FBI agent tries to copyright super-secret torture manual, inadvertently makes it public

The ACLU has spent years in court trying to get a look at a top-secret FBI interrogation manual that referred to the CIA’s notorious KUBARK torture manual. The FBI released a heavily redacted version at one point — so redacted as to be useless for determining whether its recommendations were constitutional. However, it turns out that the FBI agent who wrote the manual sent a copy to the Library of Congress in order to register a copyright in it — in his name! (Government documents are not copyrightable, but even if they were, the copyright would vest with the agent’s employer, not the agent himself). A Mother Jones reporter discovered the unredacted manual at the Library of Congress last week, and tipped off the ACLU about it. Anyone can inspect the manual on request. Go see for yourself! The 70-plus-page manual ended up in the Library of Congress, thanks to its author, an FBI official who made an unexplainable mistake. This FBI supervisory special agent, who once worked as a unit chief in the FBI’s counterterrorism division, registered a copyright for the manual in 2010 and deposited a copy with the US Copyright Office, where members of the public can inspect it upon request. What’s particularly strange about this episode is that government documents cannot be copyrighted. “A document that has not been released does not even need a copyright,” says Steven Aftergood, a government secrecy expert at the Federation of American Scientists. “Who is going to plagiarize from it? Even if you wanted to, you couldn’t violate the copyright because you don’t have the document. It isn’t available.” “The whole thing is a comedy of errors,” he adds. “It sounds like gross incompetence and ignorance.” Julian Sanchez, a fellow with the libertarian Cato Institute who has studied copyright policy, was harsher: “Do they not cover this in orientation? [Sensitive] documents should not be placed in public repositories—and, by the way, aren’t copyrightable. How do you even get a clearance without knowing this stuff?” You’ll Never Guess Where This FBI Agent Left a Secret Interrogation Manual [Nick Baumann/Mother Jones] ( via Techdirt ) ( Image: FBI , a Creative Commons Attribution Share-Alike (2.0) image from 10542402@N06’s photostream )        

Read More:
FBI agent tries to copyright super-secret torture manual, inadvertently makes it public

Android gives you the ability to deny your sensitive data to apps

Android privacy just got a lot better. The 4.3 version of Google’s mobile operating system now has hooks that allow you to override the permissions requested by the apps you install. So if you download a flashlight app that wants to harvest your location and phone ID , you can install it, and then use an app like AppOps Launcher to tell Android to withhold the information. Peter Ecklersley, a staff technologist at the Electronic Frontier Foundation, has written up a good explanation of how this works , and he attributes the decision to competitive pressure from Ios, which allows users to deny location data to apps, even if they “require” it during the installation process. I think that’s right, but not the whole story: Android has also always labored under competitive pressure from its free/open forks, like Cyanogenmod. In the days when Android didn’t allow tethering (as a sop to the mobile carriers, who are the gatekeepers to new phones for many people), Cyanogenmod signed up large numbers of users, simply by adding this functionality . Google added tethering to Android within a couple of versions. Some versions of Cyanogenmod have had the option tell your phone to lie to apps about its identity, location, and other sensitive information — a way to get around the “all or nothing” installation process whereby your the apps you install non-negotiably demand your “permission” to plunder this information. I’m not surprised to see the same feature moving into the main branch of Android. This dynamic is fascinating to me: Google has to balance all kinds of priorities in rolling out features and “anti-features” (no tethering, non-negotiable permissions) in Android, in order to please customers, carriers and developers. Free/open forks like Cyanogenmod really only need to please themselves and their users, and don’t have to worry so much about these other pressures (though now that Cyanogenmod is a commercial operation , they’ll probably need to start playing nice with carriers). But because Android competes with Cyanogenmod and the other open versions, Google can’t afford to ignore the featureset that makes them better than the official version. It’s a unique, and extremely beneficial outflow of the hybrid free/commercial Android ecosystem. In the early days, that model was at an improvement on its major competitor, Apple’s iOS, which didn’t even have a permissions model. But after various privacy scandals, Apple started forcing apps to ask for permission to collect data: first location and then other categories, like address books and photos. So for the past two years, the iPhone’s app privacy options have been miles ahead of Android’s. This changed with the release of Android 4.3, which added awesome new OS features to enhance privacy protection. You can unlock this functionality by installing a tool like App Ops Launcher. When you run it, you can easily control most of the privacy-threatening permissions your apps have tried to obtain. Want to install Shazam without having it track your location? Easy. Want to install SideCar without letting it read your address book? Done.2 Despite being overdue and not quite complete, App Ops Launcher is a huge advance in Android privacy. Its availability means Android 4.3+ a necessity for anyone who wants to use the OS while limiting how intrusive those apps can be. The Android team at Google deserves praise for giving users more control of the data that others can snatch from their pockets. Awesome Privacy Tools in Android 4.3+        

