<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: draft]]></title>
    <link>http://securityratty.com/tag/draft</link>
    <description></description>
    <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Twitter as a Terrorist's Killer App]]></title>
      <link>http://securityratty.com/article/8a4666e30e85549deeb4ca47588a862c</link>
      <guid>http://securityratty.com/article/8a4666e30e85549deeb4ca47588a862c</guid>
      <description><![CDATA[Could Twitter become terrorists' newest killer app? A draft Army intelligence report, making its way through spy circles, thinks the miniature messaging software could be used as an effective tool for...]]></description>
      <content:encoded><![CDATA[Could Twitter become terrorists' newest killer app? A draft Army intelligence report, making its way through spy circles, thinks the miniature messaging software could be used as an effective tool for coordinating militant attacks.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=053dde9fea66bdb1de339bd42479720d" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=053dde9fea66bdb1de339bd42479720d" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=oTOjM"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=oTOjM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=DLcYm"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=DLcYm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zvV4m"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zvV4m" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=PAgcM"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=PAgcM" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OQBwM"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OQBwM" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=Ebgem"><img src="http://feeds.wired.com/~f/wired/politics/security?i=Ebgem" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=Rtstm"><img src="http://feeds.wired.com/~f/wired/politics/security?i=Rtstm" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=s5TjM"><img src="http://feeds.wired.com/~f/wired/politics/security?i=s5TjM" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/430814357" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/430814358" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 24 Oct 2008 10:32:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/killer app">killer app</category>
      <category domain="http://securityratty.com/tag/effective tool">effective tool</category>
      <category domain="http://securityratty.com/tag/twitter">twitter</category>
      <category domain="http://securityratty.com/tag/spy circles">spy circles</category>
      <category domain="http://securityratty.com/tag/militant attacks">militant attacks</category>
      <category domain="http://securityratty.com/tag/miniature">miniature</category>
      <category domain="http://securityratty.com/tag/terrorists">terrorists</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/430814358/terrorist-cell.html">Twitter as a Terrorist's Killer App</source>
    </item>
    <item>
      <title><![CDATA[Fear not, no wait, you should fear.]]></title>
      <link>http://securityratty.com/article/62970ace259302e46fc33f22f86e9c5e</link>
      <guid>http://securityratty.com/article/62970ace259302e46fc33f22f86e9c5e</guid>
      <description><![CDATA[Ever get the feeling that the bow of the ship is slipping under the waves


clipped from www.msnbc.msn.com

U.S. Cybersecurity Is Weak, GAO Says



Five years after the Homeland Security Dept. took...]]></description>
      <content:encoded><![CDATA[<div > Ever get the feeling that the bow of the ship is slipping under the waves? </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/3EFCAA8A-BF2C-497A-8513-A48D6844A0AD/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/ad915f0a-26dc-4cc3-8945-0ed58ccf8ec1/3EFCAA8A-BF2C-497A-8513-A48D6844A0AD/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.msnbc.msn.com/id/26738121/" href="http://www.msnbc.msn.com/id/26738121/" style="font-size: 11px;">www.msnbc.msn.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.msnbc.msn.com/id/26738121/ -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">
U.S. Cybersecurity Is Weak, GAO Says
</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.msnbc.msn.com/id/26738121/ --><P class="textBodyBlack"><SPAN id="byLine"></SPAN><br />
Five years after the Homeland Security Dept. took charge of the team as a critical safeguard against threats to national security, US-CERT &#8220;still does not exhibit aspects of the attributes essential to having a truly national capability,&#8221; according to the draft report.<br />
</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.msnbc.msn.com/id/26738121/ --><P class="textBodyBlack"><SPAN id="byLine"></SPAN><br />
Vulnerable to Foreign Adversaries</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.msnbc.msn.com/id/26738121/ --><P class="textBodyBlack"><SPAN id="byLine"></SPAN><br />
Goals Not Being Met</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.msnbc.msn.com/id/26738121/ --><P class="textBodyBlack"><SPAN id="byLine"></SPAN><br />
Actions Are Inadequate</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.msnbc.msn.com/id/26738121/ --><P class="textBodyBlack"><SPAN id="byLine"></SPAN><br />
Weak Warning Capabilities</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/3EFCAA8A-BF2C-497A-8513-A48D6844A0AD/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_180908012351"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=180908012351&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=180908012351&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=180908012351&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_180908012351" /></a></P>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 09:23:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/homeland security dept">homeland security dept</category>
      <category domain="http://securityratty.com/tag/exhibit aspects">exhibit aspects</category>
      <category domain="http://securityratty.com/tag/critical safeguard">critical safeguard</category>
      <category domain="http://securityratty.com/tag/attributes essential">attributes essential</category>
      <category domain="http://securityratty.com/tag/national capability">national capability</category>
      <category domain="http://securityratty.com/tag/draft report">draft report</category>
      <category domain="http://securityratty.com/tag/weak">weak</category>
      <category domain="http://securityratty.com/tag/national security">national security</category>
      <category domain="http://securityratty.com/tag/foreign adversaries">foreign adversaries</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=623">Fear not, no wait, you should fear.</source>
    </item>
    <item>
      <title><![CDATA[Whos got your Laptop?]]></title>
      <link>http://securityratty.com/article/fdcc1cfa283eb2fc50672e381d8a9ccb</link>
      <guid>http://securityratty.com/article/fdcc1cfa283eb2fc50672e381d8a9ccb</guid>
      <description><![CDATA[Id like a receipt for you taking my lappie please. Sure


