July 2014 - cypherpunks - lists.cpunks.org

data mine the snowden files [was: open the snowden files]
by coderman 12 Jul '14

12 Jul '14

On Sat, Jul 5, 2014 at 11:29 AM, Geert Lovink <geert(a)desk.nl> wrote: > ... > the snowden files are of public interest. but only a small circle of > people is able to access, read, analyze, interpret and publish them. and > only a very small percentage of those files has been made available to > the public... > > what can be done about this situation? are we able to find a way to > "open" this data? and in the course of this create a modell for future > leaks? > .. > prior to my intervention harding had already hinted at some very obvious > limitations of the ongoing investigation, alluding to various reasons > why those "few lucky ones" are incapable to deal with the investigation > challenge in an approriate manner: "we are not technical experts" or > "after two hours your eyes pop out". inspite of this, harding seemed > unprepared to refelect the possibility to open the small circle of > analysts dealing with the snowden files. an impasse of extremes, a full or limited dump off the table. let's find a middle ground. how best to proceed? > * last but not least: one should work out a concept/model for > transferring those files into the public domain -- taking also into > account the obvious problems of "security" and "government pressure". > > it would be great of we could start a debate about in order to build a > case for the future of handling big data leaks in a more democratic and > sustainable manner. very great indeed. what kind of tools would make the journalists involved more effective and productive? 1. using the leaks currently published, devise a framework for "data mining" the leak documents, aka, generating metadata from the data and operating various matches and relevance across the metadata to narrow the search and aggregate related efforts or technologies across their compartmentalized worlds. 2. #1 requires that there is an index of special terms, techniques, suppliers, code names, algorithms, etc. that used to generate the metadata for deeper search and tie to general themes of surveillance. 3. extrapolating from current leaks, also look toward recent advancements and specific technical tell tales of interest. doping silicon as tailored access technique? this could refer to compromised runs of security processors for desired targets. etc. 4. justifying technical detail specifically. we have seen so little technical detail of the source code / hardware design level. how best to justify source code - explaining that the language choice, the nature of the algorithms, the structure of the distributed computing upon which it runs all conveys critical technical details important to understand what part of our technologies are compromised, and guiding the fixes required to protect against such compromises? in short, it would behoove us to build tools to make the journalists more effective, rather than bitch about not being included in the inner circle. (sadly, many good knowledge discovery tools are proprietary and applied to open source intelligence) what types of features would you want such a leak-assistant software to have? what types of existing tools, if any, would provide these capabilities? best regards,

6 12

Universities giving personal health information to NSA
by James Murphy 12 Jul '14

12 Jul '14

Seen in: http://www.healthyhorns.utexas.edu/IMAGES/pdf/privacypractices.pdf http://www.cmhc.utexas.edu/ppn.html What Are Other Way UHS [University Health Services] May Use Your PHI [Personal Health Information]? - National security and intelligence activities. No warrant, no judge, just "activities." A quick search shows that this privacy policy is spreading. How can I stop it? I get the feeling calling management's phone isn't going to do much. -- James T. Murphy III jtmurphy(a)cmu.edu PGP Key-ID: 0x67E3BC49, available at keys.gnupg.net, pgp.mit.edu.

1 0

Chile, project to modify the penal code.
by deoxyt2 12 Jul '14

12 Jul '14

Attached document [es] which attempts to modify the penal code of Chile, which involves reducing the freedom of expression in our country. A part of the amendments says: Add how numeral 3rd of article 261 of the title VI: Those who make threats or utter insults against the authority by means of electronic platforms, either textual or graphical, form being considered as aggravating circumstance that don't do it with your true identity or that attempt to impede the identification of the computer from which the message spreads. Regards. deoxyt2.-

