NSA warrantless surveillance (200107) – Wikipedia, the …

The NSA warrantless surveillance controversy ("warrantless wiretapping") concerns surveillance of persons within the United States during the collection of allegedly foreign intelligence by the U.S. National Security Agency (NSA) as part of the touted war on terror. Under this program, referred to by the Bush administration as the terrorist surveillance program,[1] part of the broader President's Surveillance Program, the NSA was authorized by executive order to monitor, without search warrants, the phone calls, Internet activity (Web, e-mail, etc.), text messaging, and other communication involving any party believed by the NSA to be outside the U.S., even if the other end of the communication lies within the U.S. However, it has been discovered that all U.S. communications have been digitally cloned by government agencies, in apparent violation of unreasonable search and seizure. The excuse given to avoid litigation[citation needed] was that no data hoarded would be reviewed until searching it would be legal. But no excuse has been offered the initial seizure of the data which is also illegal,[citation needed] according to the U.S. Constitution.[citation needed]

Critics, however, claimed that the program was in an effort to attempt to silence critics of the Bush Administration and its handling of several controversial issues during its tenure. Under public pressure, the Bush administration allegedly ceased the warrantless wiretapping program in January 2007 and returned review of surveillance to the FISA court.[2] Subsequently, in 2008 Congress passed the FISA Amendments Act of 2008, which relaxed some of the original FISA court requirements.

During the Obama Administration, the NSA has allegedly continued operating under the new FISA guidelines despite campaign promises to end warrantless wiretapping.[3] However, in April 2009 officials at the United States Department of Justice acknowledged that the NSA had engaged in "overcollection" of domestic communications in excess of the FISA court's authority, but claimed that the acts were unintentional and had since been rectified.[4]

All wiretapping of American citizens by the National Security Agency requires a warrant from a three-judge court set up under the Foreign Intelligence Surveillance Act. After the 9/11 attacks, Congress passed the Patriot Act, which granted the President broad powers to fight a war against terrorism. The George W. Bush administration used these powers to bypass the FISA court and directed the NSA to spy directly on al-Qaeda in a new NSA electronic surveillance program. Reports at the time indicate that an "apparently accidental" "glitch" resulted in the interception of communications that were purely domestic in nature.[5] This action was challenged by a number of groups, including Congress, as unconstitutional.

The exact scope of the program remains secret, but the NSA was provided total, unsupervised access to all fiber-optic communications going between some of the nation's largest telecommunication companies' major interconnected locations, including phone conversations, email, web browsing, and corporate private network traffic.[6] Critics said that such "domestic" intercepts required FISC authorization under the Foreign Intelligence Surveillance Act.[7] The Bush administration maintained that the authorized intercepts were not domestic but rather foreign intelligence integral to the conduct of war and that the warrant requirements of FISA were implicitly superseded by the subsequent passage of the Authorization for Use of Military Force Against Terrorists (AUMF).[8] FISA makes it illegal to intentionally engage in electronic surveillance under appearance of an official act or to disclose or use information obtained by electronic surveillance under appearance of an official act knowing that it was not authorized by statute; this is punishable with a fine of up to $10,000 or up to five years in prison, or both.[9] In addition, the Wiretap Act prohibits any person from illegally intercepting, disclosing, using or divulging phone calls or electronic communications; this is punishable with a fine or up to five years in prison, or both.[10]

After an article about the program, (which had been code-named Stellar Wind), was published in The New York Times on December 16, 2005, Attorney General Alberto Gonzales confirmed its existence.[11][12][13]The Times had posted the exclusive story on their website the night before, after learning that the Bush administration was considering seeking a Pentagon-Papers-style court injunction to block its publication.[14]Bill Keller, the newspaper's former executive editor, had withheld the story from publication since before the 2004 Presidential Election, and the story that was ultimately published was essentially the same as reporters James Risen and Eric Lichtblau had submitted in 2004. The delay drew criticism from some in the press, arguing that an earlier publication could have changed the election's outcome.[15] In a December 2008 interview with Newsweek, former Justice Department employee Thomas Tamm revealed himself to be the initial whistle-blower to The Times.[16] The FBI began investigating leaks about the program in 2005, with 25 agents and 5 prosecutors on the case.[17]

Gonzales said the program authorized warrantless intercepts where the government had "a reasonable basis to conclude that one party to the communication is a member of al Qaeda, affiliated with al Qaeda, or a member of an organization affiliated with al Qaeda, or working in support of al Qaeda" and that one party to the conversation was "outside of the United States."[18] The revelation raised immediate concern among elected officials, civil right activists, legal scholars and the public at large about the legality and constitutionality of the program and the potential for abuse. Since then, the controversy has expanded to include the press' role in exposing a classified program, the role and responsibility of the US Congress in its executive oversight function and the scope and extent of presidential powers under Article II of the Constitution.[19]

In mid-August 2007, a three-judge panel of the United States Court of Appeals for the Ninth Circuit heard arguments in two lawsuits challenging the surveillance program. The appeals were the first to reach the court after dozens of civil suits against the government and telecommunications companies over NSA surveillance were consolidated last year before the chief judge of the Northern District of California, Vaughn R. Walker. One of the cases is a class-action lawsuit against AT&T, focusing on allegations that the company provided the NSA with its customers' phone and Internet communications for a vast data-mining operation. Plaintiffs in the second case are the al-Haramain Foundation Islamic charity and two of its lawyers.[20][21]

On November 16, 2007, the three judgesM. Margaret McKeown, Michael Daly Hawkins, and Harry Pregersonissued a 27-page ruling that the charity, the Al-Haramain Islamic Foundation, could not introduce a key piece of evidence in its case because it fell under the government's claim of state secrets, although the judges said that "In light of extensive government disclosures, the government is hard-pressed to sustain its claim that the very subject matter of the litigation is a state secret."[22][23]

In an August 14, 2007, question-and-answer session with the El Paso Times which was published on August 22, Director of National Intelligence Mike McConnell confirmed for the first time that the private sector helped the warrantless surveillance program. McConnell argued that the companies deserved immunity for their help: "Now if you play out the suits at the value they're claimed, it would bankrupt these companies".[24] Plaintiffs in the AT&T suit subsequently filed a motion with the court to have McConnell's acknowledgement admitted as evidence in their case.[25]

The program may face an additional legal challenge in the appeal of two Albany, New York, men convicted of criminal charges in an FBI anti-terror sting operation. Their lawyers say they have evidence the men were the subjects of NSA electronic surveillance, which was used to obtain their convictions but not made public at trial or made available in response to discovery requests by defense counsel at that time.[26]

In an unusual related legal development, on October 13, 2007, The Washington Post reported that Joseph P. Nacchio, the former CEO of Qwest Communications, is appealing an April 2007 conviction on 19 counts of insider trading by alleging that the government withdrew opportunities for contracts worth hundreds of millions of dollars after Qwest refused to participate in an unidentified National Security Agency program that the company thought might be illegal. According to court documents unsealed in Denver in early October as part of Nacchio's appeal, the NSA approached Qwest about participating in a warrantless surveillance program more than six months before the Sep 11, 2001, attacks which have been cited by the government as the main impetus for its efforts. Nacchio is using the allegation to try to show why his stock sale should not have been considered improper.[27] According to a lawsuit filed against other telecommunications companies for violating customer privacy, AT&T began preparing facilities for the NSA to monitor "phone call information and Internet traffic" seven months before 9/11.[28]

On August 17, 2007, the Foreign Intelligence Surveillance Court said it would consider a request filed by the American Civil Liberties Union which asked the intelligence court to make public its recent, classified rulings on the scope of the government's wiretapping powers. Judge Colleen Kollar-Kotelly, presiding judge of the FISC, signed an order calling the ACLU's motion "an unprecedented request that warrants further briefing."[29] The FISC ordered the government to respond on the issue by August 31, saying that anything involving classified material could be filed under court seal.[30][31] On the August 31 deadline, the National Security Division of the Justice Department filed a response in opposition to the ACLU's motion with the court.[32]

In previous developments, the case ACLU v. NSA was dismissed on July 6, 2007 by the United States Court of Appeals for the Sixth Circuit.[33] The court did not rule on the spying program's legality. Instead, its 65-page opinion declared that the American Civil Liberties Union and the others who brought the case including academics, lawyers and journalists did not have the legal standing to sue because they could not demonstrate that they had been direct targets of the clandestine surveillance.[34] Detroit District Court judge Anna Diggs Taylor had originally ruled on August 17, 2006 that the program is illegal under FISA as well as unconstitutional under the First and Fourth amendments of the United States Constitution.[35][36][37]Judicial Watch, a watchdog group, discovered that at the time of the ruling Taylor "serves as a secretary and trustee for a foundation that donated funds to the ACLU of Michigan, a plaintiff in the case."[38] On February 19, 2008, the U.S. Supreme Court, without comment, turned down an appeal from the American Civil Liberties Union, letting stand the earlier decision dismissing the case.[39]

On September 28, 2006 the U.S. House of Representatives passed the Electronic Surveillance Modernization Act (H.R. 5825).[40] That bill now has been passed to the U.S. Senate, where three competing, mutually exclusive, billsthe Terrorist Surveillance Act of 2006 (S.2455) (the DeWine bill), the National Security Surveillance Act of 2006 (S.2455) (the Specter bill), and the Foreign Intelligence Surveillance Improvement and Enhancement Act of 2006 (S.3001) (the Specter-Feinstein bill) were themselves referred for debate to the full Senate by the Senate Judiciary Committee on September 13, 2006.[41] Each of these bills would in some form broaden the statutory authorization for electronic surveillance, while still subjecting it to some restrictions. The Specter-Feinstein bill would extend the peacetime period for obtaining retroactive warrants to seven days and implement other changes to facilitate eavesdropping while maintaining FISA court oversight. The DeWine bill, the Specter bill, and the Electronic Surveillance Modernization Act (passed by the House) would all authorize some limited forms or periods of warrantless electronic surveillance subject to additional programmatic oversight by either the FISC (Specter bill) or Congress (DeWine and Wilson bills).

On January 17, 2007, Attorney General Alberto Gonzales informed U.S. Senate leaders by letter that the program would not be reauthorized by the President.[2] "Any electronic surveillance that was occurring as part of the Terrorist Surveillance Program will now be conducted subject to the approval of the Foreign Intelligence Surveillance Court," according to his letter.[42]

On September 18, 2008, the Electronic Frontier Foundation (EFF), an Internet-privacy advocacy group, filed a new lawsuit against the NSA, President George W. Bush, Vice President Dick Cheney, Cheney's chief of staff David Addington, former Attorney General and White House Counsel Alberto Gonzales and other government agencies and individuals who ordered or participated in the warrantless surveillance. They sued on behalf of AT&T customers to seek redress for what the EFF alleges to be an illegal, unconstitutional, and ongoing dragnet surveillance of their communications and communications records. An earlier, ongoing suit by the EFF may be bogged down by the recent changes to FISA provisions, but these are not expected to impact this new case.[43][44]

On January 23, 2009, the administration of President Barack Obama adopted the same position as his predecessor when it urged U.S. District Judge Vaughn Walker to set aside a ruling in Al-Haramain Islamic Foundation et al. v. Obama, et al.[45] The Obama administration also sided with the former administration in its legal defense of July 2008 legislation that immunized the nation's telecommunications companies from lawsuits accusing them of complicity in the eavesdropping program, according to testimony by Attorney General Eric Holder.[46]

On March 31, 2010, Judge Vaughn R. Walker, chief judge of the Federal District Court in San Francisco, ruled that the National Security Agency's program of surveillance without warrants was illegal when it intercepted phone calls of Al Haramain. Declaring that the plaintiffs had been "subjected to unlawful surveillance", the judge said the government was liable to pay them damages.[47]

In 2012, the Ninth Circuit vacated the judgment against the United States and affirmed the district court's dismissal of the claim against Mueller.[48]

The Trailblazer Project, an NSA IT project that began in 2000, has also been linked to warrantless surveillance. It was chosen over ThinThread, which had included some privacy protections. Three ex-NSA staffers, William Binney, J. Kirke Wiebe, and Ed Loomis, all of whom had quit NSA over concerns about the legality of the agency's activities, teamed with Diane Roark, a staffer on the House Intelligence Committee, to ask the Inspector General to investigate. A major source for the IG report was Thomas Andrews Drake, an ex-Air Force senior NSA official with an expertise in computers. Siobhan Gorman of The Baltimore Sun published a series of articles about Trailblazer in 20062007.

