- cypherpunks@lists.ogf.org

shot over the bow - BIS to control crypto exports anywhere (to ensure backdoor enabled?)
by coderman 20 Oct '14

20 Oct '14

http://www.theregister.co.uk/2014/10/17/intel_subsidiary_crypto_export_fine/ """ Wind River Systems exported its software to China, Hong Kong, Russia, Israel, South Africa, and South Korea. BIS [Bureau of Industry and Security] significantly mitigated what would have been a much larger fine because the company voluntarily disclosed the violations. We believe this to be the first penalty BIS has ever issued for the unlicensed export of encryption software that did not also involve comprehensively sanctioned countries (e.g., Cuba, Iran, North Korea, Sudan or Syria). This suggests a fundamental change in BIS’s treatment of violations of the encryption regulations. Historically, BIS has resolved voluntarily disclosed violations of the encryption regulations with a warning letter but no material consequence, and has shown itself unlikely to pursue such violations that were not disclosed. This fine dramatically increases the compliance stakes for software companies — a message that BIS seemed intent upon making in its announcement. """ fuck BIS!

2 1

Re: Corporate undercover nation-state agents
by Nicolas Bourbaki 20 Oct '14

20 Oct '14

It should be clear now, if not long ago, that the US Government is the silent occupier of the stateless generation. This is true no matter the protest the American technological industry may attempt present in response to this fact. In light of this "Balkanisation" should be seen as a marketing term thought up by US actors to prevent the rest of the world from noticing that their data, sitting in or traversing the US, has less rights than that of a Syrian refugee. On 11/10/2014 03:20, bluelotus(a)openmailbox.org wrote: > https://firstlook.org/theintercept/2014/10/10/core-secrets/ > > "But the briefing document suggests another category of employees—ones > who are secretly working for the NSA without anyone else being aware. > This kind of double game, in which the NSA works with and against its > corporate partners, already characterizes some of the agency’s work, in > which information or concessions that it desires are surreptitiously > acquired if corporations will not voluntarily comply. The reference to > “under cover” agents jumped out at two security experts who reviewed > the NSA documents for The Intercept. > > “That one bullet point, it’s really strange,” said Matthew Green, a > cryptographer at Johns Hopkins University. “I don’t know how to > interpret it.” He added that the cryptography community in America > would be surprised and upset if it were the case that “people are > inside [an American] company covertly communicating with NSA and they > are not known to the company or to their fellow employees.” > > The ACLU’s Soghoian said technology executives are already deeply > concerned about the prospect of clandestine agents on the payroll to > gain access to highly sensitive data, including encryption keys, that > could make the NSA’s work “a lot easier.” > > “As more and more communications become encrypted, the attraction for > intelligence agencies of stealing an encryption key becomes > irresistible,” he said. “It’s such a juicy target.” >

5 4

Fwd: [whispersystems] Warrant Canary - Gag order in place right now?
by coderman 19 Oct '14

19 Oct '14

---------- Forwarded message ---------- From: Moxie Marlinspike <moxie(a)thoughtcrime.org> Date: Thu, 16 Oct 2014 16:27:04 -0700 Subject: Re: [whispersystems] Warrant Canary - Gag order in place right now? To: whispersystems(a)lists.riseup.net On 10/16/2014 03:13 PM, Advocatus Diaboli wrote: > I've been watching the development of TextSecure and other OWS apps for > a while, and among other things wondered why there is no warrant canary. > > 20 Minutes ago, a comment was posted in the following issue - and > promptly deleted again 5 Minutes ago: As far as I can tell, nothing was deleted, you're just looking at the wrong issue: https://github.com/WhisperSystems/whispersystems.org/issues/34 > It has been deleted by either the author or an OWS administrator. It > stated that, unlike moxie says in the issue, the EFF's lawyers obviously > are of the opinion that warrant canarys do work: There's a huge difference between the EFF taking a public position on an untested legal concept and a lawyer providing council to a client. Of course the EFF is going to advocate them, their job is to take that position. Whether warrant canaries will work or not is not my area of expertise. However, I don't want to experiment with them for two reasons: 1) Lawyers who provide us council have told us it's very likely they won't work. I don't want to advertise something that could be interpreted as an assurance which is actually false if for some reason it ever came down to that. 2) It's not the hill I want to die on. We're not well positioned to push the state of the art in legal policy or to be a test case. It's not what we're good at, and honestly the point of our work is to make those kind of questions irrelevant by not having any data to provide. That's the envelope that we *are* interested in pushing. > If this would be the case, they should not to put up a warrant canary > (because it would be lying), and they would also not be able to explain > why they cannot publish a warrant canary (because that would violate the > gag order). The only thing left do would be to find excuses why no > warrant canary is being put up and trying to avoid public attention to > the topic. Which is exactly what's happening. You left out the part about the lizard people. > So please, Moxie, if this is *not* the case, state on this mailinglist, > publicly and in clear terms, that OWS or the server admins did not yet > receive a subpoena / warrant / gag order related to any OWS app or service. We have never received a subpoena, warrant, or gag order related to any OWS app or service. Now can we go back to writing software? - moxie -- http://www.thoughtcrime.org

4 4

Malaysian Minister of Information in 2007
by Ryan Carboni 19 Oct '14

19 Oct '14

https://www.youtube.com/watch?v=4nAWrQmTmI8 Reminds me of the current FBI director. Actually Baghdad Bob is the best government spokesperson in the history of fascism.

