[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Clips September 8, 2003



Clips September 8, 2003

Databases--the next copyright battle?
Museums Launch Database to Find Nazi Stolen Art
Fierce Fight Over Secrecy, Scope of Law [Patriot Act]
Arrest warrant issued for 'N.Y. Times' hacker
Wireless carriers draft a rights code for customers
PayAgent Aims to Curtail Identity Theft Online
Lawmakers grill top cyber official at Homeland Security
With Politeness, Easing the Pain of E-Mail Mishaps

*******************************
Reuters
Databases--the next copyright battle?
By Reuters
September 5, 2003, 2:50 PM PT

Lawmakers in the U.S. House of Representatives are circulating a proposed bill that would prevent wholesale copying of school guides, news archives and other databases that do not enjoy copyright protection.
The proposed bill would provide a legal umbrella for publishers of factual information such as courtroom decisions and professional directories. The measures would be similar to the copyright laws that protect music, novels and other creative works.

The bill has not yet been introduced, but the Judiciary Committee and the Energy and Commerce Committee will hold a joint hearing on the bill in the coming weeks, a Commerce Committee spokesman said.


Backers of the measure say it would allow database providers to protect themselves against those who simply cut and paste databases to resell them or to make them available for free online.

Violators could be shut down and forced to pay triple the damages incurred.

The U.S. Chamber of Commerce and consumer advocates said they plan to write letters of protest soon, arguing that the bill could dramatically limit the public's access to information. Database providers can protect themselves through terms-of-service agreements with their customers, said Joe Rubin, director of congressional and public affairs at the chamber.

"We think this is already dealt with under license and contract law, and there's no reason to extend beyond that," Rubin said.

Sometimes user agreements do not provide enough protection, said Keith Kupferschmid, a policy expert with the Software and Information Industry Association, which supports the bill.

In one instance, a Minnesota magazine publisher had no legal recourse when its entire directory of local schools was copied and redistributed. In other cases, operators of pornographic Web sites have copied real estate listings and lawyers' directories to lure in unwitting visitors, he said.

The law could help those who make information available for free online, Kupferschmid said. Reuters America, a unit of Reuters Group, is a member of the trade group.

"If database producers know they have some law to fall back on, when someone steals their database, they'll be much more willing to get that information out there for free," he said. "Without that law, there's really nothing to protect them."

Mike Godwin, senior technology counsel at the nonprofit group Public Knowledge, said the bill would likely make information less freely available.

"Information, when not copyrighted, is something that can be shared. Once you start putting fences around information...there's no freedom of inquiry," said Godwin.

"That doesn't make us smarter, it makes us dumber," he said.
*******************************
Washington Post
Museums Launch Database to Find Nazi Stolen Art
By Jacqueline Trescott
Monday, September 8, 2003; Page C05

The true ownership of artwork stolen by the Nazis during World War II is one of the lingering mysteries of the Holocaust. For the survivors and relatives, the quest to reclaim lost art has been painful. For the museums where some of the world-class art turned up, it has been an embarrassment.

To help both sides, the American Association of Museums has organized an Internet registry of holdings in U.S. art museums that could have been appropriated by the Nazis. This centralized database, debuting today, is meant to give all parties access to the information, which a presidential commission asked the museums to organize.

"Our goal is to assure our many publics that American museums are committed to only having in their collections objects to which they have clear legal title, untainted by controversy or illegal, unjust appropriation," said Edward H. Able Jr., the president of the association.

The Web site, formally called the Nazi-Era Provenance Internet Portal, contains the research of 66 museums. Able estimated that there are 150 to 160 museums in the United States whose sizable budgets would make them likely homes for the works of Degas, Picasso, Monet and other famous artists favored by the Nazis. In 2001, the museums were asked by the Presidential Advisory Commission on Holocaust Assets to look at work that changed hands in Europe between 1932 and 1945.

