- cypherpunks - lists.cpunks.org

XKeyscore: More fun with NSA
by Karel Bílek 01 Aug '13

01 Aug '13

http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-… http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-prog… (adding some keywords for NSA and the link to the latest issue Al-Qaeda Inspire magazine for good measure) Bin Laden أسامة بن محمد بن عوض بن لادن Al-Qaeda القاعدة Jihad جهاد‎ Boston marathon تفجيرا ماراثون Hamas حماس‎ Hezbollah حزب الله http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11.pdf http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11-ar.pdf

2 1

Fwd: XKeyscore produced by SAIC, runs on RHEL
by John Young 01 Aug '13

01 Aug '13

SAIC SKIDROWE job: https://msepjobs.militaryonesource.mil/jobposting/vpcs-engineer-job >SKIDROWE?

1 0

[Bitcoin-development] Litecoin v0.8.3.7 audit report
by Eugen Leitl 01 Aug '13

01 Aug '13

----- Forwarded message from Peter Todd <pete(a)petertodd.org> ----- Date: Wed, 31 Jul 2013 18:11:10 -0400 From: Peter Todd <pete(a)petertodd.org> To: bitcoin-development(a)lists.sourceforge.net Subject: [Bitcoin-development] Litecoin v0.8.3.7 audit report User-Agent: Mutt/1.5.21 (2010-09-15) https://s3.amazonaws.com/peter.todd/litecoin-v0.8.3.7-audit-report.tar.bz2 I thought this may be of interest to Bitcoin as well as an example. -- 'peter'[:-1]@petertodd.org ------------------------------------------------------------------------------ Get your SQL database under version control now! Version control is standard for application code, but databases havent caught up. So what steps can you take to put your SQL databases under version control? Why should you start doing it? Read more to find out. http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk _______________________________________________ Bitcoin-development mailing list Bitcoin-development(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Gen. Alexander @ Black Hat [Video]
by Rich Jones 01 Aug '13

01 Aug '13

https://www.youtube.com/watch?v=xvVIZ4OyGnQ Any attendees on list with on-the-ground perspective?

1 0

Re: XKeyscore: More fun with NSA
by John Young 31 Jul '13

31 Jul '13

Thanks for the links. Great to see Guardian is again releasing a full document rather than editorial blather. At 10:01 AM 7/31/2013, you wrote: >http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-… > >http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-prog… > >(adding some keywords for NSA and the link to the latest issue >Al-Qaeda Inspire magazine for good measure) > >Bin Laden >ÃÓÇãÉ Èä ãÍãÏ Èä ÚæÖ Èä áÇÏä >Al-Qaeda >ÇáÞÇÚÏÉ >Jihad >ÌåÇÏý >Boston marathon >ÊÝÌíÑÇ ãÇÑÇËæä >Hamas >ÍãÇÓý >Hezbollah >ÍÒÈ Çááå > >http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11.pdf >http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11-ar.pdf

3 2

Re: cypherpunks Digest, Vol 1, Issue 20
by Joseph Tag 31 Jul '13

31 Jul '13

Best "intro" of CypherPunks I found was in The New York Times magazine ( mentioned PGP too ) .

1 0

Again, federal court finds cops don’t need a warrant for cellphone location data
by Eugen Leitl 31 Jul '13

