Archive for 2012/02/19

http://www.theregister.co.uk/2012/02/19/google_apple_wallet_advertising/

http://dollarcollapse.com/creeping-fascism/creeping-fascism-part-one-return-of-the-company-town/

Landline and mobile phone companies and broadband providers will be ordered to store the data for a year and make it available to the security services under the scheme.

The databases would not record the contents of calls, texts or emails but the numbers or email addresses of who they are sent and received by.

For the first time, the security services will have widespread access to information about who has been communicating with each other on social networking sites such as Facebook.

Direct messages between subscribers to websites such as Twitter would also be stored, as well as communications between players in online video games.

The Home Office is understood to have begun negotiations with internet companies in the last two months over the plan, which could be officially announced as early as May.

More:
http://www.telegraph.co.uk/technology/internet/9090617/Phone-and-email-records-to-be-stored-in-new-spy-plan.html

Jacobs also states that the state of security at government level almost makes him cry.

Dutch language news article:
http://www.nu.nl/tech/2744710/ict-veiligheid-bij-lagere-overheden-janken.html

About Bart Jacobs: http://www.cs.ru.nl/~bart/

See also:

Based on what has been demonstrated thus far, ongoing research efforts, and the continuing advancements of computing and networking technology, we believe that cloud computing is poised to have a major impact on our society’s data-central commercial and scientific endeavors.
http://cryptome.org/2012/01/nsa-cloud.pdf

 

SIDN currently has access agreements with the following investigative and enforcement authorities:

More:

https://www.sidn.nl/en/about-nl/whois/whois-access-for-investigative-agencies/

Some of the possible uses of DPI at present include:

  • Limited or Tailored Service – For some specialist cases, such as cell phone contracts that are intended to only allow the user access to Facebook or other services, DPI can ensure that this is enforced.
  • Policy Control– Broadband providers can ensure that their service-level agreements and acceptable use policies are enforced.
  • Bandwidth Management – In addition to monitoring acceptable use and throttling excessive users, DPI can also managed on-the-fly bandwidth management to redistribute traffic loads during busy times.
  • Network Security – the ability to detect and intercept viruses, spyware and DDoS attacks before they reach their destination provides the potential for a massive improvement in network security, denying malicious traffic from reaching, and exploiting, vulnerable individual systems.
  • Law Enforcement Compliance – DPI technology provides networks with the means for complying with specific law-enforcement requirements in different regions, such as CALEA.
  • Quality of Service – The traffic control and bandwidth management abilities of DPI allows service providers to intelligently shape network traffic to prevent heavy users of streaming or P2P services from slowing down the network for other users.

So Where’s the Rub?

The main purpose of Deep Packet Inspection technology is to give users a better experience and to make intelligent delivery of service more manageable for network providers. All of the above applications are primarily aimed at stopping users or software from reducing the quality of service for other users, delivering the expected service or complying with legal requirements, so why is DPI at the centre of so many debates concerning issues as fundamental as free speech, civil liberties and privacy? To understand this it’s worth looking at some high-profile debates, campaigns and recent events to see how DPI fits in.

Much more:

http://blogcritics.org/scitech/article/why-deep-packet-inspection-isnt-being/

http://www.infosecurity-magazine.com/view/23790/service-providers-lack-confidence-in-leas/

http://blogs.mcafee.com/mcafee-labs/android-diy-dos-app-boosts-hacktivism-in-south-america

http://news.cnet.com/8301-1023_3-57380697-93/judge-tosses-law-barring-sex-offenders-from-facebook/

http://news.cnet.com/8301-31001_3-57380874-261/mpaa-celebrates-new-film-agreement-with-china/

The hacking of the websites of the Federal Trade Commission’s Bureau of Consumer Protection on February 17 was the second attack on the agency’s web presence in less than a month. Both of the attacked servers were set up for the FTC by the public relations firm Fleishman-Hilliard under the same contract, and ran on servers the firm provisioned from web hosting and cloud services provider Media Temple.

But even after the server for the FTC’s OnGuardOnline.gov site (ironically, a site intended to share tips from the government on computer security and privacy for consumers) was hacked on January 24 using an exploit of security weaknesses in the applications running on it, Fleishman declined to update the software running its other sites, an executive of Media Temple told Ars.

More:

http://arstechnica.com/business/news/2012/02/after-first-anon-hack-pr-firm-failed-to-update-other-gov-websites.ars

The Canadian public safety minister Vic Toews has called in the police to investigate threats made against him and his family in response to his internet privacy bill, which has also provoked a storm of online protest.

http://www.theregister.co.uk/2012/02/18/police_threats_canada_internet_toews/

The Dutch judge argues that a name of a foundation does not equal “personal details” as defined in the current Dutch data privacy laws. Even though the name of the foundation contains the names of the complainants and Google Maps is also displaying the address information – the location where the complainants actually live – as well as pictures of the premises.

The judge then switches to an interesting philosophy, moving away from the situation at hand by arguing that:

- names of foundations typically do not match names of the people working for it
- addresses of foundations typically do not match names of the people working for it, AND Google is not making known that the addresses of the complainants and the addresses of the foundation are one and the same
- Google has rightfully requested the address information at the Dutch Chamber of Commerce
-  potential use of Google Maps by burglars is only “speculative”

One wonders how this judge would feel about any presumed link between IP addresses and personal details…

Dutch language news article:
http://tweakers.net/nieuws/80133/google-nederland-wint-privacyzaak-maps-dienst.html

Private detectives or police and government agents who don’t want to obtain a court order can also use the technique to confirm whether a person they’re tracking is attending a particular demonstration or meeting

http://arstechnica.com/business/news/2012/02/location-tracking-of-gsm-cellphones-now-easier-and-cheaper-than-ever.ars