Last month the Pirate Party Australia, along with hundreds of other organisations and individuals, made a submission to the Joint Parliamentary Committee’s Inquiry into potential reforms of National Security Legislation. I co-authored the Pirate Party Australia submission and wrote around half of it.
When the submissions were published there was one in particular which caught my attention. That being this submission by Andrew Brunatti and Neveen Abdalla of Brunel University in London. Mr. Brunatti is a doctoral candidate at the Brunel Centre for Intelligence and Security Srudies, while Mr. Abdalla is a masters candidate.
The Brunel submission was interesting because, in addition to offering support to the proposals in the Inquiry’s discussion paper, they proposed Australia introduce a system they termed a National Digital Identity Regime (NDIR). Essentially this amounted to a national ID program for all online activity by everyone in Australia and possibly elsewhere, by assigning a number or code to every Internet user.
Their proposal was based on a number of assumptions regarding the situation in Australia, incorrect information regarding existing regulations and falsified or obscured data. My concern with their proposal stemmed from the possibility of the government or law enforcement in Australia attempting to adopt their proposal, in spite of the significant flaws in both the NDIR proposal and the research backing it.
I decided to email Mr. Brunatti and copied the email to his PhD supervisors at Brunel with my concerns and criticism. Mr. Brunatti’s response was brief and answered none of my questions, concerns or criticisms. Nor did he defend himself or his co-author (I was unable to find an email address for Mr. Abdalla). As a consequence, I am standing by and stating publicly in regards to Mr. Brunatti, Mr. Abdalla and the Brunel Centre for Intelligence and Security the following criticism:
The lack of proper research and selective presentation of just those facts which support the implementation of your National Digital Identity Regime is, at best, both incompetent and disingenuous. Your evidence, such as it is, appears to utilise deliberate fallacies and obfuscation of opposing data; in order to promote an authoritarian scheme designed to eviscerate basic civil liberties.
Below I am including copies of the full correspondence with Mr. Brunatti, including links to the original email files. My emails are digitally signed with my GPG key using PGP/MIME for additional verification. Mr. Brunatti’s sole email is base64 encoded and needs to be viewed in an email client to be read.
My emails include thorough details of my criticisms and specific flaws in the Brunel submission. This includes, but is not limited to: the assumption that so-called “burner phones” are available in Australia as they are in the United States or United Kingdom (prepaid SIMs in Australia must be linked to a driver’s license or Medicare number); their addressing privacy risks with not implementing their NDIR, but do not address the privacy risks with doing so; completely ignoring previous failed attempt to implement national identity schemes in Australia (e.g. the Australia Card and the Access Card); their failure to address issues of identity theft using the NDIR and numerous unanswered questions regarding their motives for making their submission.
My initial email (original email here):
From: Ben McGinnes
Subject: Brunel submission to Australia’s National Security Inquiry
Date: Date: Sat, 25 Aug 2012 19:24:07 +1000
To: Andrew Brunatti
CC: Philip Davies, Kristian Gustafson (Staff)Hello,
I’ve been reading your submission to Australia’s Joint
Parliamentary Committee on Intelligence and Security’s Inquiry into
potential reforms of National Security Legislation. I should state
that I would have also sent this to your co-author, Neveen Abdalla,
but I have been unable to find an email address for him.Your submission is interesting and I have a few issues with it that I
wanted to raise. I will start with the factual errors and ommissions,
and then move on to other matters.1) On page 6 you cite Operation PENDENNIS as a “significant terrorist
plot” in spite of the fact that the Benbrika cell was almost
completely useless, had not selected a target beyond some initial
ideas and had no means by which to carry out an attack. There was a
significant amount of law enforcement resources deployed in catching
and charging them, though.2) On page 6 you refer to people being able to “pay cash for a
no-check ‘pay-as-you-go’ mobile phone” which are commonly referred to
as burner phones. These exist in the United States and may exist in
the UK, but do not exist in Australia. To activate a pre-paid SIM in
Australia requires a valid Medicare number or driver’s license number.3) On page 10 you cite risks to citizens’ privacy as a result of not
implementing a National Digital Identity Regime, but you fail to
mention any of the risks caused by such a scheme (see points 4 to 8).4) On pages 10 to 14 you describe your proposed National Digital
Identity system, drawing parallels to existing systems (e.g. Medicare
numbers and Tax File Numbers) by assigning a number to every person in
Australia. You ignore the fact that both the Medicare and Tax systems
are limited to a very limited subset of individual interaction with
government departments and some businesses, whereas this would apply
to everything done online. You also completely fail to mention
previous similar proposals, such as the Australia Card proposed in
1985 and the Access Card proposed in 2007. Both the Australia Card
and the Access Card were rejected by Australians.5) You have failed to address any issues pertaining to the value of
anonymity and/or pseudonymity in a democratic society. Both anonymity
and pseudonymity, while possessing some potential for abuse, also
provide essential safeguards to privacy and the democratic process by
enabling whistleblowing or protecting the identity who may be afraid
to comment publicly under their so-called “real” identity (e.g. rape
