- cypherpunks - lists.cpunks.org

Re: [Cryptography] What should I put in notifications to NSA?
by grarpamp 18 Dec '15

18 Dec '15

On Tue, Dec 15, 2015 at 11:29 PM, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > I am working on staging the code for the Mesh on SourceForge. > > https://sourceforge.net/projects/mathematicalmesh/ > > There is this bit to do: > > You must notify BIS and the ENC Encryption Request Coordinator via > e-mail of the Internet location (e.g., URL or Internet address) of the > publicly available encryption source code or provide each of them a > copy of the publicly available encryption source code. If you update > or modify the source code, you must also provide additional copies to > each of them each time the cryptographic functionality of the source > code is updated or modified. In addition, if you posted the source > code on the Internet, you must notify BIS and the ENC Encryption > Request Coordinator each time the Internet location is changed, but > you are not required to notify them of updates or modifications made > to the encryption source code at the previously notified location. In > all instances, submit the notification or copy to crypt(a)bis.doc.gov > and toenc(a)nsa.gov. > > > What do folk normally do here? I was thinking of giving them the URL > of the repository and a statement to the effect that by complying I do > not wave my first amendment rights Seriously?! How about linking to... http://fuckoff.com/ And if you're still worried, develop stuff anonymously, in/over anonymous networks. And if they still care to bother to find you, then your country's obviously shit and you need a new one. cc cpunks due to metzdowd thought police

2 1

America's Top Next Law: Go To Prison... For Reading... WTF?
by grarpamp 17 Dec '15

17 Dec '15

http://tech.slashdot.org/story/15/12/16/130218/go-to-jail-for-visiting-a-we… Eric Posner, the fourth most-cited law professor in the U.S., says the government may need to jail you if you even visit an ISIS site after enough warnings. He says, "Never before in our history have enemies outside the United States been able to propagate genuinely dangerous ideas on American territory in such an effective way—and by this I mean ideas that lead directly to terrorist attacks that kill people. The novelty of this threat calls for new thinking about limits on freedom of speech. The law would provide graduated penalties. After the first violation, a person would receive a warning letter from the government; subsequent violations would result in fines or prison sentences. The idea would be to get out the word that looking at ISIS-related websites, like looking at websites that display child pornography, is strictly forbidden" There would be exemptions for Washington-blessed journalists and others. Whew! Alas, this man isn't Donald Trump — he is a widely respected University of Chicago faculty member writing in Slate. http://www.slate.com/articles/news_and_politics/view_from_chicago/2015/12/i… http://www.teleread.com/ebooks/go-to-jail-for-visiting-a-web-site-or-maybe-… Of course crypto will be labeled a dangerous idea... Can't publish it, can't have it, can't use it, can't read it, can't think it.

3 2

Re: [Cryptography] Satoshi's PGP key.
by grarpamp 17 Dec '15

17 Dec '15

On Wed, Dec 16, 2015 at 5:50 PM, Henry Baker <hbaker1(a)pipeline.com> wrote: > Is there any chance that Satoshi works/worked for the > NSA or equivalent? > > For a huge number of reasons, s/he couldn't publish > under her/his own name, but may have gotten permission > to do this project anyway, so long as s/he didn't make > any personal profit on it. > > I can imagine that the NSA & GCHQ are still hurting > at not getting proper credit for developing "public > key" encryption, and they may not have wanted to see > a long string of bad versions of bitcoins foisted > upon the world when they already had a pretty good > solution. The NSA has proven to not be above doing things that it can exploit / track / manage.

