February 2016 - cypherpunks - lists.cpunks.org

Philosohpical - Reading between the lines: the Great War of Continents, information wars, and multipolarity
by Zenaan Harkness 17 Mar '16

17 Mar '16

Speaking of agendas, of course we each tend to see the world, the struggles of the day, through particular lenses, preferences, agendas etc. This philosophical piece has an image which could make a great desktop background - but more importantly may help remind some (such as I) to take note of the breadth of viewpoints/ agendas from which we may couch any events of the day. Perhaps you might enjoy it too. http://fortruss.blogspot.ru/2015/11/reading-between-lines-great-war-of.html Regards, Zenaan

2 2

Who we are up against
by Zenaan Harkness 07 Mar '16

07 Mar '16

For those who have not yet read of this, it's a must to comprehend. Lest ye doubt humans are rightly labelled 'sheep'. https://en.wikipedia.org/wiki/Milgram_experiment Something uplifting to counterbalance: > http://thesaker.is/submarines-in-the-desert-as-my-deepest-gratitude-to-you/ (Thank you very much Alex.) And some comedy: http://thesaker.is/scotts-collection-of-russian-humor-hilarious-must-read/ Regards, Zenaan

3 7

Once again: Tor timing attacks and a Tor confession
by Georgi Guninski 06 Mar '16

06 Mar '16

Searching the web for "tor timing attacks" (without quotes) returns too many hits. Short summary and PoC is at [1]. At [2] Tor (and/or DoD) confess: > The Tor design doesn't try to protect against an attacker who can see > or measure both traffic going into the Tor network and also traffic > coming out of the Tor network. NSA and the like definitely can "see" traffic almost everywhere, so Tor doesn't protect against the NSA, right? (some people learnt this the hard way). IMHO the first fucking thing Tor must do is to make the user click at least three times on the above disclaimer. Trying to make the rant on topic: Is it theoretically possible at all to make low latency anonymity of sufficiently decent quality? [1] http://seclists.org/fulldisclosure/2014/Mar/414 PoC: End-to-end correlation for Tor connections using an active timing attack [2] https://blog.torproject.org/blog/one-cell-enough

7 18

Standard Operating Procedure 303
by Rayzer 01 Mar '16

01 Mar '16

On January 8 2016 the US Supreme Court will consider a petition for certiorari in the EPIC v. DHS "Standard Operating Procedure 303" FOIA suit. SOP 303 is also known as the 'National Emergency Wireless Kill-Switch' “Standard Operating Procedure 303,” is the protocol that codifies a “shutdown and restoration process for use by commercial and private wireless networks during national crisis.” Moreover, the justices are expected to clarify: “the scope of FOIA’s “Exemption 7(F),” which allows the government to withhold “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information … could reasonably be expected to endanger the life or physical safety of any individual.” The central question raised by Exemption 7(F) is whether the government has to be able to identify with any specificity the “individual” whose life or physical safety might be endangered by disclosure of the requested law enforcement records. In 2008, the Second Circuit answered that question in the affirmative in ACLU v. Dep’t of Defense. In its February 2015 decision affirming the government’s rejection of EPIC’s FOIA request, the D.C. Circuit held expressly to the contrary. As I explain in the post that follows, not only is this division of authority sufficiently important so as to justify the Supreme Court’s intervention no matter how the Court ultimately rules, but, in my view, the Second Circuit clearly has the better reading of Exemption 7(F) as a matter of statutory purpose, structure, and policy. I. The Second Circuit and the PNSDA The story begins with FOIA requests filed in 2003 by the ACLU and other organizations seeking records related to the treatment and death of detainees held in US custody overseas after September 11, and records related to the practice of “rendering” some of those detainees to countries known to use torture. The litigation over the ACLU’s request eventually reduced to a dispute over at least 29 (and perhaps thousands of) photographs of detainees and detainee abuse in Afghanistan and Iraq. In June 2006, the district court ordered the release of 21 of those photographs (with proper redactions to alleviate privacy objections), and the government appealed, arguing that the photographs were covered by Exemption 7(F) insofar as their release would likely incite violence against US personnel in Afghanistan and Iraq.” In full with links at Just Security https://www.justsecurity.org/28485/foia-circuit-split-supreme-court-resolve/ -- RR "You might want to ask an expert about that - I just fiddled around with mine until it worked..."

