[Clips] The Word Crunchers

[R.A. Hettinga]

Even anonymous plaintext ain't so anonymous, boys and girls...

Cheers,
RAH

--- begin forwarded text


Date: Fri, 3 Jun 2005 23:30:57 -0400
To: Philodox Clips List <[EMAIL PROTECTED]>
From: "R.A. Hettinga" <[EMAIL PROTECTED]>
Subject: [Clips] The Word Crunchers
Reply-To: [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]



The New York Times
June 5, 2005

The Word Crunchers

 By DEBORAH FRIEDELL


In David Lodge's 1984 novel, ''Small World,'' a literature professor fond
of computer programming presents a novelist with a fantastic discovery: by
entering all the novelist's books into a computer, the professor can
determine the novelist's favorite word. The computer knows to ignore the
mortar of sentences -- articles, prepositions, pronouns -- to get to ''the
real nitty-gritty,'' Lodge writes, ''words like love or dark or heart or
God.'' But the computer's conclusion causes the novelist to shrink from
ever writing again. His favorite word, it finds, is ''greasy.''

Two decades later, Amazon.com, improving on its popular ''search inside the
book'' function, in April introduced a concordance program, whereby a click
of the mouse reveals a book's most frequently occurring words, ''excluding
common words.'' Further clicks reveal their contexts. And so we learn that
the nitty-gritty words appearing most frequently in the King James Bible
include ''God,'' ''Lord,'' ''shall'' and ''unto.'' The word that appears
most frequently in T. S. Eliot's ''Collected Poems'' is ''time'' -- ''There
will be time, there will be time'' -- while the word that turns up most
frequently in ''Extraordinary Golf,'' by Fred Shoemaker and Pete Shoemaker,
is, illuminatively, ''golf.''

Such computer tools have been centuries in the making. As the legend goes,
the first concordance -- of the Vulgate, completed in the early 13th
century -- required the labor of 500 Dominican friars. Even in more modern
times, those who began concordances knew that they might not live long
enough to see them completed. This was the case for the first directors of
the Chaucer concordance, which took 50 years before reaching publication in
1927.

In order to speed the process for his Wordsworth concordance, first
published in 1911, the scholar Lane Cooper required an army of Cornell
graduate students and faculty wives. It was a laborious undertaking,
involving glue, rubber stamps and a vastly intricate system of
cross-referenced 3-by-5 cards.

At the same time Cooper was mapping ''The Prelude,'' biologists at other
universities were discovering sex chromosomes. Indeed, in his description
of the alphabetization and arrangement involved in concordance-making,
Cooper calls to mind a profession that was only just beginning to exist. He
is a geneticist of language, isolating and mapping the smallest parts with
the confidence that they will somehow reveal the design of the whole.

In 1951, I.B.M. helped create an automated concordance that cataloged four
hymns by St. Thomas Aquinas. The scanning equipment was primitive. Words
still had to be hand-punched onto cards, programs for alphabetizing had to
be written, and many found the computers more trouble than they were worth.
Even with electronic assistance, indexing all of Aquinas took a million
man-hours and 30 years before it was finally completed in 1974.

Yet even as computers grew more sophisticated, some scholars resisted them.
In 1970, Stephen M. Parrish, an English professor, described how when he
''proposed to some of the Dante people at Harvard that they move to the
computer and finish the job in a couple of months, they recoiled in
horror.'' In their system, ''each man was assigned a block of pages to
index lovingly,'' and had been doing so contentedly for more than 25 years.
But eventually, of course, concordance makers joined the ranks of all the
other noble occupations gone.

Why did they labor so? Monks used concordances to ferret out connections
among the Gospels. Christian theologians relied on them in their quest for
proof that the Old Testament contained proleptic visions of the New. For
philologists, concordances provide a way of defining obscure words; if you
gather enough examples of a word in context, you may be able to divine its
meaning. Similarly, concordances help scholars attribute texts of uncertain
provenance by allowing them to see who might have used certain words in a
certain way. For readers, concordances can be a guide into a writer's mind.
''A glance at the Lane Cooper concordance'' led Lionel Trilling to conclude
that Wordsworth, ''whenever he has a moment of insight or happiness, talks
about it in the language of light.'' (The concordance showed the word
''gleam'' as among Wordsworth's favorites).

