[00:00.000 --> 00:02.560]  We still have room for more entries.
[00:02.800 --> 00:03.660]  We have some funny ones here.
[00:06.440 --> 00:08.000]  You can enter as many times as you want.
[00:08.720 --> 00:11.840]  And just make sure you put your name or ID on the card.
[00:12.060 --> 00:20.520]  It's a contest sort of parodying the AT&T Wheels campaign where they wind up taking credit for things they haven't yet invented.
[00:22.440 --> 00:23.640]  You can take credit for anything.
[00:23.980 --> 00:28.120]  And we have amazing prizes from people that come with money.
[00:28.560 --> 00:31.360]  We have quite a few sex-related ones, too.
[00:33.880 --> 00:35.600]  I'd say almost 50% of them.
[00:36.660 --> 00:37.480]  Which is interesting.
[00:38.320 --> 00:39.760]  And they can win, too, if they're fine.
[00:44.940 --> 00:49.680]  The box is at the glass door as you walk into the computer area for registration.
[00:50.480 --> 00:54.640]  There's your next cards there, so we write it out and drop it in.
[00:58.520 --> 00:58.900]  Contest?
[01:00.720 --> 01:02.460]  It's about 9 o'clock tonight, I guess.
[01:02.640 --> 01:03.860]  We'll be announcing it at the closing.
[01:04.700 --> 01:05.260]  It's 10:30.
[01:05.800 --> 01:06.080]  All right?
[01:07.940 --> 01:11.180]  Well, we don't know exactly what prizes we have yet, but they're good prizes.
[01:11.840 --> 01:13.040]  You won't walk away disappointed.
[01:14.580 --> 01:15.820]  We have those keys, yeah.
[01:15.820 --> 01:17.020]  We do that.
[01:17.460 --> 01:17.560]  We do that.
[01:18.440 --> 01:18.620]  Yeah.
[01:18.620 --> 01:18.780]  Yeah.
[01:18.780 --> 01:19.000]  We do that.
[01:20.040 --> 01:20.480]  Yeah.
[01:21.800 --> 01:22.500]  We do that.
[01:24.660 --> 01:28.660]  Again, the schedule changes, I guess those are only during the month of 2 o'clock.
[01:29.180 --> 01:35.820]  And, uh, nobody else is pretty much on the schedule except we've rescheduled Chaos Computer Club and acting at 6 o'clock.
[01:35.820 --> 01:35.900]  Yeah.
[01:36.460 --> 01:38.020]  So, uh, spread that around.
[01:38.200 --> 01:40.480]  We'll start with the National ID in a couple minutes.
[01:41.720 --> 01:46.880]  Also, if anybody wants to write a propel score to Phiber Optik in prison, there's another box next to the wheel box.
[02:24.340 --> 02:26.080]  Those are the National ID people over there.
[02:26.460 --> 02:26.660]  All right.
[02:27.800 --> 02:28.780]  Here, Jason.
[02:29.740 --> 02:30.480]  Thank you.
[02:30.580 --> 02:31.800]  I'm close by the way.
[02:32.300 --> 02:33.180]  Never met me.
[02:33.740 --> 02:36.600]  But anyway, can you guys hear me all right?
[02:36.780 --> 02:37.160]  Very cool.
[02:37.500 --> 02:37.820]  You can hear me?
[02:39.080 --> 02:40.500]  Someone handling the board here?
[02:41.460 --> 02:42.420]  Up these two mics.
[02:43.720 --> 02:44.260]  Thank you.
[02:45.840 --> 02:46.600]  There we are.
[02:47.180 --> 02:51.000]  Anyway, there was a gentleman here a little bit earlier, I don't know if he saw him.
[02:51.640 --> 02:53.000]  But he was handing something out.
[02:56.640 --> 02:57.940]  Did everybody get one?
[02:58.260 --> 02:59.240]  Did everybody get one?
[03:00.720 --> 03:05.600]  I don't really have much of an opinion on it, but I just thought it was interesting and I would go over it for you guys.
[03:06.700 --> 03:10.500]  Maybe you guys have some ideas of what you might want to do or not want to do.
[03:10.620 --> 03:15.200]  Maybe it angers you, maybe you find it interesting and something for you, who knows.
[03:15.640 --> 03:16.480]  But anyway...
[03:19.420 --> 03:20.380]  Yeah, I didn't notice.
[03:22.500 --> 03:24.300]  Oh yeah, free, that far.
[03:26.080 --> 03:28.820]  Anyway, that's the science point.
[03:29.100 --> 03:34.380]  What it says up on the top, it says, let's shut down, dial-a-Nazi.
[03:35.960 --> 03:46.040]  And on the top it says, the neo-Nazi skin heads opened an openly anti-Semitic racist hotline on the phone advocating killing jews, blacks, and other minorities.
[03:46.680 --> 03:49.620]  These numbers are operated in over 50 cities.
[03:50.440 --> 03:53.560]  And even in New York City, there is one which you can reach that.
[03:54.560 --> 03:58.980]  And over is 212-330-8878.
[04:01.140 --> 04:02.440]  I don't know actually.
[04:02.840 --> 04:03.360]  I don't know actually.
[04:03.360 --> 04:04.380]  I think that's kind of funny.
[04:04.900 --> 04:06.180]  But not that funny.
[04:07.740 --> 04:09.300]  Very odd stuff.
[04:09.860 --> 04:22.720]  But anyway, continues to say the vicious violent hate line calls for burning synagogues, shooting blacks and Latinos and jews and needs to be turned off permanently.
[04:28.460 --> 04:29.300]  It's interesting.
