Unlawful Eavesdropping is like search without warrant

The New York Times reports eavesdropping helped to break up a terrorist plot in Germany.

John Scott Redd, the head of US Counterterrorism Center states "But we are not safe. Nor are we likely to be for a generation or more". Seems like we should all get ready to allow governments the mechanisms to protect us and protect their power...for a very long time. Comforting thought.

There's some facts that seem to be conveniently ignored in order to try justify unlawful and illegal interception.

This eavesdropping on terrorists was performed after a court in Germany granted the equivalent of a search warrant. In Germany, the courts will only allow limited eavesdropping and both parties of the conversation must be identified as suspects with evidence presented to the court. There is also usually a limit on the time period for the lawful interception warrant.

Just as your home is your private property, any police entry requires a search warrant issued by a court...after the judge examines evidence of suspected criminal activity.

Since your communications (phone, letter or email) is your privacy, any government intrusions should also require an eavesdropping warrant issued by a court...only after examining evidence of suspected criminal activity.

It is most likely that a German court accepted as evidence of suspected terrorist activity, the fact that these individuals "had actually obtained explosive liquids, hydrogen peroxide, which they could condense, or try to condense to an explosive".

The W007...a President's New Phone

A lawsuit was filed with US Federal court in San Francisco to invalidate the new law which allows wiretapping without a court order. The suit was filed by lawyers from the Center for Constitutional Rights, who also represent the Guantanamo inmates. Apparently, the FISA court seemed to be delaying US govt's earnest attempts to catch terrrrrists. In fairness, this legislation could probably be plugging a loophole by explicitly removing barriers for interception of any communications with foreigners.

From my perspective, at least this new legislation has a sunset clause and needs Congress to renew it in six months. Hopefully, there'll be enough Americans who dare to talk about the President's new clothes...to restore their constitutional rights and fix the root cause of the problem. I honestly believe that the root cause is a foreign policy that creates many more problems than are intended to be resolved.

There's already some fallout, with Zimbabwe President Robert Mugabe citing the US program to justify using "the dictator's toolkit". So before you think I'm engaging in Bush-bashing, I'll come right out to say that the same issues are occurring in many more countries with much less debate or oversight.

There also seems to be an attempt to apply the law in retrospect in order to grant AT&T immunity in the lawsuit filed by the Electronic Frontier Foundation. Ironically, AT&T testified in court during the 1920s, "The telephone has become part and parcel of the social and business intercourse of the people of the United States, and this telephone system offers a means of espionage to which general warrants and writs of assistance were the puniest instruments of tyranny and oppression."

As Bob Dylan used to say, the times they are a-changing. All that we've grown to understand about peace, war, dictatorship, democracy, elections...are a-changing. Pretty soon, the concept of property ownership will also be reversed back a few hundred years. Back then, search warrants weren't required, since all property belonged to the state.

Unlawful Involvement of Telecoms Has Impact On People

A recent TV program on PBS Frontline talks about wiretapping capability. Spying on the Home Front touches a great deal of issues and tries to achieve a balance by allowing all those involved a chance to voice their perspective. AT&T's involvement shows that telecoms networks are in a position to be convenient tools for unlawful interception of communications, which can be indexed and stored for periods beyond their utility of preventing terrorism.

Even though the PBS program talks about events and issues in the US, it is quite reasonable to expect similar scenarios in many different countries around the world. Of course, some governments may be working with less than USD 60 billion budget. Compare the ability of the average person with a low budget laptop to search and obtain a lot of information for free from Amazon.com, BBC News, CNN, ESPN, Expedia, Flickr, Google, IMDB, LinkedIn, Lonely Planet, MarketWatch, Priceline, Reuters, Technorati, Weather Channel, Wikipedia, Yahoo...and you get a glimpse. If you are willing to spend some money online, you can obtain even more details from various high quality information aggregators and industry specific analysts.

While many people may trust their government, one particular viewer of the PBS program commented online, "Here's an easy scenario of abuse...I decided to run for Congress and someone who is a fan of the incumbent happens to work in the NSA/FBI/etc. They scan all of this massive data collected for years and can correlate my travel, shopping and hotel activities. This data indicates a pattern that I might have had an affair 5 years ago. They leak this information to my opponent's campaign and they hire a private investigator to confirm and dig up this information. A week later, this information is leaked to a news paper, journalist, tabloid etc."

Dick Cheney was certainly not amused when the press and politicians had a field day about his daughter being openly lesbian.

Now, not everyone has aspirations for political office. But there's a fundamental need for privacy in order to protect each person's family relationships and business interests.