The FBI agents investigating the 2005 The New York Times story eventually made their way to The Baltimore Sun story, and then to Binney, Wiebe, Loomis, Roark, and Drake. In 2007 armed FBI agents raided the houses of Roark, Binney, and Wiebe. Binney claimed they pointed guns at his head. Wiebe said it reminded him of the Soviet Union. None were charged with crimes except for Drake. In 2010 he was indicted under the Espionage Act of 1917, as part of Obama's unprecedented crackdown on leakers.[49][50] The charges against him were dropped in 2011 and he pled to a single misdemeanor.

The 1978 Foreign Intelligence Surveillance Act (FISA) regulates U.S. government agencies' carrying out of physical searches, and electronic surveillance, wherein a significant purpose is the gathering of foreign intelligence information. "Foreign intelligence information" is defined in 50 U.S.C.1801 as information necessary to protect the U.S. or its allies against actual or potential attack from a foreign power, sabotage or international terrorism. FISA defines a "foreign power" as a foreign government or any faction(s) of a foreign government not substantially composed of US persons, or any entity directed or controlled by a foreign government. FISA provides for both criminal and civil liability for intentional electronic surveillance under color of law except as authorized by statute.

FISA provides two documents for the authorization of surveillance. First, FISA allows the Justice Department to obtain warrants from the Foreign Intelligence Surveillance Court (FISC) before or up to 72 hours after the beginning of the surveillance. FISA authorizes a FISC judge to issue a warrant for the electronic cameras if "there is probable cause to believe that the target of the electronic surveillance is a foreign power or an agent of a foreign power." 50 U.S.C. 1805(a)(3). Second, FISA permits the President or his delegate to authorize warrantless surveillance for the collection of foreign intelligence if "there is no substantial likelihood that the surveillance will acquire the contents of any communication to which a United States person is a party". 50 U.S.C. 1802(a)(1).[51]

Soon after the September 11, 2001 attacks U.S. President George W. Bush issued an executive order that authorized the National Security Agency (NSA) to conduct surveillance of certain telephone calls without obtaining a warrant from the FISC as stipulated by FISA (see 50 U.S.C.1802 50 U.S.C.1809 ). The complete details of the executive order are not known, but according to statements by the administration,[52] the authorization covers telephone calls originating overseas from or to a person suspected of having links to terrorist organizations such as al-Qaeda or its affiliates even when the other party to the call is within the US. The legality of surveillance involving US persons and extent of this authorization is at the core of this controversy which has steadily grown to include:

About a week after the 9/11 attacks, Congress passed the Authorization for Use of Military Force Against Terrorists (AUMF) which authorized the President to "use all necessary and appropriate force against those nations, organizations, or persons he determines planned, authorized, committed, or aided the terrorist attacks that occurred on September 11, 2001, or harbored such organizations or persons, in order to prevent any future acts of international terrorism against the United States by such nations, organizations or persons."

The administration has argued that the language used in the AUMF implicitly authorized the President to exercise those powers "incident to the waging of war", including the collection of enemy intelligence, FISA provisions notwithstanding.[8]

On January 20, 2006, Senator Patrick Leahy (D-VT), the ranking Democrat on the Senate Judiciary Committee along with lone co-sponsor Senator Ted Kennedy (D-MA) introduced S. Res. 350, a resolution "expressing the sense of the Senate that Senate Joint Resolution 23 (107th Congress), as adopted by the Senate on September 14, 2001, and subsequently enacted as the Authorization for Use of Military Force does not authorize warrantless domestic surveillance of United States citizens."[55][56] This non-binding resolution died in the Senate without being brought up for debate or being voted upon.[57]

Because of its highly classified status, little is publicly known about the actual implementation of the NSA domestic electronic surveillance program. Mark Klein, a retired AT&T communications technician, submitted an affidavit including limited technical details known to him personally in support of a class-action lawsuit filed by the Electronic Frontier Foundation in federal district court in San Francisco in January 2006 on behalf of AT&T customers who alleged that they had been damaged by the telecommunications corporation's cooperation with the NSA. The lawsuit is called Hepting v. AT&T.[60][61]

A January 16, 2004 statement by Mr. Klein includes additional technical details regarding the secret 2003 construction of an NSA-operated monitoring facility in Room 641A of 611 Folsom Street in San Francisco, the site of a large SBC phone building, three floors of which are occupied by AT&T.[62][63]

According to Klein's affidavit, the NSA-equipped room uses equipment built by Narus Corporation to intercept and analyze communications traffic, as well as perform data-mining functions.[64]

In an article appearing in the January/February 2008 issue of the Institute of Electrical and Electronics Engineers journal of Security and Privacy, noted technology experts from academia and the computing industry analyzed potential security risks posed by the NSA program, based on information contained in Klein's affidavits as well as those of expert witness J. Scott Marcus, a designer of large-scale IP-based data networks, former CTO at GTE Internetworking and at Genuity, and former senior advisor for Internet Technology at the US Federal Communications Commission.[65] They concluded that the likely architecture of the system created serious security risks, including the danger that such a surveillance system could be exploited by unauthorized users, criminally misused by trusted insiders, or abused by government agents.[66]

Journalist Barton Gellman reported in the Washington Post that David Addington who was at that time legal counsel to former Vice President Dick Cheney was the author of the controlling legal and technical documents for the NSA surveillance program, typing the documents on a TEMPEST-shielded computer across from his desk in room 268 of the Eisenhower Executive Office Building and storing them in a vault in his office.[67][68][69]

The NSA surveillance controversy involves legal issues that fall into two broad disciplines: statutory interpretation and Constitutional law. Statutory interpretation is the process of interpreting and applying legislation to the facts of a given case. Constitutional law is the body of law that governs the interpretation of the United States Constitution and covers areas of law such as the relationship between the federal government and state governments, the rights of individuals, and other fundamental aspects of the application of government authority in the United States.[70]

However, there are analogies between the NSA Spying Scandal (20012007) and Hewlett-Packard spying scandal (2006)[71] that may ease to predict the court outcomes. HP, in order to find the leak source of its board strategic minutes revealed to press, employed several contractors to investigate the leak issue but without engaging any external legal firm and supervisory stakeholder. Contractors, under supervision of the HP's internal investigation team, confidentially used false pretense and social security numbers a spying technique namely Pretexting for obtaining phone records of suspicious board members and several journalists. Later on, the HP's surveillance extended beyond the board of directors leaking issue and became a conspiracy for interest of the probe initiators; through which it was claimed that the informational privacy rights of even innocent employees and directors of the board, who had nothing to do with the board leaks, were violated.

In October 2006, HP's chairwoman Patricia Dunn and HP's former chief ethics officer Kevin Hunsaker and several private investigators were charged for criminal cases under California Penal Code such as

All of these charges were dismissed.[72]

18 U.S.C.2511(2)(f) provides in relevant part that "the Foreign Intelligence Surveillance Act of 1978 shall be the exclusive means by which electronic surveillance, as defined in 50 U.S.C.1801(f) ... and the intercept of domestic [communications] may be conducted." The interpretation of this clause is central to the controversy because both sides agree that the NSA program operates outside of the procedural framework provided by FISA. The interpretive conflict arises because other provisions of FISA, including the criminal sanctions subpart 50 U.S.C.1809 include an "unless authorized by statute" provision, raising the issue of statutory ambiguity. The administration's position is that the AUMF is an authorizing statute which satisfies the FISA criteria.

The U.S. Supreme Court faced a similar issue in Hamdi v. Rumsfeld where the government claimed that the AUMF authorized the President to detain U.S. citizens designated as an enemy combatant despite its lack of specific language to that intent and notwithstanding the provisions of 18 U.S.C.4001(a) which requires that the United States government cannot detain an American citizen except by an act of Congress. In that case, the Court ruled:

[B]ecause we conclude that the Government's second assertion ["that 4001(a) is satisfied, because Hamdi is being detained "pursuant to an Act of Congress" [the AUMF] is correct, we do not address the first. In other words, for the reasons that follow, we conclude that the AUMF is explicit congressional authorization for the detention of individuals ... and that the AUMF satisfied 4001(a)'s requirement that a detention be "pursuant to an Act of Congress"

In Hamdan v. Rumsfeld however, the court rejected the government's argument that the AUMF implicitly authorized the President to establish military commissions in violation of the UCMJ. The opinion of the Court held:

Neither of these congressional Acts, [AUMF or ATC] however, expands the President's authority to convene military commissions. First, while we assume that the AUMF activated the President's war powers, see Hamdi v. Rumsfeld, 542 U.S. 507 (2004)) (plurality opinion), and that those powers include the authority to convene military commissions in appropriate circumstances, see id., at 518; Quirin, 317 U. S., at 2829; see also Yamashita, 327 U. S., at 11, there is nothing in the text or legislative history of the AUMF even hinting that Congress intended to expand or alter the authorization set forth in Article 21 of the UCMJ. Cf. Yerger, 8 Wall., at 105 ("Repeals by implication are not favored")

Determining when explicit congressional authorization is and is not required appears by this decision to require a court to first determine whether an implicit authorization would amount to a "repeal by implication" of the governing Act.

The exclusivity clause also raises a separation of powers issue. (See Constitutional law issues below)

The arguments against the legality of the NSA fall into two broad categories, those who argue that FISA raises no Constitutional issues and therefore the NSA program is illegal on its face

Common to both of these views is the argument that the participation of "US persons" as defined in FISA 50 U.S.C.1801 renders the objectional intercepts "domestic" in nature.[73] Those advocating the "no constitutional issue" position, argue that Congress has the authority it needs to legislate in this area under Article I and the Fourth Amendment[74] while those who see a constitutional conflict[75] acknowledge that the existing delineation between Congressional and Executive authority in this area is not clear[76] but that Congress, in including the exclusivity clause in FISA, meant to carve out a legitimate role for itself in this arena.

The administration holds that an exception to the normal warrant requirements exists when the purpose of the surveillance is to prevent attack from a foreign threat. Such an exception has been upheld at the Circuit Court level when the target was a foreign agent residing abroad,[77][78] a foreign agent residing in the US,[79][80][81][82] and a US citizen abroad.[83] The warrantless exception was struck down when both the target and the threat was deemed domestic.[84] The legality of targeting US persons acting as agents of a foreign power and residing in this country has not been addressed by the US Supreme Court, but has occurred at least once, in the case of Aldrich Ames.[85]

The Administration's position with regard to statutory interpretation, as outlined in the DOJ whitepaper, is to avoid what it has termed the "difficult Constitutional questions" by

This argument, as outlined in the DOJ whitepaper, is based on the language of the AUMF, specifically, the acknowledgment of the President's Constitutional authority contained in the preamble; "Whereas, the President has authority under the Constitution to take action to deter and prevent acts of international terrorism against the United States", and the language in the resolution itself;

[Be it resolved] [t]hat the President is authorized to use all necessary and appropriate force against those nations, organizations, or persons he determines planned, authorized, committed, or aided the terrorist attacks that occurred on September 11, 2001, or harbored such organizations or persons, in order to prevent any future acts of international terrorism against the United States by such nations, organizations or persons.

