December 2015 - cypherpunks - lists.cpunks.org

Fwd: [ PFIR ] MS is ramping up their criminal Windows 10 upgrade scheme
by Zenaan Harkness 08 Dec '15

08 Dec '15

Seriously, why the hell help Microsoft lift their game by involving the FTC or any other government body! Leave them be. Help people who get stung to find a new and partly free world of libre software. A better Windows OS harms the cause for libre software, does not help us. We live in a world where government is decrepit, corporations are corrupt in their manifestation in the world, and even small decisions we techies make, can have big consequences down the line. Let's put a political and ethical intent into our communication and our actions - our childrens' future needs every bit of leg up we can possibly add. WHY oh why encourage MS to take -away- reasons that people should not use Windows!?! Insanity. Zenaan ---------- Forwarded message ---------- From: "PFIR (People For Internet Responsibility) Announcement List" <pfir(a)pfir.org> Date: Mon, 7 Dec 2015 09:27:48 -0800 Subject: [ PFIR ] MS is ramping up their criminal Windows 10 upgrade scheme To: pfir-list(a)pfir.org MS is ramping up their criminal Windows 10 upgrade scheme Microsoft sets stage for massive Windows 10 upgrade strategy http://www.computerworld.com/article/3012278/microsoft-windows/microsoft-se… In an interview Friday, Mayfield said that the Windows 10 upgrade setting switcheroo on Windows 7 and 8.1 PCs was apparently due to continued updates that Microsoft has shoved onto the older devices. The Redmond, Wash. company has repeatedly re-served its original GWX app to PCs, often with undocumented changes, even if the machine already had the app, or even if the user had managed to uninstall it previously. "Microsoft has released this update several times," said Mayfield. "It doesn't change the name of the update, but every version is new, with new binary files." - - - Where the hell is the FTC when we need them? This is the sort of crap they need to be stopping. Windows 10 in its default settings -- not all of which are even straightforward to change -- is a privacy nightmare. On many older computers, its performance is slow and horrific. In many cases, older devices cease working due to lack of new drivers. What Microsoft is doing here is the equivalent of black hat hacking of user computers on an enormous scale. It's criminal. Especially if you're on an older computer, every time MS tries to get you to install Windows 10, say no, and strongly consider moving to a different system entirely, until MS' current leadership is in federal prison where they belong for computer crimes on a massive scale. --Lauren-- Lauren Weinstein (lauren(a)vortex.com) http://www.vortex.com/lauren Founder: - Network Neutrality Squad: http://www.nnsquad.org - PRIVACY Forum: http://www.vortex.com/privacy-info Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info Member: ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com Google+: http://google.com/+LaurenWeinstein Twitter: http://twitter.com/laurenweinstein Tel: +1 (818) 225-2800 / Skype: vortex.com I have consulted to Google, but I am not currently doing so. My opinions expressed here are mine alone. _______________________________________________ pfir mailing list http://lists.pfir.org/mailman/listinfo/pfir

1 0

ANN: TCP injection attack detection tool - honeybadger
by David Stainton 08 Dec '15

08 Dec '15

Dear Golang community, Edward Snowden, cypherpunks, Tor-relay operators, low-level network hackers and TCP abolitionists, I was inspired by the Snowden documents to write a TCP injection attack detection tool. Powerful entities world wide are stock piling zero-days. TCP injection attacks can be used to deliver many of these attacks. source: https://github.com/david415/HoneyBadger docs: https://honeybadger.readthedocs.org/en/latest/ tasty pcap for "integration testing": https://github.com/david415/honeybadger-pcap-files HoneyBadger does bidirectional TCP stream reassembly... temporarily storing segments in ring buffer for comparison to later received overlapping stream segments. In other words it doesn't rely on simply matching duplicate sequence numbers but compares the actual overlapping stream segment contents. This more thorough approach is needed to account for TCP's retransmission which can send various segments sizes that can differ from the original dropped segment length. Furthermore we also detect the other injection types such as handshake hijack. The literature (go ahead and scour the Internet) does NOT mention all of the TCP injection attacks that are possible. I assert that there are 5 possible types of TCP injection attack. I describe them here: https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… current honeybadger project status: - honeybadger seems mostly useable for use in the wild, though we are pretty sure that bugs exist and probably some false positive bugs at that. - active development halted several months ago when the implementation seemed good enough to deploy and sniff packets in the wild. - if in the future the gopacket dev team releases a new "sufficient" TCP reassembly API then I could severely reduce HoneyBadger's code size. - pull requests and github issue comments will inspire me to contribute feature additions and fixes It runs on Linux but does honeybadger work on *BSD? Of course it does... I wrote the gopacket BSD BPF sniffer API ;-p and tested honeybadger on NetBSD, FreeBSD and OpenBSD. I'd like to explore the possibility of writing a similar TCP injection attack detector in rust using libpnet as soon as libpnet is sufficiently mature to use for TCP analysis: https://github.com/libpnet/libpnet So what? 1. So... all TCP analyzers need to be rewritten to account for TCP injection attacks, otherwise you are doing it wrong. 2. So feel free to use HoneyBadger to analyze your own traffic over the wire or sketchy pcap files that you acquire; perhaps our data collection efforts will result in responsible disclosure of 0-days... and publicly reporting that in fact these TCP injection attacks do happen as targeted attacks against real people to violate their human rights. 3. So use my design in your software; The description of how to detect the 5 possible TCP injection attacks can serve as a part of a design document for other software projects to implement their own TCP injection attack detection. cheers from the Internet, David Stainton

