Security considerations . . .

A copper wallet insert shields your credit cards from RFID skimming.
Image: Adam Harvey

Get a Faraday wallet. Something with a lining made of copper, or steel mesh or even aluminum foil. Or add aluminum foil to the inside of the wallet you have. With one of those, “they” can “ping” you as you walk about, and the RFID’s in your credit cards and sometimes, Driver’s Licence, are shielded, and they stay silent. 

As well, street gangs and other low-lifes are getting into using ’em to identify targets to pick off, and it is alleged that they have the ability to even get through the RFID card security, get the data, and dupe an RFID card with your data.

You see, it occurs to me that the NSA could easily have all the banks' credit card data, and that means the banks' credit card RFID's chip ID’s for each account. 

So, it could be possible for “Security” to put RFID scanners all around, like TTC station exits, parking-lot doorways. Computer scan the passers-by and RFID’s belonging to “people of interest” could trip alarms. 

Similarly with your phone and its GPS, even “off” may not be off enough, and having a Faraday container will ensure that nobody can track you through your phone's GPS or by the phone's link-up with the cellular phone system. You may not be able to use your phone, but you will be a lot more “invisible” on the street, if you’re about something that you’d like to remain private.

WIRED has two reports worth checking out: Liz Stinson has an overview of security-oriented products, with an article and a Stealth Wear picture gallery, “Wanna Buy a Parka That Makes You Invisible to Drones?”, and a How-To Wiki, “Make a Faraday Cage Wallet”.

Duct Tape RULES!

Spying, commerce and law . . .

ED SNOWDEN'S REVELATIONS have serious implications for American business and law — and for us. At iPOLITICS, Steve Nixon has an article you should ponder, "What the Snowden revelations mean for business". There are issues, and they are still growing as consequences appear:

When the U.S. government decided to access e-mail traffic, phone calls and smart phone communications without conventional due process it did more damage to U.S. business than can be imagined.

Banks in the U.S. can no longer claim to offer secure financial transactions with their customers. With possible access to personal emails these government agencies have access to personal banking statements, online banking passwords, password reset links and online accounts.

•  • •

Another area that this security breakdown affects is the practice of law in general. With government tracking of private communications it can be legally argued that any communications could have been intercepted and communicated to third party sources. This strikes at the heart of the need for security in legal matters in countless ways. Confidential communications between lawyers, judges and legal clients are fully visible by government agencies through these various types of communication.

Canada was a heartbeat away from falling victim to the same fathomless problems that now plague the U.S. with Bill C-30. 

Bread crumbs . . .

CAN LEAVE A TRAIL. So does your smart phone. According to Farhad Manjoo at SLATE, in his article "Fear Your Smartphone", "It’s totally rational to worry that your phone is tracking everything you do."

Trevor Eckhart, a 25-year-old software-systems administrator in Connecticut, posted internal documents and a scary video showing what our phones know about us. Eckhart exposed the capabilities of Carrier IQ, a company that makes software used by several carriers and phone companies to gain “insight into their customers’ mobile experience,” as the firm describes it. Carrier IQ’s software, which is completely hidden from users (and could continue to work even if you opt out of your phone’s diagnostic monitoring), is capable of logging and reporting back pretty much everything that happens on your phone. It can see the apps you use, the sites you visit, your physical location, and it can even log your individual keystrokes, which means that it can read your text messages and passwords.

Apparently, unlike other phone makers, RIM's products don't ship with it, but service providers can install it. Then there's Echelon and Communications Security Establishment Canada, who may be listening in. Seems like the anonymous, pay-as-you-go cheapo phones may not disappear anytime soon, especially for border crossing.

The civil service shuffle and the hidden agenda

Last Friday the Harperites announced a rather significant shift in the upper levels of the federal bureaucracy. Except they waited until most of the notepads had been flipped shut and the blackberries were headed for the corner of Elgin and Cooper. Kady, still on the beat, noticed.