clipped from arstechnica.com

New bill would tighten rules for DHS border laptop searches



Sanchezs bill would bring more routine to the...]]></description>
      <content:encoded><![CDATA[<div > I&#8217;d like a receipt for you taking my lappie please.<br/>Sure.  </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/91B77627-B32E-4307-85A2-4EB1E258E7FB/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/4837b138-9344-4f86-ab32-b0f1976973fb/91B77627-B32E-4307-85A2-4EB1E258E7FB/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://arstechnica.com/news.ars/post/20080916-new-bill-wants-tighter-rules-for-laptop-border-searches.html" href="http://arstechnica.com/news.ars/post/20080916-new-bill-wants-tighter-rules-for-laptop-border-searches.html" style="font-size: 11px;">arstechnica.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://arstechnica.com/news.ars/post/20080916-new-bill-wants-tighter-rules-for-laptop-border-searches.html -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">
<A href="http://arstechnica.com/news.ars/post/20080916-new-bill-wants-tighter-rules-for-laptop-border-searches.html">New bill would tighten rules for DHS border laptop searches</A></div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://arstechnica.com/news.ars/post/20080916-new-bill-wants-tighter-rules-for-laptop-border-searches.html --><P><br />
Sanchez&#8217;s bill would bring more routine to the search process. The bill requires the government to draft additional rules regarding information security, the number of days a device can be retained, receipts that must be issued when devices are taken, ways to report abuses, and it requires the completion of both a privacy impact study and a civil liberties impact study. Travelers would also have the explicit right to watch as the search is conducted.<br />
</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/91B77627-B32E-4307-85A2-4EB1E258E7FB/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_170908040517"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=170908040517&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=170908040517&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=170908040517&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_170908040517" /></a></P>]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 12:05:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/bill requires">bill requires</category>
      <category domain="http://securityratty.com/tag/bill">bill</category>
      <category domain="http://securityratty.com/tag/rules">rules</category>
      <category domain="http://securityratty.com/tag/draft additional rules">draft additional rules</category>
      <category domain="http://securityratty.com/tag/dhs border laptop">dhs border laptop</category>
      <category domain="http://securityratty.com/tag/sanchezs bill">sanchezs bill</category>
      <category domain="http://securityratty.com/tag/requires">requires</category>
      <category domain="http://securityratty.com/tag/privacy impact study">privacy impact study</category>
      <category domain="http://securityratty.com/tag/report abuses">report abuses</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=615">Whos got your Laptop?</source>
    </item>
    <item>
      <title><![CDATA[Linksys WRT610N Review]]></title>
      <link>http://securityratty.com/article/edcd9863740d597dbc3a37c18f2e59ff</link>
      <guid>http://securityratty.com/article/edcd9863740d597dbc3a37c18f2e59ff</guid>
      <description><![CDATA[My review of the Linksys WRT610N at Macworld: The router works quite well at handling Wi-Fi and other functions, but is terrible at working with Mac OS X, one of the advertised features of the...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.macworld.com/article/135222/2008/09/linksyswrt610n.html"><strong>My review of the Linksys WRT610N at Macworld:</strong></a> The router works quite well at handling Wi-Fi and other functions, but is terrible at working with Mac OS X, one of the advertised features of the product. The WRT610N is a revised design of the previous simultaneous dual-band (2.4/5 GHz) Draft N WRT600N model which had far worse problems. </p>

