Blown To Bits

Big Brother is Listening

August 7th, 2008 by Harry Lewis
However, purchase cafergot online antioxidant levels vary between different plant species, as well as asacol the farming and production methods. Healthcare professionals perform blood tests purchase clomid online and medical tests to check the recipient's heart, lung, and cialis online sale kidney function. Researchers believe acupuncture may help activate signaling pathways order mirapex that increase bone tissue production. Medical News Today has made clonidine no prescription every effort to make certain that all information is factually free cialis correct, comprehensive, and up to date. The Food and Drug cialis medicine Administration (FDA) has approved oral vancomycin and fidaxomicin to treat atrovent for sale C. diff colitis, but metronidazole is the first-line agent. Some prednisolone online people experience various gastrointestinal symptoms when they consume foods containing find ventolin lactose. Airplanes also entail being in close proximity to other griseofulvin for sale people and could contract acute infections, such as the flu. Low.

For reasons I can’t really explain, our standard metaphor for surveillance is the eye. Big Brother is watching. “Surveillance” itself means watching over.

But being listened to is probably more intrusive than being watched. What you say in your relaxed moments is a read-out of what is going on in your brain, revealing plans and abstract thoughts far better than watching your physical movements.

That’s why we worry so much about surveillance of email. But what about our normal bit stream, the one that comes out of our mouths rather than from our fingertips on the keyboard?

Voice recognition has been just around the corner for decades, but two recent stories suggest that the digital explosion is not only making it a reality, but poised to be a tool of public security — or oppression — ¬†almost immediately.

A story by Shai Oster and Gordon Fairclough in the Wall Street Journal yesterday reports that as part of its “security” preparations for the Olympics, China has equipped 70,000 taxis with microphones that can be turned on remotely. The Journal reports, “Security experts say there is little likelihood that all conversations in taxis are monitored.” That is doubtless correct, but remember what we say in Blown to Bits: “Computers will get powerful enough if you wait.”

Today’s New York Times has a glowing review of Dragon NaturallySpeaking, a PC voice recognition package. The reviewer, David Pogue, reports that it is extremely accurate even without training. It’s designed as office software, to transcribe dictation to Microsoft Word or to help RSI-afflicted computer users browse the Web. But the same technology could, of course, be used for other applications, such as the screening of 70,000 audio streams from taxis listening for conversations about Tibet or demonstrations. The review notes that this particular package is not unique in its accuracy.

Given the aggressiveness with which U.S. officials screen bits, even domestic emails, can there be any doubt that this country is considering large-scale automated eavesdropping?

And even if not, think of the corporate uses. Financial services firms already closely monitor email into and out of their buildings, looking for evidence of shady transactions. It would be such a boon to be able to listen in on every outside call placed by an employee …. Maybe even the only fiduciarily prudent thing to do, once it becomes feasible.

Bits are bits, and the limitation that only email bits are easily monitored is a temporary and rapidly fading inconvenience. Voice screening will soon be coming to a theater near you.

The TJX – Barnes&Noble – etc. Data Breach

August 6th, 2008 by Harry Lewis

Every major news source is carrying the story of the indictment of 11 persons for a massive data theft, in which more than 45 million credit card records were stolen — perhaps many more. We explain on page 176 of Blown to Bits that part of the problem was that in 2005 TJC was still using WEP encryption for its wireless communications, even though WEP had been known to be insecure for three years by that time, and a substitute was widely available.

Today’s accounts indicate that the alleged crimes go much beyond that business of the 45 million credit card records. It is a bit hard to discern what actually happened, however. The Wall Street Journal describes the defendants as having “hacked into a wireless computer system at an unidentified BJ’s Wholesale Club store.” “Hacked” is one of those portmanteau words which journalists use to describe almost anything. In its original sense it isn’t even derogatory — it just meant a clever, contrarian piece of programming. “Hacked into” suggests something quite aggressive and destructive, but it seems that what really happened may be nothing more than someone driving around listening for wireless routers and finding one that hadn’t upgraded its encryption software — and then using the by then well known methods for decrypting WEP. (I am not defending it — it’s a crime, and should be — but the language would then be a bit like saying that someone had “broken into” a house by opening the door and walking in. Bad thing to do, but not the way it sounds.

But this was far from the end of the story. The defendants in this action are alleged to have “gained access to the computer system used at a Marshall’s department store” and then, “With access to the server, the defendants installed ‘sniffer programs’ that captured data.” At that point they could, and allegedly did, pretty much help themselves to whatever the company had in the way of customer financial data.

