Re traffic analysis, cpunk remailers, DC-nets. Electric Dreams Weekly column for The Asian Age by Rishab Aiyer Ghosh #41, 19/December/1994: Envelopes speak - tracking information flow Digital communication is extremely vulnerable to interception, sorting and archival. Current electronic mail systems offer less privacy than open messages on postcards - at least it's impractical to keep copies of enormous quantities of paper mail. Encryption, which is slowly gaining popularity as a means of ensuring a degree of privacy of e-mail and eventually voice communication, is analogous to letters in sealed envelopes. This protects against one invasion of privacy - of communication content, or what you write and read. However there is at present little protection against a possibly more serious invasion of privacy, that of communication context, or to whom you send and from whom you receive messages. As such messages can include anything from New Year greetings to a friend to contract negotiations to CD purchases, there is a lot that can be known about you from addressing details on the most secure, encrypted mail - the tale the envelopes tell. Currently, whether you make a phone call or send an e- mail, your communication is routed through a host of different sites - telephone exchanges or computers around the world. It may not be technically possible for these sites to extract the content of your message because of encryption. It is not feasible, and usually illegal, for them to archive traffic. But it is very easy to archive routing information, and such logs are routinely kept by computers on the e-mail network as well as telephone exchanges. The legal process of getting access to addressing information is much simpler than for intercepting communication content itself, because it is often assumed that such information is, on its own, useless. Actually it is probably more useful than interception. Such traffic analysis helped track Iranian assassins in France earlier this year, using records of 20,000 phone calls from public booths. It could also be used for intrusive monitoring of your income or hospital visits, or for that matter to crack down on Tibetan human rights activists. Cypherpunks - the assorted citizens of cyberspace who try to protect privacy through the use of technology - may have a solution. Elated by the success of anonymous remailers - special e-mail addresses that repost messages after removing any traces of the original sender, especially favoured in discussion forums for victims of sexual abuse - they are now working on methods to reduce, if not eliminate altogether, the menace of traffic analysis. Without these, it would be possible to associate anonymous messages with their original senders by carefully matching arrival times in various system logs. Remailers and their users resort to several countermeasures. They collect incoming mail and repost anonymized versions in batches of random sizes, to avoid a correlation between mail arrival times. They route mail through random groups of remailers, often in different countries, to make tracing posts back to the source harder. And of course, they encrypt as much traffic as possible. Although remailers prevent reverse traffic analysis - tracking mail from the recipient to the sender - they don't protect against traffic analysis from source - tracking the output of a specific site or individual. Dining Cryptographer networks, or DC-Nets were developed almost a decade ago as a networking protocol allowing a group of people to broadcast messages, while making it impossible to identify the specific source from within the group. Unfortunately DC-Nets have not yet gone beyond the early experiments; but there is hope that they will soon silence the electronic envelopes of traffic analysis. Privacy and freedom of expression are basic human rights. Where laws and international treaties have failed to protect them, it looks increasingly likely that in a borderless world of digital signals, technology will. Rishab Aiyer Ghosh is a freelance technology consultant and writer. You can reach him through voice mail (+91 11 3760335) or e-mail (rishab@dxm.ernet.in). --====(C) Copyright 1994 Rishab Aiyer Ghosh. ALL RIGHTS RESERVED====-- This article may be redistributed in electronic form only, PROVIDED THAT THE ARTICLE AND THIS NOTICE REMAIN INTACT. This article MAY NOT UNDER ANY CIRCUMSTANCES be redistributed in any non-electronic form, or redistributed in any form for compensation of any kind, WITHOUT PRIOR WRITTEN PERMISSION from Rishab Aiyer Ghosh (rishab@dxm.ernet.in) --==================================================================--