1 0

Yoga class cancelled for "cultural issues" (insufficient awareness by class attendees of yoga origins)
by Zenaan Harkness 17 Dec '15

17 Dec '15

The practices of this yoga regime must be corrected. Zenaan's trigger warnings: contains the following words and phrases: spiritual, oppression, cultural genocide, yoga, cultural issues, Disabilities (I was so sure we weren't allowed to use that word any more), feeling left out, mindful stretching (evidently a taboo phrase as well). http://nypost.com/2015/11/23/pc-police-suspend-yoga-class-at-university-ove… A yoga instructor who teaches at the University of Ottawa says she is fighting to keep her program alive after the school’s student body suspended it over concerns that “cultural issues” relating to the class could offend students. Jennifer Scharf, who has been offering free weekly sessions at the university’s Center for Students with Disabilities since 2008, told the Ottawa Sun that she was informed in September that the program would not come back for the fall semester. ICYMI: Still our hottest story – Free yoga class cancelled over 'cultural issues' https://t.co/GZbUHJ8VRa #ottnews pic.twitter.com/J4F7AZo6Zj — Ottawa Sun (@ottawasuncom) November 23, 2015 In an email exchange between Scharf and a representative of the university’s Student Federation — which was viewed by the newspaper — a student wrote that “while yoga is a really great idea and accessible and great for students… there are cultural issues of implication involved in the practice. “Yoga has been under a lot of controversy lately due to how it is being practiced,” the email continues, and which cultures those practices “are being taken from.” The Student Federation, which operates the center, went on to say that many of those cultures “have experienced oppression, cultural genocide and diasporas due to colonialism and Western supremacy… we need to be mindful of this and how we express ourselves while practicing yoga.” Student Federation Acting President Romeo Ahimakin told the Ottawa Sun that the class has been put on hold until a way can be figured out “to make it better, more accessible and more inclusive to certain groups of people that feel left out in yoga-like spaces. “We are trying to have those sessions done in a way in which students are aware of where the spiritual and cultural aspects come from, so that these sessions are done in a respectful manner,” he added. But Scharf, who instructed about 60 students each week in the program, said, “people are just looking for a reason to be offended by anything they can find.” Scharf says she offered the student body leaders a compromise by suggesting she change the name of the course to “mindful stretching,” but after some debate, they couldn’t reach an agreement. “I guess it was this cultural appropriation issue because yoga originally comes from India,” she told CBC News. “We’re not going through the finer points of Scripture. We’re talking about basic physical awareness and how to stretch so that you feel good.” Scharf added that she is “fighting so hard” to keep the class.

3 2

GNU Taler: Taxable Anonymous Libre Electronic Reserve
by grarpamp 16 Dec '15

16 Dec '15

https://taler.net/ Taler technology: About taxability, change and privacy One of the key goals of Taler is to provide anonymity for citizens buying goods and services, while ensuring that the state can observe incoming transactions to ensure businesses engage only in legal activities and do not evade taxes (such as income tax, sales tax or value-added tax). However, we also want to stay out of the immediate personal domain, so sharing funds within a family or copying coins between devices should not be subject to monitoring by the state. In Taler terminology, we distinguish between transactions where the exclusive ownership of the value of a coin is passed from one entity to another, and sharing whereafter control over a coin is shared by multiple electronic wallets (which may belong to different individuals). In Taler, the receiver of a transaction is visible to the state and thus can be taxed, while sharing is invisible to anyone not involved. Once a coin is shared among different individuals, any one of those can try to spend it, but only the first spender would succeed. Thus, sharing requires a strong trust relationship among the individuals involved, and thus represent interactions in the protected immediate personal domain, and not commercial transactions. When Taler needs to provide change, for example because a customer only has a 5 Euro coin but wants to make a 2 Euro purchase, it needs to create fresh coins (of a total value of 3 Euros) that are unlinkable to the original 5 Euro coin to ensure privacy. To ensure that the resulting refresh operation where the change is converted to fresh coins cannot be used to transfer funds from one entity to another, Taler ensures that any owner of an original coin that was involved in a refresh operation can follow a link to the private information of the fresh coins generated by the operation. As a result of this trick, refresh operations cannot be used to create transfers, as the linkage ensures that the fresh coins are always shared with the owner of the original coin. As a result, Taler does not intrude into the personal economic domain, offers good privacy, taxability for transactions and the ability to give change.