1 0

Re: Fwd: [whispersystems] Warrant Canary - Gag order in place
by Subrosa.io 18 Oct '14

18 Oct '14

Alternatively, it's also possible that Apple has received an order under Section 215 of the USA Patriot Act. >Date: Fri, 17 Oct 2014 10:26:25 +0100 >From: Alfie John <alfiej(a)fastmail.fm> >To: cypherpunks(a)cpunks.org >Subject: Re: Fwd: [whispersystems] Warrant Canary - Gag order in place > right now? >Message-ID: > <1413537985.1291115.180081117.257FD1CC(a)webmail.messagingengine.com> >Content-Type: text/plain > > Even Apple, which had the biggest market cap >in the world so could afford to take on this fight, bowed down and >removed their warrant canary recently. > >Sadly, until someone with a set of big brass ones goes all guns blazing >to specifically set precedent, everyone is going to sit on the sidelines >on this issue.

1 0

Legality of warrant canaries
by Griffin Boyce 18 Oct '14

18 Oct '14

Hey all, There's been a lot of discussion around warrant canaries lately, and I just want to pipe in with my experience. Back in 2012, I talked to my attorney about setting up a warrant canary or a dead man's switch -- which he pointed out would have the same legal repercussions as just releasing the gagged warrant/NSL. Why? Because they are frequently phrased in such a way that if you do or fail to do a thing to somehow make it known, then you've violated the order. You're in just as much trouble if you take out a billboard or tweet a scan of the order or use pantomime or comment out a warrant canary. The only difference is that there *might* be plausible deniability if you tell your partner "something happened at work today and I can't tell you what it is" [1], whereas you have *no* ability to deny anything if you remove a publicized warrant canary from a website. I'm not saying don't do it, but maybe talk to a lawyer first. ~Griffin [1] http://www.newyorker.com/tech/elements/what-its-like-to-get-a-national-secu… -- "I believe that usability is a security concern; systems that do not pay close attention to the human interaction factors involved risk failing to provide security by failing to attract users." ~Len Sassaman

7 6

NYPD Gets Glomar Powers
by Rich Jones 17 Oct '14

17 Oct '14

Not sure if this is too relevant to the list, but thought I'd bring it up anyway. Fairly important ruling today: http://www.rcfp.org/browse-media-law-resources/news/trial-court-allows-poli… Basically, a few years ago, the NYPD hired a bunch of ex-TLA guys to handle their freedom of information program, and then began declaring things as being secret, even though the law mentioned nothing about the ability to do this. Of course, they even extended their newly-created power to declare the even the existence-or-non-existence of information secret. Today, in horrifying fashion, the court affirmed their power to do this. FTA: > The case, *Abdur-Rashid v. New York City Police Department > <http://www.nycourts.gov/reporter/3dseries/2014/2014_24271.htm>*, > involved a request by Imam Talib Abdur-Rashid for records regarding NYPD > surveillance of himself and his mosque in New York City. The city refused > to disclose to Mr. Abdur-Rashid whether any such records existed, and told > him that even if they did exist, such records would be exempt under the New > York Freedom of Information Law (“FOIL”). > > In its decision > <http://www.nycourts.gov/reporter/3dseries/2014/2014_24271.htm>, the > court somewhat perplexingly acknowledged that according to federal and > state case law, “[i]t should follow that when a local agency such as the > NYPD is replying to a FOIL request, the Glomar doctrine is similarly > inapplicable.” However, it then went on to state that as this was a case of > first impression, the NYPD’s use of a Glomar response “is in keeping with > the spirit of similar appellate court cases.” The court determined that > “disclosing the existence of responsive records would reveal information > concerning operations, methodologies, and sources of information of the > NYPD, the resulting harm of which would allow individuals or groups to take > counter-measures to avoid detection of illegal activity, undermining > current and future NYPD investigations.” Therefore, it granted the NYPD’s > motion to dismiss the case. > This is particularly troubling as a lot of police departments look to NYPD as an example, and we may see this as a new tactic opposing police investigators across the country. It's a very bad day for FOIA in my opinion. R

1 0

Novena update
by Eugen Leitl 17 Oct '14

17 Oct '14

Bunnie seems on track. Wonder what the price tag for rubes will be. http://www.bunniestudios.com/blog/?p=4146

2 1

Re: Corporate undercover nation-state agents
by Snehan Kekre 16 Oct '14

16 Oct '14

1 0

Corporate undercover nation-state agents
by bluelotus＠openmailbox.org 16 Oct '14

16 Oct '14

https://firstlook.org/theintercept/2014/10/10/core-secrets/ "But the briefing document suggests another category of employees—ones who are secretly working for the NSA without anyone else being aware. This kind of double game, in which the NSA works with and against its corporate partners, already characterizes some of the agency’s work, in which information or concessions that it desires are surreptitiously acquired if corporations will not voluntarily comply. The reference to “under cover” agents jumped out at two security experts who reviewed the NSA documents for The Intercept. “That one bullet point, it’s really strange,” said Matthew Green, a cryptographer at Johns Hopkins University. “I don’t know how to interpret it.” He added that the cryptography community in America would be surprised and upset if it were the case that “people are inside [an American] company covertly communicating with NSA and they are not known to the company or to their fellow employees.” The ACLU’s Soghoian said technology executives are already deeply concerned about the prospect of clandestine agents on the payroll to gain access to highly sensitive data, including encryption keys, that could make the NSA’s work “a lot easier.” “As more and more communications become encrypted, the attraction for intelligence agencies of stealing an encryption key becomes irresistible,” he said. “It’s such a juicy target.”

4 5