3 6

Judge Orenstein denies USG motion to compel Apple decrypt
by John Young 29 Feb '16

29 Feb '16

Judge Orenstein denies USG motion to compel Apple decrypt. <https://t.co/3hx0rT40ja>https://cryptome.org/2016/02/usg-apple-edny-029.pdf This is older case than that in California but similar issues.

1 0

Re: [cryptome] Re: FOIPA adventures
by coderman 29 Feb '16

29 Feb '16

two new for DOCSIS tech @FBI, @CIA: "Any and all "DOCSIS" technology records, including cross-references and indirect mentions, including records outside the investigation main file. This is to include a search of each of the following record stores and interfaces: the Central Records System (CRS), the Automated Case Support system ("ACS") Investigative Case Management system ("ICM"), the Automated Case Support system ("ACS") Electronic Case File ("ECF"), and the Automated Case Support system ("ACS") Universal Index ("UNI"). I also request a search of "ELSUR", the database containing electronic surveillance information, for any and all records or activities related to "DOCSIS" or "DOCSIS intercept" or "DOCSIS access" technology. In addition, please extend the search criteria across any external storage media, including I-Drives, S-Drives, or related technologies used during the course of investigation involving Cable internet data services. DITU experimental technologies or research also within scope of this request. Please include processing notes, even if request is denied in part. Please identify individuals responsible for any aspect of FOIA processing in the processing notes, along with explanation of their involvement if not typically assigned FOIA responsibilities for the record systems above." - https://www.muckrock.com/foi/united-states-of-america-10/indocsis-19725/ "Any and all records, receipts, training, technology transfer programs, research, evaluation technologies, or other materials relevant to "DOCIS" cable communication technology. This is to include "DOCSIS 1.0", "DOCSIS 2.0", "DOCSIS 3.0", and other relevant DOCSIS protocols." - https://www.muckrock.com/foi/united-states-of-america-10/indocsisxfer-19726/ On 7/12/15, coderman <coderman(a)gmail.com> wrote: > On 7/12/15, Douglas Rankine <douglasrankine2001(a)yahoo.co.uk> wrote: >> Are they giving reasons for the rejections? > > Glomar all around. see also: > > "What Is the Big Secret Surrounding Stingray Surveillance?" > - > http://www.scientificamerican.com/article/what-is-the-big-secret-surroundin… > > --- > > What Is the Big Secret Surrounding Stingray Surveillance? > > State and local law enforcement agencies across the U.S. are setting > up fake cell towers to gather mobile data, but few will admit it > By Larry Greenemeier | June 25, 2015 > > > Stung: Law enforcement agencies sometimes use a device called a > stingray to simulate a cell phone tower, enabling them to gather > international mobile subscriber identity (IMSI), location and other > data from mobile phones connecting to them. Pictured here is an actual > cell tower in Palatine, Ill. > > > Given the amount of mobile phone traffic that cell phone towers > transmit, it is no wonder law enforcement agencies target these > devices as a rich source of data to aid their investigations. Standard > procedure involves getting a court order to obtain phone records from > a wireless carrier. When authorities cannot or do not want to go that > route, they can set up a simulated cell phone tower—often called a > stingray—that surreptitiously gathers information from the suspects in > question as well as any other mobile device in the area. > > These simulated cell sites—which collect international mobile > subscriber identity (IMSI), location and other data from mobile phones > connecting to them—have become a source of controversy for a number of > reasons. National and local law enforcement agencies closely guard > details about the technology’s use, with much of what is known about > stingrays revealed through court documents and other paperwork made > public via Freedom of Information Act (FOIA) requests. > > One such document recently revealed that the Baltimore Police > Department has used a cell site simulator 4,300 times since 2007 and > signed a nondisclosure agreement with the FBI that instructed > prosecutors to drop cases rather than reveal the department’s use of > the stingray. Other records indicate law enforcement agencies have > used the technology hundreds of times without a search warrant, > instead relying on a much more generic court order known as a pen > register and trap and trace order. Last year Harris Corp., the > Melbourne, Fla., company that makes the majority of cell site > simulators, went so far as to petition the Federal Communications > Commission to block a FOIA request for user manuals for some of the > company’s products. > > The secretive nature of stingray use has begun to backfire on law > enforcement, however, with states beginning to pass laws that require > police to obtain a warrant before they can set up a fake cell phone > tower for surveillance. Virginia, Minnesota, Utah and Washington State > now have laws regulating stingray