The genetic genealogist who played a key role in establishing the identity of the murderer was Barbara Rae-Venter. The New York Times has just published a fascinating tale of how Rae-Venter used DNA tests and publicly-available genetic information to establish the identity of a woman who was kidnapped as a child. Once more, Rae-Venter searched DNA-based genealogical sites for rough matches with the victim’s DNA. From these, she was ultimately able to establish the kidnapped girl’s family tree and thus identity.

The increasingly successful use of this technique raises an important question: given a DNA sample, how likely is it that there will be a rough match among consumer genetics databases? A US-Israeli group of researchers have published a paper exploring exactly that issue, and the results have major implications for privacy.

The researchers used a dataset of 1.28 million individuals who had sent their DNA to be analyzed by one of the increasingly-popular consumer genomics companies such as 23andMe. They took random individuals from this pool, and searched for any distant family members that might also be present in the dataset. Interestingly, they did not look for close relationships, because there is apparently a tendency for near-relatives to get tested together, which would skew the results for finding matches. Distant relatives are less likely to act in a coordinated fashion, and so searching for such matches give a better indication of the true power of this kind of genetic analysis.

In 15% of the searches, a match which corresponded to a second cousin or closer relative was found. In 60% of the searches carried out by the research team, a match which corresponded to a third cousin or closer relative was found. That’s significant, because the case involving the unsolved murders mentioned above used matches at this level. The new paper therefore indicates that for around 60% of the genetic pool studied there would be a match that would probably be good enough to identify them if they had left DNA at a location.

However, it’s important to note that the dataset used by the researchers was not representative of the US population of a whole. About 75% of the 1.28 million individuals were primarily of North European genetic background. This means that individuals primarily from that background were more likely to have a match than individuals whose genetic background was primarily from sub-Saharan Africa, say. Nonetheless, the figures in the study still give a good idea of how easy it has become to find matches for genetic material in DNA genealogy databases.

The researchers went on to calculate how big the pool of DNA samples would have to be to make the probability of finding a rough match near to certainty. They found that a genetic database needs to cover only 2% of the target population to provide a third cousin match to nearly any person:

we predict that with a database size of [about] 3 million US individuals of European descent (2% of the adults of this population), over 99% of the people of this ethnicity would have at least a single 3rd cousin match and over 65% are expected to have at least one 2nd cousin match. With the exponential growth of consumer genomics, we posit that such database scale is foreseeable for some 3rd party websites in the near future.

It may take a little longer, but the same will be true for people who descend from most other ethnic groups. The researchers went on to consider how easy it would be to establish the exact identity of a person of interest after finding one or more distant relatives in a familial search. The group tried to reduce the number of people who would need to be interviewed, using basic demographic information, such as geography, age, and gender:

On the basis of counting relevant relatives of the match, the initial list of candidates contains on average [about] 850 individuals. Our simulations indicate that localizing the target to within 100 miles will exclude 57% of the candidates on average. Next, availability of the target’s age to within [plus or minus five years] will exclude 91% of the remaining candidates. Finally, inference of the biological sex of the target will halve the list to just around 16-17 individuals, a search space that is small enough for manual inspection.

This has important implications for people who have provided their DNA for scientific purposes, and allowed it to be released anonymously. As the researchers go on to show in their paper, it is now possible to take DNA from a supposedly anonymous dataset, find matches in public genetic databases, and then work out the identity of the individual by building a family tree. That’s a big problem, because it means that it will be possible to put names to DNA sequences that may have easily-identified medical problems. Clearly, this might pose a real privacy challenge for people who have donated their DNA in the belief that it would remain anonymous, and that their possibly-serious medical conditions would never be connected with them.

That new capability may impact the willingness of people to allow their DNA to be released for scientific research. But there is a broader problem that will affect everyone. The research described above indicates that soon, US individuals of European descent will have lost their genetic anonymity. Those descended from other major populations will find themselves in a similar situation in due course.

