A Cypherpunk’s Manifesto

Eric Hughes
Activism.net

Privacy is necessary for an open society in the electronic age. Privacy is not secrecy.  A private matter is something one doesn’t want the whole world to know, but a secret matter is something one doesn’t want anybody to know. Privacy is the power to selectively reveal oneself to the world.

If two parties have some sort of dealings, then each has a memory of their interaction.  Each party can speak about their own memory of this; how could anyone prevent it?  One could pass laws against it, but the freedom of speech, even more than privacy, is fundamental to an open society; we seek not to restrict any speech at all.  If many parties speak together in the same forum, each can speak to all the others and aggregate together knowledge about individuals and other parties.  The power of electronic communications has enabled such group speech, and it will not go away merely because we might want it to.

Since we desire privacy, we must ensure that each party to a transaction have knowledge only of that which is directly necessary for that transaction.  Since any information can be spoken of, we must ensure that we reveal as little as possible.  In most cases personal identity is not salient. When I purchase a magazine at a store and hand cash to the clerk, there is no need to know who I am.  When I ask my electronic mail provider to send and receive messages, my provider need not know to whom I am speaking or what I am saying or what others are saying to me;  my provider only need know how to get the message there and how much I owe them in fees.  When my identity is revealed by the underlying mechanism of the transaction, I have no privacy.  I cannot here selectively reveal myself; I must always reveal myself.

Therefore, privacy in an open society requires anonymous transaction systems.  Until now, cash has been the primary such system.  An anonymous transaction system is not a secret transaction system.  An anonymous system empowers individuals to reveal their identity when desired and only when desired; this is the essence of privacy.

Privacy in an open society also requires cryptography.  If I say something, I want it heard only by those for whom I intend it.  If  the content of my speech is available to the world, I have no privacy.  To encrypt is to indicate the desire for privacy, and to encrypt with weak cryptography is to indicate not too much desire for privacy.  Furthermore, to reveal one’s identity with assurance when the default is anonymity requires the cryptographic signature.

We cannot expect governments, corporations, or other large, faceless organizations to grant us privacy out of their beneficence.  It is to their advantage to speak of us, and  we should expect that they will speak.  To try to prevent their speech is to fight against the realities of information. Information does not just want to be free, it longs to be free.  Information expands to fill the available storage space.  Information is Rumor’s younger, stronger cousin; Information is fleeter of foot, has more eyes, knows more, and understands less than Rumor.

We must defend our own privacy if we expect to have any.  We must come together and create systems which allow anonymous transactions to take place.  People have been defending their own privacy for centuries with whispers, darkness, envelopes, closed doors, secret handshakes, and couriers.  The technologies of the past did not allow for strong privacy, but electronic technologies do.

We the Cypherpunks are dedicated to building anonymous systems.  We are defending our privacy with cryptography, with anonymous mail forwarding systems, with digital signatures, and with electronic money.

Read More

facebooktwittergoogle_plusredditpinterest

In Reaction To Swedish Riots and Privacy Concerns, Instagram Makes Advertising U-turn

21st Century Wire says… In a direct reaction to the mayhem caused by Facebook and Instagram’s data free-for-all, pressure is being applied to the digital moguls to claw back previous plans to use children and adult pictures for commercial marketing and advertising applications. Ronan Shields Dec 21, 2012 Instagram has reverted to its original advertising terms and conditions in a move to quell unrest prompted by an earlier update to its advertising policies. The U-turn was prompted by mass unrest following an update to its terms and conditions, announced Monday (17 December), which led users of the photo-sharing site to believe that their images would be included in third-party advertising on the service. Social media channels were flooded with angry comments, with many people deleting their accounts in protest to the development. The backlash prompted Instagram co-founder Kevin Systrom to claim there had been a “misunderstanding” and that it would further modify its usage terms to clarify the matter. In a blog post published yesterday (20 December), Systrom said: “Because of the feedback we have heard from you, we are reverting this advertising section to the original version that has been in effect since we launched the service in October 2010.” Systrom goes on to say that Instagram would take time to complete its plans regarding advertising rather than “obtain permission from you to introduce possible advertising products we have not yet developed” in the post. It continues: “Finally, there was also confusion about how widely shared and distributed your photos are through our service. The distribution of your content and photos is governed by our privacy policy, and always has been. We have made a small change to our terms to make that as clear as possible.” Source: Marketing Weekfacebooktwittergoogle_plusredditpinterest