<p>Linksys addressed many of my concerns with that previous device. The 610N can mount a drive and share it via SMB and FTP, have two full-speed connections running over both bands without skipping a beat, and supports several methods of getting the one-click WPS (Wi-Fi Protected Setup) to work. Read the review for all the details, but I can't recommend this router to Mac users with any needs beyond basic networking; I'm perfectly happy to give it a full thumbs-up for Windows XP and Vista users, however.</p>

<p><img src="http://wifinetnews.com//images/2008/WRT610N_M.jpg" alt="WRT610N_M.jpg" border="0" width="229" height="111" /></p>

<p>WPS is a particular mess, by the way. Linksys has four somewhat distinct methods of using WPS to enable a password-free encrypted connection between a client and a base station: a button on the front that, when pressed, turns on WPS; and three modes (one of them similar to that button) accessible via their Web configuration software. One option is to get the base station to create a short PIN that's then entered on the client system as an out-of-band confirmation that there's no man in the middle.</p>

<p>Apple, by contrast, has a single way of joining a WPS-offering base station: it displays the network's name in bold. Select the network, and Mac OS X displays a key code that needs to be entered on the base station. But the WRT610N can't handle that option. If you put the WRT610N into a mode in which Apple can spot the device as offering a WPS handshake, you can't enter the code into the Linksys router!</p>

<p>This shows that there's still rough edges in the WPS protocol that two of the highest-selling makers of Wi-Fi gear can manage to not mesh up their respective options. (Apple declined to comment for my Macworld story; Linksys confirmed the lack of compatibility, but put the burden on Apple's doorstep.)</p>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 05:27:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wrt610n">wrt610n</category>
      <category domain="http://securityratty.com/tag/linksys wrt610n">linksys wrt610n</category>
      <category domain="http://securityratty.com/tag/linksys">linksys</category>
      <category domain="http://securityratty.com/tag/wps protocol">wps protocol</category>
      <category domain="http://securityratty.com/tag/wps">wps</category>
      <category domain="http://securityratty.com/tag/base station">base station</category>
      <category domain="http://securityratty.com/tag/linksys router">linksys router</category>
      <category domain="http://securityratty.com/tag/one-click wps">one-click wps</category>
      <category domain="http://securityratty.com/tag/wps handshake">wps handshake</category>
      <source url="http://wifinetnews.com/archives/008441.html">Linksys WRT610N Review</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Indian Terror over Wi-Fi; Fastest Wireless; Health Fears; Wi-Fi Tub; and More]]></title>
      <link>http://securityratty.com/article/38100bf79f0cedd88c5f6a02e45c5a85</link>
      <guid>http://securityratty.com/article/38100bf79f0cedd88c5f6a02e45c5a85</guid>
      <description><![CDATA[Another terror message sent via open Wi-Fi in India: Credit for terrorist blasts in Delhi was sent by email minutes before the attack took place using a Wi-Fi network owned by a retired engineer's...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.telegraphindia.com/1080915/jsp/nation/story_9835144.jsp"><strong>Another terror message sent via open Wi-Fi in India:</strong></a> Credit for terrorist blasts in Delhi was sent by email minutes before the attack took place using a Wi-Fi network owned by a retired engineer's wife. Though articles keep saying the network was "hacked," the Telegraph also notes that the network was "unsecured."</p>

<p>Italian free space optics test hits 1.2 terabits per second (<a href="http://www.corriere.it/scienze_e_tecnologie/08_settembre_11/wifi_pisa_record_3a9bf132-801f-11dd-9f6f-00144f02aabc.shtml">in Italian</a>, <a href="http://translate.google.com/translate?u=http://www.corriere.it/scienze_e_tecnologie/08_settembre_11/wifi_pisa_record_3a9bf132-801f-11dd-9f6f-00144f02aabc.shtml&hl=en&ie=UTF-8&sl=it&tl=en">Google translation</a>): Researchers in Pisa, Italy, along with colleagues from two Japanese institutions, crossed 1.2 Tbps in a test. Free space optics typically uses infrared lasers, and can work over a distance of kilometers. </p>