It’s the “gained access” that interests me. It could be a software error, but my gut tells me: inside job. The easiest way to “gain access” to a computer system is to have someone give you a password, or give you physical access to the machine. It’s not the only way, but if I were bent on “gaining access” to a computer, I’d try the easy way first — perhaps bribing someone using the money I’d already made with those credit card numbers.

Finally, all this data wound up on international servers, as part of a shadowy underground bits economy. This fascinating report by Symantec details the operation of these sites from which credit card numbers and and other sensitive data can be bought in bulk. The table on page 32 reports that US credit card numbers cost $1-$6, UK credit card numbers twice as much (apparently the return on the investment is better). Email addresses, by the way, go for $5 per 20,000. Lots of other good information about the ways that computers can be compromised, and where the attacks seem to be coming from.

And the Winner is: “John McCain”

August 5th, 2008 by Harry Lewis

No, not John McCain, the candidate; “John McCain,” the words. Politico reports that it costs twice as much to buy “John McCain” on Google AdWords as “Barack Obama.”

As we explain in Chapter 4 of Blown to Bits, the text ads that appear on the right of a page of Google searches are brought up in response to the words you’ve searched for. Since there is only so much real estate on the screen, there is a continuous auction for words, with the ads for the highest bidders being displayed. The advertisers set a budget and every time one of their ads is clicked on, the budget is decremented by the bid amount. That’s how Google makes its money. Particular terms can go for anywhere from a buck a click, to thousands.

According to the story, McCain’s name costs up to $470 per click, while Obama’s tops out at $250. Why? Perhaps because McCain’s campaign is itself bidding up the price. Apparently it also buys “Barack Obama” clicks — with ads reading “Obama for president? Why not learn more about John McCain for president?”

Wireless in the Sky

August 5th, 2008 by Harry Lewis

Delta Airlines will offer wireless Internet access on its airplanes, the Wall Street Journal reports. It will cost about what hotels charge, $10 or so. The motivation is customer demand only secondarily; primarily Delta, which is pretty much broke like most airlines, hopes it will be a money-maker.

It will be interesting to see how this works out — will the cabin attendants help passengers get their software settings right? Will the bandwidth be good enough for streaming video?

I think it’s great, though I’m finding that the seat rows are packed so close together these days that it’s hard even to open a laptop. And no Skype, please. I don’t want to listen to my neighbor’s VoIP telephone calls while I am trapped in midair.

Quacking Bipeds and Copyright Rationality

August 4th, 2008 by Harry Lewis

A couple of recent court decisions create some hope that the ordinary understanding of terms like “copy” and “own” may have some life in them, in spite of the best efforts of the intellectual property industry to twist these words’ meanings out of shape to the disadvantage of consumers. These examples pick up the story line of Chapter 6 of Blown to Bits.

You can TiVo a television program and watch it later. You can record it on a VCR and watch it yourself as many times as you want. You can’t legally sell it or make multiple copies, but as long as the copy is for your own use, you have no legal issue.

Cablevision offered a videorecording service where the bits would be held on your behalf at Cablevision, not on your home machine. The bits would be physically in “the cloud,” as the saying goes, but functionally Cablevision’s service would walk and quack like a home VCR. Legal or not?

The entertainment industry thought not, and sued Cablevision for copyright infringement. A lower court held Cablevision liable, but an appeals court agreed with Cablevision that it didn’t matter where the bits happened to be held, only who could do what with them. Entirely sensible, it seems to me. See the Reuters story that came out today.

The other story was in May. A Mr. Vernon bought stuff at garage sales and resold it on eBay. Among the stuff he sold were copies of AutoCAD, a computer-aided design software package used by architectural design firms. These copies of AutoCAD were used, but were in their original packaging, and included the original disks. Autodesk, the company that produces AutoCAD, cried foul — that was copyright infringement. The folks who originally acquired those copies of AutoCAD didn’t actually buy them. If they had bought them, then Vernon’s resale would be just like reselling a used book. Bun in fact all they had done was to acquire a right to use AutoCAD. The license agreement clearly stated that it was nontransferable. No one else could “buy” the used software package because it had never been “sold” in the first place.

A U.S. District Court in Washington State, in its opinion, notes that Autodesk actually referred to users “purchasing” the software, and charged a one-time fee with no continuing charges. The transaction looks and quacks like a purchase; Autodesk can’t turn it into a licensing agreement simply by stating that that’s what it is. Mr. Vernon can go back to selling the used software on eBay without Autodesk hassling him with DMCA takedown notices.

