Blown To Bits

China and the U.N. Propose to End Internet Anonymity

September 15th, 2008 by Harry Lewis
How buy generic zoloft we vet brands and productsMedical News Today only shows you clozapine buy online brands and products that we stand behind. Some people use purchase quinine online essential oils, such as ginger, eucalyptus, or lavender, as complementary cheapest flovent treatments to alleviate symptoms of PsA and other types of buy allopurinol arthritis. These behaviors can develop as a way to deal order zoloft with or try to forget about the original trauma and side effects purchase zyprexa cheap the resulting symptoms in the present. Healthcare professionals treat advanced cost of cipro stages with a more intensive chemotherapy treatment that combines three buy no rx viagra or four drugs. Significantly high levels of caffeine intake may discount levitra contribute to dehydration by stimulating the body to release more discount cafergot liquid than usual. Medical News Today has made every effort buy cheap azor to make certain that all information is factually correct, comprehensive, and.

CNet’s Declan McCullagh reports a very important story:

A United Nations agency is quietly drafting technical standards, proposed by the Chinese government, to define methods of tracing the original source of Internet communications and potentially curbing the ability of users to remain anonymous.

The “IP Traceback” drafting group would alter the underlying Internet protocols so that the origin of communications could be identified. Leaked documents from the group cite suppression of political opposition as one of the uses of the technological innovation.

Formal requirement of such technologies in the U.S. would presumably be illegal under the Constitution, but the U.S. National Security Agency is participating in the talks. There are ways other than blanket legal requirements to make such surveillance technologies the accepted norm in practice.

The economic power of China gives it new power. This could be a critical first case in which the world shifts its practices away from openness and toward government control in deference to the economic power of China.

Bits and the Presidential Campaign

September 15th, 2008 by Harry Lewis

Hal, Ken, and I wrote an opinion piece called Campaigning for Our Digital Future, raising some “bits” issues that the next president should think about. It was published recently in the Providence Journal.

Was the LA Metrolink Engineer Text-Messaging?

September 14th, 2008 by Harry Lewis

A teenage train enthusiast reports that he was exchanging text messages with the engineer of the train that crashed Friday, killing 25 people. The teenager, Nick Williams, responded to the engineer, Robert Sanchez, at 4:22 PM and received no response, about a minute before the train drove through a red light and crashed into a freight train.

A similar speculation, about cell phone use while driving, arose about the driver of a Boston MBTA train that crashed last summer, killing the conductor. But that theory was laid to rest by the evidence.

Evidence there will be in this case as well. A timestamped record of the engineer’s texting exists and has doubtless already been acquired by forensic investigators.

Everything Is Bits Today

September 13th, 2008 by Harry Lewis

Saturday is usually the weak newspaper day. Embarrassing news that must be revealed some time generally gets announced on Friday afternoon. Large parts of the newspaper staff are sidetracked to getting the Sunday paper ready.

But for some reason, to bits-oriented readers today’s New York Times is full of interesting stuff:

In Digital Age, Federal Files Blip Into Oblivion. A good report on the entirely unsurprising fact that digital files tend to get purged, either because people don’t realize they are important to preserve, or because new administrations tend to want to make a clean sweep and start afresh. It’s hard to put a high priority on archiving when the money could be used in some politically more expedient way. This all relates to our observations at the end of Chapter 2 about how digital information can last forever, but that’s no guarantee that it will even when you want it to.

Stuck in Google’s Doghouse. A great Joe Nocera piece on the mysteries of Google’s quality metrics and the plight of those trying to make a living through Google ads. Lots here that will make sense to readers of our Chapter 4.

Virginia: Spam Law Struck Down on Grounds of Free Speech. A great example of how hard it is to get Internet law right, as we discuss in Chapter 7. Virginia tried to control spam. A fine idea; spam is not only full of swindles, it uses enormous amounts of network bandwidth and processing locally at the machines receiving it. Unfortunately, according to the Virginia Supreme Court, the law is

unconstitutionally overbroad on its face because it prohibits the anonymous transmission of all unsolicited bulk e-mails, including those containing political, religious or other speech protected by the First Amendment to the U.S. Constitution.