Sometimes a word's infrequent appearance can be just as revealing. In the
1963 concordance to Yeats compiled by Parrish and James A. Painter, Painter
singles out the opening stanza of ''Byzantium,'' ita

Re: Papers about "Algorithm hiding" ?

[Steve Furlong]

On 6/3/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
> Another alternative is the cyphersaber type of thing, where you could just
> implement your crypto-code on the fly, as needed.

Yes, I could, and have. Presumably you could. Ben Laurie probably
could blindfolded with both hands tied behind his back. But Alice
Philanderer, Bob Pedophile, Charlie Terrorist, and Generic Joe User
can't. Your alternative is more practical than "if everybody would
xxx" (sorry, Ian) but still not good enough. If only techies are able
to protect themselves from the JBTs, then merely being a techie will
be grounds for suspicion. (As well as throwing our non-programming 
brethren to the wolves.)

The only realistic solutions are those which allow the concerned but
non-technical user to take measures to protect himself against the
perceived threat, without requiring major changes to human nature or
to society.

As it happens, I have really good test cases to refine my solutions:
my extended family is a bunch of mountain hicks with internet access.
They're not especially educated and certainly not technically adept,
and are concerned about the gummint grabbing their computers or
snooping their traffic. Once I've got an acceptable suite of tools and
a training package put together, I'll post it somewhere. (Don't hold
your collective breath; making a living takes most of my time.)


Regards,
SRF

-- 
There are no bad teachers, only defective children.

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Papers about "Algorithm hiding" ?

[astiglic]

Well, everyone who has Windows on their machine (at least a Windows 95
updated version and up, I think) has at least Microsoft's crypto provider,
 and MS CAPI to use it!  Most broswers implement HTTPS, so you have crypto
there as well.

I think we are already in a state where practically everybody that has a
computer has crypto available, and it's not difficult to use it!

Another alternative is the cyphersaber type of thing, where you could just
implement your crypto-code on the fly, as needed.

--Anton

> On 5/31/05, Ian G <[EMAIL PROTECTED]> wrote:
>> I don't agree with your conclusion that hiding algorithms
>> is a requirement.  I think there is a much better direction:
>> spread more algorithms.  If everyone is using crypto then
>> how can that be "relevant" to the case?
>
> This is so, in the ideal. But "if everyone would only..." never seems
> to work out in practice. Better to rely on what you can on your own or
> with a small group.
>
> In response to Hadmut's question, for instance, I'd hide the crypto
> app by renaming the executable. This wouldn't work for a complex app
> like PGP Suite but would suffice for a simple app. Rename the
> encrypted files as well and you're fairly safe. (I've consulted with
> firms that do disk drive analysis. From what I've seen, unless the
> application name or the data file extensions are in a known list, they
> won't be seen. But my work has been in the realm of civil suits,
> contract disputes, SEC claims, and the like; the investigators might
> be more thorough when trying to nail someone for kiddie porn.)
>
> Or use another app which by the way has crypto. Winzip apparently has
> some implementation flaws
> (http://www.cse.ucsd.edu/users/tkohno/papers/WinZip/ ) but a quick
> google doesn't show anything but brute force and dictionary attacks
> against WinRar.
>
> --
> There are no bad teachers, only defective children.
>
> -
> The Cryptography Mailing List
> Unsubscribe by sending "unsubscribe cryptography" to
> [EMAIL PROTECTED]
>



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Bluetooth cracked further

[Perry E. Metzger]

Matt Crawford <[EMAIL PROTECTED]> writes:
> On Jun 3, 2005, at 11:55, Perry E. Metzger wrote:
>> 2) They also have a way of forcing pairing to happen, by impersonating
>>one of the devices and saying "oops! I need to pair again!" to the
>>other.
>
> Do the devices then pair again without user intervention, re-using the
> PIN that paired them initially?

That is my understanding. Ugly, isn't it?

> I always imagined I could use a lame PIN if I was far from any
> eavesdroppers...

Given the nature of this new attack, it probably doesn't matter.

Perry

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Bluetooth cracked further

[Edgar Danielyan]

> If you have a pair of bluetooth devices that are paired, best to keep
> them in a faraday cage at all times.