Able said the voluntary effort had worked well. "The museums weren't aware that some of this material had made it into their collections," he said. "The directors are totally committed and sensitive to this. They don't want to have anything in the collections that is stolen." Many of the country's largest museums complied, including the National Gallery of Art, the Metropolitan Museum of Art, the Museum of Modern Art, the Philadelphia Museum of Art, the Walters Art Museum, the J. Paul Getty Museum, the Art Institute of Chicago, the Museum of Fine Arts in Boston, the Baltimore Museum of Art, the Detroit Institute of Arts and the Guggenheim.

Since the spotlight fell on the whereabouts of Nazi stolen art in the 1990s, American museums have identified or returned almost a score of works. About six other cases are pending. Once ownership was established, not everything was returned. "In some cases the object went back to the claimant; in some cases it was sold to the institution; some gave part of it to the institution and others gave it outright," Able said.

The material submitted by the museums for the registry is straightforward. It includes the artist, the artist's nationality, the country of origin and the artwork's title. Once a piece is identified, the researcher is directed to additional material provided by the museum on its provenance (the history of its ownership). A gap may or may not mean the work had been stolen, said Able.

Just getting that far in a search is noteworthy, said Gideon Taylor, executive director of the Conference on Jewish Material Claims Against Germany. "Information has been disorganized and sporadic. This organizes it. Often with restitution the lack of access to information can be a blockage. A lot of people don't get to the start of their journey because they don't know what to pursue," said Taylor. The conference gave $75,000 to the project, which has a budget of $750,000 over the next five years.
*******************************
Washington Post
Fierce Fight Over Secrecy, Scope of Law
Amid Rights Debate, Law Cloaks Data on Its Impact
By Amy Goldstein
Monday, September 8, 2003; Page A01


In Seattle, the public library printed 3,000 bookmarks to alert patrons that the FBI could, in the name of national security, seek permission from a secret federal court to inspect their reading and computer records -- and prohibit librarians from revealing that a search had taken place.

In suburban Boston, a state legislator was stunned to discover last spring that her bank had blocked a $300 wire transfer because she is married to a naturalized U.S. citizen named Nasir Khan.

And in Hillsboro, Ore., Police Chief Ron Louie has ordered his officers to refuse to assist any federal terrorism investigations that his department believes violate state law or constitutional rights.

As the second anniversary of the Sept. 11, 2001, attacks approaches, the Bush administration's war on terror has produced a secondary battle: fierce struggles in Congress, the courts and communities such as these over how the war on terror should be carried out. At the heart of this debate is the USA Patriot Act, the law signed by President Bush 45 days after the terror strikes that enhanced the executive branch's powers to conduct surveillance, search for money-laundering, share intelligence with criminal prosecutors and charge suspected terrorists with crimes.

Yet the paradox of this debate is that it is playing out in a near-total information vacuum: By its very terms, the Patriot Act hides information about how its most contentious aspects are used, allowing investigations to be authorized and conducted under greater secrecy.

As a result, critics ranging from the liberal American Civil Liberties Union to the conservative Eagle Forum complain that the law is violating people's rights but acknowledge that they cannot cite specific instances of abuse.

"The problem is, we don't know how [the law] has been used," said David Cole, a Georgetown University law professor who has represented terror suspects in cases in which the government has employed secret evidence. "They set it up in such a way . . . [that] it's very hard to judge."

Attorney General John D. Ashcroft and other supporters of the law assert that the act is crucial to allowing the government to fulfill its anti-terror responsibilities, but they say little about how it accomplishes those tasks.

Justice officials praise their newfound ability to share information from foreign intelligence operations with criminal investigators, allowing them to more swiftly disrupt potential terrorist acts before they occur.

Ashcroft also insists that the law has not gone far enough, while an unlikely alliance on the ideological left and the right insists that it has trampled civil liberties and must be curtailed.

This summer, two major lawsuits were filed challenging the Patriot Act's central provisions. The Republican-led House startled the administration in July by voting to halt funding for a part of the law that allows more delays in notifying people about searches of their records or belongings. And the GOP chairmen of the two congressional committees that oversee the Justice Department have warned Ashcroft that they will resist any effort, for now, to strengthen the law.