victims, domestic violence victims, stalking victims, etc.) as the
result of a geuine fear of some form of reprisal. Nor does it address
the fact that there is currently no requirement in Australia for
people to always identify themselves by the name that appears on their
birth certificate, citizenship papers or passport.6) Your National Digital Identity Regime requires mandatory
identification of all individuals to law enforcement, which is not
something that is currently required.7) Your National Digital Identity Regime appears designed to be
utilised with all online services and communication, yet it contains
no detail as to how the system would be designed to prevent identity
theft if just one such online service were compromised by criminals.8) Your National Digital Identity Regime does not address the problems
stemming from other unlawful or unauthorised access to it. In
particular abuse of power by law enforcement personnel, including
corrupt members of law enforcement. Nor have you addressed the risk
to lives by corrupt personnel accessing National Digital Identity
systems (ref. the murder of Terence and Christine Hodson following the
leaking of their Victoria Police LEAP records to criminals during
Melbourne’s gangland war).The lack of proper research and selective presentation of just those
facts which support the implementation of your National Digital
Identity Regime is, at best, both incompetent and disingenuous. Your
evidence, such as it is, appears to utilise deliberate fallacies and
obfuscation of opposing data; in order to promote an authoritarian
scheme designed to eviscerate basic civil liberties.You appear to be trading off the reputation of Brunel University in an
attempt to foist a scheme which would reduce the privacy of a everyone
in a society in which you do not live and would not be directly
affected by the adverse repercussions of.Your submission and proposed National Digital Identity Regime raises
more questions than it appears to answer:* Why did Brunel University decide to make a submission to a national
security inquiry when no one involved in the submission is
Australian or lives in Australia?* Is the National Digital Identity Regime being recommended to
Australia because Australia lacks the treaty obligations that
European Union member states have protecting human rights (e.g. the
European Convention on Human Rights)?* Do you hope that a National Digital Identity Regime being applied in
Australia would serve as a basis to implement a similar system in
other countries, such as the UK and EU member states?* Would you actually want to live in a country with a mandatory
National Digital Identity Regime or are you only interested
inflicting this on others?* How do you respond to criticisms of your submission as being a
paternalistic attitude towards a former colony?The National Digital Identity Regime would facilitate a significant
level of surveillance of everyone in Australia, especially in
conjunction with the decryption on demand (C15a) and data retention
(C15c) proposals of the original inquiry discussion paper. This
proposal would be a severe blow to human and civil rights in
Australia, which are already lacking the kind of constitutional and
legislative safeguards available to many other countries around the
world and all other western liberal democracies.As you’ve probably guessed by now, not only do I oppose a large number
of the proposals in the discussion paper (see below for more detail),
I also oppose your National Digital Identity Regime. I find it
particularly offensive that you seek to advance this scheme in a
country where you won’t have to deal with the consequences yourself.
We’re not exported convicts anymore, you can’t simply use Australia as
a laboratory for testing your authoritarian theories.Note: I co-authored the Pirate Party Australia submission to the
PJCIS inquiry (submission no. 134) and wrote a submission for the
Access Card Inquiry in 2007 (submission no. 16).Those submissions are available here:
http://www.aph.gov.au/binaries/senate/committee/fapa_ctte/completed_inquiries/2004-07/access_card/submissions/sub16.pdf
http://www.aph.gov.au/Parliamentary_Business/Committees/House_of_Representatives_Committees?url=pjcis/nsl2012/subs/sub134.pdf
Regards,
Ben–
Ben McGinnes http://www.adversary.org/ Twitter: benmcginnes
Systems Administrator, Writer, Trainer, ICT Consultant
Encrypted email preferred – primary OpenPGP/GPG key: 0x73590E5Dhttp://pgp.mit.edu:11371/pks/lookup?op=get&search=0x321E4E2373590E5D
OpenPGP/GPG key transition: http://www.adversary.org/keyswitch.txt.asc
You might think that an email like that would produce a somewhat concerned response in a serious academic, but all I received was this (original email here):
From: Andrew Brunatti
Subject: RE: Brunel submission to Australia’s National Security Inquiry
Date: Sun, 26 Aug 2012 19:37:00 +0100
To: Ben McGinnes
CC: Philip Davies, Kristian Gustafson (Staff)Dear Mr. McGinnes,
Thanks very much for your email commenting on our submission to the PJCIS. You raise some points that my co-author and I find very valuable and we look forward to integrating your critiques into any future work.
I’ve read your own submission with interest and have found it most engaging. I’m glad to see other informed and engaged voices weighing in on the lawful access debate, which I think we would both agree is one of fundamental importance.
I look forward, as I’m sure you do, to the Committee’s deliberations and final report, and hope that a balance can be struck which addresses both privacy and security concerns.
Best regards,
Andrew
_______________
Andrew Brunatti
PhD Candidate (Politics & History)
Brunel Centre for Intelligence and Security Studies (BCISS)
Brunel University, Uxbridge
UB8 3PH, UKAcademic Email: [email protected]
“Most ambassadors do not worry that the wrong people will read their cables, but that the right people won’t.” (Peter W Galbraith)
Thus far, that is the entirety of the correspondence I have received from Andrew Brunatti or anyone else at Brunel University.