31 Jul '13

http://arstechnica.com/tech-policy/2013/07/again-federal-court-finds-cops-d… Again, federal court finds cops don’t need a warrant for cellphone location data If you want your records anonymized, tell "the market or the political process." by Cyrus Farivar - July 31 2013, 1:17am WEDT GOVERNMENT LAWSUITS In a new 2-1 decision published (PDF) Tuesday, the Fifth Circuit Court of Appeals has held that law enforcement does not need a warrant to obtain cell-site location information (CSLI) from a mobile phone, falling in line with other recent high-level federal court decisions. In July, however, the New Jersey Supreme Court ruled unanimously that cops do not have this right (at least in the Garden State), setting up a situation where the Supreme Court could rule to settle the debate once and for all. The Fifth Circuit’s majority judges cited the Stored Communications Act (also known as a 2703(d) order) as grounds to allow CSLI to law enforcement. Under that federal statute, authorities can’t retrieve the contents of electronic communication, but they can find out where and to whom electronic communication was sent. In contemporary cases within the last decade, law enforcement and judges have increasingly used this reasoning to obtain extensive location data that can effectively turn the phone into a tracking device. Such information previously would have required a much higher legal threshold like a probable cause-driven warrant. In the majority decision, the judges wrote (PDF) that cell site information was nothing more than a business record, which "the Government has neither 'required [n]or persuaded' providers to keep." "In the case of such historical cell site information, the Government merely comes in after the fact and asks a provider to turn over records the provider has already created," the judges continued. "Moreover, these are the providers’ own records of transactions to which it is a party. The caller is not conveying location information to anyone other than his service provider. He is sending information so that the provider can perform the service for which he pays it: to connect his call." Not surprisingly, civil libertarians decried the Fifth Circuit's decision. As the American Civil Liberties Union's Catherine Crump wrote: This ruling is troubling because, as we and the Electronic Frontier Foundation (EFF) argued, only a warrant standard fully protects Americans' privacy interests in their locations and movements over time. Cell phone companies store records on where each of us have been, often stretching back for years. That location information is sensitive and can reveal a great deal—what doctors people visit, where they spend the night, who their friends are, and where they worship. Given the sensitivity of these facts, law enforcement agents should have to demonstrate to a judge that they have a good reason to believe that they will turn up evidence of wrongdoing before gaining access to information that can paint a detailed picture of where a person has been over time. Still, the Fifth Circuit judges did have one more remedy for mobile phone users who want to keep their location private: just, y'know, "demand" it from your mobile carrier. As they wrote: We understand that cell phone users may reasonably want their location information to remain private, just as they may want their trash, placed curbside in opaque bags, Greenwood, 486 U.S. at 40-41, or the view of their property from 400 feet above the ground, Florida v. Riley, 488 U.S. 445, 451 (1989), to remain so. But the recourse for these desires is in the market or the political process: in demanding that service providers do away with such records (or anonymize them) or in lobbying elected representatives to enact statutory protections. The Fourth Amendment, safeguarded by the courts, protects only reasonable expectations of privacy.

1 0

XKeyscore: NSA tool collects 'nearly everything a user does on the internet'
by Eugen Leitl 31 Jul '13

