necessarily 100 per cent accurate (...) It is quite clear you can't trust the Government with your personal information. They need to massively tighten up the way they deal with these issues." Innocents fear DNA database errors (26.11.2007) http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2007/11/26/ndna126.xml Outrage at 500,000 DNA database mistakes (27.08.2007) http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2007/08/27/ndna127.xml EDRI-gram : UK Home Office plans to fingerprint children starting 11 (14.03.2007) http://www.edri.org/edrigram/number5.5/uk-fingerprint-children ============================================================ 5. IP rules to be changed to give access to environmental technology ============================================================ On 20 November 2007, the Members of the European Parliament (EP) approved a report that asks for the revision of the World Trade Organization Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) in order to allow the compulsory licensing of patented environmental technologies. The European Parliament considers developing countries should be able to have free access to the technologies developed to target the environmental issues such as climate change. This action comes also as a result of the environmental activists' criticism of the EU Global Paper stating the intention to ask for a high level of Intellecutual Property (IP) standards on European markets. According to environmental activists, such a policy creates problems for developing countries that cannot afford expensive environmentally-friendly technologies. "With a high IPR (intellectual property rights) regime, products and processes are now patented and less accessible (...) So to really achieve the transfer of climate-friendly technology, the biggest incentive would be to eliminate IPRs related to these technologies." said campaigner Meena Raman from Friends of the Earth group. Dalindyebo Shabalala of the Center for International Environmental Law in Geneva believes TRIPS should include clearer provisions on the patent excepts related to public health and environmental emergencies and waiving patents should ensure wider availability of fuel-efficient cars. French Green MEP Alain Lipietz, the author of the EP report drafted in preparation to the international conference on climate change taking place between 3-14 December 2007 in Bali, Indonesia, considers that not only IP rules should be revised but also tariffs on "green goods" should be eliminated and means should be found to subsidise polluting industries. On the other hand, Stavros Dimas, the European commissioner for the environment, stated that the cost of the IP rights in such technologies is a relatively small part of the whole cost and that there are other issues to be taken into consideration when talking about barriers to technology transfer such as the economical policies of the developing countries. He considers that many companies are not willing to invest in developing countries where their IP rights are not protected and "if capacity-building in the host country is inadequate." More discussions on all the types of barriers to the transfer of environmentally-friendly technologies will be held during the present conference in Bali. EU Parliament Urges Change In IP Rules For Environmental Technology (29.11.2007) http://www.ip-watch.org/weblog/index.php?p=851 European Parliament resolution of 29 November 2007 on trade and climate change (29.11.2007) http://www.europarl.europa.eu/sides/getDoc.do?Type=TA&Reference=P6-TA-2007-… ============================================================ 6. UK Retailers blow the whistle on DRM ============================================================ The Entertainment Retailers Association (ERA) asks the music industry to get rid of DRM which they consider responsible for the continuously decreasing of online music sales in UK. The industry music seems to ignore the consumers' preferences who are displeased with the copy protection systems imposing limitations on the content use. Additionally, the occurrence of various incompatible DRM formats has led to confusion and reserve with the consumers who tend to prefer file-sharing, lest they should find themselves in the position of not being able to play the music on their electronic equipment. According to Kim Bayley, ERA director, the DRM is "working against the consumer interest" and "puts consumers off". In a statement to Financial Times, she has made reference to a survey already discussed in the EDRi-gram, carried out by Entertainment Media Research and media law firm Olswang. The study has revealed the fact that four out of five consumers would rather have copy protection free versions of the music they want to buy. Therefore, many of them go to file-sharing peer-to-peer services. Some recording companies, like EMI and Universal have already offered DRM free catalogues and have experienced increased sales after that which is an argument in favour of dropping DRM. During the last three years, an average of one song per resident was sold online in UK, a sign that it's time the music industry gave up DRM if they want to see any improvement in the online sales. UK retailers to record labels: DRM is killing us (21.11.2007) http://arstechnica.com/news.ars/post/20071121-uk-retailers-to-record-labels… UK retailers join the anti-DRM crusade (23.11.2007) http://www.downloadsquad.com/2007/11/23/uk-retailers-join-the-anti-drm-crus… UK retailers complain DRM is "stifling" music (21.11.2007) http://www.macnn.com/articles/07/11/21/uk.retailers.against.drm/ EDRI-gram: DRM-free music is supported by consumers (29.08.2007) http://www.edri.org/edrigram/number5.16/drm-free-music EDRI-gram: DRM debate continues in Europe (28.02.2007) http://www.edri.org/edrigram/number5.4/drm-debate ============================================================ 7. European scientific information - too late on open access? ============================================================ The recent meeting on 22-24 November 2007 of the Competitiveness European Council meeting adopted its conclusions on scientific information in the digital age: access, dissemination and preservation. The conclusions underline the importance of scientific output resulting from publicly funded research being available on the Internet at no cost to the reader under economically viable circumstances, including delayed open access. They also ask the member countries "to systematically assess conditions that affect access to scientific information", including: a.The way in which researchers exercise their copyright on scientific articles; b.The level of investments in the dissemination of scientific information as compared to total investments in research, and c. The use of financial mechanisms to improve access, such as refunding VAT for digital journal subscriptions to libraries. But the Slovenian Minister for Growth, Ziga Tur, considered the conclusions as coming too late, explaining in his blog: "The bottom line is that in the scientific publishing process there is a decreasing value added by the publishers. The research is funded by the governments or the industry, performed by the researchers, papers are written and reviewed by them for free, only at the very end a publisher comes along that takes over the copyright, publishes the work and sells the journal at great expense to the community that created and edited the content for free." He also considers that the document aims too low, in talking only about "delayed open access" and suggesting refunding VAT that would mean "simply subsidizing commercial publishers". The Slovenian Ministry suggests a much more categorical European approach to the open access issues considering that "the explosion of the internet based technologies in the US have been made possible by the (1) open access to software, (2) open standards and (3) freely available scientific articles on the subject. The cited document brings nothing like that to Europe." Council Conclusions on scientific information in the digital age: access, dissemination and preservation - 2832nd Competitiveness (Internal market, Industry and Research) Council meeting (22-23.11.2007) http://www.consilium.europa.eu/ueDocs/cms_Data/docs/pressData/en/intm/97236… Council on Scientific Information in the Digital Age: Too Little Too Late (27.11.2007) http://zturk.blogactiv.eu/archives/4 Latest EU steps in the field of scientific publishing 'too little, too late' (29.11.2007) http://www.euractiv.com/en/science/latest-eu-steps-field-scientific-publish… ============================================================ 8. Third international conference e-Society.Mk 2007 ============================================================ The conference on the topic of "Inclusive e-Government" was organized by the Metamorphosis Foundation last week within the frames of the project "Western Balkans Network for Inclusive e-Government". The project aims at strengthening the cooperation and coordination among all the relevant stakeholders, decision-makers, government representatives, as well as representatives of the business, academic and nongovernmental sector in order to improve the quality and raise the level of usability and accessibility of electronic services provided by the public administration. "Although the inclusion is characteristic for the countries with a more advanced degree of development of the information society, this does not mean that we should not discuss this topic in Macedonia and work on it, since our goal is becoming part of the European society", said Goran Manchev, adviser in the Cabinet of the Minister in charge of Information Society. In the field of inclusion, as Manchev outlined, the Government is conducting projects, such as "Computer for Every Child", the vouchers for the students, intervals of free internet access etc., which, according to him, are an introduction into bridging the digital divide in society. The executive director of the Foundation Open Society Institute - Macedonia, Vladimir Milchin, emphasized that the people working in the central and local administration should increase their knowledge and improve their skills in order to enable the users to increase their influence in society and in shaping the public policies by using ICT : "This means reaching the goal of having an open government and citizens who have access, i.e. coming to a certain degree of inclusion, without which the democratic, nor open society could not be imagined", said Milchin in his address to the conference attendants. "Knowledge and skills are among the prerequisites for establishing an inclusive e-government into an information society. The digital divide is increasing. The gap between the people using ICT technology and the ones that are not is increasing. Therefore, we need to bridge the gap and enable inclusion. We are aware that if Macedonia does not perform well in this area, we will fall behind the European countries", stressed Marjan Gushev, board member of the Metamorphosis foundation. According to him, the "e" in the term "e-Government" stands more for efficient rather than electronic Government, meaning that the Government's activities should be reorganized in order to result in providing better services for the citizens and businesses. The second days focused on best practices in the e-Government. Most participants claimed that the region benefits a lot from the transfer of knowledge about good e-Gov practices from the EU, especially from Austria, Slovenia and Estonia, three of the five top-ranked EU countries in this area, according to Capgemini methodology. On the other hand, reposts from different WBC pointed out not only to the low level of e-Gov sophistication (around 2 out of 4), but also to lack of interest in aspects of inclusion, especially lack of commitment in applying standards for accessibility and usability in existing e-services. Bardhyl Jashari from Metamorphosis Foundation emphasized the importance of cooperation between different societal sectors: governmental, business, educational and civic in overcoming these obstacles. He also pointed out that in the case of Macedonia, around 70% of the population does not use the internet at all, so in order to have truly inclusive e-society, all the sectors must find mechanisms to include this portion of population in the processes of development. About 250 representatives of the governmental, nongovernmental, education and business sector from 11 countries participated at the conference that took place on 29-30 November 2007. E-society.Mk 2007 International Conference http://e-society.org.mk/portal/content/view/24/31/lang,en/ (contribution by EDRi-member Metamorphosis Foundation - Macedonia) ============================================================ 9. Progress in the European Digital Libraries EU Initiative ============================================================ A meeting on 27 November 2007 of a high level group on digital libraries and officials of the European Commission formalised the agreement between European libraries, archives and museums in a common effort to create a European digital library that would give access to a common European cultural and scientific heritage. The EU European Digital Libraries initiative is part of "i2010: European Information Society 2010" initiative launched in June 2006 with the purpose to "foster growth and jobs in the information society and media industries", followed, in August 2006, by the adoption of the Recommendation on digitisation and digital preservation urging "EU Member States to set up large-scale digitisation facilities so as to accelerate the process of getting Europe's cultural heritage on line via the European digital library". In this sense, Member States were encouraged to tackle questions related to copyright and "the systematic preservation of digital content in order to ensure long term access to the material". The idea of European Digital Libraries was backed by the Culture Ministers of all EU Member States and by a resolution adopted by the European Parliament on 27 September 2007. Recently, a European digital library foundation has been created gathering European associations that represent museums, libraries and archives. According to Information Society and Media Commissioner Viviane Reding, the creation of the foundation "shows the commitment of Europe's cultural institutions to work together and make their collections available and searchable to the wide public through a common and multilingual access point online". The launching of a European digital library prototype is planned for November 2008. The prototype will give direct access to at least 2 million digital books, records, photographs, maps, films from the European libraries, archives and museums. It is foreseen that by 2010 the digital library will exceed the initially targeted 6 million digital objects. The success of the initiative depends on the financing of the digitisation and on finding solutions to make copyrighted works searchable through the European digital library. Therefore, the discussions during the meeting on 27 November were focused on finding new ways to finance digitisation through public private partnerships, in finding solutions for mass-digitisation of out of print works and orphan works and on issues related to access to and preservation of scientific information. The group decided to find an agreement by June 2008 to deal with orphan works that would including criteria to look for rightholders and an agreement was also reached by libraries, scientists and scientific publishers to experiment open access to scientific publications which have been under embargo during the last period. Launch of European digital library "on track" (28.11.2007) http://www.europa.eu/rapid/pressReleasesAction.do?reference=IP/07/1784 The European Digital Library: Frequently Asked Questions (25.08.2007) http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/06/311&format=… EDRI-gram: European Parliament resolution on a European digital library (10.10.2007) http://www.edri.org/edrigram/number5.19/ep-digital-library EDRI-gram: Copyright clearing for EU digital libraries project (25.04.2007) http://www.edri.org/edrigram/number5.8/copyright-digital-libraries ============================================================ 10. Recommended Reading ============================================================ Closing speech on Public Security, Privacy and Technology -Franco Frattini, European Commissioner responsible for Justice, Freedom and Security http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/07/728 ============================================================ 11. Agenda ============================================================ 5-7 December 2007, Pisa, Italy Second DELOS Conference on Digital Libraries http://www.delos.info/index.php?option=com_content&task=view&id=606&Itemid=… 27-30 December, Berlin, Germany 24th Chaos Communication Congress http://events.ccc.de/congress/2007/Main_Page 17 January 2008, London, UK Nanotechnology for security and the crime prevention III http://www.nano.org.uk/events/ionevents.htm#security 22 January 2008, London, UK Gov 2.0, or Truly Transformative Government http://www.oii.ox.ac.uk/events/details.cfm?id=169 17-18 June 2008, Seoul, Korea The Future of the Internet Economy - OECD Ministerial Meeting www.oecd.org/FutureInternet 23-25 July 2008, Leuven, Belgium The 8th Privacy Enhancing Technologies Symposium (PETS 2008) http://petsymposium.org/2008/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 28 members based or with offices in 17 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by zooko 06 Jul '18