use, with California and Texas > considering similar measures. Proposed federal legislation to prevent > the government from tracking people’s cell phone or GPS location > without a warrant could also include stingray technology. > > Scientific American recently spoke with Brian Owsley, an assistant > professor of law at the University of North Texas Dallas College of > Law, about the legal issues and privacy implications surrounding the > use of a stingray to indiscriminately collect mobile phone data. Given > the invasive nature of the technology and scarcity of laws governing > its use, Owsley, a former U.S. magistrate judge in Texas, says the > lack of reliable information documenting the technology’s use is > particularly troubling. > > > [An edited transcript of the interview follows.] > > When and why did law enforcement agencies begin using international > cell site simulators to intercept mobile phone traffic and track > movement of mobile phone users? > > Initially, intelligence agencies—CIA and the like—couldn’t get local > or national telecommunications companies in other countries to > cooperate with U.S. surveillance operations against nationals in those > countries. To fill that void companies like the Harris Corp. started > creating cell site simulators for these agencies to use. Once Harris > saturated the intelligence and military markets [with] their products, > they turned to federal agencies operating in the U.S. So the [Drug > Enforcement Administration], Homeland Security, FBI and others started > having their own simulated cell sites to use for surveillance. > Eventually this trickled down further to yet another untapped market: > state and local law enforcement. That’s where we are today in terms of > the proliferation of this technology. > > > Under what circumstances do U.S. law enforcement agencies use cell > site simulators and related technology? > > There are three examples of how law enforcement typically use > stingrays for surveillance: First, law enforcement officials may use > the cell site simulator with the known cell phone number of a targeted > individual in order to determine that individual's location. For > example, officials are searching for a fugitive and have a cell phone > number that they believe the individual is using. They may operate a > stingray near areas where they believe that the individual may be, > such as a relative's home. > > Second, law enforcement officials may use the stingray to target a > specific individual who is using a cell phone, but these officials do > not know the cell phone number. They follow the targeted individual > from a site to various other locations over a certain time period. At > each new location, they activate the stingray and capture the cell > phone data for all of the nearby cell phones. After they have captured > the data at a number of sites they can analyze the data to determine > the cell phone or cell phones used by the targeted individual. This > approach captures the data of all nearby cell phones, including > countless cell phones of individuals unrelated to the criminal > investigation. > > Third, law enforcement officials have been known to operate stingray > at political rallies and protests. Using the stingray at these types > of events captures the cell phone data of everyone in attendance. > > > How does law enforcement get permission to perform this type of > surveillance? > > Federal law enforcement agencies typically get courts to approve use > of something like stingray through a pen register application [a pen > register is a device that records the numbers called from a particular > phone line]. With that type of application, essentially the government > says, we want this information. We think it’s going to be relevant to > an ongoing criminal investigation. As you can imagine, that’s a pretty > low bar for them to satisfy in the eyes of the court. Just about > anything could fit into that description. You don’t even have to show > that such an investigation would lead to an arrest or prosecution. Law > enforcement is telling the court, look, we’re in the middle of this > investigation. If we get this information, we think it might lead to > some other important information. > > Different court orders have different standards for approval. The > highest standard would be for a wiretap. A search warrant likewise has > a much higher standard than a pen register, requiring law enforcement > to prove probable cause before a judge will grant permission to use > additional means of investigation. The problem that I have with a pen > register to justify use of something like a stingray is that the > standard for a pen register is much too low, given the invasive nature > of a pen register. Instead, I think the use of a stingray should be > consistent with the Fourth Amendment of the Constitution and pursuant > to a search warrant. > > > Why not explicitly state the type of technology being used and its > specific purpose when filing for a court order? > > [When] law enforcement agencies seek to obtain judicial authorization > through a pen register, they