"Buy a Bluetooth phone and get a matching colour Faraday cage for FREE!" *

* Faraday not included.

...

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Bluetooth cracked further

[Matt Crawford]

On Jun 3, 2005, at 11:55, Perry E. Metzger wrote:

2) They also have a way of forcing pairing to happen, by impersonating
   one of the devices and saying "oops! I need to pair again!" to the
   other.


Do the devices then pair again without user intervention, re-using the 
PIN that paired them initially?


I always imagined I could use a lame PIN if I was far from any 
eavesdroppers...



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Bluetooth cracked further

[Perry E. Metzger]

"Perry E. Metzger" <[EMAIL PROTECTED]> writes:
> Cracking the Bluetooth PIN
>
> http://www.eng.tau.ac.il/~yash/shaked-wool-mobisys05/index.html

I realized I didn't mention the really evil part.

1) They can crack your security if they can listen in to the pairing
   communication.
2) They also have a way of forcing pairing to happen, by impersonating
   one of the devices and saying "oops! I need to pair again!" to the
   other.

If you have a pair of bluetooth devices that are paired, best to keep
them in a faraday cage at all times.

Perry

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Bluetooth cracked further

[Perry E. Metzger]

Cracking the Bluetooth PIN

http://www.eng.tau.ac.il/~yash/shaked-wool-mobisys05/index.html

Abstract:
  This paper describes the implementation of an attack on the Bluetooth
  security mechanism. Specifically, we describe a passive attack, in
  which an attacker can find the PIN used during the pairing process. We
  then describe the cracking speed we can achieve through three
  optimizations methods. Our fastest optimization employs an algebraic
  representation of a central cryptographic primitive (SAFER+) used in
  Bluetooth. Our results show that a 4-digit PIN can be cracked in less
  than 0.3 sec on an old Pentium III 450MHz computer, and in 0.06 sec on
  a Pentium IV 3Ghz HT computer. 


-- 
Perry E. Metzger[EMAIL PROTECTED]

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Digital signatures have a big problem with meaning

[John Gilmore]

> That cuts both ways though.  Since so many systems *do* screw with data (in
> insignificant ways, e.g. stripping trailing blanks), anyone who does massage
> data in such a way that any trivial change will be detected is going to be
> inundated with false positives.  Just ask any OpenPGP implementor about
> handling text canonicalisation.

Even mere hash checks are turning up obscure data corruptions.  Some
people reported that BitTorrent would never finish certain files,
getting to 99.9% and stalling.  The problem is that their NAT box was
replacing its external IP address with its internal address --
anywhere in a packet.  This is called "Game mode" in some NAT boxes.
Their router was corrupting random binary data (and altering the TCP,
UDP, and Ethernet packet checksums!).  They never noticed until
BitTorrent used end-to-end application-level SHA1 hash checks and
retransmission to detect and correct it.

  http://azureus.aelitis.com/wiki/index.php/NinetyNine

John

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: [Clips] Storm Brews Over Encryption 'Safe Harbor' in Data Breach Bills

[Ian G]

On Friday 03 June 2005 14:38, Greg Rose wrote:
> At 00:48 2005-06-03 +0100, Ian G wrote:
> >Just to make it more interesting, the AG of New York, Elliot Spitzer
> >has introduced a  package of legislation intended to "rein in identity
> > theft" including:
> >
> >   Facilitating prosecutions against computer hackers by creating
> >   specific criminal penalties for the use of encryption to conceal
> >   a crime, to conceal the identity of another person who commits
> >   a crime, or to disrupt the normal operation of a computer;
>
> Ah, imagine the beautiful circularity of the Justice Department using
> encryption to protect their criminal identity database from disclosure...
> or not.

They might have a problem with meeting the legal requirements
for disclosure if the alleged criminals were not as yet behind bars... 
I wonder if bin Laden would have an action against the Justice
Department if his file was stolen?

Anyway...