The administration also adds that the program is legal under Title II of the USA PATRIOT Act entitled Enhanced Surveillance Procedures,[citation needed] although it is not relying upon the domestic law enforcement provisions of the PATRIOT Act for authorization of any of the NSA program activities.[citation needed] The President had said prior to this, that Americans' civil liberties were being protected and that purely domestic wiretapping was being conducted pursuant to warrants under applicable law, including the Patriot Act.[87]

These arguments must be compared to the language of the FISA itself, which states:

Notwithstanding any other law, the President, through the Attorney General, may authorize electronic surveillance without a court order under this subchapter to acquire foreign intelligence information for a period not to exceed fifteen calendar days following a declaration of war by the Congress.[88]

Because the law only authorizes the President to bypass the FISA court during the first 15 days of a war declared by Congress (see "Declaration of war"), the administration's argument rests on the assumption that the AUMF gave the President more power than was understood as absolutely implicit in any Congressional "declaration of war" at the time of the statute's enactment. However, as a "declaration of war by the Congress" encompasses all military actions so declared, no matter how small, brief or otherwise constrained by Congress, the above citation could be seen as setting not a default or typical level of Presidential wartime authority, but instead a presumptive minimum, which might more often than not be extended (explicitly or implicitly) by Congress's war declaration.

According to Peter J. Wallison, former White House Counsel to President Ronald Reagan: "It is true, of course, that a president's failure to report to Congress when he is required to do so by law is a serious matter, but in reality the reporting requirement was a technicality that a President could not be expected to know about."[89] In regard to this program, a Gang of Eight (eight key members of Congress, thirteen in this case between the 107th and 109th Congressional Sessions) have been kept informed to some degree:

Under the National Security Act of 1947, 501503, codified as 50 USC 413-413b,[90] the President is required to keep Congressional intelligence committees "fully and currently" informed of U.S. intelligence activities, "consistent with ... protection from unauthorized disclosure of classified information relating to sensitive intelligence sources and methods or other exceptionally sensitive matters." For covert actions, from which intelligence gathering activities are specifically excluded in 413b(e)(1), the President is specifically permitted to limit reporting to the so-called "Gang of Eight".[91]

The administration contends that with regard to the NSA surveillance program, the administration fulfilled its notification obligations by briefing key members of Congress (thirteen individuals in this case between the 107th and 109th Congressional sessions) have been briefed on the NSA program more than a dozen times[citation needed] but they were forbidden from sharing information about the program with other members or staff.[citation needed]

On January 18, 2006 the Congressional Research Service released a report, "Statutory Procedures Under Which Congress Is To Be Informed of U.S. Intelligence Activities, Including Covert Actions".[92][93] That report found that "[b]ased upon publicly reported descriptions of the program, the NSA surveillance program would appear to fall more closely under the definition of an intelligence collection program, rather than qualify as a covert action program as defined by statute", and, therefore, concluded there was no specific statutory basis for limiting briefings on the terrorist surveillance program to the Gang of Eight.[94] However, the report goes on to note in its concluding paragraph that limited disclosure is also permitted under the statute "in order to protect intelligence sources and methods".[95]

Thus, although the specific statutory "Gang of Eight" notification procedure for covert action would not seem to apply to the NSA program, it is not clear if a limited notification procedure intended to protect sources and methods is expressly prohibited. Additionally, should the sources and methods exception apply it will require a factual determination as to whether it should apply to disclosure of the program itself or only to specific sensitive aspects.

The constitutional debate surrounding executive authorization of warrantless surveillance is principally about separation of powers ("checks and balances"). If, as discussed above, no "fair reading" of FISA can be found in satisfaction of the canon of avoidance, these issues will have to be decided at the appellate level, by United States courts of appeals. It should be noted that in such a separation of powers dispute, the burden of proof is placed upon the Congress to establish its supremacy in the matter: the Executive branch enjoys the presumption of authority until an Appellate Court rules against it.[citation needed]

Article I vests Congress with the sole authority "To make Rules for the Government and Regulation of the land and naval Forces" and "To make all Laws which shall be necessary and proper for carrying into Execution the foregoing Powers, and all other Powers vested by this Constitution in the Government of the United States, or in any Department or Officer thereof." The U.S. Supreme Court has used the "necessary and proper" clause of Article I to affirm broad Congressional authority to legislate as it sees fit in the domestic arena[citation needed] but has limited its application in the arena of foreign affairs. In the landmark Curtiss-Wright decision, Justice Sutherland writes in his opinion of the Court:

The ["powers of the federal government in respect of foreign or external affairs and those in respect of domestic or internal affairs"] are different, both in respect of their origin and their nature. The broad statement that the federal government can exercise no powers except those specifically enumerated in the Constitution, and such implied powers as are necessary and proper to carry into effect the enumerated powers, is categorically true only in respect of our internal affairs.

Article II vests the President with power as "Commander in Chief of the Army and Navy of the United States," and requires that he "shall take Care that the Laws be faithfully executed".

The U.S. Supreme Court has historically used Article II to justify wide deference to the President in the arena of foreign affairs.[citation needed] Two historical and recent Supreme Court cases define the secret wiretapping by the NSA. Quoting again from the Curtiss-Wright decision:

It is important to bear in mind that we are here dealing not alone with an authority vested in the President by an exertion of legislative power, but with such an authority plus the very delicate, plenary and exclusive power of the President as the sole organ of the federal government in the field of international relationsa power which does not require as a basis for its exercise an act of Congress, but which, of course, like every other governmental power, must be exercised in subordination to the applicable provisions of the Constitution.

The extent of the President's power as Commander-in-Chief has never been fully defined, but two U.S. Supreme Court cases are considered seminal in this area:[96][97]Youngstown Sheet and Tube Co. v. Sawyer and Curtiss-Wright.

In addition, two relatively new cases, Hamdi v. Rumsfeld and Hamdan v. Rumsfeld, have clarified, and in the case of Hamdan limited, the scope of executive power to detain and try suspected terrorists as enemy combatants.

In Hamdan, the Court's opinion in footnote 23, rejected the notion that Congress is impotent to regulate the exercise of executive war powers:

Whether or not the President has independent power, absent congressional authorization, to convene military commissions, he may not disregard limitations that Congress has, in proper exercise of its own war powers, placed on his powers. See Youngstown Sheet & Tube Co. v. Sawyer, 343 U. S. 579, 637 (1952) (Jackson, J., concurring). The Government does not argue otherwise.

Whether "proper exercise" of Congressional war powers includes authority to regulate the gathering of foreign intelligence, which in other rulings[citation needed] has been recognized as "fundamentally incident to the waging of war", is a historical point of contention between the Executive and Legislative branches.[8][98]

As noted in "Presidential Authority to Conduct Warrantless Electronic Surveillance to Gather Foreign Intelligence Information", published by The Congressional Research Service:

A review of the history of intelligence collection and its regulation by Congress suggests that the two political branches have never quite achieved a meeting of the minds regarding their respective powers. Presidents have long contended that the ability to conduct surveillance for intelligence purposes is a purely executive function, and have tended to make broad assertions of authority while resisting efforts on the part of Congress or the courts to impose restrictions. Congress has asserted itself with respect to domestic surveillance, but has largely left matters involving overseas surveillance to executive self-regulation, subject to congressional oversight and willingness to provide funds.

The same report makes clear the Congressional view that intelligence gathered within the U.S. and where "one party is a U.S. person" qualifies as domestic in nature and as such completely within their purview to regulate, and further that Congress may "tailor the President's use of an inherent constitutional power":

The passage of FISA and the inclusion of such exclusivity language reflects Congress's view of its authority to cabin the President's use of any inherent constitutional authority with respect to warrantless electronic surveillance to gather foreign intelligence.

The Senate Judiciary Committee articulated its view with respect to congressional power to tailor the President's use of an inherent constitutional power:

The Fourth Amendment to the United States Constitution is part of the Bill of Rights and helps guard against "unreasonable" searches and seizures by agents of the government. It is solely a right of the people that neither the Executive nor Legislative branch can lawfully abrogate, not even if acting in concert: no statute can make an unreasonable search reasonable, nor a reasonable search unreasonable.

The term "unreasonable" is deliberately imprecise but connotes the sense that there is a rational basis for the search and that it is not an excessive imposition upon the individual given the motivation for and circumstances of the search, and is in accordance with customary societal norms. It is conceived that a judge will be sufficiently distanced from the authorities seeking a warrant that they can render an impartial decision unaffected by any prejudices or improper motivations they (or the legislators who enacted a law they are seeking to enforce) may harbor.

An individual who believes their Fourth Amendment rights have been violated by an unreasonable search or seizure may file a civil suit for monetary compensation and seek a court-ordered end to a pattern or practice of such unlawful activities by government authorities, although the plaintiff will need to have evidence that such a wiretap is taking place in order to show standing (Amnesty International v. Clapper). Such civil rights violations are sometimes punishable by state or federal law. Evidence obtained in an unlawful search or seizure is generally inadmissible in a criminal trial.

The law countenances searches without warrant as "reasonable" in numerous circumstances, among them (see below): the persons, property, and papers of individuals crossing the border of the United States and those of paroled felons; in prisons, public schools and government offices; and of international mail. Although these are undertaken as a result of statute or Executive order, they should not be seen as deriving their legitimacy from these, rather, the Fourth Amendment explicitly allows reasonable searches, and the government has instituted some of these as public policy.

The Supreme Court held in Katz v. United States (1967), that the monitoring and recording of private conversations within the United States constitutes a "search" for Fourth Amendment purposes, and therefore the government must generally obtain a warrant before undertaking such domestic recordings.

The Supreme Court has also held in Smith v Maryland (1979) that citizens have no Fourth Amendment expectation of privacy in the business records (sometimes termed metadata) of their communications. This means that the court can subpoena data such as the numbers that an individual has phoned, when and, to a limited degree, where (subject to Jones v. United States) the phone conversation occurred, although a full judicial warrant would be required for the government to acquire or admit audio content from the telephone call. Under Section 215 of the PATRIOT act, the FBI can subpoena some or all such records from a business record holder using a warrant applied for in the Foreign Intelligence Surveillance Court.

The protection of "private conversations" has been held to apply only to conversations where the participants have not only manifested a desire but also a reasonable expectation that their conversation is indeed private and that no other party is listening in. In the absence of such a reasonable expectation, the Fourth Amendment does not apply, and surveillance without warrant does not violate it. Privacy is clearly not a reasonable expectation in communications to persons in the many countries whose governments openly intercept electronic communications, and is of dubious reasonability in countries against which the United States is waging war.

The law also recognizes a distinction between domestic surveillance taking place within U.S. borders and foreign surveillance of non-U.S. persons either in the U.S. or abroad.[99] In United States v. Verdugo-Urquidez, the Supreme Court reaffirmed the principle that the Constitution does not extend protection to non-U.S. persons located outside of the United States, so no warrant would be required to engage in even physical searches of non-U.S. citizens abroad.

The U.S. Supreme Court has never ruled on the constitutionality of warrantless searches targeting foreign powers or their agents within the US. There have been, however, a number of Circuit Court rulings upholding the constitutionality of such warrantless searches.[100] In United States v. Bin Laden, the Second Circuit noted that "no court, prior to FISA, that was faced with the choice, imposed a warrant requirement for foreign intelligence searches undertaken within the United States."[101] Assistant Attorney General William Moschella in his written response to questions from the House Judiciary Committee explained that in the administration's view, this unanimity of pre-FISA Circuit Court decisions vindicates their argument that warrantless foreign-intelligence surveillance authority existed prior to FISA and since, as these ruling indicate, that authority derives from the Executive's inherent Article II powers, they may not be encroached by statute.[102] In 2002, the United States Foreign Intelligence Surveillance Court of Review (Court of Review) met for the first time and issued an opinion (In re: Sealed Case No. 02-001) which seems to echo that view. They too noted all the Federal courts of appeal having looked at the issue had concluded that there was constitutional power for the president to conduct warrantless foreign intelligence surveillance. Furthermore, based on these rulings it "took for granted such power exits" and ruled that under this presumption, "FISA could not encroach on the president's constitutional power." Professor Orin Kerr argues in rebuttal that the part of In re: Sealed Case No. 02-001 that dealt with FISA (rather than the Fourth Amendment) was nonbinding obiter dicta and that the argument does not restrict Congress's power to regulate the executive in general.[103]

Harold Koh, dean of Yale Law School, Suzanne Spaulding, former general counsel for the Intelligence Committees of the House and Senate, and former Counsel to the President John Dean, contend that FISA clearly makes the wiretapping illegal and subject to the criminal penalties of FISA,[104] (in seeming disagreement with the FISA Court of Review finding above) and that the president's own admissions already constitute sufficient evidence of a violation of the Fourth Amendment, without requiring further factual evidence. Professor John C. Eastman, in his analysis, prepared at the behest of the House Judiciary Committee, comparing the CRS and DOJ reports, concluded instead that under the Constitution and ratified by both historical and Supreme Court precedent, "the President clearly has the authority to conduct surveillance of enemy communications in time of war and of the communications to and from those he reasonably believes are affiliated with our enemies. Moreover, it should go without saying that such activities are a fundamental incident of war."[105]

Orin S. Kerr, associate professor of law at The George Washington University Law School[106] and a leading scholar in the subjects of computer crime law and internet surveillance,[107] points to an analogy between the NSA intercepts and searches allowed by the Fourth Amendment under the border search exception.