06 Jul '18

<p2p-hackers(a)lists.zooko.com > Subject: [p2p-hackers] ANNOUNCING Tahoe-LAFS v1.4 ANNOUNCING Tahoe, the Least-Authority Filesystem, v1.4 The allmydata.org team is pleased to announce the release of version 1.4.1 of "Tahoe", the Lightweight-Authorization Filesystem. This is the first release of Tahoe-LAFS which was created solely as a labor of love by volunteers -- it is no longer funded by allmydata.com (see [1] for details). Tahoe-LAFS is a secure, decentralized, fault-tolerant cloud storage system. All of the source code is publicly available under Free Software, Open Source licences. This filesystem is distributed over multiple servers in such a way the filesystem continues to operate correctly even when some of the servers are unavailable, malfunctioning, or malicious. Here is the one-page explanation of Tahoe's unique security and fault-tolerance properties: http://allmydata.org/source/tahoe/trunk/docs/about.html This is the successor to Tahoe-LAFS v1.3, which was released February 13, 2009 [2]. This is a major new release, adding garbage collection, improved diagnostics and error-reporting, and fixing a critical performance problem when downloading large (many GB) files. See the NEWS file [3] and the known_issues.txt file [4] for more information. Besides the Tahoe core, a crop of related projects have sprung up, including frontends for Windows and Macintosh, two front-ends written in JavaScript, a Ruby interface, a plugin for duplicity, a plugin for TiddlyWiki, a new backup tool named "GridBackup", CIFS/SMB integration, an iPhone app, and three incomplete frontends for FUSE. See the Related Projects page on the wiki: [5]. COMPATIBILITY Tahoe v1.4 is fully compatible with the version 1 series of Tahoe. Files written by v1.4 clients can be read by clients of all versions back to v1.0. v1.4 clients can read files produced by clients of all versions since v1.0. v1.4 servers can serve clients of all versions back to v1.0 and v1.4 clients can use servers of all versions back to v1.0. This is the fifth release in the version 1 series. The version 1 series of Tahoe will be actively supported and maintained for the forseeable future, and future versions of Tahoe will retain the ability to read files and directories produced by Tahoe v1 for the forseeable future. The version 1 branch of Tahoe is the basis of the consumer backup product from Allmydata, Inc. -- http://allmydata.com . WHAT IS IT GOOD FOR? With Tahoe, you can distribute your filesystem across a set of servers, such that if some of them fail or even turn out to be malicious, the entire filesystem continues to be available. You can share your files with other users, using a simple and flexible access control scheme. Because this software is new, we do not categorically recommend it as the sole repository of data which is extremely confidential or precious. However, we believe that erasure coding, strong encryption, Free/Open Source Software and careful engineering make Tahoe safer than common alternatives, such as RAID, removable drive, tape, "on-line storage" or "Cloud storage" systems. This software comes with extensive tests, and there are no known security flaws which would compromise confidentiality or data integrity. (For all currently known issues please see the known_issues.txt file [3].) This release of Tahoe is suitable for the "friendnet" use case [6] -- it is easy to create a filesystem spread over the computers of you and your friends so that you can share disk space and files. LICENCE You may use this package under the GNU General Public License, version 2 or, at your option, any later version. See the file "COPYING.GPL" [7] for the terms of the GNU General Public License, version 2. You may use this package under the Transitive Grace Period Public Licence, version 1 or, at your option, any later version. (The Transitive Grace Period Public Licence has requirements similar to the GPL except that it allows you to wait for up to twelve months after you redistribute a derived work before releasing the source code of your derived work.) See the file "COPYING.TGPPL.html" [8] for the terms of the Transitive Grace Period Public Licence, version 1. (You may choose to use this package under the terms of either licence, at your option.) INSTALLATION Tahoe works on Linux, Mac OS X, Windows, Cygwin, and Solaris, and probably most other systems. Start with "docs/install.html" [9]. HACKING AND COMMUNITY Please join us on the mailing list [10]. Patches are gratefully accepted -- the RoadMap page [11] shows the next improvements that we plan to make and CREDITS [12] lists the names of people who've contributed to the project. The wiki Dev page [13] contains resources for hackers. SPONSORSHIP Tahoe was originally developed thanks to the sponsorship of Allmydata, Inc. [14], a provider of commercial backup services. Allmydata, Inc. created the Tahoe project, and contributed hardware, software, ideas, bug reports, suggestions, demands, and money (employing several Tahoe hackers and instructing them to spend part of their work time on this Free Software project). Also they awarded customized t-shirts to hackers who find security flaws in Tahoe (see http://hacktahoe.org ). After discontinuing funding of Tahoe R&D in early 2009, Allmydata, Inc. has continued to provide servers, co-lo space and bandwidth to the open source project. Thank you to Allmydata, Inc. for their generous and public-spirited support. Zooko Wilcox-O'Hearn on behalf of the allmydata.org team Special acknowledgment goes to Brian Warner, whose superb engineering skills and dedication are primarily responsible for the Tahoe implementation, and significantly responsible for the Tahoe design as well, not to mention most of the docs and tests and many other things besides. April 13, 2009 Boulder, Colorado, USA [1] http://allmydata.org/pipermail/tahoe-dev/2009-March/001461.html [2] http://allmydata.org/trac/tahoe/browser/relnotes.txt?rev=3620 [3] http://allmydata.org/trac/tahoe/browser/NEWS?rev=3835 [4] http://allmydata.org/trac/tahoe/browser/docs/known_issues.txt [5] http://allmydata.org/trac/tahoe/wiki/RelatedProjects [6] http://allmydata.org/trac/tahoe/wiki/UseCases [7] http://allmydata.org/trac/tahoe/browser/COPYING.GPL [8] http://allmydata.org/source/tahoe/trunk/COPYING.TGPPL.html [9] http://allmydata.org/source/tahoe/trunk/docs/install.html [10] http://allmydata.org/cgi-bin/mailman/listinfo/tahoe-dev [11] http://allmydata.org/trac/tahoe/roadmap [12] http://allmydata.org/trac/tahoe/browser/CREDITS?rev=3758 [13] http://allmydata.org/trac/tahoe/wiki/Dev [14] http://allmydata.com --- Tahoe, the Least-Authority Filesystem -- http://allmydata.org store your data: $10/month -- http://allmydata.com/?tracking=zsig I am available for work -- http://zooko.com/risumi.html _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers

1 0

Victims of the darkness: Government surveillance and
by EEkid＠aol.com 06 Jul '18

06 Jul '18

intimidation I'm not sure which is more interesting, the story or the source. Jerry ************************************************************************ ****** Victims of the darkness: Government surveillance and intimidation 12/26/2005 13:42 The Bush Administration has consistently harassed citizens who exercise their First Amendment freedoms and voice concerns about government policies "As nightfall does not come at once, neither does oppression. In both instances there is a twilight where everything remains seemingly unchanged, and it is in such a twilight that we must be aware of the change in the air, however slight, lest we become unwitting victims of the darkness." Supreme Court Justice William O. Douglas Not since the notorious McCarthy era of the 1950s, when American freedoms faced extinction, has there been such an attack against the Bill of Rights. The recent media focus on President Bush's authorizing the National Security Agency to spy on ordinary Americans has brought this issue to the forefront. On secret orders from President Bush, the NSA has been monitoring the international phone calls and emails of Americans without warrants. Moreover, the Bush Administration has consistently harassed citizens who exercise their First Amendment freedoms and voice concerns about government policies. The main weapon used in this war is intimidation, specifically through governmental surveillance and government agents. Indeed, the American government has a near paranoia about dissenting citizens. "The Administration and campaign of George W. Bush," writes former Congressman Bob Barr (R-Ga.), "is squelching any possible hint of disagreement or protest at every political rally or gathering." For example, in March of this year, three citizens were removed from President Bush's town hall meeting in Aurora, Colo., because the car they arrived in featured the bumper sticker, "No More Blood for Oil." This past summer, FBI agents went to Windsor, Conn., with a document marked for delivery by hand. On Matianuk Avenue, across from the tennis courts, two special agents found their man. They gave George Christian the letter, which warned him to tell no one - ever - what it said. The letter, which was on FBI stationery, directed Christian to surrender "all subscriber information, billing information and access logs of any person" who used a specific computer at a library branch some distance away. Christian, who manages digital records for three dozen Connecticut libraries, said in an affidavit that he configures his system for privacy. But the vendors of the software Christian operates said their databases can reveal the websites that visitors browse, the e- mail accounts they open and the books they borrow. Christian refused to hand over the records, and his employer, Library Connection, Inc., filed suit for the right to protest the FBI demand in public. This case affords a rare glimpse of an exponentially growing practice of domestic surveillance under some of the heinous provisions of the USA Patriot Act. National security letters, such as the one issued to George Christian, were created in the 1970s for espionage and terrorism investigations. They were originally intended as narrow exceptions in consumer privacy law, enabling the FBI to review in secret the customer records of suspected foreign agents. However, the Patriot Act and Bush Administration guidelines for its use have transformed those letters by permitting clandestine scrutiny of U. S. residents and visitors who are not alleged to be terrorists or spies. "The FBI now issues more than 30,000 national security letters a year," writes Barton Gellman in The Washington Post, "a hundredfold increase over historic norms. The letters - one of which can be used to sweep up the records of many people - are extending the bureau's reach as never before into the telephone calls, correspondence and financial lives of ordinary Americans." Indeed, according to a previously classified document released recently, the FBI has conducted clandestine surveillance on some U. S. residents for as long as 18 months at a time without proper paperwork or oversight. Thus, the government does not limit its attacks to actual terrorists. Ordinary American citizens are the focus as well. Take the case of Selena Jarvis, a social studies teacher at Currituck County High School in North Carolina. She assigned her senior civics and economics class to use photographs to illustrate their freedoms as found in the Bill of Rights. One student photographed a picture of George W. Bush next to his own hand in a thumbs-down position as a way to express his freedom to dissent. However, while developing the student's photographs, a Wal-Mart photo department employee, in obvious need of some education on the Bill of Rights, called the police. They then contacted the Secret Service. But rather than dismissing the case, the Secret Service decided to investigate the matter. The agents interrogated the student and questioned Jarvis. While questioning Jarvis, an agent asked her if she thought the photo was suspicious. Dumbfounded, Jarvis responded, "No, it was a Bill of Rights project!" Jarvis was startled at the claim that the student was a terrorist and called the whole thing "ridiculous." Why would the Secret Service, which is not run by incompetent individuals, take the time to investigate a high school student and his class project? It is safe to assume that the Secret Service knew the student was not a terrorist and wanted to make an example of him for others who might be bold enough to use their right to dissent. After the ordeal, Selena Jarvis commented, "I blame Wal-Mart more than anybody. I was really disgusted with them. But everyone was using poor judgment, from Wal-Mart up to the Secret Service." Unfortunately, this is not the only "ridiculous" case of individuals tattling on their neighbors. For example, Barry Reingold was questioned by the FBI after he criticized the war in Afghanistan in the locker room of his local health club. In another case, Derek Kjar's neighbors reported his bumper sticker of George Bush wearing a crown with the heading "King George - off with his head." As a result, Kjar was interrogated by the Secret Service. In both instances, close contacts of the two men reported them to the authorities. And as if things weren't bad enough, the military is now spying on us. A secret database obtained by NBC News recently reveals that the Department of Defense and the Pentagon have also increased intelligence collection on American citizens inside the country. This includes monitoring peaceful anti-war groups and protests and involves video taping, monitoring the Internet and collecting the name of anyone critical of the government. There is even a toll-free number for anyone interested to report on fellow Americans to the military. And the spying even includes religious groups such as those attending the Quaker Meeting House in Lake Worth, Florida. "On a domestic level, this is unprecedented," says NBC News analyst William Arkin. "I think it is the beginning of enormous problems and enormous mischief for the military." Since 9/11, it has been consistently drummed into our heads by the government, with all its alerts and multi-colored alarms, that terrorists are everywhere and even your next door neighbor could be one. As a result, the government's promotion of fear and paranoia has moved us closer to an Orwellian state where citizens inform on one another. The result is that the citizens often do the job of the police and no longer use good judgment before reporting their neighbors. In the process, such informing citizens are doing away with their own freedoms. These tactics are not new to the world. The Nazi and Soviet secret police of former regimes were infamous for such tactics. The police controlled the people through fear, and the subsequent result was a totalitarian state. They turned their respective population into a society of informers. Aleksandr Solzhenitsyn, the Nobel Peace Prize-winning author and former Soviet dissident, once spoke of how fear destroys the will of the people. He noted how the Russian people would kneel inside the doors of their apartments, pressing their ears to listen when the KGB came at midnight to arrest a neighbor who had spoken out against the government. Solzhenitsyn said that if all the people would have come out and driven off the secret police, sheer public opinion would have demoralized the effort to subdue a free people. But fear and paranoia kept the people at bay. We should not be afraid of government agents, whether employed by the FBI, the military or local authorities. Their salaries are paid through our tax dollars. Supposedly, they are our servants. Truly free societies do not function that way. Our fear of government servants is a clear indication of ominous things to come. If citizens are too frightened to use their freedoms, then those freedoms will become extinct. And the darkness will be complete. http://english.pravda.ru/mailbox/22/101/399/16678_surveillance.html ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Victims of the darkness: Government surveillance and
by David Farber 06 Jul '18