FBI Probes Theft of Justice Dept. Data
http://www.washingtonpost.com/wp-dyn/content/article/2005/05/31/AR2005053101379.html


The FBI is investigating the theft of a laptop computer containing travel 
account information for as many as 80,000 Justice Department employees, but 
it is unclear how much personal data are at risk of falling into the wrong 
hands.
Authorities think the computer was stolen between May 7 and May 9 from Omega 
World Travel of Fairfax, which is one of the largest travel companies in the 
Washington area and does extensive business with government agencies.

 
  Justice Department spokeswoman Gina Talamona said the data included names 
and account numbers from travel account credit cards issued to government 
employees by J.P Morgan Chase & Co. and its subsidiary Bank One Corp.
She said the information did not include Social Security numbers or home 
addresses that often are used by identity thieves to establish credit or to 
purchase goods in other people's names.
In addition, she said the account information was protected by passwords, 
although sophisticated hackers often can break into stored databases.
Omega World Travel officials declined to comment on how the laptop was stolen 
or other elements of the case, as did the FBI, which is investigating.
The theft is one of a spate of incidents over the past several months that 
have resulted in sensitive data on millions of U.S. consumers being stolen or 
exposed.
In December, Bank of America Corp. lost computer tapes containing records on 
1.2 million federal workers, including several U.S. senators.
Talamona said that no Justice Department worker has reported suspicious 
activity on his or her financial accounts since the incident.
The banks issuing the travel cards have placed alerts on the workers' 
accounts, Talamona said.
She added that Omega World Travel has agreed to several changes to its 
security practices, including beefing up physical security at its offices, 
conducting a computer security review and ensuring that the stolen computer 
cannot be reconnected to the firm's network.
The travel cards have not been canceled, Talamona said.

-- 
Advances in Financial Cryptography:
   https://www.financialcryptography.com/mt/archives/000458.html

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Digital signatures have a big problem with meaning

[Peter Gutmann]

Anne & Lynn Wheeler <[EMAIL PROTECTED]> writes:

>the problem was that xml didn't have a deterministic definition for encoding
>fields.

Yup, see "Why XML Security is Broken",
http://www.cs.auckland.ac.nz/~pgut001/pubs/xmlsec.txt, for more on this.  Mind
you ASN.1 is little better, there are rules for deterministic encoding, but so
many things get them wrong that experience has shown the only safe way to
handle it is to do an exact bit-for-bit copy from A to B, rather than trying
to re-code at any point.  I've frequently commented that there is only one
workable rule for encoding objects like X.500 DNs, and that's memcpy().

Peter.

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Digital signatures have a big problem with meaning

[Anne & Lynn Wheeler]

Peter Gutmann wrote:

That cuts both ways though.  Since so many systems *do* screw with data (in
insignificant ways, e.g. stripping trailing blanks), anyone who does massage
data in such a way that any trivial change will be detected is going to be
inundated with false positives.  Just ask any OpenPGP implementor about
handling text canonicalisation.


this was one of the big issues in the asn.1 encoding vis-a-vis xml 
encoding wars.


asn.1 encoding provided deterministic encoding for signed material, 
although some of the more common applications of digital signature have 
what is transmitted is the original encoded material along with the 
signature of that encoded material.


fstc/e-check project wanted to digital sign stuff that was xml encoded 
... but not transmit the xml encoded fields. they wanted to take 
standard financial transaction fields ... momentarily xml encode the 
standard fields, digitally sign the encoded material ... and then append 
the resulting digital signature to the (original) standard transaction 
for transmission.


the problem was that xml didn't have a deterministic definition for 
encoding fields. when the recipient/relying party received the 
transmission ... they had to take the standard transaction fields and 
re-encode in xml in order to verifiy the digital signature. fstc/e-check 
came up with fsml for deterministic encoding of fields ... so that the 
encoding done by the originator (of the digital signature) and the 
encoding done by the relying party (for verifying the digital signature) 
would have identical bit patterns.


fsml was subsequently contributed to the xml digital signature project.

xml is descendent of gml invented by "G", "M", and "L" in 1969 at the 
science center

http://www.garlic.com/~lynn/subtopic.html#545tech
and then standardized at ISO in the 70s
http://www.garlic.com/~lynn/subtopic.html#sgml

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: [Clips] Paying Extra for Faster Airport Security