2 1

GeoIP is a threat to democracy
by Nicolas Bourbaki 11 Jul '14

11 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It seemed logical that old-world media companies would want to restrict access to content on the Internet. GeoIP was then used to induce distribution barriers analogous to those found offline so that existing models of rent extraction could survive. And while this is something most of us would be fine with leaving to the invisible hand of the market we can not take the same stance when governments start to use these measures to dictate who is a citizen, and who is not, and who is provided civil liberties and who is not. This is what the XKeyscore rules made clear was happening and will continue to happen in the future. The internet standards and governing bodies cannot relinquish themselves of political responsibility any longer. The structure of a protocol will dictate our behavior and in this world there is no such thing as an agnostic protocol. The term "neutrality" is false. In the context of service providers battling with media providers over who gets a larger share of rent from consumers, "neutrality" may be the agreed upon term but the policies that result from this debate will have real impact on our behavior, the ethics of the protocol, and our liberties. Once a neutral protocol is understood as an oxymoron standards bodies with charters claiming to serve the betterment of all nations, corporations and consumers should be clearly seen for what they are: a new Tower of Babel. Those of us still placing stones one on top of the other within these institutions should take a moment to look at our work and ask what are we actually doing. In 2010 the DHS went against their own charter and hijacked ICANN's to take down hundreds of domains for unclear copyright claims. Why is ICANN still relevant when decentralized models could easily replace them when supported by either the EU, Google or Firefox? And when the NSA can with absolutely no oversight claim that the location of an IP in some table dictates who gets civil liberties, why have we not replaced BGP or at least begun to build parallel models within universities or like minded corporations that could support reverse tunnels through collision free identities similar to Tor's onion service handles? The number of protocols that falsely advertised as agnostic are many. We should be ashamed that it took such a scandal as pervasive western surveillance to awaken us to this falsehood when so many, living under more hostel regimes, have lived with the tools of oppression we built into these protocols from the very start. If we cannot convince our institutions to take fixing these falsehoods seriously by considering civil liberties within the protocol, and overcome the obstacles of legacy systems, and work for support for parallel models, than at least we can hasten the demise of this Babel to start anew. Indeed this may sadden optimists such as Larry Page and others that are waiting for technology to become our messiah. But as Benjamin Franklin would say, those who would trade liberated networks for efficient networks deserve neither. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJTv3iAAAoJEHi6xtksL8/uJo4P/jf7RVFFJKtUD5VmEzWUr7eK 2B74/ksSqjJWyqHCVcWCRVIQpokzgBq6cwITNRky8ahh0I1+4NORJVOj++n9b6d0 4Wv2mihZpEdIOLOZZESSYgb05L9rPXuX8HTdOtWkbFgpcofXqO59Q1Y6xOKhdZlI 2PwZTXUkmnqycv7cE1n6GgYrR41M+RZzXSiEEHqeVi3pbfYGEaTTX78vcmYzmMGP E7NlJzUvwWRLZMnX9+RN0qUiZQsqKRhOYwfl3Pj7XOo7GNlUqGcphY+cQUHTSNf5 i3HZbblq3UDCAQ7kWFiX+yj5NGVAyfUVBYxJx0/RrJf5zcG9JfzKPXuOtlfeq/yF G9SJ+qCydnCzDmdZCphw0pcGOZnDRBPQzUjd+bdjpBbv2y76Jz3zKzj3Jv1QjkeN NMaw7fGfJ4uTCddFJv2gLdgB0BZta6shhqBoca3k03qWJAmKkp4/559ApoZo8Eyz Gg8+iwPQPsew/2SpXtV6uj1jyLcy36jM1F0IC4OkfGwAFyHJ+Xy/QQehJLlZ+yPO r+aLDIN1+a1ydLINCcv9OhVQCuUO9vfPah0TB2Jql+kD05MNfMnDtTMYVgQaMlcd o+QOj9U2fhVN5qWpMWoxathO0k+L1nwIMUqpMi6GOMS9wqw8pUCdoBhDka/FElQG 50CdY4PooGDfOksxeF+G =3CPP -----END PGP SIGNATURE-----

1 0

tools used by intelligence analysts
by Eugen Leitl 11 Jul '14

11 Jul '14

*ORA for network analysis http://www.casos.cs.cmu.edu/projects/ora/ Pentaho for data transformation http://www.pentaho.com/ Rapid Miner for data mining http://sourceforge.net/projects/rapidminer/ Orange for data visualisations and analysis http://orange.biolab.si/ Maltego for the analysis of networks between people, companies, websites, etc. http://www.paterva.com/web6/products/maltego.php Apache Hadoop for large-scale, distributed computing and analysis Axis Pro http://www.textronsystems.com/products/advanced-information/axis-pro Starlight http://starlight.pnnl.gov/ Analyst's Notebook http://www-03.ibm.com/software/products/en/analysts-notebook-family Palantir http://www.palantir.com/products/ XPLR witk Reddit plugin https://pay.reddit.com/r/TheoryOfReddit/comments/1um89b/preddit_a_subreddit… Tiny Tiny Rss http://tt-rss.org/redmine/projects/tt-rss/wiki Pligg http://pligg.com/ Twitter, Reddit, ... ARC GIS CPOF http://en.wikipedia.org/wiki/Command_Post_of_the_Future Metasploit Oryon http://sourceforge.net/projects/oryon/ (?) Investigative Dashboard https://investigativedashboard.org/ (?)

