June 2014 - cypherpunks - lists.cpunks.org

[was: Internet Giants erect barriers to spy agencies]
by coderman 07 Jun '14

07 Jun '14

On Fri, Jun 6, 2014 at 10:50 PM, jim bell <jamesdbell9(a)yahoo.com> wrote: > ... > After years of cooperating with the government, the immediate goal now is to > thwart Washington — as well as Beijing and Moscow. i'm holding my breath...

1 0

Fwd: Help investigate cell phone snooping by police nationwide
by coderman 07 Jun '14

07 Jun '14

---------- Forwarded message ---------- From: Michael at MuckRock <michael(a)muckrock.com> Date: Fri, Jun 6, 2014 at 7:53 AM Subject: Help investigate cell phone snooping by police nationwide Hi, Right now, we're gearing for MuckRock's biggest investigative project yet, and we need your help. First, a little context. Local police departments across America are increasingly tapping into information from your cell phone: Your location, who you're with, who you are calling. Using fake cell phone towers, often called Stingrays, they generally don't even need a warrant, and have relatively few restrictions on who, when, and what they collect. Or how they use it. Since these programs are often funded by federal grants, very few people outside of law enforcement know how, or even if, they're being used, with almost non-existent debate about if this information should be collected, and what limits should be set for for how it's used or how long it's kept. This is where you come in. We're launching this project on Beacon Reader, where a donation of just $5, about what it costs for us to successfully file a request, can make a big difference. Just like with the Drone Census, often times MuckRock is the *only* group asking for this information, which otherwise would never be made public. You can support the project at this link, and, again, even just $5 can make a huge difference: https://www.muckrock.com/ If you're not in a position to help financially, we would still really appreciate your help — share what we're up to with your friends, sending in news articles you see or tips regarding cell phone tracking, and, in a few days, sending in information regarding which departments you'd like us to file with through a special page on MuckRock. Thanks for all your support in the past, and we're looking forward to working with you to shine a light on this under-reported area. Thanks, Michael

3 5

Re: [cryptome] Re: Fwd: Help investigate cell phone snooping by police nationwide
by coderman 07 Jun '14

07 Jun '14

On Fri, Jun 6, 2014 at 8:42 PM, <shelley(a)misanthropia.info> wrote: >.... > Unfortunately, using airplane mode is not enough to keep you from being > tracked. You must remove the battery. i can confirm this directly. a ride into Vegas for DC 20 demonstrated that Alexander's toys have the ability to inject into receive only (airplane mode) and tip to exploitation. (baseband exploits being exceptional at leaking keys, elevating privs, and erasing tracks...) battery out or faraday caged the only effective options. (or as Snowden demonstrated, put in a fridge to avoid scrutiny and audio capture the best idea. non-serial tower associations are an anomaly alerted and acted upon.)

1 0

Reset the Net
by Jerry 06 Jun '14

06 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Anyone else find it ironic that the reset the net site asks you to take back your privacy online by providing your email address? "On June 5, I will take strong steps to protect my freedom from government mass surveillance. I expect the services I use to do the same." https://www.resetthenet.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJTkHskAAoJEBuh/pdhlD5190QH/07t6NrJjKWlJr1LMQFFmx1S l6mDhq1DYO97lio2AYslNv4bL98cIK/uWpI/Z3AsnJfvhzC9rl5MhiYkmeNbSt4U cPmPA9OWJtWPEU1d1978rAWfz3+OnbLgnm9FYGJyJpcnokedomldJnerj2pVp9/+ OmEd9JsirDug0sW6Uf0m8gMPTLvrbC9QmGdM7QJw8Ela1+iN9HJbCn3iiW2aH5v5 QNw4zFbpdTkRG6enkVSkUk5Z3J9lmIO6w9m1rmeQ3MABhyzOOsbqqNmr04plD0QW Qnisa9XbeWgxz+v1puV0+n2oWBJk78M70a8s9b+jrhXHiAtPV5uzyddrqo3sV60= =zPS+ -----END PGP SIGNATURE-----

