Blown To Bits

Archive for 2008

Twitter to Freedom

Friday, April 25th, 2008 by Ken Ledeen
On cheapest remeron the other hand, open wounds break the surface of the tizanidine online stores skin and may also damage underlying tissues. If a person buying cialis has mild or no symptoms, maintaining a healthy lifestyle as cheap dexamethasone pharmacy much as possible will help reduce the risk of complications. clonidine All of the content on Yoga for Beginners is free, purchase betnovate best price professional with no in-app purchases or subscriptions required. People may feel clomid prescription a slight scratch or pinprick when a healthcare professional withdraws buy cheap diclofenac blood, but it is not very painful. It is also cream professional important to follow storage and preparation instructions carefully and make ventolin prescription sure that the food is at a safe temperature when drug mirapex it arrives. The surgeon positions and secures the implant and celebrex for sale then closes the incision with stitches or staples. The dedication order atenolol of so much energy to interpreting speech and sounds means that.

Sometimes its not what you say, but to whom and how you say it. And in the post-digital-explosion world the possibilities are utterly transformed.

Consider what happened with James Karl Buck.

On April 10th he was arrested in Egypt while covering an anti-government protest.¬† As he was being led off to¬† an uncertain future he sent a single word message to the Twitter.com blogging site.¬† In case you’ve¬†never looked at it, in their own words “Twitter is a service for friends, family, and co‚Äìworkers to communicate and stay connected through the exchange of quick, frequent answers to one simple question:¬†¬† What are you doing?”
When I first encountered Twitter I had two conflicting reactions.¬† The first was “you’ve got to be kidding, will anybody actually do this?”¬† The second was “why not?”¬† After all, I had witnessed inumerable¬†cell phone conversations that had no more content than the central twitter question “what are you doing.”
  
But I digress.
  
Jim Buck sent his single word message “ARRESTED” to his friends¬†via Twitter, and it was enough to make all the¬†difference.¬†¬†You can read the whole story on the web here.
 
From the Blown To Bits perspective this is a classic example of the fundamental transformation that the digital explosion¬†has wrought.¬† Information moves everywhere.¬† The degree of connectivity, the ability to convey information¬†broadly, is staggeringly different from what was available in the pre-explosion era.¬† Twitter didn’t get Jim¬†out of jail, the collective efforts of his friends did.¬† But in the absence of the web, his fate could well have¬†been quite different.¬†
 
Had the designers of the Internet not created a system that¬†could be adapted for use in ways that were not imagined by those very creators, had they not produced, in Jonathan Zittrain’s lexicon, a “generative¬†technology” James Buck might well be in an Egpytian jail today.
       

Protest Rowling?

Thursday, April 24th, 2008 by Harry Lewis

It’s been a long time since I’ve been at a protest. I went to a few against the Vietnam War in 1969. I’ve observed some protests (hey, I was a dean). I’ve negotiated with protesters and counter-protesters (once managed to keep the pro-Israel and pro-Palestine students respectfully apart at opposite ends of Harvard Yard). I’ve even been protested against. But I’ve never suggested organizing one.

There’s always a first time.More...

J. K. Rowling will be Harvard’s Commencement speaker on June 5. She’ll get an honorary degree in the morning and be the principal speaker at the afternoon exercises.

So? Everyone loves her, don’t they?

Rowling aggressively protects the Harry Potter books, which is certainly her right. No reason why she has to put out a Creative Commons version (as we will do, once Blown to Bits has been in print for a while).