06 Jul '18

intimidation X-Mailer: Apple Mail (2.746.2) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

EDRI-gram newsletter - Number 5.23, 5 December 2007
by EDRI-gram newsletter 06 Jul '18

06 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 5.23, 5 December 2007 ============================================================ Contents ============================================================ 1. New agreement between the French ISPs and record industries 2. RFID and Informed Consent - Using and removing of RFID functionality 3. Public letter on data security sent by MEPs to Frattini 4. UK DNA database errors raise concerns 5. IP rules to be changed to give access to environmental technology 6. UK Retailers blow the whistle on DRM 7. European scientific information - too late on open access? 8. Third international conference e-Society.Mk 2007 9. Progress in the European Digital Libraries EU Initiative 10. Recommended Reading 11. Agenda 12. About ============================================================ 1. New agreement between the French ISPs and record industries ============================================================ Under the patronage of the French President Nicolas Sarkozy, an agreement was signed on 23 November 2007 between some French ISPs and the music and movie representatives in order to act directly against the big illegal file-sharers. These could be warned in the first stage and then their connection could be even cut-off.. The agreement was struck under the supervision of the Olivennes Commission, named after its chairman Denis Olivennes who is also the President-Director General of FNAC, the largest French retailer of cultural and consumer electronics products. According to this convention and as already announced by EDRI-gram one month ago, the French ISPs will spy on their users to see if they are big file-sharers. Those who are identified could get first a formal warning, but then they could be even cut-off or suspended. The agreement foresees also the possibility to have a national register of the subscribers that were suspended, but it is doubtful that such a register will be accepted by the French Data Protection Authority - CNIL. As a "compensation", the movie industry has agreed to release the DVD movies just six months after the cinema run and the music industry to offer DRM-free songs for legal download. But the agreement is not applicable yet, since there is no authority created to apply the agreement. The present authority created by the DADVSI law for the regulation of DRMs and other technical measures does not have attributions in these sense. The administrative sanctions could be applied also to the ISPs that didn't sign the agreement if they don't collaborate with the new authority. Another problem of the new agreement is the open support to the filtering technologies, that should be "tested" by the ISPs for maximum 2 years and then implemented if they are "realistic from a financial and technical point of view." Nicolas Sarkozy used the opportunity to boast himself fro having respected his presidential campaign commitments, and to first make such a type of agreement in France, considering it as the "future of a civilised internet." The deal was praised by the International Federation of the Phonographic Industry (IFPI) that consider it as the single most important initiative to help win the war on online piracy that we have seen so far." But colleagues of Mr. Sarkozy from the same party, such as Marc Le Fur and Alain Suguenot, argued against it because it "creates a truly exceptional jurisdiction for downloaders, contravening the principle of equality before the law". Even the chair of the commission, Denis Olivennes, admitted that the current penalties were "totally disproportionate" for those young people who could be engaged in illegal file-sharing. French consumer NGO UFC Que Choisir described the agreement as "very tough, potentially destructive of freedom, anti-economic and against digital history". A response to the agreement was seen a few days later, when several major web 2.0 actors such as AOL, Dailymotion, Google, PriceMinister and Yahoo announced the creation of a French NGO called Association of Community Internet Services ( L'Association des services internet communautaires - ASIC) that wants to present the "opportunities that the web 2.0 offers for the French economy and culture." Unfortunately, the French bad example was quickly picked up and used in other countries as a positive example. As EDRI-member Open Rights Group reports, during an event in UK last week organised by the Social Market Foundation with the title "Intellectual Property Rights and Consumer Rights", the minister responsible for UK-Intellectual Property Office spoke of the need for balance in reforming Britain intellectual property regulation but the Government's actions do not yet evidence this commitment. Richard Mollett from the British Phonographic Industry (BPI) flagged moves towards a voluntary agreement between the BPI and ISPs to reduce copyright-infringing traffic, similar to French model. He expects "an initial warning from the ISP that infringing traffic is associated with a particular account will halt 75% of infringers. If suspicious activity continues then account suspension is the next step, before the final sanction of account termination." But "(...) fortunately this point was recognised by all parties to the discussion, cutting off internet access is very much the 'nuclear option'." In the US, the Motion Picture Association of America Chairman Dan Glickman confirmed this trend at a UBS AG media conference in New York, stating that: "Within the next few years all the major ISPs will be much more aggressive monitoring for people who use their Internet connections" for illegal file-sharing, Agreement for the development and protection of cultural works and programs in the new networks (only in French, 23.11.2007) http://www.culture.gouv.fr/culture/actualites/index-olivennes231107.htm Mission assigned to Denis Olivennes in the fight against illegal downloading and the drafting of legal offers of music, audiovisual and cinema works (only in French, 23.11.2007) http://www.culture.gouv.fr/culture/actualites/index-olivennes231107.htm France unveils anti-piracy plan (23.11.2007) http://news.bbc.co.uk/2/hi/technology/7110024.stm French record industry, ISPs in entente to boot off file-sharers (23.11.2007) http://www.theregister.co.uk/2007/11/23/france_isps_record/ Olivennes Agreement: Ratiatum decripts the measures - item by item (only in French, 26.11.2007) http://www.ratiatum.com/news6105_Accord_Olivennes_Ratiatum_decrypte_point_p… AOL, Dailymotion, Google, Yahoo and PriceMinister are organizing to defend their position (only in French, 3.12.2007) http://www.zdnet.fr/actualites/internet/0,39020774,39376103,00.htm?xtor=EPR… "3 steps and you're terminated" (2.12.2007) http://www.openrightsgroup.org/2007/12/02/3-steps-and-youre-terminated/ ISPs to monitor Piracy (5.12.2007) http://www.nypost.com/seven/12052007/business/isps_to_monitor_piracy_208853… EDRI-gram: French ruling against video-sharing platform DailyMotion (18.07.2007) http://www.edri.org/edrigram/number5.14/dailymotion-decision EDRI-gram: French ISPs agree to spy on Internet users to stop online piracy (10.10.2007) http://www.edri.org/edrigram/number5.19/french-isp-piracy ============================================================ 2. RFID and Informed Consent - Using and removing of RFID functionality ============================================================ Following the the EDRi statements on RFID Privacy Issues and RFID Security Issues published earlier this year, EDRi recently contributed with a third written statement to the European Commission's RFID Expert Group focusing on RFID and Informed Consent. In this paper, EDRi deals with the possibilities of informing individuals about RFID use and strongly asks for a strict opt-in regime for RFID usage. Furthermore various mechanisms for removing, altering or disabling RFID functionality are discussed and evaluated with respect to the protection of personal data. Finally, EDRi suggests a concept of responsibilities to ensure that RFID technology is only disseminated to organisations that explicitly consented to the use of RFIDs and that are able to take appropriate measures to protect individuals' privacy. EDRi's statement on RFID and Informed Consent is now publicly available. http://www.edri.org/docs/EDRi_RFID_Informed_Consent_published.pdf RFID Privacy Issues (10.07.2007) http://www.edri.org/docs/EDRi_RFID_Privacy_Issues_published.pdf RFID Security Issues (07.2007) http://www.edri.org/docs/EDRi_RFID_Security_Issues.pdf (Contribution by Andreas Krisch - EDRi) ============================================================ 3. Public letter on data security sent by MEPs to Frattini ============================================================ Two members of the European Parliament (MEPs), rapporteurs on the European huge biometric databases Visa Information System (VIS) and the Schengen Information System II (SIS II), have addressed a public letter to commissioner Frattini asking for effective data protection and data security provisions and thus excluding the copying or storage of sensitive data in mobile formats such as, for instance, diskettes or CD-ROMs. This letter comes as a reaction to the UK government data protection security problems, after two CDs containing the personal data of 25 million citizens were lost in the post. The two MEPs - Baroness Sarah Ludford MEP, Liberal Democrat European justice spokeswoman and European Parliament rapporteur on the VIS and Carlos Coelho, responsible for the Schengen Information System - have reminded Commissioner Frattini and the Portuguese Presidency that during the negotiations on the SIS II one of the major concerns of the Parliament was exactly the problem of the so-called "technical copies" that lead to personal data stored off-line. The compromise with the Council was that all routine technical copies which lead to data stored offline would have to be phased out, and that only in exceptional cases could a copy be made offline if several rigorous criteria were met and they were destroyed after 48 hours. The letter, published by Statewatch, reminds that, in the current discussions on the draft Common Consular Instructions/biometrics collection measure, the European Commission provided the European Parliament with a document in which "offline copies on disc are still presented as a possible means of transfer of visa data, and that in a context in which encryption may be challenged by the host country." This is seen as a major concern by the 2 MEPs that asked the Commission to learn from the UK problems: "Not only the UK government but the EU as a whole