There are also dangers of inaccurate information being held for too long. In the UK, a little girl made a remark "My dad bonked me last night." A lady at the cafeteria overheard this and reported it to the school authorities, which sparked an investigation into the father being a sex offender. They later confirmed that the girl was talking about her father tapping her playfully on the head with an inflatable hammer. Five years later the father discovered he was being refused work because he was still classed as a suspected paedophile.

BTW, you can also watch the full PBS program online

Marconi Award for Co-Author of RSA Encryption Algorithm...with Simple Explanation about RSA

The Marconi Society recognizes a living scientist who shares the determination that advances in communications and information technology be directed to the social, economic and cultural improvement of all humanity.

Ronald Rivest, Professor of Electrical Engineering and Computer Science at MIT, will receive the annual award and $100,000 prize for his pioneering work in the field of cryptography, computer and network security.

"Ron Rivest's achievements have led to the ability of individuals across the planet --in large cities and in remote villages-- to conduct and benefit from secure transactions on the Internet. Public key cryptography has flattened the planet by enabling secure communication via email, web browsers, secure shells, virtual private networks, mobile phones and other applications requiring the secure exchange of information. The technology has enabled entrepreneurial activity on an unprecedented level, and facilitated major advances in political and social interactions." said Robert Lucky, chairman of the non-profit Marconi Society.

CryptoGraf brings Ron Rivest's work with public key crypto to enable mobile phone users send securely encrypted messages, so I have great respect and admiration for him. I was delighted that the closest I got to know Ron was when I met and talked to his neighbor at a trade show. When I mentioned the work that CryptoGraf did with RSA encryption (Ron Rivest is the "R" in RSA) and our enhancements to PKI usability for mobile messaging, it triggered a nice conversation. At some point, she related that she struggled to explain Ron's "invention" to her young son. She couldn't explain it in terms simple enough for her boy to understand.

It's difficult for the average person to appreciate public key crypto, let alone the workings of the underlying mathematical algorithm, since the concept is counter-intuitive.

Most people have no problem understanding standard crypto when it involves using the same key to encrypt and decrypt. That's quite intuitive and is based on the age old method of sharing secret codes. It's also simple to see the analogy of sharing duplicate keys to open and close a lock.

The problem with this standard crypto is that for two people who have never met, to personally exchange duplicate keys, it is impossible to securely share a secret.

However, public key crypto makes it possible for people who have never met to exchange a secret message. Public key crypto uses two separate (but related) keys. One key is used to encrypt, while another key is used to decrypt. Of the two keys, one key is distributed to be made public and is called the public key. The other related key is kept private and is called the private key.

At this point most people who know crypto, enough to try to explain public and private keys, start loosing the attention of their audience.

The counter-intuitive part about public key crypto is that the public key is used to encrypt and the private key is used to decrypt. So Alice can send Bob a message by encrypting the message with Bob's public key. Since Bob is the only person who has the private key, Bob can be certain that he is the only person who can decrypt and read the secret message.

Since our aim is to enhance the usability of CryptoGraf, I've grappled with various analogies to explain the mechanisms underlying the security of RSA, which is the basis of the security of CryptoGraf. The closest I can get is the result of several brainstorming sessions with my brother about ways to explain public key crypto in simple terms. It is still a work in progress, but I try to explain the analogy here. There's a limitation to the analogy since I can't yet figure out how to extend this to illustrate digital signatures.

Here's the Simple Explanation about RSA...
Using public key crypto to communicate is like using a P.O. Box to send and receive letters. Let's say Bob is the owner of the P.O. Box. Bob is the only one who has the key to open the P.O. Box to retrieve the letters. When Alice wants to send a letter to Bob, Alice must have access to Bob's P.O. Box. The P.O. Box is Bob's public key. The private key is used to open the P.O. Box to retrieve the letter.

Some people may consider this analogy "incomplete" since it requires Alice to personally insert the letter into the P.O. Box to make sure that no one else gets access to the letter, to make sure that no one has a chance to even try to open the envelope. Or in essence, it requires multiple copies of Bob's P.O. Box to be shipped out. Anyone who wants to send a secret letter to Bob will insert the letter into their copy of Bob's P.O. Box and ship the P.O. Box to Bob. Bob will use his private key to open each P.O. Box delivered to him.

Hope this goes toward helping the average guy understand the ingenuity of Ron Rivest and the Marconi award for his accomplishment in making it possible for people to securely exchange messages and do e-commerce over the Internet.

Mobile Advertising Fumbles

A lot of analysis and design effort has been put into CryptoGraf Messaging v2.0.