¬†But she is suing a librarian named Steven Vander Ark to prevent him from publishing a Harry Potter lexicon. Her claim that putting out the lexicon will ‚Äúopen the floodgates for anyone to lift an author’s work and present it as their own‚Äù is absurd. There are countless examples of published indexes and concordances. They do the authors no harm and probably do them good. I could not have read Joyce without my handy Skeleton Key to Finnegan‚Äôs Wake.¬†Ironically, Rowling used to think that Vander Ark‚Äôs site was swell. Probably she‚Äôs now decided to write a lexicon of her own and doesn‚Äôt want the competition.¬†Copyright law is out of balance, as we explain in Blown to Bits. The imbalance often takes the form, as it does in this case, of heavyweights using the law to sit on the little guys. But the analogies apply at all levels. Farhad Manjoo has blogged about the Harry Potter lexicon, pointing out that taking Rowling‚Äôs argument to its logical conclusion would prevent Google from indexing the Web and making advertising money from the index, unless it got explicit permission from each web site.¬†So I‚Äôm in favor of protesting Rowling‚Äôs anticompetitive abuse of copyright law. Unfortunately, your authors can‚Äôt organize the protest, since two of them will be busy in their official roles organizing Commencement itself!¬†

MSN Music RIP

Wednesday, April 23rd, 2008 by Hal Abelson

 

 

Yesterday, Microsoft delivered the coup de gr?¢ce to MSN Music DRM. May it rest in peace.

Digital Rights Management (DRM) is the practice of distributing digital content together with control programs that restrict how it can be used. For example, a publisher can distribute music that can played only a designated number of times, or only on designated computers, or that must periodically “phone home” over the Internet for reauthorization and relicensing. Content providers, notably the recording industry, embraced DRM as a way to cope with unauthorized downloading and file sharing.

Blown to Bits argues that DRM schemes are ineffective and anti-competitive and in the long run a bad deal for publishers and customers alike. If you buy music that must contact a license server before it can be played, then the music isn’t really yours ‚Äì if the license server goes away, ‚Äúyour music‚Äù becomes a useless wad of encrypted bits.More...

That drawback of DRM was driven home yesterday when Microsoft announced that it would be shutting down the license servers for MSN Music, a DRM scheme introduced in 2004 to the fanfare announcement that this would “finally bring digital music to the masses.” Music tracks purchased from the MSN Music store can be played only on computers licensed for that track. You can have at most five computers licensed for a track at once. If you get a sixth computer, you must contact the MSN server to de-authorize one of the five and license the new one. A “new computer” here means not only a new physical machine: if you upgrade your operating system, you need new licenses for all the music tracks.

Microsoft stopped selling new MSN Music in 2006, when it introduced Zune Marketplace. In an email yesterday from the General Manager of MSN Entertainment Services, purchasers of MSN Music tracks learned that the license server will be shutting down on August 31. After then they’ll be stuck: no more licensing new machines ‚Äì replace a computer, or upgrade an operating system after the summer, and their music can’t be transferred to it.

The anti-consumer nature of DRM is becoming increasingly apparent, and publishers are starting to move away from it. And yet, as described in the book, the desire to shore up DRM gave birth to the innovation-hostile anticircumvention provisions of the Digital Millennium Copyright Act, and new DRM-inspired legislative proposals are still very much alive on Capitol Hill. What can consumers do when the content they purchased phones home, but no one answers? Perhaps they should have it phone Congress.

Google is #1

Tuesday, April 22nd, 2008 by Harry Lewis

Google is the #1 brand in the world, according a Millward Brown report, Top 100 Most Powerful Brands ‘08. The ranking formula multiplies “Intangible earnings” by “Portion of intangible earnings attributable to brand” by “Brand earnings multiple.” Others will have to judge whether these three factors are the right ones, whether their values can be determined meaningfully, and whether that is the right way to combine them. I am a bit skeptical. The #2 brand? GE. #3 is Microsoft, #4 is Coca-Cola, and #5 is China Mobile.

If Google is the #1 brand—and that does feel right, whatever calculation produced the result—the implication is astonishing. The top brand in the world is one that almost no one had heard of a decade ago. The earliest reference I could find to “Google” in a search of newspaper archives was a May 31, 1998 column by Bradley Peniston in the Annapolis, MD Capital, entitled “Yahoo for new search engine.” (That’s leaving out all the articles about the Barney Google comic strip.) A week later, in his next column, Peniston had to explain where to find Google—on the Stanford web site!