1 0

Encrypted email search indexing
by Silicon Dragon 07 Dec '15

07 Dec '15

*"Various hurdles are preventing wide-spread adoption of PGP encrypted communication, with easy searchability being one of them. I propose a standard allowing users to search through encrypted email safely. The search is tailored for text messages containing distinct words. Searching is achieved through a search index in plain-text attached to each email. The index contains each of the unique words contained in a message, salt hashed. There will be 10-50 salts per email account used randomly on a per word basis. Larger amount of salts mean more safety and more expensive search. Incoming messages will also get appended with a search index using IMAP APPEND command. ..."* https://ipfs.io/ipfs/QmVntBs8AxmeuLacGappM5LhB8ao9k2RPijvByESt4HmgC

4 3

Movie about aaron swartz can use some funding on kickstarter
by Cari Machet 07 Dec '15

07 Dec '15

I am not affiliated in any way - seems like a nice project Heres aarons moms tweet Only 3 days left to fund Kickstarter for "From DeadDrop to SecureDrop" https://t.co/ez7TA06XyV Link to Trailer: https://t.co/py6W00LmWs

2 2

Presidential Emergency Action Documents
by coderman 07 Dec '15

07 Dec '15

http://www.governmentattic.org/18docs/NRCupdtPEADS_2004.pdf Description of document: Nuclear Regulatory Commission (NRC) Update of Presidential Emergency Action Documents (PEADS), 2004 Requested date: 2012 Released date: January 2015 Posted date: 07-December-2015 Source of document: US Nuclear Regulatory Commission Mail Stop T-5 F09 Washington, DC 20555-0001 Fax: 301-415-5130 E-mail: FOIA.resource(a)nrc.gov The governmentattic.org web site (â€œthe siteâ€) is noncommercial and free to the public. The site and materials made available on the site, such as this file, are for reference only. The governmentattic.org web site and its principals have made every effort to make this information as complete and as accurate as possible, however, there may be mistakes and omissions, both typographical and in content. The governmentattic.org web site and its principals shall have neither liability nor responsibility to any person or entity with respect to any loss or damage caused, or alleged to have been caused, directly or indirectly, by the information provided on the governmentattic.org web site or in this file. The public records published on the site were obtained from government agencies using proper legal channels. Each document is identified as to the source. Any concerns about the contents of the site should be directed to the agency originating the document in question. GovernmentAttic.org is not responsible for the contents of documents published on the website. RESPONSE NUMBER U.S. NUCLEAR REGULATORY COMMISSION FOIA/PA NRC FORM 464 Part I (10-2014) 5 2013-0068 RESPONSE TO FREEDOM OF INFORMATION ACT (FOIA) I PRIVACY ACT(PA)REQUEST RESPONSE TYPE DATE REQUESTER 0 FINAL D PARTIAL JAN t 6,~vlS PART I. - INFORMATION RELEASED D D D No additional agency records subject to the request have been located. Requested records are available through another public distribution program. See Comments section. \GROUP 0 \~ROUP D \GROUP D D D Agency records subject to the request that are identified in the specified group are already available in public . ADAMS or on microfiche in the NRC Public Document Room. I Agency records subject to the request that are contained in the specified group are being made available in I public ADAMS. I Agency records subject to the request are enclosed. Records subject to the request that contain information originated by or of interest to another Federal agency have been referred to that agency (see comments section) for a disclosure determination and direct response to you. We are continuing to process your request. See Comments. PART I.A -- FEES AMOUNT* sI * See comments for details I D D You will be billed by NRC for the amount listed. You will receive a refund for the amount listed. D D None. Minimum fee threshold not met. Fees waived. PART l.B -- INFORMATION NOT LOCATED OR WITHHELD FROM DISCLOSURE D No agency records subject to the request have been located. For your information, Congress excluded three discrete categories of law enforcement and national security records from the requirements of the FOIA. See 5 U.S.C. Â§ 552(c) (2006 & Supp. IV (2010). This response is limited to those records that are subject to the requirements of the FOIA. This is a standard notification that is given to all our requesters and should not be taken as an indication that excluded records do, or do not, exist. Certain information in the requested records is being withheld from disclosure pursuant to the exemptions described in and for the reasons stated in Part II. This determination may be appealed within 30 days by writing to the FOIA/PA Officer, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001. Clearly state on the envelope and in the letter that it is a "FOIA/PA Appeal." PART l.C COMMENTS ( Use attached Comments continuation page if required) 1. Group H: Secy-04-0129: "Update of Presidential Emergency Action Documents (PEADS)" 2. This is Response #5 and the Final Response. SIGNATURE~Â·F...ccL>VM ..,,...,,~RMATION ACT AND PRIVACY ACT OFFICER Roger Andoh NRC FORM 464 Part 1 (10-2014) NRC FORM 464 Part II (08-2013) / .'