need to ensure that lessons are learned from this monumental blunder at HMRC. We cannot allow lax security standards on access or copying of vast centralised databases to imperil the personal security of millions of people", said Sarah Ludford. "EU data protection laws either need to be toughened up or accompanied by a strict training and auditing regime in which data protection supervisors must be given adequate resources and enforcement powers, both hitherto lacking in the UK." They also demand that the European Commission together with the Article 29 Working Party and European Data Protection Supervisor should draw up a green paper on the risks that exist and the safeguards needed to keep data safe. A new draft proposal that needs the ammend the European Privacy and Electronic Communications Directive has been published by the European Commission. One of the important changes will be the obligation of the electronic communication companies to notify its customers when a privacy breach had occurred. Letter to Franco Frattini on data security (22.11.2007) http://www.statewatch.org/news/2007/nov/eu-ep-letter-frattini-data-security… EU must learn database lessons from UK lost records (22.11.2007) http://www.sarahludfordmep.org.uk/news/000951/eu_must_learn_database_lesson… European Commission plans security breach notification law (5.12.2007) http://www.out-law.com/page-8741 EDRI-gram: UK government loses personal data on 25 million citizens (21.11.2007) http://www.edri.org/edrigram/number5.22/personal-data-lost-uk ============================================================ 4. UK DNA database errors raise concerns ============================================================ The largest DNA database in the world covering details on about 4.5 million people including information on every person arrested, convicted or not, and on 900 000 children raises questions as inaccuracies and administrative errors have been found in its records. Incorrect dates, spelling mistakes and duplications have been found by Data Quality and Integrity Team of the DNA database unit. These mistakes can lead to innocent people being accused of crimes and wrongly arrested. Information added to incorrect profiles has also obliged the police to erase affected records. The DNA Database Unit had also admitted in a report in May 2007 that between 1995 and 2005 it failed to load 26 200 records to the DNA database because of errors, which resulted in 183 undetected crimes. In August 2007 statistics released by the Home Office were showing around 550 000 files with wrongly recorded or miss spelt names. This created big concerns among civil rights groups. Shami Chakrabarti, the director of civil rights group Liberty, considered it was already bad that the database included innocent people which had never been charged, many children and a large percentage of ethnic minorities. "Now it turns out we don't know the accuracy of the data. How many Postman Pats and Donald Ducks have entries on a system worthy of the Keystone Cops?" she commented. A spokesman from the National Policing Improvement Agency stated that most of these errors have been corrected but admitted errors are still possible. "Between January and November 1,450 demographic discrepancies have been discovered and rectified. Some of these are spelling errors, date taken amendments and Force code amendments (...) The Custodian Accreditation Service has identified and logged 111 unexpected results - possible errors - for the financial year 2006/07 that have resulted in the deletion of a profile or an amendment to the profile." John Hemming, the Liberal Democrat MP for Birmingham Yardley and an Internet entrepreneur who is investigating the reasons of the occurrence of so many errors stated: "It is important that people recognise Government databases are not necessarily 100 per cent accurate (...) It is quite clear you can't trust the Government with your personal information. They need to massively tighten up the way they deal with these issues." Innocents fear DNA database errors (26.11.2007) http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2007/11/26/ndna126.xml Outrage at 500,000 DNA database mistakes (27.08.2007) http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2007/08/27/ndna127.xml EDRI-gram : UK Home Office plans to fingerprint children starting 11 (14.03.2007) http://www.edri.org/edrigram/number5.5/uk-fingerprint-children ============================================================ 5. IP rules to be changed to give access to environmental technology ============================================================ On 20 November 2007, the Members of the European Parliament (EP) approved a report that asks for the revision of the World Trade Organization Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) in order to allow the compulsory licensing of patented environmental technologies. The European Parliament considers developing countries should be able to have free access to the technologies developed to target the environmental issues such as climate change. This action comes also as a result of the environmental activists' criticism of the EU Global Paper stating the intention to ask for a high level of Intellecutual Property (IP) standards on European markets. According to environmental activists, such a policy creates problems for developing countries that cannot afford expensive environmentally-friendly technologies. "With a high IPR (intellectual property rights) regime, products and processes are now patented and less accessible (...) So to really achieve the transfer of climate-friendly technology, the biggest incentive would be to eliminate IPRs related to these technologies." said campaigner Meena Raman from Friends of the Earth group. Dalindyebo Shabalala of the Center for International Environmental Law in Geneva believes TRIPS should include clearer provisions on the patent excepts related to public health and environmental emergencies and waiving patents should ensure wider availability of fuel-efficient cars. French Green MEP Alain Lipietz, the author of the EP report drafted in preparation to the international conference on climate change taking place between 3-14 December 2007 in Bali, Indonesia, considers that not only IP rules should be revised but also tariffs on "green goods" should be eliminated and means should be found to subsidise polluting industries. On the other hand, Stavros Dimas, the European commissioner for the environment, stated that the cost of the IP rights in such technologies is a relatively small part of the whole cost and that there are other issues to be taken into consideration when talking about barriers to technology transfer such as the economical policies of the developing countries. He considers that many companies are not willing to invest in developing countries where their IP rights are not protected and "if capacity-building in the host country is inadequate." More discussions on all the types of barriers to the transfer of environmentally-friendly technologies will be held during the present conference in Bali. EU Parliament Urges Change In IP Rules For Environmental Technology (29.11.2007) http://www.ip-watch.org/weblog/index.php?p=851 European Parliament resolution of 29 November 2007 on trade and climate change (29.11.2007) http://www.europarl.europa.eu/sides/getDoc.do?Type=TA&Reference=P6-TA-2007-… ============================================================ 6. UK Retailers blow the whistle on DRM ============================================================ The Entertainment Retailers Association (ERA) asks the music industry to get rid of DRM which they consider responsible for the continuously decreasing of online music sales in UK. The industry music seems to ignore the consumers' preferences who are displeased with the copy protection systems imposing limitations on the content use. Additionally, the occurrence of various incompatible DRM formats has led to confusion and reserve with the consumers who tend to prefer file-sharing, lest they should find themselves in the position of not being able to play the music on their electronic equipment. According to Kim Bayley, ERA director, the DRM is "working against the consumer interest" and "puts consumers off". In a statement to Financial Times, she has made reference to a survey already discussed in the EDRi-gram, carried out by Entertainment Media Research and media law firm Olswang. The study has revealed the fact that four out of five consumers would rather have copy protection free versions of the music they want to buy. Therefore, many of them go to file-sharing peer-to-peer services. Some recording companies, like EMI and Universal have already offered DRM free catalogues and have experienced increased sales after that which is an argument in favour of dropping DRM. During the last three years, an average of one song per resident was sold online in UK, a sign that it's time the music industry gave up DRM if they want to see any improvement in the online sales. UK retailers to record labels: DRM is killing us (21.11.2007) http://arstechnica.com/news.ars/post/20071121-uk-retailers-to-record-labels… UK retailers join the anti-DRM crusade (23.11.2007) http://www.downloadsquad.com/2007/11/23/uk-retailers-join-the-anti-drm-crus… UK retailers complain DRM is "stifling" music (21.11.2007) http://www.macnn.com/articles/07/11/21/uk.retailers.against.drm/ EDRI-gram: DRM-free music is supported by consumers (29.08.2007) http://www.edri.org/edrigram/number5.16/drm-free-music EDRI-gram: DRM debate continues in Europe (28.02.2007) http://www.edri.org/edrigram/number5.4/drm-debate ============================================================ 7. European scientific information - too late on open access? ============================================================ The recent meeting on 22-24 November 2007 of the Competitiveness European Council meeting adopted its conclusions on scientific information in the digital age: access, dissemination and preservation. The conclusions underline the importance of scientific output resulting from publicly funded research being available on the Internet at no cost to the reader under economically viable circumstances, including delayed open access. They also ask the member countries "to systematically assess conditions that affect access to scientific information", including: a.The way in which researchers exercise their copyright on scientific articles; b.The level of investments in the dissemination of scientific information as compared to total investments in research, and c. The use of financial mechanisms to improve access, such as refunding VAT for digital journal subscriptions to libraries. But the Slovenian Minister for Growth, Ziga Tur, considered the conclusions as coming