When those types of announcements are made late on a Friday afternoon there is good reason to cast a cynical eye and Cathie raised the obvious question. The Harperites are trying to hide something - but what?

Today, she nails it.

What?!!!!

Read this! I mean it. Read it!

When I used to tell my troops that I would have their gut for garters, this is the kind of thing that qualified for executing such an act.

Ask yourself: Where is you income tax form going? No wonder these guys want to get rid of the long-form census. They believe everyone will abuse it the way they do.

The company Stockwell keeps.

When I read Dr. Prole's description of the new virtual strip-search device being tested at Kelowna International Airport I knew I had read about this system well over a year ago being tested in the US. Sure enough, I waded into the wayback machine and found this posting from December 2006.

On closer comparison however, I realized that they are actually two different devices. The system being tested in Phoenix Arizona's, Sky Harbor International Airport is actually an x-ray backscatter system, different from the millimeter wave system being tested in Kelowna.

I did think it worth looking at Sky Harbor International to see how the backscatter test was working out. Well look at that. Sky Harbor International now has both backscatter and millimeter wave full body scanners in operation. And the millimeter wave scanner is identical to the one now deployed in Kelowna.

I thought it a little odd, (although not shatteringly so), that the description of the operations, procedures and even the equipment trials were virtually identical between the two airports: one in the U.S. and one in Canada where the privacy laws differ.

It leads to one common point. The supplier of the millimeter wave full body scanners in both Kelowna and Phoenix is the same - L3 Communications. And it leads to the conclusion that L3 developed the procedures for both airports, including the marketing effort to downplay legitimate privacy concerns. It is too much of a coincidence that CBC reporting on Kelowna's equipment, USA Today reporting on Phoenix and the US Transportation Safety Agency's excusatory description of their whole body imaging process would all read the same and provide identical assurances and alternatives.

And then there is the curious choice of supplier. L3 Communications is not some third-floor Canadian company with an idea and a marketing plan. No. L3 Communications is a Manhattan-based Fortune-500 corporation, well entrenched in the US military-industrial complex with a deep connection to private military contracting in the Iraq war.

L3 owns Military Professional Resources Incorporated (MPRI), (acquired in 2000), which, while described as a Private Military Company, is nothing less than a mercenary group. They also own Government Services Incorporated (GSI), a private intelligence company with personnel spread out through the Middle-East at 22 US bases. Add Titan corporation to the mix. They provide interrogators and interpreters to the US military along with security and intelligence services. And through Titan, L3 is connected to detainee abuse at Abu Ghraib, although L3 did not purchase Titan until after the details of torture were disclosed. (It should be noted that when Titan's involvement in Abu Ghraib became public other companies offering to buy Titan withdrew their bids. Only L3's offer remained.)

While L3 is firmly ensconced in the Pentagon's intelligence efforts, it also seems to have a solid position with the Bush administration in other areas. Working through various subsidiaries, L3 has managed to acquire Pentagon contracts even though they have been hauled up to answer for failure to perform and failure to deliver. In fact, one contract in Iraq brought the company under criminal investigation for:

... concealing test failures and providing flawed parts for emergency radios used by Special Forces and Air Force teams in Iraq and elsewhere.

The next trip to answer for non-performance came when it was revealed that a major component of the US border security system simply did not work. The company involved, IMC, through what appears to have been a "no-bid" contract, was suppose to have installed and tested the equipment for the US Remote Video Surveillance Program on the US side of the Canadian and Mexican borders. When the DHS Inspector General reviewed the installation it was discovered that the system did not function, much of the work had not been done and was wrapped in an agreement which violated federal contracting rules. IMC is a wholly owned subsidiary of L3.