4 3

Silent Circle Takes on Phones, Skype, Telecoms
by John Young 11 Jul '14

11 Jul '14

https://blog.silentcircle.com/why-are-we-competing-with-phone-makers-skype-…

1 0

[Server-sky] Server sky and social architecture
by Eugen Leitl 10 Jul '14

10 Jul '14

----- Forwarded message from Keith Lofstrom <keithl(a)kl-ic.com> ----- Date: Wed, 9 Jul 2014 11:43:47 -0700 From: Keith Lofstrom <keithl(a)kl-ic.com> To: Server Sky - Internet and Computing in Orbit <server-sky(a)server-sky.com> Subject: [Server-sky] Server sky and social architecture Message-ID: <20140709184347.GA5290(a)gate.kl-ic.com> User-Agent: Mutt/1.4.2.2i Reply-To: keithl(a)keithl.com Inspired by a brief conversation with Cory Doctorow at his presentation 2014 July 8, Tuesday: http://server-sky.com/CodeLawHardware Keith -- Keith Lofstrom keithl(a)keithl.com _______________________________________________ Server-sky mailing list Server-sky(a)lists.server-sky.com http://lists.server-sky.com/mailman/listinfo/server-sky ----- End forwarded message ----- Code is Law, Hardware is Code's Language CodeLawHardware The Law of Law is language. If your language is richly metaphorical and contains the word "schadenfreude", you will annex the Sudetenland, gas most of your ethnic minorities, and a surviving ethnic outlier will use your language to express general relativity. Other languages better express other crimes and concepts. A linguist will tell you all languages can express all concepts - languages are Turing complete - but this fashionable conceit does not tell us why different cultures do different things. Code is law. Hardware is the language and law of code. Code can only do what hardware permits. A Turing complete machine can manufacture any set of symbols from any other set, but those symbols cannot go where the hardware doesn't connect. In 1990 I designed a chip, a non-blocking crossbar routing device, for the startup I-Cube Design Systems. This chip routed signals from any pin to any other pin, and could route 240 inputs to any combination of 240 other outputs. But it also had fanout - it could route an input to two or more outputs. 160 inputs could become 320 outputs. This was useful for the original task - hardware logic simulation. When the original logic simulator customers became enmired in patent lawsuits, I-Cube found a new customer, another small startup called Cisco. Cisco's routers distributed the backbone of the early internet, and still route most of it. I realize, decades later, that I made one of the architectural decisions that allows the NSA to watch you as you read this webpage. Cisco's routers flowed bitstreams, not "packets", a software metaphor for a time-bounded sequence of bits. Packet headers told the router which flow got the bits, the router told the crossbar device which path the bits should take. Sending the bits to more than one place was implicit in how the hardware worked, because the hardware had fanout. Cisco remains, I-Cube was killed by incompetent venture capitalists. I'm not party to how Cisco designs routers today, but fanout is implicit in dataflow, hardware can stream one transmitter to multiple receivers, tracelessly. Software is merely "judicial opinion" applied to that hardware, and we non-electrical macroscopic human beings only have opinions, not sure knowledge, about how the bits are actually moving and transforming from memory location to other (possibly multiple) memory locations. Software can encrypt - or it can pretend to. Software becomes machine instructions via a compiler. Dennis Ritchie taught us that a compiler emits machine instructions chosen by the compiler author, who can override the decisions of the source code author. The hardware author can override both. The hard disk manufacturer decides what firmware bytes go on the boot tracks of your hard drive, the disk firmware decides what bytes you actually get to your RAM from which disk track, and this firmware is invisible to the machine code it dispenses. In an age of Viterbi coding and VLSI disk chips, even a hardware logic analyzer may not tell you what's actually on the boot tracks. For sure knowledge, you will need your own hardware, either your own replacement disk chips or a focused ion beam milling system (FIB) to take apart the disk chips and learn what they actually do. The economics of chip production make it impossibly expensive to