Re: ID Rules Exist, But Can't Be Seen

2004-10-01 Thread J.A. Terranson

On Thu, 30 Sep 2004, Tyler Durden wrote:

 If this is the case, then this reveals what I would argue to be a dangerous
 mindset: The government needs to protect the people from themselves...ie,
 from the normal operation of democracy.

 On Cyperhpunks I would suppose this does not seem suprising.

ObObviousUnderstatement: 1 ObDurden: 0

 But it perhaps reveals that there is explicit, conscious thought occurring
 along these lines in the government. THAT, perhaps, is new.

Not.

ObObviousUnderstatement: 2 ObDurden: 0

 -TD

-- 
Yours,

J.A. Terranson
[EMAIL PROTECTED]
0xBD4A95BF

  ...justice is a duty towards those whom you love and those whom you do
  not.  And people's rights will not be harmed if the opponent speaks out
  about them.  Osama Bin Laden
- - -

  There aught to be limits to freedom!George Bush
- - -

Which one scares you more?



Re: ID Rules Exist, But Can't Be Seen

2004-10-01 Thread John Kelsey
From: Tyler Durden [EMAIL PROTECTED]
Sent: Sep 30, 2004 5:06 PM
To: [EMAIL PROTECTED]
Subject: ID Rules Exist, But Can't Be Seen

..
For instance, is it indeed possible that revealing this rule would pose an 
additional security risk? If such a rule exists (and it does) then hijackers 
obviously already know about it. Could this rule also reveal some deeper 
secrets about how hijackers can be detected? I seriously doubt it.

One possibility raised by Dan Simon (I think) on Eric Rescorla's excellent blog is 
that the rule is part of some monthly briefing that is sent out, which might include 
some kind of information they'd rather not have published, e.g., be especially 
careful about anyone carrying a guitar case; we've heard rumors about using one to 
bring a Tommy gun onboard.  

Then of course, the argument may be that the government wanted to hide the 
rule for the very reason of making it more unassailable. In other words, if 
the rule were known, then it might be more easily contested in court. Hiding 
the rule protects the law which in turn protects national security.

Maybe.  I guess the thing that's confusing about any of these answers is that the 
rules as they're applied must be propogated to thousands of people.  It's not like 
they could easily hide guidance like no more than 10 Arabs per flight or 
double-screen anyone with brown skin and a Koran--someone would leak it.  Perhaps 
the written rules include things like this that they don't want to subject to court 
scrutiny, but then how do they get that down to the people doing the screening at the 
gate?  

The whole idea of laws that the citizens aren't allowed to see just sounds like 
something you'd expect in some godawful third-world dictatorship, not in the US.  

-TD

--John Kelsey



Re: ID Rules Exist, But Can't Be Seen

2004-10-01 Thread Tyler Durden
John Kelsey wrote...
Maybe.  I guess the thing that's confusing about any of these answers is 
that the rules as they're applied must be propogated to thousands of 
people.  It's not like they could easily hide guidance like no more than 
10 Arabs per flight or double-screen anyone with brown skin and a 
Koran--someone would leak it.  Perhaps the written rules include things 
like this that they don't want to subject to court scrutiny, but then how 
do they get that down to the people doing the screening at the gate?
That's a good point. And those screeners ain't exactly the cream of the 
crop, if ya' know what I mean. A year ago they were making minimum wage, so 
if someone wanted a copy of those guidelines, it'd be easy as hell to con it 
out of one of em. (INVOKE SPIRIT OF TIM MAY HERE)...dress all official-like 
with a clipboard and some random badge, and start quizzing the locals about 
the current rules. Maybe that wouldn't work at JFK, but go to the airport 
at, say, Lexington So Carolina or Bumfuck Idaho and you'd get the 
information faster than a hillbilly can skin a possum for dinner.

So no way they could keep such a big secret, and I would suspect that the 
Brazil-factor is not so great that the TSA doesn't already know that.