[04:29.560 --> 04:30.140]  Yeah, I don't know.
[04:30.440 --> 04:32.940]  You know, I'm just coming up here to see what you guys think.
[04:33.200 --> 04:33.380]  You know.
[04:34.500 --> 04:35.920]  I have no opinion on it.
[04:36.120 --> 04:36.300]  Trust me.
[04:36.940 --> 04:40.500]  But anyway, continues to say phone phreaks.
[04:41.100 --> 04:46.260]  You must use your various assorted bag of tricks to shut down these lines.
[04:50.360 --> 04:55.220]  No cowardly sputterings about free speech for these fascist scum.
[04:59.000 --> 05:04.180]  Just think for a minute what the neo-Nazis would do to you and your family if they ever came to power.
[05:08.380 --> 05:09.200]  I don't know.
[05:09.440 --> 05:11.420]  Anyway, it's not so impossible.
[05:11.740 --> 05:16.720]  Just remember how well David the Nazi did in elections in Louisiana.
[05:20.360 --> 05:21.760]  Yeah, I don't know.
[05:22.160 --> 05:22.680]  Anyway.
[05:32.160 --> 05:35.100]  I had a comment but I forget what it was now that I'm up here.
[05:35.100 --> 05:35.620]  But anyway.
[05:36.380 --> 05:42.700]  I just thought everybody should know that since the mic is open, I figured I'd take the time to come up here and be vocal.
[05:50.180 --> 05:51.280]  Everybody have a good time.
[05:51.880 --> 05:53.400]  And actually it's kind of fun up here.
[05:53.560 --> 05:56.900]  So you should come up and just start rambling as I am now.
[05:57.500 --> 05:57.980]  Okay.
[06:09.960 --> 06:11.280]  National ID people are here.
[06:12.360 --> 06:14.020]  They're not the National ID people.
[06:14.240 --> 06:15.000]  They're the people.
[06:15.820 --> 06:17.580]  We'll be talking about National IDs.
[06:17.720 --> 06:19.500]  They've got hostility with real enemies.
[06:26.620 --> 06:27.100]  Okay.
[06:27.240 --> 06:29.820]  Well there's this developing thing happening in the government.
[06:30.140 --> 06:31.760]  It's called the National ID card.
[06:31.940 --> 06:34.300]  And your government wants everyone to carry one.
[06:34.500 --> 06:39.020]  And in fact they're going so far as to say you're going to need to carry one if they get their way.
[06:39.240 --> 06:47.920]  This National ID card is going to have things on it like your medical information, your social security number, your banking history information or access information.
[06:49.680 --> 07:08.580]  And in fact the vision is that in the future, maybe five, ten years down the line, when everybody gets used to using this National ID card, one of the things they won't have to do is they can abolish tax returns because they'll have such a keen hit on what your finances are that they'll be able to project what your tax situation looks like and just pull it directly out of your account.
[07:09.900 --> 07:17.740]  So we're going to talk really briefly like for two minutes, maybe one each, or maybe even 30 seconds each about what little we know about this.
[07:18.200 --> 07:22.440]  I've heard that it's to be a National ID card with all those pieces of information.
[07:22.700 --> 07:23.580]  It's mag-strap data.
[07:23.840 --> 07:24.540]  And have your photo.
[07:26.680 --> 07:29.700]  And these guys are going to say what little they know about it so far too.
[07:29.700 --> 07:36.700]  And the face office is one of the groups that is suggesting that this is a great idea to help save the people behind it.
[07:43.500 --> 07:46.580]  And six months after that, they'll actually remember the issue of the card.
[07:48.200 --> 07:50.520]  And three years later, they'll actually receive those.
[07:51.280 --> 07:53.840]  What has happened is the U.S.
[07:54.020 --> 08:05.260]  Commission on Immigration Reform, which was a commission set up by the 1990 Immigration Reform Act, has been investigating the idea of workplace verification.
[08:06.100 --> 08:17.560]  And about two months ago, and we think this was a deliberate leak by the White House, there was a report on CBS News that they were going to actually come out with a recommendation for a national identity card.
[08:17.560 --> 08:39.060]  The card that CBS News reported was going to be a mag-stripe-based card with your fingerprint, your photograph, your social security number, and your mag-stripe, and that it was going to be used not just for immigration, for workplace verification, but also for government programs.
[08:39.060 --> 08:48.340]  So I imagine the first thing that they would actually use it would be healthcare and taxation and things like that would be come shortly after.
[08:49.260 --> 08:57.180]  After this was announced, there was quite a firestorm of controversy as there isn't much support ever in the U.S.
[08:57.240 --> 08:58.280]  for a national ID card.
[08:58.400 --> 09:00.060]  So they started backpedaling.
[09:01.120 --> 09:19.040]  And now they're touting it as a national registration database, where they'll suck information from the Social Security Administration and the INS, and for the five largest states, the U.S., New York, California, Florida, Illinois, and Texas.
[09:19.860 --> 09:25.680]  And there will be, however, they haven't actually left out the option of an ID card.
[09:25.880 --> 09:35.780]  And I think this is just basically their way of trying to slip it in first, have this database, and then after the fact, they'll come back and say, oh, we need some sort of real verification system.
[09:35.780 --> 09:37.600]  And they'll go with an ID card.
[09:37.740 --> 09:40.200]  One of those five states is actually going to test this.
[09:40.400 --> 09:46.600]  So if you're a lucky resident of one of those states, you may have your very own identity card just for this.
[09:47.000 --> 09:47.960]  California is one.
[09:48.840 --> 09:56.200]  California will probably be the one going with the ID card knowing what a wonderful civil libertarian that Wilson is.