Â¥~. .., .,.. J c ... ' DATE JAN I 6, ~o \.5 PART II.A -- APPLICABLE EXEMPTIONS Records subject to the request that are contained in the specified group are being withheld in their entirety or in part under the . Exemption No.(s) of the PA and/or the FOIA as indicated below (5 U.S.C. 552a and/or 5 U.S.C. 552(b)). I. 0 2013-0068 RESPONSE TO FREEDOM OF INFORMATION ACT (FOIA) I PRIVACY ACT (PA) REQUEST I GHROUP 0 U.S. NUCLEAR REGULATORY COMMISSION FOIA/PA ....... Exemption 1: The withheld information is properly classified pursuant to Executive Order 12958. Exemption 2: The withheld information relates solely to the internal personnel rules and practices of NRC. OExemption 3: The withheld Information is specifically exempted from public disclosure by statute indicated. O Sections 141-145 of the Atomic Energy Act, which prohibits the disclosure of Restricted Data or Formerly Restricted Data (42 U.S.C. 2161-2165). 0 0 0 The information is considered to be confidential business (proprietary) information. The information is considered to be proprietary because it concerns a licensee's or applicant's physical protection or material control and accounting program for special nuclear material pursuant to 10 CFR 2.390(d)(1). The Information was submitted by a foreign source and received in confidence pursuant to 10 CFR 2.390(d)(2). Disclosure will harm an identifiable private or governmental interest. Exemption 5: The withheld information consists of interagency or intraagency records that are not available through discovery during litigation. Applicable privileges: 0 0 0 0 0 O 41 U.S.C., Section 4702(b), prohibits the disclosure of contractor proposals in the possession and control of an executive agency to any person under section 552 of Title 5, U.S.C. (the FOIA), except when incorporated into the contract between the agency and the submitter of the proposal. Exemption 4: The withheld information is a trade secret or commercial or financial information that is being withheld for the reason(s) indicated. 0 0 0 0 0 Section 147 of the Atomic Energy Act, which prohibits the disclosure of Unclassified Safeguards Information (42 U.S.C. 2167). Deliberative process: Disclosure of predecisional information would tend to inhibit the open and frank exchange of ideas essential to the deliberative process. \/Vhere records are withheld in their entirety, the facts are inex1ricably intertwined with the predecisional information. There also are no reasonably segregable factual portions because the release of the facts would permit an indirect inquiry into the predecisional process of the agency. Attorney work-product privilege. (Documents prepared by an attorney in contemplation of litigation) Attorney-client privilege. (Confidential communications between an attorney and his/her client) Exemption 6: The withheld information is exempted from public disclosure because its disclosure would result in a clearly unwarranted Invasion of personal privacy. Exemption 7: The withheld information consists of records compiled for law enforcement purposes and is being withheld for the reason(s) indicated. 0 0 0 0 0 I (A) Disclosure could reasonably be expected to interfere with an enforcement proceeding (e.g., it would reveal the scope, direction, and focus of enforcement efforts, and thus could possibly allow recipients to take action to shield potential wrong doing or a violation of NRC requirements from investigators). (C) Disclosure could constitute an unwarranted invasion of personal privacy. (D) The information consists of names of individuals and other information the disclosure of which could reasonably be expected to reveal identities of confidential sources. (E) Disclosure would reveal techniques and procedures for law enforcement investigations or prosecutions, or guidelines that could reasonably be expected to risk circumvention of the law. (F) Disclosure could reasonably be expected to endanger the life or physical safety of an individual. OTHER (Specify) PART 11.B -- DENYING OFFICIALS Pursuant to 10 CFR 9.25(g), 9.25(h), and/or 9.65(b) of the U.S. Nuclear Regulatory Commission regulations, it has been determined that the information withheld is exempt from production or disclosure, and that its production or disclosure is contrary to the public interest. The person responsible for the denial are those officials identified below as denying officials and the FOIA/PA Officer for any denials that may be appealed to the Executive Director for Operations (EDO). DENYING OFFICIAL James T. Wiggins RECORDS DENIED TITLE/OFFICE Director, Office of Nuclear Security Incident Reporting See Form 464, Part l.C APPELLATE OFFICIAL EDD SECY IG 000 l J LJ LJ ODD Appeal must be made in writing within 30 days of receipt of this response. Appeals should be mailed to the FOIA/Privacy Act Officer, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, for action by the appropriate appellate official(s). You should clearly state on the envelope and letter that it is a "FOIA/PA Appeal." NRC FORM 464 Part II (08-2013) SECY-04-0129 July 23, 2004 '"'Y ISSUE TO: Chairman Diaz_i:.n.1 Commissioner~Â·-====<:.;"-'=-...;;..._-=-=-----Commissioner