[Anne & Lynn Wheeler]

there were several news URLs a month or so ago about the issue of 
"faster" in conjunction with the orlanda effort and some of the 
predictions on possibly 40mil (most frequently travelling) people sign 
up if such programs were rolled out around the country.


the issue raised was that they were effectively paying to have a 
priority queue for the existing screening stations (effectively could 
take the place of the first class queue at some airports) ... and what 
is the characteristic of a priority queue if nearly everybody is 
standing in the priority queue rather than the regular queue.


having done some work on queuing ... i turned out the mainframe resource 
manager in the 70s

http://www.garlic.com/~lynn/subtopic.html#fairshare
http://www.garlic.com/~lynn/subtopic.html#wsclock

if the service stations are the same ... and you just are re-arranging 
the order of service ... priority queues have the appearance of meeting 
their objectives when only a small percentage of the total population is 
in the priority queue.



R.A. Hettinga wrote:

--- begin forwarded text


Date: Thu, 2 Jun 2005 20:40:26 -0400
To: Philodox Clips List <[EMAIL PROTECTED]>
From: "R.A. Hettinga" <[EMAIL PROTECTED]>
Subject: [Clips] Paying Extra for Faster Airport Security
Reply-To: [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]

Security needs identity like a fish needs... well, you get the idea...

Cheers,
RAH
---




The Wall Street Journal

 June 2, 2005



Paying Extra for Faster Airport Security
Orlando Kicks Off Program
 Offering Quicker Screenings
 To Holders of Special Cards


-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: [Clips] Storm Brews Over Encryption 'Safe Harbor' in Data Breach Bills

[Greg Rose]

At 00:48 2005-06-03 +0100, Ian G wrote:

Just to make it more interesting, the AG of New York, Elliot Spitzer
has introduced a  package of legislation intended to "rein in identity theft"
including:

  Facilitating prosecutions against computer hackers by creating
  specific criminal penalties for the use of encryption to conceal
  a crime, to conceal the identity of another person who commits
  a crime, or to disrupt the normal operation of a computer;


Ah, imagine the beautiful circularity of the Justice Department using 
encryption to protect their criminal identity database from disclosure... 
or not.


Greg.

Greg RoseINTERNET: [EMAIL PROTECTED]
Qualcomm Incorporated VOICE: +1-858-651-5733   FAX: +1-858-651-5766
5775 Morehouse Drivehttp://people.qualcomm.com/ggr/
San Diego, CA 92121   232B EC8F 44C6 C853 D68F E107 E6BF CD2F 1081 A37C


-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: [Clips] Storm Brews Over Encryption 'Safe Harbor' in Data Breach Bills

[Thierry Moreau]

Adam Shostack wrote:



No.  If I get your database with SQL injection, all conditions are
met, and I have your plaintext.  But, the data is in an encrypted
form, and you're saved.


I'm not familiar with SQL injection vulnerabilities. Perhaps the issue 
is misrepresentation by the SQL provider that the database is encrypted 
using proper algorithms and key management. I guess that if a database 
access application using SQL injections has cleartext access to the 
data, this data is either not appropriately encrypted or the control of 
the encryption key escaped the legitimate user when the SQL injections 
were leaked to the adversary.


One issue with rulemaking/lawmaking is that consequences of a rule are 
sometimes unexpected because words (e.g. "properly encrypted") are 
smetimes corrupted by diverted usage e.g. public relations aspects of 
e-commerce security. So, even if your statement was technically wrong, 
if *you* are convinced that a database vulnerable to SQL injection 
tampering threat is nonetheless "encrypted", then a judge might be so 
convinced. Consequently, the lawmaking exercise must be more specific 
than above, e.g. using reference to by-laws which define acceptable 
encryption technology and key management techniques ... which is no 
longer a simple solution.


Thanks for highlighting the limits of the original post, either on a 
technical basis or on issues of lawmaking strategy.


