Thursday, February 22, 2007

Feinstein to GAO: Investigate E-voting System. Feinstein to GAO: Investigate E-voting System. During the 2006 election in Florida, electronic voting machines may have "undercounted" to the tune of 18,000 votes in Sarasota County. But because the new machines were not designed to provide paper receipts, there is no way to double check the vote. Now, Senator Dianne Feinstein of California has taken action. Last week, she asked the Government Accountability Office (GAO) to investigate electronic voting systems that do not provide voter-verified paper ballots. Senator Feinstein specifically highlighted the problems in Florida, and asked for a "top to bottom investigation" "Should the GAO become aware of any systems that are prone to software malfunctions, are susceptible to fraud, or use hardware design that would lead to voting system problems, I would request that you also inspect those systems," writes Senator Feinstein. EFF and a coalition of voting integrity groups, representing Sarasota County voters, have filed suit in state court in Tallahassee asking for a re-vote in Florida's 13th congressional district. To find out more about EFF's work defending your right to vote, visit our E-voting page. [EFF: Deep Links] 11:56:31 AM  PermaLink   / trackback []

AT&T Whistleblower Wins Award. AT&T Whistleblower Wins Award. Whistleblower Mark Klein will get some well-deserved acknowledgement when he receives a James Madison Freedom of Information Award next month. The award could hardly find a more deserving recipient [~] Klein is the former AT&T technician who exposed the extent of the government's warrantless wiretapping program In early 2006, Klein came forward with internal AT&T documents that show the company cooperated with the NSA's secret program to eavesdrop on internet communications, in violation of federal wiretapping laws and the Fourth Amendment. Klein's evidence demonstrates that in at least one of AT&T's facilities, internet traffic was diverted to a secret, secure room to which only the NSA had access. All of the documents have been used in EFF's court case, which is currently under review by the Ninth Circuit Court of Appeals and a portion have been made broadly available on the internet since April, 2006. In the words of EFF Staff Attorney Kurt Opsahl, Klein is [base "]a true American hero.[per thou] This public recognition of his bravery in defense of the public's right to know is richly deserved. [EFF: Deep Links] 11:28:40 AM  PermaLink   / trackback []

Music moguls seek security blanket - Los Angeles Times One way to judge the music industry's troubles is to watch annual sales figures for CDs, which have slumped 25% since 2000. But it's more revealing to chart how the major record companies' attitudes about new business models online have been shifting. At first the shifts were almost too small to notice, as when the labels started making a handful of downloadable songs available for $2.50 or more. But as the file-sharing phenomenon grew and CD sales slipped, the changes became more pronounced. The labels started offering the rights to songs on terms that didn't cripple their online partners. They embraced Apple's iTunes Music Store, whose anti-piracy technology doesn't actually limit copying. They cut deals with file-sharing companies for subscription services that let users share the songs they rented. Along the way, though, the major labels adamantly refused to do the kind of deal necessary to replicate what the original Napster, Kazaa and eDonkey had provided: they would not accept a flat fee a "blanket" license that lets Internet service providers sell an all-you-can-eat sonic buffet, enabling customers to download, burn and swap as much as they pleased. The rights would be included in the cost of a high-speed Internet access line, so the downloads would seem free while still generating royalties for artists, songwriters, labels and publishers. That reticence may be giving way, too, thanks to the relentless decline in revenue. Just look at what the head of the major record companies' global trade group, let slip last month at a music-industry gathering in France. If Internet service providers "want to come to us and look for a blanket license for an amount per month," IFPI chief John Kennedy said, "let's engage in that discussion." His U.S. counterpart, Mitch Bainwol of the Recording Industry Assn. of America (RIAA), quickly added that the licenses should be negotiated voluntarily, not compelled by the government. So that part of the labels' thinking hasn't changed. Nevertheless, Kennedy's remark reflects a potential sea change in the way the record companies do business. If the labels follow through, it could trigger the greatest explosion in innovation since engineers at the Fraunhofer Institute in Germany developed the MP3 format.   That's a big "if," but two of the four majors have already taken the first step. In England, a venture called PlayLouder MSP is negotiating deals with record companies and music publishers for a competitively priced high-speed Internet access service that will include the right to download millions of songs, transfer them to portable devices and share them with friends. The main restriction is that subscribers can't send songs to people who aren't customers of PlayLouder MSP. In other words, it's a private electronic playground for music lovers. The company, which expects to launch its service this year, plans to put a chunk of the monthly service charges into a royalty pool that would be divided according to popularity--the more often a song is downloaded, the larger the share of the pool that its copyright holders will receive. To monitor the network and enforce its borders, PlayLouder MSP relies on technology that can identify songs as they pass through the network--and, if necessary, block them. So far, several large independent labels from the U.S. and the U.K. have agreed to let the company offer MP3s of all their songs, while two of the majors, Sony BMG and EMI, have agreed to supply songs wrapped in electronic locks. Those locks won't make much difference, though; as part of the deal, subscribers will be free to share MP3s from all of PlayLouder MSP's partners, including Sony BMG and EMI. 11:24:50 AM  PermaLink   / trackback []