31 Jul '13

http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-… XKeyscore: NSA tool collects 'nearly everything a user does on the internet' • XKeyscore gives 'widest-reaching' collection of online data • NSA analysts require no prior authorization for searches • Sweeps up emails, social media activity and browsing history • NSA's XKeyscore program – read one of the presentations Glenn Greenwald theguardian.com, Wednesday 31 July 2013 13.56 BST XKeyscore map One presentation claims the XKeyscore program covers 'nearly everything a typical user does on the internet' A top secret National Security Agency program allows analysts to search with no prior authorization through vast databases containing emails, online chats and the browsing histories of millions of individuals, according to documents provided by whistleblower Edward Snowden. The NSA boasts in training materials that the program, called XKeyscore, is its "widest-reaching" system for developing intelligence from the internet. The latest revelations will add to the intense public and congressional debate around the extent of NSA surveillance programs. They come as senior intelligence officials testify to the Senate judiciary committee on Wednesday, releasing classified documents in response to the Guardian's earlier stories on bulk collection of phone records and Fisa surveillance court oversight. The files shed light on one of Snowden's most controversial statements, made in his first video interview published by the Guardian on June 10. "I, sitting at my desk," said Snowden, could "wiretap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal email". US officials vehemently denied this specific claim. Mike Rogers, the Republican chairman of the House intelligence committee, said of Snowden's assertion: "He's lying. It's impossible for him to do what he was saying he could do." But training materials for XKeyscore detail how analysts can use it and other systems to mine enormous agency databases by filling in a simple on-screen form giving only a broad justification for the search. The request is not reviewed by a court or any NSA personnel before it is processed. XKeyscore, the documents boast, is the NSA's "widest reaching" system developing intelligence from computer networks – what the agency calls Digital Network Intelligence (DNI). One presentation claims the program covers "nearly everything a typical user does on the internet", including the content of emails, websites visited and searches, as well as their metadata. Analysts can also use XKeyscore and other NSA systems to obtain ongoing "real-time" interception of an individual's internet activity. Under US law, the NSA is required to obtain an individualized Fisa warrant only if the target of their surveillance is a 'US person', though no such warrant is required for intercepting the communications of Americans with foreign targets. But XKeyscore provides the technological capability, if not the legal authority, to target even US persons for extensive electronic surveillance without a warrant provided that some identifying information, such as their email or IP address, is known to the analyst. One training slide illustrates the digital activity constantly being collected by XKeyscore and the analyst's ability to query the databases at any time. KS1 The purpose of XKeyscore is to allow analysts to search the metadata as well as the content of emails and other internet activity, such as browser history, even when there is no known email account (a "selector" in NSA parlance) associated with the individual being targeted. Analysts can also search by name, telephone number, IP address, keywords, the language in which the internet activity was conducted or the type of browser used. One document notes that this is because "strong selection [search by email address] itself gives us only a very limited capability" because "a large amount of time spent on the web is performing actions that are anonymous." The NSA documents assert that by 2008, 300 terrorists had been captured using intelligence from XKeyscore. Analysts are warned that searching the full database for content will yield too many results to sift through. Instead they are advised to use the metadata also stored in the databases to narrow down what to review. A slide entitled "plug-ins" in a December 2012 document describes the various fields of information that can be searched. It includes "every email address seen in a session by both username and domain", "every phone number seen in a session (eg address book entries or signature block)" and user activity – "the webmail and chat activity to include username, buddylist, machine specific cookies etc". Email monitoring In a second Guardian interview in June, Snowden elaborated on his statement about being able to read any individual's email if he had their email address. He said the claim was based in part on the email search capabilities of XKeyscore, which Snowden says he was authorized to use while working as a Booz Allen contractor for the NSA. One top-secret document describes how the program "searches within bodies of emails, webpages and documents", including the "To, From, CC, BCC lines" and the 'Contact Us' pages on websites". To search for emails, an analyst using XKS enters the individual's email address into a simple online search form, along with the "justification" for the search and the time period for which the emails are sought. KS2 KS3edit The analyst then selects which of those returned emails they want to read by opening them in NSA reading software. The system is similar to the way in which NSA analysts generally can intercept the communications of anyone they select, including, as one NSA document put it, "communications that transit the United States and communications that terminate in the United States". One document, a top secret 2010 guide describing the training received by NSA analysts for general surveillance under the Fisa Amendments Act of 2008, explains that analysts can begin surveillance on anyone by clicking a few simple pull-down menus designed to provide both legal and targeting justifications. Once options on the pull-down menus are selected, their target is marked for electronic surveillance and the analyst is able to review the content of their communications: KS4 Chats, browsing history and other internet activity Beyond emails, the XKeyscore system allows analysts to monitor a virtually unlimited array of other internet activities, including those within social media. An NSA tool called DNI Presenter, used to read the content of stored emails, also enables an analyst using XKeyscore to read the content of Facebook chats or private messages. KS5 An analyst can monitor such Facebook chats by entering the Facebook user name and a date range into a simple search screen. KS6 Analysts can search for internet browsing activities using a wide range of information, including search terms entered by the user or the websites viewed. KS7 As one slide indicates, the ability to search HTTP activity by keyword permits the analyst access to what the NSA calls "nearly everything a typical user does on the internet". KS8 The XKeyscore program also allows an analyst to learn the IP addresses of every person who visits any website the analyst specifies. KS9 The quantity of communications accessible through programs such as XKeyscore is staggeringly large. One NSA report from 2007 estimated that there were 850bn "call events" collected and stored in the NSA databases, and close to 150bn internet records. Each day, the document says, 1-2bn records were added. William Binney, a former NSA mathematician, said last year that the agency had "assembled on the order of 20tn transactions about US citizens with other US citizens", an estimate, he said, that "only was involving phone calls and emails". A 2010 Washington Post article reported that "every day, collection systems at the [NSA] intercept and store 1.7bn emails, phone calls and other type of communications." The XKeyscore system is continuously collecting so much internet data that it can be stored only for short periods of time. Content remains on the system for only three to five days, while metadata is stored for 30 days. One document explains: "At some sites, the amount of data we receive per day (20+ terabytes) can only be stored for as little as 24 hours." To solve this problem, the NSA has created a multi-tiered system that allows analysts to store "interesting" content in other databases, such as one named Pinwale which can store material for up to five years. It is the databases of XKeyscore, one document shows, that now contain the greatest amount of communications data collected by the NSA. KS10 In 2012, there were at least 41 billion total records collected and stored in XKeyscore for a single 30-day period. KS11 Legal v technical restrictions While the Fisa Amendments Act of 2008 requires an individualized warrant for the targeting of US persons, NSA analysts are permitted to intercept the communications of such individuals without a warrant if they are in contact with one of the NSA's foreign targets. The ACLU's deputy legal director, Jameel Jaffer, told the Guardian last month that national security officials expressly said that a primary purpose of the new law was to enable them to collect large amounts of Americans' communications without individualized warrants. "The government doesn't need to 'target' Americans in order to collect huge volumes of their communications," said Jaffer. "The government inevitably sweeps up the communications of many Americans" when targeting foreign nationals for surveillance. An example is provided by one XKeyscore document showing an NSA target in Tehran communicating with people in Frankfurt, Amsterdam and New York. KS12 In recent years, the NSA has attempted to segregate exclusively domestic US communications in separate databases. But even NSA documents acknowledge that such efforts are imperfect, as even purely domestic communications can travel on foreign systems, and NSA tools are sometimes unable to identify the national origins of communications. Moreover, all communications between Americans and someone on foreign soil are included in the same databases as foreign-to-foreign communications, making them readily searchable without warrants. Some searches conducted by NSA analysts are periodically reviewed by their supervisors within the NSA. "It's very rare to be questioned on our searches," Snowden told the Guardian in June, "and even when we are, it's usually along the lines of: 'let's bulk up the justification'." In a letter this week to senator Ron Wyden, director of national intelligence James Clapper acknowledged that NSA analysts have exceeded even legal limits as interpreted by the NSA in domestic surveillance. Acknowledging what he called "a number of compliance problems", Clapper attributed them to "human error" or "highly sophisticated technology issues" rather than "bad faith". However, Wyden said on the Senate floor on Tuesday: "These violations are more serious than those stated by the intelligence community, and are troubling." In a statement to the Guardian, the NSA said: "NSA's activities are focused and specifically deployed against – and only against – legitimate foreign intelligence targets in response to requirements that our leaders need for information necessary to protect our nation and its interests. "XKeyscore is used as a part of NSA's lawful foreign signals intelligence collection system. "Allegations of widespread, unchecked analyst access to NSA collection data are simply not true. Access to XKeyscore, as well as all of NSA's analytic tools, is limited to only those personnel who require access for their assigned tasks … In addition, there are multiple technical, manual and supervisory checks and balances within the system to prevent deliberate misuse from occurring." "Every search by an NSA analyst is fully auditable, to ensure that they are proper and within the law. "These types of programs allow us to collect the information that enables us to perform our missions successfully – to defend the nation and to protect US and allied troops abroad."

