January 2016 - cypherpunks - lists.cpunks.org

Tracking GLOMAR
by Michael Best 19 Jan '16

19 Jan '16

Does anyone know about any projects that are collecting or tracking GLOMAR responses? A quick Google search didn't turn anything up, but it could be worthwhile.

2 1

FOIPA adventures
by Michael Best 19 Jan '16

19 Jan '16

It's outside the realm of your usual FOIA requests, but since I'm out of requests for the month (and already bought more than a few extra...) I figured I'd mention it. While posting docs related to the MLK assassination trial <http://that1archive.neocities.org/subfolder1/MLK-assassination-trial.html>, I realized that Loyd Jowers <https://en.wikipedia.org/wiki/Loyd_Jowers>, who confessed to playing a part in the MLK assassination a few months before his death, surely has an FBI file. The DOJ did a follow-up investigation and their report concluded he and the other witnesses were lying, but it'd be interesting to see what the FBI had on him and what materials the DOJ/FBI referenced beyond the trial transcript. Let me know if you file anything on it, otherwise I'll try to get to it next month (unless I get distracted by other shiny FOIAs/projects/IRL (what do I mean, this listserv isn't real?!?) stuffs). --Mike *coderman* coderman(a)gmail.com <coderman%40gmail.com?Subject=Re%3A%20FOIPA%20adventures&In-Reply-To=%3CCAJVRA1SEFzByw4wA9o0u%3D64QHWJmdLmMtbX_debnhBFPOBSxBw%40mail.gmail.com%3E> *Sun Jan 17 07:47:47 EST 2016* > still have one FOIA left for January; trying to pick a topic... it must > beat this one, in terms of poking bear caliber: > ''' > Records of any communication, agreements, transcripts, memorandum of > understanding, contracts, or other responsive materials relating to > Ibragim Todashev as an Undercover Employee, Informant, or Cooperating > Witness with the Bureau before his death on May 22, 2013 at age 27 in > Florida while being interviewed about his possible connection to a > triple murder in Waltham, Mass., on Sept. 11, 2011. Note that while > the content of conversation may be withheld for privacy and other > reasons, the existence of these conversations or other law > enforcements records may not be concealed. Please search > cross-references for Ibragim Todashev that may reveal such > communication, in addition to primary indexes. Thank you! > ''' > - > https://www.muckrock.com/foi/united-states-of-america-10/inducedbytrap-2348… > best regards,

3 2

TheCthulhu (CthulhuSec)'s Insurance File
by Michael Best 19 Jan '16

19 Jan '16

https://insurance.thecthulhu.com/ > I would like to ask the public for help. My freedom may soon be > compromised, and therefore I require assistance to see out a final stage. I cannot comment on the contents of the container below other than it > contains pdfs, word documents, powerpoints, images and a few sql dumps. > Every person who downloads this for the record is doing a service for > democracy, and should hold people accountable for their atrocities. > When the time comes, I will ensure the passphrase for the container is > published either through myself or by proxy. I am not the only person with > it either. > To my friends out there, here is something to consider: > https://www.intelexit.org > I will not be intimidated. I am not afraid. I know the consequences, and I > accept them. > With the power of democracy, comes the responsibility of defending it from > any threat. SHA1: 2300 C680 5A95 D14A 75C0 9136 D28A 6459 42A6 1027 SHA256: 39D4 3376 8682 0821 36DF BF75 83B5 F6C0 7619 ADF5 8039 403F 9995 > C8FE 0245 DC75 Download links on TheCthuhu's page: https://insurance.thecthulhu.com/

2 2

Chaum Fathers Bastard Child To RubberHose ... PrivaTegrity cMix
by grarpamp 19 Jan '16