4 4

NSA Attacks on VPN, SSL, TLS, SSH, Tor
by John Young 16 Dec '15

16 Dec '15

Der Spiegel released largest single day number of Snowden docs today, 666 pages, on NSA Attacks on VPN, SSL, TLS, SSH, Tor. http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-… We offer a RAR of the 44 docs: http://cryptome.org/2014/12/nsa-spiegel-14-1228.rar (197MB)

8 9

List: Why Zenaan's volcanos are bad
by grarpamp 16 Dec '15

16 Dec '15

Because they're completely fucking offtopic to anything cypherpunk! You know... crypto, cpunk relevant politics, privacy, crypto apps, law, tech, associated punkery, etc. Quit posting random offtopic shit. "The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society."

2 1

US Pres. Cand. Carly Fiorina Comes Out Against Crypto and Privacy
by grarpamp 16 Dec '15

16 Dec '15

http://www.breitbart.com/big-government/2015/12/14/exclusive-carly-fiorina-… When Fiorina was CEO at Hewlett-Packard, the NSA called her after the terrorist attack on September 11, 2001 asking for help. “They needed help getting a large amount of equipment very quickly. The reason they needed help getting that large amount of equipment quickly was because they were trying to stand up their ability to track people that were of a suspicious nature,” Fiorina explained. I diverted a lot of equipment from paying customers to the government in a very short period of time. I was happy to do it. “Number one, I would retaliate against China and Russia. They have hacked into some of our most sensitive systems and we haven’t done much about it,” she said, vowing, “I would retaliate.” “First that means there has to be laws that have to be passed. There are some things that have to be permissible legally, which would allow the private sector and the public sector to share information,” she said. One of the places we need help is to deal with all of these encrypted communications...we have to be able to work around it “It’s important for people to understand that because they’ve misunderstood that, and this address is one phone number to another phone number, that’s it,” she said, adding, “There is no content discussed. “ teaching people how to disappear online. They have online help desks.” Fiorina [babbled on about] the terrorist attack in San Bernardino

3 2

Concrete containment of Iceland's Eyjafjallajokull volcano desperately needed - please urgently contribute
by Zenaan Harkness 16 Dec '15