I didn’t really feel that that was a sufficient response, so I replied (original email here):
From: Ben McGinnes
Subject: Re: Brunel submission to Australia’s National Security Inquiry
Date: Mon, 27 Aug 2012 20:27:23 +1000
To: Andrew Brunatti
CC: Philip Davies, Kristian Gustafson (Staff)On 27/08/12 4:37 AM, Andrew Brunatti wrote:
> Dear Mr. McGinnes,
>
> Thanks very much for your email commenting on our submission to the
> PJCIS. You raise some points that my co-author and I find very
> valuable and we look forward to integrating your critiques into any
> future work.That’s good, but you have failed to answer any of my questions or
address any of the inaccuracies in your own submission.In addition to the flaws in your submission and proposed National
Digital Identity Regime, I am still waiting for a response to this
criticism:“The lack of proper research and selective presentation of just
those facts which support the implementation of your National
Digital Identity Regime is, at best, both incompetent and
disingenuous. Your evidence, such as it is, appears to utilise
deliberate fallacies and obfuscation of opposing data; in order to
promote an authoritarian scheme designed to eviscerate basic civil
liberties.”I am also waiting for answers to these questions:
* Why did Brunel University decide to make a submission to a national
security inquiry when no one involved in the submission is
Australian or lives in Australia?* Is the National Digital Identity Regime being recommended to
Australia because Australia lacks the treaty obligations that
European Union member states have protecting human rights (e.g. the
European Convention on Human Rights)?* Do you hope that a National Digital Identity Regime being applied in
Australia would serve as a basis to implement a similar system in
other countries, such as the UK and EU member states?* Would you actually want to live in a country with a mandatory
National Digital Identity Regime or are you only interested
inflicting this on others?* How do you respond to criticisms of your submission as being a
paternalistic attitude towards a former colony?To which I wish to add the following question:
* Is the National Digital Identity Regime proposal and your submission
part of an effort drum up business for the BCISS Consultancy
service?> I’ve read your own submission with interest and have found it most
> engaging. I’m glad to see other informed and engaged voices
> weighing in on the lawful access debate, which I think we would both
> agree is one of fundamental importance.It’s certainly important, but you and I clearly hold opposing points
of view regarding appropriate use of such power.> I look forward, as I’m sure you do, to the Committee’s deliberations
> and final report, and hope that a balance can be struck which
> addresses both privacy and security concerns.I’m certainly interested in the outcome of the report, but seeing the
shift in my country over the last decade or so I hold grave doubts
regarding what balance there will be. Especially with the lack of
constitutionally or legislatively protected rights in Australia.You should be able to understand that, all you have to do is imagine
what would happen to your life if your government directed the powers
available to it under RIPA at you. There’s a reason I cited it along
with the USA PATRIOT Act in the PPAU submission.Regards,
Ben–
Ben McGinnes http://www.adversary.org/ Twitter: benmcginnes
Systems Administrator, Writer, Trainer, ICT Consultant
Encrypted email preferred – primary OpenPGP/GPG key: 0x73590E5Dhttp://pgp.mit.edu:11371/pks/lookup?op=get&search=0x321E4E2373590E5D
OpenPGP/GPG key transition: http://www.adversary.org/keyswitch.txt.asc
More than three weeks after sending that email, which was ample time to at least deny my accusations regarding Mr. Brunatti’s and Mr. Abdalla’s academic credibility, I still didn’t see any kind of response or defense. This prompted me to send another email stating my intention to publish and giving them some additional time to reply. They have elected not to do defend themselves or respond.
My fair warning email (original email here):
From: Ben McGinnes
Subject: Re: Brunel submission to Australia’s National Security Inquiry
Date: Sun, 23 Sep 2012 06:42:13 +1000
To: Andrew Brunatti
CC: Philip Davies, Kristian Gustafson (Staff)Hello,
It’s been a while since I sent this and, to my surprise, you
have thus far chosen not to respond to my criticism or questions.
Indeed, you have mounted no defence regarding my accusations
falsifying data to support your proposal, deliberate obfuscation of
data and generally poor academic practices.Given what you have proposed for adoption in my country, I believe it
is appropriate to publicise your failure to address these valid
criticisms.This email is fair warning that I intend to publish this
correspondence no earlier than Wednesday the 26th of September (AEST).
With the time difference that gives you two business days to discuss
this with any relevant Brunel staff (not to mention the three and a
half weeks prior to this email.Any response addressing my concerns or queries received before that
time will be published. If a response is provided which leads to a
reasonable discussion I may postpone publication.By the way, all of my email has been digitally signed with my GPG key,
which makes it possible to externally verify the messages I sent to
confirm that they were not modified or doctored prior to publication.
I also run my own mail server and can extract the logs showing
successful delivery to your server, as well as the connection from
your server with your one brief response. So simply letting this
slide and later claiming the email is fake won’t work. You can
double-check with your maths or computer science colleagues how
difficult it is to successfully forge a 3072-bit RSA signature.Regards,
Ben[included forward of my email from 27/8/2012]
Yesterday I discovered the Bets of Bitcoin site, which is a simple yet entertaining betting site. It’s a pretty simple idea: people sign up, make a statement and then people bet on whether they agree or disagree with the site.