Viet D. Dinh, a former assistant attorney general who drafted much of the law, said the debate over its merits is constructive. He said the government is gravitating now from "the sprint stage" to the "marathon phase" of confronting terrorism

"Somewhere in this marketplace of ideas, of truths and half-truths, of fact and spin, we get a . . . picture of what the [Justice] Department should be doing," Dinh said. "The debate is healthy to establish the rules of this continuing path toward safety."

Information vs. Security


Exasperated with how little they knew about the ways the Patriot Act was being applied, the ACLU and the Electronic Privacy Information Center, a Washington-based public interest group, went to court last October with a freedom of information complaint against the Justice Department. Before a judge dismissed the case in May, Justice officials released a few hundred pages that said little about their activities. One document was a six-page list of instances in which "national security letters" had been issued to authorize searches -- with every line blacked out.

Last year, the House and Senate Judiciary committees -- charged with overseeing the Justice Department -- began to send the agency written requests for statistics summarizing how often Patriot Act provisions had been used. The first replies largely made clear that the information sought by lawmakers was classified.

In such a climate of official secrecy, there are nevertheless small clues to the extent the law is helping authorities' anti-terror work.

In May, the Justice Department told Congress that it had asked courts for permission to delay notifying people of 47 searches and 15 seizures of their belongings. The document said the courts had consented every time but one, but it did not detail why the delays were needed.

The next month, in testimony before the House Judiciary Committee, Ashcroft said he personally authorized 170 emergency orders to conduct surveillance, allowing investigators 72 hours before they must seek permission from an obscure, secret court whose role has been expanded under the law.

Created a quarter-century ago under the Foreign Intelligence Surveillance Act (FISA), the special court requires a lower burden of proof than criminal courts do when authorizing wiretaps and other forms of surveillance. Before Sept. 11, 2001, its primary focus was foreign intelligence cases.

Under the Patriot Act, investigators can go before the court in cases that are primarily criminal as long as they have some foreign intelligence aspect. Ashcroft told the committee that those 170 emergency FISA orders represented three times as many as had ever been authorized before Sept. 11, 2001 -- but he did not disclose how many of them had involved terrorism cases.

Nor has the department said how often it has used FISA court orders to search libraries, the realm that has provoked perhaps the strongest negative reaction. The Justice Department's interest in libraries revolves around their public computers, over which potential terrorists could communicate without detection. One source familiar with the department's activity said that FBI agents had contacted libraries about 50 times in the past two years, but usually at the request of librarians and as part of ordinary criminal investigations unrelated to terrorism. As for how many times the government has used the law's powers to enter a library, a senior Justice official said, "Whether it is one or 100 or zero, it is classified."

As their main examples of the law's usefulness, Justice officials cite a few high-profile cases, some involving suspected terrorism. Perhaps foremost among these cases, agency officials say, is that of a former computer engineering professor in Florida, Sami Al-Arian, who was charged in February in a 50-count indictment with conspiring to commit murder by helping Palestinian suicide bombers in Israel. Ashcroft has said the indictment was possible only because the Patriot Act allows information gathered in classified national security investigations to be shared with criminal prosecutors.

Actions taken under the Patriot Act do not include designating individuals as enemy combatants, which is a constitutional power granted to the president during wartime.

Massachusetts state Rep. Kay Khan (D) learned about the use of the Patriot Act in her case after repeatedly asking why a $300 wire transfer had not reached her brother. She discovered that her husband's name was on a special list at their bank because it may have been used by someone else as an alias. "So we are on some list, which is scary," she said. "I just feel that it's intrusive."

Critics of the law complain that cases such as Khan's are of greater concern than investigations, such as Al-Arian's, that lead to prosecutions. "We are more concerned about the information that is collected and maintained on potentially thousands of law-abiding citizens who are never going to be charged," said David Sobel, general counsel for the Electronic Privacy Information Center.

Conservatives' Fears


Robert L. Barr Jr., a conservative Republican former House member who now works on privacy issues with the American Conservative Union, is one of many conservatives who argue that expanded surveillance powers and a broadened definition of who may be labeled a possible terrorist ultimately could be used against groups on the right, such as militia members or antiabortion activists.