Blogs Are Great, but Is Anyone Reading Them?

Sunday, April 20th, 2008 by Harry Lewis

The New York Times reports this morning that When the Ex Blogs, the Dirtiest Laundry Is Aired. Divorced people are using their personal blogs to let the world know what creeps their former spouses are.

There is nothing really surprising about this. For years people have been worried about the mean, nasty stuff young people say about each other on Facebook, in MySpace, and on blogs. Adults are just catching up to youth culture. It’s also true that teenagers were walking around with MP3 players and earbuds a few years before middle-aged men with briefcases were doing it. One of the women quoted isn’t worried about the impact on her children for exactly that reason. As the Times reports, “It is a generational issue …. We think it will be a big deal, but it won’t be to them. By the time they are old enough to read it, they will have spent their entire life online. It will be like, ‘Oh yeah, I expected that.’ ”

Yet I find the article interesting in several ways, beyond the head-shaking instinct. Why is it apparently mostly women doing this? Is it really a healthy form of catharsis, as a number of those posting comments have suggested?But perhaps most surprising is the statement that 10% of adult Internet users have created their own blogs. I tracked down that number, and it is understated: The actual percentage, from this table, is 12%. Is that level sustainable? The same report says that only 39% of adult Internet users read other people’s blogs! One imagines a strange world in which millions of people are writing blogs about intimate personal matters, and almost no one is reading most of them.

Phishing by Phone

Sunday, April 20th, 2008 by Hal Abelson

 

 

As everyone keeps telling us over and over, we should never send sensitive information to an email address, or enter it into a web page, unless we’re confident we know where it’s going. Tricking people with bogus network addresses is called phishing. It’s an online fraud that goes back to the pre-Web days of America On Line, but its prevalence has skyrocketed over past decade because it’s so easy to accomplish with today’s web browsers. A text link you see on a web page might read ‚Äúwww.bankofamerica.com,‚Äù but if you were to examine the program code, you’d see that it’s not Bank of America’s web site you visit when you click on the link, but some other site, perhaps located in Eastern Europe, which looks just like the Bank of America site. Enter your account number and password, and they are dutifully stashed away as loot for identity thieves.

It’s a well-known trick, and even people who should know better get fooled all the time. For the past several several months, a large fraction of the MIT community has been receiving email messages from ‚Äúthe MIT network administrators‚Äù telling them that their MIT email accounts are about to expire and they need to re-register by emailing their password to an address shown in the message. You’d think MIT people wouldn’t fall for this, but it happens. The real MIT network administrators watch for email outgoing to the bogus address and contact the hapless victims, a group that’s included a few faculty members in the past month.

More...

When everything is bits, frauds easily cross from one domain to another. In a variant of phishing known as vishing (‚Äúvoice phishing‚Äù) the perpetrator uses bogus caller ID information to trick victims into thinking they are being called by a bank, mimics the bank’s automated answering system, and asks for credit card information to be entered by touch tone. Spoofing the caller ID information ‚Äì making a fake phone number appear on recipient’s caller ID display ‚Äì is simple thanks to Voice over IP and the open Internet architecture that lets anyone create phone applications. There’s phone software widely available that includes spoofing as a ‚Äúfeature,‚Äù and even services like www.spoofcard.com that will sell you an account from which you can make spoofed phone calls: merely type in the called ID number you’d like your recipient to see, and call.

Just today, I encountered a variant of this trick I hadn’t seen before ‚Äì a cross-domain phishing hoax (phvishing ?) that almost fooled me. It came in the guise of an official looking email from Bank of America informing me that I needed to call them ‚Äúregarding recent activity on your account.‚Äù The email included the usual strong warnings against replying by sending account information by email. No bogus phishing links on this web page: all the links really did go to the BofA web site. But phoning the 800 number reached an official sounding automated answering system that asked me to punch in my account number, expiration date, and credit card validation code. It then told me that my card information had ‚Äúalready been registered‚Äù and everything was OK. Luckily, the email spoof was poorly done, and a close look at the return address showed that the mail was bogus, so I knew enough not to enter my real credit card data. It turns out that this hoax has been around since at least 2006; I just hadn’t encountered it before.