<p><a href="http://www.canada.com/montrealgazette/news/story.html?id=2e090761-519c-4de6-9ace-4153d6dc71d2"><strong>More Canadian Wi-Fi health fears:</strong></a> This time in an island in Montr&eacute;al. One of the concerned citizens: "This is something that is really under the radar. People do not know that long-term health hazards are associated with wireless technology." They don't know that because all verifiable, repeatable, well-conducted, academic tests so far indicate that there's no such health hazard associated with EMF. The concerned folks are raising an alarm about Wi-Fi being broadcast island wide, but are not paying attention, obviously, to the AM/FM radio, satellite radio, cellular, cordless, and thousand other wireless uses that are bombarding them right now, often at far higher signal levels.</p>

<p><a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/09/13/AR2008091300340.html"><strong>Wi-Fi in a tub:</strong></a> I'm not going to say anything more.</p>

<p><a href="http://www.quickertek.com/products/expresscard.php"><strong>QuickerTek adds antenna to 300 mW ExpressCard for MacBook Pro:</strong></a> Users of Apple's higher-end laptops can drop $200 to get a 300 mW Draft N (802.11n) ExpressCard and 5 dBi external antenna with a mounting clip. That's a lot of power, and it's important to recall that have a louder signal doesn't mean that distant base stations can necessarily hear you better. Draft N devices typically pair better listening (receive sensitivity) with higher transmission power, however.</p>

<p><a href="http://networklocationapp.com/"><strong>Mac product ties location settings to Wi-Fi position:</strong></a> Centrix has updated its $29 Mac OS X location preferences program NetworkLocation to take advantage of Skyhook Wireless's Wi-Fi positioning data. You can now tie the package of settings that control what email account you use, iChat status, programs launched, disks mounted, and other factors, to where you're currently at.</p>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 06:03:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi network owned">wi-fi network owned</category>
      <category domain="http://securityratty.com/tag/wireless">wireless</category>
      <category domain="http://securityratty.com/tag/wi-fi position">wi-fi position</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/skyhook wireless">skyhook wireless</category>
      <category domain="http://securityratty.com/tag/broadcast island wide">broadcast island wide</category>
      <category domain="http://securityratty.com/tag/island">island</category>
      <category domain="http://securityratty.com/tag/dbi external antenna">dbi external antenna</category>
      <source url="http://wifinetnews.com/archives/008439.html">Wee-Fi: Indian Terror over Wi-Fi; Fastest Wireless; Health Fears; Wi-Fi Tub; and More</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Share Cell Connections over Wi-Fi; Mile High-Fi Salaciousness; Giga-Fi; and More]]></title>
      <link>http://securityratty.com/article/457365225a8b72096232f2b375549cff</link>
      <guid>http://securityratty.com/article/457365225a8b72096232f2b375549cff</guid>
      <description><![CDATA[New version of Windows Mobile software to share cell data connections over Wi-Fi: Morose Media ships version 1.20 of WMWifiRouter, a Windows Mobile 5 and 6 application that routes cellular data...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.wmwifirouter.com/"><strong>New version of Windows Mobile software to share cell data connections over Wi-Fi:</strong></a> Morose Media ships version 1.20 of WMWifiRouter, a Windows Mobile 5 and 6 application that routes cellular data connections over Wi-Fi, turning your phone into a micro-hotspot. The software can also share a cell connection via Bluetooth or USB. The software costs $30 or &euro;20, and requires Internet (Connection) Sharing (ICS), which some providers may have removed from your phone. (The company set the price at US$30 before the euro drop, so is offering a kind of discount over their real &euro;20 price for the moment.)</p>

<p><a href="http://www.nytimes.com/2008/09/11/technology/personaltech/11smart.html?_r=1&8cir&emc=cirb1&oref=slogin"><strong>The New York Times rounds up using cell phones as hotspots:</strong></a> Though the reporter, Bob Tedeschi, mentions the issue of having to have an unlimited data plan to avoid unpleasant charges, and worries about bad drains and malicious users, he doesn't note that many carriers don't allow this kind of sharing or routing without a separate "tethering" plan, that can run $20 or more per month. Also, U.S. carriers have now all imposed a 5 GB per month reasonable use cap; some will cut you off, some charge you more, some cancel your service based on exceeding this use.</p>