give everyone a different chip architecture, though you can cheaply individualize every chip (another of my inventions, see http://siidtech.com ). If there is a ghost in the hardware machine, it is in all the machines, and those versed in VLSI, equipped with FIB, can find the ghosts. The individuality can be perfectly hidden, and cannot be unmasked without destroying the chip. Puzzling out a proprietary design is possible but time-consuming, perhaps costing as much as the original design. Verifying that an open source hardware design is faithfully replicated in silicon is relatively easy, and could be automated, perhaps as cheap as sequencing a genome. We do not do so, because software designers pretend the substrate does not exist, or is logically identical to all other substrates, and thus not worth controlling or verifying (doctors and pharmaceutical companies share the same pretense). Open source hardware can also encrypt, and properly-designed hardware can encrypt without fanout (no feasible side channel attacks). If we choose, we can build individual hardware that encrypts each keystroke and decrypts it at each screen, whether the path between is centimeters or megameters. With proper hardware, you can still use Gmail for your mail host, but your messages are gibberish to Google, and to whoever they share the messages with. Google banner ads can be ignored by your decrypter. Google would starve, so they want to make your software and hardware "for free", protecting their product (which is you). Hardware geeks will still need to re-examine (identical) copies of the hardware from time to time, to make sure the hardware matches specification, and crypto geeks will need to frequently re-examine the specification to make sure it is mathematically correct. And sometimes the hardware will be invalid, and we will need to replace it with new hardware. But a billion transistors costs pennies from Intel, which Amazon can get to you overnight. Why this matters to Server Sky Server sky will use far fewer routers. Access to server sky arrays will be trigonometric, agile antenna pointing, not packet routing via DNS and border gateway protocol; if the array is above the horizon and has what you want, you can talk to it directly without intermediaries, and your conversation can be encrypted end-to-end. Of course, each end can have fanout, with either the orbiting array or your ground terminal copying your conversation to your Designated Overlord. Each end can have a fanout of zero, censorship applied by that same (or different) Designated Overlord. No man-in-the-middle attacks when there is only vacuum and Maxwell's equations between sender and receiver. Orbital mechanics, Doppler shift, and twelve-nines-accurate shared clocks provide link authentication that cannot be spoofed without reshaping space-time. There will be Designated Overlords - in the US, we call the overlords "Google" and "Hollywood", in China the overlords are the Communist Party and/or the People's Liberation Army. People can't seem to live without chains, sigh. But we must design our hardware so the overlords are explicit in the design, few in number, and subject to organized social opinion (which may be more true for China than the US, though I love Google more than the PLA). This matters because the Server Sky team will make the design decisions now that will shape the hardware for decades, until the next big re-architecting (the last two were the Bell network, and internet protocol). These decisions should be informed by every capable brain on the planet. They should not be made by me, nor by my handful of smart but fallible collaborators. The best minds work elsewhere, and the best minds, if they know what's good for them, will get involved while the future is still conceptual and easy to shape. After launch, we can still replace all the satellites and all the ground terminals and all the end-user gear, but this is costly, and even the best minds don't have the money and persuasiveness to make this happen often. Better to get it approximately right the first time, and make it plug-upgradable. This webpage is an appeal for help. Bad social design is easy, and regrettably common. Hardware is easy compared to competent social design. I beg you to help design the future you and your descendants will live in. I goofed up once, I would rather not do it again.