16 Dec '15

Witness the awesome 11km high CO2 destructive power of Eyjafjallajokull: http://www.icelandontheweb.com/articles-on-iceland/nature/volcanoes/eyjafja… Donations can be sent to my personal account. Thank you and regards, Zenaan PS 11km high is quite impressive, even for a volcano - this beast must be stopped! PS2 The following is a rather interesting link, bringing into question a few things, hopefully its purported facts are factual: http://volcanoes.usgs.gov/hazards/gas/climate.php PS3 But do note the precise wording by the Professor below - one would hope his wording is precise since he is a professor and all... ---------- Forwarded message ---------- Author's credentials: Ian Rutherford Plimer is an Australian geologist, professor emeritus of earth sciences at the University of Melbourne, a professor of mining geology at the University of Adelaide and the director of multiple mineral exploration and mining companies. He has published 130 scientific papers, six books and edited the Encyclopedia of Geology. Born 12 February 1946 (age 68) Residence Australia <http://en.wikipedia.org/wiki/Australia> Nationality Australian Fields Earth Science <http://en.wikipedia.org/wiki/Earth_Science> ,Geology <http://en.wikipedia.org/wiki/Geology> ,Mining Engineering <http://en.wikipedia.org/wiki/Mining_Engineering> Institutions University of New England <http://en.wikipedia.org/wiki/University_of_New_England_%28Australia%29> ,University of Newcastle <http://en.wikipedia.org/wiki/University_of_Newcastle_%28Australia%29> ,University of Melbourne <http://en.wikipedia.org/wiki/University_of_Melbourne> ,University of Adelaide <http://en.wikipedia.org/wiki/University_of_Adelaide> Almamater <http://en.wikipedia.org/wiki/Alma_mater> University of New South Wales <http://en.wikipedia.org/wiki/University_of_New_South_Wales> , Macquarie University <http://en.wikipedia.org/wiki/Macquarie_University> Thesis <http://en.wikipedia.org/wiki/Thesis> The pipe deposits of tungsten-molybdenum-bismuth in eastern Australia < http://www.worldcat.org/title/pipe-deposits-of-tungsten-molybdenum-bismuth-… > (1976) Notable awards Eureka Prize <http://en.wikipedia.org/wiki/Eureka_Prize> (1995, 2002),Centenary Medal <http://en.wikipedia.org/wiki/Centenary_Medal> (2003), Clarke Medal <http://en.wikipedia.org/wiki/Clarke_Medal> (2004) Where Does the Carbon Dioxide Really Come From? Professor Ian Plimer could not have said it better! PLIMER: "Okay, here's the bombshell. The volcanic eruption in Iceland. Since its first spewing of volcanic ash has, in just FOUR DAYS, NEGATED EVERY SINGLE EFFORT you have made in the past five years to control CO2 emissions on our planet - all of you. Of course, you know about this evil carbon dioxide that we are trying to suppress - it's that vital chemical compound that every plant requires to live and grow and to synthesize into oxygen for us humans and all animal life. I know it's very disheartening to realize that all of the carbon emission savings you have accomplished while suffering the inconvenience and expense of driving Prius hybrids, buying fabric grocery bags, sitting up till midnight to finish your kids "The Green Revolution" science project, throwing out all of your non-green cleaning supplies, using only two squares of toilet paper, putting a brick in your toilet tank reservoir, selling your SUV and speedboat, vacationing at home instead of abroad. Nearly getting hit every day on your bicycle, replacing all of your 50 cent light bulbs with $10.00 light bulbs. Well, all of those things you have done have all gone down the tubes in just four days. The volcanic ash emitted into the Earth's atmosphere in just four days - yes, FOUR DAYS - by that volcano in Iceland has totally erased every single effort you have made to reduce the evil beast, carbon. And there are around 200 active volcanoes on the planet spewing out this crud at any one time - EVERY DAY. I don't really want to rain on your parade too much, but I should mention that when the volcano Mt Pinatubo erupted in the Philippines in 1991, it spewed out more greenhouse gases into the atmosphere than the entire human race had emitted in all its years on earth. Yes, folks, Mt Pinatubo was active for over One year - think about it. Of course, I shouldn't spoil this 'touchy-feely tree-hugging' moment and mention the effect of solar and cosmic activity and the well-recognized 800-year global heating and cooling cycle, which keeps happening despite our completely insignificant efforts to affect climate change. And I do wish I had a silver lining to this volcanic ash cloud, but the fact of the matter is that the bush fire season across the western USA and Australia this year alone will negate your efforts to reduce carbon in our world for the next two to three years. And it happens every year. Just remember that your government just tried to impose a whopping carbon tax on you, on the basis of the bogus 'human-caused' climate-change scenario. Hey, isn't it interesting how they don't mention 'Global Warming' anymore, but just 'Climate Change'- you know why? It's because the planet has COOLED by 0.7 degrees in the past century and these global warming bull artists got caught with their pants down. And, just keep in mind that you might yet have an Emissions Trading Scheme - that whopping new tax - imposed on you that will achieve absolutely nothing except make you poorer. It won't stop any volcanoes from erupting, that's for sure. But, hey, relax and have a nice day anyway. ------ End of Forwarded Message