Facebook To Fight Germany’s Demand of Anonymity for Its Users

AP/Washington Post BERLIN — Facebook will fight a German privacy watchdog’s demand to allow users to register with fake names, insisting Tuesday that its current practice fully complies with the law. The California-based social networking site has long required users to register with their real names — a policy that the data protection commissioner of Schleswig-Holstein state says is in breach of German law and European rules designed to protect free speech online. The commissioner, Thilo Weichert, ordered Facebook on Monday to rescind its real name policy immediately. “We believe the orders are without merit, a waste of German taxpayers’ money and we will fight it vigorously,” Facebook said in a statement. The company claims that its real name policy is intended to protect users. Weichert told The Associated Press that Facebook has two weeks to respond. If it fails to comply with the order, his office can impose a penalty against the company, said Weichert. The maximum fine would be only €50,000 ($66,000) — peanuts for a multinational company, but nevertheless a symbolic blow that could also lead to a tougher stance from other German and European privacy regulators. “We have the right to prevent this data protection breach,” he said. “Theoretically we can order the website blocked, but that would be disproportionate.” German privacy rules have posed a legal headache for Facebook, Google and other web giants in recent years. The country has strict laws on data protection that give consumers significant rights to limit the way companies use their information. Weichert has previously warned investors against buying Facebook shares, warning that the company’s “business model will implode” because Facebook users’ private information is used in breach of European law. Read more  facebooktwittergoogle_plusredditpinterest

Facebook and Instagram’s New Ad Policy Change ‘Could Compromise Privacy for Teens’

21st Century Wire says… this story appeared only yesterday in the Washington Post, and it’s uncanny how neatly this ties into the Instagram riots in Sweden on the same day. It would be uncanny – unless you believe that’s it’s part of a larger step by step plan. Hegelian dialectic: Problem+Reaction=Solution… their solution, of course. This latest artificial crisis was created by the corporations behind closed doors, who have now created digital cartels between many of these platforms online. The solution will be some form of global governance-administered restriction of privacy or anonymity online. There would be no crisis if the corporations were not so hell-bent on using people’s photographs and data as free content for generating ads no one needs… Washington Post Brian Womack (Bloomberg) – Facebook Inc.’s Instagram policy changes, announced yesterday, may let advertisers use teenagers’ photos for marketing, raising privacy and security concerns, said Jeffrey Chester, executive director for the Center for Digital Democracy. The new policies, which now apply to users as young as 13, enable Instagram, a photo-sharing service that Facebook bought in August, to use members’ names, text, photos and other content with marketing messages, the company said on its site. The new terms of use, set to take effect next month, could be exploitative, Chester said. Facebook, operator of the world’s largest social network with more than 1 billion users, is changing policies for its Instagram unit as it looks for ways to increase revenue across its services. Instagram, popular with teens and young adults, reached more than 100 million users, Facebook Chief Executive Officer Mark Zuckerberg said in September. Facebook “sees teens as a digital goldmine,” said Chester, whose group is focused on privacy issues. “We will be pressing the Federal Trade Commission to issue policies to protect teen privacy.” If users are younger than 18, then they “represent” that at least one parent or guardian has also agreed to content being used in marketing, according to the updated usage terms. The changes are aimed at protecting members while preventing abuse, Instagram said in a blog. In the updated policy document, Instagram also said it may not always identify paid services or sponsored content. The company said it doesn’t claim ownership of any content on the service, though some businesses may pay to display users’ names, likeness or photos in connection with sponsored content. “Our updated privacy policy helps Instagram function more easily as part of Facebook by being able to share info between the two groups,” the company said. “This means we can do things like fight spam more effectively, detect system and reliability problems more quickly, and build better features for everyone by understanding how Instagram is used.” Read morefacebooktwittergoogle_plusredditpinterest

European Regulator Forces Facebook to Change Its Data Policy

By Laura O’Reilly The privacy watchdog responsible for regulating Facebook in Europe is understood to have forced the social network to change one of its latest proposed policies that would see it blend user data with that of ‘Instagram’. The Irish Data Protection Commissioner (DPC), which presides over the social network’s European headquarters in Dublin, says it expects Facebook’s proposed data use policy to be modified to allow users a greater level of consent over the way their actions and content on the site can be used by the company. A spokeswoman at the Irish DPC told technology blog The Register: “We have sought and received clarifications on a number of aspects and have outlined our position in relation to what consent will be required for aspects of the policy.” It is not yet clear the exact aspects of the policy Facebook has agreed to change, but it is thought to relate to the Instagram data share proposals. Facebook was hoping that by combining data from its platform and the photo sharing app it acquired earlier this year would be able to help the company offer brands more targeted advertising opportunities. The social network said in a statement last week when it first emerged the Irish DPC had contacted the company: “We are in regular contact with our regulators to ensure that we maintain high standards of transparency in respect of our policies and practices. We expect to maintain a continuous dialogue with the Irish DPC as our service evolves.” Facebook’s proposals to combine its user data with that of Instagram have also been opposed by two privacy campaign groups – The Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy (CDD) – which wrote a joint letter requesting the company reconsiders the amends to its policy. They also object to Facebook’s plans to stop users’ ability to vote on changes to its privacy policy, which it has allowed since 2009 for any change that attracts at least 7,000 comments. It is also looking to change users’ inbox default settings, which could lead to members receiving more unwanted messages from other users or spam from companies. The letter says: “Because these proposed changes raise privacy risks for users, maybe contrary to law, and violate your previous commitments to users about site governance, we urge you to withdraw the proposed changes.” In the UK, the Open Rights Group is writing to the Information Commissioner’s Office to ask it to examine the changes in Facebook’s privacy policy and act on them in a similar way to other data protection authorities elsewhere. In April Facebook reached a settlement with the US Federal Trade Commission over claims it had deceived users into sharing more information than they realised. Under the settlement, Facebook must obtain user consent for significant changes to its privacy settings and must commit to 20 years of independent audits.facebooktwittergoogle_plusredditpinterest