[10:00.440 --> 10:01.480]  Yes, if O.J. Simpson had had an ID card, the murder would not have happened.
[10:04.940 --> 10:07.340]  It can solve all crime for you.
[10:09.040 --> 10:14.780]  Talking from some experience, this is the International Privacy Bulletin, which I edit.
[10:16.000 --> 10:18.760]  It's the official newsletter of Privacy International.
[10:19.160 --> 10:21.940]  And we've done a number of campaigns around the world on this.
[10:22.200 --> 10:29.100]  In Australia, a campaign led by Simon Davies, basically brought down the Australian government.
[10:29.100 --> 10:31.280]  The parliament had to dissolve.
[10:32.340 --> 10:34.680]  And the program was scrapped.
[10:34.820 --> 10:37.280]  There were riots in some of the sub-capitals.
[10:37.720 --> 10:44.480]  In one case, they tried to overturn the minister's card with the minister in it.
[10:47.120 --> 10:52.340]  But basically what has happened in a lot of these other countries is they do introduce a card.
[10:52.520 --> 10:55.460]  And it's supposed to be a fairly friendly card.
[10:55.660 --> 10:58.040]  You know, it's designed for your convenience.
[10:58.340 --> 11:01.300]  And it's only supposed to be used for very limited instances.
[11:01.580 --> 11:02.820]  And there's legal protections.
[11:03.760 --> 11:08.400]  And then after the fact, more functions keep getting added onto that card.
[11:08.580 --> 11:09.980]  It's what we call function creep.
[11:11.020 --> 11:16.480]  In the Netherlands, I'm sure somebody from here can talk about it probably in more detail than I can.
[11:16.680 --> 11:22.520]  But they started out with a card for social security, similar to the problems we've had with our social security number.
[11:23.260 --> 11:26.420]  And then they started adding functions onto it.
[11:26.480 --> 11:32.420]  Now it's gotten to the point where they can demand it at sporting events, on buses, all sorts of places.
[11:32.620 --> 11:36.680]  And that has some real significant implications for constitutional rights.
[11:36.680 --> 11:50.040]  If you are going, I know in Germany I've seen some reported cases where they frequently ask more for young people that are looking like they're heading towards demonstrations for their ID cards as a harassing tactic.
[11:50.900 --> 11:56.760]  More than your average, I don't know, right-wing or whoever the hell is running the show over there now.
[11:58.040 --> 12:07.220]  So for a variety of reasons, I mean this can infringe on free speech, free assembly, it's a real chilling effect on a lot of constitutional rights, not just rights.
[12:09.080 --> 12:17.940]  I've been to a couple of presentations by the information infrastructure task force.
[12:18.660 --> 12:23.300]  The people who are going to bring you the superhighway from D.C.
[12:24.320 --> 12:28.800]  In fact, they've been through the same presentation six times and six different agencies for six different reasons.
[12:29.300 --> 12:31.040]  So they're at least all saying the same thing.
[12:31.040 --> 12:36.820]  One of the things that they're talking about is a thing called virtual agencies.
[12:37.280 --> 12:56.020]  And the government has decided, and I've got to admit, it's not a bad idea on its face, that certain people, for example, who receive services from the government may have to go to as many as 15 to 30 different places in order to receive the various government services that they need.
[12:56.020 --> 13:01.520]  And the concept now, in some respects, is reasonable.
[13:01.760 --> 13:06.880]  And for any business organization, why not let these people go to one place and get all the things that they need?
[13:07.080 --> 13:09.840]  Well, they've thought of doing this a couple of ways.
[13:10.020 --> 13:20.540]  And one way is to give you a thing that basically looks like an ATM card, except it would give you your welfare money, and your food stamps, and your FTC, and everything else all at one place.
[13:20.620 --> 13:22.740]  And maybe not even with you talking to a human being.
[13:22.740 --> 13:24.960]  So those are all the same agency?
[13:25.580 --> 13:29.280]  Those are all the same agency, but there are a couple of different local states, too.
[13:29.880 --> 13:33.760]  The federal government has talked about coordinating with the states to provide all of these services in one place.
[13:34.240 --> 13:38.940]  And, of course, to do this, you need the magic token thing, which is, of course, a card.
[13:40.580 --> 13:52.480]  So one of the things that you'll hear if you're looking for red flags is listen for this virtual agency and service delivery talk, because that's exactly what they're talking about, and this is the tool that you'll use.
[13:56.020 --> 13:56.840]  Pardon me?
[14:00.080 --> 14:00.720]  Okay.
[14:01.080 --> 14:20.780]  If you hear people talking about virtual agencies or enhanced delivery of government services, things like that, they're... what they're talking about is having all of these agencies all know you through one place, and other people in other conversations have said,
[14:20.900 --> 14:25.900]  oh, you know, you can put the DMV there, and you can put the IRS there, and you can put everyone else there.
[14:26.080 --> 14:30.400]  So it doesn't just have to be things they're giving to you, it could also be things they're taking from you.
[14:31.400 --> 14:36.900]  Now, that having been said, I want to touch on something that I think directly implies to the people here.
[14:37.440 --> 14:50.440]  Dave and I have talked at a couple of different hearings before legislators, and I tend to sort of hold the role of the technical needy who gets trotted out when it gets ugly.
[14:52.300 --> 14:59.140]  And as technical people, all of you are uniquely suited to have an influence on these people.