The statements can be anything from whether Barack Obama will be re-elected as the president of USA to whether the existence of extraterrestrials to be officially confirmed by US government by the end of 2012. For people with a few spare Bitcoins the site can be quite entertaining. Especially with some bets having an outcome that is so obvious it’s ridiculous.
So I created an account and threw a single Bitcoin in there to have a little play. Obviously I bet against the US government officially confirming the existence of extraterrestrials. In the unlikely event that I’m wrong then I’ll be more entertained by space aliens than worried about the lost bet.
Then I started trying to think of something for other people to bet on and which could be more entertaining and debated than a host of political bets (although they’re always fun). So I came up with something that I was sure would divide opinion and it was announced as live a short while ago.
Bet: Silk Road will be closed by July 1st, 2013 betsofbitco.in/item?id=688 #bitcoin
— Bets of Bitcoin (@betsofbitcoin) September 20, 2012
The bet is whether or not the darknet site Silk Road will be closed by July 1st, 2013. Those who agree with the statement are betting on either a major success by law enforcement, the pseudonymous entity known as Dread Pirate Roberts retiring without passing the site on to another person (or people) or simply scamming all the users and running off with the cash. Those who disagree with the statement assume that the Silk Road staff will be able to stay one step ahead of the police for the next nine months and are in their business for the long haul.
Depending on how you look at these things, this kind of bet really could go either way. My initial bet is in the disagree camp, mainly because I think the people behind the site are pretty clever and probably can maintain a technical advantage, plus an ongoing income is much better than a quick, but large scam. That said, it could really go either way and a lot can happen in nine months.
Regardless of whether I’m right or wrong, though, I expect to get a bit of entertainment out of this site by the time the bet deadline is reached. As long as the level of entertainment is worth at least ฿0.2 BTC to me, then it’s well worth it (and at the current exchange rate that seems likely).
I’d still like to see the denizens of law enforcement put their money where their mouth is and bet on agreement with my statement, but I’ll never see where the other bets come from.
Getting back to the rest of the site, it’s a nice, simple design; very clean and easy to use. I only have one technical concern with it, which I’ll be taking up with the developers. Other than that, I think it could be quite entertaining. Especially when Australian Bitcoin users start making bets on Australian politics, such as the outcome of elections and whether Kevin Rudd makes another tilt for leading the ALP.
Everywhere we go, everywhere we turn we are being watched, tracked, surveilled. It’s impossible to walk to the shops without being caught on someone’s cameras. Everyone carries with them a portable tracking device with GPS and a microphone, we’ve been enticed into spying on ourselves for a shiny toy and apparent convenience.
There was a time when this wasn’t the case, when CCTV cameras were rare and not placed every few feet along a shopping strip. There was a time when a person could walk down the street without some nameless entity being able to press a button and see where they were with accuracy down to a few metres.
This is not George Orwell’s 1984, this is far more insidious and it’s getting worse every day. The business of surveillance is worth billions in the currency of your choice. The agenda of surveillance of everyone all the time is vigourously promoted by both corporate capitalists and the state.
The corporate world wishes to protect their monetary fiefdoms. One of the largest examples of which being the self-proclaimed intellectual property lobby. They have successfully managed to gain state support for the notion that a civil dispute, such as copyright infringement (e.g. downloading a digital copy of a song or video), is a crime. Thus enabling their subornment of the apparatus of law enforcement for their private financial benefit.
The state, on the other hand, has been in the business of watching the people, both its own and those of other states, for far longer. For the state the purpose is control and the maintaining of power of those running the state. They tell the people they want to control that it is to protect those people from the Bad People; terrorists, organised criminals and pædophiles. It’s always the same bogeymen and it plays on the politics of fear. The state tells people that there are lots of Bad People out there, but the state can protect them just as long as the people do what they’re told and live their lives the way the state dictates.
If you aren’t doing something wrong then you don’t have anything to fear.1
One of the most common, usually pro-state, arguments is that you have nothing to hide then there is nothing to fear from the prying eyes of state based surveillance. This argument is flawed in very fundamental ways, as has been repeatedly proven, both in writing and practice. Daniel Solove, professor of law at George Washington University, demonstrated this in both his book, Nothing to Hide: The False Tradeoff Between Privacy and Security, and his related article in The Chronicle of Higher Education.2
It doesn’t even take corrupt practices by those with the power to pry into the lives of regular people to demonstrate the flaws in the “nothing to hide” argument. Especially when this is extended to corporate surveillance. It is also very easy for those engaging in surveillance to blur the line between what they view as legitimate surveillance and what may not be or definitely is not in any way legitimate.
The revelations last year of the practices of News International staff in the pursuit of private information to sell newspapers is a prime example of the how easy it is for those with the ability to pry into the lives and business of others to go too far in the pursuit of their goals.
As long as we do what we’re told, we have nothing to fear.3
A more accurate argument is that if we obey then we have nothing to fear, but even then there is no guarantee that we will not be caught by the excesses of either corporate or state surveillance. It is, in fact, the fear of repercussions from not obeying the dictates of the state or corporate entities which ensures obedience.