too late, explaining in his blog: "The bottom line is that in the scientific publishing process there is a decreasing value added by the publishers. The research is funded by the governments or the industry, performed by the researchers, papers are written and reviewed by them for free, only at the very end a publisher comes along that takes over the copyright, publishes the work and sells the journal at great expense to the community that created and edited the content for free." He also considers that the document aims too low, in talking only about "delayed open access" and suggesting refunding VAT that would mean "simply subsidizing commercial publishers". The Slovenian Ministry suggests a much more categorical European approach to the open access issues considering that "the explosion of the internet based technologies in the US have been made possible by the (1) open access to software, (2) open standards and (3) freely available scientific articles on the subject. The cited document brings nothing like that to Europe." Council Conclusions on scientific information in the digital age: access, dissemination and preservation - 2832nd Competitiveness (Internal market, Industry and Research) Council meeting (22-23.11.2007) http://www.consilium.europa.eu/ueDocs/cms_Data/docs/pressData/en/intm/97236… Council on Scientific Information in the Digital Age: Too Little Too Late (27.11.2007) http://zturk.blogactiv.eu/archives/4 Latest EU steps in the field of scientific publishing 'too little, too late' (29.11.2007) http://www.euractiv.com/en/science/latest-eu-steps-field-scientific-publish… ============================================================ 8. Third international conference e-Society.Mk 2007 ============================================================ The conference on the topic of "Inclusive e-Government" was organized by the Metamorphosis Foundation last week within the frames of the project "Western Balkans Network for Inclusive e-Government". The project aims at strengthening the cooperation and coordination among all the relevant stakeholders, decision-makers, government representatives, as well as representatives of the business, academic and nongovernmental sector in order to improve the quality and raise the level of usability and accessibility of electronic services provided by the public administration. "Although the inclusion is characteristic for the countries with a more advanced degree of development of the information society, this does not mean that we should not discuss this topic in Macedonia and work on it, since our goal is becoming part of the European society", said Goran Manchev, adviser in the Cabinet of the Minister in charge of Information Society. In the field of inclusion, as Manchev outlined, the Government is conducting projects, such as "Computer for Every Child", the vouchers for the students, intervals of free internet access etc., which, according to him, are an introduction into bridging the digital divide in society. The executive director of the Foundation Open Society Institute - Macedonia, Vladimir Milchin, emphasized that the people working in the central and local administration should increase their knowledge and improve their skills in order to enable the users to increase their influence in society and in shaping the public policies by using ICT : "This means reaching the goal of having an open government and citizens who have access, i.e. coming to a certain degree of inclusion, without which the democratic, nor open society could not be imagined", said Milchin in his address to the conference attendants. "Knowledge and skills are among the prerequisites for establishing an inclusive e-government into an information society. The digital divide is increasing. The gap between the people using ICT technology and the ones that are not is increasing. Therefore, we need to bridge the gap and enable inclusion. We are aware that if Macedonia does not perform well in this area, we will fall behind the European countries", stressed Marjan Gushev, board member of the Metamorphosis foundation. According to him, the "e" in the term "e-Government" stands more for efficient rather than electronic Government, meaning that the Government's activities should be reorganized in order to result in providing better services for the citizens and businesses. The second days focused on best practices in the e-Government. Most participants claimed that the region benefits a lot from the transfer of knowledge about good e-Gov practices from the EU, especially from Austria, Slovenia and Estonia, three of the five top-ranked EU countries in this area, according to Capgemini methodology. On the other hand, reposts from different WBC pointed out not only to the low level of e-Gov sophistication (around 2 out of 4), but also to lack of interest in aspects of inclusion, especially lack of commitment in applying standards for accessibility and usability in existing e-services. Bardhyl Jashari from Metamorphosis Foundation emphasized the importance of cooperation between different societal sectors: governmental, business, educational and civic in overcoming these obstacles. He also pointed out that in the case of Macedonia, around 70% of the population does not use the internet at all, so in order to have truly inclusive e-society, all the sectors must find mechanisms to include this portion of population in the processes of development. About 250 representatives of the governmental, nongovernmental, education and business sector from 11 countries participated at the conference that took place on 29-30 November 2007. E-society.Mk 2007 International Conference http://e-society.org.mk/portal/content/view/24/31/lang,en/ (contribution by EDRi-member Metamorphosis Foundation - Macedonia) ============================================================ 9. Progress in the European Digital Libraries EU Initiative ============================================================ A meeting on 27 November 2007 of a high level group on digital libraries and officials of the European Commission formalised the agreement between European libraries, archives and museums in a common effort to create a European digital library that would give access to a common European cultural and scientific heritage. The EU European Digital Libraries initiative is part of "i2010: European Information Society 2010" initiative launched in June 2006 with the purpose to "foster growth and jobs in the information society and media industries", followed, in August 2006, by the adoption of the Recommendation on digitisation and digital preservation urging "EU Member States to set up large-scale digitisation facilities so as to accelerate the process of getting Europe's cultural heritage on line via the European digital library". In this sense, Member States were encouraged to tackle questions related to copyright and "the systematic preservation of digital content in order to ensure long term access to the material". The idea of European Digital Libraries was backed by the Culture Ministers of all EU Member States and by a resolution adopted by the European Parliament on 27 September 2007. Recently, a European digital library foundation has been created gathering European associations that represent museums, libraries and archives. According to Information Society and Media Commissioner Viviane Reding, the creation of the foundation "shows the commitment of Europe's cultural institutions to work together and make their collections available and searchable to the wide public through a common and multilingual access point online". The launching of a European digital library prototype is planned for November 2008. The prototype will give direct access to at least 2 million digital books, records, photographs, maps, films from the European libraries, archives and museums. It is foreseen that by 2010 the digital library will exceed the initially targeted 6 million digital objects. The success of the initiative depends on the financing of the digitisation and on finding solutions to make copyrighted works searchable through the European digital library. Therefore, the discussions during the meeting on 27 November were focused on finding new ways to finance digitisation through public private partnerships, in finding solutions for mass-digitisation of out of print works and orphan works and on issues related to access to and preservation of scientific information. The group decided to find an agreement by June 2008 to deal with orphan works that would including criteria to look for rightholders and an agreement was also reached by libraries, scientists and scientific publishers to experiment open access to scientific publications which have been under embargo during the last period. Launch of European digital library "on track" (28.11.2007) http://www.europa.eu/rapid/pressReleasesAction.do?reference=IP/07/1784 The European Digital Library: Frequently Asked Questions (25.08.2007) http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/06/311&format=… EDRI-gram: European Parliament resolution on a European digital library (10.10.2007) http://www.edri.org/edrigram/number5.19/ep-digital-library EDRI-gram: Copyright clearing for EU digital libraries project (25.04.2007) http://www.edri.org/edrigram/number5.8/copyright-digital-libraries ============================================================ 10. Recommended Reading ============================================================ Closing speech on Public Security, Privacy and Technology -Franco Frattini, European Commissioner responsible for Justice, Freedom and Security http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/07/728 ============================================================ 11. Agenda ============================================================ 5-7 December 2007, Pisa, Italy Second DELOS Conference on Digital Libraries http://www.delos.info/index.php?option=com_content&task=view&id=606&Itemid=… 27-30 December, Berlin, Germany 24th Chaos Communication Congress http://events.ccc.de/congress/2007/Main_Page 17 January 2008, London, UK Nanotechnology for security and the crime prevention III http://www.nano.org.uk/events/ionevents.htm#security 22 January 2008, London, UK Gov 2.0, or Truly Transformative Government http://www.oii.ox.ac.uk/events/details.cfm?id=169 17-18 June 2008, Seoul, Korea The Future of the Internet Economy - OECD Ministerial Meeting www.oecd.org/FutureInternet 23-25 July 2008, Leuven, Belgium The 8th Privacy Enhancing Technologies Symposium (PETS 2008) http://petsymposium.org/2008/ ============================================================ 12. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 28 members based or with offices in 17 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by zooko 06 Jul '18