The border search exception permits searches at the border of the United States "or its functional equivalent." (United States v. Montoya De Hernandez, 473 U.S. 531, 538 (1985)). The idea here is that the United States as a sovereign nation has a right to inspect stuff entering or exiting the country as a way of protecting its sovereign interests, and that the Fourth Amendment permits such searches. Courts have applied the border search exception in cases of PCs and computer hard drives; if you bring a computer into or out of the United States, the government can search your computer for contraband or other prohibited items at the airport or wherever you are entering or leaving the country. See, e.g., United States v. Ickes, 393 F.3d 501 (4th Cir. 2005) (Wilkinson, J.)...At the same time, I don't know of a rationale in the case law for treating data differently than physical storage devices. The case law on the border search exception is phrased in pretty broad language, so it seems at least plausible that a border search exception could apply to monitoring at an ISP or telephone provider as the "functional equivalent of the border," much like airports are the functional equivalent of the border in the case of international airline travel...the most persuasive case on point: United States v. Ramsey, [held] that the border search exception applies to all international postal mail, permitting all international postal mail to be searched.

Evidence gathered without warrant may raise significant Fourth Amendment issues which could preclude its use in a criminal trial. As a general rule of law, evidence obtained improperly without lawful authority, may not be used in a criminal prosecution.[citation needed] The U.S. Supreme Court has never addressed the constitutionality of warrantless searches (which has been broadly defined by the court to include surveillance) targeting foreign powers or their agents, the admissibility of such evidence in a criminal trial nor whether it is permissible to obtain or use evidence gathered without warrant against US persons acting as agents of a foreign power.[citation needed]

The National Security Act of 1947[108] requires Presidential findings for covert acts. SEC. 503. [50 U.S.C. 413b] (a) (5) of that act states: "A finding may not authorize any action that would violate the Constitution or any statute of the United States."

On August 17, 2006, Judge Anna Diggs Taylor of the United States District Court for the Eastern District of Michigan ruled in ACLU v. NSA that the Terrorist Surveillance Program was unconstitutional under the Fourth and First Amendments and enjoined the NSA from using the program to conduct electronic surveillance "in contravention of [FISA or Title III]".[36] In her ruling,[109] she wrote:

The President of the United States, a creature of the same Constitution which gave us these Amendments, has indisputably violated the Fourth in failing to procure judicial orders as required by FISA, and accordingly has violated the First Amendment Rights of these Plaintiffs as well.

Even some legal experts who agreed with the outcome have criticized the reasoning set forth in the opinion.[110] Others have argued that the perceived flaws in the opinion in fact reflect the Department of Justice's refusal to argue the legal merits of the program (they chose to focus solely on arguments about standing and state secrets grounds).[111]

On October 4, 2006, a panel of the United States Court of Appeals for the Sixth Circuit unanimously ruled that the government can continue the program while it appeals the lower court decision.[112][113]

On July 6, 2007 the Sixth Circuit dismissed the case, finding that the plaintiffs had no standing.

The Court found that:[114]

[T]he plaintiffs do not and because of the State Secrets Doctrine cannot produce any evidence that any of their own communications have ever been intercepted by the NSA, under the TSP, or without warrants. Instead, they assert a mere belief, which they contend is reasonable and which they label a well founded belief,...

Implicit in each of the plaintiffs' alleged injuries is the underlying possibility which the plaintiffs label a "well founded belief" and seek to treat as a probability or even a certainty that the NSA is presently intercepting, or will eventually intercept, communications to or from one or more of these particular plaintiffs, and that such interception would be detrimental to the plaintiffs' clients, sources, or overseas contacts. This is the premise upon which the plaintiffs' entire theory is built.

But even though the plaintiffs' beliefs based on their superior knowledge of their contacts' activities may be reasonable, the alternative possibility remains that the NSA might not be intercepting, and might never actually intercept, any communication by any of the plaintiffs named in this lawsuit.

Corporate secrecy is also an issue. Wired reported: In a letter to the EFF, AT&T objected to the filing of the documents in any manner, saying that they contain sensitive trade secrets and could be "used to 'hack' into the AT&T network, compromising its integrity."[115] However, Chief Judge Vaughn Walker stated, during the September 12, 2008 hearing in the class-action lawsuit filed by the EFF, that the Klein evidence could be presented in court, effectively ruling that AT&T's trade secret and security claims were unfounded.

The majority of legal arguments supporting the NSA warrantless surveillance program have been based on the War Powers Resolution. There have not been any other noteworthy types of supporting legal arguments. The War Powers Resolution has been questioned as unconstitutional since its creation, and its adaptation to the NSA warrantless surveillance program has been questionable.

Go here to read the rest:
NSA warrantless surveillance (200107) - Wikipedia, the ...

What is Open Source Software Explained – Webopedia.com

Main Did You Know Computer_Science Updated April 10, 2014 / Posted September 26, 2008

By Vangie Beal

We discuss open source software, the basics behind the Open Source Initiative (OSI), and Free Software Licensing.

Open source refers to a program or software in which the source code (the form of the program when a programmer writes a program in a particular programming language) is available to the general public for use and/or modification from its original design free of charge. Open source code is typically created as a collaborative effort in which programmers improve upon the code and share the changes within the community.

The rationale for this movement is that a larger group of programmers not concerned with proprietary ownership or financial gain will produce a more useful and bug-free product for everyone to use. The concept relies on peer review to find and eliminate bugs in the program code, a process that commercially developed and packaged programs do not employ.

The basics behind the Open Source Initiative is that when programmers can read, redistribute and modify the source code for a piece of software, the software evolves. Open source sprouted in the technological community as a response to proprietary software owned by corporations.

Proprietary software is privately owned and controlled. In the computer industry, proprietary is considered the opposite of open. A proprietary design or technique is one that is owned by a company. It also implies that the company has not divulged specifications that would allow other companies to duplicate the product.

Open Source is a certification standard issued by the Open Source Initiative (OSI) that indicates that the source code of a computer program is made available free of charge to the general public. OSI dictates that in order to be considered "OSI Certified" a product must meet the following criteria:

Open source software is normally distributed with the source code under an open source license. The Open Source Initiative sets the following distribution terms that open-source software must comply with;

Open source doesn't just mean access to the source code. The distribution terms of open-source software must comply with the following criteria:

The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license shall not require a royalty or other fee for such sale.

The program must include source code, and must allow distribution in source code as well as compiled form. Where some form of a product is not distributed with source code, there must be a well-publicized means of obtaining the source code for no more than a reasonable reproduction cost preferably, downloading via the Internet without charge. The source code must be the preferred form in which a programmer would modify the program. Deliberately obfuscated source code is not allowed. Intermediate forms such as the output of a preprocessor or translator are not allowed

The license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software.

The license may restrict source-code from being distributed in modified form only if the license allows the distribution of "patch files" with the source code for the purpose of modifying the program at build time. The license must explicitly permit distribution of software built from modified source code. The license may require derived works to carry a different name or version number from the original software.

The license must not discriminate against any person or group of persons.

The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.

The rights attached to the program must apply to all to whom the program is redistributed without the need for execution of an additional license by those parties.

The rights attached to the program must not depend on the program's being part of a particular software distribution. If the program is extracted from that distribution and used or distributed within the terms of the program's license, all parties to whom the program is redistributed should have the same rights as those that are granted in conjunction with the original software distribution.

The license must not place restrictions on other software that is distributed along with the licensed software. For example, the license must not insist that all other programs distributed on the same medium must be open-source software.

No provision of the license may be predicated on any individual technology or style of interface.

[Source: Open Source Initiative, "The Open Source Definition"]

All open source software is not distributed under the same licensing agreement. Some may use a free software license, a copyleft, or GPL compatible. The GNU GPL license is a free software license and a copyleft license, while a "GNU Lesser General Public License" is a free software license, but not a strong copyleft license. There are many different types of licenses for free software . some GNU GPL compatible, some not.

The Open Source Initiative approves open source licenses after they have successfully gone through the approval process and comply with the Open Source Definition (above). There is currently well over fifty licenses that have been approved by the OSI.

For example, the GNU General Public License (GPL) is one license that accompanies some open source software that details how the software and its accompany source code can be freely copied, distributed and modified. The most widespread use of GPL is in reference to the GNU GPL, which is commonly abbreviated simply as GPL when it is understood that the term refers to the GNU GPL.

One of the basic tenets of the GPL is that anyone who acquires the material must make it available to anyone else under the same licensing agreement. The GPL does not cover activities other than the copying, distributing and modifying of the source code.

Other open source licenses include the following:

[Source: You can read the details and newly added approved licenses on the OSI Open Source Licenses Web page]

A software programmer really has his or her own reasons for contributing to open source projects. Some may just be looking for fun or a challenge, while others are looking to improve skill and build on their programming abilities, or they may want to belong to a group project. In many instances there is the opportunity to make money as open source projects can be funded by government or corporate sponsors. Unlike commercial projects, open source projects allow the programmer's name to be known, which benefits a programmer's name and portfolio which can lead to future jobs with other funded open source or commercial projects.

The hype and benefits of open source has not gone unnoticed in the commercial world where some corporations have jumped on the open source bandwagon. Since commercial software is sold for profit, one may wonder why a company would be interested in open source projects. In many cases companies are able to profit through selling add-on tools or modules, or paid consulting services and technical support for the program.

Sendmail is an open source mail transfer agent (MTA) used for routing and delivery e-mail. The original version of Sendmail was written by Eric Allman in the early 1980s. It is estimated that Sendmail is installed on 60 to 80 percent of the Internet's mail-server computers.

Often referred to as simply Apache, a public-domain open source Web server developed by a loosely knit group of programmers. The first version of Apache, based on the NCSA httpd Web server, was developed in 1995. Core development of the Apache Web server is performed by a group of about 20 volunteer programmers, called the Apache Group. However, because the source code is freely available, anyone can adapt the server for specific needs, and there is a large public library of Apache add-ons.

(Pronounced lee-nucks or lih-nucks). A freely distributable open source operating system that runs on a number of hardware platforms. The Linux kernel was developed mainly by Linus Torvalds. Because it's free, and because it runs on many platforms, including PCs and Macintoshes, Linux has become an extremely popular alternative to proprietary operating systems.

Acronym for GNU Network Object Model Environment. (Pronounced guh-nome) GNOME is part of the GNU project and part of the free software, or open source, movement. GNOME is a Windows-like desktop system that works on UNIX and UNIX-like systems and is not dependent on any one window manager. The current version runs on Linux, FreeBSD, IRIX and Solaris. The main objective of GNOME is to provide a user-friendly suite of applications and an easy-to-use desktop.

open source Generically, open source refers to a program in which the source code is available to the general public for use and/or modification from its original design free of charge, i.e., open.

GPL Short for General Public License, the license that accompanies some open source software

GNU Self-referentially, short for GNU's not UNIX, a UNIX-compatible software system developed by the Free Software Foundation (FSF).

Linux Pronounced lee-nucks or lih-nucks. A freely-distributable open source operating system that runs on a number of hardware platforms.

GNOME Acronym for GNU Network Object Model Environment. (Pronounced guh-nome.) GNOME is part of the GNU project and part of the free software, or open source, movement.

