Incite

MPAA Kills Anti-Pretexting Bill

The California Legislature was about to pass a bill protecting us from people using deceptive information to steal our private information, but the MPAA stopped them.

A tough California bill that would have prohibited companies andindividuals from using deceptive "pretexting" ruses to steal privateinformation about consumers was killed after determined lobbying by themotion picture industry, Wired News has learned.

The bill, SB1666,was written by state Sen. Debra Bowen, and would have barredinvestigators from making "false, fictitious or fraudulent" statementsor representations to obtain private information about an individual,including telephone calling records, Social Security numbers andfinancial information. Victims would have had the right to sue fordamages.

The bill won approval in three committees and sailed through thestate Senate with a 30-0 vote. Then, according to Lenny Goldberg, alobbyist for the Privacy Rights Clearinghouse, the measure encounteredunexpected, last-minute resistance from the Motion Picture Associationof America.

"The MPAA has a tremendous amount of clout and they toldlegislators, 'We need to pose as someone other than who we are to stopillegal downloading,'" Goldberg said.

MPAA Kills Anti-Pretexting Bill

technorati tags:privacy, identity, identityTheft, theft, pre-texting, steal, MPAA, information

Save Internet Neutrality

It’s time to act to preserve neutrality of the internet.

Net Neutrality ensures that Republican and Democrat Web sites open just as quickly, regardless of the political affiliation or financial self-interest of any Internet company. It allows a video on a small news blog to be just as accessible as the video on a large corporate news site. And it prevents Google from ever having to worry about Yahoo outbidding it for the right to work more quickly on your computer.

It is precisely because of Net Neutrality that the Internet has been a revolutionary force for democratic participation, economic innovation and free speech. The free and open Internet empowers everyday people — mothers and fathers, sisters and brothers, young and old alike. But this week, as Congress rewrites our nation’s telecommunications policy, Internet freedom at risk.  (From Washington Times, June 16, 2006)

Last week the House of Representatives voted to do away with Net Neutrality protections.  This will drastically change the internet. 

Telecom executives have been surprisingly blatant in public comments about their desire to erect tollbooths on the information superhighway as soon as Net Neutrality is dead and buried — creating a fast lane for some and a slow lane for everyone else. AT&T’s Chief Executive Officer Ed Whitacre has said, “The Internet can’t be free” and referred to the Internet as “my pipes” which others must pay to go through. BellSouth’s William Smith said his company should be able to charge Yahoo for the opportunity to load faster than Google on your computer.  (From Washington Times)

Easy Identity Theft - Passports, Keys and Drivers Licenses With RFID Chips

I've been talking about the security problems surrounding the new drivers licenses and passports with RFID chips that the government is about to issue.  They make life very easy for identity thieves - actually, for all thieves - and they make you much less secure.

Here's how easy it is to steal your information and your identity:

"I just need to bump into James and get my hand within a few inches of him," Westhues says. We're shivering in the early spring air outside the offices of Sandstorm, the Internet security company Van Bokkelen runs north of Boston. As Van Bokkelen approaches from the parking lot, Westhues brushes past him. A coil of copper wire flashes briefly in Westhues' palm, then disappears.

Van Bokkelen enters the building, and Westhues returns to me. "Let's see if I've got his keys," he says, meaning the signal from Van Bokkelen's smartcard badge. The card contains an RFID sensor chip, which emits a short burst of radio waves when activated by the reader next to Sandstorm's door. If the signal translates into an authorized ID number, the door unlocks.

The coil in Westhues' hand is the antenna for the wallet-sized device he calls a cloner, which is currently shoved up his sleeve. The cloner can elicit, record, and mimic signals from smartcard RFID chips. Westhues takes out the device and, using a USB cable, connects it to his laptop and downloads the data from Van Bokkelen's card for processing. Then, satisfied that he has retrieved the code, Westhues switches the cloner from Record mode to Emit. We head to the locked door.