I think you may be onto something w.r.t the Profiling issue. That may have 
more to do with it than anything. In other words, they don't want the thing 
contested in court, and the powers that be may not want to be personally 
liable.

So in other words, this law is basically secret so that it can be secret. If 
nothing else, the Iraq WMD debacle should teach that they really don't have 
some deep, secret and justifiable information.

-TD
_
Is your PC infected? Get a FREE online computer virus scan from McAfee® 
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963



Re: ID Rules Exist, But Can't Be Seen

2004-10-01 Thread Major Variola (ret)
At 05:06 PM 9/30/04 -0400, Tyler Durden wrote:
I post this not as a refernce per se, but to ask the question:

Exactly Why Does the Government Not Want to Reveal Their ID Rules?

For instance, is it indeed possible that revealing this rule would pose
an
additional security risk? If such a rule exists (and it does) then
hijackers
obviously already know about it.

Not only that, but as Bruce S pointed out, they can reverse-engineer
the rules by sending probes.





Re: ID Rules Exist, But Can't Be Seen

2004-10-01 Thread Steve Furlong
Talking out his ass, Tyler Durden wrote:

 That's a good point. And those screeners ain't exactly the cream of the 
 crop, if ya' know what I mean. A year ago they were making minimum wage, so 
 if someone wanted a copy of those guidelines, it'd be easy as hell to con it 
 out of one of em. (INVOKE SPIRIT OF TIM MAY HERE)...dress all official-like 
 with a clipboard and some random badge, and start quizzing the locals about 
 the current rules. Maybe that wouldn't work at JFK, but go to the airport 
 at, say, Lexington So Carolina or Bumfuck Idaho and you'd get the 
 information faster than a hillbilly can skin a possum for dinner.

Have you ever done penetration testing? It would be harder at a small
airport because the people all know each other. It's the larger
organizations in which you're able to cloak yourself in anonymity.

You are correct, however, in your characterization of the screeners.
Sheesh, what a bunch of mouth-breathing imbeciles and petty thieves. I
haven't flown since 2001, but I bring people to NYC airports frequently,
and am always impressed with TSA's level of professionalism. Not
favorably impressed, mind you, but impressed.





Re: Federal program to monitor everyone on the road

2004-10-01 Thread Hal Finney
There was a brief mention of this technology at the Crypto conference.
I provided some pointers in a comment to an Ed Felten blog entry at
http://www.freedom-to-tinker.com/archives/000677.html#comments (scroll
down to the 3rd comment).

Dan Boneh et al presented a proposal for a group signature scheme so that
the data collected would not be personally identifiable.  The problem is
that the data needs to be authenticated, otherwise rogue transmitters
could send false data and perhaps cause traffic flow problems or even
serious accidents.  So they want to use some cryptographic method.
Putting a common key in the whole system would make it too easy for
rogues to get access to, would be unrevocable, and we are back to the
rogue transmitter problem.  Using individual certified keys is the
default solution but has privacy problems: everyone would be constantly
transmitting a cryptographically verifiable record of their driving
patterns, speed, lane changing and who knows what else.

With the group signature, everybody has a unique key but their
transmissions are not bound to that key.  And if a key gets scraped
out and goes rogue, it can be revoked.  This is supposed to provide
flexibility, authentication, and privacy.

In practice I am skeptical that society will choose to protect privacy at
the expense of security.  One optional feature of group signatures is a
trusted party who can penetrate the anonymity and learn the identity of
the author of a particular message.  I suspect that any vehicle based
embedded communications system will retain that capability, a sort of
license plate in the virtual realm.  The ability to track the paths of
bank robbers and terrorists would be too inviting for society to give up,
especially if the data is only available to government agents.

Hal



Federal program to monitor everyone on the road

2004-10-01 Thread Sunder
http://www.boingboing.net/2004/10/01/federal_program_to_m.html

 Federal program to monitor everyone on the road

Interesting article about the Fed's plans to develop an all-knowing 
intelligent highway system.

