Blown To Bits

Archive for the ‘Security’ Category

The End of Checks?

Friday, December 5th, 2008 by Harry Lewis
Lyrica remeron no prescription may not be the right treatment option for you if order lipitor online you have certain medical conditions or other factors affecting your cheapest cialis side effects dose health. Oncologists can specialize in treating cancers that affect specific buy no rx clozapine populations or parts of the body. To prepare for the discount lumigan surgery, a doctor will assess a person's clinical history and buy cheap t-ject 60 online ask questions about past treatment. Communal sharing can help lift discount zyprexa the burden of living with psoriasis and help prevent feelings cialis purchase of isolation, depression, and anxiety. This may involve saying no lowest price for viagra to social situations or isolating themselves from friends and family buy methotrexate to prevent opportunities for physical contact. Depending on where a cheap cialis on internet phlebotomist works, they may also have additional responsibilities and handle cafergot online other specimens, such as sputum, urine, and stool samples. However, order cheapest pamoate low cost dosage the symptoms of PLS typically affect the lower body first, discount cipro before affecting the upper body, and people with PLS typically have.

Don Knuth, the father of modern computer science, has for forty years been paying people to discover errors in his books. Catching the master in some minor oversight or typographical inconsistency was a grand game, at which everyone won: the lowliest sophomore could become a local hero, while adding to the sum of knowledge embodied in Knuth’s great encyclopedia of the field. It became such an honor to receive a small check from Knuth that almost no one ever cashed them (most people, as Knuth wryly observed, cached them instead). The proud display of a Knuthian check has apparently caused his bank account numbers to leak into the public domain, and his bank accounts have been broken into. Here is Knuth’s explanation of how this happens, and the larger lesson:

Leading banks and investment funds have been foundering, because of bad debts and lack of trust; and other, less well-known kinds of fiscal chaos are also on the horizon. For example, due to an unfixable security flaw in the way funds are now transferred electronically, worldwide,¬†it is no longer safe to write personal checks. A criminal who sees the numbers that are printed at the bottom of any check that you write can use that information to withdraw all the money from your account. He or she can do this in various ways, without even knowing your name — for example by creating an ATM card, or by impersonating a bank in some country of the world where safeguards are minimal, or by printing a document that looks like a check. The account number and routing information are all that international financial institutions look at before deciding to transfer funds from one account to another.

The end of personal checks may not be a big deal–we can certainly see it happening de facto. I used to write dozens every month, but with online banking and electronic fund transfers, I am down to two or three per month, and even that number is decreasing rapidly. I hadn’t thought about this being a real loss to anyone. But for those of us who know the enormous symbolic value of a $2.56 check from Don Knuth, his new plan doesn’t feel quite the same:

After painful deliberation I’ve come up with a new plan, which I hope will be acceptable to all concerned, and perhaps even welcomed as an improvement. Instead of rewarding heroic bug-finders with dollars, I shall henceforth award brownie points, otherwise known as hexadecimal dollars (0x$). From now on it will be kudos, not escudos.

Instead of writing personal checks,¬†I’ll write personal certificates of deposit to each awardee’s account at the Bank of San Serriffe, which is an offshore institution that has branches in Blefuscu and Elbonia on the planet Pincus.

Times change. Checks were always a way of transferring information, so turning them into bits makes all kinds of sense, but sometimes even those monetary informational chits carry a lot of emotional clout.

Town of Brookline Opposes Surveillance Cameras

Thursday, December 4th, 2008 by Harry Lewis

Surveillance cameras have been popping up where I live, in Brookline, Massachusetts, a town contiguous with Boston but with a very distinct history. And governance: we still have an old-fashioned Town Meeting, where the elected representatives of our districts are ordinary citizens, who work with a Town Manager, not a Mayor.

As reported in the Brookline Tab, our local paper, folks have had enough of the profusion of cameras. This one article has all the themes laid out; it could be a template for debates elsewhere. The police chief:

“It’s never been our intent, and it’s not our intent, to spy on people. It’s our intent to take advantage of technology to make Brookline a safe place.”

The righteous citizenry:

Opponents of the system — which include the Progressive Democrats of Massachusetts, Brookline PAX, state Rep. Frank Smizik and several dozen residents — have described the system as the first step toward a slippery slope of police surveillance. Several residents referenced George Orwell’s dystopian novel, “1984.”

The conformists:

If the board chooses to reject the cameras, it would be the only community in greater Boston not linked to the system.

The privacy zealots:

Several said they feared that the Department of Homeland Security could eventually demand access to footage from the cameras, or that hackers could break into the network and view live video feeds. Archived footage would also be subject to public records requests, meaning that any member of the public could potentially access stored videos — something that has concerned even town officials.

The free-speech libertarians:

Abram Chipman, a Washington Street resident who holds a weekly vigil in Coolidge Corner protesting the war in Iraq, said he would feel less comfortable knowing police could be watching his activities. Joan Lancourt, a resident of Beaconsfield Road, said she worried the cameras would have a “chilling effect” on political protest in Brookline. “I was dismayed, because the potential for self-censorship is real,” she said.