<p><a href="http://www.networkworld.com/news/2008/090908-ieee-considers-gigabit.html?hpg1=bn"><strong>Gigabit Wi-Fi? Someday:</strong></a> TechWorld considers the IEEE's Very High Throughput (VHT) study group, which wants to start work on 1 Gbps or faster Wi-Fi standard for completion in 2012. With 802.11n offering raw symbol rates up to 600 Mbps--even though no devices have shipped with the radios and antennas to offer that optional high speed yet--there's interest in other frequencies that would allow faster encodings, as well as aggregating multiple links to achieve high speed rates. My experience in testing and using 2.4 GHz with Draft N would show that wide or aggregated channels doesn't work very well. The article's writer, Peter Judge, notes that ultrawideband had potential (over short distances) to approach the gigabit mark, but that UWB hasn't really reached the market in any substantive way years after it was promised to be a big technology.</p>

<p><a href="http://www.nbc5i.com/news/17435300/detail.html"><strong>Flight attendants express concerns about in-flight broadband porn:</strong></a> When I've spoken to airlines, industry experts, and service providers, I find that they all have stories about how porn is viewed on computers, through DVD players, and in convenient magazine form on planes today. Adding the Internet may provide new salacious imagery, but the problem predates Internet access, and filtering Internet service is never as good a solution as a social one. Someone idiotic enough to view porn on a plane over the Internet is also stupid enough to bring along inappropriate DVDs they watch while seated next to children. Flight attendants already have the power vested in them to take care of this. The flight attendants for American might be expressing this concern as part of a bargaining issue, where their responsibilities but not commensurate pay have increased.</p>

<p><a href="http://www.kxly.com/Global/story.asp?S=8989329"><strong>Spokane ends free Wi-Fi:</strong></a> Remember Vivato? Boy, I sure do. A company with a reach far exceeding its grasp, Vivato initially powered Spokane's downtown network. The network has continued to run on some basis--I'm not sure using what equipment--and now will move from free to fee. OneEighty Networks will charge about $10 per month to cover the costs of the network, for which local businesses at one point chipped in.</p>