Most people have probably never heard of the agency, called the 
Intelligent Transportation Systems Joint Program Office. And they haven't 
heard of its plans to add another dimension to our national road system, 
one that uses tracking and sensor technology to erase the lines between 
cars, the road and the government transportation management centers from 
which every aspect of transportation will be observed and managed.

For 13 years, a powerful group of car manufacturers, technology 
companies and government interests has fought to bring this system to 
life. They envision a future in which massive databases will track the 
comings and goings of everyone who travels by car or mass transit. The 
only way for people to evade the national transportation tracking system 
they're creating will be to travel on foot. Drive your car, and your every 
movement could be recorded and archived. The federal government will know 
the exact route you drove to work, how many times you braked along the 
way, the precise moment you arrived -- and that every other Tuesday you 
opt to ride the bus.


Link to actual story: http://charlotte.creativeloafing.com/news_cover.html

--Kaos-Keraunos-Kybernetos---
 + ^ + :Our enemies are innovative and resourceful, and so are we.  /|\
  \|/  :They never stop thinking about new ways to harm our country /\|/\
--*--:and our people, and neither do we. -G. W. Bush, 2004.08.05 \/|\/
  /|\  : \|/
 + v + :War is Peace, freedom is slavery, Bush is President.
-



RE: QC Hype Watch: Quantum cryptography gets practical

2004-10-01 Thread Tyler Durden
What's a quantum repeater in this context?
As for Hype Watch, I tend to agree, but I also believe that Gelfond (who I 
spoke to last year) actually does have a 'viable' system. Commerically 
viable is another thing entirely, however.

-TD

From: R. A. Hettinga [EMAIL PROTECTED]
To: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: QC Hype Watch: Quantum cryptography gets practical
Date: Thu, 30 Sep 2004 17:39:24 -0400
http://www.computerworld.com/printthis/2004/0,4814,96111,00.html
 - Computerworld
 Quantum cryptography gets practical
 Opinion by Bob Gelfond, MagiQ Technologies Inc.


  SEPTEMBER 30, 2004  (COMPUTERWORLD)  -  In theory and in labs, quantum
cryptography -- cryptography based on the laws of physics rather than
traditional, computational difficulty -- has been around for years.
Advancements in science and in the world's telecommunications
infrastructure, however, have led to the commercialization of this
technology and its practical application in industries where high-value
assets must be secure.
 Protecting information today usually involves the use of a cryptographic
protocol where sensitive information is encrypted into a form that would be
unreadable by anyone without a key. For this system to work effectively,
the key must be absolutely random and kept secret from everyone except the
communicating parties. It must also be refreshed regularly to keep the
communications channel safe. The challenge resides in the techniques used
for the encryption and distribution of this key to its intended parties to
avoid any interception of the key or any eavesdropping by a third party.
 Many organizations are advancing quantum technology and bringing it
outside academia. Research labs, private companies, international alliances
such as the European Union and agencies such as the Defense Advanced
Research Projects Agency are investing tens of millions of dollars in
quantum research, with projects specifically focused on the challenge of
key distribution.
 The trouble with key distribution
Huge investment in the late 1990s through 2001 created a vast
telecommunications infrastructure resulting in millions of miles of optical
fiber laid across the country and throughout buildings to enable high-speed
communications. This revolution combined a heavy reliance on fiber-optic
infrastructure with the use of open network protocols such as Ethernet and
IP to help systems communicate.
 Although this investment delivers increased productivity, dependence on
optical fiber compounds key distribution challenges because of the relative
ease with which optical taps can be used. With thousands of photons
representing each bit of data traveling over fiber, nonintrusive, low-cost
optical taps placed anywhere along the fiber can siphon off enough data
without degrading the signal to cause a security breach. The threat profile
is particularly high where clusters of telecommunications gear are found in
closets, the basements of parking garages or central offices. Data can be
tapped through monitoring jacks on this equipment with inexpensive handheld
devices. This enables data to be compromised without eavesdroppers
disclosing themselves to the communicating parties.
 Another important aspect of this problem is the refresh rate of the keys.
Taking large systems off-line to refresh keys can cause considerable
headaches, such as halting business operations and creating other security
threats. Therefore, many traditional key-distribution systems refresh keys
less than once per year. Infrequent key refreshing is detrimental to the
security of a system because it makes brute-force attacks much easier and
can thereby provide an eavesdropper with full access to encrypted
information until the compromised key is refreshed.
 Adding quantum physics to the key distribution equation
Companies are now in a position to use advancements in quantum
cryptography, such as quantum key distribution (QKD) systems, to secure
their most valued information. Two factors have made this possible: the
vast stretches of optical fiber (lit and dark) laid in metropolitan areas,
and the decreasing cost in recent years of components necessary for
producing QKD systems as a result of the over-investment in
telecommunications during the early 2000s.
 Based on the laws of quantum mechanics, the keys generated and
disseminated using QKD systems have proved to be absolutely random and
secure. Keys are encoded on a photon-by-photon basis, and quantum mechanics
guarantees that the act of an eavesdropper intercepting a photon will
irretrievably change the information encoded on that photon. Therefore, the
eavesdropper can't copy or read the photon -- or the information encoded on
it -- without modifying it, which makes it possible to detect the security
breach. In addition to mitigating the threat of optical taps, QKD systems
are able to refresh keys at a rate of up to 10 times per second, further
increasing the level of security of the encrypted data.
 Not for 