06 Jul '18

<p2p-hackers(a)lists.zooko.com > Subject: [p2p-hackers] ANNOUNCING Tahoe-LAFS v1.4 ANNOUNCING Tahoe, the Least-Authority Filesystem, v1.4 The allmydata.org team is pleased to announce the release of version 1.4.1 of "Tahoe", the Lightweight-Authorization Filesystem. This is the first release of Tahoe-LAFS which was created solely as a labor of love by volunteers -- it is no longer funded by allmydata.com (see [1] for details). Tahoe-LAFS is a secure, decentralized, fault-tolerant cloud storage system. All of the source code is publicly available under Free Software, Open Source licences. This filesystem is distributed over multiple servers in such a way the filesystem continues to operate correctly even when some of the servers are unavailable, malfunctioning, or malicious. Here is the one-page explanation of Tahoe's unique security and fault-tolerance properties: http://allmydata.org/source/tahoe/trunk/docs/about.html This is the successor to Tahoe-LAFS v1.3, which was released February 13, 2009 [2]. This is a major new release, adding garbage collection, improved diagnostics and error-reporting, and fixing a critical performance problem when downloading large (many GB) files. See the NEWS file [3] and the known_issues.txt file [4] for more information. Besides the Tahoe core, a crop of related projects have sprung up, including frontends for Windows and Macintosh, two front-ends written in JavaScript, a Ruby interface, a plugin for duplicity, a plugin for TiddlyWiki, a new backup tool named "GridBackup", CIFS/SMB integration, an iPhone app, and three incomplete frontends for FUSE. See the Related Projects page on the wiki: [5]. COMPATIBILITY Tahoe v1.4 is fully compatible with the version 1 series of Tahoe. Files written by v1.4 clients can be read by clients of all versions back to v1.0. v1.4 clients can read files produced by clients of all versions since v1.0. v1.4 servers can serve clients of all versions back to v1.0 and v1.4 clients can use servers of all versions back to v1.0. This is the fifth release in the version 1 series. The version 1 series of Tahoe will be actively supported and maintained for the forseeable future, and future versions of Tahoe will retain the ability to read files and directories produced by Tahoe v1 for the forseeable future. The version 1 branch of Tahoe is the basis of the consumer backup product from Allmydata, Inc. -- http://allmydata.com . WHAT IS IT GOOD FOR? With Tahoe, you can distribute your filesystem across a set of servers, such that if some of them fail or even turn out to be malicious, the entire filesystem continues to be available. You can share your files with other users, using a simple and flexible access control scheme. Because this software is new, we do not categorically recommend it as the sole repository of data which is extremely confidential or precious. However, we believe that erasure coding, strong encryption, Free/Open Source Software and careful engineering make Tahoe safer than common alternatives, such as RAID, removable drive, tape, "on-line storage" or "Cloud storage" systems. This software comes with extensive tests, and there are no known security flaws which would compromise confidentiality or data integrity. (For all currently known issues please see the known_issues.txt file [3].) This release of Tahoe is suitable for the "friendnet" use case [6] -- it is easy to create a filesystem spread over the computers of you and your friends so that you can share disk space and files. LICENCE You may use this package under the GNU General Public License, version 2 or, at your option, any later version. See the file "COPYING.GPL" [7] for the terms of the GNU General Public License, version 2. You may use this package under the Transitive Grace Period Public Licence, version 1 or, at your option, any later version. (The Transitive Grace Period Public Licence has requirements similar to the GPL except that it allows you to wait for up to twelve months after you redistribute a derived work before releasing the source code of your derived work.) See the file "COPYING.TGPPL.html" [8] for the terms of the Transitive Grace Period Public Licence, version 1. (You may choose to use this package under the terms of either licence, at your option.) INSTALLATION Tahoe works on Linux, Mac OS X, Windows, Cygwin, and Solaris, and probably most other systems. Start with "docs/install.html" [9]. HACKING AND COMMUNITY Please join us on the mailing list [10]. Patches are gratefully accepted -- the RoadMap page [11] shows the next improvements that we plan to make and CREDITS [12] lists the names of people who've contributed to the project. The wiki Dev page [13] contains resources for hackers. SPONSORSHIP Tahoe was originally developed thanks to the sponsorship of Allmydata, Inc. [14], a provider of commercial backup services. Allmydata, Inc. created the Tahoe project, and contributed hardware, software, ideas, bug reports, suggestions, demands, and money (employing several Tahoe hackers and instructing them to spend part of their work time on this Free Software project). Also they awarded customized t-shirts to hackers who find security flaws in Tahoe (see http://hacktahoe.org ). After discontinuing funding of Tahoe R&D in early 2009, Allmydata, Inc. has continued to provide servers, co-lo space and bandwidth to the open source project. Thank you to Allmydata, Inc. for their generous and public-spirited support. Zooko Wilcox-O'Hearn on behalf of the allmydata.org team Special acknowledgment goes to Brian Warner, whose superb engineering skills and dedication are primarily responsible for the Tahoe implementation, and significantly responsible for the Tahoe design as well, not to mention most of the docs and tests and many other things besides. April 13, 2009 Boulder, Colorado, USA [1] http://allmydata.org/pipermail/tahoe-dev/2009-March/001461.html [2] http://allmydata.org/trac/tahoe/browser/relnotes.txt?rev=3620 [3] http://allmydata.org/trac/tahoe/browser/NEWS?rev=3835 [4] http://allmydata.org/trac/tahoe/browser/docs/known_issues.txt [5] http://allmydata.org/trac/tahoe/wiki/RelatedProjects [6] http://allmydata.org/trac/tahoe/wiki/UseCases [7] http://allmydata.org/trac/tahoe/browser/COPYING.GPL [8] http://allmydata.org/source/tahoe/trunk/COPYING.TGPPL.html [9] http://allmydata.org/source/tahoe/trunk/docs/install.html [10] http://allmydata.org/cgi-bin/mailman/listinfo/tahoe-dev [11] http://allmydata.org/trac/tahoe/roadmap [12] http://allmydata.org/trac/tahoe/browser/CREDITS?rev=3758 [13] http://allmydata.org/trac/tahoe/wiki/Dev [14] http://allmydata.com --- Tahoe, the Least-Authority Filesystem -- http://allmydata.org store your data: $10/month -- http://allmydata.com/?tracking=zsig I am available for work -- http://zooko.com/risumi.html _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers

1 0

Re: [tor-talk] Tor and HTTPS graphic
by Number Six 06 Jul '18

06 Jul '18

On Tue, Mar 6, 2012, at 04:20 PM, Seth David Schoen wrote: > andrew(a)torproject.is writes: > > > The GPA is in every paper on the topic. But only Seth has the real > > answer. > > I was concerned that the graphic should not make people think that > _no one_ can ever associate them with their browsing when they use > Tor. I've been taught to think of the GPA threat (and other traffic > correlation threats) as real, so I thought people should have some > indication of those threats. Why do you assume that the NSA can break Tor but not HTTPS? As I see it, if you extrapolate the timing attack literature to justify ignoring fixing active attacks, why do you not extrapolate the work on RSA key cracking to assume that the NSA can factor popular website keys in bathtubs full of DNA? Or, at the very least, why not extrapolate it to the NSA compromising one of the 1000-some wildcard root certificates your own SSL Observatory scan has detected? This paywall (ie non-"dumpster available") abstract appears to indicate that the research community is within striking distance of factoring an RSA keys in use by many HTTPS servers today. At least, when compared to how close timing attack research is to breaking Tor. http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=1435370 I guess I'm just wondering: where do we draw the line? In addition to the decentralized HTTPS certificate observatory, one could imagine a network verifying the DH parameters are the same when received by two endpoints of an HTTPS session. If perfect forward secrecy is universally deployed, a bathtub full of DNA or server compromise that yielded an RSA private key for google.com could be used transparently to escape your decentralized observatory scan, but a DH-recording scanning network will still see different DH parameters at the endpoints. But how do deploy such a network? Is planetlab up to the task? Is anyone studying endpoint consensus on DH parameters? Shouldn't they be? It seems like our rabbit hole is very deep. Do we really have what it takes to watch the watchers? I fucking hope so, but it does seem that consensus reality wrt cryptographic security is hard to establish. -- http://www.fastmail.fm - Access all of your messages and folders wherever you are _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Victims of the darkness: Government surveillance and
by EEkid＠aol.com 06 Jul '18