They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.4
Franklin’s maxim is as true now as it ever was, both in regular life and in the extension of it which we call the online world.
As you read this now the Australian government is well on the way towards slashing the online freedom of the populace under the guise of protecting that very same population. Last month the Cybercrime Legislation Amendment Bill 2011 passed in the Senate, receiving Royal Assent this month. The Bill widens the scope of other legislation, such as the Telecommunications Act 1997 and the Telecommunications (Interception and Access) Act 1979, to require data be retained on private activities prior to the obtaining of a warrant. Changes to the Mutual Assistance in Criminal Matters Act 1987 enable this to be done on behalf of foreign law enforcement and intelligence agencies, including in countries and investigations where the death penalty may apply. Other changes to these acts and the Criminal Code Act 1995 have been made in order to comply with the European Convention on Cybercrime.
It is worth mentioning that the other states which have signed and ratified the Convention on Cybercrime have either or both of legislative or constitutional guarantees of certain freedoms in order to protect their citizens. Constitutionally guaranteed rights, such as those in Germany and Sweden, or treaties with equal power to the Convention on Cybercrime such as the Convention on Human Rights. Australians, on the other hand, have no such protections. Australia does not have constitutionally protected rights like those afforded in the United States of America, with the exception of there being no provision of a state sanctioned religion. Australia has not signed the Convention on Human Rights. Australia has signed and ratified the International Covenant on Civil and Political Rights, but with enough exceptions to effectively neuter it. This places Australians in a very dangerous position where we must adhere not just to the dictates of our own government, but also those of foreign powers.
Two days prior to the passing of the Cybercrime Legislation Amendment Bill 2011 was the final date for submissions to the Joint Parliamentary Committee on Intelligence and Security’s Inquiry into potential reforms of National Security Legislation.5 The reforms proposed in the discussion paper for that inquiry are a push for a massive increase in unfettered power being placed in the hands of law enforcement and intelligence agencies. This includes, but is certainly not limited to, the ability to provide their members with immunity when committing crimes, the ability to demand the decryption of data regardless of relevance to an investigation or the rights of the data owner to defend themselves from prosecution and a massive data retention scheme aimed at the surveillance of everyone, everywhere, all the time.
All government, in its essence, is a conspiracy against the superior man: its one permanent object is to oppress him and cripple him. If it be aristocratic in organization, then it seeks to protect the man who is superior only in law against the man who is superior in fact; if it be democratic, then it seeks to protect the man who is inferior in every way against both. One of its primary functions is to regiment men by force, to make them as much alike as possible and as dependent upon one another as possible, to search out and combat originality among them. All it can see in an original idea is potential change, and hence an invasion of its prerogatives. The most dangerous man to any government is the man who is able to think things out for himself, without regard to the prevailing superstitions and taboos. Almost inevitably he comes to the conclusion that the government he lives under is dishonest, insane and intolerable, and so, if he is romantic, he tries to change it. And even if he is not romantic personally he is very apt to spread discontent among those who are.6
It is clear from the legislation and treaties being adopted within and between states around the globe that governments view the flow of information and ideas between people as a threat to to state control and order. Thus they seek to employ both legislative and technological measures to limit and monitor that flow of information.
Technology does, however, provide the means of resisting these attempts at control at total surveillance. There are a number of existing projects and protocols designed to protect the security and privacy of individuals, primarily through the use of encryption. The Tor Project enables Internet users to hide web and other traffic from scrutiny, Transport Layer Security (TLS) provides encrypted connections between networked computer systems, the GNU Privacy Guard (GPG) provides encrypted email and file encryption, Off-the-Record Messaging (OTR) provides encrypted instant messaging, the Secure Real-time Transport Protocol (SRTP) with ZRTP provides encrypted voice communication and Bitcoin provides secure and decentralised currency exchange in an anonymous or pseudonymous manner.
This technology has traditionally been the domain of those who understand the technology intimately, people often labelled as geeks or nerds. The reality of the world we live in now means that these often obscure programs are becoming a necessity for everyone. Most people use some of this technology already, connecting to a secure website like a bank being the most common example. The fact is that regardless of whether you are an activist, a journalist, a lawyer, a doctor or just an ordinary citizen who does not want to share every single activity you do and communication you have online with the surveillance state; using this technology is an integral part of the survival skills of the digital age.
So how do people who are not geeks or nerds or computer science students learn these essential skills? A very good question. There isn’t a TAFE or adult education course providing instruction in this technology and the usual answer was to go online and search for the programs, read about them and then start using them. That is still an option, but it is no longer the only option.
Following the passing of the Cybercrime Legislation Amendment Bill 2011, online activist Asher Wolf promoted the idea of the CryptoParty. A CryptoParty is a gathering of people wishing to learn about these privacy protecting technologies, bringing them together with people who know the technology and who are able to teach it.
If you believe it is time to learn how to protect yourself from the encroaching surveillance of either the state or corporate enterprise, then come to a CryptoParty to learn how to do so.
The first CryptoParties have already begun and Melbourne’s CryptoParty will be on Saturday the 22nd of September, from 5:00pm until late at the Electron Workshop in North Melbourne. Other CryptoParties are being organised on the cryptoparty.org website.