Call for Papers: ShmooCon. 2005. No moose. We swear.

2004-10-01 Thread R. A. Hettinga
http://www.shmoocon.org/cfp.html

 Washington, D.C.

 Call for Papers [PDF]

 http://www.shmoocon.org

 The Shmoo Group is soliciting papers and presentations for the first
annual ShmooCon. ShmooCon 2005 will be a highly-technical and entertaining
East coast hacker convention focused on technology exploitation, inventive
software and hardware solutions, as well as open discussion on a variety of
technology and security topics. ShmooCon 2005 will be held on February 4-6,
2005 at the Wardman Park Marriott in Washington, D.C., just minutes from
your choice of 3-letter agencies.

 ShmooCon 2005 will have three tracks, each dedicated to the following:
 Break It! - Technology Exploitation
 Build It! - Inventive Software and Hardware Solutions
 BoF It! - Open Discussion of Technology and Security Topics

 Topics for the Break It! track may include, but are not limited to,
EXPLOITATION of:
 - Consumer electronic devices
 - Application, host, and network security
 - Telephony
 - Physical security

 Topics for the Build It! track may include, but are not limited to,
inventive software and hardware SOLUTIONS in:
 - Robotics
 - Distributed computing
 - Community wireless networking
 - Mobile personal computing

 Topics for the BoF It! track may include, but are not limited to, open
DISCUSSION of the following:
 - Privacy and anonymity
 - Exploit and vulnerability disclosure / databases
 - DRM (Digital Rights Management), fair use, copyright infringement
 - Open source software world domination strategies

 Presentation Format
 All presentations and discussions will be 55 minutes in length.
Presentations in the Break It! and Build It! tracks must include
demonstrations of personally developed techniques, working code, and/or
devices, with code and/or schematics being open-source and released to the
public for free. Initiating an open discussion for BoF It! requires
subject matter expertise, active involvement with the topic at hand, and a
brief presentation of the topic/problem scope.

 Shmooballs will be issued to the audience, to facilitate a frank and open
discussion of opinions. Speakers are encouraged to present innovative ideas
that not everyone agrees with.