Me~l9tation Vote) FROM: Stephen G. Bums Acting General Counsel SUBJECT: UPDATE OF PRESIDENTIAL EMERGENCY ACTION DOCUMENTS (PEADS) PURPOSE: [OUO] This paper outlines the combined efforts of OGC and NSIR to review and make recommendations for update of the Presidential Emergency Action Documents (PEADs). There are 48 PEADs, which are currently being reviewed and updated on a government-wide basis. The review and update process is being managed by the Department of Justice (DOJ), the Federal Emergency Management Agency (FEMA), and the National Security Council (NSC). [OUO] The NRC's input to the PEAD review and update process is due to DOJ and FEMA on July 30, 2004. This paper requests Commission approval to transmit the attached inputs (Attachment 2) to DOJ and FEMA on that date. DISCUSSION: I. Background The PEADs [OUO] The PEADs are pre-coordinated legal documents designed to implement Presidential decisions during a national emergency. The PEADs consist of proclamations, executive orders, Presidential messages, and draft legislation ready for submission to Congress. Originally designed for use in the event of any major attack against the United States that disrupted the normal functions of the government, PEADs are used to implement extraordinary Presidential authority in response to extraordinary situations. CONTACT: Darani Reddick, OGC: 415-3841 Jared Heck, OGC: 415-1623 Declassified by: Krista Ziebell #3220 Information Security Specialist Declassified on: 20141125 SECRET DECLASSIFIED .ll!PllVED PROM 19 l!-:1~ ~ii0i~P.l-Â ,4~x;, 2 SECRET DECLASSIFIED [OUO] The PEADs are useful tools in the case of an emergency because they are flexible, may be quickly executed, and are capable of rapid distribution and implementation. PEADs reduce the normal amount of time required to promulgate and implement such Presidential documents by being prepared in advance of an emergency. They are divided into seven categories according to their subject matter, and designate departments or agencies that would have primary or support responsibility should the PEAD be executed. [OUO] Under the PEAD system, primary responsibility is designated to an agency recommending the execution of the PEAD, or one of the main agencies responsible for its implementation. Support responsibility is designated to an agency that has either been assigned direct involvement in carrying out one or more provisions of a PEAD, or an agency that would be directly impacted by the carrying out of a PEAD. The PEAD Update and Revision Project [OUO] The current PEAD portfolio was created in 1989 and contains 48 PEAOs. The first meeting to discuss the PEAD update and revision project took place on April 22, 2004. The NRC was not invited to this meeting, nor was the NRC specifically invited to review the PEAD portfolio. According to FEMA, the NRC was not asked to participate in the review because the NRC is not listed as a primary or support agency in any PEAD. [OUO] NSIR staff did not learn until June 2004 that the PEAD review was underway. NSIR staff subsequently contacted FEMA and requested copies of the PEADs and guidance on how to participate in the review process. NSIR staff did not receive this information until late June. [OUO] The PEAD review and update process calls on all federal departments and agencies to review existing PEADs and develop any new PEADs within their jurisdiction. FEMA serves as the Executive Secretariat to facilitate the review and update process, while DOJ determines the legal sufficiency of any proposed changes or additions to the PEADs. The NSC provides overall policy direction for the effort, and will serve as the final approval authority for any recommended PEAD changes. [OUO] There were three main steps to the OGC/NSIR PEAD review and update process. First, OGC and NSIR jointly reviewed existing PEADs to determine their potential impact on the NRC, its licensees, and the energy sector in general. Second, NSIR developed a list of potential NRC security concerns during a national emergency that might be addressed through the PEAD mechanism, and researched whether those concerns are currently being addressed outside the PEAD framework. Finally, OGC researched the legal basis for existing PEADs, as well as recently enacted legislation, to determine whether there is any statutory basis to justify the proposal of a new or amended PEAD to address NSIR's concerns. On the basis of our review, OGC recommends one minor change to the comments on an existing PEAD. SECRET DECLASSIFIED 3 SECRET DECLASSIFIED II. Analysis of Existing PEADs fSi [U] As mentioned above, the PEADs are organized by seven broad categories: fBi [U] Only category D contains PEADs that, if executed, might directly impact the operations of NRG-licensed facilities. These PEADs, D-201 and D-301, are discussed in some detail below. PEADs in cate ories A, F, and G mi ht indirect! affect NRC licensees-for example, PEADs in categories B and are not likely to impact NRC operations or NRC-licensed activities and are not discussed here. [UJ We turn now to a discussion of specific PEADs of greatest interest to the NRC. fSJ [U] fS:l [U] fS:l [U] f-61 [U] SUPPORTING AGENCIES: To be determined at the time of implementation SECRET DECLASSIFIED 4 SECRET DECLASSIFIED fSj [UJ One statute that does is the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. Â§ 5121 et. seq. That Act authorizes the President to declare an emergency under certain circumstances, thus bringing federal resources to bear in response to catastrophic events. For example, in the event of a successful terrorist attack on a nuclear power plant or a natural disaster resulting in a radioactive release, the President might choose to execute his Stafford Act authority. 