4 3

Cellphone Operator Reveals Scale of Government Snooping
by jim bell 06 Jun '14

06 Jun '14

http://news.yahoo.com/cellphone-operator-reveals-scale-govt-snooping-114153… LONDON (AP) — Government snooping into phone networks is extensive worldwide, one of the world's largest cellphone companies revealed Friday, saying that several countries demand direct access to its networks without warrant or prior notice. The most explosive revelation was that in six countries, authorities require immediate access to an operator's network — bypassing legal niceties like warrants. It did not name the countries for legal reasons and to safeguard employees working there.The detailed report from Vodafone, which covers the 29 countries in which it operates in Europe, Africa and Asia, provides the most comprehensive look to date at how governments monitor mobile phone communications. It amounts to a call for a debate on the issue as businesses increasingly worry about being seen as worthy of trust. "In those countries, Vodafone will not receive any form of demand for lawful interception access as the relevant agencies and authorities already have permanent access to customer communications via their own direct link," the report said. Vodafone's report comes one year after former NSA systems analyst Edward Snowden revealed that U.S. and other countries' intelligence agencies routinely gathered huge amounts of private data belonging to millions of innocent people in America and across the globe. The revelations have focused particular attention on the role of Western technology and telecommunications firms, which stand accused of facilitating the mass surveillance by giving spies unrestricted access to their networks. Several Silicon Valley companies have since attempted to restore consumers' trust by publishing data on government surveillance. By making its report public, together with a breakdown on requests for information, Vodafone took the unusual step of entering the international debate about balancing the rights of privacy against security. Rather than being stuck with responsibility and consumer backlash when consumers realize their data has been scooped up without their knowledge, companies like Vodafone have decided it is time to push for a debate.But telecoms companies found themselves in an even more uncomfortable position. Historically closer to governments since many were once state-owned, telecoms companies are much more heavily regulated and have employees on the ground — making them more sensitive to government demands for data. "Companies are recognizing they have a responsibility to disclose government access," Daniel Castro, senior analyst for the Information Technology and Innovation Foundation in Washington, D.C. "This is new." The study comes at a time when other businesses are also calling for a revamp of laws too outdated to stand up to the quickly changing telecommunications universe. Executives in Silicon Valley, for example, have stepped up pressure on President Barack Obama to curb the U.S. government surveillance programs that collect information off the Internet. "They want their customers to be able to trust them to store their data in a private and secure manner," Castro said.Twitter Inc., LinkedIn Corp., AOL Inc., Google Inc., Apple Inc., Yahoo Inc., Facebook Inc. and Microsoft Corp. are pushing for tighter controls over electronic espionage — fearing that eavesdropping threatens the technology industry's financial livelihood. Vodafone's report is also seen by some as an effort to turn the page on the company's embarrassing role in the protests that toppled Egyptian strongman Hosni Mubarak in 2011. As the protests raged, Vodafone bombarded its Egyptian subscribers with pro-government text messages. At the time, the company said it had no choice but to comply, but was severely criticized for its actions. A change in culture followed. "They took a hard lesson there," said Cynthia Wong, a senior internet researcher at Human Rights Watch. "Even if the government is the ultimate problem, they realized they needed to take steps to mitigate harm to their users." Civil rights advocates applauded Vodafone for releasing the report, and cracking open the debate, even as they expressed alarm at the infringements into civil rights. "For governments to access phone calls at the flick of a switch is unprecedented and terrifying," said Shami Chakrabarti, director of the human rights group Liberty, adding that the Snowden revelations showed the Internet was already being treated as "fair game." "Bluster that all is well is wearing pretty thin - our analogue laws need a digital overhaul," she said. Though some of the governments included in the report were able to block disclosure of any aspect of how interception was conducted, the report is unique in that it offers insight into how governments conduct surveillance. Though some of the U.S. operators, such as AT&T and Verizon offered information amid the Snowden allegations, the level of detail is minuscule compared with Friday's report, Wong said. Civil rights advocates weren't the only ones applauding Vodafone's actions. Norway's Telenor Group, which also has operations across Eastern Europe and Asia, offered support, noting governments have the ultimate responsibility to act. The countries included in the report are: Albania, Australia, Belgium, the Czech Republic, Congo, Egypt, Fiji, France, Germany, Ghana, Greece, Hungary, India, Ireland, Italy, Kenya, Lesotho, Malta, Mozambique, the Netherlands, New Zealand, Portugal, Qatar, Romania, South Africa, Spain, Tanzania, Turkey and the U.K. Associated Press Writers Raphael Satter in London, Jan M. Olsen in Copenhagen contributed to this report.