 Submission Procedure
 To submit, email [EMAIL PROTECTED] with the following information:
 1. Speaker name(s) and/or handle(s)
 2. Presentation Title
 3. Track preference
 4. Two to three paragraph presentation description and/or outline
 5. List facilities required. Projector for use with VGA input, flipchart,
sound projection, Internet connectivity will be provided.
 6. Speaker bio
 7. Contact info for speaker (email AND mobile number, please)

 Accepted speakers will receive free admission to the conference, as well
as a $100 honorarium after evaluation of their completed presentation. 6
runner-ups will receive free admission as hot-alternates. They should come
to ShmooCon 2005 prepared to speak, and, if it becomes necessary for them
to speak as an alternate, they too will receive a $100 honorarium after
evaluation of their completed presentation. NOTE: select presentation
submissions which are not accepted will be awarded a 50% discounted
admission to ShmooCon 2005. Presentations must be designed to include
source code, schematics, or other substantial details that demonstrate the
topic being discussed.

 Presentation proposals will be reviewed by members of the Shmoo Group. A
list of the reviewers will be posted on the ShmooCon 2005 web site when the
Call For Papers is formally issued.

 If you feel you have a presentation that would be appropriate but that
does not meet these guidelines, feel free to submit it anyway but be sure
to include a cover letter explaining your reasoning so we can evaluate your
proposal.

 All questions regarding this call for papers should be addressed to
[EMAIL PROTECTED]

 Schedule
 Check the web site for final dates
 July 30, 2004 CFP opens
 Early Fall 2004 papers for preferential first round consideration due
 Middle Fall 2004 final due date for all papers
 Late Fall 2004 speakers notified

 Submissions are due by late fall 2004. Preference will be given to
submissions received by early fall 2004. Selected speakers will be notified
by Halloween, 2004. We look forward to receiving your submissions as well
as seeing you at ShmooCon 2005!

 ShmooCON 2005 CFP 1.0 RC6


news


about


registration


cfp


program


schedule


location


sponsors


links






contact us . privacy policy
 ©2004, The Shmoo Group




-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'



CFP: Privacy Enhancing Technologies (PET 2005)

2004-10-01 Thread R. A. Hettinga

--- begin forwarded text


Delivered-To: [EMAIL PROTECTED]
To: sec-lists: ;
Cc: [EMAIL PROTECTED]
Subject: CFP: Privacy Enhancing Technologies (PET 2005)
From: George Danezis [EMAIL PROTECTED]
Sender: [EMAIL PROTECTED]
List-Id: Open NymIP-RG discussion list nymip-rg-interest.nymip.org
List-Post: mailto:[EMAIL PROTECTED]
List-Help: mailto:[EMAIL PROTECTED]
List-Subscribe: http://www.nymip.org/mailman/listinfo/nymip-rg-interest,
mailto:[EMAIL PROTECTED]
List-Archive: http://www.nymip.org/pipermail/nymip-rg-interest/
Date: Mon, 27 Sep 2004 13:11:22 +0100

5th Workshop on Privacy Enhancing Technologies
Dubrovnik, CroatiaMay 30 - June 1, 2005

C A L L   F O R   P A P E R S

http://petworkshop.org/2005/

Important Dates:
Paper submission: February 7, 2005
Notification of acceptance: April 4, 2005
Camera-ready copy for preproceedings: May 6, 2005
Camera-ready copy for proceedings: July 1, 2005

Award for Outstanding Research in Privacy Enhancing Technologies
Nomination period: March 4, 2004 through March 7, 2005
Nomination instructions: http://petworkshop.org/award/

---

Privacy and anonymity are increasingly important in the online world.
Corporations, governments, and other organizations are realizing and
exploiting their power to track users and their behavior, and restrict
the ability to publish or retrieve documents. Approaches to
protecting individuals, groups, but also companies and governments
from such profiling and censorship include decentralization,
encryption, distributed trust, and automated policy disclosure.

This 5th workshop addresses the design and realization of such privacy
and anti-censorship services for the Internet and other communication
networks by bringing together anonymity and privacy experts from
around the world to discuss recent advances and new perspectives.