Disgracebook Diaries: Facebook Privacy Chain Letter Resurfaces

Hayley Tsukayama Washington Post

Hoaxes are hard things to put down — particularly when they seem to offer something that people want. to hear. Such is the case with the latest Facebook hoax, actually a rehash of one that cropped up in June, that claims users can change their copyright rights by simply posting a status message. The post illustrates both how little users know about their digital rights and how much they want clear control over content they post to Facebook. The statement, which users are copying and pasting onto their profiles, reportedly confers copyright privileges to individual Facebook users that are different than the ones they agreed to when using the service. Under the network’s terms and conditions, users grant Facebook the right to use, distribute and share posted items subject to its terms of service and user privacy settings. Copying and pasting a status update doesn’t change anything about that agreement. It should go without saying that users have to abide by the terms and conditions they agreed to when they signed up for the site, and even posting something replete with legal jargon doesn’t let you alter that agreement. As Sophos’ Chet Wisniewskiwrote in June: “These messages are simply another chain letter type hoax pinned upon wishful thinking.” If you want to limit what Facebook can share about you, there are two main things that you can do: be aware of the privacy settings you put on your pictures and thoughts and limit the things that you post. Facebook did recently propose changes to its privacy policy, known on the network as a data use policy by updating language dealing with how the network can share user information. According to the changes, Facebook can obtain data about users from affiliates and advertising partners to ”improve the quality of ads” shown on the site. The company is also pulling back the ability for users to vote on changes to the privacy policy — a policy the company introduced in 2009 that never seemed to catch on with its users. Facebook users have until noon Wednesday to weigh in on the changes. Facebook’s chief privacy officer, Erin Egan, will address suggestions about the proposal once the comment period is over. Note: The Washington Post Co.’s chairman and chief executive, Donald E. Graham, is a member of Facebook’s board of directors.facebooktwittergoogle_plusredditpinterest

ANDROID TROJAN HORSE CAN RECORD YOUR PHONE CALLS

CA security team finds more advanced Android malware .

By Jon Brodkin Network World August 02, 2011  
 
A new Android Trojan is capable of recording phone conversations, according to a CA security researcher. While a previous Trojan found by CA logged the details of incoming and outgoing phone calls and the call duration, the malware identified this week records the actual phone conversations in AMR format and stores the recordings on the device’s SD card.

BACK DOOR: Mobile Trojan malware can record your most private conversations.

The malware also “drops a ‘configuration’ file that contains key information about the remote server and the parameters,” CA security researcher Dinesh Venkatesan writes in a blog, perhaps suggesting that the recorded calls can be uploaded to a server maintained by an attacker. TARGET: Malware writers gunning for Google Android Venkatesan tested the Trojan in “a controlled environment with two mobile emulators running along with simulated Internet services,” and posted screenshots with the results. It appears the Trojan can only be installed if the Android device owner clicks the “install” button on a message that looks strikingly similar to the installation screens of legitimate applications. After the malware and the remote server configuration file are installed on the Android device, making a phone call “triggers the payload” — in other words, recording the call and storing it on the SD card. “As it is already widely acknowledged that this year is the year of mobile malware, we advice the smartphone users to be more logical and exercise the basic security principles while surfing and installing any applications,” Venkatesan writes. While Android provides more flexibility than the iPhone by allowing installation of third-party applications, even those that were not approved for the Android Market, this freedom seems to come with increased security risk. Malware-infected applications have also been found in the Android Market itself, but users can protect themselves by installing antivirus software, just as they would on a PC. Follow Jon Brodkin on Twitter: www.twitter.com/jbrodkin Read more about security in Network World’s Security section.
facebooktwittergoogle_plusredditpinterest