Uncategorized

I’m reading yet another book about eavesdropping, Diffie and Landau’s Privacy on the Line, which covers privacy and surveillance debates from a crypto-focused standpoint. This is not surprising given that one of the co-authors, Whitfield Diffie, is one of the most famous names in cryptography research.

One of the cases it discusses, which I didn’t previously know about, is Phil Karn’s challenge to the Clinton administration’s silly export-control restrictions on cryptography software. The government required a license before cryptographic software could be exported. Karn applied for, and recieved, a license to export Bruce Schneier’s famous Applied Cryptography, a textbook on cryptography that included the source code to many important cryptographic algorithms. The government ruled, reasonably enough, that books were protected by the First Amendment and he could export Schneier’s tome.

Karn then typed the source code to one of the crypto algorithms printed in Schneier’s book, saved it on a floppy disk, and applied for permission to export that. This time the answer was different: the floppy disk was a “munition,” and could not be sent out of the country. Karn sued, and the case dragged out in federal courts through 2000, when the Clinton administration finally relented and stopped trying to control the export of cryptography software.
Continue reading →

SHARE: 17 comments

If you ask my colleague Jim Harper about his past, he’ll tell you a suspiciously plausible story about going to law school, working on the Hill, and so forth. This of course, is complete nonsense, as I’m learning from James Bamford’s Body of Secrets. It turns out that Jim has been intimately involved in espionage activities since the 1960s. From pp. 244-5:

A man with darting eyes was walking quickly up the sidewalk on Sixteenth Street in northwest Washington. A dozen blocks behind him stood the North Portico of the White House. Just before reaching the University Club, he made a quick turn through a black wrought-iron fence that protected a gray turn-of-the-century gothic stone mansion. On the side of the door was a gold plaque bearing the letters “CCCP”—the Russian abbreviation of Union of Soviet Socialist Republics.”

A few minutes later, Yakof Lukashevich, a slender Soviet embassy security officer with stiff, unruly hair, greeted the man. “I want to sell you top secrets,” the man impatiently told the Russian. “Valuable military information. I’ve brought along a sample.” With that, he reached into the front pocket of his jacket and handed Lukashevich a top secret NSA keylist for the U.S. military’s worldwide KL-47 cipher machine. With it, and the right equipment, the Russians would be able o break one of America’s most secret cipher systems. “My name is James,” the man said. “James Harper.” It was the beginning of a long and profitable relationship. Within weeks Harper would be selling the Soviets keylists for the KW-7, a cipher system more modern and secret than the KL-47. Over the KW-7 passed some of the nation’s most valuable information.

So when Jim writes about effective and ineffective ways to conduct surveillance, we should pay attention, because he writes from first-hand experience.

SHARE: 19 comments

The Wall Street Journal today reported that U.S. online publishers are seeing increased traffic from overseas while seeing little revenue from these foreign visitors. This represents both an uncompensated cost—in the form of server space and bandwidth—and an untapped source of revenue. So untapped, in fact, that foreign visitors account for only 5% of revenues for most major sites while constituting as much as half of their traffic.

Many publishers are attempting to tackle the problem by using geographic information related to visitors’ IP addresses—the basic identifiers that allow computers to communicate over the Internet. (You can see what information can be gleened from your IP by visiting sites like Proxify, that display the information that is publicly available regarding your IP address.)

While this seems like a convenient way for advertisers to turn foreign traffic into a new source of income, lawmakers may interfere with this process, denying web publishers the revenues needed to continue the growth of their businesses. Efforts to limit what information web publishers and advertisers can use in order to serve up content and ads to readers are underway both in the U.S. and in the E.U. In fact, Europe is split over whether to consider IP addresses “personally identifiably information” and grant them legal protections as a result.

My colleague Wayne Crews recently testified before the Senate Committee on Commerce regarding this side of the pond’s approach to privacy regulation. In his testimony, Crews was quick to point out that regulation would not only cut off revenue streams, but also stem the development of future technologies which may use information in ways we’ve never considered. Those developments are surely to be in advertising, but will also undoubtedly be in other areas of communication—perhaps some will be as revolutionary as the web itself.