19 Jan '16

http://www.wired.com/2016/01/david-chaum-father-of-online-anonymity-plan-to… Now Chaum has returned with his first online privacy invention in more than a decade. And with it, he wants to bring those crypto wars to an end... a new encryption scheme he calls PrivaTegrity ... based on cMix. Chaum wouldn't comment on whether the project... would be commercialized or run as a non-profit. Chaum is also building into PrivaTegrity another feature... a backdoor that allows anyone doing something "generally recognized as evil" to have their anonymity and privacy stripped altogether. Nine server council... a hoseablitly focus point similar to Tor dirauths. In any case... interesting. https://www.scribd.com/doc/294737065/cMix-Anonymization-by-High-Performance…

11 17

CREST: CIA Records Search Tool
by Michael Best 18 Jan '16

18 Jan '16

I'm spending a fair amount of time at NARA II. Any thoughts on how I might be able to automate retrieval of documents from the CREST database? There are about 10 million pages of CIA docs that haven't even been accessed, much less made their way online. Since 2000, CIA has installed and maintained an electronic full-text searchable system, which it has named CREST (the CIA Records Search Tool), at NARA II in College Park, Maryland. *Over 11 million pages have been released in electronic format and reside on the CREST database, from which researchers have printed about 1.1 million pages. **In order to directly access CREST, a researcher must visit the National Archives at College Park, Maryland.* http://www.foia.cia.gov/collection/crest-25-year-program-archive

7 17

FBI on MLK Jr.
by Michael Best 18 Jan '16

18 Jan '16

Since it's today, I thought I'd share some of my MLK files. FBI Surveillance of Martin Luther King Jr. https://archive.org/details/nsia-KingMartinLutherKingJrDrFBISurveillanceEtc… Martin Luther King Jr. wiretaps https://archive.org/details/nsia-KingMartinLutherJrDrWiretapsPost-Assassina… FBI Field Office Records Inventory re: MLK Assassination https://archive.org/details/nsia-KingMartinLutherJrDrAssassinationFBIFieldO… J. Edgar Hoover's personal file on Martin Luther King Jr. https://archive.org/details/nsia- FBIHooverJEdgarPersonalFileOnMartinLutherKingJr Martin Luther King Jr. and associates FBI files https://archive.org/details/MLKFBI There should be at least one more MLK assassination related doc coming later today, watch That1Archive <http://That1Archive.neocities.org> for it and other goodies. --Mike That1Archive.neocities.org

1 1

“Your Account May Have Been Targeted by State-Sponsored Actors”
by Razer 18 Jan '16