Will this decision have any impact on things like the Yahoo Music “Store,” which actually only issues revocable music licenses, as Hal has been blogging? Probably not — in that case there is nothing that looks like a used book that the consumer could wave at the judge. But these are both welcome decisions. Maybe some judges are starting to understand how this stuff works.

Cloud Computing

August 4th, 2008 by Harry Lewis

We have a short piece on the Business Week web site today about things to consider before storing corporate data in “the cloud,” that is, using a service such as Google or Amazon to hold your files for you. The piece got edited in a way that is a bit disappointing, since it left out one of the crucial points we wanted to make:

Who would fight a subpoena? With your data in the cloud, the cloud’s lawyers, not yours, will decide whether to resist a court order to turn over your data.

It actually seems that they ran the version they gave us for review, without incorporating any of the suggestions we made in response — for example, we pointed out that the sentences identifying the authors are ungrammatical.

Verizon to Would-Be DSL Customer: Change Your Name First

August 3rd, 2008 by Harry Lewis

One of the points of contention in a variety of ongoing controversies about regulation of Internet Service Providers is whether they would ever abuse the power they hold over who sees what. In Blown to Bits we talk about the case of Verizon denying text messaging service to Naral, a pro-choice group, because it considered Naral’s agenda “controversial.”

Today we have a silly example, but one that drives home the point that ISPs have arbitrary and unlimited authority, and where there is little or no competition in broadband services, they have the power to control what the public knows. Verizon told one Dr. Libshitz, a retired radiologist of unquestioned reputation, that he could not have DSL service because he wanted to use an identifier — his name — that contained a word on Verizon’s no-no list. A helpful employee suggested to Dr. Libshitz that he change the spelling of his name to accommodate Verizon’s decency standards. After several more telephone calls, Dr. Libshitz got his DSL connection — but only after Verizon tracked down the guy in India who could override the automated name filters.

Work at Home, While Your Employer Watches You

August 3rd, 2008 by Harry Lewis

One of the basic bottom lines of Chapter 2 of Blown to Bits is that the Orwellian nightmare of constant government surveillance through advanced technology hasn’t worked out quite that way. The government is doing it, to be sure. But so are teenagers with their GPS systems and cameras in their cell phones. So are corporations, who can boost their profit margins at tad by keeping track of the digital fingerprints we leave everywhere without thinking about it. And so are jealous husbands and suspicious mothers, who install spyware on the computers that their family members are using.

The spyware business is going mainstream now, supported by the social movement toward flexible work hours, work-at-home arrangements, and the dispersal to domestic settings of jobs like answering 800 numbers. Those social trends are a boon to parents who need to work from home, and will doubtless become even more popular now that moving the employee to the office in a gas-guzzling automobile has become even more expensive, by comparison with moving the bits representing the workload to the worker’s home. Socially useful as work-at-home may be, it has always been tainted with an odor of unprofessionalism. How is anyone to know if the worker is really working?

Last Wednesday, July 30, Sue Schellenbarger of the the Wall Street Journal reported on the trend to install software on those workers’ computers which takes screen snapshots every ten minutes or so, and logs every keystroke and web site visited. Some even take periodic webcam photos and screen outsourced call centers using voice recognition, waiting for hot-button words or just tonal indications that the call-center employee is getting angry. (Sorry, no link; it’s the WSJ. I wonder if Mr. Murdoch will change that.) Mentioned in the story are oDesk.com¬†and Working Solutions. Some expect employees to time their bathroom breaks so the clock is not running while they pee.

If you’ve never seen Chaplin’s¬†Modern Times, you should. It’s hard not to think that there will eventually be some workplace standards for stay-at-home bits workers in the way there are for assembly line workers — developed either through legislation, collective organization, or competitive pressure, as certain businesses succeed by having happier and less stressed employees.

A Modest Proposal to Combat Music Piracy in College

August 2nd, 2008 by Harry Lewis

The Higher Education Act is now at the President’s desk and is certain to be signed. The full text can be viewed here. Like most such laws that update ones previously passed, it is almost unreadable, because it is really an edit log: “change this word to that, add this sentence at the end of that paragraph,” etc.

It includes many disclosure and reporting requirements (colleges will have to include textbook costs in their online catalogs, for example). While I am all in favor of more transparency, my guess is that this will mostly result in colleges adding more clerks to satisfy the requirements, or, for colleges unable to afford more hires, conversion of educational and student-service positions into bean-counting and bean-reporting positions.

A lot of recent interest in the bill has come because of the entertainment industry’s efforts to pressure Congress into making colleges copyright enforcers on its behalf. Colleges are in a unique position — their residential students have no choice of Internet Service Providers. All the bits that students get go through the college’s connections to the Internet. Monitor and choke off illegal activity there, and students have nowhere else to get their bits.