do not directly indicate that they are > applying for authorization to use a stingray. Doing so might cause > some courts to question whether the pen register statute [as opposed > to some higher standard] is the appropriate basis for authorizing a > stingray. In addition, law enforcement agencies typically have to sign > nondisclosure agreements with Harris Corp. in order to receive the > federal Homeland Security funding needed to purchase the technology. > So there’s this concern, at least at the local law enforcement level, > about revealing any information about it because that would violate > the agreement with Harris and maybe subject them to losing the > equipment or some other consequences. > > > Why would law enforcement agencies sign a nondisclosure agreement with > a technology company? > > I’m not sure whether the agreements are being driven by the FBI or by > Harris, but these agreements seem to be getting less relevant insofar > as [there is less] need to keep the public unaware of the existence of > this technology. In the last three or so years there’s been a lot more > awareness about the technology and its use. When agencies were first > signing these agreements years ago, use of this technology wasn’t > widely known. Now you are getting situations where criminal defense > attorneys learn about stingray and similar technologies and the role > they may be playing in the arrests of some of their clients. Defense > teams are starting to ask questions and require the government to > produce documentation such as court orders, and that’s creating the > confrontation you’re now seeing. > > > Why have law enforcement agencies kept their use of cell site > simulators so secretive? > > Some of it is the cloudy legal issues surrounding the legitimate uses > of this technology. Law enforcement agencies will also argue that the > more information that’s available about this technology, the harder it > is for them to use these devices to fight crime. Yet there’s a growing > knowledge of this technology, and a serious criminal enterprise is > already aware of it. People are already using prepaid disposable > phones [sometimes referred to as “burner phones”] to some extent to > defeat this technology. Sophisticated criminals are aware that there’s > electronic surveillance out there in myriad ways, and so they’re going > to take precautions. From a technology perspective, it’s sort of a > cat-and-mouse game. There’s also a device that locates cell site > simulators, something referred to as an IMSI catcher. There’s an arms > race back and forth to get the best technology and to get the edge. > > > What does it say to you about the whole process that a prosecutor or a > law enforcement agency is willing to sacrifice a conviction in order > to keep their methods a secret? > > I think it’s a very odd approach. You are throwing away some > convictions or potential convictions for the sake of secrecy. But it’s > even harder to understand now that knowledge of the technology is > becoming so common. There have been documented cases in Baltimore and > Saint Louis where stingray has supposedly been used. The use of > stingray and related technologies is a roll of the dice in the sense > that law enforcement is hoping that either the defense attorneys don’t > have enough savvy or wherewithal to find out about the technology and > ask the right questions or, even if that does happen, they’re hoping > that the judge that they have is favorable to their approach and not > going to order them to reveal information about its use. In the rare > occasions when things go against them, they just dismiss it. > > > You yourself denied a law enforcement application three years ago to > use a stingray. Under what circumstances would you approve its use? > > I want to make clear: I don’t have a problem with stingray itself—I > understand that this can be a valuable tool in law enforcement’s > arsenal. My problem is that I want it to be used pursuant to a high > standard of proof that it’s needed, and that I want the approval > process to be more transparent. One of the reasons I’d like to see > some more documentation of stingray applications and orders is because > I have this suspicion—but there’s no way of confirming it one way or > another—that some judges are signing approvals to use this technology > thinking that they’re just signing a pen register. If a judge thinks > it’s [just] another pen register application, they’re just going to > sign it without giving it much pause. > > > Now that the use of this stingrays and related technologies has been > made public, where will this issue be a year or a few years from now? > > A year from now I think we’re in the same position. You’re dealing > with outdated statutes concerning new and very different technology. > It’s possible in five years maybe that Congress will step in and do > something. More likely, state legislatures will take most of the > action to monitor this type of surveillance. Washington State, > California [and others] have already acted, and Texas is evaluating > the standards for approving stingray use. >