2 1

Google'es End-to-End
by rysiek 06 Jun '14

06 Jun '14

Hi there, not sure what to think about this one: http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encrypti… Technical specs: https://code.google.com/p/end-to-end/ -- Pozdr rysiek

10 19

"a skilled backdoor-writer can defeat skilled auditors"?
by rysiek 05 Jun '14

05 Jun '14

Hi there, in a different thread, Cam posted a link containing this gem: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - In short several very skilled security auditors examined a small Python program — about 100 lines of code — into which three bugs had been inserted by the authors. There was an “easy,” “medium,” and “hard” backdoor. There were three or four teams of auditors. 1. One auditor found the “easy” and the “medium” ones in about 70 minutes, and then spent the rest of the day failing to find any other bugs. 2. One team of two auditors found the “easy” bug in about five hours, and spent the rest of the day failing to find any other bugs. 3. One auditor found the “easy” bug in about four hours, and then stopped. 4. One auditor either found no bugs or else was on a team with the third auditor — the report is unclear. See Chapter 7 of Yee’s report for these details. I should emphasize that that I personally consider these people to be extremely skilled. One possible conclusion that could be drawn from this experience is that a skilled backdoor-writer can defeat skilled auditors. This hypothesis holds that only accidental bugs can be reliably detected by auditors, not deliberately hidden bugs. Anyway, as far as I understand the bugs you folks left in were accidental bugs that you then deliberately didn’t-fix, rather than bugs that you intentionally made hard-to-spot. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://blog.spideroak.com/20140220090004-responsibly-bringing-new-cryptogr… I have no problem believing it is thus, but can't help wondering if there are any ways to mitigate it. -- Pozdr rysiek

7 13

[p2p-hackers] Reset The Net! And a LeastAuthority.com update
by Zooko Wilcox-OHearn 05 Jun '14

05 Jun '14

It is Reset The Net day! It is the one year anniversary of the Snowden disclosures. A coalition of many companies, organizations, and individuals is using this to urge people to adopt and deploy encryption software: https://ResetTheNet.org At LeastAuthority.com, we're announcing an upgrade to our verifiably end-to-end-encrypted cloud storage service: https://leastauthority.com/blog/ This service is all Free and Open Source software, based on the Tahoe-LAFS project: https://Tahoe-LAFS.org Regards, Zooko Wilcox-O'Hearn Founder, CEO, and Customer Support Rep https://LeastAuthority.com Freedom matters. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers

1 0

stinky shit in fedland - lawful^H^H^Hless mobile fuckery cover-ups in progress...
by coderman 04 Jun '14