Already, given a DNA sample, distant relatives can probably be found. That’s the case whether or not the individual concerned had uploaded DNA to a consumer genomics company. And from those close relatives it is likely that a family tree could be built up that would allow them to be correctly identified. Moreover, as more people add their genetic profiles to genealogical databases, the easier, quicker and cheaper it will become to name them.

It is not unreasonable to assume that in a few years’ time, there will be well-populated family trees for more or less everyone in countries where consumer genomics is offered as a low-cost service. As a result, for almost any genetic material found on an object, or at a site, it will be possible to establish the likely identity of the person who left it there. Since we are continuously shedding our DNA wherever we go, this could become the perfect way to identify people and to track their movements and activities – without the need to install any surveillance equipment beforehand.

Featured image by 23andMe.

The post Coming soon: everyone’s genetic anonymity undermined by distant relatives – and there’s nothing you can do about it appeared first on Privacy News Online by Private Internet Access VPN.

Defending the new law which he penned, Brazilian Congressman Áureo of Brazil’s Solidariedade party said he proposed the rule to bring transparency to online speech. He said:

“Freedom of expression is guaranteed, but it cannot be anonymous.”

One doesn’t need to look far to see the potential chilling effects this will have on free speech. Another question is whether or not social media platforms will even comply with Brazilian orders. Facebook’s WhatsApp is a famous example in Brazil, having been banned multiple times for refusing to give up metadata on Brazilian users.

Brazilians speak out against their further restricted freedom of expression

Several associations representing newspapers, television stations, radio stations, and even magazines – the type of sites that would invariably end up having anonymous comments about political parties and candidates on their social media accounts – spoke out vehemently against the new law. They don’t like that politicians can bypass the judicial process to stifly freedom of expression. The associations said:

“Brazil’s internet legal framework clearly states that only through a judicial order it is possible to force the withdrawal of online content.”

Carlos Affonso Souza, director at the Institute of Technology and Society, also voiced his concern about the change – telling Reuters:

“That piece of legislation will transform candidates and parties into electoral judges, with powers to take out of the web any content they consider offensive to them.”

Like this article? Get notified by email when there is a new article or signup to receive the latest news in the fight for Privacy via the Online Privacy News RSS Feed.

Featured image from Rachel Hinman via CC 2.0.

The post Brazilian politician: “Freedom of expression is guaranteed, but it cannot be anonymous” appeared first on Privacy News Online by Private Internet Access VPN.

“Throughout the years Satoshi wrote thousands of posts and emails and most of which are publicly available. According to my source, the NSA was able to the use the ‘writer invariant’ method of stylometry to compare Satoshi’s ‘known’ writings with trillions of writing samples from people across the globe.”

The application of what is known as stylometry is only useful if you have other holdings of text linked to named individuals, which can be compared to a kind of stylistic fingerprint extracted from the texts under study. The problem is that Satoshi Nakamoto could be anyone, anywhere. That means stylometry is only likely to be helpful if you have a huge database of writings that includes everyone on the planet who is active on the Internet; people who are not online can probably be excluded since they are unlikely to have come up with something as inherently Net-based as Bitcoin. Although we are not generally aware of the fact, the NSA has just such a database, as the Medium article explains:

“The NSA then took bulk emails and texts collected from their mass surveillance efforts. First through PRISM (a court-approved front-door access to Google and Yahoo user accounts) and then through MUSCULAR (where the NSA copies the data flows across fiber optic cables that carry information among the data centers of Google, Yahoo, Amazon, and Facebook) the NSA was able to place trillions of writings from more than a billion people in the same plane as Satoshi’s writings to find his true identity. The effort took less than a month and resulted in positive match.”

Again, leaving aside the fact that we are not told the supposed true identity of Bitcoin’s creator, what is much more relevant for readers of this blog is that the NSA possesses trillions of texts written by billions of people, and can therefore fruitfully apply stylometry to work out the author of a document, provided it is substantial enough to make any match that is found statistically meaningful.

