Banks seeking to gag crypto research

NEWS

Diners Club on Friday went to the High Court in London to try to get an order gagging public disclosure of cryptographic vulnerabilities in the technology used to protect withdrawals from ATMs. At risk is the right of a Cambridge research student to include previously published cryptographic research in his PhD thesis, the extent to which banks and other big companies can use the law to keep vulnerabilities in their systems secret (even though the secrets appear to be leaking out), and over £50,000 that used to belong to a South African couple, Anil and Vanita Singh. The case has its roots in March 2000, when over £50,000 was withdrawn during 190 separate transactions at ATMs in Britain from the Singhs' Diners Club card account. The Singhs say they did not withdraw the money, and claim that at the time, they were in South Africa, where they live. But Diner's Club International says that because all the computer systems involved are secure, the Singhs must be responsible for the withdrawals. It is seeking to recover the money from the Singhs, and the case is due to be heard in the High Court from 3 to 14 March. To help their case, the Singhs asked three cryptography experts based in Cambridge to act as defence witnesses: Ross Anderson of the Cambridge Computer Laboratory, and his students, Richard Clayton and Michael Bond, the latter of whom is writing a PhD thesis which in part looks at vulnerabilities in ATM systems. It is evidence from these witnesses which Diners Club is, says Anderson, seeking to oppressively gag. Lawyers acting for Citibank (a joint applicant in the case) and Diners Club sent a fax this week to Ross Anderson that contained a draft order ordering that they attend a preliminary hearing on Friday to determine whether evidence should be heard in camera. In Anderson's comments, which he submitted in a letter to the Queen's Bench Division because he could not attend the hearing, he said the terms of the secrecy order are "oppressive" and "inappropriate in the extreme". The problem is, according to Anderson, that the "gaping vulnerabilities in the design of the cryptographic equipment used by the applicants and by other banks involved... are of significant scientific interest and are relevant to public policy." They have, wrote Anderson, already been widely published and even incorporated into undergraduate teaching. Some of the vulnerabilities were verified by tests at the Cambridge Computer Lab on one of the affected types of machine. If the gagging order were granted, stopping publication of any evidence, it would, wrote Anderson, prohibit Bond from including in his thesis information that he has already published. Furthermore, the order "would suppress scientific research and teaching, and it would undermine the rights of many other victims of the current wave of 'phantom' withdrawals from cash machines." The phantom withdrawals Anderson referred to are an increasingly common phenomenon, according to a posting he made to the Cryptome security mailing list. "For the last couple of years or so there has been a rising tide of phantoms," he wrote. "I get emails with increasing frequency from people all over the world whose banks have debited them for ATM withdrawals that they deny making. Banks in many countries simply claim that their systems are secure and so the customers must be responsible. It now looks like some of these vulnerabilities have also been discovered by the bad guys. Our courts and regulators should make the banks fix their systems, rather than just lying about security and dumping the costs on the customers." The case is due to begin on 3 March.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

7 hours ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility

Replying to an old topic that I'm currently facing with my CEO (who is on a Mac). Our servers are primarily Windows Servers, office is about...

13 hours ago by txtrainguy on Windows Server 2008 drops the ball for Mac compatibility

Sure, that makes perfect sense. Pay wrong-doers money and thank them for breaching your security and pointing out your flaws, that would surely...

14 hours ago by k0tcs3 on US indicts Romanian over NASA climate change hack

I think he's referring specifically to Android apps, as Apple do regulate their App Store, but Google seem to let any old crap onto the Android store!

14 hours ago by Random_Error on RIM: BlackBerry will keep 'garbage' apps out of store

Keep the crap apps out?! How will they compete with Android and Apple's claim to fame of having so many life changing apps? I wonder if the media...

19 hours ago by Paul Fezziwig via Facebook on RIM: BlackBerry will keep 'garbage' apps out of store

It has been shown time after time that if there is an author store that sells the songs at even 1$ per song and gives you a high-quality digital...