The workshop seeks submissions from academia and industry presenting
novel research on all theoretical and practical aspects of privacy
technologies, as well as experimental studies of fielded systems.  We
encourage submissions from other communities such as law and business
that present their perspectives on technological issues.  As in past
years, we will publish proceedings after the workshop in the Springer
Lecture Notes in Computer Science series.

Suggested topics include but are not restricted to:

* Anonymous communications and publishing systems
* Censorship resistance
* Pseudonyms, identity management, linkability, and reputation
* Data protection technologies
* Location privacy
* Policy, law, and human rights relating to privacy
* Privacy and anonymity in peer-to-peer architectures
* Economics of privacy
* Fielded systems and techniques for enhancing privacy in existing systems
* Protocols that preserve anonymity/privacy
* Privacy-enhanced access control or authentication/certification
* Anonymous credentials
* Election schemes
* Privacy threat models
* Models for anonymity and unobservability
* Attacks on anonymity systems
* Traffic analysis
* Profiling and data mining
* Privacy vulnerabilities and their impact on phishing and identity theft
* Deployment models for privacy infrastructures
* Novel relations of payment mechanisms and anonymity
* Usability issues and user interfaces for PETs
* Reliability, robustness and abuse prevention in privacy systems

Stipends to attend the workshop will be made available, on the basis
of need, to cover travel expenses, hotel, or conference fees.  You do
not need to submit a technical paper and you do not need to be a
student to apply for a stipend.  For more information, see
http://petworkshop.org/2005/stipends.html

General Chair:
Damir Gojmerac ([EMAIL PROTECTED]), Fina Corporation, Croatia

Program Chairs:
George Danezis ([EMAIL PROTECTED]), University of Cambridge, UK
David Martin ([EMAIL PROTECTED]), University of Massachusetts at Lowell, USA

Program Committee:

Martin Abadi, University of California at Santa Cruz, USA
Alessandro Acquisti, Heinz School, Carnegie Mellon University, USA
Caspar Bowden, Microsoft EMEA, UK
Jean Camp, Indiana University at Bloomington, USA
Richard Clayton, University of Cambridge, UK
Lorrie Cranor, School of Computer Science, Carnegie Mellon University, USA
Roger Dingledine, The Free Haven Project, USA
Hannes Federrath, University of Regensburg, Germany
Ian Goldberg, Zero Knowledge Systems, Canada
Philippe Golle, Palo Alto Research Center, USA
Marit Hansen, Independent Centre for Privacy Protection Schleswig-Holstein,
  Germany
Markus Jakobsson, Indiana University at Bloomington, USA
Dogan Kesdogan, Rheinisch-Westfaelische Technische Hochschule Aachen, Germany
Brian Levine, University of Massachusetts at Amherst, USA
Andreas Pfitzmann, Dresden University of Technology, Germany
Matthias Schunter, IBM Zurich Research Lab, Switzerland
Andrei Serjantov, University of Cambridge, England
Paul Syverson, Naval Research Lab, USA
Latanya Sweeney, Carnegie Mellon 

Patriot Act Misinformation

2004-10-01 Thread R. A. Hettinga
http://online.wsj.com/article_print/0,,SB109659214177033379,00.html

The Wall Street Journal


 October 1, 2004

 REVIEW  OUTLOOK


Patriot Act Misinformation
October 1, 2004; Page A14

The American Civil Liberties Union has been spinning its victory in a
federal court in New York this week as a blow against the USA Patriot Act.
One typical headline: Federal Judge Calls Patriot Act Secret Searches
Unconstitutional. An ACLU press release hails the decision as a landmark
victory against the Ashcroft Justice Department.

Well, no. If reporters had bothered to read Judge Victor Marrero's
decision, they would have learned that the law he actually struck down was
a provision of the Electronic Communications Privacy Act of 1986. Section
2709 authorizes the FBI to issue National Security Letters to obtain
information from wire communications companies about their subscribers.
NSLs are issued secretly and the recipient is prohibited from notifying
anyone about the request.