Maybe it’s not really about crime, but emergency evacuation:

“Having a camera allows for prenotice, of some degree, of what is coming on the roadway,” said Gary Toth, a Gardner Road resident and volunteer for the Community Emergency Response Team.

Or maybe it really is about crime:

Two test cameras have already aided in several incidents, including a sexual assault and drunken driving crash.

The article also raises the proper questions about cost and about how long the data will be retained.

I love this town, because of its diversity. My kids’ elementary school classes had scores of native languages. But the other thing it has is a diversity of ideas, and a population prepared to express them — a good, old-fashioned, blooming, buzzing democratic cacophony.

Pentagon Bans Flash Drives

Tuesday, November 25th, 2008 by Harry Lewis

A few weeks ago we noted a case in England where data giving access to the records of 25 million Britons was found on a flash drive that some clown dropped in the parking lot of a pub.

Now the AP is reporting that the Pentagon is banning all flash drives, and is collecting the drives that are in the hands of Pentagon workers, with no assurance they will ever be returned. The goal is apparently not to prevent data from leaking out, but to prevent viruses from being imported on infected drives that people plug into the USB port of their desktop machines.

They Have Got To Be Kidding Department

Thursday, November 13th, 2008 by Harry Lewis

Anyone who wants to work in the new administration has to fill out a questionnaire with 63 extremely intrusive questions. Obama is doing everything he can to avoid surprises, like the Clinton nominees with their under-the-counter nanny payments. But many of the questions are questions only being asked because of the digital explosion and the resulting permanence of detailed information. Here are a couple of my favorite queries (emphasis mine):

Writings: Please list and, if readily available, provide a copy of each book, article, column or publication (including but not limited to any posts or comments on blogs or other websites) you have authored, individually or with others. Please list all aliases or “handles” you have used to communicate on the Internet.

Electronic communications: If you have ever sent an electronic communication, including but not limited to an email, text message or instant message, that could suggest a conflict of interest or be a possible source of embarrassment to you, your family, or the President-Elect if it were made public, please describe.

That is, “Of course, your potentially embarrassing private emails may not disqualify you, not at all. But please tell us about them. And thank you for these details! We always wondered who ‘hilarysux2008’ was, glad to know.”

NYT story here.

Seems to me there are three possibilities here. Either people are not going to work in the administration because of these disclosure requirements. Or the ones who do will be adventureless people who have never taken a risk or had much fun.

Or they will be liars.

Whatever it is, in 10 years, I’m betting, the balance will be struck in a different place.

“Mistakes Happen”

Monday, November 3rd, 2008 by Harry Lewis

So reassures the mother of Daniel Harrington, who apparently lost a memory stick in the parking lot of a pub in England. Harrington works for an IT firm that supplies services to the British government. The flash drive evidently contained not personal records, but source code and passwords that might enable someone to access those personal records. As a result, the “Government Gateway” system has been shut down.

The device was found a couple of weeks ago, and yesterday was turned over to the Daily Mail, which is having a lot of fun with the story. A sample of the reactions:

Shami Chakrabarti, director of Liberty, said the civil rights group had conducted an audit which showed that the Government had lost 30million pieces of data in the past year.

‘That’s one data bungle for every two people in the country,’ she said. ‘Still they plough on with their Big Brother ambitions; ID cards and the scary central communications database: disasters waiting to happen at our expense.’

Lib Dem MP Norman Baker said the Government were asking for data from taxpayers that they could not protect.

‘The Government cannot be trusted with all this information but they collect more and more,’ he said.

I’ll bet these data breaches are no more common in the UK than in the US, but they certainly have had a bad run of them lately, and you can see why the MP is worried about the government’s plans.

More on Voting

Monday, October 27th, 2008 by Harry Lewis

As we discussed recently, electronic voting is an extremely tough problem, because it requires voters to have confidence that their votes are being recorded correctly, and to be unable to prove to anyone else how they voted. The two conditions can be achieved with the aid of cryptography — in theory. But it’s also essential that the system be simple to use and works in such a way that the general public will have confidence that there are no scams embedded in the software somehow.

There is a nice article in Salon on a couple of fairly realistic voter-verifiable election systems, including one by Ben Adida, who worked with Hal at MIT and is associated with Harvard’s Center for Research on Computation and Society. There’s progress and reason for hope, but it’s also possible that a bad experience in the upcoming election with some completely unrelated kind of electronic voting machines could increase resistance for any kind of continued deployment of better-designed systems.

Internet Voting

Thursday, October 23rd, 2008 by Harry Lewis

The US Armed Forces are using the Internet for voting this year. I’m quite skeptical about machine voting in general. But by comparison with vote-at-home, both electronic voting and Internet voting are far superior ideas. The country seems to have forgotten that votes can be bought, if you can demonstrate to someone that you actually voted a particular way, by having them watch you or by walking away with a receipt showing how your vote was registered. You can also be pressured (OK, kids, let’s all sit down at the kitchen table and fill out our ballots family-style).