The conviction of a big-time spammer was overturned and he is free to prey on us all — in Virginia at least. I am sure that anti-spam laws in other states, and the federal statute, are being examined today in light of this decision.

Three big-time bits stories in one Saturday. And that’s not even counting the claim in the sexy front-page story that the Internet is contributing to the total collapse of the morality of Chilean 14-year-olds.

United Airlines and the Communications Decency Act

September 12th, 2008 by Harry Lewis

United Airlines is the company whose stock lost most of its value — a billion dollars, give or take a few — when Bloomberg News posted a headline of an old article stating that UAL had declared bankruptcy. UAL had indeed declared bankruptcy, but that was six years ago. The misleading headline triggered a sell-off that nearly wiped out the entire value of the company’s stock in a few minutes. Hal blogged this a few days ago.

People lost a lot of money because of this mistake. Who’s responsible, and is anyone liable?

Google returned the old article in response to a query for “bankruptcy 2008.” Not clear why that happened, but I’ve been noticing some old articles turning up in response to Google Alerts the past few days. Maybe they are doing some re-indexing. Whatever — it’s hard to hold Google responsible for what happened later, and you certainly couldn’t consider them liable. They make no promises about their search results. Bloomberg and the service that fed the article to Bloomberg misused the information that came back from Google.

It feels like Bloomberg should be on the hook. They posted the headline without checking its accuracy, as would have been trivially easy to do. But they aren’t liable, because of the provisions of Section 230 of the Communications Decency Act, the Good Samaritan Clause. As we explain in detail in Chapter 7, this clause says:

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

This law was meant to encourage Web site operators to make their sites child-friendly without running the risks a print publisher would incur if they missed something obscene or slanderous. But it’s a blanket get-out-of-jail-free card for businesses like Bloomberg, which post things others have reported.

So the folks who lost that billion dollars can’t collect from Bloomberg. Ironically, Hal described what happened in slightly incorrect language, saying that the selloff happened because of “Bloomberg News Wire printing a one-line note.” Not printing actually, but posting online. If Bloomberg had actually printed it on paper, CDA Section 230 would not apply, and Bloomberg might be in big, big trouble!

Thanks to a poster from the Volokh Conspiracy for pointing this out.

Passwords

September 11th, 2008 by Harry Lewis

Passwords are a nuisance. As a security technology, they have many problems.

  1. If they are complicated, or consist of meaningless strings of symbols, we forget them.
  2. So we pick strings that are easy to remember, our children’s names or our birthdates. Then either
    1. They are easy for attackers to guess, and aren’t secure at all, or
    2. (As now commonly happens) the site won’t let us use such a simple password, and we have to come up with something stronger.
  3. If we try to make passwords easier to remember by using the same password for multiple sites, then the security of the password is only as strong as the security with which the most amateur of those sites protects the password data. So if you are asked to create a password for access to a web site that seems sketchy, don’t use the same password as you use for your financial data, because it could be a scam; the scam artist may be able to figure out your bank or credit card number from a statement you threw out in the trash and may try the password with that account.
  4. Because passwords are a nuisance to keep re-entering, single passwords sometimes give access to lots of information that could be split up to increase security.
  5. For the same reason, some services don’t log you out after a period of inactivity. This is one of the worst security problems with Facebook. If you forget that you have left yourself logged in and allow someone else to use your computer, even days later, they have access to your profile — and also to all the information that your login enables you to see about your “friends.”
  6. Systems with default passwords, so that they work “right out of the box” but advise you to change the password for security reasons, are extremely vulnerable. Anyone who knows the default password, perhaps because they used to work with the supplier or have used the device or system themselves, or can guess it ¬†(“admin” and “0000” are good to try),¬†can break into yours if you take the easy way. Here is a nice story about someone stealing gasoline from a pump that had not had its security code reset by the gas station proprietor.