Continue reading here:
Android gives you the ability to deny your sensitive data to apps

Pee-Wee Herman talks about the remastered Christmas Special and Playhouse episodes

Kembrew writes, “I saw your post in Boing Boing today about Pee-Wee, and coincidentally, I just published a piece on Pee-wee’s Christmas Special . I think it’s the first time Paul Reubens has been interviewed about the upcoming remastered Pee-wee’s Playhouse DVDs that will come out next year.” I previously invoked the term “eye-popping” to describe Pee-wee’s Playhouse, but starting next year, viewers will run the risk of having their eyeballs permanently dislodged from their sockets. “The Christmas Special is going to come out, along with the entire Playhouse series, on Blu-ray,” Reubens tells me. “It’s being remastered now.” “The show was never seen on film,” he says. “The show was shot on film and transferred to tape and edited on tape, and all the effects were done on tape. Then the entire show was put on another tape to broadcast, so there are three or four generations of quality that are lost on every episode. So we went back to the original film elements, and the company I’m working with has recreated every edit in every single show, and recreated all the effects from all the original elements—which we were lucky to have kept.” “It looks unbelievable. It’s so extreme, people are going to freak out when they see it,” Reubens adds. “The detail and clarity and color is amazing.” This means that Gary Panter’s set design, the stop motion animation and other details will come alive in psychedelic high definition. It’s the kids show equivalent of being upgraded from cough syrup to mescaline. Pee-wee’s (remastered) Christmas Adventure: An interview with Paul Reubens [Kembrew McLeod/Little Village]        

See original article:
Pee-Wee Herman talks about the remastered Christmas Special and Playhouse episodes

FreeBSD won’t use Intel & Via’s hardware random number generators, believes NSA has compromised them

The maintainers of the security-conscious FreeBSD operating system have declared that they will no longer rely on the random number generators in Intel and Via’s chips , on the grounds that the NSA likely has weakened these opaque hardware systems in order to ease surveillance. The decision is tied to the revelations of the BULLRUN/EDGEHILL programs, wherein the NSA and GCHQ spend $250M/year sabotaging security in standards, operating systems, software, and networks. “For 10, we are going to backtrack and remove RDRAND and Padlock backends and feed them into Yarrow instead of delivering their output directly to /dev/random,” FreeBSD developers said. “It will still be possible to access hardware random number generators, that is, RDRAND, Padlock etc., directly by inline assembly or by using OpenSSL from userland, if required, but we cannot trust them any more.” In separate meeting minutes, developers specifically invoked Snowden’s name when discussing the change. “Edward Snowdon [sic] — v. high probability of backdoors in some (HW) RNGs,” the notes read, referring to hardware RNGs. Then, alluding to the Dual EC_DRBG RNG forged by the National Institute of Standards and Technology and said to contain an NSA-engineered backdoor, the notes read: “Including elliptic curve generator included in NIST. rdrand in ivbridge not implemented by Intel… Cannot trust HW RNGs to provide good entropy directly. (rdrand implemented in microcode. Intel will add opcode to go directly to HW.) This means partial revert of some work on rdrand and padlock.” “We cannot trust” Intel and Via’s chip-based crypto, FreeBSD developers say [Dan Goodin/Ars Technica]        

Read the original post:
FreeBSD won’t use Intel & Via’s hardware random number generators, believes NSA has compromised them