Did You Know... The Open Source Definition was written by Bruce Perens as "The Debian Free Software Guidelines", and refined it using the comments of the Debian developers in a month-long e-mail conference in June, 1997. He removed the Debian-specific references from the document to create the "Open Source Definition."

Based in Nova Scotia, Vangie Beal is has been writing about technology for more than a decade. She is a frequent contributor to EcommerceGuide and managing editor at Webopedia. You can tweet her online @AuroraGG.

TECH RESOURCES FROM OUR PARTNERS

See original here:
What is Open Source Software Explained - Webopedia.com

Why Free Software is better than Open Source – GNU …

While free software by any other name would give you the same freedom, it makes a big difference which name we use: different words convey different ideas.

In 1998, some of the people in the free software community began using the term open source software instead of free software to describe what they do. The term open source quickly became associated with a different approach, a different philosophy, different values, and even a different criterion for which licenses are acceptable. The Free Software movement and the Open Source movement are today separate movements with different views and goals, although we can and do work together on some practical projects.

The fundamental difference between the two movements is in their values, their ways of looking at the world. For the Open Source movement, the issue of whether software should be open source is a practical question, not an ethical one. As one person put it, Open source is a development methodology; free software is a social movement. For the Open Source movement, non-free software is a suboptimal solution. For the Free Software movement, non-free software is a social problem and free software is the solution.

The Free Software movement and the Open Source movement are like two political camps within the free software community.

Radical groups in the 1960s developed a reputation for factionalism: organizations split because of disagreements on details of strategy, and then treated each other as enemies. Or at least, such is the image people have of them, whether or not it was true.

The relationship between the Free Software movement and the Open Source movement is just the opposite of that picture. We disagree on the basic principles, but agree more or less on the practical recommendations. So we can and do work together on many specific projects. We don't think of the Open Source movement as an enemy. The enemy is proprietary software.

We are not against the Open Source movement, but we don't want to be lumped in with them. We acknowledge that they have contributed to our community, but we created this community, and we want people to know this. We want people to associate our achievements with our values and our philosophy, not with theirs. We want to be heard, not obscured behind a group with different views. To prevent people from thinking we are part of them, we take pains to avoid using the word open to describe free software, or its contrary, closed, in talking about non-free software.

So please mention the Free Software movement when you talk about the work we have done, and the software we have developedsuch as the GNU/Linux operating system.

This rest of this article compares the two terms free software and open source. It shows why the term open source does not solve any problems, and in fact creates some.

The term free software has an ambiguity problem: an unintended meaning, Software you can get for zero price, fits the term just as well as the intended meaning, software which gives the user certain freedoms. We address this problem by publishing a more precise definition of free software, but this is not a perfect solution; it cannot completely eliminate the problem. An unambiguously correct term would be better, if it didn't have other problems.

Unfortunately, all the alternatives in English have problems of their own. We've looked at many alternatives that people have suggested, but none is so clearly right that switching to it would be a good idea. Every proposed replacement for free software has a similar kind of semantic problem, or worseand this includes open source software.

The official definition of open source software, as published by the Open Source Initiative, is very close to our definition of free software; however, it is a little looser in some respects, and they have accepted a few licenses that we consider unacceptably restrictive of the users. However, the obvious meaning for the expression open source software is You can look at the source code. This is a much weaker criterion than free software; it includes free software, but also some proprietary programs, including Xv, and Qt under its original license (before the QPL).

That obvious meaning for open source is not the meaning that its advocates intend. The result is that most people misunderstand what those advocates are advocating. Here is how writer Neal Stephenson defined open source:

Linux is open source software meaning, simply, that anyone can get copies of its source code files.

I don't think he deliberately sought to reject or dispute the official definition. I think he simply applied the conventions of the English language to come up with a meaning for the term. The state of Kansas published a similar definition:

Make use of open-source software (OSS). OSS is software for which the source code is freely and publicly available, though the specific licensing agreements vary as to what one is allowed to do with that code.

Of course, the open source people have tried to deal with this by publishing a precise definition for the term, just as we have done for free software.

But the explanation for free software is simplea person who has grasped the idea of free speech, not free beer will not get it wrong again. There is no such succinct way to explain the official meaning of open source and show clearly why the natural definition is the wrong one.

The main argument for the term open source software is that free software makes some people uneasy. That's true: talking about freedom, about ethical issues, about responsibilities as well as convenience, is asking people to think about things they might rather ignore. This can trigger discomfort, and some people may reject the idea for that. It does not follow that society would be better off if we stop talking about these things.

Years ago, free software developers noticed this discomfort reaction, and some started exploring an approach for avoiding it. They figured that by keeping quiet about ethics and freedom, and talking only about the immediate practical benefits of certain free software, they might be able to sell the software more effectively to certain users, especially business. The term open source is offered as a way of doing more of thisa way to be more acceptable to business. The views and values of the Open Source movement stem from this decision.

This approach has proved effective, in its own terms. Today many people are switching to free software for purely practical reasons. That is good, as far as it goes, but that isn't all we need to do! Attracting users to free software is not the whole job, just the first step.

Sooner or later these users will be invited to switch back to proprietary software for some practical advantage. Countless companies seek to offer such temptation, and why would users decline? Only if they have learned to value the freedom free software gives them, for its own sake. It is up to us to spread this ideaand in order to do that, we have to talk about freedom. A certain amount of the keep quiet approach to business can be useful for the community, but we must have plenty of freedom talk too.

At present, we have plenty of keep quiet, but not enough freedom talk. Most people involved with free software say little about freedomusually because they seek to be more acceptable to business. Software distributors especially show this pattern. Some GNU/Linux operating system distributions add proprietary packages to the basic free system, and they invite users to consider this an advantage, rather than a step backwards from freedom.

We are failing to keep up with the influx of free software users, failing to teach people about freedom and our community as fast as they enter it. This is why non-free software (which Qt was when it first became popular), and partially non-free operating system distributions, find such fertile ground. To stop using the word free now would be a mistake; we need more, not less, talk about freedom.

If those using the term open source draw more users into our community, that is a contribution, but the rest of us will have to work even harder to bring the issue of freedom to those users' attention. We have to say, It's free software and it gives you freedom!more and louder than ever before.

The advocates of open source software tried to make it a trademark, saying this would enable them to prevent misuse. This initiative was later dropped, the term being too descriptive to qualify as a trademark; thus, the legal status of open source is the same as that of free software: there is no legal constraint on using it. I have heard reports of a number of companies' calling software packages open source even though they did not fit the official definition; I have observed some instances myself.

But would it have made a big difference to use a term that is a trademark? Not necessarily.

Companies also made announcements that give the impression that a program is open source software without explicitly saying so. For example, one IBM announcement, about a program that did not fit the official definition, said this:

As is common in the open source community, users of the ... technology will also be able to collaborate with IBM ...

This did not actually say that the program was open source, but many readers did not notice that detail. (I should note that IBM was sincerely trying to make this program free software, and later adopted a new license which does make it free software and open source; but when that announcement was made, the program did not qualify as either one.)

And here is how Cygnus Solutions, which was formed to be a free software company and subsequently branched out (so to speak) into proprietary software, advertised some proprietary software products:

Cygnus Solutions is a leader in the open source market and has just launched two products into the [GNU/]Linux marketplace.

Unlike IBM, Cygnus was not trying to make these packages free software, and the packages did not come close to qualifying. But Cygnus didn't actually say that these are open source software, they just made use of the term to give careless readers that impression.

These observations suggest that a trademark would not have truly prevented the confusion that comes with the term open source.

The Open Source Definition is clear enough, and it is quite clear that the typical non-free program does not qualify. So you would think that Open Source company would mean one whose products are free software (or close to it), right? Alas, many companies are trying to give it a different meaning.

At the Open Source Developers Day meeting in August 1998, several of the commercial developers invited said they intend to make only a part of their work free software (or open source). The focus of their business is on developing proprietary add-ons (software or manuals) to sell to the users of this free software. They ask us to regard this as legitimate, as part of our community, because some of the money is donated to free software development.

In effect, these companies seek to gain the favorable cachet of open source for their proprietary software productseven though those are not open source softwarebecause they have some relationship to free software or because the same company also maintains some free software. (One company founder said quite explicitly that they would put, into the free package they support, as little of their work as the community would stand for.)

Over the years, many companies have contributed to free software development. Some of these companies primarily developed non-free software, but the two activities were separate; thus, we could ignore their non-free products, and work with them on free software projects. Then we could honestly thank them afterward for their free software contributions, without talking about the rest of what they did.

We cannot do the same with these new companies, because they won't let us. These companies actively invite the public to lump all their activities together; they want us to regard their non-free software as favorably as we would regard a real contribution, although it is not one. They present themselves as open source companies, hoping that we will get a warm fuzzy feeling about them, and that we will be fuzzy-minded in applying it.

This manipulative practice would be no less harmful if it were done using the term free software. But companies do not seem to use the term free software that way; perhaps its association with idealism makes it seem unsuitable. The term open source opened the door for this.

At a trade show in late 1998, dedicated to the operating system often referred to as Linux, the featured speaker was an executive from a prominent software company. He was probably invited on account of his company's decision to support that system. Unfortunately, their form of support consists of releasing non-free software that works with the systemin other words, using our community as a market but not contributing to it.

He said, There is no way we will make our product open source, but perhaps we will make it internal open source. If we allow our customer support staff to have access to the source code, they could fix bugs for the customers, and we could provide a better product and better service. (This is not an exact quote, as I did not write his words down, but it gets the gist.)

People in the audience afterward told me, He just doesn't get the point. But is that so? Which point did he not get?

He did not miss the point of the Open Source movement. That movement does not say users should have freedom, only that allowing more people to look at the source code and help improve it makes for faster and better development. The executive grasped that point completely; unwilling to carry out that approach in full, users included, he was considering implementing it partially, within the company.

The point that he missed is the point that open source was designed not to raise: the point that users deserve freedom.

Spreading the idea of freedom is a big jobit needs your help. That's why we stick to the term free software in the GNU Project, so we can help do that job. If you feel that freedom and community are important for their own sakenot just for the convenience they bringplease join us in using the term free software.

Lakhani and Wolf's paper on the motivation of free software developers says that a considerable fraction are motivated by the view that software should be free. This was despite the fact that they surveyed the developers on SourceForge, a site that does not support the view that this is an ethical issue.

This essay is published in Free Software, Free Society: The Selected Essays of Richard M. Stallman.

More here:
Why Free Software is better than Open Source - GNU ...

Edward Snowden, American Hero? His Greatest Defender And …

WASHINGTON -- More than two years after former National Security Agencycontractor-turned-whistleblower Edward Snowden revealed the U.S. governments mass surveillance program, his chief critic and his chief defender met on stage Wednesday morning at the annual Hewlett-Packard cybersecurity conference.

There was no bloodshed, raised voices or thrown tables as Glenn Greenwald, the journalist to whom Snowden provided his trove of documents, and former NSA Director Keith Alexander squared off. But even after two years of public outcry -- culminating with Congress voting this year to end the sweeping data programs Snowden revealed in 2013 -- tension was palpable when the whistleblowers name came up.

Around the world, hes regarded overwhelmingly as a hero, Greenwald said. He came to established media outlets... he deserves our collective gratitude for enable us to have the discussion that were having.

Perhaps unsurprisingly, Alexander, who led the NSA through the tumultuous revelations, didnt agree.

I see it slightly differently, he said after a pregnant pause.

You say you took an oath to support and defend the Constitution against all enemies foreign and domestic... he did not do that, Alexander said. So as a consequence, I think he should face justice with a jury of his peers.

Alexander did say he thought Snowden could have achieved a similar end if he had simply revealed the court documents justifying what was known as the 215 program, which sweeps up the telephone data of millions of Americans, including the numbers they dial and the length and time of the calls. But rather than just revealing the court records, Snowden provided Greenwald with millions of documents on the intricacies of programs and operations of the NSA, other intelligence agencies and U.S. allies.