LA Times: Start Blanket Licensing, Stop Blanket Lawsuits. LA Times: Start Blanket Licensing, Stop Blanket Lawsuits. The major record labels have stayed the course for the last five years with predictable results -- they've stuck by DRM, ratcheted up their file sharing lawsuit campaign, and let revenues continue to slide. Today, the LA Times suggests some reasons to think the labels may finally be coming around to a sensible solution that EFF has long advocated -- blanket licenses for music fans to share as much music as they like for a flat monthly fee. "If Internet service providers 'want to come to us and look for a blanket license for an amount per month,' IFPI chief John Kennedy said, 'let's engage in that discussion....' In the past, label executives made three main arguments against the blanket-licensing concept: it turned their companies into glorified marketing firms; it forced labels to fight over a fixed pool of dollars, so that one artist's gain was another one's loss; and there wouldn't be enough money in the pool to replace all the CD sales that would be lost. The first two complaints get little mention today; instead, the make-or-break issue for blanket-licensing deals is the amount of royalties the service can generate." "That's the right focus. Blanket licensing wouldn't transform labels into advertising companies; the only element of their business they would lose is the part that distributes plastic discs, and that's going away anyway. When consumers can choose from a virtually unlimited supply of songs, the ability of a label to find, sign and promote the most compelling artists will be even more important than it is today. And the fees that consumers pay for downloading rights represent only a portion of the money [that blanket licensing] could generate for copyright holders. There's also money to be made from advertisers, mobile phone companies, device makers and premium music services that want to insert themselves into the network." As we point out in our white paper about blanket licensing, even a small monthly fee from the millions of American filesharers could provide more profit than the industry has ever seen. Unfortunately, the record labels haven't done a complete 180 from their backward-thinking ways. For instance, the labels seem eager to coopt ISPs into helping push their file sharing lawsuit campaign even further, and the AP reports that the labels have radically increased their copyright notices aimed at college students. Neither of these actions will put a dime in artists' pockets or get the labels any closer to a real solution. The LA Times story closes by saying, "You have to wonder how low [major label revenues] have to go before blanket licenses look like a better approach than blanket lawsuits." To put it another way: how much longer do ordinary music fans and innovators have to be treated like criminals before a better way forward is finally pursued? [EFF: Deep Links] 11:19:11 AM  PermaLink   / trackback []

From the Unmitigated Gall Department. From the Unmitigated Gall Department. How is it that the National Association of Broadcasters, which is seeking regulatory relief from current media ownership caps, has the gumption to criticize the proposed merger of XM Satellite Radio and Sirius Satellite Radio? Their statement following the announced merger can be found here, but this is the part I like best: When the FCC authorized satellite radio, it specifically found that the public would be served best by two competitive nationwide systems. Now, with their stock price at rock bottom and their business model in disarray[sigma]they seek a government bail-out to avoid competing in the marketplace. read more [Public Knowledge - Blogging, Events, and Action Alerts] 11:15:31 AM  PermaLink   / trackback []