[14:59.140 --> 15:13.740]  The one that really strikes me, the Virginia General Assembly had hearings on the use of social security numbers in transaction identification, and it wasn't just government transactions, they were interested in studying private sector transactions too,
[15:13.960 --> 15:24.220]  because as I'm sure it's the same where you all are, where I am, without a driver's license, writing a check anywhere is a pretty amazingly difficult process.
[15:25.800 --> 15:32.700]  Now, in my state, I have the unfortunate experience of having my social security number be my driver's license number.
[15:32.940 --> 15:36.520]  And there are, I believe, there are 37 states that don't.
[15:36.720 --> 15:39.220]  So, however many that leaves do.
[15:40.960 --> 15:43.900]  34 or 37, I forget, it's not going back to the right.
[15:44.140 --> 15:44.940]  It's not, no?
[15:45.260 --> 15:46.840]  Okay, well, so much for being an optimist.
[15:48.420 --> 15:58.520]  So, I talked to these guys, and I said, here is the reason why the social security number is a uniquely bad, unique key for databases.
[15:59.300 --> 16:04.680]  And I explained, for example, that the numbers were all right next to each other.
[16:05.020 --> 16:13.700]  That there was no mechanism for a checksum to either glance at or, through a simple operation, determine the validity of a number.
[16:14.440 --> 16:17.120]  Which is how it's so easy to swipe other people's.
[16:18.160 --> 16:20.480]  And I've met several people who have had that happen to them.
[16:21.440 --> 16:28.500]  And also that, in fact, there were mechanisms that were better suited for databases to get the job done.
[16:28.500 --> 16:42.340]  For example, Maryland, right across the river from where I live, uses sound X codes, which is a really neat magic technology that basically allows you to take the sound of someone's name and encode it sort of numerically and be able to look it up really fast.
[16:42.420 --> 16:45.900]  And if you're wondering whether this stuff works, Directory Assistance uses this, basically.
[16:46.040 --> 16:47.900]  That's how they can get you your numbers so fast.
[16:48.300 --> 16:53.540]  Because there's basically a hashing of the way a word sounds into a numerical value.
[16:53.840 --> 16:58.100]  And they have this number, and they can put other stuff in there, you know, like checksums and things like that.
[16:58.100 --> 17:02.340]  And I was talking to these guys, these legislators, delegates to the Virginia State Assembly.
[17:02.840 --> 17:05.660]  And they actually really wanted to know about this stuff.
[17:05.900 --> 17:14.160]  And they grilled me for like 20 minutes about what's a checksum, what's a check digit, what's a sound X code, what's a hash.
[17:14.300 --> 17:15.800]  I mean, it was phenomenal.
[17:15.800 --> 17:18.820]  And some of the questions are fairly enlightened.
[17:18.980 --> 17:25.900]  And I don't, for a second, presume to think that all legislators are that interested in how things work.
[17:26.020 --> 17:32.260]  But you know, I gave these guys rational, technical arguments for why what they were talking about was stupid.
[17:34.440 --> 17:36.720]  And for the most part, they listened.
[17:36.880 --> 17:49.140]  Now, the Department of Motor Vehicles, which was really the interested party in this case, because we were trying to get social security numbers off the driver's licenses, played along through nine rounds of hearings and then turned status in the back later.
[17:49.140 --> 17:51.060]  But we've come to expect that.
[17:51.340 --> 18:04.300]  But the fact is, the legislators actually asked questions that indicated that they wanted to know the technical reasons or the rationality or irrationality of the policies that they were discussing.
[18:04.660 --> 18:08.480]  And we are the people who are able to give them that information.
[18:08.840 --> 18:18.700]  So do not think that just because you're a technical person, people don't necessarily want to hear what you have to say, because they actually do.
[18:19.020 --> 18:23.020]  Now, it may mean that you have to actually rein yourself in a little bit.
[18:23.220 --> 18:27.280]  I mean, I had to, like, not go into anarchist screens when I was up there talking to these guys.
[18:28.980 --> 18:31.060]  But I taught them something.
[18:31.260 --> 18:35.040]  And they thanked me afterwards, and they asked me more questions afterwards.
[18:35.460 --> 18:48.280]  And some of them now know why it is the social security number, leaving policy issues aside for purely technical reasons, which are much more difficult to defeat, logically.
[18:48.900 --> 18:53.700]  For purely technical reasons, they now have some information about why it is a stupid thing to use it.
[18:55.200 --> 19:07.100]  So, that having been said, you should all know that there is a group called the American Association of Motor Vehicle Administrators who is really gung-ho about the SSM and thinks everyone should use it for everything all the time.
[19:07.100 --> 19:10.020]  So, if you ever see anybody from there, be mean to them.
[19:11.820 --> 19:14.320]  Yeah, tattoo theirs on their forehead.
[19:15.340 --> 19:24.460]  But don't get too discouraged, because many of us in this room have the ability to give people information that they're not going to get from other ways.
[19:24.600 --> 19:31.400]  They're not going to get it from policy people, even very, very motivated, well-intentioned policy people, because that's not their thing.
[19:31.400 --> 19:43.400]  If you can tell these guys, for technical reasons, why certain plans suck, you've got a card that a lot of people won't necessarily have that you can use.
[19:43.680 --> 19:44.540]  Not an ID card.
[19:44.920 --> 19:45.940]  A Trump card.
[19:47.280 --> 19:50.900]  I wanted to get a really brief case study, and then I see we've got a question already.
[19:51.640 --> 20:02.840]  There's a few situations in California that are sort of illustrative of the kind of mindset that's going on on the government level that doesn't have access to this technological data that you have access to.
[20:03.080 --> 20:10.940]  There are two sets of, two groups of people that need the information you have, and if you ever get the chance to sit down and talk with them, I would encourage you to do so.