2 1

distributing Cryptome June 2014 [was: data mine the snowden files]
by coderman 10 Jul '14

10 Jul '14

On Wed, Jul 9, 2014 at 7:04 AM, coderman <coderman(a)gmail.com> wrote: > ... > anyone who would like to host mirrors is welcome to tell me how they > anticipate mirroring ~30G of data as quickly as possible. :) based on feedback, here is what i intend: 1. A torrent of: USB-1.rar USB-2.rar Update-13-1231.rar each of these have an accompanying signature from John. i will include a magnet URI. 2. The same files on a hidden service with nginx and HTTP/1.1 range request capable (resume-able) 3. An extracted collection of all relevant files, which can be rsync'ed from hidden service or browsed directly. note that this is a point in time archive from June 2014. please donate to John as i hate to think i would be taking revenue from his pocket with this setup! best regards,

3 3

Re: <nettime> Facebook's Mood Study: Orwellian newspeak 2.0
by Eugen Leitl 10 Jul '14

10 Jul '14

----- Forwarded message from Brian Holmes <bhcontinentaldrift(a)gmail.com> ----- Date: Wed, 09 Jul 2014 12:26:20 -0500 From: Brian Holmes <bhcontinentaldrift(a)gmail.com> To: nettime-l(a)kein.org Subject: Re: <nettime> Facebook's Mood Study: Orwellian newspeak 2.0 On 07/09/2014 12:53 AM, nettime's avid reader wrote: > It turns out that one of the researchers who ran Facebook's recent > psychological experiments received funding from the U.S. Department of > Defense to study the contagion of ideas So why should the crossover of one researcher be so suspicious? Are we being told that DOD's Minerva project itself contagious? Isn't this just more aimless paranoia from the crazies? Check out David Price, the author of Weaponizing Anthropology: "When you looked at the individual bits of many of these projects they sort of looked like normal social science, textual analysis, historical research, and so on, but when you added these bits up they all shared themes of legibility with all the distortions of over-simplification. Minerva is farming out the piece-work of empire in ways that can allow individuals to disassociate their individual contributions from the larger project." That's it, right down to the banality and the over-simplification. The crucial technique used by DoD to exploit civilian research is the concept of "dual use" - the professors see the civilian, peace-time use (a salve for their conscience) and the military planners see the research as small pieces in a larger effort that they coordinate. The best book I know about this is Mind Wars, by the bioethicist Jonathan Moreno (with that unforgettable first chapter, Darpa on Your Mind). But in the meantime, definitely read the two Guardian articles by Nafeez Ahmed that describe the Minerva project and its backgrounds: http://tinyurl.com/pentagon-mass-civil-breakdown http://tinyurl.com/climate-change-energy-shocks Ahmed's key conclusion is this: "NSA mass surveillance is partially motivated to prepare for the destabilising impact of coming environmental, energy and economic shocks." They want your info so they can model, influence and shape your behavior. Big data = social control. There's no use sticking our heads in the sand. The military is right that massive disorder lies on the horizon, because it started three years ago (with Fukushima, Tahrir, Occupy and right now, Isis). The question is, how do we guide ourselves through the breakdown of the neoliberal order toward a more viable way of life? Whoever thinks there will be a spontaneous "return to normal" is ripe for the manipulations of militarized social science, delivered via the giant corporations. That nexus (big science-corporations-military) is as old as WWII, and its tradition is unbroken, despite the scandals of the 60s and 70s. The covert force of miitarized social science will act, it _is_ acting on society right now. We need to massively recognize that our whole oil-based civilization is currently on a disaster course, and that course is having immediate consequences. We need to find the ways to make this into a fully public preoccupation, so that the efforts to steer the ensuing chaos are not guided by the single aim of preserving the plutocratic status quo and the capitalist exploitation of society. Efforts to maintain the status quo inevitably worsen the problems we are facing. And one-off protests, occupations and revolts, valuable as they may be, will not change the dynamics of an entire social order. Civil society has tremendous resources to deal with the problems of the present. On the basis of transformative processes that have already begun, over the next thirty years we could leave the petroleum economy behind for alternative energies, transform the food system into healthy fare for all, end massive inequality and the hatred, oppression and terrorism that comes in its wake, and find a new ethos, a new culture, a new art of living. But none of that can be done if you think your own life won't change. What's missing is the public recognition that the current form of society can't last. It will end in authoritarianism and bloodshed, or it will end in far better ways, with people you can love and air you can breathe. What we have in our lives is not some unbearable nightmare, but the chance to be part of the transition. so let's go further, Brian # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message -----

1 0

Re: Tox.im
by Dāvis Mosāns 10 Jul '14

10 Jul '14

2014-07-06 23:28 GMT+03:00 rysiek <rysiek(a)hackerspace.pl>: > Dnia niedziela, 6 lipca 2014 22:25:59 piszesz: > > hmm, I wonder are there any such open protocol specification created? I > > know about XMPP, but nothing more... > > Well, there's the Diaspora protocol: > https://wiki.diasporafoundation.org/Federation_protocol_overview > > And... StatusNet/OStatus, PumpIO, TentIO, ActivityStreams, BuddyCloud > (XMPP- > based, I guess), and quite a few others I don't really remember. Some of > them > are related, all are incompatible. And all the devs are showing strong > symptoms of the NIH syndrome. > > Which is absurd. > > -- > Pozdr > rysiek that indeed is stupid and so no one have solved it yet... for social network or basically any IM/chat/etc to be usable it must have majority of people (eg. your friends) users there, otherwise without people they are totally useless so currently we're stuck with no-so-great applications/protocols only because everyone already are on them like Facebook and Skype. On that mailing list there were discussion about a polyglot protocol/application which could support all networks so users wouldn't be forced to migrate which I think is essential because a lot of people won't bother. There was mention to Sockethub <http://sockethub.org/>which seems quite cool, only for a bit different use case I would say. Another thing I would like to mention is BitlBee <http://bitlbee.org> it is a gateway between various IM/chat networks and IRC so you can chat with friends on Facebook using your favorite IRC client, or post a tweet on your Twitter and use various other protocols. It even supports OTR.

9 21