11 83

'Weapon of Mass Transparency': a Script to FOIA the Files of 7,000 Dead FBI Officials
by Michael Best 29 Feb '16

29 Feb '16

http://motherboard.vice.com/read/an-activist-michael-best-wrote-a-script-to… http://that1archive.neocities.org/tools/FBIOFFICIALS.csv http://that1archive.neocities.org/tools/FOIA%20bash%20FBI - NOTE: use a text editor to replace "FIRST NAME LAST NAME" etc with your information before executing and verify the code before running the bash script -- Veritas aequitas liberabit vos Veri universum vici That 1 Archive <http://that1archive.neocities.org/> @NatSecGeek <https://twitter.com/NatSecGeek> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: SKS 1.1.5 Comment: Hostname: pgp.mit.edu mQINBChG9zoBEADKzALG4UHCjY6L9OFUxWRVGGCW7LY71K2EAK/0jkRh1wPkJ4chPaVJ3vVD nJ0d8HxsyR5R3+y7GH6GCc/tK0IDPJah+xpQnraS1nWUvAlSaaxsBK4hJfuVGyfBg/joQVKU OhpqJLQhRIkUWk30QC94IbOKiCTb6V4pStLYyrLieewjT481vvRIYp/48IS5eiveZW0/IpcA HBON7xJw6P1murC8PNOJSWRCp9FJhcs3wIPG3cFTfsxSZnGcoivMgFLtGAfLbztpZkcHEMOR 4qamVvirzYGHma0UlOzyNr7xpxyLXFsU5kKzQ8Az2nP1GG7vuqXSjPNLIvvHFL+g+gKuCe9W xTa9Ac038RRSiBGdDrvTFpQ/h9h5GWIHP7nsA4TCeZSpL81aqp7Cb0MK3KPQmteTPIujVCnx jXXHrOe9Tj6iYUU8edApISyBEVFZMd+EtfDEDf/ZwDjzSGE85vv1dZ/ck7iJvS8FwM8hsRBG U9huCKiItGs26teUJ2Sum49YaEiDL4QLQhJ+FbsAusxJg+V3GE/4w75K/6/czT0p10Mf66Uo fRFTvYRE7S6CNDxzTI4q7+pnRlxMBduGC33KY4eq4Py/O3LWHBDxZ+LffIa/tWcB/7oZ6yDo bdWleNk5wnJdPGr6lUTHTM4tpDIEcXYpvjzyLcMtg4tFm/Dc0QARAQABtGVNaWNoYWVsIEJl c3QgKFByaXZhdGUsIG5vdCBzZWN1cmUuIEZvciBzZWN1cmUgZW1haWwsIHJlcXVlc3QgYSBv bmUtdGltZSBrZXkuKSA8dGhlbWlrZWJlc3RAZ21haWwuY29tPokCPQQTAQoAJwUCKEb3OgIb AwUJNXc1AAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCiYH9hY4dAS3e+D/sFwyJER4/4 ZnHYC/1EzCpHeDikSmULEgsvNgzo73thOV9/Q2I8mCJTlQjsK4rZ2YiDzi4b0CN8kzjpxtVz BsBsxfyPLrdH4VoqeqeBVzbwHxSk7bYUI3vFt+e3gBgpAxbVfPXCnYUnWPRlr9dc/JZoPJH4 p8yRIqktehbAE3Fa3gkfrXJ5e6+/nKlQhikyvo9VuErrLpPMXBzOq4/2LVfurkcOzlp1RBjs