[20:11.320 --> 20:24.200]  One is government people, like when you get a chance to go to some kind of hearing, or like if a bill is pending in your area, just find two minutes worth of something to say, or just go hang out and see how easy it is to do.
[20:24.200 --> 20:29.260]  You basically walk up to a mic, you tell them something interesting for two minutes, and you're done, or maybe five minutes.
[20:29.600 --> 20:35.240]  But those hearings are actually a valuable place to talk or to listen to find out what kind of a procedure is going on.
[20:35.460 --> 20:43.920]  One of the things that's very revealing is how many of the other side is there talking, and how many little of our side is there talking, if there were to be some delineation between sides.
[20:44.140 --> 20:45.320]  And the other is press.
[20:45.580 --> 20:50.200]  You probably all know how completely biased press can be, and how completely misinformed.
[20:50.920 --> 20:56.160]  And part of it is the responsibility of the editorial staff, which says, okay, here's a story for you.
[20:56.240 --> 20:58.720]  I know you've been working in housewares for, you know, six years.
[20:58.900 --> 21:02.820]  You need to do a computer story this time, and you're going to do it on the national ID card.
[21:02.940 --> 21:11.640]  So this poor press person, who's completely uninformed and completely out of their field in some cases, has to go out, get completely informed on the issue, and write a cohesive story.
[21:11.780 --> 21:13.520]  We all know what the result of that is.
[21:13.600 --> 21:15.320]  So if you meet a press person, talk to them.
[21:15.320 --> 21:21.660]  And then about this case study, there's interesting things going on in the database level in California, which I want to point out.
[21:22.020 --> 21:25.800]  One thing is that there are state-funded childcare centers.
[21:26.180 --> 21:28.140]  It's not a big concern, I know, to this crowd.
[21:28.260 --> 21:35.360]  But, you know, it's a valid note that you probably went through school as young kids, and teachers probably wrote interesting things about you and your school records.
[21:35.700 --> 21:42.960]  Well, one of the things that's going on is that in the California state-funded childcare centers, that information is going online.
[21:43.160 --> 21:44.740]  There's fairly low security levels.
[21:44.940 --> 21:59.020]  And that information once is about all of the kids that are in those state-funded childcare centers, once that goes online, it stays online until that kid turns 18 and knows enough to file for removal from the system.
[21:59.220 --> 22:16.780]  So that information is, if they don't know that, that information is there in the databases, accessible to all California people that have access to that information, which would basically be the jails, the childcare systems, all the doctors, any of the medical agencies or social service agencies.
[22:17.060 --> 22:20.040]  All that information is available on a fairly low security level.
[22:20.240 --> 22:30.300]  So, you know, if a kid has trouble in school, that information is there when they're 16, that some teacher wrote troublemaker, then the jail is going to have access to that information, and the police, and they're going to know about it.
[22:30.380 --> 22:34.720]  So there's a lot of interconnection of your lives going on on the government level where they want this.
[22:34.720 --> 22:38.000]  So don't think it's not relevant to you, because it certainly is.
[22:38.480 --> 22:38.640]  Sure.
[22:39.820 --> 22:40.120]  Okay.
[22:40.580 --> 22:49.880]  To follow up on that also, going to the issue of education records, there was a bill that passed this year called the Goals 2000 Bill to improve education.
[22:50.460 --> 22:54.840]  I mean, nobody doubts that the education system could use some serious work here in the U.S.
[22:54.840 --> 23:08.220]  but one of the practical effects of the Goals 2000 Bill is that they're creating cradle-to-grave databases of education records, calling it lifetime learning.
[23:09.480 --> 23:24.440]  The National Center for Education Statistics, which is a part of the Department of Education, has put out several books that some friendly people sent to me, talking about the kind of data collection they want to do and keep online, and continue to use,
[23:24.600 --> 23:34.280]  not just until you're 18 or you're 24, but they want to follow you after that and see where you've been working and how much money you're making and link it with other databases using your social security number.
[23:35.280 --> 23:42.720]  I mean, I want to understand, though, you know, there's some pretty good education systems around the world, and I don't think they need a fucking database to have good education.
[23:44.160 --> 23:47.500]  And also, the press has done occasionally a good job.
[23:47.680 --> 23:51.300]  Investors Business Daily had a pretty good article on Friday.
[23:51.620 --> 23:53.460]  Do we need a national ID card?
[23:53.640 --> 23:56.380]  Loss of privacy may offset any efficiency gains.
[23:56.800 --> 24:00.600]  So it is possible to educate them.
[24:02.040 --> 24:20.820]  And one project that CPSR has done, at least in Boston, is they've done an Adopt the Legislator program, where a couple of chapter members get together and they find some legislators who are actually interested in learning about technology and teach them once a week or once a month about various things.
[24:21.000 --> 24:22.740]  It's a really useful program.
[24:22.940 --> 24:24.680]  It's stuff that you all could do quite easily.
[24:26.120 --> 24:31.660]  CPSR is computer professionals for social responsibility, and I want to tell you, you are all computer professionals because you're here.
[24:31.820 --> 24:32.580]  This makes you a moment.
[24:33.080 --> 24:34.820]  I'm also a member of Privacy International.
[24:35.260 --> 24:38.480]  It's probably good for me to plug it into Dave since he's the guy.
[24:39.880 --> 24:44.460]  Privacy International has some really neat people all over the world doing a lot of stuff.
[24:44.620 --> 24:52.980]  And if you want to know what's happening from all over the world doing this stuff, you want to get networked with people who are also trying to protect their privacy, it's a really good organization, too.