<p><a href="http://www.onair.aero/"><strong>Brazilian TAM airline signs up for in-flight calling, messaging:</strong></a> OnAir has signed up the Brazilian carrier TAM, which will deploy the service on its Airbus A320 craft. Brazil hasn't yet provided regulatory approval, so no launch date is noted. TAM is the largest domestic and international carrier for Brazil.</p>]]></content:encoded>
      <pubDate>Thu, 11 Sep 2008 07:02:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/internet service">internet service</category>
      <category domain="http://securityratty.com/tag/faster wi-fi standard">faster wi-fi standard</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <category domain="http://securityratty.com/tag/internet access">internet access</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/software costs">software costs</category>
      <category domain="http://securityratty.com/tag/free wi-fi">free wi-fi</category>
      <source url="http://wifinetnews.com/archives/008436.html">Wee-Fi: Share Cell Connections over Wi-Fi; Mile High-Fi Salaciousness; Giga-Fi; and More</source>
    </item>
    <item>
      <title><![CDATA[[OT rant] Are there any home WiFi routers that DON'T SUCK?]]></title>
      <link>http://securityratty.com/article/2110e94e736fbe5f32088eee09481bee</link>
      <guid>http://securityratty.com/article/2110e94e736fbe5f32088eee09481bee</guid>
      <description><![CDATA[Warning: rant ahead, and names named
When I'm not traveling, I like to work from home some days rather than endure the trek from Seattle to Redmond (although it's much better now that our own employee...]]></description>
      <content:encoded><![CDATA[<p><em>Warning: rant ahead, and names named.</em></p>  <p>When I'm not traveling, I like to work from home some days rather than endure the trek from Seattle to Redmond (although it's much better now that our own <a href="http://seattlepi.nwsource.com/business/332970_msftbus25.html" target="_blank">employee transit service</a> has expanded into my neighborhood -- the existence of which is sad commentary on the availability and reliability of Seattle's public transit companies).</p>  <p>This means, of course, that I need fast and stable network connections. Comcast with their PowerBoost is working very well for me. But I just can't find a decent wireless router at all. My Lenovo T61p (with Intel 4965abgn adapter) just won't stay connected to my D-Link DIR-628 and IT'S DRIVING ME CRAZY! (Yes, I've tried various driver versions, from both Lenovo and Intel.)</p>  <p>My house is in an area with a lot of wireless activity -- sometimes I can see nine or ten SSIDs. I'm running draft N on 2.4GHz (which occupies two non-adjacent channels, currently 1 and 4), and I suspect the problem is collision interference. I could shift the router to 5.2GHz, which I probably would help, but then the rest of the computers in my house won't connect. Why, you ask? Well get this: the DIR-628 is part of <a href="http://www.dlink.com/products/category.asp?cid=1&amp;sec=1#cid_103" target="_blank">D-Link's RangeBooster N family</a>. So I stayed in the family and got two DWA-542 adapters for the desktop computers. Yet they only do 2.4GHz! Silly me, I assumed that being in the same family means full support of the router's capabilities.</p>  <p>I'm very tempted to replace my router again -- and I'm thinking that the best option is to get one with dual radios. That way I can move my T61p to 5.2GHz and replace the desktop adapters, while still having single-channel 802.11b/g on 2.4GHz for the Wii and my PlayStation Portable.</p>  <p>Now my request: tell me about your experience with home routers. What do you really like, and why? What should I buy?</p><img src="http://blogs.technet.com/aggbug.aspx?PostID=3110595" width="1" height="1">]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 20:12:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/decent wireless router">decent wireless router</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/router">router</category>
      <category domain="http://securityratty.com/tag/lenovo">lenovo</category>
      <category domain="http://securityratty.com/tag/d-link dir-628">d-link dir-628</category>
      <category domain="http://securityratty.com/tag/lenovo t61p">lenovo t61p</category>
      <category domain="http://securityratty.com/tag/intel">intel</category>
      <category domain="http://securityratty.com/tag/dir-628">dir-628</category>
      <category domain="http://securityratty.com/tag/intel 4965abgn adapter">intel 4965abgn adapter</category>
      <source url="http://blogs.technet.com/steriley/archive/2008/08/22/ot-rant-are-there-any-home-wifi-routers-that-don-t-suck.aspx">[OT rant] Are there any home WiFi routers that DON'T SUCK?</source>
    </item>
    <item>
      <title><![CDATA[The Secret Sauce is the Situation Models]]></title>
      <link>http://securityratty.com/article/e137f84c371e05c9a9841a0cc1ff27ec</link>
      <guid>http://securityratty.com/article/e137f84c371e05c9a9841a0cc1ff27ec</guid>
      <description><![CDATA[AlanLundberg wrote, Intelligent Business Process Platform? in response to Bringing Order to Chaos where someone from PWC linked event processing to business intelligence and business process...]]></description>
      <content:encoded><![CDATA[<p>Alan Lundberg wrote, <a href="http://tibcoblogs.com/cep/2008/08/04/intelligent-business-process-platform/">Intelligent Business Process Platform?</a> in response to <a href="http://www.pwc.com/extweb/home.nsf/docid/FB2EF3AC6E351ECC8525746B00676021" target="_blank">Bringing Order to Chaos</a> where someone from PWC linked event processing to business intelligence and business process management.  In turn, James Taylor penned <a href="http://smartenoughsystems.com/wp/2008/08/05/using-decision-management-to-deliver-intelligent-business-performance/">Using decision management to deliver intelligent business performance</a> where James rightly said that it does not require &#8220;heroic efforts&#8221; to integrate event processing, BI, BPM and other decision support tools.  </p>