The obvious problems seem to have been covered here (for example, the vote travels from the foreign location to the US via a VPN connection, which should be secure). It’s not comforting that the system has had so little scrutiny (see Kerckhoffs’s principle in Blown to Bits — we’d feel much better if a bunch of our best hackers had been let loose on the system and it couldn’t be cracked). But given that soldiers are so disenfranchised generally, I regard this as a positive invention. Of course, I hope they’re not voting in the configuration shown in the picture, where they can easily look at their buddies’ screens!

The Palin Email Indictment

Thursday, October 9th, 2008 by Harry Lewis

An interesting discussion is happening on the Volokh Conspiracy blog. The indictment against the college student who broke into Sarah Palin’s email charges him with a felony. The prosecutor, in order to get the charges up to the felony level, must claim that the break-in occurred in furtherance of some other tortuous or criminal act. Perhaps they mean that he posted the new password so others could also view Palin’s emails — that he was enabling other violations of the same statute. It isn’t at all clear, and some of the lawyers who are commenting wonder if the argument isn’t circular and the indictment flawed. That would go with the view I mentioned earlier that the crime was a misdemeanor at worst.

You can download the indictment here. It is easy to read, if not to interpret.

Serious Charges For Breaking Into Palin’s Email Account

Wednesday, October 8th, 2008 by Harry Lewis

David C. Kernell, the college student who allegedly broke into Sarah Palin’s email account, has been indicted by a federal grand jury for intentionally accessing her account without authorization. You will recall (previous blog post here) that someone boasted of doing this by getting her password reset through knowledge of the answers to three security questions — birthdate, ZIP code, and where she met her husband.

It appears that the young man is being charged under the Computer Fraud and Abuse Act. The press release goes on to state,

If convicted of the charge, the defendant faces a maximum of five years in prison, a $250,000 fine and a three year term of supervised release.

A few days ago, experts were speculating that he would probably be up on a misdemeanor, and unlikely to do any significant jail time.

“It would be a stretch to charge a felony [in the Palin case], but if they want to be hard on [the hacker], they could do that,” [former DOJ computer crime prosecutor Mark] Rasch said. “I wouldn’t have predicted that they would use that argument in the MySpace case, but they did. So they could certainly do that to [Palin’s hacker].”

The MySpace case is the case of Lori Drew, discussed in Blown to Bits. It looks as though the prosecutors have decided to throw the book at Mr. Kernell, as they did at Ms. Drew.

In the article on email privacy I published yesterday, I mention the Palin incident, not venturing to speculate on its criminality, given Mark Rasch’s doubt about what prosecutors might do. The case will be interesting to watch.

More on Internet Safety

Wednesday, September 24th, 2008 by Harry Lewis

I was pretty shaken by the end of the first day of the Internet Safety Technical Task Force yesterday. I had a meeting right afterwards, which I entered by yelping a primal scream.

All day yesterday, company after company gave presentations on how their products would help keep little Johnnie safe from predators and away from pornography. (You can check the conference program for the names of these businesses and hot links to their products. I should hasten to add that while I didn’t like much of what I was hearing, the meeting was run flawlessly — civil and lively and punctual too. Congratulations for a superb job by John Palfrey and the Berkman Center staff.) Some of the businesses offering solutions then answered the question of what we should do when Johnnie, frustrated with his overbearing parents, goes down the street to Libertarian Libby’s home, where the computer has no spyware: If we didn’t either keep Johnnie out of Libby’s house, or walk down the street ourselves and sell the same product to Libby’s parents, well, we were bad parents.

I tried to make the point that it is developmentally unhealthy to surveil your kids constantly, and safety was not the only value at stake. Growing up and learning trust and self-reliance are important too. Absolutely, was the answer. When your cell phone rings half a continent away because our product just caught Johnnie typing “boobs” into his Web browser, that creates a great opportunity for parent and child to sit down for a heart-to-heart.

I rather think that kids growing up in a 1984 childhood will expect to live in a 1984 adult world, with Big Brother watching over them constantly.

In any case, I am given to understand that there actually isn’t any evidence that predation on children is on the increase, in spite of the Internet horror stories, some of which we repeat in Blown to Bits. (One company actually reported that after monitoring tens of thousands of children, they had reported exactly 3 potential predators to the police.) Moreover, children who are victims are statistically likely to have other issues, and to come from families whose parents (if they have any) wouldn’t spend their nights worrying about their children’s safety. Child predation is a problem, but there are worse problems at which societal resources should be directed (for example, brutal child pornography is on the rise, I understand). Where we seem headed with Internet safety seems mad.

Several of the companies reported that the would retain the information they collected “forever.”

The fundamental problem with the agenda the states’ Attorneys General laid out is that it is premised on a moral and perhaps legal presumption that parents have an absolute right to know everything that their minor (under 18) children are saying and hearing. If society worked that way, it would never make any progress, as the prejudices and taboos of the parents would be handed on perfectly from one generation to the next. That isn’t social conservatism; that’s the preservation of human ignorance.