They contend that the department's reluctance to disclose more about the law's use is unacceptable. "To make this blanket claim of national security that disclosure of the general information regarding the number of times government powers have been exercised and in what matter . . . is absolutely nonsense," Barr said.

The FISA court itself ruled 16 months ago that it is improper for federal authorities to mingle intelligence information with criminal cases, as the law allows. But the Justice Department appealed that decision, and it was overturned by a secret appeals court. Because there was no opposing party in the appeal, the law's critics had no way to challenge that decision.

As the law and the controversy around it near their second anniversary, it remains uncertain whether Congress will change the law -- or how strenuously Ashcroft will insist that it be strengthened.

"There are no plans at this time to introduce legislation," said Barbara Comstock, a Justice Department spokeswoman.

Seeking More Powers


Yet the source familiar with the department's work said Ashcroft's aides have been drafting three proposed expansions of Justice Department authority. They would like to make it easier to charge someone with material support for terrorism, to issue subpoenas without court approval and to hold people charged with terrorism prior to trial.

In the same vein, the Senate Judiciary Committee has been working on a bill, largely devoted to fighting drug trafficking, that in some drafts contains a few extra powers that Justice wants. Committee aides said they are unsure whether the chairman, Sen. Orrin G. Hatch (R-Utah), will introduce the bill or what it will contain.

There are signs that lawmakers may not be in a mood to expand federal law enforcement powers. Last spring, Hatch tried and failed to make permanent several parts of the Patriot Act concerning surveillance that are set to expire in two years.

House Judiciary Committee Chairman F. James Sensenbrenner Jr. (R-Wis.) said, "The burden is on the Justice Department to show they are using their authorities in a lawful, constitutional and prudent manner."

Sensenbrenner said he and Hatch deterred an effort by Ashcroft last winter to circulate a sequel to the law, known as Patriot II. Sensenbrenner said that Justice officials had begun scheduling meetings with the committees' staffs to discuss such a possibility. "Both Senator Hatch and I told the attorney general in no uncertain terms that would be extremely counterproductive," Sensenbrenner said. "It would still be counterproductive."

In recent months, most legislative efforts have focused mainly on attempts to restrict the law's scope. Bills in both chambers would, for example, exempt libraries from searches.

The most stern rebuke to the administration came in July, when the House voted to cut off money for searches in which the notification is delayed. The sponsor was conservative Rep. C.L. "Butch" Otter (Idaho), and his amendment was supported by 111 fellow Republicans who had voted for the original law in 2001. The Senate is unlikely to follow suit.

Justice officials disagree with those who say the original law was passed in anxiety and haste immediately after the nation's worst terrorist attacks. "It's a myth . . . that everyone was rushing in and all had bad hair days and didn't know what they were doing," said Comstock, the Justice spokeswoman. Approval of the delayed notification provision had been bipartisan, she noted.

Still, there are signs the department is worried about preserving its ground. Three days after Otter's amendment passed, an assistant attorney general sent the House an eight-page broadside protesting the vote and an addendum that derided it as a "terrorist tip-off amendment." Ashcroft last month launched a cross-country tour to campaign for the law.

But Otter is drafting other changes. One would repeal the expanded surveillance powers next July, a year before they are to expire; another would place decisions to issue warrants to investigate religious and political groups more firmly into the hands of criminal courts.

"What we are going to have to do is, brick by brick, take the most egregious parts out of the Patriot Act," he said.
*******************************
USA Today
Arrest warrant issued for 'N.Y. Times' hacker
Posted 9/5/2003 8:08 PM

SAN FRANCISCO (Reuters)  Federal law enforcement officials have obtained an arrest warrant for a hacker who makes a habit of breaking into corporate computers and then publicly exposing the security holes, a spokeswoman for a federal public defender's office confirmed Friday.
The complaint against Adrian Lamo is sealed so the details were not released, said a spokeswoman in the Federal Public Defender's office in Sacramento, California, where Lamo's family lives.

The spokeswoman said her office was contacted by either Lamo or his family to help with his representation given the pending arrest.

Lamo could not immediately be reached for comment.