If he had taken the one court document and said, This is what Im going to do... I think this would be a whole different discussion, Alexander said. I do think he had the opportunity [to be] what many could consider an American hero.

See original here:
Edward Snowden, American Hero? His Greatest Defender And ...

Julian Assange’s secret escape plan made public – The Times …

LONDON: Julian Assange, who has been holed up in the Ecuadorian embassy since 2012 had plans to escape his asylum with the help of a fancy dress, it has been revealed.

Leaked documents have confirmed that growing pressure from US and the UK to lift their hand of protection from Assange and the whistleblower's eccentric behaviour had forced Ecuadorian to draw up plausible and bizarre plans to allow him to leave the building and give the Scotland Yard officials standing guard outside a slip.

One of the possibilities looked at by the Ecuador officials was to dress him up in a disguise so that he could walk out of the building unnoticed.

A sudden dash into the nearly Harrods department store just a few yards away from the embassy was also an option.

Britain recently lodged a formal protest to Ecuador over the country's decision to harbour Assange by giving him asylum in their embassy in London. The protest came days after Swedish prosecutors dropped their investigation into an allegation of sexual molestation and an accusation of unlawful coercion against Assange because they ran out of time to question him.

Britain has spent 12 million since 2012 policing out the Ecuador embassy to nab Assange is he steps out.

Britain is now desperately trying to get Ecuador to let the Swedish investigators to question Assange. Under Swedish law, charges cannot be laid without interviewing the suspect.

One of the documents made public said, "Assange could leave in fancy dress or try a discreet exit. He can try to reach a nearby helipad across the rooftops, or he could get lost among the people in Harrods."

The documents have been reported by Ecuadorian journalist Fernando Villavicencio and the Buzzfeed website.

The papers also documents several of Assange's eccentric activities - tampering with equipment in an off-limit security control room inside the embassy, punching a security guard or destroying a tall book shelf into bits.

Documents read "we cannot allow these incidents to be repeated, nor any further attacks against personnel who work for the embassy."

The report also notes a need to "control access to alcohol".

Stay updated on the go with Times of India News App. Click here to download it for your device.

Link:
Julian Assange's secret escape plan made public - The Times ...

Ecuadorian embassy’s plans to help Julian Assange flee in …

By Josh White For The Daily Mail

Published: 11:25 EST, 1 September 2015 | Updated: 19:58 EST, 1 September 2015

Fugitive Wikileaks founder Julian Assange was poised to slip past British police in fancy dress as part of desperate plans by the Ecuador government to smuggle him out of their London embassy, it emerged yesterday.

Other schemes to remove him from the embassy where he has claimed asylum for three years to avoid extradition to Sweden on sexual assault and rape charges included a dash across the rooftops of Knightsbridge to a nearby helipad or disappearing among tourists visiting Harrods, according to leaked documents.

None of the escape plans were attempted, with diplomats concerned at the scale of police surveillance, and they also concluded it would be impossible to smuggle out Assange in a diplomatic package because of advanced technology that can detect body heat.

The 44-year-old was said to have been acting strangely in the Kensignton flat, which he has not left since arriving in 2012, and diplomats from the South American country proposed a way of him fleeing in fancy dress

Leaked documents show a number of bizarre plans to help him escape, without being arrested by the constantly waiting Metropolitan Police officers. Pictured is the Ecuadorian embassy in London

But they state: Assange could leave in fancy dress or try to escape across rooftops towards a nearby helipad, or get lost among the people in Harrods.

UK officials have repeatedly attacked the cost of surveillance on Assange, with the bill standing at 11.9m at the end of June.

The details of Assanges time in the embassy are contained within leaked documents dating back to 2012.

They note his evident anger and a need to control [his] access to alcohol, but also reveal that his antics could cause discomfort to personnel, mainly women.

Ecuador's foreign minister Ricardo Patino and WikiLeaks founder Julian Assange during a press conference inside the Ecuadorian embassy in London last year

The 44-year-old Australian is said to be plagued with night terrors and has a tendency to shout and talk incoherently into the small hours.

Swedish prosecutors dropped sexual assault claims against him last month as a time limit expired, but he is still wanted on a rape accusation made after his visit to the country five years ago.

Assange denies the allegations.

Swedish officials yesterday said they are close to an agreement with Ecuador which could see Assange questioned in London before the end of the year.

A Scotland Yard spokesman said: Our objective is to arrest Julian Assange for breach of bail.

A balloon marking the first anniversary of WikiLeaks founder Julian Assange's entry to Ecuador's embassy is tethered above the building

The WikiLeaks founder was alleged to have raped a woman known as SW, then aged 26, and committed other sexual offences against AA, a 31-year-old woman in Sweden

The rest is here:
Ecuadorian embassy's plans to help Julian Assange flee in ...

WikiLeaks Assange stays indoors, fears CIA drone attack …

Published August 30, 2015

WikiLeaks founder Julian Assange, right, sits with the Rev. Jesse Jackson inside the Embassy of Ecuador in London, Friday Aug. 21, 2015. (The Associated Press)

WikiLeaks founder Julian Assange fears he will be sent to the United States, where he could face the death penalty, and even worries that he will be targeted by a CIA drone.

Assange, who faces extradition to Sweden on rape charges and has been holed up at the Ecuadorean Embassy in London since 2012, said in an interview with The Times Magazine that things have become so dangerous that he cannot even poke his head out of the embassys balcony doors.

"There are security issues with being on the balcony; there have been bomb threats and assassination threats from various people," he said during the interview.

Assange did, however, appear on the balcony of the embassy building with the Rev. Jesse Jackson, the American civil rights activist, who visited Assange for more than an hour during a stop in London on August 21.

"There are security issues with being on the balcony; there have been bomb threats and assassination threats from various people."

- Julian Assange, Wikileaks founder

Assange, 44, who hails from Australia, faces rape allegations in Sweden, although Swedish prosecutors have dropped their investigation into lesser sexual assault allegations after failing to question Assange within the 5-year statute of limitations period.

Assange says he believes the situation will be resolved in the next two years, but has refused to travel to Sweden, saying he fears it would lead to him being extradited to the United States because of an investigation into WikiLeaks' dissemination of hundreds of thousands of classified U.S. documents.

Assange published the classified U.S. information that he received from NSA leaker Edward Snowden, the former NSA contract systems analyst who is living in Russia on a temporary grant of asylum after leaking a massive volume of government documents.

He said Snowden is in Russia on Assanges advice; Assange said: "He preferred Latin America, but my advice was that he should take asylum in Russia despite the negative PR consequences, because my assessment is that he had a significant risk he could be kidnapped from Latin America on CIA orders.

"Kidnapped or possibly killed."

On the possibility of being droned by the CIA, Assange told the magazine: I'm a white guy. Unless I convert to Islam, it's not that likely that I'll be droned, but we have seen things creeping toward that.

The Associated Press contributed to this report.

View original post here:
WikiLeaks Assange stays indoors, fears CIA drone attack ...

Cryptography (Windows)

Purpose

Cryptography is the use of codes to convert data so that only a specific recipient will be able to read it, using a key.

Microsoft cryptographic technologies include CryptoAPI, Cryptographic Service Providers (CSP), CryptoAPI Tools, CAPICOM, WinTrust, issuing and managing certificates, and developing customizable public key infrastructures. Certificate and smart card enrollment, certificate management, and custom module development are also described.

CryptoAPI is intended for use by developers of Windows-based applications that will enable users to create and exchange documents and other data in a secure environment, especially over nonsecure media such as the Internet. Developers should be familiar with the C and C++ programming languages and the Windows programming environment. Although not required, an understanding of cryptography or security-related subjects is advised.

CAPICOM is a 32-bit only component that is intended for use by developers who are creating applications using Visual Basic Scripting Edition (VBScript) programming language or the C++ programming language. CAPICOM is available for use in the operating systems specified in Run-Time Requirements. For future development, we recommend that you use the .NET Framework to implement security features. For more information, see Alternatives to Using CAPICOM.

For information about run-time requirements for a particular programming element, see the Requirements section of the reference page for that element.

CAPICOM 2.1.0.2 is supported on the following operating systems and versions:

CAPICOM is available as a redistributable file that can be downloaded from Platform SDK Redistributable: CAPICOM.

Certificate Services requires the following versions of these operating systems:

About Cryptography

Key cryptography concepts and a high-level view of Microsoft cryptography technologies.

Using Cryptography

Cryptography processes, procedures, and extended samples of C and Visual Basic programs using CryptoAPI functions and CAPICOM objects.

Cryptography Reference

Detailed descriptions of the Microsoft cryptography functions, interfaces, objects, structures, and other programming elements. Includes reference descriptions of the API for working with digital certificates.

Read the original here:
Cryptography (Windows)

Cryptography – University of Washington

Cryptography

Hill-ciphers

an application of Linear Algebra

by: Paal Schiefloe

3 December 2001

[top]

This project for my Linear Algebra class is about cryptography. I will discuss a simple method of enciphering and deciphering a message using matrix transformations and modular arithmetic, and show how elementary row operations can sometimes be used to break an opponent's code.

The ciphers I will discuss are called Hill ciphers after Lester S. Hill who introduced them in two papers: "Cryptography in an Algebraic Alphabet," American Mathematical Monthly, 36, June-July 1929, pp. 306-312; and "Concerning Certain Linear Transformation Apparatus of Cryptography," American Mathematical Monthly, 38, March 1931, pp. 135-154.

I will show an example of how a message is enciphered and deciphered using Hill ciphers, I will also briefly discuss how to break a Hill cipher using elementary row operations by giving an example from "Elementary Linear Algebra, Applications version, edition 6".

[top]

Cryptography has for long been an important issue in the realm of computers. It was mainly used for the security needed for passwords but now cryptography is very important due to the Internet's flow of sensitive information such as credit card information and other sensitive information which is fairly easy to monitor by unintended third hand parties.

The idea behind enciphering a message is to make it worthless to everyone except for the party with the deciphering "key".

[top]

For Hill ciphers I assign numerical values to each plaintext and ciphertext letter so that A=1, B=2, C=2 and so on. If I wanted to I could have assigned numerical values for all the other characters on a keyboard, but for simplicity I will only assign numerical values to the letters in the alphabet in this project.

The following procedure shows the simplest Hill ciphers (Hill 2-cipher), successive pairs of plaintext that are transformed into ciphertext by a 2 x 2 matrix A.

NOTE: I will impose an additional condition on matrix A later. Here I have assigned numerical values to the alphabet:

Choose a 2 x 2 matrix A with integer entries to perform the encoding.

(The matrix has to be invertible modulo m, but I will discuss this later)

Group successive plaintext letters into pairs. If we end up with one single letter at the end, simply add an arbitrary "dummy" letter to fill out the last pair of letters.

Enciphering Step 3.

Convert each plaintext pair p1p2 into a column vector p.

Then form the plaintext matrix P of all our plaintext column vectors.

To encipher the message we multiply our plaintext matrix P by our transformation matrix A to form the product AP.

The product of our matrix multiplication is the ciphertext matrix C.

Enciphering Step 4.

Now we convert each ciphertext vector into its alphabetical equivalent and write out our enciphered message.

This was the encoding procedure, pretty simple, huh:) Let's see how we decipher our enciphered message.

Deciphering Step 1. Now we group the successive ciphertext letters into pairs and convert each ciphertext pair c1c2 into a column vector c. Then form the ciphertext matrix C of all our ciphertext column vectors.

Deciphering Step 2.

Multiply the ciphertext matrix C with the inverse of our enciphering matrix A to obtain the deciphered message. Not too difficult, huh:)

NOTE: To use this procedure we have to understand the concept of modular arithmetic. In the 6 steps I showed you above, I chose not to include the modular arithmetic in the steps for simplicity. However, modular arithmetic is important for this procedure to work. Keep reading and I'll show you why this is so important:)

[top]

We have the transformation matrix A

When we multiply this vector by our transformation matrix A, we get the enciphered column vector

Uh...hmmm, what letters correspond to the integers 148 and 64? This is where Modular Arithmetic comes in handy.