1. “Surveillance,” last modified September 13, 2012, https://en.wikipedia.org/wiki/Surveillance#Support.
2. Daniel J. Solove, “Why Privacy Matters Even if You Have ‘Nothing to Hide’,” The Chronicle of Higher Education, May 15, 2011, accessed September 16, 2012, https://chronicle.com/article/Why-Privacy-Matters-Even-if/127461/.
3. “Surveillance,” last modified September 13, 2012, https://en.wikipedia.org/wiki/Surveillance#Opposition.
4. Benjamin Franklin and William Temple Franklin, Memoirs of the Life and Writings of Benjamin Franklin, (London: Henry Colburn, 1818), 270.
http://books.google.com/books?id=W2MFAAAAQAAJ&pg=PA270&lpg=PA270t#PPA270,M1.5. “Inquiry into potential reforms of National Security Legislation,” Joint Parliamentary Committee on Intelligence and Security, Parliament of Australia, accessed September 16, 2012, http://www.aph.gov.au/Parliamentary_Business/Committees/House_of_Representatives_Committees?url=pjcis/nsl2012/index.htm.
6. Henry Louis Mencken, The Smart Set, December, 1919.
“H. L. Mencken,” last modified September 9, 2012, https://en.wikiquote.org/wiki/H._L._Mencken.
This article was first published at isocracy.org.
I strongly encourage signing the petition to the Australian Senate from Pirate Party Australia regarding the Joint Parliamentary Committee on Intelligence and Security’s Inquiry into potential reforms of National Security Legislation. Sign this if you can’t make a submission to the inquiry, although I strongly urge all Australians to do so, or if you are reading this outside of Australia.
If the petition below does not load properly on your screen, please visit the petition page directly.
I am changing my OpenPGP/GPG key from this one to this one. Both keys are also available here and a proper key transition statement is here.
I have updated all the contact points on this website, but not the legacy site that is still kicking around. I have also signed the SSL statement with the new key that is mentioned in the About page.
It is important to note that the old key is not compromised and will remain active for some time. There are several reasons for the switch, but one of the main ones was my increasing discomfort at using a 1024-bit signing and certification master key. The new key has a much larger certification key and a separate signing subkey, as well as a separate encryption subkey.
I had previously intended to wait for ECC and the finalisation of the SHA-3 selection process before updating my old key, but I am no longer convinced that that was the best idea. Hence the change.
I would ask that anyone who has signed my old key (0x371AC5BFA04AE313) please review my transition document and, if satisfied, sign the new key (0x321E4E2373590E5D).
Last week the complete unredacted diplomatic cables obtained by WikiLeaks last year were revealed to the world following a series of events involving WikiLeaks, the Guardian and possibly others. There has been much finger pointing regarding who is to ultimately blame for this, which is essentially pointless. The deed is done and the information is out. A couple of days later WikiLeaks, under the direction of Julian Assange, elected to update their Cablegate site with the unredacted data and provide a full mirror archive [torrent] and PostgreSQL database copy [torrent].
Already there are interesting revelations being brought to international attention by the latest data releases. There are also very valid concerns regarding the safety of intelligence sources, victims of crime and political dissidents who are identified in the cables. Amongst these have been the revelation that one or more cables identify current Australian intelligence officers, as reported in The Age and The Sydney Morning Herald.
Last Friday a statement [PDF] was made by Robert McClelland, the Australian Attorney-General, regarding this fact and confirming that the Australian Security Intelligence Organisation (ASIO), along with other agencies, were reviewing the material. Mr. McLelland reiterated that Section 92 of the Australian Security Intelligence Organisation Act 1979 (ASIO Act) makes it a crime to “publish or cause to be published in a newspaper or other publication, or by radio broadcast or television, or otherwise make public, any matter stating, or from which it could reasonably be inferred, that a person having a particular name or otherwise identified, or a person residing at a particular address, is an officer (not including the Director-General), employee or agent of the Organisation or is in any way connected with such an officer, employee or agent or, subject to subsection (1B), is a former officer (not including a former Director-General), employee or agent of the Organisation or is in any way connected with such a former officer, employee or agent.” That second part is obviously aimed at protecting the families of ASIO employees, while subsection 1B deals with exceptions where former officers have consented to their previous employment being made public.
This has led to speculation that Julian Assange could face prosecution under Section 92 of the ASIO Act. There may be the possibility of additional charges relating to officers of other Australian agencies, such as the Office of National Assessments (ONA) or the Australian Secret Intelligence Service (ASIS). In adition to the cable referred to by The Age and The Sydney Morning Herald there is at least one cable which lists the names of a number of senior ONA analysts and there may be more buried amongst the quarter of a million cables.
One of the problems facing any Australian prosecution in this matter will be whether or not charges can be laid based on the sequence of events. The initial revelations of the complete data came from a GPG encrypted file which had been available online via BitTorrent for several months and which was decrypted using a passphrase published by the Guardian. Each on its own could not reveal the information, they had to be used together to obtain the data. If charges were to be laid related to that, who would be charged? Julian Assange for creating the encrypted file? Another WikiLeaks staffer for putting it on BitTorrent? David Leigh and Luke Harding at the Guardian for publishing the decryption passphrase in WikiLeaks: Inside Jullian Assange’s War on Secrecy? John Young at Cryptome for providing the decrypted CSV file? Raymond Hill at Cablegate Search for using that data in his online database? Others?