In an interview with SecurityFocus.com published on the Web site Friday, Lamo said he believed the warrant was related to his hacking into The New York Times' computer system early last year. He also said he did not plan to turn himself in.

Lamo exploited weaknesses in the newspaper's password policies and gained access to social security numbers and home numbers for thousands of people, including former president Jimmy Carter, former secretary of state James Baker and actors Robert Redford and Warren Beatty, SecurityFocus.com reported.

A spokeswoman for The New York Times did not immediately return a call seeking comment late Friday. The U.S. Attorney's office for the southern district of New York declined to comment on the case.
*******************************
Seattle Post Intelligencer
Saturday, September 6, 2003
Wireless carriers draft a rights code for customers
By SCOTT LANMAN
BLOOMBERG NEWS

U.S. wireless-telephone companies including Verizon Wireless Services Inc. and Cingular Wireless LLC said yesterday that they will announce voluntary customer-rights standards for the industry in advance of plans by regulators to impose such rules.

The Cellular Telecommunications & Internet Association, an industry trade group that represents the wireless companies, will unveil its guidelines in Washington on Tuesday. Carriers that adopt the 10 rules will have to include more disclosure in advertising and allow customers a 14-day trial period to cancel new service, said Kimberly Kuo, a spokeswoman for the group.

The association's move will come a week before a scheduled vote by the California Public Utilities Commission on more extensive customer-rights regulations for the telecommunications industry.

The number of U.S. wireless-phone users has more than doubled since 1998 to about 150 million as more consumers abandon land-based lines. Complaints about wireless carriers to federal regulators rose 38 percent to 4,119 in the first quarter from the prior year. The complaints, and widespread service outages during the August Northeast blackout, have led to calls for increased regulation of wireless carriers.

"The most generous thing I can say is that it's OK," Carl Wood, a member of the California PUC, said of the trade group's standards in an interview. The guidelines "are at best a statement of good intentions, and there is no enforcement behind it. This is not comparable to regulations."

The association will let carriers who comply with the voluntary guidelines use a "quality seal" in their advertising, Kuo said. "This is a way to increase customer information and customer service without the costs and hassles that are tied to a lot of the state regulatory proposals."
*******************************
Washington Post
PayAgent Aims to Curtail Identity Theft Online
By Ellen McCarthy
Monday, September 8, 2003; Page E05

Last week, the Federal Trade Commission said that identity theft struck almost 10 million people last year, costing victims $5 billion and businesses about $48 billion. And despite a growing awareness of the problem, few expect the statistics to decline any time soon.

Anari Belpre had been working for almost two years on a system that would allow low wage earners to decide which day to get paid when he started hearing more and more about identity theft.

"It's clear and obvious that identity theft is a major problem and it's constantly growing as the Internet becomes a greater part of our lives," said Belpre, founder and chief executive of PayAgent Corp.

Belpre put the payroll product on hold and buckled down with his Web developer to create a system that would help protect consumers from online identity theft. PayAgent's service won't stop criminals from obtaining personal information, but it is designed to prevent thieves from buying goods through the Internet with another person's credit card information.

Under PayAgent's system, consumers can register their names and personal information with the company and then choose a user name and password. Whenever an online transaction is being made through a Web site that also contracts with PayAgent, the system searches for matching names in PayAgent's files. If there is a match, the buyer will be asked to enter his or her user name and password.

The company charges consumers $24.95 a year for the service and e-commerce companies would pay $200 to $375 in set-up costs, plus a monthly fee of $30, Belpre said. The company is just beginning to sell its service, but has some major hurdles ahead because a critical mass of consumers and businesses will have to sign up to make the service effective.
*******************************
Government Executive
September 4, 2003
Lawmakers grill top cyber official at Homeland Security
By Greta Wodele, National Journal's Technology Daily

House lawmakers on Thursday fired questions at the new chief of infrastructure protection at the Homeland Security Department, asking about the division's fiscal 2004 budget request, upcoming deadlines and the amount of information it shares with Congress.