Our alphabet is given by non negative integers from 1, 2, , ..., m, where m is the length of our alphabet (in this case m = 26).

What we do when we have over 26, is simply "wrapping around" the numbers from 27 to 52 to represent the 26 letters again, then we do the same thing from 53 to 78 etc. We can do the same with negative integers (in this case Z=0, Y=-1, X=-2 etc.).

The procedure of "wrapping" is quite general. It is the same procedure we use every noon and midnight when we begin again to number the hours 1, 2, etc. In a 24 hour system, 18:00 is the same as 6:00 (pm) and 13:00 is 1:00 (pm).

How we do this mathematically is as follows: When we have integers greater than 26, we replace it by the remainder that results when this integer is divided by 26. So if we have the number 148 from the example above, we divide 148 by 26 and the remainder is 18.

148 - (5 * 26) = 18

Here are a couple examples for some different modulus:

7 = 2 (mod 5) because the remainder is 2 after dividing 7 by 5

19 = 3 (mod 2) because the remainder is 3 after dividing 19 by 2

-1 = 25 (mod 26) because the remainder is 25 after dividing -1 by 26

The formal definitions:

If m is a positive integer and a and b are any integers, then we say that a is equivalent to b modulo m, written

a = b (mod m)

if a-b is an integer multiple of m.

Now to the most important part of the concept of Modular Arithmetic for Hill ciphers. As mentioned in the procedure for enciphering and deciphering plaintext using a simple Hill-cipher above, we have to impose an additional condition for our transformation matrix A:

The transformation matrix A must be invertible modulo m for this procedure to work.

So when finding the inverse of our transformation matrix A we have to take (mod m) into consideration.

However, since this project is about Linear Algebra, I chose to skip the details about the modular arithmetic here, and provide a table of the reciprocols of modulo 26 instead. The inmportant thing is to keep in mind when checking our transformation matrix to see if it is invertile it ha to be invertible modulo m, you see how this is done in the example provided below the table of reciprocals modulo 26:.

[top]

Let's say we want to encipher the following sentence,"THE PROFESSOR IS EVIL", into ciphertext.

The first thing we do is to group the letters into pairs of 2 letters. If we would do a Hill 3-cipher, we would group the letters in groups of 3 letters and use a 3 x 3 transformation matrix, but in this example we're using a Hill 2-cipher.

For a Hill n-cipher, use n x n transformation matrix.

So, I have grouped the letters like this:

This leads us to step 3 of the procedure, convert each pair into a column to form the plaintext matrix P.

Oooops, most of these numbers in E are over 26, but by using the trick we learned from modular arithmetic we easily convert into nicer numbers, remember this is in modulo 26.

Then we assign letters to the numerical values by using our table and this is what we get:

RLQFXCHAAQAFCWAXMB

Yeah, we enciphered the message, let's hope the professor can't break it. I'll show you later how Hill-ciphers can be broken by using row reduction.

All right, time to decipher the messages.

Let's imagine we just received this message from one of our classmates, we know the matrix A he/she used to encipher the message with, so what do we do?

Now we work backwards, once again grouping the ciphertext into pairs of 2 letters and assigning numerical values for the letters. We make each pair into a column vector in a matrix E.

Then we simply multiply the matrix E by the inverse of A, but we have to remember our modular arithmetic from the example above.

"THE PROFESSOR IS EVIL"

Nice, we just deciphered the message.

[top]

If we are able to obtain a small amount of corresponding plaintext and ciphertext from a secret message, it is possible to determine the deciphering matrix A and then again decipher the entire message. We have learned in class that a linear transformation is determined by its values at a basis. This means that if we have a Hill n-cipher, and if

p1, p2, ... , pn

are linear independent plaintext vectors whose corresponding ciphertext vectors

Ap1, Ap2, ..., Apn

are known, then we have enough information to determine the matrix A and later A-1 (mod m).

To illustrate this I found an example from "Elementary Linear Algebra, Applications version, edition 6".

Let's say that we obtain an enciphered message and we are able to deduce that it is a letter starting with "DEAR". With a small amount of such data it may be possible to determine the deciphering matrix of a Hill-cipher and consequently get access to the rest of the message.

...Bibliography/References... [top]

Howard Anton and Christ Rorres. Elementary Linear Algebra Application Version. 6th edition. John Wiley & Sons, INC.

Eisenberg, Murray. Hill Ciphers and Modular Linear Algebra. 3 Nov 1999 (accessed 26 November - 2 December 2001) <http://www.math.umass.edu/~murray/Hillciph.pdf>

Goulet, John. Project #6 Cryptography. (accessed 26 November - 2 December 2001) <http://www.prenhall.com/divisions/esm/app/ph-linear/kolman/html/proj6.html>

More:
Cryptography - University of Washington

XML Encryption Syntax and Processing

This document specifies a process for encrypting data and representing the result in XML. The data may be arbitrary data (including an XML document), an XML element, or XML element content. The result of encrypting data is an XML Encryption element which contains or references the cipher data.

This document is the W3C XML Encryption Recommendation (REC). This document has been reviewed by W3C Members and other interested parties and has been endorsed by the Director as a W3C Recommendation. It is a stable document and may be used as reference material or cited as a normative reference from another document. W3C's role in making the Recommendation is to draw attention to the specification and to promote its widespread deployment. This enhances the functionality and interoperability of the Web.

This specification was produced by the W3C XML Encryption Working Group (Activity) which believes the specification is sufficient for the creation of independent interoperable implementations as demonstrated in the Interoperability Report.

Patent disclosures relevant to this specification may be found on the Working Group's patent disclosure page in conformance with W3C policy.

Please report errors in this document to xml-encryption@w3.org (public archive).

The list of known errors in this specification is available at http://www.w3.org/Encryption/2002/12-xmlenc-errata.

The English version of this specification is the only normative version. Information about translations of this document (if any) is available http://www.w3.org/Encryption/2002/12-xmlenc-translations.

A list of current W3C Recommendations and other technical documents can be found at http://www.w3.org/TR/.

This document specifies a process for encrypting data and representing the result in XML. The data may be arbitrary data (including an XML document), an XML element, or XML element content. The result of encrypting data is an XML Encryption EncryptedData element which contains (via one of its children's content) or identifies (via a URI reference) the cipher data.

When encrypting an XML element or element content the EncryptedData element replaces the element or content (respectively) in the encrypted version of the XML document.

When encrypting arbitrary data (including entire XML documents), the EncryptedData element may become the root of a new XML document or become a child element in an application-chosen XML document.

This specification uses XML schemas [XML-schema] to describe the content model.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this specification are to be interpreted as described in RFC2119 [KEYWORDS]:

"they MUST only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm (e.g., limiting retransmissions)"

Consequently, we use these capitalized keywords to unambiguously specify requirements over protocol and application features and behavior that affect the interoperability and security of implementations. These key words are not used (capitalized) to describe XML grammar; schema definitions unambiguously describe such requirements and we wish to reserve the prominence of these terms for the natural language descriptions of protocols and features. For instance, an XML attribute might be described as being "optional." Compliance with the XML-namespace specification [XML-NS] is described as "REQUIRED."

The design philosophy and requirements of this specification (including the limitations related to instance validity) are addressed in the XML Encryption Requirements [EncReq].

No provision is made for an explicit version number in this syntax. If a future version is needed, it will use a different namespace. The experimental XML namespace [XML-NS] URI that MUST be used by implementations of this (dated) specification is:

This namespace is also used as the prefix for algorithm identifiers used by this specification. While applications MUST support XML and XML namespaces, the use of internal entities [XML, section 4.2.1], the "xenc" XML namespace prefix [XML-NS, section 2] and defaulting/scoping conventions are OPTIONAL; we use these facilities to provide compact and readable examples. Additionally, the entity &xenc; is defined so as to provide short-hand identifiers for URIs defined in this specification. For example "&xenc;Element" corresponds to "http://www.w3.org/2001/04/xmlenc#Element".

This specification makes use of the XML Signature [XML-DSIG] namespace and schema definitions

URIs [URI] MUST abide by the [XML-Schema] anyURI type definition and the [XML-DSIG, 4.3.3.1 The URI Attribute] specification (i.e., permitted characters, character escaping, scheme support, etc.).

The contributions of the following Working Group members to this specification are gratefully acknowledged in accordance with the contributor policies and the active WG roster.

Additionally, we thank the following for their comments during and subsequent to Last Call:

This section provides an overview and examples of XML Encryption syntax. The formal syntax is found in Encryption Syntax (section 3); the specific processing is given in Processing Rules (section 4).

Expressed in shorthand form, the EncryptedData element has the following structure (where "?" denotes zero or one occurrence; "+" denotes one or more occurrences; "*" denotes zero or more occurrences; and the empty element tag means the element must be empty ):

The CipherData element envelopes or references the raw encrypted data. If enveloping, the raw encrypted data is the CipherValue element's content; if referencing, the CipherReference element's URI attribute points to the location of the raw encrypted data

Consider the following fictitious payment information, which includes identification information and information appropriate to a payment method (e.g., credit card, money transfer, or electronic check):

This markup represents that John Smith is using his credit card with a limit of $5,000USD.

Smith's credit card number is sensitive information! If the application wishes to keep that information confidential, it can encrypt the CreditCard element:

By encrypting the entire CreditCard element from its start to end tags, the identity of the element itself is hidden. (An eavesdropper doesn't know whether he used a credit card or money transfer.) The CipherData element contains the encrypted serialization of the CreditCard element.

As an alternative scenario, it may be useful for intermediate agents to know that John used a credit card with a particular limit, but not the card's number, issuer, and expiration date. In this case, the content (character data or children elements) of the CreditCard element is encrypted:

Or, consider the scenario in which all the information except the actual credit card number can be in the clear, including the fact that the Number element exists:

Both CreditCard and Number are in the clear, but the character data content of Number is encrypted.

If the application scenario requires all of the information to be encrypted, the whole document is encrypted as an octet sequence. This applies to arbitrary data including XML documents.

An XML document may contain zero or more EncryptedData elements. EncryptedData cannot be the parent or child of another EncryptedData element. However, the actual data encrypted can be anything, including EncryptedData and EncryptedKey elements (i.e., super-encryption). During super-encryption of an EncryptedData or EncryptedKey element, one must encrypt the entire element. Encrypting only the content of these elements, or encrypting selected child elements is an invalid instance under the provided schema. For example, consider the following:

A valid super-encryption of "//xenc:EncryptedData[@Id='ED1']" would be:

where the CipherValue content of 'newEncryptedData' is the base64 encoding of the encrypted octet sequence resulting from encrypting the EncryptedData element with Id='ED1'.

[s1] The type of data encrypted may be represented as an attribute value to aid in decryption and subsequent processing. In this case, the data encrypted was an 'element'. Other alternatives include 'content' of an element, or an external octet sequence which can also be identified via the MimeType and Encoding attributes.

[s2] This (3DES CBC) is a symmetric key cipher.

[s4] The symmetric key has an associated name "John Smith".

[s6] CipherData contains a CipherValue, which is a base64 encoded octet sequence. Alternately, it could contain a CipherReference, which is a URI reference along with transforms necessary to obtain the encrypted data as an octet sequence

The following EncryptedData structure is very similar to the one above, except this time the key is referenced using a ds:RetrievalMethod:

[t02] This (AES-128-CBC) is a symmetric key cipher.

[t04] ds:RetrievalMethod is used to indicate the location of a key with type &xenc;EncryptedKey. The (AES) key is located at '#EK'.

[t05] ds:KeyName provides an alternative method of identifying the key needed to decrypt the CipherData. Either or both the ds:KeyName and ds:KeyRetrievalMethod could be used to identify the same key.

Within the same XML document, there existed an EncryptedKey structure that was referenced within [t04]:

[t09] The EncryptedKey element is similar to the EncryptedData element except that the data encrypted is always a key value.

[t10] The EncryptionMethod is the RSA public key algorithm.

[t12] ds:KeyName of "John Smith" is a property of the key necessary for decrypting (using RSA) the CipherData.