hWr6B98EiOXs44ZGLEkINxJiW8koFhw/WDuON8LKi/DtLiqqtBVTjrkqKCuKzSAVncGGcEVO 3Om3aOIOvG0do/wQKYXnpbeGsHwx2PGrJ7H+lb2bIb5KhbZkbG4rMTjsVnuGN+IF4BxBhmGz MYoooWy4VCLL0o8keomU8JPXt+fZDqJ9sNjY/asTsjOa6aE3bIa6w3mWUeefGwA25oXur3Rr L3wmu1pPzCejumfA1X93dS9UZS3xni+7W34g6YbsREuaZ+YBxFLN227JXAx2pEdjLsuVOaqM 9CO7ARHsxDZoE9U7n0s3txnSw/2YYwjEK1wDhdLnHBL3ZzaAcaHnpzsTYQAVW7uXKKHhzeSK GP3O4ByCisM/7WLFvIIpaNNs85jI1PvKH0GutSTl9xXDfWuYMl9rwwbteBB/oGSxlIFe0pqq IDNfAJdR/HjTLqrTES2wdXJS1bkCDQQoRvc6ARAAmltXrhVfpePdIFrfEHCet4nkQvmRI+AX rUgiNlxQDW8M5FzlUfT2xpMXHMWuKehTYpFq7bNbFi+fwBhMajgvgDsTuLInftKSFp+sisbR n8psv7CpGB4jp0Xd4y1Wm/HejV/kga0kcUVVetaqyzgZedn1UnccQRzDBVWW2j2ed+hi/8g0 /d7mbVG81yzJo8tLidM90xFF7JGlijm0dBAqmhD4UgkxSnJQ3PK5onqdjdbx7HkP68RrkeTQ vhWK1978qzdSl9ljJ0jLnoAaDNPs5Dj/TyYCtqoKHUqMbTwU5nIQnJG7geMeSw/7OVnKlypF Rs/JesZzMBooZTRxZJuIB/q0wOfE/MYTwGSwLs2brUwJFJ6bSYmerZ+81S8W/Y4mehJ3o6Vl SabrrVN+LlBfUuRqd5U909WECzk6HVnwnRfL07zD+1y5cLU+e4MQs2227kLriTIxtDZ/umeG hKQgNgFGTAPHJxA96xGvQ8Ovv+XEivlO0jxBNMIiopNSlMDE+k3nigWHuavt9LUUCOd45aw7 0pgKstQQgpFfVAwV98LPpUKxa61q6wQiQHAcP7YxuQG0dsr4nUq2xids5l1IpOLzZJ3nRThM k7alkljBbqphbocV3FsSXOkpcSWns94k1QGmrPzEPLF0FHFBG6whWoaoEySMkdsN1zVu4GMU o2EAEQEAAYkCJQQYAQoADwUCKEb3OgIbDAUJNXc1AAAKCRCiYH9hY4dASzTaEACKXVgc8KmZ xWyYTUQgIwrj3J/re68uIilq0iBBDocgEZZpxyf6lD1V3IKBjAPpWyYHMrrrLY64rFDR+8DE Xyhm1Wv2S6YJuWJtyAlS4bciXjJE6evirIH5GoFq++vzsufRaudAoQ56hJ0+Z3dNMMWZ6YuP zWNNL2tvpdo3Nvd8bqiADWSffFdIPv5Yj/mZsXmaDN+7iWYlAdCrubGyGzFHlCh26Ghu6SS0 /u8x1/Oi7ma7fUMFnEsFiYjwBkD3pQKK1dm7j2f1OMxi8uky8vgBgx40aeJkoUgEvIHWsCIi CWVTyfiGeWIcKbK7tYP5jsjV5fUv+TaQ1pApt++Pyop1aogfQ8icNBQQkdX6E4gNhnPOPTM8 FTl69Tq5Ori5+TM8VM0iPGiydlcAXIAD3OyR4tZM12Ga1AtppKjx31EyDB4SPzUmDWRy5WgG NRH3+RgiK/iXVcvLdFIKj3/AvctSLdbayyaFD8zrE/wcMzLfie+iE231+rG/7gmcR3H1rcYE vxvmWAPikLQKiMUpPBNSvfLPUTrwNSGiZ5ieAAPgOooc3u5nohwZmEW1pg6HirZgIAgAYuyL aLgnikwH70guiQ4Ufsih3gy0ddsUwliUTtbYQyX0OBQoTUyaiXPy0Wu2FJfsxiW8X9Lu9pIH KOwU9K76VKot+UikGqeFQsS/Ig== =M+du -----END PGP PUBLIC KEY BLOCK-----