20 hours ago by Aigars Mahinovs via Facebook on Copyright isn't working, says European Commission

""As a result of Butyka's alleged conduct, researchers were unable to use the computers for more than two months while NASA removed the malicious...

22 hours ago by awbMaven on US indicts Romanian over NASA climate change hack

It simultaneously worries me and uplifts me that a self-proclaimed group of internet activists name themselves after Indian mythical figures....

1 day ago by subhorup on Anonymous activists release PCAnywhere source code

It's actually far easier to work anonymously on the internet than you think. With tools like Tor bouncing your traffic around the world before...

1 day ago by naviathan on Anonymous activists release PCAnywhere source code

1000272134 and bluedalmatian with you both there but then I'm still in 10.04 land (and happy with it)

1 day ago by Agnostic_OS on Ten factors that make Ubuntu 11.10 a hit

Interesting article and definitely see your points on the products mentioned. One of the top products for our Help Desk (approximately 20% of all...

2 days ago by apexwm on Ten flawed products that derail productivity

Absolutely - this should obviously not be handled my isp - but handled by their hosting operator. What's been suggested here is that my isp police...

2 days ago by Paul Hutchinson via Facebook on MPs urge ISPs to take down terrorist material

Looks like a great phone. I don't notice any deficiencies in WP7. used IOS before, that's pretty good. I don't spend much time in Apps, all i need...

2 days ago by Techs UK on Nokia pins US 're-entry' hopes on Lumia 900

Now with the help of these apps you are always synced with MS outlook while on the move. Just download apps like xobni or outlookreflex and get...

2 days ago by Larry Bloggy via Facebook on Outlook Social Connector beta 2 and the LinkedIn connector

Your details are wrong. The version currently being made is the one with 2 USB ports, 256MB RAM and a network port. This is the Model B. The...

2 days ago by mike40g123 on Raspberry Pi boards set to go on sale

The thing that has been puzzling me for quite a while is how Anonymous can remain anonymous whilst not only being active on the Internet but also...

3 days ago by Moley on Anonymous activists release PCAnywhere source code

If what Semantec is saying is rue, that is even worse and shows a complete disregard for thier users. If what Anonymous claims is true and the...

3 days ago by Don Dilly via Facebook on Anonymous activists release PCAnywhere source code

Didn't seem particularly biased to me either. Oh though you might have mentioned some other competitors with free search and email services...

3 days ago by MattChurchy on Time for an evil umpire: Google, Microsoft & privacy

James - exactly as much as anyone paid you for your comment; I don't feel that I need to say that I'm independant and unbiased, but just for you...

3 days ago by Simon Bisson and Mary Branscombe on Time for an evil umpire: Google, Microsoft & privacy

Once they realise symantec are willing to pay real money, they will simply keep extorting, unless of course symantec/authorities can use the...

3 days ago by Carl White via Facebook on Symantec offered hackers $50k in source code sting

Featured white papers

Latest jobs

Banks seeking to gag crypto research

Daily Newsletters

Topics

Related stories

Heart of England NHS begins massive digitisation plan

Hard-drive woes hit PC shipments in fourth quarter

Post your comment

ZDNet UK Live

Latest in IT Strategy

Heart of England NHS begins massive digitisation plan

Hard-drive woes hit PC shipments in fourth quarter

Featured white papers

Latest jobs

Test Analyst - Business Intelligence /Data Warehousing

Test Analyst - Business Intelligence /Data Warehousing

Technical MI Manager - 50-60k - Leeds

Inside ZDNet UK

Cabinet Office: no lobby influence on open standards

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

Case study: How cloud enables growth

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

News & Analysis

Reviews

Blogs

Resources

About Us

Member Services

Special Features

Advertising Features

ZDNet UK / News and Analysis / Business of IT / IT Strategy

Banks seeking to gag crypto research

Daily Newsletters

Topics

Related stories

Post your comment

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Latest in IT Strategy

Featured white papers

Latest jobs

Inside ZDNet UK

Resources

About Us

Member Services

Special Features

Advertising Features