[t14] The CipherData's CipherValue is an octet sequence that is processed (serialized, encrypted, and encoded) by a referring encrypted object's EncryptionMethod. (Note, an EncryptedKey's EncryptionMethod is the algorithm used to encrypt these octets and does not speak about what type of octets they are.)

[t15-17] A ReferenceList identifies the encrypted objects (DataReference and KeyReference) encrypted with this key. The ReferenceList contains a list of references to data encrypted by the symmetric key carried within this structure.

[t18] The CarriedKeyName element is used to identify the encrypted key value which may be referenced by the KeyName element in ds:KeyInfo. (Since ID attribute values must be unique to a document,CarriedKeyName can indicate that several EncryptedKey structures contain the same key value encrypted for different recipients.)

This section provides a detailed description of the syntax and features for XML Encryption. Features described in this section MUST be implemented unless otherwise noted. The syntax is defined via [XML-Schema] with the following XML preamble, declaration, internal entity, and import:

EncryptedType is the abstract type from which EncryptedData and EncryptedKey are derived. While these two latter element types are very similar with respect to their content models, a syntactical distinction is useful to processing. Implementation MUST generate laxly schema valid [XML-schema] EncryptedData or EncryptedKey as specified by the subsequent schema declarations. (Note the laxly schema valid generation means that the content permitted by xsd:ANY need not be valid.) Implementations SHOULD create these XML structures (EncryptedType elements and their descendents/content) in Normalization Form C [NFC, NFC-Corrigendum].

EncryptionMethod is an optional element that describes the encryption algorithm applied to the cipher data. If the element is absent, the encryption algorithm must be known by the recipient or the decryption will fail.

ds:KeyInfo is an optional element, defined by [XML-DSIG], that carries information about the key used to encrypt the data. Subsequent sections of this specification define new elements that may appear as children of ds:KeyInfo.

CipherData is a mandatory element that contains the CipherValue or CipherReference with the encrypted data.

EncryptionProperties can contain additional information concerning the generation of the EncryptedType (e.g., date/time stamp).

Id is an optional attribute providing for the standard method of assigning a string id to the element within the document context.

Type is an optional attribute identifying type information about the plaintext form of the encrypted content. While optional, this specification takes advantage of it for mandatory processing described in Processing Rules: Decryption (section 4.2). If the EncryptedData element contains data of Type 'element' or element 'content', and replaces that data in an XML document context, it is strongly recommended the Type attribute be provided. Without this information, the decryptor will be unable to automatically restore the XML document to its original cleartext form.

MimeType is an optional (advisory) attribute which describes the media type of the data which has been encrypted. The value of this attribute is a string with values defined by [MIME]. For example, if the data that is encrypted is a base64 encoded PNG, the transfer Encoding may be specified as 'http://www.w3.org/2000/09/xmldsig#base64' and the MimeType as 'image/png'. This attribute is purely advisory; no validation of the MimeType information is required and it does not indicate the encryption application must do any additional processing. Note, this information may not be necessary if it is already bound to the identifier in the Type attribute. For example, the Element and Content types defined in this specification are always UTF-8 encoded text.

EncryptionMethod is an optional element that describes the encryption algorithm applied to the cipher data. If the element is absent, the encryption algorithm must be known by the recipient or the decryption will fail.

The permitted child elements of the EncryptionMethod are determined by the specific value of the Algorithm attribute URI, and the KeySize child element is always permitted. For example, the RSA-OAEP algorithm (section 5.4.2) uses the ds:DigestMethod and OAEPparams elements. (We rely upon the ANY schema construct because it is not possible to specify element content based on the value of an attribute.)

The presence of any child element under EncryptionMethod which is not permitted by the algorithm or the presence of a KeySize child inconsistent with the algorithm MUST be treated as an error. (All algorithm URIs specified in this document imply a key size but this is not true in general. Most popular stream cipher algorithms take variable size keys.)

The CipherData is a mandatory element that provides the encrypted data. It must either contain the encrypted octet sequence as base64 encoded text of the CipherValue element, or provide a reference to an external location containing the encrypted octet sequence via the CipherReference element.

If CipherValue is not supplied directly, the CipherReference identifies a source which, when processed, yields the encrypted octet sequence.

The actual value is obtained as follows. The CipherReference URI contains an identifier that is dereferenced. Should the CipherReference element contain an OPTIONAL sequence of Transforms, the data resulting from dereferencing the URI is transformed as specified so as to yield the intended cipher value. For example, if the value is base64 encoded within an XML document; the transforms could specify an XPath expression followed by a base64 decoding so as to extract the octets.

The syntax of the URI and Transforms is similar to that of [XML-DSIG]. However, there is a difference between signature and encryption processing. In [XML-DSIG] both generation and validation processing start with the same source data and perform that transform in the same order. In encryption, the decryptor has only the cipher data and the specified transforms are enumerated for the decryptor, in the order necessary to obtain the octets. Consequently, because it has different semantics Transforms is in the &xenc; namespace.

For example, if the relevant cipher value is captured within a CipherValue element within a different XML document, the CipherReference might look as follows:

Implementations MUST support the CipherReference feature and the same URI encoding, dereferencing, scheme, and HTTP response codes as that of [XML-DSIG]. The Transform feature and particular transform algorithms are OPTIONAL.

The EncryptedData element is the core element in the syntax. Not only does its CipherData child contain the encrypted data, but it's also the element that replaces the encrypted element, or serves as the new document root.

There are three ways that the keying material needed to decrypt CipherData can be provided:

In addition, we provide two additional child elements: applications MUST support EncryptedKey (section 3.5.1) and MAY support AgreementMethod (section 5.5).

(This can be used within a ds:RetrievalMethod element to identify the referent's type.)

The EncryptedKey element is used to transport encryption keys from the originator to a known recipient(s). It may be used as a stand-alone XML document, be placed within an application document, or appear inside an EncryptedData element as a child of a ds:KeyInfo element. The key value is always encrypted to the recipient(s). When EncryptedKey is decrypted the resulting octets are made available to the EncryptionMethod algorithm without any additional processing.

ReferenceList is an optional element containing pointers to data and keys encrypted using this key. The reference list may contain multiple references to EncryptedKey and EncryptedData elements. This is done using KeyReference and DataReference elements respectively. These are defined below.

CarriedKeyName is an optional element for associating a user readable name with the key value. This may then be used to reference the key using the ds:KeyName element within ds:KeyInfo. The same CarriedKeyName label, unlike an ID type, may occur multiple times within a single document. The value of the key is to be the same in all EncryptedKey elements identified with the same CarriedKeyName label within a single XML document. Note that because whitespace is significant in the value of the ds:KeyName element, whitespace is also significant in the value of the CarriedKeyName element.

Recipient is an optional attribute that contains a hint as to which recipient this encrypted key value is intended for. Its contents are application dependent.

The Type attribute inheritted from EncryptedType can be used to further specify the type of the encrypted key if the EncryptionMethod Algorithm does not define a unambiguous encoding/representation. (Note, all the algorithms in this specification have an unambigous representation for their associated key structures.)

The ds:RetrievalMethod [XML-DSIG]with a Type of 'http://www.w3.org/2001/04/xmlenc#EncryptedKey' provides a way to express a link to an EncryptedKey element containing the key needed to decrypt the CipherData associated with an EncryptedData or EncryptedKey element. The ds:RetrievalMethod with this type is always a child of the ds:KeyInfo element and may appear multiple times. If there is more than one instance of a ds:RetrievalMethod in a ds:KeyInfo of this type, then the EncryptedKey objects referred to must contain the same key value, possibly encrypted in different ways or for different recipients.

ReferenceList is an element that contains pointers from a key value of an EncryptedKey to items encrypted by that key value (EncryptedData or EncryptedKey elements).

DataReference elements are used to refer to EncryptedData elements that were encrypted using the key defined in the enclosing EncryptedKey element. Multiple DataReference elements can occur if multiple EncryptedData elements exist that are encrypted by the same key.

KeyReference elements are used to refer to EncryptedKey elements that were encrypted using the key defined in the enclosing EncryptedKey element. Multiple KeyReference elements can occur if multiple EncryptedKey elements exist that are encrypted by the same key.

For both types of references one may optionally specify child elements to aid the recipient in retrieving the EncryptedKey and/or EncryptedData elements. These could include information such as XPath transforms, decompression transforms, or information on how to retrieve the elements from a document storage facility. For example:

(This can be used within a ds:Reference element to identify the referent's type.)

Additional information items concerning the generation of the EncryptedData or EncryptedKey can be placed in an EncryptionProperty element (e.g., date/time stamp or the serial number of cryptographic hardware used during encryption). The Target attribute identifies the EncryptedType structure being described. anyAttribute permits the inclusion of attributes from the XML namespace to be included (i.e., xml:space, xml:lang, and xml:base).

This section describes the operations to be performed as part of encryption and decryption processing by implementations of this specification. The conformance requirements are specified over the following roles:

For each data item to be encrypted as an EncryptedData or EncryptedKey (elements derived from EncryptedType), the encryptor must:

The definition of this type as bound to an identifier specifies how to obtain and interpret the plaintext octets after decryption. For example, the idenifier could indicate that the data is an instance of another application (e.g., some XML compression application) that must be further processed. Or, if the data is a simple octet sequence it MAY be described with the MimeType and Encoding attributes. For example, the data might be an XML document (MimeType="text/xml"), sequence of characters (MimeType="text/plain"), or binary image data (MimeType="image/png").

An EncryptedType structure represents all of the information previously discussed including the type of the encrypted data, encryption algorithm, parameters, key, type of the encrypted data, etc.

The encryptor SHOULD be able to replace the unencrypted 'element' or 'content' with the EncryptedData element. When an application requires an XML element or content to be replaced, it supplies the XML document context in addition to identifying the element or content to be replaced. The encryptor removes the identified element or content and inserts the EncryptedData element in its place.

(Note: If the Type is "content" the document resulting from decryption will not be well-formed if (a) the original plaintext was not well-formed (e.g., PCDATA by itself is not well-formed) and (b) the EncryptedData element was previously the root element of the document)

For each EncryptedType derived element, (i.e., EncryptedData or EncryptedKey), to be decrypted, the decryptor must:

The application supplies the XML document context and identifies the EncryptedData element being replaced. If the document into which the replacement is occurring is not UTF-8, the decryptor MUST transcode the UTF-8 encoded characters into the target encoding.

Encryption and decryption operations are transforms on octets. The application is responsible for the marshalling XML such that it can be serialized into an octet sequence, encrypted, decrypted, and be of use to the recipient.

For example, if the application wishes to canonicalize its data or encode/compress the data in an XML packaging format, the application needs to marshal the XML accordingly and identify the resulting type via the EncryptedData Type attribute. The likelihood of successful decryption and subsequent processing will be dependent on the recipient's support for the given type. Also, if the data is intended to be processed both before encryption and after decryption (e.g., XML Signature [XML-DSIG] validation or an XSLT transform) the encrypting application must be careful to preserve information necessary for that process's success.

For interoperability purposes, the following types MUST be implemented such that an implementation will be able to take as input and yield as output data matching the production rules 39 and 43 from [XML]:

The following sections contain specifications for decrypting, replacing, and serializing XML content (i.e., Type 'element' or element 'content') using the [XPath] data model. These sections are non-normative and OPTIONAL to implementors of this specification, but they may be normatively referenced by and MANDATORY to other specifications that require a consistent processing for applications, such as [XML-DSIG-Decrypt].

Where P is the context in which the serialized XML should be parsed (a document node or element node) and O is the octet sequence representing UTF-8 encoded characters resulting from step 4.3 in the Decryption Processing (section 4.2). Y is node-set representing the decrypted content obtained by the following steps:

Where X is the [XPath] node set corresponding to an XML document and e is an EncryptedData element node in X.

In Encrypting XML (section 4.1, step 3.1), when serializing an XML fragment special care SHOULD be taken with respect to default namespaces. If the data will be subsequently decrypted in the context of a parent XML document then serialization can produce elements in the wrong namespace. Consider the following fragment of XML:

Read more here:
XML Encryption Syntax and Processing