1 0

The FBI, Carnegie-Mellon University, CERT/CC, and Tor
by Rayzer 15 Dec '15

15 Dec '15

> The news of CMU’s possible assistance in compromising Tor’s most > critical feature, anonymity, presents an opportunity for many to > attack the integrity of CERT/CC and the researchers at the Software > Engineering Institute. Bruce Schneier and others have been quick to > point out that this incident has erased (or at least greatly > diminished) CERT/CC’s hard-earned reputation as an honest broker. It > is certain to be a warning to other CSIRTs around the world that they > should transparently define their relationships with law enforcement > agencies. From Just Security (legal): https://www.justsecurity.org/28343/fbi-stop-undermining-norms-root/ Reports surfaced last month suggesting that Carnegie Mellon University (CMU) has been helping <https://www.schneier.com/blog/archives/2015/11/did_carnegie-me.html> the FBI crack Tor, the secure browsing application used by privacy-conscious Internet users for both legal and illegal activities. Normally, an academic institution assisting law enforcement in fighting crime wouldn’t raise any eyebrows, particularly if that assistance came in the form of responding to subpoenas. But this isn’t your average case. Beyond the complicated (and unclear) set of facts involved, CMU houses the Computer Emergency Response Team Coordination Center (CERT/CC), one of the world’s most important hubs for coordinating information about various cybersecurity vulnerabilities and attacks. More than a month after the news first broke, the details are murky at best. Tor has alleged <https://blog.torproject.org/blog/did-fbi-pay-university-attack-tor-users> that the FBI paid CMU to crack the system’s anonymity feature in exchange for payment. CMU’s own statement <https://www.cmu.edu/news/stories/archives/2015/november/media-statement.html> about the incident says that many of the media reports have been inaccurate, but acknowledges that the university — and by extension CERT/CC — complies with valid subpoenas that it receives (as it must). It also said that it receives “no funding for compliance.” The FBI has said <http://www.forbes.com/sites/thomasbrewster/2015/11/18/fbi-cmu-tor-million-d…> that reports on the payment are inaccurate, but stopped short of saying no payment was made. And Tor has responded <http://www.wired.com/2015/11/carnegie-mellon-denies-fbi-paid-for-tor-breaki…> by saying that these vague responses raise a whole host of questions on their own. The public saga leading up to the recent accusations began in July 2014, when Ed Felten, the then-director of Princeton’s Center for Information Technology Policy, noted <https://freedom-to-tinker.com/blog/felten/why-were-cert-researchers-attacki…> that CERT/CC researchers at CMU had submitted a presentation abstract to organizers of the Black Hat security conference discussing a new vulnerability they had found in Tor. The timing of CERT/CC’s pitch to Black Hat aligned with a large-scale attack on Tor that lasted from January to July 2014, during which CERT/CC researchers shared only “hints” about the vulnerability they had discovered. As for the abstract, it was abruptly withdrawn in July when CMU failed to approve the content of the talk for public release. Eyebrows were again raised in January 2015, after the arrest <http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-sustained-attac…> of a man who allegedly helped run Silk Road 2.0, a large online trading post on the dark web whose visitors often use Tor to access the site. At the time, some speculated that his arrest was tied to the attack against Tor in the first half of 2014. Most recently, in mid-November, Tor accused CMU of accepting payment and assisting the FBI — in ways that indicate a warrant was not involved — to “attack hidden services users in a broad sweep, and then sift through their data to find people.” These allegations are hugely problematic for CERT/CC. As an entity that espouses <http://www.cert.org/about/> to be “a trusted, authoritative organization dedicated to improving the security of computer systems and networks,” finding and not disclosing vulnerabilities is a good way to undermine that trust. Exploiting those vulnerabilities is even worse. But let’s take a step back for a moment. Why, beyond the obvious privacy concerns raised by Tor, is this such a big deal? CERT/CC, and indeed the Computer Security Incident Response Team (CSIRT) community as a whole <https://www.newamerica.org/cybersecurity-initiative/csirt-basics-for-policy…>, is a pillar of global cybersecurity. (CSIRT is another term often used to describe the type of organization CERT/CC is.) Generally, CSIRTs are responsible for receiving, reviewing, and responding to computer security incident reports from a set of clients, which can include government agencies, private companies, security researchers, and ordinary Internet users. Since