2 fS} Federal response to a Presidentially-declared emergency under the Stafford Act would be organized under the National Response Plan {NRP}, which is currently being developed by the De artment of Homeland Security (DHS) with input from the NRC and other a encies. [UJ fS} [UJ With the Commission's approval, OGC would recommend that DOJ add clarifying comments The specific clarifying comments are set forth in the proposed transmittal to DOJ (Attachment 2). fSl [U] fSj [U] f5i [U] f5i [U] SUPPORTING AGENCIES: To be determined at time of implementation 2 [0UO] We refer here to the President's authority to declare an "emergency" under the Stafford Act, not his more familiar power to declare a "major disaster" in response to a state governor's request. The President's authority to declare an "emergency" can be exercised without first receiving a state governor's requestfor assistance. Compare 42 U.S.C. Â§ 5191 (a) with 42 U.S.C. Â§ 5191 (b). 3 [U) According to the House Report No. 93-707 on the Energy Reorganization Act of 1974, DOE (then the Energy Research and Development Administration) and NRC share authority under AEA section 108. H.R. Rep. No. 93-707 at 27 {Dec. 7, 1973). Under section 201 of the Energy Reorganization Act, NRC exercises ulicensing and regulatory" functions under section 108. DOE exercises all other functions. See ERAÂ§ 104(c). SECRET DECLASSIFIED 5 SECRET DECLASSIFIED ~ [U] fS:l [ U] [Si [U] [Si [U] fSi [U] Nevertheless, the attached inputs to DOJ (Attachment 2) reflect this expectation and call for appropriate NRC coordination in the event this PEAD is executed in a manner that impacts NRC-licensed facilities. ~ [U] "'[U] See 50 U.S.C. App. 2071. Statutory authority in 10 U.S.C. Â§ 2538 and 50 U.S.C. Â§ 82 also forms the legal basis for the President's authority under PEAD D-201. 5 [U] 10 U.S.C. Â§ 2538 authorizes the President to take such action in the time of war or when war is imminent, while 50 U.S.C. Â§ 82 could only be used in the time of war. This section is particularly applicable to the NRC because it defines uwar materials" to include "arms, armament, ammunition, stores, supplies, and equipment for ships and airplanes, and everything required for or in connection with the production thereof." Naval reactor fuel manufactured by a fuel facility is likely to fall under this definition. 6 [U] Executive Order 12,919 delegated to DOE the President's authority under 50 (continued ... ) SECRET DECLASSIFIED 6 SECRET DECLASSIFIED fS] [U] fS] [U] fBi [U] fBi [U] fe:J [U] fSi [U] fe:J [U] 5 SUPPORTING AGENCIES: To be determined at the time of implementation ( ... continued) U.S.C. App. 2017(c) to require the allocation of materials, equipment, and services to maximize domestic energy supplies with respect to all forms of energy. See 59 Fed. Reg. 29,525 ( 1994). 7 [U] See 50 U.S.C. 2071 (a) & (b). 8 [U] See note 6, supra. SECRET DECLASSIFIED 7 SECRET DECLASSIFIED fst [U] ~ [U] fS1 [U] fSj [U] fSj [U] fSj [UJ SUPPORTING AGENCIES: To be determined at the time of implementation [U] Under 10 U.S.C. Â§ 12406, the President may call the National Guard into federal service whenever one of the following three circumstances exist: the United States, or any of the Territories, Commonwealths, or possessions, is invaded or is in danger of invasion by a foreign nation; there is a rebellion or danger of rebellion against the authority of the Government of the United States; or the President is unable with the regular forces to execute the laws of the United States. (1) (2) (3) 9 [UJ 50 U.S.C. Â§ 2152(12). 10 [UJ 50 U.S.C. App. 2071. SECRET DECLASSIFIED 8 SECRET DECLASSIFIED fS} [U] fS} [U] fS} [U] Other than this statement of clarity, no revision to this PEAD is necessary. [U] ~ Other Energy-Related PEADs [U] SECRET DECLASSIFIED 9 SECRET DECLASSIFIED [Si [U] Ill. Analysis of Recently Enacted Legislation and Consideration of New PEADs [OUO] As stated above, NSIR provided OGC with a list of potential areas of NRC concern during a national emergency that might be remedied by creation of a new PEAD (Attachment 1 ). In addition to analyzing existing PEADs to determine whether they could be used to address NSIR's concerns, OGC analyzed recently enacted legislation to determine whether any new Presidential emergency powers have been established that might be incorporated into the PEADs. Specifically, OGC examined the USA PATRIOT Act of 2001 and the Homeland Security Act of 2002 to determine whether Congress has provided the President with any emergency powers that might support new PEADs germane to the NRC's mission and/or responsive to NSIR's concerns. [OUO) The Homeland Security Act, though sweeping in its reorganization of federal agencies, did not