--

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [EMAIL PROTECTED]


-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: [Clips] Storm Brews Over Encryption 'Safe Harbor' in Data Breach Bills

[Adam Shostack]

On Fri, Jun 03, 2005 at 12:12:31AM -0400, Thierry Moreau wrote:
| Here is a suggestion for an encrypted data exception based on reasonable 
| key management principles:
| 
| 
| 
| Sec xyz) The [breach notification requirement set forth in section ...] 
| does not apply to [breached data portions] for which the following 
| conditions are demonstrably met:
| 
| a) the [breached data portion] is in an encrypted form using an 
| encryption algorithm and an encryption key that can be shown to be 
| [resistant / comptatible or equivalent to NIST recommended practice for 
| encrypting classified data],
| 
| b) the said encryption key has always been under the sole control of the 
| [data originator],
| 
| c) the [data originator] is in a position to retire every copy of the 
| said encryption key from operations, and
| 
| d) the [data originator] takes all resaonable steps to so retire every 
| copy of the said encryption key from operations as soon as the [data 
| breach event] is known to [the data originator], and completes such 
| retirement within [a delay e.g. the same delay as for notification].
| 
| The evidence that conditions a) to d) are met shall be [kept for auditor 
| review / filed with an incident report otherwise mandated]
| 
| 
| 
| Is that actually a reasonable key management principle?

No.  If I get your database with SQL injection, all conditions are
met, and I have your plaintext.  But, the data is in an encrypted
form, and you're saved.

Adam

| Is it possible the the US law-makers adopt such sensible approaches?
| 
| -- 
| 
| - Thierry Moreau
| 
| CONNOTECH Experts-conseils inc.
| 9130 Place de Montgolfier
| Montreal, Qc
| Canada   H2M 2A1
| 
| Tel.: (514)385-5691
| Fax:  (514)385-5900
| 
| web site: http://www.connotech.com
| e-mail: [EMAIL PROTECTED]
| 
| 
| -
| The Cryptography Mailing List
| Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Digital signatures have a big problem with meaning

[Peter Gutmann]

Rich Salz <[EMAIL PROTECTED]> writes:

>I think signatures are increasingly being used for technical reasons, not
>legal.  That is, sign and verify just to prove that all the layers of
>middleware and Internet and general bugaboos didn't screw with it. 

That cuts both ways though.  Since so many systems *do* screw with data (in
insignificant ways, e.g. stripping trailing blanks), anyone who does massage
data in such a way that any trivial change will be detected is going to be
inundated with false positives.  Just ask any OpenPGP implementor about
handling text canonicalisation.

Peter.

-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

[Clips] Security Woes Don't Slow Reed's Push Into Data Collection

[R.A. Hettinga]

--- begin forwarded text


Date: Thu, 2 Jun 2005 23:45:21 -0400
To: Philodox Clips List <[EMAIL PROTECTED]>
From: "R.A. Hettinga" <[EMAIL PROTECTED]>
Subject: [Clips] Security Woes Don't Slow Reed's Push Into Data Collection
Reply-To: [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]



The Wall Street Journal

 June 3, 2005
 HEARD ON THE STREET

Security Woes Don't Slow
 Reed's Push Into Data Collection

By DAVID PRINGLE
Staff Reporter of THE WALL STREET JOURNAL
June 3, 2005


LONDON -- News of security breaches at LexisNexis has thrust the
Internet-based data company's parent, publishing titan Reed Elsevier PLC,
into the spotlight and tossed around Reed's share price in the past few
months. Investors might want to prepare themselves for more of the same.

Far from backing off, Reed plans to push deeper into the business of
collecting personal data on individuals for sale to employers, banks,
lawyers and other clients -- the source of the problems at LexisNexis.

Reed's chief executive, Sir Crispin Davis, says he expects "significant"
opportunities to further expand the business in the U.S. in the next few
years. "It's a highly attractive, long-term growth opportunity," he says.
"This is a new, emerging industry, and it isn't, perhaps, too surprising
that we are facing these kinds of troubles."

Reed could soon be in the headlines again once investigators in the U.S.
determine how data brokers now owned by the London-based company allowed 59
security breaches, lifting such personal data as Social Security numbers,
addresses and driver's license records of 310,000 Americans over two years.

The Secret Service and the Federal Bureau of Investigation have searched
dozens of homes and computers as part of an investigation into the data
theft. Reed faces a suit seeking class-action status in federal court for
the Southern District of California that claims the company "trampled the
privacy interests and expectations of consumers."