[24:54.640 --> 25:01.980]  So of the information providers that we need to get into questions, that are the people and groups that are doing this kind of information.
[25:02.760 --> 25:08.080]  CPSR, very grassroots, membership-oriented, but basically activists on the grassroots level.
[25:08.700 --> 25:15.480]  EFF, which takes on some fairly high-profile cases occasionally and does a fair amount of public education with big net presence.
[25:16.120 --> 25:20.580]  Privacy International, more international scope than some of the rest of these.
[25:20.580 --> 25:26.120]  And also the Electronic Privacy Information Center, which is a black stock group in Washington, D.C.
[25:30.460 --> 25:34.560]  Those are probably the four groups that are doing the most activities in these places.
[25:34.580 --> 25:35.420]  So here's number three.
[25:35.760 --> 25:36.580]  Okay, do you have a question?
[25:37.760 --> 25:46.800]  I understand what we're going to do with the analysis system here, but it seems to be a big issue with some of the private facilities.
[25:46.800 --> 25:51.800]  So then, can we go into a little more about why you feel...
[25:55.500 --> 25:57.940]  They could think they could keep doing something else.
[25:58.600 --> 26:01.400]  Your first day in the hot seat, you're torn at it just because...
[26:01.400 --> 26:01.700]  Right.
[26:02.220 --> 26:07.860]  In other words, what's the argument for using it for an administrator of some database, some service that you use?
[26:08.800 --> 26:11.480]  You'll hear a lot of different talk about why social security.
[26:11.620 --> 26:16.740]  The question is, why can't people use something else as the unique key when they build these databases?
[26:16.740 --> 26:18.140]  Well, there are two reasons.
[26:18.320 --> 26:19.340]  One is that they're lazy.
[26:20.040 --> 26:21.580]  There's no reason why they can't.
[26:21.700 --> 26:22.200]  They're lazy.
[26:23.000 --> 26:30.000]  There are also people who really, really understand about data matching with other databases and are really gung-ho to make sure that they'll be able to do that.
[26:30.120 --> 26:31.760]  So they set theirs up to make it easier.
[26:31.920 --> 26:34.820]  And right now, the social security number is the thing that makes that easier.
[26:35.560 --> 26:39.700]  There are a lot of other things that are better keys for databases.
[26:39.700 --> 26:48.640]  There are a lot of other things that have less potential for duplication inadvertently, that are for which you can find errors more expediently.
[26:48.920 --> 26:51.940]  I mean, even your credit card numbers have checked something.
[26:52.080 --> 26:57.340]  It's a simple algorithm, but if you go and just make one up off the top of your head, there's a fair possibility it will not work.
[26:57.340 --> 27:13.140]  Now, there's no reason why the thing that basically has come to refer to you as an entity shouldn't have at least that level of simple protection and authentication or integrity validation.
[27:13.500 --> 27:14.360]  But it doesn't.
[27:14.500 --> 27:15.980]  I can look at an SSN.
[27:16.200 --> 27:25.300]  I can tell you where you were living when it was issued, more or less what time within the last few decades it was issued.
[27:26.320 --> 27:35.860]  And beyond that, I mean, you can actually walk up the number space and almost any number you pick, you're going to hit somebody if it's anywhere near where yours is.
[27:36.440 --> 27:37.340]  This is ridiculous.
[27:37.680 --> 27:47.580]  This is, as a number, it may have been good in 1947, but 39, there's a hell of a lot more technology now and it doesn't take a lot to implement it.
[27:47.680 --> 27:57.720]  So if in fact you are ever building databases for businesses or for anything of people and you need a key, don't use the SSN because it sucks.
[27:58.000 --> 28:04.260]  It's too easy to stumble in the number space onto another person.
[28:04.560 --> 28:09.820]  And we've already seen what happens when people's credit ratings get inadvertently confused because someone used the wrong SSN.
[28:09.820 --> 28:13.620]  What I'm saying is that why couldn't the government just have got to get another system?
[28:14.220 --> 28:15.960]  Social Security is supposed to be for your...
[28:17.200 --> 28:21.720]  Part of the reason is they're doing it to streamline the system and this number is already in existence.
[28:21.960 --> 28:24.000]  So if you want to streamline it, you don't add another piece.
[28:25.060 --> 28:27.140]  And we don't think that's necessarily a feature.
[28:29.100 --> 28:29.940]  Do you have any questions?
[29:05.150 --> 29:07.950]  There are places where that's illegal and I think Dave actually has it.
[29:07.990 --> 29:08.670]  What was the question?
[29:08.930 --> 29:21.450]  For universities, most universities are accepting if you bug the system, if you say I don't want to use my Social Security, a lot of universities are now getting systems where they'll give you an alternative number which is configured the same but it's just not available on Social Security.
[29:21.730 --> 29:24.770]  The question was what can you do to keep your...
[29:24.770 --> 29:29.830]  In the California example, what can you do to get rid of your information, your educational information before you're 18?
[29:30.210 --> 29:34.070]  And given that universities and stuff are using it, what do you do?
[29:34.230 --> 29:37.090]  And there are instances where universities can't do that.
[29:39.550 --> 29:55.510]  Under the Family Education and Privacy Rights Act, the FERPA, also known as the Buckley Amendment in 1974, there's pretty strict restrictions on what's to be done with education records of any entity that receives any kind of federal money.
[29:55.510 --> 30:03.270]  And that pretty much covers everything except maybe some very small religious schools that refuse to take federal money.
[30:04.350 --> 30:06.910]  And they actually can be sued for it too.
[30:07.070 --> 30:08.090]  It's not just losing money.