1 0

[FoRK] Functional encryption, or "Computer scientists develop 'mathematical jigsaw puzzles' to encrypt software"
by Eugen Leitl 31 Jul '13

31 Jul '13

----- Forwarded message from Noon Silk <noonslists(a)gmail.com> ----- Date: Wed, 31 Jul 2013 21:18:45 +1000 From: Noon Silk <noonslists(a)gmail.com> To: Friends of Rohit Khare <fork(a)xent.com> Subject: [FoRK] Functional encryption, or "Computer scientists develop 'mathematical jigsaw puzzles' to encrypt software" Reply-To: Friends of Rohit Khare <fork(a)xent.com> http://newsroom.ucla.edu/portal/ucla/ucla-computer-scientists-develop-24752… Looks interesting. -- UCLA computer science professor Amit Sahai and a team of researchers have designed a system to encrypt software so that it only allows someone to use a program as intended while preventing any deciphering of the code behind it. This is known in computer science as "software obfuscation," and it is the first time it has been accomplished. [...] "You can inspect everything, you can turn it upside-down, you can look at it from different angles and you still won't have any idea what it's doing," he added. "The only thing you can do with it is put it together the way that it was meant to interlock. If you tried to do anything else — like if you tried to bash this piece and put it in some other way — you'd just end up with garbage." *Functional encryption* The new technique for software obfuscation paved the way for another breakthrough called functional encryption. With functional encryption, instead of sending an encrypted message, an encrypted function is sent in its place. This offers a much more secure way to protect information, Sahai said. Previous work on functional encryption was limited to supporting very few functions; the new work can handle any computable function. For example, a single message could be sent to a group of people in such a way that each receiver would obtain different information, depending on characteristics of that particular receiver. In another example, a hospital could share the outcomes of treatment with researchers without revealing details such as identifying patient information. "Through functional encryption, you only get the specific answer, you don't learn anything else," Sahai said. -- -- Noon Silk Fancy a quantum lunch? https://sites.google.com/site/quantumlunch/ "Every morning when I wake up, I experience an exquisite joy — the joy of being this signature." _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tahoe-dev] press release: LeastAuthority.com announces Spy-Proof Backup
by Eugen Leitl 31 Jul '13