"Want me to let you in?" Westhues asks. I nod.

He waves the cloner's antenna in front of a black box attached to the wall. The single red LED blinks green. The lock clicks. We walk in and find Van Bokkelen waiting.

Wired 14.05: The RFID Hacking Underground

MPAA Finds Itself Accused of Piracy

The MPAA appears to be using loopholes it denies to others who want to copy films.

This Film Is Not Yet Rated looks at the motion picture ratings system created and run by the MPAA. Director Kirby Dick submitted the film for rating in November. After receiving the movie, the MPAA subsequently made copies without Dick's permission. Dick had specifically requested in an e-mail that the MPAA not make copies of the movie. The MPAA responded by saying that "the confidentiality of your film is our first priority."

Dick later learned that the MPAA made copies of the film to distribute them to its employees, despite the MPAA's  stance on unauthorized copying. Ah, there's nothing like the smell of hypocrisy in the morning-apparently the prohibition against copying films without the copyright owner's consent doesn't apply to the MPAA. A lawyer for the MPAA justified the organization's apparent hypocrisy by saying that Dick had invaded the privacy of some MPAA staffers, which justified the MPAA's actions.

This is from Ars Technica:  MPAA admits to unauthorized movie copying

The original article is from the Los Angeles Times:  The MPAA Finds Itself Accused of Privacy
where there is more information.

Bush Agreed About Warrants

In Buffalo on April 20, 2004 President Bush said clearly and forcefully:

"Any time you hear the United States government talking about wiretap, it requires -- a wiretap requires a court order. Nothing has changed, by the way. When we're talking about chasing down terrorists, we're talking about getting a court order before we do so."

This was two years after he asked the NSA to conduct domestic surveillance without warrants - and they complied with his wishes.  He clearly knew and agreed that warrants were necessary even as he proceeded without them.

FISA Court and NSA Search Delays

The FISA Court does not cause delays in starting searches or wiretaps.  Here is some information on an actual case which clarifies the workings of the Court and some of the misconceptions about it before and after 9/11 and The Patriot Act.  It also shows the effect of Attorney General Ashcroft's ranking of terrorism as his lowest priority in early August 2001:

Republican commentators such as William Kristol and Rush Limbaugh claim FISA procedures, and the legal impediments they impose, prevented FBI agents from acting. Consequently, they maintain President Bush is justified in abrogating FISA law to order the NSA to eavesdrop on Americans.

As legal counsel to the Minneapolis FBI Division and witness to the entire Moussaoui case, I can tell you that these assertions are not just factually wrong, they miss the real problems that existed within our intelligence gathering superstructure. I wrote a 13 page memo and testified before Congress on these very failures. Yet, some individuals continue to misapply and misrepresent what I said.

MYTH #1: THE JUSTICE DEPARTMENT DECIDED THERE WAS NOT SUFFICIENT EVIDENCE TO GET A FISA WARRANT TO ALLOW THE INSPECTION OF MOUSSAOUI'S COMPUTER FILES.

The Blog | Coleen Rowley: FISA Not to Blame for Moussaoui Mess | The Huffington Post

Technorati Tags: privacy, security

RFID Chips To Travel in U.S. Passports

The State Department has officially implemented the new RFID passport regulations, effective October 2006.  The new passports will contain Radio Frequency ID chips (RFID) that will broadcast your information like little radio stations.  Since it has been determined that this information can be read from as far as 160 feet away, they've added some material to dampen the signal when the passport is closed, but it won't completely prevent the broadcasting.  When the passport is open - at airports, hotels, etc. - all bets are off.

This means that identity thieves, or thieves in general, do not have to gain possession of your passport to take your information, they only have to be in your vicinity.

Technorati Tags: identity theft, privacy, RFID, security

Does Your Car Key Pose a Security Risk?