[30:08.330 --> 30:15.910]  There was a case at Rutgers University a couple of years ago where the students were a little upset with all the stuff that was going on.
[30:15.910 --> 30:20.310]  They were putting social security numbers on registers and on ID cards and all this stuff.
[30:20.530 --> 30:21.890]  And they sued in one.
[30:22.750 --> 30:26.930]  So it is very viable if you can find somebody to take a case.
[30:27.030 --> 30:33.830]  There is a case law out there that you can sue the university to prevent them from using the social security number as your ID number.
[30:34.890 --> 30:38.930]  Also under the Privacy Act of 1974, it's a federal...
[30:39.640 --> 30:44.810]  It's a state or federal entity and that includes state schools.
[30:45.990 --> 30:53.070]  You can demand that they not use it unless they were using it pre-1974 and that's probably available.
[30:53.070 --> 30:58.910]  The first question she had was actually about identification in her workplace.
[30:59.250 --> 31:05.150]  And under INS rules or under federal law, there's actually about 20 or 30 documents that they could use.
[31:05.350 --> 31:09.590]  So it's not just a single document that they have, but that's what they'd like to have.
[31:09.890 --> 31:16.030]  And as soon as they have one document that everybody's going to have, you can bet your bottom dollar they're going to start using it for other benefits.
[31:20.490 --> 31:23.230]  My birth certificate doesn't have my social security number on it.
[31:24.050 --> 31:25.850]  Nor does my baptismal certificate.
[31:26.970 --> 31:28.850]  You had a question, this third guy?
[31:29.390 --> 31:30.250]  Yeah, just more quick.
[31:30.510 --> 31:31.630]  What's the difference between the one that
[31:34.820 --> 31:35.580]  you're supposed to be here?
[31:35.680 --> 31:38.640]  Well, Privacy International is an international group.
[31:39.060 --> 31:40.460]  It's based in London.
[31:41.960 --> 31:45.600]  We're basically the Washington office of it, I don't know if it gets.
[31:45.840 --> 31:52.980]  But it's a coalition of a series of groups around the world, in Germany, in Australia, in the Netherlands,
[31:56.220 --> 32:02.700]  that it's really, it's made use for the sciences and advocacy group, is to be able to share information worldwide.
[32:03.040 --> 32:09.080]  In 1987, when the Australia Park campaign happened, they had no idea what was going on anywhere else in the world.
[32:09.280 --> 32:20.300]  And they realized that had they known what had gone on in Europe years previous, with riots and stuff against censuses and ID cards, they would have been able to use it and be even more effective than they were.
[32:20.300 --> 32:31.500]  So, the forum PI, I joined a few years later, to do that kind of information sharing and coordinated attacks and that sort of thing around the world.
[32:59.040 --> 33:02.740]  That's, in other words, the question is how do you protect your privacy, your transaction privacy?
[33:03.020 --> 33:03.900]  How do you make the efficiency?
[33:04.440 --> 33:12.540]  Um, there are mathematical ways to do that, and in fact, Eric Hughes is certainly doing a lot of work on that, as are some other people.
[33:12.540 --> 33:17.400]  Um, there are a couple things going on that, that are worth thinking about.
[33:17.720 --> 33:28.700]  Um, the Uniform Commercial Code, which is sort of the law of the land in respect to doing business, is undergoing, would it be fair to describe it as an overhaul, I think?
[33:30.060 --> 33:38.480]  And, uh, in my understanding, I've met some people who work for some very large computer companies that develop very big machines that don't ever go down even when you pull boards out of them and stuff.
[33:39.820 --> 33:53.900]  And, apparently, the government is really trying to figure out how to design systems that would be able to keep track of basically all of the trans-, the total body of transaction information for financial transactions in the United States.
[33:54.200 --> 33:55.820]  That includes cash.
[33:57.180 --> 34:04.180]  And the technology is basically, has matured enough to the point that you could conceivably do that.
[34:04.200 --> 34:05.320]  That's a hell of a lot of work.
[34:06.240 --> 34:10.260]  But, it should be noted that there are people working on that stuff now.
[34:10.600 --> 34:18.760]  So, one of the things to keep a real close eye on is the, uh, the business world.
[34:19.000 --> 34:25.460]  Because the Department of Justice and the Department of Treasury, a lot of this stuff comes out of Treasury, so you need to keep an eye on them.
[34:25.660 --> 34:26.780]  It's not all justice anymore.
[34:27.180 --> 34:31.200]  The Treasury Department really, really wants to know stuff about how you spend your money.
[35:04.270 --> 35:10.570]  You know, there are ways to develop databases that are, that are basically anonymous.
[35:10.570 --> 35:16.970]  Um, and if you provide the mapping, then they can go and look up how to find the mapping between you and that thing.
[35:18.030 --> 35:23.850]  Again, it's a situation where you have to educate people for building these tools to use that technology.
[35:24.090 --> 35:28.390]  Because, yeah, there, there is technology to create anonymous databases of very useful information.
[35:28.390 --> 35:32.470]  Now, there are obviously validity checking problems with that, that are really hard to reconcile.
[35:33.150 --> 35:34.250]  But, but there are tools.
[35:34.430 --> 35:37.410]  I mean, that's kind of, one of the magic things that Matt Layton is talking about.
[35:37.510 --> 35:38.570]  That you can do with cryptography.
[35:38.770 --> 35:41.950]  You can create stuff and not know who it belongs to.
[35:42.190 --> 35:44.450]  And all of a sudden, when you need it, be able to restore it.
[35:45.070 --> 35:46.510]  I think we have another question.