31 Jul '13

----- Forwarded message from Zooko Wilcox-OHearn <zooko(a)leastauthority.com> ----- Date: Wed, 31 Jul 2013 11:36:52 +0000 From: Zooko Wilcox-OHearn <zooko(a)leastauthority.com> To: Tahoe-LAFS development <tahoe-dev(a)tahoe-lafs.org> Subject: [tahoe-dev] press release: LeastAuthority.com announces Spy-Proof Backup Folks: We're really happy to be offering our LAFS-based ciphertext storage service to the public! Please spread the word. Thank you very much to everyone in our little community for making things like this possible. Regards, Zooko Wilcox-O'Hearn Founder, CEO, and Customer Support Rep https://LeastAuthority.com LeastAuthority.com Announces A Spy-Proof Storage Service Wednesday, July 31, 2013 [1]LeastAuthority.com today announced “Simple Secure Storage Service (S4)”, a backup service that encrypts your files to protect them from the prying eyes of spies and criminals. “People deserve privacy and security in the digital data that make up our daily lives.” said the company's founder and CEO, Zooko Wilcox-O'Hearn. “As an individual or a business, you shouldn't have to give up control over your data in order to get the benefits of cloud storage.” verifiable end-to-end security The Simple Secure Storage Service offers verifiable end-to-end security. It offers “end-to-end security” because all of the customer's data is encrypted locally — on the customer's own personal computer — before it is uploaded to the cloud. During its stay in the cloud, it cannot be decrypted by LeastAuthority.com, nor by anyone else, without the decryption key which is held only by the customer. S4 offers “verifiable end-to-end security” because all of the source code that makes up the Simple Secure Storage Service is published for everyone to see. Not only is the source code publicly visible, but it also comes with Free (Libre) and Open Source rights granted to the public allowing anyone to inspect the source code, experiment on it, alter it, and even to distribute their own version of it and to sell commercial services. Wilcox-O'Hearn says “If you rely on closed-source, proprietary software, then you're just taking the vendor's word for it that it actually provides the end-to-end security that they claim. As the PRISM scandal shows, that claim is sometimes a lie.” The web site of LeastAuthority.com proudly states “We can never see your data, and you can always see our code.”. trusted by experts The Simple Secure Storage Service is built on a technology named “Least-Authority File System (LAFS)”. LAFS has been studied and used by computer scientists, hackers, Free and Open Source software developers, activists, the U.S. Defense Advanced Research Projects Agency, and the U.S. National Security Agency. The design has been published in a peer-reviewed scientific workshop: Wilcox-O'Hearn, Zooko, and Brian Warner. “Tahoe: the least-authority filesystem.” Proceedings of the 4th ACM international workshop on Storage security and survivability. ACM, 2008. [2]http://eprint.iacr.org/2012/524.pdf It has been cited in more than 50 scientific research papers, and has received plaudits from the U.S. Comprehensive National Cybersecurity Initiative, which stated: “Systems like Least-Authority File System are making these methods immediately usable for securely and availably storing files at rest; we propose that the methods be further reviewed, written up, and strongly evangelized as best practices in both government and industry.” Dr. Richard Stallman, President of the Free Software Foundation ([3]https://fsf.org/) said “Free/Libre software is software that the users control. If you use only free/libre software, you control your local computing — but using the Internet raises other issues of freedom and privacy, which many network services don't respect. The Simple Secure Storage Service (S4) is an example of a network service that does respect your freedom and privacy.” Jacob Appelbaum, Tor project developer ([4]https://www.torproject.org/) and WikiLeaks volunteer ([5]http://wikileaks.org/) said “LAFS's design acknowledges the importance of verifiable end-to-end security through cryptography, Free/Libre release of software and transparent peer-reviewed system design.” The LAFS software is already packaged in several widely-used operating systems such as Debian GNU/Linux and Ubuntu. [6]https://LeastAuthority.com References Visible links 1. https://leastauthority.com/ 2. http://eprint.iacr.org/2012/524.pdf 3. https://fsf.org/ 4. https://www.torproject.org/ 5. http://wikileaks.org/ 6. https://leastauthority.com/ _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0