the late 1980s, CERT/CC, as the name suggests, has been a major coordination center for global CSIRT activities. As as result, it has access to a wide array of incident information and vulnerabilities, which could, hypothetically, be used to help crack Tor’s anonymity feature. In addition, the organization — initially funded as a DARPA project and still funded <http://www.cert.org/faq/> with federal money — is largely transnational in nature and serves as the secretariat for national CSIRTs, more than 100 of which are distributed across the globe. CSIRTs are increasingly referenced in international discussions as a key component in efforts to build global capacity to combat cybersecurity threats and develop norms of behavior among nations in the cyber realm. For example, the United Nations Group of Governmental Experts on cybersecurity suggested <http://www.un.org/ga/search/view_doc.asp?symbol=A/70/174> this summer that special teams authorized to respond to cybersecurity incidents, such as CSIRTs, should not be used to “engage in malicious international activity” and should not be the target of attacks. If CSIRTs are to be held out as off limits, they need to be impartial (like, say, the Red Cross <http://time.com/3713226/red-cross-cyberspace/>) and cannot be political actors, lest they become legitimate targets. CERT/CC, and many other CSIRTs around the world, collect information that can be very useful for both identifying and capturing criminals. They rely heavily <https://www.newamerica.org/cybersecurity-initiative/csirt-basics-for-policy…> on the trust incident reporters and vulnerability researchers have in the CSIRTs, trust that is garnered after developing close ties with the constituencies they serve. When a CSIRT is discovered, or even rumored, to be acting in a way that is negligent or undermines network security of perfectly legal services, this bond of trust is fractured. Less trust means less information for CSIRTs. To pour salt on the wound, the controversy around the latest story undermines the effectiveness of CERT/CC both to carry out its own duties and to assist the FBI in the future. Though it is often not explicit in documentation, a relationship between CSIRTs and law enforcement agencies is often assumed. Indeed, such cooperation can be helpful for both law enforcement and CSIRTs. Law enforcement can obtain important technical information about incidents from CSIRTs, which in turn helps law enforcement identify and pursue cyber-criminals. On the flipside, some industries (particularly in the US) have close relationships with law enforcement that result in law enforcement becoming an important reporter of incidents to the CSIRT. But if these two types of bodies are to have close working relationships, they should follow explicit and transparent guidelines in accordance with due process. If the FBI is engaging with CSIRTs to essentially break a feature of Internet security en masse, it is making its own life more difficult down the line by removing the legitimacy of a key ally in cyber criminal investigations. To be clear: This is not an indictment of CSIRTs working with law enforcement. As I explain in detail with my colleagues Isabel Skierka, Mirko Hohmann, and Tim Maurer in our recent report <https://static.newamerica.org/attachments/11916-national-csirts-and-their-r…>, cooperation between CSIRTs and law enforcement is not necessarily a bad thing. A comprehensive approach to addressing cybercrime would ideally meld the technical expertise and access CSIRTs have painstakingly developed with traditional law enforcement expertise found in agencies like the FBI. In fact, many national-level CSIRTs actually sit within law enforcement, intelligence, or national security organizations or have formal liaisons with those agencies. Indeed, most in the CSIRT community seem ready to accept that CSIRTs have reached a point in their maturity where a formal, transparent relationship with law enforcement is practicable. This is because the quandary facing CSIRTs is one that has pervaded the American intelligence community for decades: Some activities simply do not pass the front-page test; meaning that some actions, when they come to light, will hurt the reputation of the organization. As New America Cybersecurity Fellow and Georgia Tech professor Peter Swire wrote earlier this year <https://www.newamerica.org/new-america/the-declining-half-life-of-secrets/>, the half-life of secrets is diminishing, and interactions like CERT/CC’s with the FBI are likely to become known much sooner than they would in the past. For the CSIRT community, which relies so heavily on trust for effectiveness, keeping their relationships with the government secret will be both extremely difficult and may undermine their reputations once they come to light. The news of CMU’s possible assistance in compromising Tor’s most critical feature, anonymity, presents an opportunity