I doubt that I would have been fooled for an instant had this been a pure email hoax or a pure phone hoax, but the combination of the two was something I hadn’t expected. We all know to be cautious about internet messaging, but fewer of us feel are as suspicious about phone numbers, especially when we’re the ones doing the calling, as with the phony Bank of America number. The root of this difference in attitude is that the Internet (as described in Blown to Bits) has grown up as an open architecture, while the phone system has not. As the communication systems converge, they produce hybrids to which our instincts and attitudes are not attuned. Where this will end up, we don’t know. But of this we can be certain: digital convergence will continue, and so will human fraud.

 

 

Were you at the Wu-Tang concert?

Saturday, April 19th, 2008 by Ken Ledeen

I was cutting through Harvard Yard yesterday evening on my way to the

Law School to hear Jonathan Zittrain speak about his new book when I ran into some of the loudest music I had ever heard. Wu-Tang Clan was performing on the steps of Memorial Church as part of Yardfest – a free concert for undergraduates.  Since my kids are in their mid thirties, Wu-Tang was not part of my musical experience.  They did, however, draw a big crowd.

Now when I was in school, a crowd this big would almost certainly have been for one of two things: a demonstration against the war in

Vietnam, or a demonstration in support of civil rights.  It was the sixties and those were the things that dominated campus life.  Either would have drawn a crowd, and, it’s highly likely that a couple of folks from the FBI with cameras would be there as well. J. Edgar Hoover liked to know who was attending those sorts of things.

There were no FBI folks at Wu-Tang yesterday.  That wasn’t because who attends a rap concert doesn’t matter to the FBI, it’s because pretty much everyone there had a cell phone in their pocket, and that’s all it takes to place you somewhere with decent accuracy.

Did you go to the Obama rally last October?   We can always ask Verizon.

All the technology is in place to do just that.  The phone company has to know where you are to route calls to you, and bits are so cheap these days that there’s no reason to throw them away, no reason not to keep the position history around.

I’m not saying that it’s all happening now, just that it can.  There is, however, plenty of evidence.  Consider Google maps for mobile’s ability to show where you are. (http://www.google.com/mobile/gmm/mylocation/index.html).  No need even for GPS.  And if Google can get this information in real time, who else can? This is one more example of intended consequences of technologies, one more example of the good side / dark side of bits.  If you want to be able to ask your Google to find the nearest Chinese restaurant, then the capability to track your location must exist. And if it exists, we can save it. And if we can save it ….you get the picture.

Phishing for Military Secrets, and Zittrain’s Book

Wednesday, April 16th, 2008 by Harry Lewis

Business Week has a story that is scary and maybe reassuring at the same time. Perhaps it will be reassuring to people who have opened an email or clicked on an attachment against their better judgment that people who handle sensitive military secrets are tempted to do the same.

The spam and phishing attacks I receive are pretty lame, like this one I got today:

Dear HARVARD.EDU Subscriber,

To verify your HARVARD.EDU account, you must reply to this email immediately and enter your password here (*********)

Failure to do this will immediately render your email address deactivated from our database.

…

Thank you for using HARVARD.EDU !

THE HARVARD.EDU TEAM

The reply-to address is a mysterious gmail account, but if that weren’t bad enough, the thank-you from HARVARD.EDU is a dead giveaway. The ones that Booz Allen received were of much higher quality. They appeared to come from a real person in the office of the Secretary of the  Air Force, an individual with responsibility for sales of aircraft to foreign governments. And that is what the body of the email was about. But it was malware–wired to install software in the recipient’s computer that would log keystrokes and screenshots and send them to … China. We report  in Blown to Bits that after the major communications trunks to the Chinese mainland were severed by an earthquake, the volume of spam reaching the US dipped for a few days.