significantly expand the emergency powers of the President. Most, if not all, Presidential powers established by the Act relate to appointments, transfers and designations of officials responsible for executing the Act. The Act does establish some substantive Presidential authority-for example, the President is directed to prescribe government-wide policies and Â· procedures for sharing and protecting homeland security information. But this authority is apparently exercised through normal policymaking channels on a continuing basis and would not require a PEAD for emergency implementation. [OUOJ The USA PATRIOT Act includes a wide range of provisions aimed at improving investigative tools in the fight against terrorism. These provisions largely apply to the day-to-day functions of law-enforcement agencies. The Act also expands the President's authority to confiscate property of foreign entities that engage in armed hostilities against the United States. Although seizure of property would disrupt terrorist organization over time, it would not likely address pressing social, economic, military, or political issues during or after a national emergency. Therefore, there appears to be no need for this Presidential authority to be implemented through the PEAD mechanism. It is also unclear how a PEAD related to the President's powers under the USA PATRIOT Act would relate to NRC's mission. [OUO] Ultimately, OGC discovered no new statutory authority that might be used to support development of new PEADs germane to NRC's mission or that would address the areas of concern identified by NSIR (Attachment 1). SECRET DECLASSIFIED 10 SECRET DECLASSIFIED COORDINATION [U] This paper has been coordinated with the Office of the Executive Director for Operations and the Office of Nuclear Security and Incident Response. RECOMMENDATION [U] That the Commission approve transmittal of the proposed comment letter to FEMA and DOJ (Attachment 2). [U] Note: In order to meet the July 30 deadline, prompt Commission action is requested. Attachments: 1. NSIR Areas of Potential Concern 2. Proposed Comment Letter Commissioners' completed vote sheets/comments should be provided directly to the Office of the Secretary by COB Wednesday, July 28, 2004. Commission Staff Office comments, if any, should be submitted to the Commissioners NLT July 27, 2004, with an information copy to the Office of the Secretary. If the paper is of such a nature that it requires additional review and comment, the Commissioners and the Secretariat should be apprised of when comments may be expected. DISTRIBUTION: Commissioners OGG EDO SECY SECRET DECLASSIFIED ATTACHMENT 1 NSIR AREAS OF POTENTIAL CONCERN DURING NATIONAL EMERGENCIES [OUO] As part of the PEAD review and update process, NSIR staff posed a number of scenarios that might arise during a national emergency and asked whether any PEADs should be changed or added to address those scenarios. NSIR (in consultation with other offices) also considered whether existing authorities outside the PEAD framework cold be used to address its concerns. OGC then analyzed existing PEADs and recent legislation to determine whether any of NSIR's concerns should be addressed through PEAD changes. Ultimately, OGC recommends no substantive changes to the PEADs because NSIR's concerns can either be addressed using existing PEADs, or are better addressed through other decisionmaking processes. NSIR Concerns Addressed by Existing PEADs [OUO] 1. In the event of a national emergency, the President should not have to wait for a state governor to request assistance under the Stafford Act or to engage the National Response Plan. Should a PEAD be developed that would allow the President to act accordingly? Under 42 U.S.C. Â§ 5191 (b), the President may engage the Stafford Act without a request from a state governor by declaring that an emergency exists for which the primary responsibility for response rests with the United States because the emergency involves a Â·subject area for which, under the Constitution or laws of the United States, the United States exercises exclusive or preeminent responsibility and authority. The National Response Plan would be used to implement the Stafford Act in these circumstances. [OUO] GC will recommend [OUO] make this explicit. [OUO] fSj [U] ~ [U] l3J [U] 2. Situations may arise where security at critical nuclear facilities needs to be supplemented with armed forces. Should the President be able to direct the use of National Guard units or military reserves for this purpose using a PEAD? 3. Situations may arise where specific goods or services are needed to respond to a nuclear incident. For example, priority diagnosis and treatment for essential nuclear power plant personnel exposed to a range of chem-bio-rad hazards may be needed. SECRET DECLASSIFIED 2 SECRET DECLASSIFIED fSj [U] fSf [U] In the scenario posed by NSIR, the Department of Health and Human Services, which has been delegated authority to act under the DPA by Executive Order 12,919, would be em owered Other NSIR Concerns for Which No PEAD Changes are Needed [OUO] 1. Situations may arise where a need for power requires continued nuclear power plant operation in violation of federal environmental laws or