But investors expect Reed to ride out this furor largely unscathed. Its
share price is up 11% in London this year, compared with a 6% rise in the
Dow Jones Stoxx 600 Media index for Europe. In 4 p.m. New York Stock
Exchange composite trading yesterday, Reed's American depositary receipts
were up 51 cents to $39.18, giving Reed a market capitalization of about
$23 billion.

Sir Crispin's push into the data-brokering market is part of his wider
strategy to turn the 125-year-old company into a high-tech business
offering database products covering everything from scientific papers to
industrial widgets to the academic performance of American schoolchildren.
Today, about 30% of the company's revenue comes from products that didn't
exist five years ago, almost all of them Internet-based. Sir Crispin wants
Internet operations to account for as much as 70% of revenue within five
years.

For investors in Reed, whose core business has long been publishing
thousands of scientific and business journals, this strategy means Reed is
becoming increasingly exposed to the risk of security breaches, technology
failures and regulatory intervention. It is telling that Reed hasn't
launched a data-brokering business in Europe, where the regulations
governing such activities are much tougher than in the U.S.

"It's a bit more risky," says Micha Zwaaf, an analyst with ABN Asset
Management in Amsterdam. Mr. Zwaaf, who recommends that ABN's funds buy
Reed stock, adds, "Those scientific journals have been around for 200
years, so the risk of something happening there is much smaller, but there
is no growth."

Mr. Zwaaf says he expects the investigation by U.S. law-enforcement
agencies to implicate weak security at some of Reed's customers rather than
problems at the company itself. At the same time, he argues that any move
by regulators to tighten restrictions on the sale of personal data would
give the industry more credibility and could actually be a boon to Reed.

Indeed, members of Congress are calling for laws mandating new security
measures in the wake of the LexisNexis thefts, as well as other recent
online security gaffes. Still, Chuck Richard, a New York-based analyst with
research firm Outsell Inc., says the people affected by these security
breaches aren't likely to have enough political clout to impose tough new
restrictions on Reed and others. "Controversial? Yes. Likely to be severely
curtailed? No," he says. Neither Outsell nor Mr. Richard owns Reed stock.
Mr. Richard doesn't rate the stock.

Investors' willingness to stick by the company will depend to a large
degree on their trust in Sir Crispin, a former Procter & Gamble Co.
executive who had no online experience before joining Reed. But in his six
years at the helm, he has transformed the company from an old-fashioned
publisher of magazines, such as the Lancet medical journal, into an
Internet powerhouse.

Nick Baker, Reed's chief strategy officer, acknowledges that Reed's
exp

Re: [Clips] Storm Brews Over Encryption 'Safe Harbor' in Data Breach Bills

[Thierry Moreau]

Posted on cryptography@metzdowd.com:




EWeek


Storm Brews Over Encryption 'Safe Harbor' in Data Breach Bills
May 31, 2005
 By   Caron Carlson

Spurred by the ongoing flood of sensitive data breaches this spring, nearly
a dozen states may have breach notification laws on their books by summer.
In turn, makers of security software and companies in several other
industries are pressuring Capitol Hill for a federal law pre-empting the
states' measures.

In Congress, more than a half-dozen bills requiring a range of data
security measures and breach notification rules are pending, and at least
two more are slated for introduction in coming months.



Here is a suggestion for an encrypted data exception based on reasonable 
key management principles:




Sec xyz) The [breach notification requirement set forth in section ...] 
does not apply to [breached data portions] for which the following 
conditions are demonstrably met:


a) the [breached data portion] is in an encrypted form using an 
encryption algorithm and an encryption key that can be shown to be 
[resistant / comptatible or equivalent to NIST recommended practice for 
encrypting classified data],


b) the said encryption key has always been under the sole control of the 
[data originator],


c) the [data originator] is in a position to retire every copy of the 
said encryption key from operations, and


d) the [data originator] takes all resaonable steps to so retire every 
copy of the said encryption key from operations as soon as the [data 
breach event] is known to [the data originator], and completes such 
retirement within [a delay e.g. the same delay as for notification].


The evidence that conditions a) to d) are met shall be [kept for auditor 
review / filed with an incident report otherwise mandated]




Is that actually a reasonable key management principle?

Is it possible the the US law-makers adopt such sensible approaches?

--

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [EMAIL PROTECTED]


-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]