So the involvement of the Canadian government with this firm raises questions. L3 is clearly a war profiteer and benefits from the largess of the Bush administration with "no-bid" contracts. What started out as a high-tech security company has evolved to develop its own dark side with involvement in the worst of US military scandals. Its failure to deliver the material and training to the US Border Patrol on a major project is bad enough, but the fact that the investigation into the affair was suddenly dropped, without conclusions, raises further questions. And then there's this coincidence:

... the manager of the border security project was Rebecca Reyes, who is now director of policy, procedures and administration at L-3 subsidiary, MPRI. She also happens to be the daughter of Silvestre Reyes, a member of the U.S. Congress from Texas, a former Border Patrol agent who is now a senior member of both the Armed Services and Select Intelligence Committees of the House of Representatives.

Yeah, well, that was then; this is now.

The "now" is that Canada's Public Safety Minister is courting a US war profiteer with an ugly track record. Sure, it's only $200,000 per copy for L3's ProVision remote strip-search device. Sure the company has provided assurances that a person's privacy will not be violated because the process keeps them anonymous.

That, along with other guarantees they have failed to make good on.

And if you think it stops with having some stranger look at a detailed picture of your naked body during an airport screening, think again. Millimeter wave technology already has the capability to do wide area scans. Do you think they're going to stop with a silly tubular booth?

Tough Dems ? ? ? ?

Let's see how tough the democrats are in standing up to bushco.

My money's on "Not Very."

The one hope for privacy advocates is Senator Chris Dodd's promise to filibuster any bill that included the telecom immunity provision. Note how the major presidential candidates have been silent on an issue that is of such importance. They're too busy sniping at each other in a "he said, she said" spat.

Go figure.


From Reuters today:

Committee head sees approval of phone immunity
Wed Jan 23, 2008 5:51pm EST - By Thomas Ferraro

WASHINGTON (Reuters) - The Democratic-led U.S. Senate will approve President George W. Bush's demand that telephone companies that participated in his warrantless domestic spying program receive retroactive immunity from lawsuits, a top lawmaker predicted on Wednesday.

_______________


Yet it remained uncertain if the Senate could reach an agreement with the Democratic-led House of Representatives on such legislation before a surveillance law it would replace expires next week on February 1.

Vice President Dick Cheney joined the fray, saying, "We're reminding Congress that they must act now to modernize FISA," the 1978 Foreign Intelligence Surveillance Act.

Speaking at the Heritage Foundation, a conservative Washington think tank, Cheney added, "Those who assist the government in tracking terrorists should not be punished with lawsuits."

Yeah, let's not punish the corporations and executives that were spying on US citizens.

That would be just wrong . . . .

Heading in the Wrong Direction . . . .

The US really sucks, but Canada is slipping, too. Check last year vs. this year to see the trend in the wrong direction.

From Privacy International: Read the whole article here.

(Click Map to Enlarge)

Each year since 1997, the US-based Electronic Privacy Information Center and the UK-based Privacy International have undertaken what has now become the most comprehensive survey of global privacy ever published. The Privacy & Human Rights Report surveys developments in 70 countries, assessing the state of surveillance and privacy protection.

Grading

Countries have been graded according to a mean score across fourteen criteria. These are divided into

Score range	Description
4.1-5.0	Consistently upholds human right standards
3.6-4.0	Significant protections and safeguards
3.1-3.5	Adequate safeguards against abuse
2.6-3.0	Some safeguards but weakened protections (Canada)
2.1-2.5	Systemic failure to uphold safeguards
1.6-2.0	Extensive surveillance societies
1.1-1.5	Endemic surveillance societies (United States)

CANADA (Score: 2.9)

• Privacy not mentioned in Charter of Rights and Freedoms, but courts have recognised the right to a reasonable expectation of privacy
• Statutory rules at the federal level (public and private sectors) and provincial laws apply to sectors and governments
• Federal commission is widely recognised as lacking in powers such as order-marking powers, and ability to regulate trans-border data flows
• Variety of provincial privacy commissioners have made privacy-enhancing decisions and taken cases through the courts over the past year (particularly Ontario)
• Court orders required for interception and there is no reasonable alternative method of investigation
• Video surveillance is spreading despite guidelines from privacy commissioners
• Highly controversial no-fly list, lacking legal mandate
• Continues to threaten new policy on online surveillance
• Increased calls for biometric documents to cater for U.S. pressure, while plans are still unclear for biometric passports