2 1

"ODNI trying to sneak through attack on MDR"
by Michael Best 29 Feb '16

29 Feb '16

$72 an hour fees, $0.50/page for copies http://www.regulations.gov/#!documentDetail;D=ODNI-2016-0001-0001 https://twitter.com/NSANate/status/704313004263870465 -- Veritas aequitas liberabit vos Veri universum vici That 1 Archive <http://that1archive.neocities.org/> @NatSecGeek <https://twitter.com/NatSecGeek>

1 0

The Natseckers
by John Young 28 Feb '16

28 Feb '16

DoJ is required to cloak NSA-CIA capabilities by pretending full sharing does not take place. Redacted and excluded filings and decisions by DoJ, district, appeal, SCOTUS and FISA courts along with open and classified executive orders by and POTUS, and best of all, classified contracts, implements this. In olden days there was a fairy-land time when NSA-CIA were required to cull, select and "minimize" (except in wartime and emergencies) their take and capabilities with FBI and law enforcement, but no longer, the Patriot Act Dr Zeuss loosened the ties that never bound. Going to court melodramatizes and sanitizes the bung-holing (like USG v. Apple) with in camera, withholding, stonewalling and denying. It should be understood, Dear Dummies, that lawyers, security clearance holders, corporations, NGOs and and greeders who assist and abet spying understand how to play this rigged game to keep the public "safe and secure" in blissful passivity. Encryption, necessarily quietly compromised for dependable marketability, has always been a formulaic-algorithmic Faustian character in the comsec-infosec charade where official secrecy triumphs over chaotic rabble-empowering democracy. This big-budget high-profit Broadway performance is called "The Natseckers." At 08:06 PM 2/27/2016, you wrote: >isn't there supposed to be "sharing" when it comes to terrorism. >patriot act & such. > >Sent: Friday, February 26, 2016 at 2:15 PM From: "John Young" ><jya(a)pipeline.com> To: "Henry Baker" <hbaker1(a)pipeline.com>, >cypherpunks(a)cpunks.org, cryptome(a)freelists.org, >cryptography(a)metzdowd.com, cryptography(a)randombit.net Subject: Re: >[cryptography] [Cryptography] USG v. Apple, Apple Motion to Vacate >Decrypt Order >At 11:13 AM 2/26/2016, Henry Baker wrote: >If this interpretation of >the All Writs Act is upheld, then the DOJ >will have to consult with >the intelligence community prior to >compelling companies like Apple >to decrypt phones. It would be quite >interesting for DOJ to >publicly stipulate that NSA could (or could >not) break into iOS 8 >or 9. This is truly a sticky wicket, since the >intelligence >community is generally prohibited from working on >domestic issues. >We asked for an opinion of Michael Froomkin, Law Professor at >University of Miami, on Henry Baker's comments: ><https://cryptome.org/2016/02/can-spies-break-apple-crypto.htm>https://cryptome.org/2016/02/can-spies-break-apple-crypto.htm >_______________________________________________ cryptography mailing >list cryptography(a)randombit.net ><http://lists.randombit.net/mailman/listinfo/cryptography>http://lists.randombit.net/mailman/listinfo/cryptography

1 0

OFFSystem
by grarpamp 28 Feb '16

28 Feb '16

On 2/25/16, Jerry Leichter <leichter(a)lrw.com> wrote: >> So let me understand: exactly *where* is my data? >> >> If I have a file full of random numbers in country #1 and another file >> full of random numbers in country #2 and another file full of random >> numbers in country #3 and so on, so I guess my "data" is in *all* of the >> countries. >> >> But only I know the function that will transform the data stored in all of >> these countries into a form that might actually be useful, so my "data" is >> also in *none* of the countries. > Congratulations. You've rediscovered the argument every kiddie comes up > with to protect themselves from copyright lawsuits: I don't actually have > your protect music on my server. I have a bunch of random numbers. So does > my friend across the street. It happens that if you XOR the two together > you get the music, but neither of us actually has your music.... > > It's nonsense. You're acting as if judges were idiots. They're not. > > If you encrypt your stuff locally before putting it in the cloud, and hold > the key yourself, you're protected against anything the cloud provider can > do. They can only deliver what they have (encrypted text that neither they > nor the government can read), not what they don't have (the corresponding > plaintext.) This is much safer than any hacks for spreading the stuff > around. > > Add integrity checks if you're concerned about modification attacks. Use > replicas and error correction to deal with failures of individual replicas. > > The rest is just noise. > -- Jerry https://en.wikipedia.org/wiki/OFFSystem http://offsystem.sourceforge.net/ Add https if you're concerned to make it better.

2 1