That’s just dealing with the initial release of the data. The next question is whether or not Julian Assange or others involved with WikiLeaks can be charged for effectively republishing the data after it has already been decrypted by others? No doubt this is something which Australian Commonwealth prosecuters will consider following the reviews of the diplomatic cables being conducted by ASIO and others.
On Sunday the Attorney-General followed the national security theme with a statement [PDF] announcing a new national security awareness campaign promoting the National Security Hotline (NSH). The NSH was introduced in 2002 by the Howard Government and the initial advertising campaign in 2003 featured much derided fridge magnets for every household.
What is unclear about the latest NSH advertising campaign is whether it was already planned, whether or not it is in response to or accelerated due to the release of the unredacted cables or whether it is part of a push to turn public opinion against WikiLeaks. When the cables were being dribbled out with effort taken to redact information that could identify people at risk of violence or retaliation it was difficult for many people to take the government’s objection too seriously. The complete release last week changes that scenario completely and the publication has been condemned by the traditional media organisations, which had previously worked with WikiLeaks to redact and publish the cables. It is possible that the Attorney-General’s department views an elevation of national security in the public consciousness will make it easier for people to draw the conclusion that the cable publication and, by extension, WikiLeaks is to be condemned.
Regardless of one’s opinions of Julian Assange and WikiLeaks, either for or against, the fact is that the facility to provide a platform for the global release of sensitive material has been a major change for both national and international politics. It has shifted the concentration of power in ways which governments are not used to. They are beginning to learn a similar lesson to that of the media: that the people formerly known as the audience are able to actively engage to a greater extent than previously possible. Not only are people able to do this, but they actually do it.
As I type this there are people around the globe pouring through the released cables looking for interesting information. Some of the results are published by traditional media outlets, some are blogged about and some are included in the running commentary on Twitter or other social media networks. Most people refer to the latter as crowd-sourcing, but governments and intelligence agencies refer to it as open source intelligence. It is another example of ordinary citizens being able to level a playing field which has previously been restricted to governments, intelligence agencies, law enforcement and corporations with the budgets necessary to obtain and mine vast amounts of data. This shift is, unsurprisingly, of real concern to those organisations which have traditionally maintained a monopoly on information.
As a consequence, moves by governments around the world to attempt to limit or discourage this power shift are to be expected. Where that coincides with existing national security legislation, such as that protecting intelligence officers here in Australia, a link is able to be drawn between the power shift and a subtext of potential sedition. It’s not quite accusing anyone engaged in any aspect of the shift in power and sharing (versus control) of information of treason, but it is a manner of presenting opposition to people doing so as in the interests of national security. It is a subtle and dangerous approach to the changing nature of politics and intelligence, which could backfire. Yet it is one which will be pursued by any government seeking to maintain a concentration of power; that being, all of them.
It also won’t work, not completely, that genie is well and truly out of the bottle. The governments, intelligence agencies, law enforcement and corporations already know this; their game is now to limit anything which they see as potentially damaging. The extent of their success or failure in this will only become apparent over time; not just in relation to the various releases from WikiLeaks, but also information which will be released by other sources and organisations in the future.
There are new players in the Great Game of international politics, players who were previously viewed almost entirely as pawns. It will be very interesting to see how it plays out as the power and the rules shift.
Yesterday’s news that Paul Freebody, a candidate for the Queensland seat of Cairns, has been expelled from the Liberal National Party (LNP) highlights the need for the greater adoption of email encryption and digital signatures.
As with the OzCar Affair of two years ago, the issue here relates more to the verification that an email has not been tampered with rather than protecting the content from prying eyes. Thus it is a digital signature which would have been of use to Freebody in this case. Had he already been using OpenPGP compliant software to sign his emails, such as PGP or GPG, Freebody could have proven that the change to his email after signing and sending it was made by someone else, without needing to identify or, in this case, embarass that person.
The reports regarding the case of Paul Freebody are a little unclear as to whether the modified email had been sent from his computer or whether a family member who had received the email modified it and then forwarded it on. Regardless of which of those two alternatives it was, the regular use of a digital signature would have helped.
If the email had been modified on Mr. Freebody’s computer before it was sent, the prompt to sign the message would have prevented message from being sent without the relevant passphrase. If the relative had removed the signing option then Mr. Freebody could have pointed to the lack of the signature as a certain level of proof that he did not send that email.
Had the email been signed and a recipient modified the content before forwarding it to others, the signature would not validate for that message and Mr. Freebody could then have pointed to that as proof that the message had been altered. In this case Mr. Freebody could have provided a copy of the original message with the valid signature for comparison.
This is the second time in as many years in which a forged or modified email has resulted in a scalp being claimed in Australian politics; yet the tools to prevent it have been available for two decades and standardised since the late 1990s. Since that time the ease of using email encryption and signatures, particularly with the combination of Thunderbird, GPG and Enigmail, has been improved considerably.