18 Jan '16

Just Security's editor: This post is the latest installment of our “Monday Reflections” feature, in which a different Just Security editor examines the big stories from the previous week or looks ahead to key developments on the horizon. The end of 2015 brought a flurry of announcements from tech companies, including Facebook, Yahoo, and Microsoft, promising to notify their users if the company believes that state-sponsored actors are targeting the users’ accounts. These state-sponsored-attacker notifications share features of other kinds of attributions. On the one hand, like the Mandiant report and other reports by cybersecurity companies highlighting state-sponsored cyberintrusions, private companies are responsible for the attribution. On the other hand, like the limited evidentiary disclosures made by the US government in attributing the Sony Pictures hack to North Korea, the companies withhold the evidentiary basis for the notifications in order to protect their detection methods and avoid tipping off attackers. The notifications contribute to evolving debates about the requisite evidentiary basis for attribution of state-sponsored cyberattacks—debates over types of evidence, amounts of evidence, and levels of public disclosure that should be required for attribution in different contexts. The notifications also show that while standards of evidence for attribution are discussed in multilateral fora like the United Nations, states are not the only parties whose practice matters. Company Notifications Google pioneered notifications to users about state-sponsored attacks in 2012. The company explained in a blog post at the time that in response to “specific intelligence—either directly from users or from [its] own monitoring efforts”—it would display a banner stating “Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer.” Facebook made a similar announcement in October 2015. In a blog post by Chief Security Officer Alex Stamos, Facebook explained that it would show users a warning if the company has “a strong suspicion that an attack could be government-sponsored.” According to the New York Times, in the wake of the Iranian nuclear deal and “[j]ust weeks into the new [Facebook] alert system,” numerous State Department officials who work on Iran and the Middle East received notifications that their accounts had been targeted by a state-sponsored actor. In mid-December, Twitter, which had not previously announced a policy on state-sponsored attacks, notified some users that their accounts “may have been targeted by state-sponsored actors,” who were “trying to obtain information such as email addresses, IP addresses, and/or phone numbers.” (A copy a notification sent to another user is available here.) On December 21, Yahoo Chief Information Security Officer Bob Lord announced that “Yahoo will now notify you if we strongly suspect that your account may have been targeted by a state-sponsored actor.” Microsoft followed suit on December 30, announcing in a blog post by Corporate Vice President for Trustworthy Computing Scott Charney that Microsoft “will now notify you if we believe your account has been targeted or compromised by an individual or group working on behalf of a nation state.” According to the companies, they issue notifications for state-sponsored attackers in particular because, as Facebook explains, “these types of attacks tend to be more advanced and dangerous than others.” The notifications are intended to prompt users to better secure their account with the notifying company and other online accounts by, for example, enabling two-step verification, changing passwords, and monitoring for unusual activity. Similarities to and Differences From Other Attributions to Nation-States The state-sponsored-attacker notifications share similarities with prior attributions by both the private sector and the US government. On the one hand, the notifications (and the attributions supporting them) are done by private companies, like the reports on state-sponsored intrusions issued by cybersecurity companies like Mandiant and Crowdstrike that I discussed in an earlier post. On the other hand, unlike the extensive technical details that often accompany such reports (see, for example, the Mandiant APT1 report), the state-sponsored-attacker notifications do not come with evidence to back up the attribution. Google’s post on the notifications explains: “You might ask how we know this activity is state-sponsored. We can’t go into the details without giving away information that would be helpful to these bad actors, but our detailed analysis—as well as victim reports—strongly suggest the involvement of states or groups that are state-sponsored.” Facebook’s post similarly states, “To protect the integrity of our methods and processes, we often won’t be able to explain how we attribute certain attacks to suspected attackers.” The invocation of secrecy to protect “methods and processes” echoes similar statements made by the FBI in announcing the attribution of the Sony Pictures hack to North Korea. The FBI press release explained that the “need to protect sensitive sources and methods” prevented the Bureau from sharing details of its evidence against North Korea. The FBI provided a general description of the evidence supporting the attribution, including, for example, “significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea.” But the lack of detailed information triggered significant skepticism within the security community, prompting FBI Director James Comey to release additional information several weeks later. Unlike the other types of attribution, the state-sponsored-attacker notifications do not name the state involved. They simply inform a user that some “state-sponsored actor” has targeted the user’s account. Of course, upon receipt of a notification, some users may have a pretty good idea which state is targeting them, and the pattern of accounts targeted may reveal the state’s identity to the company or to the public if/when the notifications become public. That may be what happened with the Facebook notifications to State Department employees discussed above. Still, the notifications’ failure to name the particular state involved renders them somewhat less accusatory than attributions that name a specific state... In full, with links: https://www.justsecurity.org/28731/your-account-targeted-state-sponsored-ac… -- RR "You might want to ask an expert about that - I just fiddled around with mine until it worked..."

1 0

making better earth humans [was: Self Preservation and Irreversible Decline]
by coderman 17 Jan '16

17 Jan '16

On 1/16/16, juan <juan.g71(a)gmail.com> wrote: > [ ... insert feedback loop of awful here... ] > "a picture is worth...." this is funny and accurate! i have no political disposition, no "team". early on studying decentralization of technology it became clear you need decentralization of all things, there is no place to define a delineation safely. decentralization as driving force in implies that every node must rise to the challenge. in the technical realm this is a fun detour through information security, accuracy, and byzantine tolerance, among many obscure details. but in earth humans, it means the utmost moral imperative is: making better earth humans! first step of this process being education. best resources for educating future generations of cypherpunks?