<p>As a reference, you may have seen this briefing, one of many where I show these functional relationships, <a href="http://debs.msrg.utoronto.ca/bass.pdf">Mythbusters: Event Stream Processing Versus Complex Event Processing</a>, from DEBS2007.  For example slide 23 shows the functional relationship between events, pre-processing, event tracking, situational detection, historical patterns (the output of BI tools, for example), visualization and business process management.</p>
<p>In <a href="http://rvsoapbox.blogspot.com/2008/08/faithful-representation.html" target="_blank">Faithful Representation</a>, Richard Veryard reminds his readers that the most challenging part is in the situation models (not the system integration).  Unfortunately, by accident, Richard incorrectly attributes Opher Etzion&#8217;s &#8220;first order situation model approximation&#8221; to both Opher and I in this quote from Richard&#8217;s post, <em>&#8220;a simple situation model of complex events, in which events (including derived, composite and complex events) represent the &#8220;situation&#8221;.    </em></p>
<p>Actually, that simple situation model above is Opher&#8217;s, not mine.  I have offered a more general and comprehensive (first draft) situation model, in <a title="A Simple Situation Model for Complex Events" rel="bookmark" href="http://www.thecepblog.com/2008/07/15/a-simple-situation-model-for-complex-events/">A Simple Situation Model for Complex Events</a> based on a cognitive situation model used by <a href="http://www.nd.edu/~memory/theory.html" target="_blank">researchers at the University of Notre Dame</a>.  I do not believe that complex events and situations can be modelled accurately using Opher&#8217;s simple model of <em>derived, composite and complex events.   </em>This model is overly simple, in my opinion. to represent the vast majority of CEP classes of problems, perhaps explaining why Opher and I do not agree on the state-of-the-art of CEP.  Opher tends to view CEP as mostly an extension of active database technology where I see CEP as a technology that is much more closely aligned with the cognitive models represented in the <a href="http://www.thecepblog.com/what-is-complex-event-processing/" target="_blank">art-and-science of multi-sensor data fusion (MSDF).</a>  </p>
<p>Complex events represent situations, and situations must be accurately modelled if we are going to accurately detect them in real-time.  If your business cannot model a complex event (situation) then it does not matter what software you buy, how much money you spend, or what event processing and integration platform you use.   The models are hard.  The system integration is relatively easy.</p>
<p>The secret sauce is the situation and complex event models.</p>
<p>As mentioned here a few times, it does not matter how fast you process events in real-time, if your model is wrong, you just detect the wrong thing very fast.  This is very bad and quite dangerous.  You will make bad decisions fast.  You will waste time, money and resources.</p>
<p>This is why CEP benchmarks should be based on accuracy in situation detection, not in latency and other low-level performance metrics.   First, get the models right; then refine to detect faster, if speed is required.   What has happened in CEP to date, is that the models are so simple, they do not really detect complex events, they just process and act on simple events that are easy to model. </p>
]]></content:encoded>
      <pubDate>Sat, 09 Aug 2008 06:23:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/situation">situation</category>
      <category domain="http://securityratty.com/tag/situation detection">situation detection</category>
      <category domain="http://securityratty.com/tag/cognitive situation model">cognitive situation model</category>
      <category domain="http://securityratty.com/tag/simple situation model">simple situation model</category>
      <category domain="http://securityratty.com/tag/model">model</category>
      <category domain="http://securityratty.com/tag/situation models">situation models</category>
      <category domain="http://securityratty.com/tag/situation model approximation">situation model approximation</category>
      <category domain="http://securityratty.com/tag/events">events</category>
      <category domain="http://securityratty.com/tag/complex events based">complex events based</category>
      <source url="http://www.thecepblog.com/2008/08/09/the-secret-sauce-is-the-situation-models/">The Secret Sauce is the Situation Models</source>
    </item>
    <item>
      <title><![CDATA[TrueCrypt's Deniable File System]]></title>
      <link>http://securityratty.com/article/723a30942bcc2bbbe6f365b4d74045e7</link>
      <guid>http://securityratty.com/article/723a30942bcc2bbbe6f365b4d74045e7</guid>
      <description><![CDATA[Together with Tadayoshi Kohno, Steve Gribble, and three of their students at the University of Washington, I have a new paper that breaks the deniable encryption feature of TrueCrypt version 5.1a....]]></description>
      <content:encoded><![CDATA[Together with Tadayoshi Kohno, Steve Gribble, and three of their students at the University of Washington, I have  a <a href="http://www.schneier.com/paper-truecrypt-dfs.html">new paper</a> that breaks the deniable encryption feature of TrueCrypt version 5.1a.  Basically, modern operating systems leak information like mad, making deniability a very difficult requirement to satisfy.

