Slashdot Mirror
Software to Support Human Rights
An anonymous reader writes "Some software rollouts have lives hanging in the balance. Human rights workers in massacre zones from El Salvador to Kosovo face prying eyes peering into their address books and logs, who follow up with bullets and poison gas. One project, Martus, takes these hostile environments into account: a leak can get whole families killed. They use encryption, distributed backup, and other techniques designed to survive the ultimate corrosive environment: vindictive armies in countrysides in the throes of war. The source code is open, to allow meaningful contributions from anyone willing to help. These people bet their lives on open source and private data. The sponsor organization, Benetech in Silicon Valley, funds projects that arm global rights workers, and people under siege, with communications tools that counterbalance the overwhelming force used to exterminate everything "Free"."
The source code is open, to allow meaningful contributions from anyone,
[b]including people who do not mean well[b]
watch out!
it might not be long untill we need this or something like it to protect us from our own homland security KGB.
Famous Last Words: "hmm...wikipedia says it's edible"
If the encryption software is open source, doesn't that mean that hostiles who want to break the encryption can use the source to make sonething to counter the encryption?
I have a vague idea on why that's not so, but nothing definate. I heard it being compared to trying to put a sausage into a meat grinder backwards to make a pig.
Yup...
Also vim helps human rights... "Uganda licence" is a good idea to make OS Software even more useful...
And soon enough even the possession of these kinds of tools will be enough to put people in jail. After all, they were probably using them to swap MP3s or kiddie-pr0n or even plan terrorist acts.
Strong crypto is only a part of the answer (whatever that answer may be).
Xix.
"Everything is adjustable, provided you have the right tools"
The evil army will just beat your key out of you. They aren't just going to try a few codes and walk off; they are going to break out the hoses and the electric generators. They may not be able to break the encryption, but they sure as hell can break you.
Boycott Redhat, never ever use or install Redhat personally or in your work.
Redhat supported tyrannic mainland China against democratic Taiwan and gladly removed Taiwans status as independant in their latest distributions. The only reason is to make more dollars from China.
It should be notet that companies like HP and Microsoft has refused to remove Taiwans status as independant despite pressure and fines from the dictatorship in China.
There is plenty of really good distributions, there is simply no need to support tyranny.
I mean, the Government says "give me your decryption key or we will put you in jail until you do". Here the choice will be giving up your key vs. giving up your life. Unless someone is VERY dedicated and brave, they are going to give up the key when they have a gun to their head (or worse).
Freedom Is Universal
Linux-Universe
Hence my other comment somewhere in here.
If it's a high profile, or an International organisation that can tell the authorities where to stick it, crypto can be very valuable. For example, to keep intercepted communications secret. OTOH, no amount of crypto is going to do you any good if they can haul you away and beat it out of you.
It's a very useful tool, but only in the right circumstances.
Xix.
"Everything is adjustable, provided you have the right tools"
it is just as useful to criminals as to human rights workers. This is not, of course, a problem per se, but
using this as a pretext, governments will simply ban possession and usage of this software. If they need any pretext, that is - in the kind of country this software is designed to be used, "human rights worker" is just another word for criminal.
This kind of software is useful to preserve personal privacy in a civilized nation. In a thugocracy, however, the police will just confiscate your computer, or you will be extradited/tortured/shot for being in possession of this software.
People interested in this might also be interested in the rubberhose project.
From the homepage:
"Rubberhose transparently and deniably encrypts disk data, minimising the effectiveness of warrants, coersive interrogations and other compulsive mechanisms, such as U.K RIP legislation. Rubberhose differs from conventional disk encryption systems in that it has an advanced modular architecture, self-test suite, is more secure, portable, utilises information hiding (steganography / deniable cryptography), works with any file system and has source freely available. Currently supported ciphers are DES, 3DES, IDEA, RC5, RC6, Blowfish, Twofish and CAST."
Ubi dubium ibi libertas: Where there is doubt, there is freedom.
I see this software and I find myself very afraid. It neatly packages up a military grade cryptographic communications solution and makes it freely available to the public. While the people who it is intended for will benefit greatly from it, those who intend to do harm will also have easy access to it.
Martus is a cryptographic solution: overt, secret communications. The people who this is intended for are already under surveilance by those who wish to do them and their contacts harm, so making the already-intercepted messages unreadable is the solution to this problem.
Criminal organisations would likely need more of a steganographic solution: covert, secret communications. An often-overlooked fact about secret communications is that the mere presence of secret messages can be an indicator that something is going on.
When Nazi Germany was using the Enigma, they had their communications officers send garbage messages[1] so that the Allies would not detect a sudden burst of communications activity indicating some sort of military action.
If a terrorist organisation* were to begin using a system like this, any intelligence services watching them would be tipped off and would have to figure out what's going on the old fashioned way (we all know what that means). But, the fact is that they are alerted to what's going on and can then follow up.
If you think about these points, I hope that your fears of evil people exploiting this effort may be eased. If anything, using this (or similar) software will tip their hands and expose that something is going on.
*An organisation targetting civilians with violent actions to serve political means.
[1] Simon Singh, The Code Book. (1999) Random House, New York
I read the website, it seems the creators of Martus (along with humanitarian workers) are under the delusion that nothing gets done about these human rights violations because nobody knows about them.
They are wrong, people do know about them (many of them).
People don't give a shit. That's the problem, nobody wants to go solve other people's problems. It's not lack of awareness. Sure there is lack of awareness, and yes very few of the human rights violations of the world are documented.
But fundamentally, people only care about their own problems even if they are much smaller in comparison. People do not want to sacrifice for others, especially people they dont know are dont have a cultural bond with. It's a combination of ignorance and apathy, with apathy being the MAJOR dominant factor.
Martus and other projects like it will be a disappointment until people figure start caring about issues of human rights and try to solve them in a meaningful and logical manner (and that excludes the "let them kill each other" excuse/way).
is not that it uses cryptography. It basicly uses pgp, which you or any terrorist or human rights (HR) activist could download. But the software isn't about just sending encrypted messages, which is all terrorists would want.
The point is that in Martus, the crypto is integrated into a package that allows HR groups to a) send the data to a secure server, where there is b) a central database, and c) allow other, approved groups to view the data. This allows HR groups to get the info out from problematic areas to a place where the international community can see what's going on. Sure, terrorists could use the software to send messages, but what the heck do they need a database for? For HR groups, the problematic gov't could come cart off every computer and piece of paper in their office, and the data would still be secure and accessible. And as soon as they got access to another computer, they could start adding to it again.
The Economics of Website Security
Please remember that Java can be compiled. When it is, it can run ok even on older systems. We did a stock exchange client in Uzbekistan in Java on a 32MB 66MHz 486 under Win98SE because that was all they had available for the dealers at the exchange.
See my journal, I write things there
Redhat supported tyrannic mainland China
Oh please, if you all feel so strongly about tyrannic China, then why don't we see a boycott of Chinese products? Take a look around you and see how many products you use all the time that were "made in China". My Microsoft mouse, my Logitech mouse, my keyboard at work, some of the parts inside my computer, my Microcom modem etc, all made or assembled in China. Americans don't want to support China's tyranny, but they don't feel so strongly about it that they will stop buying China's cheaper products as a protest.