This means for practical purposes, that it is very difficult to write longer documents, or produce sets of smaller texts, anonymously. All the NSA needs to do is to calculate the stylometric fingerprint for a document or group of posts, and then compare it with the huge holdings of texts with identifiable authors in its database. Of course, the NSA will not expend large amounts of time and money doing so unless the document is of particular importance or – as in the case of Satoshi Nakamoto – the person sought is of particular note.

The quantity of digital data being generated continues to grow rapidly. As a result, the number of emails and social media posts that the NSA must store in order to have a comprehensive record of everyone’s writing style is also growing rapidly. However, don’t start hoping that the NSA will be overwhelmed, and forced to store only a portion of that data flood. Last December, Amazon announced a new service called the AWS Snowmobile:

“This secure data truck stores up to 100 PB of data and can help you to move exabytes to AWS in a matter of weeks (you can get more than one if necessary). Designed to meet the needs of our customers in the financial services, media & entertainment, scientific, and other industries, Snowmobile attaches to your network and appears as a local, NFS-mounted volume.”

The AWS Snowmobile is primarily designed to move petabytes – or even exabytes – from company data centers to Amazon’s AWS cloud. But if Amazon can put that much storage in a single container, think how much the NSA might have crammed into its extensive facilities. Given that ten AWS Snowmobile containers can store an exabyte, the NSA could easily by running databases holding a zettabye or even a yottabyte. To put that in perspective, a Wired article on Amazon’s product notes that a single AWS Snowmobile could hold five copies of the Internet Archive – effectively a backup copy of the Web, past and present – which contains “only” about 18.5 petabytes of unique data. Storing every email and social media post it intercepts is clearly quite feasible for the NSA.

Even if it doesn’t (currently) do this, there is little doubt that the NSA, and other top intelligence agencies in other countries, have vast holdings of our digital activities. That’s important not just for existing applications like stylometric analysis, but particularly for training future artificial intelligence systems. Indeed, most of the power of such AI tools comes from feeding in lots of relevant data to hone the system. Whatever algorithms the NSA and other spy agencies have developed, they are probably already pretty good at analyzing our digital lives thanks to the huge data stores available for training.

That’s the bad news. Some good news is that just as stylometric analysis is gaining new power through the application of technology, so it can perhaps be defeated by technology. There’s an open source project on GitHub called Anonymouth:

“a Java-based application that aims to give users to tools and knowledge needed to begin anonymizing documents they have written.

It does this by firing up JStylo libraries (an author detection application also developed by [the Privacy, Security and Automation Lab at Drexel University, Philadelphia]) to detect stylometric patterns and determine features (like word length, bigrams, trigrams, etc.) that the user should remove/add to help obsure their style and identity.”

And so the great digital arms race continues, between those wanting to preserve their anonymity and privacy online, and those wishing to strip them away.

Featured image by Amazon.

The post Another threat to your privacy: the way you write appeared first on Privacy News Online by Private Internet Access VPN.

If CISPA or other privacy-busting legislations pass, every detail of our personal lives will be at risk – and you’ll want to buy Bitcoins for safety. Although many of our foundations are rooted in anonymity, everything we see, do and buy may soon be exposed. However, technology always evolves, and anonymity is no exception.

As many already know, Bitcoin is a decentralized, digital currency that can be used like cash. What many people may not already know, however, is that there is no need to hand over all of your information to an exchange to buy bitcoins. It’s already incredibly easy to buy bitcoins anonymously, in less than 10 minutes!

Update: The following is an antiquated method to buy bitcoins anonymously. Currently, the best way to buy bitcoins anonymously is still to use a VPN or Tor and use a service like described by the anonymous member of the Bitcoin community below.

How to Buy Bitcoins Online Anonymously

• • •

The post How to Buy Bitcoins Anonymously in the US, Instantly appeared first on Privacy News Online by Private Internet Access VPN.