Spooks of Warcraft: how the NSA infiltrated gamespace

A new Snowden leak details how he NSA and GCHQ tasked its agents to infiltrate Second Life, World of Warcraft, and other MMOs to find jihadis and spy on them. The battalions of undercover orcs did indeed take much of gamespace, but there’s no evidence they ever spotted a plot. I was once questioned by members of an “unnamed branch of the State Department” at a games and public diplomacy event about the likelihood that jihadis were playing MMOs; and I said something like, “Sure, of course. Everyone plays MMOs.” I didn’t realize they’d take it all quite so much to heart. The absurdity of sending spies to infiltrate Warcraft can best be understood as a natural outflow of the doctrine that holds that if any two bad guys, anywhere in the world, can communicate in such a way that the NSA can’t listen in on them, all of society will crumble. Once you set yourself the insane task of eavesdropping on all conversations, everywhere, always, it’s inevitable that you’ll send Secret Squirrel and his pals to Azeroth. At the request of GCHQ, the NSA had begun a deliberate effort to extract World of Warcraft metadata from their troves of intelligence, and trying to link “accounts, characters and guilds” to Islamic extremism and arms dealing efforts. A later memo noted that among the game’s active subscribers were “telecom engineers, embassy drivers, scientists, the military and other intelligence agencies”. The UK agency did not stop at World of Warcraft, though: by September a memo noted GCHQ had “successfully been able to get the discussions between different game players on Xbox Live”. Meanwhile, the FBI, CIA, and the Defense Humint Service were all running human intelligence operations – undercover agents – within the virtual world of Second Life. In fact, so crowded were the virtual worlds with staff from the different agencies, that there was a need to try to “deconflict” their efforts – or, in other words, to make sure each agency wasn’t just duplicating what the others were doing. By the end of 2008, such human intelligence efforts had produced at least one usable piece of intelligence, according to the documents: following the successful takedown of a website used to trade stolen credit card details, the fraudsters moved to Second Life – and GCHQ followed, having gained their first “operational deployment” into the virtual world. This, they noted, put them in touch with an “avatar [game character] who helpfully volunteered information on the target group’s latest activities”. Second Life continued to occupy the intelligence agencies’ thoughts throughout 2009. One memo noted the game’s economy was “essentially unregulated” and so “will almost certainly be used as a venue for terrorist laundering and will, with certainty, be used for terrorist propaganda and recruitment”. Revealed: spy agencies’ covert push to infiltrate virtual world of online games [James Ball/The Guardian]        

See the article here:
Spooks of Warcraft: how the NSA infiltrated gamespace

Botnet of 20,000 point-of-sale machines

Details are emerging about Stardust, a piece of malicious software that targets point-of-sale credit-card processing machines. Stardust has reportedly compromised over 20,000 PoS machines and turned them into a easy-to-control botnet. The malware’s masters can monitor the botnet in realtime and issue fine-grained commands to its components, harvesting a titanic volume of payment card details. The discovery comes as researchers from a separate security firm called Arbor Networks published a blog post on Tuesday reporting an active PoS compromise campaign. The advisory is based on two servers found to be hosting Dexter and other PoS malware. Arbor researchers said the campaign looks to be most active in the Eastern Hemisphere. There was no mention of a botnet or of US restaurants or retailers being infected, so the report may be observing a campaign independent from the one found by IntelCrawler. It remains unclear how the attackers manage to initially infect PoS terminals and servers that make up the botnet. In the past, criminals have targeted known vulnerabilities in applications that many sellers of PoS software use to remotely administer customer systems. Weak administrator passwords, a failure to install security updates in a timely fashion, or unknown vulnerabilities in the PoS applications themselves are also possibilities. Credit card fraud comes of age with advances in point-of-sale botnets [Dan Goodin/Ars Technica]        

Read this article:
Botnet of 20,000 point-of-sale machines

Crowfunded prize for first open jailbreak of Ios 7

Elizabeth Stark writes, “We’re pleased to announce the Device Freedom Prize : a crowdfunded reward for the first developer(s) who release an open source iOS 7 jailbreak. Providing users the ability to control their devices is crucial in an age where we’re increasingly dependent on our mobile phones. An open source jailbreak provides users the capability to install what they want on their own devices, the ability to audit the code they’re using to do so, and enables disabled users to more easily use their devices .” “We’ve assembled a judging panel of awesome folks that care a lot about these issues, including Boing Boing’s own Cory Doctorow; Kyle Wiens, CEO of iFixit; Biella Coleman, Professor and Author of Coding Freedom, and Chris Maury, Accessibility Advocate. Contribute to the prize to help make an open source iOS jailbreak a reality.” Is iOS7 jailbroken yet? ( Thanks, Elizabeth ! )        

Taken from:
Crowfunded prize for first open jailbreak of Ios 7

Apps come bundled with secret Bitcoin mining programs, paper over the practice with EULAs