<blockquote><b>ABSTRACT:</b>  We examine the security requirements for creating a Deniable File System (DFS), and the efficacy with which the TrueCrypt disk-encryption software meets those requirements. We find that the Windows Vista operating system itself, Microsoft Word, and Google Desktop all compromise the deniability of a TrueCrypt DFS. While staged in the context of TrueCrypt, our research highlights several fundamental challenges to the creation and use of any DFS: even when the file system may be deniable in the pure, mathematical sense, we find that the environment surrounding that file system can undermine its deniability, as well as its contents. Finally, we suggest approaches for overcoming these challenges on modern operating systems like Windows.</blockquote>

The students did most of the actual work.  I helped with the basic ideas, and contributed the threat model.  Deniability is a very hard feature to achieve.

<blockquote>There are several threat models against which a DFS could potentially be secure:

<ul><li>One-Time Access. The attacker has a single snapshot of the disk image. An example would be when the secret police seize Alice’s computer.
<li>Intermittent Access. The attacker has several snapshots of the disk image, taken at different times. An example would be border guards who make a copy of Alice’s hard drive every time she enters or leaves the country.
<li>Regular Access. The attacker has many snapshots of the disk image, taken in short intervals. An example would be if the secret police break into Alice’s apartment every day when she is away, and make a copy of the disk each time.</ul></blockquote>

Since we wrote our paper, TrueCrypt released version 6.0 of its software, which <a href="http://www.truecrypt.org/docs/?s=hidden-operating-system">claims<a/> <a href="http://www.truecrypt.org/docs/?s=hidden-volume-precautions">to</a> have addressed many of the issues we've uncovered.  In the paper, we said:

<blockquote>We analyzed the most current version of TrueCrypt available at the writing of the paper, version 5.1a. We shared a draft of our paper with the TrueCrypt development team in May 2008. TrueCrypt version 6.0 was released in July 2008. We have not analyzed version 6.0, but observe that TrueCrypt v6.0 does take new steps to improve TrueCrypt’s deniability properties (e.g., via the  creation of deniable operating systems, which we also recommend in Section 5). We suggest that the breadth of our results for TrueCrypt v5.1a highlight the challenges to creating deniable file systems. Given these potential challenges, we encourage the users not to blindly trust the deniability of such systems. Rather, we encourage further research evaluating the deniability of such systems, as well as research on new yet light-weight methods for improving deniability.</blockquote>

So we cannot break  the deniability feature in TrueCrypt 6.0.  But, honestly, I wouldn't trust it.

There have been two <a href="http://www.darkreading.com/document.asp?doc_id=159192&WT.svl=news2_1">news</a> <a href="http://www.pcworld.com/businesscenter/article/148513/data_can_leak_from_partially_encrypted_disks.html">articles</a> (and a SlashDot <a href="http://yro.slashdot.org/article.pl?sid=08/07/17/2043248">thread</a>) about the paper.

One talks about a generalization to encrypted partitions.  If you don't encrypt the entire drive, there is the possibility -- and it seems very probable -- that information about the encrypted partition will leak onto the unencrypted rest of the drive.  Whole disk encryption is the smartest option.

Our paper will be presented at the <a href="https://131.106.3.253/events/hotsec08/index.html">3rd USENIX Workshop on Hot Topics in Security</a> (HotSec '08).  I've written about deniability <a href="http://www.schneier.com/blog/archives/2006/04/deniable_file_s.html">before</a>.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=GC5EFJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=GC5EFJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=aZgBKJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=aZgBKJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 02:56:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/truecrypt">truecrypt</category>
      <category domain="http://securityratty.com/tag/deniable file system">deniable file system</category>
      <category domain="http://securityratty.com/tag/file system">file system</category>
      <category domain="http://securityratty.com/tag/truecrypt version">truecrypt version</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/truecrypt dfs">truecrypt dfs</category>
      <category domain="http://securityratty.com/tag/deniable">deniable</category>
      <category domain="http://securityratty.com/tag/truecrypt disk-encryption software">truecrypt disk-encryption software</category>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/truecrypts_deni.html">TrueCrypt's Deniable File System</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</link>
      <guid>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote>

<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=152f487f101abbcdd9c900fc3eb46268" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=152f487f101abbcdd9c900fc3eb46268" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/330098895" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/330098895/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
  </channel>
</rss>