04 Jun '14

https://www.aclu.org/blog/national-security-technology-and-liberty/us-marsh… --- U.S. Marshals Seize Local Cops’ Cell Phone Tracking Files in Extraordinary Attempt to Keep Information From Public 06/03/2014 Government Secrecy By Nathan Freed Wessler, Staff Attorney, ACLU Speech, Privacy & Technology Project at 12:13pm A run-of-the-mill public records request about cell phone surveillance submitted to a local police department in Florida has unearthed blatant violations of open government laws, including an incredible seizure of state records by the U.S. Marshals Service, which is part of the Justice Department. Today the ACLU and the ACLU of Florida filed an emergency motion in state court to preserve the public’s right of access to government records. Over the past several months, the ACLU has filed dozens of public records requests with Florida law enforcement agencies seeking information about their use of controversial cell phone tracking devices known as “stingrays.” (The devices are also known as “cell site simulators” or “IMSI catchers.”) Stingrays track phones by mimicking service providers’ cell towers and sending out powerful signals that trick nearby phones — including phones of countless bystanders — into sending their locations and identifying information. The Florida agencies’ responses to our requests have varied widely, with some stonewalling and others releasing records. The most recent request went to the Sarasota Police Department, and the fallout from that request has raised red flag after red flag. RED FLAG #1: The Sarasota Police initially told us that they had responsive records, including applications filed by and orders issued to a local detective under the state “trap and trace” statute that he had relied on for authorization to conduct stingray surveillance. That raised the first red flag, since trap and trace orders are typically used to gather limited information about the phone numbers of incoming calls, not to track cell phones inside private spaces or conduct dragnet surveillance. And, such orders require a very low legal standard. As one federal magistrate judge has held, police should be permitted to use stingrays only after obtaining a probable cause warrant, if at all. RED FLAG #2: The Sarasota Police set up an appointment for us to inspect the applications and orders, as required by Florida law. But a few hours before that appointment, an assistant city attorney sent an email cancelling the meeting on the basis that the U.S. Marshals Service was claiming the records as their own and instructing the local cops not to release them. Their explanation: the Marshals Service had deputized the local officer, and therefore the records were actually the property of the federal government. We emphatically disagree, since the Sarasota detective created the applications, brought them to court, and retained the applications and orders in his files. Merely giving him a second title (“Special Deputy U.S. Marshal”) does not change these facts. But regardless, once the Sarasota Police Department received our records request, state law required them to hold onto the records for at least 30 days, to give us an opportunity to go to court and seek an order for release of the documents. Instead of complying with that clear legal obligation, the local police allowed the records to disappear by letting the U.S. Marshals drive down from their office in Tampa, seize the physical files, and move them to an unknown location. We’ve seen our fair share of federal government attempts to keep records about stingrays secret, but we’ve never seen an actual physical raid on state records in order to conceal them from public view. RED FLAG #3: Realizing we weren’t going to get hold of the Sarasota Police Department’s copies of the applications and orders anytime soon, we asked the county court if we could obtain copies from its files. Incredibly, the court said it had no copies. The court doesn’t even have docket entries indicating that applications were filed or orders issued. Apparently, the local detective came to court with a single paper copy of the application and proposed order, and then walked out with the same papers once signed by a judge. Court rules — and the First Amendment — require judges to retain copies of judicial records and to make them available to the public, but the court (and the detective) completely flouted those requirements here. The ACLU’s emergency motion seeks a temporary injunction preventing the Sarasota Police Department from transferring any more files to the U.S. Marshals, as well as a determination that the police violated state law by sending the stingray applications and orders to the Marshals Service in the first place and an order requiring the police to produce the records. When the government obtains court authorization to use invasive surveillance equipment, the public should not be kept in the dark. We have open records laws for a reason, but they mean nothing if the government can violate their clear commands at its whim.

1 3

#PayPal14: Distributed Donations of Support
by Douglas Lucas 04 Jun '14

04 Jun '14

Hi cypherpunks, I am one of the original authors of the May 12 press release http://pastebin.com/39nSLf94 "No Place to Hide: #PayPal14, Glenn Greenwald, and the PayPal Billionaire" Greenbacks' billionaire backer Pierre Omidyar makes the PayPal 14 pay $86,000 for Distributed Denial-of-Service attacks (DDOS), so we are promoting Distributed Donations-of-Support (DDOS): http://www.gofundme.com/Paypal14 Without need of celebrities or go-betweens, you can donate directly to the PayPal 14 at that page. If you can't chip in, please share that page and ask people to go back to their roots by helping political prisoners/hostages directly. The first week the op raised $5,052. The second week the op raised $2,298. Tonight alone the op raised $180. We had no SONY movie deal and didn't redact anything. I am sure people who have difficulty unhitching their wagons from celebrities and 'Thought Leaders' will say what a bad idea it is to attack Redaction White Man who is telling multi-millionaire anchors about the NSA to an audience who has already gotten the message the NSA spies on every undefended gizmo. By the way, the US is not the world; did you know Nigeria has 'NSA capability' from Israeli tech? The op got two cool articles the first week: http://www.ibtimes.co.uk/anonymous-paypal14-campaign-spreads-pirated-copy-g… http://rt.com/usa/158976-greenwald-anonymous-paypal-pastebin/ And best of all, got brave people protesting Greenbacks' Boston tour stop in person (pics!): https://twitter.com/Lyzard/status/467085082734624768 https://twitter.com/Aan_ath/status/467101897627668480 https://twitter.com/Free_Hammond/status/467111734579568641 https://twitter.com/Aan_ath/status/467154122995924992 Op-ed expected later this week. Thanks, Douglas

1 0