Researchers at Malwarebytes have discovered that some programs covertly install Bitcoin-mining software on users’ computers , papering over the practice by including sneaky language in their license agreements allowing for “computer calculations, security.” The malicious programs include YourFreeProxy from Mutual Public, AKA We Build Toolbars, LLC, AKA WBT. YourFreeProxy comes with a program called Monitor.exe, which repeatedly phones home to WBT, eventually silently downloading and installing a Bitcoin mining program called “jhProtominer.” So now that we have proof that a PUP is installing miners on users systems, do they do it without ever letting the user know? Well not exactly, their EULA specifically covers a section on Computer Calculations: COMPUTER CALCULATIONS, SECURITY: as part of downloading a Mutual Public, your computer may do mathematical calculations for our affiliated networks to confirm transactions and increase security. Any rewards or fees collected by WBT or our affiliates are the sole property of WBT and our affiliates. Their explanation is basically the purpose of Bitcoin Miners and that they will install this software on the system, run it, use up your system resources and finally keep all rewards from the effort YOUR system puts in. Talk about sneaky. In my opinion, PUPs have gone to a new low with the inclusion of this type of scheme, they already collected information on your browsing and purchasing habits with search toolbars and redirectors. They assault users with pop-up ads and unnecessary software to make a buck from their affiliates. Now they are just putting the nails in the coffin by stealing resources and driving user systems to the grave. Potentially Unwanted Miners – Toolbar Peddlers Use Your System To Make BTC [Adam Kujawa/Malwarebytes] ( via /. )        

Originally posted here:
Apps come bundled with secret Bitcoin mining programs, paper over the practice with EULAs

New CC licenses: tighter, shorter, more readable, more global

Creative Commons has released version 4.0 of its sharing-friendly, easy-to-use copyright licenses . The new licenses represent a significant improvement over earlier versions. They work in over 60 jurisdictions out of the box, without having to choose different versions depending on which country you’re in; they’re more clearly worded; they eliminate confusion over jurisdiction-specific rights like the European database right and moral rights. They clarify how license users are meant to attribute the works they use; provide for anonymity in license use; and give license users a 30 day window to correct violations, making enforcement simpler. Amazingly, they’re also shorter than the previous licenses, and easier to read, to boot. 30-day window to correct license violations All CC licenses terminate when a licensee breaks their terms, but under 4.0, a licensee’s rights are reinstated automatically if she corrects a breach within 30 days of discovering it. The cure period in version 4.0 resembles similar provisions in a some other public licenses and better reflects how licensors and licensees resolve compliance issues in practice. It also assures users that provided they act promptly, they can continue using the CC-licensed work without worry that they may have lost their rights permanently. Increased readability The 4.0 license suite is decidedly easier to read and understand than prior versions, not to mention much shorter and better organized. The simplified license structure and use of plain language whenever possible increases the likelihood that licensors and reusers will understand their rights and obligations. This improves enforceability of the licenses and reduces confusion and disagreement about how the licenses operate. Clarity about adaptations The BY and BY-NC 4.0 licenses are clearer about how adaptations are to be licensed, a source of confusion for some under the earlier versions of those licenses. These licenses now clarify that you can apply any license to your contributions you want so long as your license doesn’t prevent users of the remix from complying with the original license. While this is how 3.0 and earlier versions are understood, the 4.0 licenses make it abundantly clear and will help remixers in understanding their licensing obligations. What’s New in 4.0        

More:
New CC licenses: tighter, shorter, more readable, more global

LED stickers: turn your notebook into a lightshow

Noah Swartz writes, “Jie Qi from the MIT Media Lab and Bunnie Huang of Hacking the Xbox fame have teamed up to make LED stickers! Using adhesive copper tape you can turn any notebook into a fantastical light up circuit sketchbook. I got to play with them myself at FOO Camp and they’re as easy to use as the look, and in the time since Ji and Bunnie have gone back to the lab and made a number of sensor and controller stickerss that give you loads of options of what to make. They’re running a fundraiser to do a big production run of these over at Crowdsupply, and while they have funding I’m sure lots of people will be kicking themselves if they don’t manage to grab some of these while they can.” Circuit Stickers ( Thanks, Noah! )        

View original post here:
LED stickers: turn your notebook into a lightshow