under degraded safety conditions. Would a PEAD authorizing such operation be useful? Â· [OUO] OGC does not recommend the development of a PEAD that could be used to order operation of nuclear power plants under degraded safety conditions. Enforcement discretion could be exercised by federal authorities (including the NRC) to allow continued operation even though not all safety and environmental requirements are being met. Specific decisions should be made by the agencies expert in the relevant field. PEADs are not used to make these detailed, technical judgments. [OUO} 2. Terrorist attacks may cause radioactive material shipments to be rerouted through states that object. Is a PEAD necessary to resolve those objections? [OUO] The Department of Transportation currently has the authority to route shipments over a state's objection, so a PEAD is not needed. DOT regulations adopted under the Hazardous Materials Transportation Act of 1975, as amended, would preempt state efforts to block emergency rerouting of radioactive material shipments. See 49 U.S.C. Â§Â§ 5101-5127; 49 C.F.R. Â§ 397.101. [OUO] 3. The NRC may need to take control of certain radioactive materials because of increased threats, weakened security, or other reasons that increase the risk to the public. Is a PEAD necessary for this purpose? SECRET DECLASSIFIED 3 SECRET DECLASSIFIED [OUO] Under AEA sections 1OB and 186.c, the Commission has authority to order the recapture of special nuclear material if a license is revoked or if Congress declares a national emergency. [OUO] The Commission also has broad authority under the AEA to take actions to protect public health and safety and promote the common defense and security. This authority can be invoked to ensure protection of material by mandating protective measures or transfer of material to an authorized recipient. The NRC also has a standing agreement with DOE to take radioactive materials when necessary to protect the public. [QUO] [QUO] 4. It may become critical and urgent that the NRC participate more directly in assessing a threat or in sharing threat information than is normally allowed. Should a PEAD ordering enhanced information sharing be written to meet the NRC's needs? Information sharing and intelligence coordination continues to be a high priority in the daily operations of the federal government. In a national emergency, OGC expects that those efforts would be further enhanced as observed in the response to the attacks of September 11, 2001 .. Improvements to information and intelligence sharing should continue to be pursued through the Department of Homeland Security and existing intelligence groups with which NRC has working contacts. [OUO] 5. Nuclear power plant workers may refuse to work due to terrorist threats against the plant or a spreading outbreak of communicable disease or virus. Should a PEAD be developed to address this possibility? [OUO] If a nuclear plant does not have enough willing workers to operate safely, it would have to be shut down. There is no legal authority that could be used to force nuclear power plant employees to work. SECRET DECLASSIFIED SECRET DECLASSIFIED ATTACHMENT 2 PROPOSED COMMENT LETTER TO DOJ Dear Sir or Madam: [DUO] This letter provides the Nuclear Regulatory Commission's (NRC) input to the Presidential Emergency Action Documents (PEADs) update and review process. Although the NRC was not invited to participate in this review, the NRC learned of the project through contacts with FEMA and requested the opportunity to comment. The NRC did not receive the PEADs or review guidance until late June. [DUO] The NRC recommends one minor change to the comments on an existing PEAD, offers clarifying comments setting forth its understanding of another PEAD, and sets forth its expected role as a support agency in the event certain PEADs are executed. fSi [U] fSi [U] fSi [U] fSj [U] to implement the NRP or the Stafford Act in every situation. In typical scenarios, the President implements those authorities by declaring a "major disaster" in response to a state ovemor's re uest-this model remains valid and should continue to be followed But extraordinary circumstances may arise that require the President to engage the Stafford Act and the NRP even before a state requests federal assistance. In such circumstances, the President may wish to exercise his authority under 42 U.S.C. Â§ 5191(b) to declare an "emergency" so that federal resources are quickly brought to bear. But currently, it is not c l e a r can trigger application of the NRP. the followin comment to the legal basis discussion SECRET DECLASSIFIED 2 SECRET DECLASSIFIED Alternatively, the President could issue a subsequent, stand-alone executive order implementing his emergency powers under the Stafford Act. fSj [U] Clarification of NRC Supporting Agency Role f5i [U] The NRC notes that a number of PEADs, if executed in a If you have any questions about our comments, please contact our staff attorney Darani Reddick at (301) 415-3841 or Jared Heck at (301) 415-1623. I can be reached at (301) 4151740. Thank you for the opportunity to provide input to the PEAD review and update process. Sincerely, Stephen G. Bums Acting General Counsel SECRET DECLASSIFIED