Costly as spam may be, the problem the Business Week article reports is potentially more serious. Effective breaches of the security of military and intelligence computer systems endanger U.S. security, and also undermine public confidence in the Internet itself.So the government is responding. According to the story, “By June all government agencies must cut the number of communication channels, or ports, through which their networks connect to the Internet from more than 4,000 to fewer than 100. On Apr. 8, Homeland Security Dept. Secretary Michael Chertoff called the President’s order a cyber security ‘Manhattan Project.’”

This is what Jonathan Zittrain is worried about, in his new book, The Future of the Internet–And How to Stop It–that the wide open Internet with which we are familiar will prove to be more trouble than it is worth, and we will, for our own good, opt for a safer network to which Chinese spies, and probably also American teenagers, cannot get connected.   The Boston area launch of Zittrain’s book will be at Langdell Hall at Harvard at 6pm this Friday, April 18. It’s a great book and should be a great event!

Freedom of Texting

Friday, April 11th, 2008 by Harry Lewis

If you use your phone to talk about how bad your phone company is, could the phone company cut off your service?

The answer, believe it or not, seems to be, “It depends.” If you are merely talking on the phone, then no, the phone company has to let you do it. But if you are texting, the answer seems to be yes, your service could legally be terminated.

The reason this gets tricky even to explain is that there really is no such thing as a phone company any more. Verizon, which absorbed my old land line company, sells video services. Comcast, which used to be my cable TV company, now provides my residential “land line” service.

“Common carrier” laws have applied in the past to railroads (they couldn’t pick and choose among passengers; anyone with the money to buy a ticket is equally entitled to a seat) and to telephones (so phone companies couldn’t pick and choose their customers on political grounds, for example). As discussed in Blown to Bits, Verizon denied Naral Pro-Choice America the opportunity to create a text messaging group on the basis that it might be used for ‘controversial’ messages. It backed down on the case but not on its legal right to discriminate as it chose.

The FCC is now accepting comments on how text messaging should be treated in the code, like telephoning, where the service provider can’t control what the customers say, or like broadcasting, where the people who own the antenna get editorial control over what gets said. If you think this is a ridiculous no-brainer, you’re mistaken. It’s a real battle and the FCC needs to hear from as many people as possible.

The easiest thing to do is to go to the webform on the Public Knowledge site and to fill it out. PK also has a great deal more information about the issue. There is only a short window of opportunity; please act!

The Underground Bits Economy

Thursday, April 10th, 2008 by Hal Abelson

One sign of a maturing industry is the development of aftermarkets. First there were cars, then there were used car dealers. And first there were bits, and then there were … used bits dealers? Some used bits transactions are legit, if possibly annoying. You give Sam’s Health Foods your email address so Sam can confirm your order for organic bean sprouts, and the next thing you know, you are receiving emails from Mary’s Gardening Tools. Sam decided to share his email address files with Mary, and Mary thinks that bean-sprout-eaters are more likely than other people to be gardeners. Of course, this is the kind of “sharing” that puts a few bucks in Sam’s pocket.

Other used bits dealers are like the people who steal catalytic converters and fancy headlamps from late-model cars and then sell them on the black market. There is a robust underground economy in bank account numbers, credit card numbers, eBay accounts, and even full identities. According to Symantec Global Internet Security Threat Report (downloadable free here), the going rate for bank account numbers is $10-$1000, while credit card numbers are $0.40-$20.00 each (but are usually sold in bulk). Bank account numbers cost more, because getting money from a bank account is quicker and, if properly done, leaves fewer fingerprints than converting a credit card number to cash. Identities go for $1-$15, but EU identities cost more than US identities, perhaps because of rising demand.

It’s a fascinating report. Symantec is in the security business, but many of the trends and recommendations are of general interest, unrelated to Symantec’s products. For example, the robust market in bank account and credit card numbers has made services like Paypal increasingly popular. Such electronic payment systems are guaranteed against misuse and they do not require revealing any financial information to the online store.