3 2

RE: Re: US State Of New York to Ban Encrypted Screenlocked Phones and Devices
by boot＠ghostmail.com 17 Jan '16

17 Jan '16

Last week, former NSA Director Michael Hayden made a very strong argument against deliberately weakening security products by adding backdoors https://www.schneier.com/blog/archives/2016/01/michael_hayden_.html Thu Jan 14 2016 18:22:44 from Patrick Lonergan <xcelq(a)fastmail.com> ------------------------------ When we make something un break able. like tor but even the "un breakable" anonymous can be broken. On Thu, Jan 14, 2016, at 09:10 AM, boot(a)ghostmail.com wrote:no no no this is all wrong.. If new york can decrypt, it means there is a backdoor we know backdoors can be used by anyone who finds them. this is bad not only for pplz but also for business, who will still trust us tech? Thu Jan 14 2016 00:24:18 from John Young <jya(a)pipeline.com> ------------------------------ http://assembly.state.ny.us/leg/?default_fld=&bn=A08093&term=2015&Summary=Y… "New York can and should lead the nation in protecting its citizens, and in responding to the misguided and dangerous attempts by digital device manufacturers to turn digital devices into virtual safes that, being beyond the reach of law enforcement, are havens for criminals. Revela- tions in the recent past about NSA surveillance and similar government intrusions on privacy have made people acutely aware of threats to their privacy. The goal of this bill is not to limit peoples' privacy. Peoples' privacy is protected by the warrant requirement, as it always has been. This bill would help to protect all New Yorkers." We Love New York Sent from secure GhostMail. Easy and free encrypted email, chat and cloud storage, free sign up here. Sent from secure GhostMail. Easy and free encrypted email, chat and cloud storage, free sign up here: https://www.ghostmail.com

4 4

Post-"Pre-Publication Review" by DIA censored words "SIGINT" and "Ned Beatty"
by Razer 17 Jan '16

17 Jan '16

Not JUST FOIAs. Fixing Pre-Publication Review: What Should Be Done? By Steven Aftergood Friday, January 15, 2016 at 9:15 AM Jack Goldsmith and Oona Hathaway called attention in several recent columns to the pre-publication review process (here, here, here, and here) that many current and former national security officials and other government employees must submit to before their work can be published. The process, they argued, has become dysfunctional, overstepping legitimate national security boundaries and infringing on freedom of speech as well as the public’s right to know. Their case is strong. Among many pertinent examples, the experience of former Army Reserve officer Anthony Shaffer is particularly instructive. After he wrote a memoir of his Afghan war experience, Shaffer submitted his manuscript to the Army for review, as required, and the approved text was printed. But then the Defense Intelligence Agency intervened and objected that in its estimation the cleared volume still contained classified information. Publication was halted, and the Department of Defense was obliged to purchase and pulp thousands of copies of the book, although numerous publicity copies had already been released. A new version of the book with the objectionable words and passages blacked out was finally published for sale. (Shaffer presented his version of events in a First Amendment lawsuit he brought in 2010, with very limited success.) What makes the Shaffer case valuable in this context is that both the pre- and post-publication review versions of his text entered public circulation, permitting external scrutiny of the deletions required by the official reviewers. In nearly every case, the redacted words and passages seem to be devoid of national security sensitivity, as the Army itself had originally concluded. The most frequent redaction is the cover name that the author used while serving in Afghanistan, “Christopher Stryker.” Also commonly deleted are references to the National Security Agency, its headquarters location in Fort Meade, Maryland, and the use of the term “SIGINT” (signals intelligence). Somewhat more plausibly, the identity of the former CIA chief of station in Kabul was replaced with a pseudonym. But rather less plausibly, a passing mention of the name of character actor Ned Beatty was deleted. The point, in other words, is that there is an empirical foundation for the belief that pre-publication review has gone off the rails. As it is conducted today, the review process too often arbitrarily impedes the freedom of many US government employees to participate in public discourse. In full with links at JUst Security: https://www.justsecurity.org/28827/fixing-pre-publication-review-done/ -- RR "You might want to ask an expert about that - I just fiddled around with mine until it worked..."

2 1