Step 1

In the past, step 2 generally consisted of several intricate steps that required a significant amount of effort and skill.  Even if a system was filled with valuable data, it was highly unlikely that any of said data was actually valuable to the hacker.

Therefore, at this point, one generally had to undergo several steps to turn a profit:

1. Find a buyer who was interested in the data.
2. Sell the data.
3. Seller had to make sure buyer sent funds.
4. Buyer had to make sure seller sent data.
5. All steps needed to be conducted anonymously.

This meant that hackers had to create fake bank accounts, which meant they had to create fake identities, which meant they needed to purchase these from yet another untrusted source in order to conduct the anonymous transaction.  As one can see, these were quite daunting tasks.  Of course, there were (and still are) major criminal organizations, as well as highly entrepreneurial hackers, that have solved these problems.  But, overall, these persons and organizations represented a minority percentage of the people who wished to hack for profit.  For everyone else, the difficulties and risks involved in obtaining bank accounts with false identities or receiving payments in some other anonymous manner just wasn’t worth it.

For most hackers, there was little opportunity to profit from hacking, and therefore, most hacking was conducted for purely non financial reasons.  Many of the most talented hackers were not criminal by nature, and as such, were unwilling to take the dangerous risks required to financially gain from a hack.  As such, much hacking was conducted for seemingly altruistic reasons (e.g., showing the site they infiltrated it, how they did it, and how to fix it).  Many hackers did this to obtain a job, or merely to feel good about themselves after helping someone out (as well as internet fame).

However, everything changed when a new money was created out of thin air.  Bitcoin solves all of the above problems for hackers entirely and, moreover, quite elegantly.  Suddenly, hackers are able to profit with minimal effort:

1. Hack.
2. Grab Bitcoin Private Keys.
3. Transfer Bitcoins to oneself.

At this point the hacker has already profited.  They can go further and put the Bitcoins through a mixing service to anonymize them and then cash them out at an exchange for USD.  Furthermore, this can all be done over Tor to remain fully untraceable.

When compared to the previous monetization schemes associated with hacking, this is several orders of magnitude easier.  All one needs to do is simply find a system with Bitcoins on them.  While this is scarce now, it is highly likely that Bitcoins will become much more prevalent over time.  Additionally, it is fairly simple to find servers who are holding Bitcoins (see Linode) as well as monitor the Bitcoin P2P network for IPs associated with Bitcoin transactions.

Even script-kiddies who distribute applications to create botnets which can be used for mining or DDoS attacks no longer need to DDoS sites and hold them ransom.  Instead, they can simply steal Bitcoins off any computer they control.

Hacking has changed.  And while money can be generated with a computer, it can now  also be stolen through black hat hacking even faster.  It’s not Houdini; but rather, Who dun’ it?  And, today, it looks like we’ll never know.

Some tips on staying safe:

1. Use a VPN or Tor to mask your IP on the Bitcoin P2P network.
2. Keep all of your Bitcoins in an offline wallet.
3. Use a BrainWallet.

If you have other suggestions, please feel free to leave them in the comments!

The post Pullin’ a Rabbit out of a Black Hat appeared first on Privacy News Online by Private Internet Access VPN.

Anonymity

The founder of 2Ch, a popular anonymous forum in Japan, said,

“… delivering news without taking any risk is very important to us. There is a lot of information disclosure or secret news gathered on Channel 2. Few people would post that kind of information by taking a risk. Moreover, people can only truly discuss something when they don’t know each other.

If there is a user ID attached to a user, a discussion tends to become a criticizing game. On the other hand, under the anonymous system, even though your opinion/information is criticized, you don’t know with whom to be upset. Also with a user ID, those who participate in the site for a long time tend to have authority, and it becomes difficult for a user to disagree with them. Under a perfectly anonymous system, you can say, ‘it’s boring,’ if it is actually boring. All information is treated equally; only an accurate argument will work.” (Source: Wikipedia)

There is very little room for argument as to how anonymity protects ideas, society and ultimately, the freedom of humanity.  However, anonymity has also become an important tool to protect oneself from the many dangers of the Internet.