UNITED STATES OF AMERICA (Score: 1.5)

• No right to privacy in constitution, though search and seizure protections exist in 4th Amendment; case law on government searches has considered new technology
• No comprehensive privacy law, many sectoral laws; though tort of privacy
• FTC continues to give inadequate attention to privacy issues, though issued self-regulating privacy guidelines on advertising in 2007
• State-level data breach legislation has proven to be useful in identifying faults in security
• REAL-ID and biometric identification programs continue to spread without adequate oversight, research, and funding structures
• Extensive data-sharing programs across federal government and with private sector
• Spreading use of CCTV
• Congress approved presidential program of spying on foreign communications over U.S. networks, e.g. Gmail, Hotmail, etc.; and now considering immunity for telephone companies, while government claims secrecy, thus barring any legal action
• No data retention law as yet, but equally no data protection law
• World leading in border surveillance, mandating trans-border data flows
• Weak protections of financial and medical privacy; plans spread for 'rings of steel' around cities to monitor movements of individuals
• Democratic safeguards tend to be strong but new Congress and political dynamics show that immigration and terrorism continue to leave politicians scared and without principle
• Lack of action on data breach legislation on the federal level while REAL-ID is still compelled upon states has shown that states can make informed decisions
• Recent news regarding FBI biometric database raises particular concerns as this could lead to the largest database of biometrics around the world that is not protected by strong privacy law

Perhaps upcoming elections in both countries will reverse the trend.

I'm not holding my breath . . . .

(Cross-posted from Moving to Vancouver)

Now We're Really Screwed . . . .

From the Washington Post:

FBI Prepares Vast Database Of Biometrics
$1 Billion Project to Include Images of Irises and Faces

By Ellen Nakashima - Washington Post Staff Writer
Saturday, December 22, 2007

CLARKSBURG, W. Va. -- The FBI is embarking on a $1 billion effort to build the world's largest computer database of peoples' physical characteristics, a project that would give the government unprecedented abilities to identify individuals in the United States and abroad.

Digital images of faces, fingerprints and palm patterns are already flowing into FBI systems in a climate-controlled, secure basement here. Next month, the FBI intends to award a 10-year contract that would significantly expand the amount and kinds of biometric information it receives. And in the coming years, law enforcement authorities around the world will be able to rely on iris patterns, face-shape data, scars and perhaps even the unique ways people walk and talk, to solve crimes and identify criminals and terrorists. The FBI will also retain, upon request by employers, the fingerprints of employees who have undergone criminal background checks so the employers can be notified if employees have brushes with the law.

_______________


The increasing use of biometrics for identification is raising questions about the ability of Americans to avoid unwanted scrutiny. It is drawing criticism from those who worry that people's bodies will become de facto national identification cards. Critics say that such government initiatives should not proceed without proof that the technology really can pick a criminal out of a crowd.

_______________


The Department of Homeland Security has been using iris scans at some airports to verify the identity of travelers who have passed background checks and who want to move through lines quickly. The department is also looking to apply iris- and face-recognition techniques to other programs. The DHS already has a database of millions of sets of fingerprints, which includes records collected from U.S. and foreign travelers stopped at borders for criminal violations, from U.S. citizens adopting children overseas, and from visa applicants abroad. There could be multiple records of one person's prints.

_______________


In an underground facility the size of two football fields, a request reaches an FBI server every second from somewhere in the United States or Canada, comparing a set of digital fingerprints against the FBI's database of 55 million sets of electronic fingerprints. A possible match is made -- or ruled out--as many as 100,000 times a day.

Looks like it's time to lose the beauty mark and stop swishin' through the airport, girls . . . .

(Cross-posted from Moving to Vancouver)