Mobile app users can also now send an SMS Invite to their contacts to download (OTA) and use the Free Version of CryptoGraf Messaging. This SMS based Invite differs from the current wave of mobile advertising which is often perceived as unsolicited spam. The SMS based Invite to download and use CryptoGraf Messaging is more effective since subscribers who send the SMS Invite are well placed to know that the recipient will accept it as an informative message.

While at Nokia, I briefly managed a mobile advertising pilot trial. This system was an enabler of marketing based on positive opt-in to advertising. With a full CRM keeping information about subscriber input interests and preferences for receiving advertising. Subscribers would also have the added incentive of receiving discounts and coupons. I kept emphasizing the need to respect the subscriber's privacy and personal space. Subscriber's should be asked what topics interest them, how often and what times of the day they would be willing to receive a message from the mobile operator. Subscriber data gathering could be done at time of subscription and even modified when their interests or preferences changed. The system was designed to follow standard media industry practice with the involvement of full advertising value chain. This included advertisers, ad publishers, ad agencies, media planners, media buyers, the audience, and of course, the mobile operator being enabled to play several roles within this value chain. I offered the analogy of the mobile operator being the owner of several magazines, with each magazine having subscribers tuned to special interests. Ad agencies and media planners normally place ads in a particular magazine, with the knowledge that readers opted-in to advertising that's probably relevant to them. I was never to know how the mobile advertising trials would turn out, since my superiors needed me to work on a federated single sign-on related project, and Nokia soon decided to stop supplying network operators with mobile advertising servers.

Now a big talking point in the market is mobile advertising. This is apparently to help the whole industry boost revenues. But is also largely inspired by the success of Google's business model based on advertising revenues. Google's services enable them to collect internet user interests and search preferences and offer advertising that is non-intrusive and takes up a small part of the screen space. Users can even ignore google's advertising without taking any extra steps.

Google's web based advertising is in stark contrast to email that is labelled as spam. Spam is perceived as such due to the message being irrelevant to recipient's interest. There's also no knowing how email addresses are collected. However, bloggers who publish their email address can hardly complain when they receive email from a stranger. They'd be fortunate if part of the information they receive is relevant to their blog.

We made a judgement call by sending email announcing CryptoGraf Messaging upgrade release without asking the recipients explicit permission. The emails were sent to people I had personally met or been referred. We also sent the email to different organizations, journalists, mailing list regulars and bloggers who wrote about topics that were related to the email. However, a certain blogger wrote back asking why we sent him email. I apologised for sending him an unsolicited email but explained that we were implementing a mobile marketing technique (SMS based Invites to download and use CryptoGraf Messaging) which was in the spirit of topics covered in his blog. He also wrote back that the email was "neither welcome nor unwelcome", so apparently the content was of some interest to him. With hindsight, it seems that he's put up his email address as bait for his blog. We made a judgment call by sending email to a stranger based on their publicly available contact information and professed topic of interest. But we need to admit that we did not fully comply with best practices prescribed by the CAN-SPAM Act.

Meanwhile, too many mobile users have no recourse when they receive mobile advertising from their network operator with messages that are often irrelevant to their interests and arriving at unpredictable times of the day.

Somehow, it seems the advertisers and ad agencies are the ones who receive the short end of the deal. Mobile subscribers who are interrupted (in the shower, in a meeting, while driving, etc.) are less likely to be receptive to such marketing. Mobile marketing as it is currently implemented is as sophisticated as telemarketing.

Protect our Privacy...for our own Security

A recent issue of the Scientific American talks about the need for privacy from an interesting ethical and engineering perspective.

Privacy is needed by..."a lion that sees a deer down at a lake and it can't let the deer know he's there or [the deer] might get a head start on him. And he doesn't want to announce to the other lions [what he has found] because that creates competition. There's a primal need for secrecy so we can achieve our goals."

Privacy is also necessary for individuals to be allowed room to make mistakes and to grow. Just as a child stumbles while trying to walk, he is taught to enjoy the experience and grow with the encouragement from parents. This is based on the universal principles of repentance and forgiveness. Societies that have room for such principles to be practicable are more likely to flourish since people would not be afraid of being branded a failure but to learn from their mistakes. Bankruptcy laws are a good example of a mechanism which allows a person to recover in spite of failed attempts.

Too many systems are engineered to collect information, without regard to how the data will be used or it's relevance after a certain time period. The marketing department will always ask for more data about customers, demographics, behaviour, etc. It is also relatively simple to satisfy requirements for data collection given the computing capacity we have for storage and analysis. But in spite of the data gathering and analysis capability, there's too many instances when marketing is still done with the sophistication of telemarketing...mobile advertising being the main culprit.