I've talked about RFID tags in the new passports and some states' new drivers licenses and how they will be able to broadcast your data to identity thieves. I thought that would be a problem in the future. Apparently, the future is now. Johns Hopkins University and RSA Laboratories have done some tests on Mobil Speedpasses and car keys with RFID chips in them. They found that they were extremely easy to hack - get the information out - and clone. The security is very weak.

Undoubtedly, passports and drivers licenses will have stronger security - we hope - but that only means it will probably take a little longer for thieves and terrorists to learn how to break the security and clone the IDs. And remember, they broadcast your information, so the thieves don't need to touch you or your keys or cards or passports - they just have to be in the same area as you are. They transmit all the time. You won't even know anything has happened.

So far, the only way to protect your RFID keys, passports and drivers licenses ... is to wrap them in aluminum foil until you need to use them. :-)

I feel more secure - how about you?

With just "a few hundred dollars worth of equipment," Rubin says his team was able to wirelessly interact with car keys and payment tags at close range, and obtain enough information to crack their security system. They could then create a clone of the device, he says. This clone would allow someone to purchase gas on a victim's key-tag or disable a car's alarm system, but would not allow you to unlock a car's doors, Rubin says.

The chips tested during the study were more advanced than those that exist in older cars, Rubin says. "The one that we broke is the latest and greatest," he says, adding that older cars have weaker security systems that could be easier to hack into.

Read more: PCWorld.com - Does Your Car Key Pose a Security Risk?

Passport Privacy Protection? Nope

The Bush Administration fights the concept of foreign countries telling us how to behave in any way, but they let them dictate how our passports should work. Why?

By the end of this year, our new passports will have an embedded microchip that can broadcast our information - name, birth date, picture - to anyone within 30 feet - unencrypted. Why does this information need to be broadcast? The only reason I can think of is so the government can scan people whenever they want to - to discover who's going into any kind of meeting, for example. This would give governments much greater surveillance power without the need for a warrant.

The reason they are unencrypted, we're told, is to make them more easily usable by foreign countries. It makes it easier for terrorists and identity thieves to get information as well. Since the information is unencrypted, they are LESS secure than our current passports, and will not stop counterfeiters.

Credit cards work just fine by swiping the card. Current passports require physical contact to be scanned, so someone would have to have possession of them to steal your information. You wouldn't be able to be tracked by having it in your bag - a downside for surveillance - a plus for your privacy and the safety of your identity.

I suppose we could just put them inside aluminum foil to stop the broadcasts ;-)

WASHINGTON -- The Bush administration opposed security measures for new microchip-equipped passports that privacy advocates contended were needed to prevent identity theft, government snooping or a terror attack, according to State Department documents released Friday.

The passports, scheduled to be issued by the end of 2005, could be read electronically from as far away as 30 feet, according to the American Civil Liberties Union, which obtained the documents under a Freedom of Information Act request.

Though the passports wouldn't include transmitters of their own, they would have antennas to allow a reader to capture the data.

The ability to read remotely, or "skim," personal data raises the possibility that passport holders would be vulnerable to identity theft, the ACLU said. It also would allow government agents to find out covertly who was attending a political meeting or make it easier for terrorists to target Americans traveling abroad, the ACLU said.

Read more: Wired News: Passport Privacy Protection? Nope

Why is American Airlines gathering written dossiers on fliers' friends?

This post from Boing Boing makes you wonder what exactly is going on with security these days. It seems to be getting pretty intrusive without any legal justification.

Wednesday, January 19, 2005

Last week on a trip from London to the US, American Airlines demanded that I write out a list of the names and addresses of all the friends I would be staying with in the USA. They claimed that this was due to a TSA regulation, but refused to state which regulation required them to gather this information, nor what they would do with it once they'd gathered it. I raised a stink, and was eventually told that I wouldn't have to give them the requested dossier because I was a Platinum AAdvantage Card holder (e.g., because I fly frequently with AA). I have written an open letter to AA asking for details on this -- see the link below for the whole text.

Read more: Boing Boing: Why is American Airlines gathering written dossiers on fliers' friends?