Kentucky Republican Harold Rogers, chairman of the Homeland Security Appropriations Subcommittee, said during a hearing on the information analysis and infrastructure protection directorate that the unit's budget request did not "provide nearly enough detailed" information and characterized the requests for funding as "simply not adequate." Rogers and subcommittee ranking Democrat Martin Olav Sabo of Minnesota said obtaining the budget information for the agency, and the department overall, was onerous, cumbersome and time-consuming.


"I wonder if we're better off spending the $800 million elsewhere," Sabo said of the $829 million requested by the Bush administration for the directorate, which is in charge of assessing threats to the nation's cyber and physical infrastructures.


Frank Libutti, who became the division's undersecretary two months ago, pledged to provide a more detailed budget in the future. Responding to questions from Sabo about lawmakers not receiving classified or unclassified information from the department, Libutti vowed to address the panel's concerns at "any time."


Rogers also asked Libutti if the division would meet a Dec. 15 deadline established in the spending bill for Homeland Security to define the scope, cost and schedule for programs to assess security threats. Libutti said while his division would meet the deadlines, assessing threats is an "ongoing, day-to-day operation."


Lawmakers did not ask Libutti about a deadline his division missed last month for a report on the current number of intelligence and cyber-security analysts under the directorate. The full Appropriations Committee requested the report by Aug. 30, saying in a report on the measure that the panel "does not believe that [the directorate] is hiring enough intelligence analysts responsible for terrorist assessment, cyber-security threat analysis and biowarfare threat assessment."


A committee aide said the panel is hoping to receive the report before the House and Senate conference committee meets to finalize the Homeland Security appropriations bill, H.R. 2555.


When National Journal's Technology Daily asked about the missed deadline during a break, Libutti said he would take it "under advisement." The secretary reiterated from his testimony that his unit employs about 60 analysts, which includes cyber-security analysts, and that Homeland Security as a whole has more than 850 on board.


New York Democrat Jose Serrano peppered Libutti with questions about the threat of computer viruses on the nation's infrastructure. Libutti responded that the "cybersecurity piece" at the division is "critical and paramount to protecting infrastructure." It requires a "partnership" with state and local governments, as well as the private sector, he said.


The lawmakers ended the hearing by asking Libutti to return to Capitol Hill for a classified briefing on its various programs, including an update on cyber-security initiatives, the national security-alert system, and information sharing with state and local governments.
*******************************
New York Times
September 8, 2003
COMPRESSED DATA
With Politeness, Easing the Pain of E-Mail Mishaps
By ALAN KRAUSS

One side effect of the recent torrent of e-mail messages unleashed by worms and viruses like Blaster and SoBig.F, which raid people's e-mail address books and automatically send out messages, is the increase in electronic "return to sender" notes showing up in users' In Boxes.

In the bounce messages, as they are known, strings of letters and numbers are followed by a phrase saying that a message could not be delivered. It is typically rendered in dry automatonese, as in: "The IronMail encountered problems while parsing the attached message. The message has a malformed mime. The message has not passed through any of the queues in IronMail." But one e-mail server program, Qmail, sends a bounce message that is personable and even a bit apologetic.

"Hi," said one such message from an e-mail server computer running Qmail. "This is the qmail-send program at email.seznam.cz. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out."

Qmail, available free from the Web site Qmail.org, was written by Daniel J. Bernstein, a professor at the University of Illinois at Chicago. He created it as an alternative to Sendmail, the most widely used e-mail server program. Developed in the early days of the Internet, Sendmail has been plagued by flaws  most relating to security  as it has been adapted for wider use.

Mr. Bernstein could not be reached for comment. But Russell Nelson, a software consultant in Potsdam, N.Y., who runs the nonprofit Qmail.org, affectionately described Mr. Bernstein as a gentle iconoclast.

Mr. Nelson noted some of the other human touches in Qmail. If something goes wrong internally, Qmail sounds a note of alarm: "Alert: Oh no! Lost Qmail connection. Dying . . ." And if it receives a request to verify an e-mail address, the response come from any ambitious young shipping clerk: "Send some mail. I'll try my best."

Recipients of the Qmail messages routinely assume the sender is a sentient being, Mr. Nelson said. "Users see that and think that a person actually typed it in and that they should respond. People actually do reply."
*******************************