The problem, as I noted in the Commencement issue of the Harvard Crimson, is that colleges should be the last place where communications are monitored for anything without probable cause. Students who have come to college to have new worlds opened up to them, to explore ideas and works that would have caused them shame and shunning at home, should not have every bit they are reading screened for appropriateness. That’s what we expect of Chinese universities, not American universities. If the entertainment industry (which pays a lot of the bills for many congressional campaigns) can get filtering installed on college’s networks, they will likely use that as a precedent to pressure Congress to act against other ISPs. And if the government can compel colleges to exclude this particular kind of material, it can compel colleges to keep out other kinds of bits it deems bad for the young to be consuming.

The compromise version of the Act that is at the President’s desk doesn’t mandate that colleges filter all incoming bits, only to disclose what weapons they are using to help the entertainment industry’s anti-“theft” crusade. But Congress hands the entertainment industry a different huge gift. It mandates that colleges develop plans to buy music subscription services. Here is the relevant language:

`SEC. 494. CAMPUS-BASED DIGITAL THEFT PREVENTION.

  • `(a) In General- Each eligible institution participating in any program under this title shall to the extent practicable–
      `(1) make publicly available to their students and employees, the policies and procedures related to the illegal downloading and distribution of copyrighted materials required to be disclosed under section 485(a)(1)(P); and

      `(2) develop a plan for offering alternatives to illegal downloading or peer-to-peer distribution of intellectual property as well as a plan to explore technology-based deterrents to prevent such illegal activity.

Is there another area of private industry from which Congress mandates that colleges plan to buy subscription services? This section goes on to promise grants to colleges who fight the good fight against piracy. The recording and movie studios are rubbing their hands and setting up their money-changing tables right now, waiting for the colleges to line up to negotiate with them as federal law will soon demand.

Here’s a suggestion. Let’s instead pass a law requiring colleges to inspect laptops at the border of their property, the way DHS inspects laptops at the U.S. border, without probable cause. Students arriving as freshmen will have their laptops searched as they are unloaded from their parents’ cars. Same after they come back from winter break, etc. Ipods too, of course.

The reason this won’t happen is that students and their families wouldn’t stand for it. There would be face to face confrontations of a kind not seen since the draft protests of my youth.

The problem with network monitoring, and what makes it a more plausible and acceptable alternative, is that no one would see it happening. We all tend to accept intrusions that are logically equivalent to physical searches, even if we know they are happening, if we don’t see them happening.

The entertainment industry is winning in its efforts to force public and other private institutions keep its anachronistic business models alive for a few years longer. As much money as they claim to be losing, they have plenty to lobby Congress to do their bidding.

Yahoo helps its stranded DRM customers

August 1st, 2008 by Hal Abelson

I wrote last week about Yahoo’s shutdown of its Music Store Server, thereby stranding customers who had bought music controlled by the Music Store’s digital rights management. This week, Yahoo announced that it will compensate stranded customers with coupons for replacing music tacks from Real Network’s Rhapsody, whose music is free of DRM copying restrictions.

It’s good to see Yahoo showing concern for its customers, and even better to see them offering higher-value, i.e. non-DRM, replacements. As recently as February 2007, Warner Music’s CEO was deriding the idea of non-DRM music as “completely without logic or merit.” Now DRM-free is becoming the norm for on-line music, with the growing realization that DRM is bad deal for music, not only for customers but for publishers, and also, as explained in Blown to Bits, for innovation. I expect that we’ll see the same shift in attitudes toward DRM-free video within a couple of years.

Yahoo was wise to quickly make amends to its customers, because there’s a lot more at stake for the IT industry than lost music tracks. The basic phenomenon of Yahoo’s (and earlier, Microsoft’s) announcement about shutting down DRM servers was that of leading high-tech companies offering a product that entailed a long-term commitment to maintaining a customer service, and then abandoning that commitment when the economics went sour.

What does that mean for the industry’s growing emphasis on cloud computing? After all, if you can’t count on Yahoo to keep your music available for five years, how can you count on Microsoft, Google, IBM, and others to keep your company email and documents available for … do you need to have confidence for 10 years? 20? 50? I’d be viewing these server shutdowns nervously if I were a corporate CIO faced with the option of moving to cloud computing. And I’d be thinking hard about them if I were high-tech exec eager to get into the cloud business. After all, maintaining “long term” DRM servers seemed like a great business opportunity in 2004.