Microsoft to Tighten Anti-Piracy Noose in Vista. Microsoft to Tighten Anti-Piracy Noose in Vista. In response to "overly optimistic" sales forecasts for its Vista operating system, Microsoft Corp. plans to "dial up" the anti-piracy technology built into this latest version of Windows. No doubt this move will boost Microsoft's sales to some degree, but if previous experience with Microsoft's anti-piracy methods in Windows XP is any indicator, this new effort is just as likely to alienate or anger many legitimate users. CEO Steve Ballmer revealed the anti-piracy plans in a conference call with Wall Street financial analysts last week, according to this Computerworld article. "'One way Microsoft can bump up Windows sales is to tighten the screws on pirates,' Ballmer said. "Piracy reduction can be a source of Windows revenue growth, and I think we'll make some piracy improvements this year." The Computerworld story says the expansion of the Windows Genuine Advantage plan is part of an effort to squeeze more revenue from China, India, Brazil, Russia and other emerging markets. Online PC help forums are littered with reports from legitimate Windows users who have been errantly flagged as software pirates by Microsoft, so here's hoping that the company can iron out some of the kinks in its anti-piracy detection and reporting technology. [Security Fix] 11:10:50 AM  PermaLink   / trackback []

Serious Flaw in Google Desktop Prompts Patch. Serious Flaw in Google Desktop Prompts Patch. Search engine giant Google has issued an update for people running its powerful Desktop software. Researchers had demonstrated a potentially devastating security hole in the software that could allow bad guys to snoop on users' computers or even to install additional software. For the uninitiated, Google Desktop is free software that sits on your computer and indexes your e-mail, chat conversations, documents and previous Web searches to make them easy to find. But according to a discovery last year by Waltham, Mass., security company Watchfire, attackers could hijack a user's sensitive data in older versions of the software. This flaw appears to be quite dangerous, but the mechanics of it and the steps the bad guys would need to take seem complicated. Anyone who wants to learn more about this flaw should check out Watchfire's research paper here. There also is a longish video that provides a real-world example of how an attack could work. I've always expected someone to discover a vulnerability like this. I've almost avoided installing the program entirely because of these concerns. But my need to quickly find files on my machine won out, as Microsoft's built-in Windows search capability is just too slow and ineffective. As Security Fix and others have noted, security is all about trade-offs. For the sake of productivity, this was one trade-off I was willing to make. The good news is that Google has shipped an update to close this security hole. The bad news is that users may need to jump through a few hoops to get the new version. I had some serious problems trying to update my installation of Google Desktop. No matter which option I tried, the program icon for Google Desktop in my Windows system tray stubbornly refused to respond. I had to dig into the Windows registry to find which version of the program I was running. According to Watchfire, any version of Google Desktop that is not version number 5.0.0701.30540 is vulnerable. The registry said my version was 3.2005.907.1757. I clearly needed to update. I was surprised to discover that I already had an application called Google Updater installed. However, it clearly had not updated for me. When I tried to run it, the program kept producing an error message saying it could not continue. Appropriately, I "Googled" for clues to the origin of the error message. I followed advice on Google Groups to temporarily disable the anti-virus software on my machine and close any browser windows. Nothing seemed to work. I ultimately had to completely reinstall Google Desktop and Google Updater. I then had to reboot to get the current version working properly. The latest version appears to have a function that will periodically check for and install updates as they are made available. I'm not sure whether the previous Google Updater had this option, and it isn't clear as to whether the new updater actually does what it says. Users who have to update their Google Updater as I did may find that Google has bundled the new Updater into its "Google Pack." It seems Google is perpetually in beta phase: Earlier today, when I first visited the Google Pack page while the older, non-working version of Google Updater was installed, I had to uncheck several software options that were pre-enabled in Google Pack. This included Google Earth, Google Screensaver Pack and a six-month trial of Symantec anti-virus software. Now, after installing the latest Google Updater, when I revisit that same page, the Symantec option is gone and none of the items are pre-checked. Curiously enough, Google also is offering Adobe Reader 7, which as any avid Security Fix reader already knows, is dangerously out of date. [Security Fix] 11:06:04 AM  PermaLink   / trackback []

'Hoax' stuns classical music world. 'Hoax' stuns classical music world. Joyce Hatto: the greatest pianist no-one has heard of Gramophone magazine has unearthed what one sound recording expert describes as "the biggest attempt at recording theft ever." [The Register - Music and Media] Editor: Sounds like a perfect example of GIGO (Garbage In Garbage Out). Remember, just because it's on a computer, doesn't mean that' it is accurate. 11:01:34 AM  PermaLink   / trackback []