Personally, I have several passwords, and I try a pyramid approach: A low-security password for a large number of sites that have no information on me worth protecting; a high-security password for a very small number of sites with very valuable information, such as credit card companies and banks; and a couple of layers in between. A lot of people I know seem to use a scheme like this.

But here’s a nice idea used by one fellow I know. He uses an algorithm to combine the name or URL of the web site with some personal information to produce site passwords that are different for every site. To take an overly simple example (he didn’t tell me his exact method), if this site (bitsbook) needed a password, I might append my first name to it, to create the password “bitbookharry”. That would be too simple — you’d need to break up the words, insert some nonalphabetic and capitalized characters, etc. But the basic idea of just having to remember a single algorithm, which you can apply to the URL along with some easily remembered personal information, sounds like a good trick.

But really, we need a different security mechanism (and there are some; perhaps more on that later).

Little-Brotherism Goes Mainstream

September 10th, 2008 by Harry Lewis

The New York City police department has established a Real Time Crime Center, to which citizens are encouraged to send cell phone photos of crimes. You can also text “CRIMES” with your tips. Mayor Bloomberg spoke enthusiastically about the new unit, but urged common sense. “If some big hulking guy is coming at you with a hatchet,” he said, “I would suggest you don‚Äôt take out your camera and try to take a picture.”

Doubtless this will help solve some crimes, as it perhaps did in the case of Jeffrey Berman reported in Blown to Bits. Will it have any unforeseen consequences? How will we feel about vigilante citizen jaywalking enforcers who snap pictures of us crossing the street at the wrong place and build up digital police files of our persistent lawlessness?

Too Much Information?

September 10th, 2008 by Harry Lewis

The Washington Post reports that there are competing web sites for women who want to track their menstrual cycles online: mymonthlycycles.com and mon.thly.info. Also Bedpost for tracking your sex life, and many other tools for recording and analyzing the ordinary moments and extraordinary moments of your daily life.

Personally, no matter what the sites’ privacy policies say, there are some data I wouldn’t put in “the cloud”!

Blown to Bits in Hong Kong

September 10th, 2008 by Harry Lewis

There is a nice review of Blown to Bits in the Asian Review of Books this morning.

A Surprising Technique for Mobile Phone Surveillance

September 9th, 2008 by Harry Lewis

Chris Soghioian reports on a little-known industry that does something you might have thought illegal: provide to governments detailed data, including graphical presentations, of who is calling whom. The companies data-mine phone records to infer clusters. The story shows an example, taken from a corporate presentation, of a Google Earth map of Indonesia mashed up with phone data on 50 million people, crunched to reveal small groups of dissidents with a habit of calling each other.

But it couldn’t happen here, I hear you cry. If the government wanted this work done for them, where would they get the data? The cell phone companies, such as Verizon and Sprint, can’t legally turn it over without a court order, right?

Well, sort of right. But it turns out that wiretap laws don’t protect the data when it’s in the hands of other companies that the cell phone companies use for services related to your phone calls. For example, the cellular carrier doesn’t actually own any cell phone towers; it relies on companies such as Tower, Inc. for those. Tower, Inc. passes the phone calls on to the cellular carrier for processing, but isn’t covered by the same restrictive laws about use of that data. According to the article, suppose the National Security Agency wanted to conduct surveillance of the phone habits of U.S. citizens within the U.S.

Thus, while it may be impossible for the NSA to legally obtain large-scale, real-time customer location information from Verizon, the spooks at¬†Fort Meade¬†can simply go to the company that owns and operates the wireless towers that Verizon uses for its network and get accurate information on anyone using those towers–or go to other entities connecting the wireless network to the landline network. The wiretapping laws, at least in this situation, simply don’t apply.

And with the gag orders attached to data requests in the Patriot Act era, no one would probably be the wiser if this were happening right now.