Until people in public life start using at least this aspect of cryptographic technology, even if they don’t actually encrypt their email, these kind of scandals will continue to occur.
Recently I have noticed that a number of my friends and acquaintances have had their GMail accounts compromised. While my preferred email address is on my own server, I do have a GMail address too (actually I have a couple, but only one that is really used much) and it has not been compromised. I’ve been asked about it a little bit and I figured it best to add my thoughts here regarding best practices, along with some software recommendations.
The first and most obvious recommendation is to use a strong password, ideally with a minimum of 128 bits of entropy. The best way to achieve this is to generate a suitably strong password with KeePassX (Windows users should use KeePass). KeePassX can also be used to generate and securely store passwords for any other account or site. KeePass and KeePassX store all passwords in a database that is protected by a passphrase and 256-bit AES or Twofish encryption.
The second recommendation is to never under any circumstances use the same password for multiple accounts. Passwords for one service should not be used to link it to another service where it may be exploited by an application or plugin for the second service. This way even if one service is compromised, the potential damage is limited to that service only and won’t be able to affect other accounts on different sites.
The third recommendation is to always connect using SSL/TLS. I always recommend the Mozilla Firefox browser with the EFF’s HTTPS Everywhere plugin. The Google settings for always connecting via HTTPS and enabling either or both of IMAPS and POP3S.
The fourth recommendation is to configure a proper mail client, such as Mozilla Thunderbird, to connect with IMAP over SSL. Using a proper and robust mail client, like Thunderbird, is my preferred method of accessing email, but in the case of GMail and other primarily web based email hosting does not prevent access via the web.
The fifth recommendation is to use the Tor Browser Bundle when connecting to GMail through a public wireless point or public network (e.g. an Internet café). This software includes a modified version of Firefox that incorporates HTTPS Everywhere and will help prevent session hijacking, such as that used by the Firesheep exploit. The Tor Browser Bundle is designed to run from a USB stick and does not require any installation; simply click and run.
These fairly straight forward measures should be enough to protect any GMail account from compromise and may also be applied to other web email hosts such as Hotmail or Yahoo. Although I have not checked the extent of support for SSL/TLS connections to either of those services.
Finally, I still encourage the use of the GNU Privacy Guard for securing correspondence between parties, but that is a different matter to securing the accounts themselves.
This site can be accessed via a TLS/SSL connection, but the certificate is locally signed.
So what does this mean?
Well, as far as the security of the connection between your computer, gentle reader, and the server is concerned it means that it is just as secure as any connection using a 256-bit AES key. That’s very secure.
It also means that your browser will display a prominent warning that the site is not trusted. This can be a bit deceptive because when your browser says that it just means that my certificate is not signed by one of around a couple of hundred certificate authorities (the exact number varies between browsers).
So why not get a certificate authority to sign my certificate?
There are two main reasons for this: cost and a false sense of security.
The certificate authorities (CA) charge exorbitant sums for most of their certificates. My current key is valid for five years (beginning last September) and can be used by any subdomain on my domain. To get a key like that signed by any CA would cost hundreds of dollars or even thousands through some CAs. While there are free certificates available from some CAs, these are almost always the absolute bare bones; limited to a single hostname (I would have to choose between www.adversary.org or my server’s real hostname of seditious.adversary.org) and limited in the amount of time the certificate could be valid for. Most free certificates are only valid for one year or less.
The second reason is the false sense of security. Most people are satisfied by just seeing the little padlock icon appear in their browser, or a change in the address bar. Very few actually verify the details of a site’s certificate and the connection. Often they don’t even confirm that the certificate really is signed for the correct organisation. This can lead to very bad things.
Don’t believe me? Fine, start with this article from Wired in 2009. There are plenty of other articles on this issue, just do a little search on “ssl certificate exploit” to see them.
Now since this site isn’t hosting any kind of merchant site with a payment gateway, I have no business compliance requirements to submit to an external certificate “authority” for my domain. I would much rather people verify the SSL fingerprint themselves and add the exception. The current fingerprints (MD5 and SHA1) are available in the About section of this site.
For the last couple of years the Australian government has been strongly pushing a policy of Internet censorship; usually dubbed the Clean Feed, following the UK model. The first ACMA report from 2008 included some detail of attempts to filter more than just web traffic.
The ACMA report prompted me to analyse the methods by which the government might be able to achieve one of the options in the ACMA report: filtering HTTPS traffic. My report, Cleaning A HTTPS Feed: Report on the Filtering of the Hypertext Transfer Protocol over Transport Layer Security or Secure Socket Layer Connections, was first published last year by Atomic MPC Magazine and later by Civil Liberties Australia.
Since last year’s election and the precarious outcome, the government has announced a review of the classification system before making a final decision on how to proceed with an Internet censorship regime. In spite of the significant opposition to the scheme, both the Minister responsible, Senator Stephen Conroy, and Prime Minister Gillard have voiced continued support for censorship of the Internet.
As the government does not wish to drop this policy, I don’t wish my report into the implications of certain aspects of filtering to slip by. My full report on the methods of filtering traffic which is intended to be secure is available here (PDF).