Core CS & Core PS Network High-Level Security Requirements. Core CS & Core PS Network High-Level Security Requirements. Jamie Fisher submits this extensive white paper on mobile/cellular security network. By Jamie Fisher. [Infosec Writers Latest Security Papers] 10:58:10 AM  PermaLink   / trackback []

Judge Refuses to Release Critical Documents in AT&T Surveillance Case. Judge Refuses to Release Critical Documents in AT&T Surveillance Case. Klein Declaration and Other Internal Documents to Stay Sealed for Now San Francisco - A federal judge in San Francisco today denied requests from media groups to unseal critical evidence in the Electronic Frontier Foundation's (EFF's) class-action lawsuit against AT&T. EFF's suit accuses the telecom giant of collaborating with the National Security Agency (NSA) in illegal spying on millions of ordinary Americans. The sealed evidence includes a declaration by Mark Klein, a retired AT&T telecommunications technician, as well as several internal AT&T documents and portions of a declaration from EFF's expert witness. Some of the evidence was previously released in redacted form, while other evidence is still completely unavailable to the media and the public. "We're disappointed that the court did not choose to unseal all of the documents that include or refer to the evidence presented by Mark Klein and our expert, J. Scott Marcus. The government has already agreed that the evidence is neither classified nor a state secret, and is only being held under seal because of AT&T's weak trade secrecy claims," said Cindy Cohn, EFF's Legal Director. "Given that the privacy of millions of Americans is at stake, we strongly believe that the public would benefit from seeing this evidence for themselves." Today's order is in response to a December hearing on the sealing issue. U.S. District Court Judge Vaughn Walker granted the media groups' request to intervene in the case, and said that he might revisit the unsealing motion at a later date. For Judge Walker's full order: http://www.eff.org/legal/cases/att/order_media_unsealing.pdf For more on EFF's case against AT&T: http://www.eff.org/legal/cases/att/ Contacts: Cindy Cohn Legal Director Electronic Frontier Foundation cindy@eff.org Rebecca Jeschke Media Coordinator Electronic Frontier Foundation press@eff.org [EFF: Breaking News] 10:56:51 AM  PermaLink   / trackback []

Judge Denies Complete Stay in AT&T Surveillance Case. Judge Denies Complete Stay in AT&T Surveillance Case. Government and AT&T Cannot Freeze Proceedings During Appeal San Francisco - A federal judge today ruled that the Electronic Frontier Foundation (EFF) can go forward with elements of its class action lawsuit against AT&T for collaborating with the government on illegal spying in ordinary Americans -- despite the government and AT&T's request to freeze proceedings during an appeal. In his ruling, U.S. District Court Judge Vaughn Walker opened the door to beginning the discovery process, allowing EFF to ask "limited and targeted" questions as long as those questions do not overlap with the issues under consideration in the 9th U.S. Circuit Court of Appeals. "The government wanted to put this case in the deep freeze," said EFF Staff Attorney Kurt Opsahl. "Instead, the court has invited us to move forward with some targeted questions. We're glad to accept that invitation, which will allow progress while respecting the government's national security concerns." Judge Walker also refused to implement a blanket stay on the other telecommunications surveillance cases transferred to his court. He ruled that unless the parties stipulate to a stay, then "defendants will answer or otherwise respond to the complaint" by March 29. Earlier today, Judge Walker denied requests from media groups to unseal critical evidence in the AT&T case. "We're disappointed that the court did not choose to unseal all of the documents that include or refer to the evidence presented by Mark Klein and our expert, J. Scott Marcus. The government has already agreed that the evidence is neither classified nor a state secret, and is only being held under seal because of AT&T's weak trade secrecy claims," said Cindy Cohn, EFF's Legal Director. "Given that the privacy of millions of Americans is at stake, we strongly believe that the public would benefit from seeing this evidence for themselves." Judge Walker did grant the media groups' request to intervene, and said he might revisit the unsealing issue at a later date. For Judge Walker's full order: http://www.eff.org/legal/cases/att/stayorder220.pdf For more on EFF's case against AT&T: http://www.eff.org/legal/cases/att/ Contacts: Kurt Opsahl Staff Attorney Electronic Frontier Foundation kurt@eff.org Rebecca Jeschke Media Coordinator Electronic Frontier Foundation press@eff.org [EFF: Breaking News] 10:55:14 AM  PermaLink   / trackback []