1 0

Re: [tor-talk] How does one remove the NSA Virus off the BIOS Chip as described by Snowden in the ANT Program
by coderman 07 Dec '15

07 Dec '15

On 12/6/15, William H. Depperman <whd2(a)columbia.edu> wrote: > Go Fuck yourself and please do not email any more. finals month?

1 0

Re: [Cryptography] Cryptography is not a science currently
by Ryan Carboni 07 Dec '15

07 Dec '15

> > There is a long history of corruption in the US. And the FBI and NSA were > certainly not immune. The abuse of the FBI to pursue Hoover's racist > political agenda, LOVEINT, etc. People talk badly about Hoover, but never about the CIA? Given the powers of the FBI, Hoover was nothing like L. Ron Hubbard, Nixon, or Beria. The CIA on the other hand.... stole a hard drive. http://www.theguardian.com/world/2015/oct/23/el-salvador-civil-war-classifi… This year. Hoover's FBI constantly talked about discretion, and people even wrote to Hoover! Some villain he is. He even blackmailed the elites, which is pretty terrible. Strange that a senile war criminal like Ronald Reagan is more admired than J. Edgar Hoover, true American hero. I assume Google now encrypts everything everywhere inside the corporation. > Excellent, except why didn't all the targets in Prism join all at the same time? I guess each corporation's plaintext are just that hard to crack, they had to work a year per company to break their plaintext. Maybe instead of encryption they should change their plaintext encoding? Maybe for additional security everyone should proprietary plaintext? So when the Snowden papers came out 20 years later they suddenly realized > that the technology had moved on and it would be very easy to send much of > Fort Meade dark. Snowden isn't such a big deal. Maybe no one cares about Nicholas Merril and his fight against a national security letter. Maybe no one cares about Mark Klein, or that Congress gave retroactive immunity to telecommunications providers in cooperating with the government. Maybe no one cares that Theo de Raadt lost a DARPA grant for criticizing the Iraq war. Maybe no one cares... Why am I wasting my time? There are thousands of events that transpired before Snowden, and Snowden is a big deal? How is he a big deal? If you didn't know the NSA was spying on everyone before Snowden, you're a moron or a shill. There's no respectful way to get this point across, it's abundantly clear to anyone with half a brain and pays attention to anything that this is all public knowledge. To pretend that there was some big secret before Snowden is ridiculous. The only interesting new bit of knowledge in 2013 was parallel construction. I had no idea that the federal government was */that/* crooked.

2 3

Re: Non-DoD crypto funding? A contradiction in terms?
by Ryan Carboni 07 Dec '15

07 Dec '15

On Sun, Dec 6, 2015 at 8:19 AM, Henry Baker <hbaker1(a)pipeline.com> wrote: > http://web.cs.ucdavis.edu/~rogaway/papers/moral-fn.pdf > > "From 2000 to 2010, fewer than 15% of the papers at > CRYPTO that acknowledged U.S. extramural funding > acknowledged DoD funding. In 2011, this rose to 25%. > From 2012 to2015, it rose to 65%. Nowadays, many > cryptographers put together a large patchwork of > grants, *the largest of which are usually DoD.*" > > I'm afraid that *funding* is the biggest hurdle > to achieving Rogaway's goals. It's somewhat > easier for Rogaway, as he has tenure, but how > does a young crypto researcher get non-DoD > funding? > > And yet he expressed fear that an errant remark on a phone call would lead to his assassination? I will trust him if he has a suspicious suicide, otherwise the hyperbole is more cause for suspicion.

1 0

Fwd: [Cryptography] Anyone else seen some odd shipping delays?
by grarpamp 06 Dec '15

06 Dec '15

---------- Forwarded message ---------- From: Phillip Hallam-Baker <phill(a)hallambaker.com> Date: Thu, Dec 3, 2015 at 9:27 PM Subject: [Cryptography] Anyone else seen some odd shipping delays? To: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com> Twice in the past week, I have ordered a computer and it has been subject to odd shipping delays and the UPS data makes no sense. I don't think it is seasonal, other stuff arrives fine. Only computers seem to be held up. So anyone have ideas for checking over a QNAP box to see what surprises might have been planted in the firmware? _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Re: Sheeple
by coderman 06 Dec '15

06 Dec '15

On 12/5/15, Richard Crisp <rdcrisp(a)earthlink.net> wrote: > Isn't that at odds with "hate crime" laws? These are defined by thought > process vs the actual acts. laws are malleable; like putty. soon enough, laws protecting free speech completely eroded. then, victory! ... best regards,

1 0