As Judge Marrero noted in his ruling, Section 2790 has been available to
the FBI since 1986. He concludes that there must have been hundreds of
NSLs issued since that time. The Patriot Act did amend Section 2790, but
that amendment has nothing to do with the part that Judge Marrero says is
unconstitutional.

One more thing: The Electronics Communications Act was not the invention of
John Ashcroft. It was sponsored by that famous and menacing right-winger,
Vermont Senator Patrick Leahy, who said at the time that Section 2790
provides a clear procedure for access to telephone toll records in
counterintelligence investigations.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'



'Frustrated' U.S. Cybersecurity Chief Abruptly Resigns

2004-10-01 Thread R. A. Hettinga
http://www.local6.com/print/3776699/detail.html?use=print

local6.com

'Frustrated' U.S. Cybersecurity Chief Abruptly Resigns

POSTED: 11:32 AM EDT October 1, 2004
WASHINGTON -- The government's cybersecurity chief has abruptly resigned
after one year with the Department of Homeland Security, confiding to
industry colleagues his frustration over what he considers a lack of
attention paid to computer security issues within the agency.

 Amit Yoran, a former software executive from Symantec Corp., informed the
White House about his plans to quit as director of the National Cyber
Security Division and made his resignation effective at the end of
Thursday, effectively giving a single's day notice of his intentions to
leave.

 Yoran said Friday he felt the timing was right to pursue other
opportunities. It was unclear immediately who might succeed him even
temporarily. Yoran's deputy is Donald Andy Purdy, a former senior adviser
to the White House on cybersecurity issues.

 Yoran has privately described frustrations in recent months to colleagues
in the technology industry, according to lobbyists who recounted these
conversations on condition they not be identified because the talks were
personal.

 As cybersecurity chief, Yoran and his division - with an $80 million
budget and 60 employees - were responsible for carrying out dozens of
recommendations in the Bush administration's National Strategy to Secure
Cyberspace, a set of proposals to better protect computer networks.

 Yoran's position as a director -- at least three steps beneath Homeland
Security Secretary Tom Ridge -- has irritated the technology industry and
even some lawmakers. They have pressed unsuccessfully in recent months to
elevate Yoran's role to that of an assistant secretary, which could mean
broader authority and more money for cybersecurity issues.

 Amit's decision to step down is unfortunate and certainly will set back
efforts until more leadership is demonstrated by the Department of Homeland
Security to solve this problem, said Paul Kurtz, a former cybersecurity
official on the White House National Security Council and now head of the
Washington-based Cyber Security Industry Alliance, a trade group.

 Under Yoran, Homeland Security established an ambitious new cyber alert
system, which sends urgent e-mails to subscribers about major virus
outbreaks and other Internet attacks as they occur, along with detailed
instructions to help computer users protect themselves.

 It also mapped the government's universe of connected electronic devices,
the first step toward scanning them systematically for weaknesses that
could be exploited by hackers or foreign governments. And it began
routinely identifying U.S. computers and networks that were victims of
break-ins.

 Yoran effectively replaced a position once held by Richard Clarke, a
special adviser to President Bush, and Howard Schmidt, who succeeded Clarke
but left government during the formation of the Department of Homeland
Security to work as chief security officer at eBay Inc.

 Yoran cofounded Riptech Inc. of Alexandria, Va., in March 1998, which
monitored government and corporate computers around the world with an
elaborate sensor network to protect against attacks. He sold the firm in
July 2002 to Symantec for $145 million and stayed on as vice president for
managed security services.

-- 
-
R. A. Hettinga mailto: [EMAIL PROTECTED]
The Internet Bearer Underwriting Corporation http://www.ibuc.com/
44 Farquhar Street, Boston, MA 02131 USA
... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience. -- Edward Gibbon, 'Decline and Fall of the Roman Empire'