• • •

In the early days of the Internet, IRC Networks which, at the time, did not mask IP addresses and hostmasks, quickly became the World of Warcraft for the youth and angry alike.  A popular network, known as Eris Free Networks or EFnet, became a group warzone where users would compete to take control of IRC channels and IRC nicknames.  Essentially, one would be able to utilize a form of DOS attack to disconnect other users and servers from the network.  Some of these attacks consisted of sending a specific ICMP packet which confused routers, while others consisted of simple traffic/packet floods.  These attacks were used against both the IRC servers to incite a network-split as well as specific users in order to remove opposition groups from control of IRC channels and nicknames.

Groups eventually utilized Eggdrop bot networks which consisted of multiple IRC clients spread across multiple geographic networks to maintain connectivity to IRC, and essentially, maintain control of IRC channels and nicknames even in the event of network-splits and bot floods.  Many of the bots and individual IRC connections were run through high powered UNIX Shells in order to utilize more stable connections with bigger pipes.  With this came the birth of multiple vanity hosts, which utilized the “reverse DNS” of IP addresses to portray custom messages in user’s hostnames.

A revolutionary solution arrived when dalvenjah launched DALnet, and with it, channel and nickname registration services.  However, quickly it became a reality that cloaking IP addresses was still important, even with the absence of channel and nickname wars.

At this point, more experienced (aka higher level) users (aka script kiddies) were able to utilize tools such as Teardrop, Smurf, Boink, Ping of Death, amongst others against the less experienced (aka newbies).  Some of these led to instant blue screens [of death], while others hilariously crashed the TCP Network Stack causing a dialog box to open indicating the computer would restart in 60 seconds.  With long boot times on the slow computers of yesterday, the re-spawn time associated with a death in World of Warcraft is a far cry from the 5+ minute waits caused by these restarts along with the potential busy signals when dialing into ISPs.

As such, for the receivers of these attacks, there were very few laughs.  This made it increasingly important to protect one’s IP address with the use of UNIX shells as well as IRC bouncers.  Finally, anonymizing and cloaking one’s IP address became so important in preventing hacks, attacks, and serious smacks (worse than getting slapped by mIRC’s trout) that innovation was introduced by binary and Mysidia (Darkfire.Net/Sorcery.Net) in the creation of built-in IRC cloaking on IRC servers which has, today, become adopted in the majority of IRC networks’ codes.

Fast forward today, a different mischief in IP usage has begun.  While script kiddies and individuals used to be the perpetrators of negative IP usage, today, corporations have begun to use IP addresses as well for data tracking.  On August 4, 2006, AOL released the data for millions of searches by millions of users.  Programmers were able to cross-reference the “anonymized” data to figure out who entered each search query.  This was a massive breech of data privacy which led to severe embarrassment for many.

Projects such as Do Not Track attempt to protect users by providing an opt-out from data tracking and mining.  However, there seems to be very little reason at this time for corporations to comply with these projects.  Further, projects such as YouHaveDownloaded that provides P2P BitTorrent download data by IP, have helped to re-emphasize that IP privacy is ever so important.  In fact, cross referencing BitTorrent data with Skype P2P traffic leads to a direct breech in identity and, essentially, privacy.  Additionally, anonymous crypto-currencies such as Bitcoin suffer from these same problems, especially when not used with a patched Bitcoin client.

Today, many users opt to protect their identity using Tor and VPN services.  The protection of our privacy and access to anonymizing identity protection services is an important must as we build the Internet, which is, today, still just a newbie.

The post Cloak and Swagger: A Brief History of Anonymous Identity Protection on the Internet appeared first on Privacy News Online by Private Internet Access VPN.