06 Jul '18

intimidation I'm not sure which is more interesting, the story or the source. Jerry ************************************************************************ ****** Victims of the darkness: Government surveillance and intimidation 12/26/2005 13:42 The Bush Administration has consistently harassed citizens who exercise their First Amendment freedoms and voice concerns about government policies "As nightfall does not come at once, neither does oppression. In both instances there is a twilight where everything remains seemingly unchanged, and it is in such a twilight that we must be aware of the change in the air, however slight, lest we become unwitting victims of the darkness." Supreme Court Justice William O. Douglas Not since the notorious McCarthy era of the 1950s, when American freedoms faced extinction, has there been such an attack against the Bill of Rights. The recent media focus on President Bush's authorizing the National Security Agency to spy on ordinary Americans has brought this issue to the forefront. On secret orders from President Bush, the NSA has been monitoring the international phone calls and emails of Americans without warrants. Moreover, the Bush Administration has consistently harassed citizens who exercise their First Amendment freedoms and voice concerns about government policies. The main weapon used in this war is intimidation, specifically through governmental surveillance and government agents. Indeed, the American government has a near paranoia about dissenting citizens. "The Administration and campaign of George W. Bush," writes former Congressman Bob Barr (R-Ga.), "is squelching any possible hint of disagreement or protest at every political rally or gathering." For example, in March of this year, three citizens were removed from President Bush's town hall meeting in Aurora, Colo., because the car they arrived in featured the bumper sticker, "No More Blood for Oil." This past summer, FBI agents went to Windsor, Conn., with a document marked for delivery by hand. On Matianuk Avenue, across from the tennis courts, two special agents found their man. They gave George Christian the letter, which warned him to tell no one - ever - what it said. The letter, which was on FBI stationery, directed Christian to surrender "all subscriber information, billing information and access logs of any person" who used a specific computer at a library branch some distance away. Christian, who manages digital records for three dozen Connecticut libraries, said in an affidavit that he configures his system for privacy. But the vendors of the software Christian operates said their databases can reveal the websites that visitors browse, the e- mail accounts they open and the books they borrow. Christian refused to hand over the records, and his employer, Library Connection, Inc., filed suit for the right to protest the FBI demand in public. This case affords a rare glimpse of an exponentially growing practice of domestic surveillance under some of the heinous provisions of the USA Patriot Act. National security letters, such as the one issued to George Christian, were created in the 1970s for espionage and terrorism investigations. They were originally intended as narrow exceptions in consumer privacy law, enabling the FBI to review in secret the customer records of suspected foreign agents. However, the Patriot Act and Bush Administration guidelines for its use have transformed those letters by permitting clandestine scrutiny of U. S. residents and visitors who are not alleged to be terrorists or spies. "The FBI now issues more than 30,000 national security letters a year," writes Barton Gellman in The Washington Post, "a hundredfold increase over historic norms. The letters - one of which can be used to sweep up the records of many people - are extending the bureau's reach as never before into the telephone calls, correspondence and financial lives of ordinary Americans." Indeed, according to a previously classified document released recently, the FBI has conducted clandestine surveillance on some U. S. residents for as long as 18 months at a time without proper paperwork or oversight. Thus, the government does not limit its attacks to actual terrorists. Ordinary American citizens are the focus as well. Take the case of Selena Jarvis, a social studies teacher at Currituck County High School in North Carolina. She assigned her senior civics and economics class to use photographs to illustrate their freedoms as found in the Bill of Rights. One student photographed a picture of George W. Bush next to his own hand in a thumbs-down position as a way to express his freedom to dissent. However, while developing the student's photographs, a Wal-Mart photo department employee, in obvious need of some education on the Bill of Rights, called the police. They then contacted the Secret Service. But rather than dismissing the case, the Secret Service decided to investigate the matter. The agents interrogated the student and questioned Jarvis. While questioning Jarvis, an agent asked her if she thought the photo was suspicious. Dumbfounded, Jarvis responded, "No, it was a Bill of Rights project!" Jarvis was startled at the claim that the student was a terrorist and called the whole thing "ridiculous." Why would the Secret Service, which is not run by incompetent individuals, take the time to investigate a high school student and his class project? It is safe to assume that the Secret Service knew the student was not a terrorist and wanted to make an example of him for others who might be bold enough to use their right to dissent. After the ordeal, Selena Jarvis commented, "I blame Wal-Mart more than anybody. I was really disgusted with them. But everyone was using poor judgment, from Wal-Mart up to the Secret Service." Unfortunately, this is not the only "ridiculous" case of individuals tattling on their neighbors. For example, Barry Reingold was questioned by the FBI after he criticized the war in Afghanistan in the locker room of his local health club. In another case, Derek Kjar's neighbors reported his bumper sticker of George Bush wearing a crown with the heading "King George - off with his head." As a result, Kjar was interrogated by the Secret Service. In both instances, close contacts of the two men reported them to the authorities. And as if things weren't bad enough, the military is now spying on us. A secret database obtained by NBC News recently reveals that the Department of Defense and the Pentagon have also increased intelligence collection on American citizens inside the country. This includes monitoring peaceful anti-war groups and protests and involves video taping, monitoring the Internet and collecting the name of anyone critical of the government. There is even a toll-free number for anyone interested to report on fellow Americans to the military. And the spying even includes religious groups such as those attending the Quaker Meeting House in Lake Worth, Florida. "On a domestic level, this is unprecedented," says NBC News analyst William Arkin. "I think it is the beginning of enormous problems and enormous mischief for the military." Since 9/11, it has been consistently drummed into our heads by the government, with all its alerts and multi-colored alarms, that terrorists are everywhere and even your next door neighbor could be one. As a result, the government's promotion of fear and paranoia has moved us closer to an Orwellian state where citizens inform on one another. The result is that the citizens often do the job of the police and no longer use good judgment before reporting their neighbors. In the process, such informing citizens are doing away with their own freedoms. These tactics are not new to the world. The Nazi and Soviet secret police of former regimes were infamous for such tactics. The police controlled the people through fear, and the subsequent result was a totalitarian state. They turned their respective population into a society of informers. Aleksandr Solzhenitsyn, the Nobel Peace Prize-winning author and former Soviet dissident, once spoke of how fear destroys the will of the people. He noted how the Russian people would kneel inside the doors of their apartments, pressing their ears to listen when the KGB came at midnight to arrest a neighbor who had spoken out against the government. Solzhenitsyn said that if all the people would have come out and driven off the secret police, sheer public opinion would have demoralized the effort to subdue a free people. But fear and paranoia kept the people at bay. We should not be afraid of government agents, whether employed by the FBI, the military or local authorities. Their salaries are paid through our tax dollars. Supposedly, they are our servants. Truly free societies do not function that way. Our fear of government servants is a clear indication of ominous things to come. If citizens are too frightened to use their freedoms, then those freedoms will become extinct. And the darkness will be complete. http://english.pravda.ru/mailbox/22/101/399/16678_surveillance.html ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Victims of the darkness: Government surveillance and
by David Farber 06 Jul '18

06 Jul '18

intimidation X-Mailer: Apple Mail (2.746.2) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

Re: [tor-talk] Tor and HTTPS graphic
by Number Six 06 Jul '18

06 Jul '18

On Tue, Mar 6, 2012, at 04:20 PM, Seth David Schoen wrote: > andrew(a)torproject.is writes: > > > The GPA is in every paper on the topic. But only Seth has the real > > answer. > > I was concerned that the graphic should not make people think that > _no one_ can ever associate them with their browsing when they use > Tor. I've been taught to think of the GPA threat (and other traffic > correlation threats) as real, so I thought people should have some > indication of those threats. Why do you assume that the NSA can break Tor but not HTTPS? As I see it, if you extrapolate the timing attack literature to justify ignoring fixing active attacks, why do you not extrapolate the work on RSA key cracking to assume that the NSA can factor popular website keys in bathtubs full of DNA? Or, at the very least, why not extrapolate it to the NSA compromising one of the 1000-some wildcard root certificates your own SSL Observatory scan has detected? This paywall (ie non-"dumpster available") abstract appears to indicate that the research community is within striking distance of factoring an RSA keys in use by many HTTPS servers today. At least, when compared to how close timing attack research is to breaking Tor. http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=1435370 I guess I'm just wondering: where do we draw the line? In addition to the decentralized HTTPS certificate observatory, one could imagine a network verifying the DH parameters are the same when received by two endpoints of an HTTPS session. If perfect forward secrecy is universally deployed, a bathtub full of DNA or server compromise that yielded an RSA private key for google.com could be used transparently to escape your decentralized observatory scan, but a DH-recording scanning network will still see different DH parameters at the endpoints. But how do deploy such a network? Is planetlab up to the task? Is anyone studying endpoint consensus on DH parameters? Shouldn't they be? It seems like our rabbit hole is very deep. Do we really have what it takes to watch the watchers? I fucking hope so, but it does seem that consensus reality wrt cryptographic security is hard to establish. -- http://www.fastmail.fm - Access all of your messages and folders wherever you are _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0