We also have to consider the “little guys” of the web. According to Google’s Q1 2008 conference call (transcript can be seen here) the search company passed along over $4 billion to its AdSense publishers network in 2007. So, restrictive privacy regulations won’t just harm big companies like Google, Microsoft, CBS, or NewsCorp; the small websites and blogs supported by larger ad networks will also be affected by laws or regulations that would prevent advertisers from getting the right ads to the right people.

The biggest issue at hand, however, is the notion of consumer choice.  Currently, search site users can choose from a huge variety of search engines and other services, each offering different privacy guarantees to visitors. Increasingly engines other than Google—like those run by Microsoft and Yahoo!—are differentiating themselves from the Mountain-View-based giant through their privacy policies, providing consumers with additional choices. And people ought to be able to choose if they want to offer up some of their personal data in return for more customized services, or tolerate a less accurate search in order to preserve their privacy.

Certainly this choice is better than the solution Congress is offering: no choice at all.

SHARE: 6 comments

I’m not sure what to say about yesterday’s FISA vote that I haven’t said a dozen times before. I’m disappointed, obviously, but I can’t say I was surprised. I was probably more surprised that the White House didn’t get its way in February than that it did get its way in July. The powers that Congress granted yesterday will almost certainly be abused in the coming years, but we probably won’t find out about them until long after it’s too late to do anything about them.

But Aaron Massey makes an excellent point that’s worth quoting:

Although there are many aspects of this bill that disappoint me, I would like to take a moment to talk about the one closest to my research: legal compliance in technology systems. This bill sets an incredibly bad precedent for anyone advocating legal compliance. Essentially, what the telecommunications companies did was blatantly against the law. However, this bill retroactively provides them immunity for their actions. When the consequences for violating the law are removed retroactively, companies have an incentive to violate the law in the future.

The ethics in situations like this are already difficult for engineers to recognize. For a technologist like Mark Klein, setting up a room with a whole bunch of cables going into it is a normal daily aspect of their job. Most will not see the ethical implications. Most engineers at that level are not aware of the bigger picture. They may not be able to say for sure whether their action is a violation of the law. To speak out about such a thing already takes great personal courage.

The last thing engineers need to see is a case like this. They will recognize that even if they do risk their job to speak out about a possible legal problem, and even if that possible problem is recognized as such, it is now, with the passage of this bill, clearly possible that Congress will bend over backwards to let their employer off the hook.

To understand how difficult it was before this amendment was passed for someone like Mark Klein to do what he did, I urge you to read the introduction Cindy Cohn gave him at the EFF Pioneer Awards. Congress has just made it harder on the heroes. This is a disappointing day.

SHARE: 8 comments

Via Hit & Run, Sarah Lai Stirland reports on the plan to roll out a new political action committee called Accountability Now, which would punish members of Congress who voted to legalize warrantless wiretapping and immunize the participation of telecommunications companies in illegal spying.

On the Accountability Now site, you can pledge to donate money in a newsworthy August 8th money bomb that will raise money to defeat candidates selling out privacy and civil liberties. I rarely, rarely support politicians, even the ones I think are good. The opportunity to oppose some bad ones is quite delicious.

August 8th is the day Nixon resigned thirty-five years ago.

SHARE: 0 comments

Ars has a write-up of a new report that claims that the transition to digital television will be a disaster, and that the government needs to spend still more money to ease the transition process. The whole thing is just silly. The government is providing two free converter boxes to every household. If someone is too oblivious to apply for a converter box in the months leading up to the transition, I can only assume there will be lots of discussion of it on their televisions the week or two before the transition. And if that doesn’t convince them to get a converter box, surely they’ll figure it out the day their TV stops working.

I’m sorry, but going for a few days with no television just isn’t an emergency. I suppose it’s remotely possible that a natural disaster will hit the day after the transition and somebody won’t be warned because they didn’t have their converter box installed. But this is frankly quite a reach. People don’t have access to TV for all sorts of reasons. I rarely turn mine on because I’ve got better things to do with my time. That doesn’t constitute an emergency.

It warms my heart to see common sense prevailing among Ars’s commenters. As Ars reader brownd4 puts it, “If people aren’t smart enough to know about this ahead of time, they’ll do something about it when their TVs go dark. Not a big deal.”

SHARE: 7 comments