[35:46.510 --> 35:50.350]  Yeah, I just want to know where to get membership information on these organizations.
[35:51.930 --> 35:56.030]  On all four that you mentioned, or like any or all of the above?
[35:56.470 --> 36:00.370]  I have membership information on PI here.
[36:00.670 --> 36:08.740]  And I put a bunch of press releases on when we sued the FBI for Epic out in the main hall earlier.
[36:08.740 --> 36:10.920]  So, for that, uh...
[36:10.920 --> 36:14.160]  EFF is EFF at EFF dot org.
[36:14.460 --> 36:17.380]  CPSR is CPSR at CPSR dot org.
[36:18.340 --> 36:19.660]  That's kind of new.
[36:21.100 --> 36:22.340]  Okay, sorry.
[36:22.660 --> 36:24.140]  Electronic Frontier Foundation.
[36:24.540 --> 36:32.500]  Information can be gotten by emailing EFF at EFF dot org org.
[36:33.340 --> 36:38.060]  And CPSR is CPS, Computer Professionals for Social Responsibility.
[36:38.060 --> 36:43.280]  Login CPSR at CPSR dot org.
[36:44.220 --> 36:46.680]  And EFF, we decided it'd be different.
[36:46.920 --> 36:48.420]  It's info at EFF dot org.
[37:00.150 --> 37:01.830]  No, it's Thailand.
[37:02.290 --> 37:09.650]  Even got an award for it from the Smithsonian Institute for the best use of tracking technology.
[37:09.650 --> 37:13.390]  It's this little ID card that literally links everything together.
[37:13.670 --> 37:17.290]  From criminal records to not just you, but your family also.
[37:18.550 --> 37:18.870]  Um...
[37:19.190 --> 37:25.370]  And our friends at Computer World at the Smithsonian gave them the award for great use of technology for that.
[37:39.530 --> 37:52.410]  Yeah, we need to, um, I don't know about open mic, but we just sort of made up their time, so, um, somebody needs to give me an update if we can, like, keep moving on into the social engineering space or if their telephone ever showed up.
[37:52.410 --> 37:56.130]  There's a Panasonic telephone that sprouted, like, somewhere in a specialized telephone.
[37:56.510 --> 37:56.930]  Yeah.
[37:57.190 --> 37:58.350]  He said to have it on.
[38:01.510 --> 38:03.330]  And also, um, there was a note earlier.
[38:03.490 --> 38:08.290]  Somebody that's got a radio has it permanently on, so everyone's listening to the conversation wherever you're sitting.
[38:10.350 --> 38:14.950]  Whoever's got radios on, please check them to make sure the mic button isn't permanently on.
[38:26.010 --> 38:31.730]  So, uh, if there's no other questions, then, um, I guess we'll move into, did you have a question?
[38:38.710 --> 38:39.750]  Email your congressman.
[38:40.430 --> 38:45.850]  Congress critters are actually scared to get email because, you know, if they give, if they get an account, then they might, like, care for people.
[38:47.350 --> 38:49.910]  Oh, and we, we have one public service announcement.
[38:50.170 --> 38:52.270]  If Kevin Mitnick is here, please call the FBI.
[38:55.650 --> 38:57.610]  Oh, they're looking for you.
[38:59.670 --> 39:01.650]  Don't fuck with my credit rating, please.
[39:03.250 --> 39:04.070]  The gentleman.
[39:14.540 --> 39:15.060]  Okay.
[39:15.420 --> 39:22.140]  Um, the update on, um, Phiber Optik has call from jail is that, it's going to be taped and it'll be played at, uh, 11 o'clock.
[39:25.180 --> 39:26.080]  We'll see a hand.
[39:26.320 --> 39:27.260]  An easy question.
[39:27.500 --> 39:30.480]  Can you, uh, tell me where I can get some information on asymmetric ciphers?
[39:31.260 --> 39:32.560]  On asymmetric ciphers?
[39:32.580 --> 39:34.120]  You mean, like, public key encryption?
[39:34.960 --> 39:47.900]  No, where, uh, where I generate a decryption key, uh, no, an encryption key, um, and I compute also my own decryption key, but I only send the encryption key.
[39:47.900 --> 39:48.140]  Right.
[39:48.460 --> 39:48.760]  Yeah.
[39:48.760 --> 39:55.100]  The general, the general, the general, specific application of asymmetric ciphers you're talking about is, is commonly called public key cryptography.
[39:55.100 --> 40:05.580]  I strongly recommend a book by a guy named Bruce Schneier, S-C-H-N-E-I-E-R, called Applied Cryptography.
[40:05.980 --> 40:10.180]  Um, you can find it at almost any bookstore and they are selling very, very quickly.
[40:10.680 --> 40:15.280]  Uh, and the, the, basically the book is, is directed at those people.
[40:15.440 --> 40:20.960]  He says, it's not necessarily for scientists, but it's probably for people who are sitting next to workstations.
[40:21.660 --> 40:25.380]  There's, there's source code in the bag and descriptions of outer and stuff like that.
[40:25.520 --> 40:25.780]  Thank you.
[40:26.060 --> 40:31.720]  So, uh, according to the government, you can export the book, but you can't export the disc with the exact same source code.
[40:57.310 --> 41:03.070]  Oh, there's a, there's a, there's a big, there's a major push with respect to denying services to people of armed citizens.
[41:03.390 --> 41:08.950]  I mean, that's, that's been fairly explicit when you, if you listen to, watch TV and you get back in Congress.
[41:18.010 --> 41:21.670]  You just got the, uh, the high side and we need to stop here.
[41:21.730 --> 41:23.270]  Thank you.