In a Scientific American interview, Latanya Sweeney, makes an excellent point that "the privacy problems that I've seen are probably best solved by the person who first created the technology. What we really have to do is train engineers and computer scientists to design and build technologies in the right kind of way from the beginning."

So far, making engineers aware of human computer interfaces is only just beginning to show results with the recognition given to products that enhance usability. The next step, to make engineers aware of acceptance and social adoption requires them to think of barriers to technology. We already engineer systems that refrain from intruding on personal physical space. We are quite capable of engineering systems to enhance people's mental capacity and productive use of time. However, too many engineers presume that when systems intrude into people's privacy and temporal space, there are justifiable benefits but do not offer users a viable means to choose to opt-out of those "benefits".

CryptoGraf Messaging v2.0 now on N95, E65, N73, E61i

CryptoGraf Messaging v2.0 allows users to send encrypted and digitally signed SMS and MMS on their mobile smartphones based on the widely available Symbian platform which include popular handsets like the Nokia N95, E61i and E65 from among over 50 different models.

Early 21st century has now been marked by grim security concerns, but those concerns have now dominated to the extent of subverting due legal process and the democratic system of checks and balances. There is a compelling need to go beyond fear as the driver of policy, decisions and actions. Several highly publicized abuses of power due to broad assertions of authority now affect the privacy of citizens, activists, journalists, diplomats and businessmen to impact civil rights and free trade.

CryptoGraf Messaging reconciles conflicting needs in the face of these provocative security concerns. CryptoGraf is committed to enabling privacy as a basis of civil rights and to protecting personal financial information. CryptoGraf Messaging complies with effective EU anti-terrorism legislation which mandates keeping call records to track criminal networks...without the need for intrusive wiretapping which can often be misused for politically partisan purposes or for economic gain.

There is an acute awareness among mobile device users of the increased amount of theft and loss of devices. Several youth also realise the value of keeping their personal communications away from prying eyes. With CryptoGraf Messaging, users need not worry about loss of important business or personal communications on their handsets.

Users can also send an SMS based Invite so their contacts can download CryptoGraf Messaging v2.0 over the air and use the Free Version with no time limit. This SMS based Invite differs from the current wave of mobile advertising which is often perceived as unsolicited spam.

The helpless mobile subscriber has no way to opt out of receiving mobile ads...they're not even asked about our preferences. I'm very frustrated each time I use GPRS or even send an MMS only to start getting mobile ads at unpredictable times of the day.

The SMS based Invite to download and use CryptoGraf Messaging is more effective since subscribers who initiate the invitation are well positioned to know that the recipient will accept it as an informative message.

CryptoGraf Messaging allows users to generate very secure encryption keys by selecting an image from their camera phone. Random pixels from the selected image are used in combination to result in a highly secure encryption key.

The user experience of CryptoGraf Messaging is simple when encrypting messages to send. The sender simply composes the message, selects the recipient and presses "send”…and CryptoGraf Messaging automatically encrypts the message with the recipient's public key. When the message arrives at the recipient's phone, the encrypted message can only be read when recipient uses CryptoGraf Messaging. So a Free Version, with no time limit, is also available for users to correspond with 2 contacts.

Features:
- Securely Encrypt SMS and MMS with CryptoGraf Messaging
- Peer to Peer Encryption, without any servers needed
- Secure international roaming for mobile users
- Text SMS and MMS in any language (supported by phone)
- Change SIM cards and still keep communications private
- MMS includes text, image, sound and video clips
- Easy to use with mobile Messaging App’s Inbox, Sent and Other Folders
- Prevent snoopers and thieves from reading private messages on your mobile
- Prevent wire-tappers and operators from scanning your private messages
- English, German, Spanish and Thai localised menus and dialogs
- Send SMS Invites for your contacts to download and use the Free Version
- Free Version (no time limit) for secure communication with 2 contacts
- Purchase CryptoGraf Activation Code to communicate with more contacts

The Most Secure Crypto (Technical Info):
- P2P Secure Public Key (Crypto Contact) Exchange
- RSA Crypto Key size 1024 or 2048 bits for Encryption
- AES Crypto Key size 256 bits for Encryption
- SHA256 with RSA Digital Signature
- X.509 Standard Secure Public Key Digital Certificate (Crypto Contacts)

Security Mobility Usability:
- Randomizer of Crypto Keys uses images from mobile phone gallery
- Exchange Crypto Contacts by bluetooth, sms or mms
- Forward Crypto Contacts
- Backup or Restore private Crypto Profile
- Export or Import X.509 Public Key Digital Certificates