for many to attack the integrity of CERT/CC and the researchers at the Software Engineering Institute. Bruce Schneier <https://www.schneier.com/blog/archives/2015/11/did_carnegie-me.html> and others <http://blog.cryptographyengineering.com/2015/11/why-tor-attack-matters.html> have been quick to point out that this incident has erased (or at least greatly diminished) CERT/CC’s hard-earned reputation as an honest broker. It is certain to be a warning to other CSIRTs around the world that they should transparently define their relationships with law enforcement agencies. Regardless of how fault should be apportioned in this particular instance, the news comes as part of a larger trend in the CSIRT community. Once relatively apolitical, these technical teams are undergoing a process of politicization. National level CSIRTs, many of which once resided outside of government in academic institutions and non-governmental organizations, are being pulled into government structures. At the same time, their relationships with law enforcement agencies are becoming closer and (to those outside of the agencies) more opaque. What can be done to protect the credibility and neutrality of these important pillars in the network security ecosystem? The recommendations we outline in our report provide a roadmap: * The first step to protect trust in these teams is to reverse the recent trend and /not/ place them under the control of law enforcement and intelligence agencies. Such agencies are incentivized to use the tools at their disposal to investigate crime, collect intelligence, and pursue threat groups, and thus will often disregard the apolitical information coordination role CSIRTs play. * Second, CSIRTs and law enforcement must more transparently define the terms of their cooperation, including how and under what circumstances they interact. They should also clearly define what kinds of information and expertise are exchanged and what direction(s) shared information flows. * Third, for CSIRTs to remain trusted brokers, they must clarify their mandates and missions. Traditionally, a CSIRT has placed remediating damage from incidents and returning systems to operation as top priorities. Is this still the case, or is CSIRT expertise being poured into combating cybercrime and assisting law enforcement agencies in developing tools and methods to discover criminals? Finally, though not included in our recommendations in the report, to recover the trust it has recently lost, CERT/CC’s mission and role needs to be clearly defined by the organization itself, its funders, its partners, and its constituency. Is it essentially a second US national CSIRT alongside the Department of Homeland Security’s US-CERT <https://www.us-cert.gov/>, or is it something closer to a private CSIRT that plays a role in maintaining global cybersecurity? If it is a global, non-government CSIRT, transparently defining its relationship with law enforcement, intelligence, and other political actors — both inside and outside the US — is all the more important. In the end, the actions of the computer security professionals at CERT/CC who allegedly aided the FBI are somewhat understandable. Their overarching goal is to secure computer systems. The traditional CSIRT approach focuses on technical identification and remediation of incidents, in addition to promoting technical measures to protect systems from attacks in the first place. The goal of law enforcement bodies in cybersecurity is to lend a helping hand in preventing attacks from taking place by rounding up the likely and past perpetrators. That aligns with the CSIRT community’s goal. But the allegations of the researchers’ work (the cybersecurity applicability of which is dubious at best) to crack Tor demonstrate the damage that can be done when when a CSIRT’s interaction with law enforcement is not openly and strictly governed. The controversy surrounding this story represents something much larger than the alleged incident. CSIRTs are meant to be apolitical actors concentrating on computer and network security. The ramifications of politicization and muddied mandates could permeate up to states’ efforts to develop international norms of behavior in cyberspace, like those outlined <https://ccdcoe.org/2015-un-gge-report-major-players-recommending-norms-beha…> by the UN Group of Governmental Experts, that rely on the integrity and independence of global CSIRTs. By undermining these norms before they take root, the FBI, and by extension the US government, undermine their own efforts to promote an open and secure cyberspace through norms for responsible state behavior. About the Author Robert Morgus is a Policy Analyst with New America’s Cybersecurity Initiative and International Security Program. You can follow him on Twitter (@robmorgus). -- RR "You might want to ask an expert about that - I just fiddled around with mine until it worked..."

1 0