Two thumbs up...

on a post asking why does Radio Shack need my phone number to sell me batteries? Though my policy is to tell them my number is 999-123-4567 and my email is billg@microsoft.com, and dare them to prove otherwise.

Knowing without evidence

Ruth Marcus' column yesterday brings up a number of good points and for the most part, she's on the money. But there's a section that makes no sense at all:

The difficulty lies in how to deal with suspected terrorists at the outset. The Obama administration no doubt would recoil at the back-to-the-Bush-administration atmospherics of indefinitely detaining an enemy combatant on American soil. But what to do in cases like that of Padilla, where the evidence is still sketchy but the suspect too dangerous to remain loose?

Work with me here, Ruth. If the evidence is all that "sketchy," if it's just not possible to point to anything specific to determine that someone should be detained, then how do you know they're too dangerous to let loose? Or are you in favor of allowing detention on the basis of hunches? Well, dude looks like he might do something, so we're going to hold him just in case.

She goes on to discuss one option--allowing detention up to 14 days without judicial approval--but that doesn't address the problem. At the end of 14 days, you've either got evidence or it's still 'sketchy.' Would she still somehow magically just know which people were too dangerous to be let loose? How? It's not like prosecutors have a hard time finding sympathetic judges willing to authorize detention even in marginal cases on national-security issues.

Yes, there are gray areas. But the entire assumption that we should be holding people "just in case" is a threat to the rule of law, which has taken (and is still taking) a beating.

Proportionate Response, Ctd.

Michael O'Hare at RBC breaks down the numbers further.

Also [h/t Andrew Sullivan], the breathlessly-announced new profiling guidelines appear to be more security theater than security.

And in what may be a sign of the Apocalypse, Glenn Greenwald agrees with David Brooks about the futility of expecting Absolute Security from any institution.

Proportionate Response

Over at Slate, William Saletan shows once again why he's not to be taken seriously.

In his breathless, tough-guy prose, he lays out why we should all be happy to let TSA do full-body scans. Terrorists can hide bombs anywhere! We're not checking people's crotches, so that's what they'll do! Won't someone think of the children? This is keeping us safe! OK, sure, the TSA said they wouldn't use this on everyone and they've already shown that to be a lie, but hey, the TSA is keeping us safe! It's for our own good! If you're one of those mamby-pamby privacy types, then you just don't understand what a scary dangerous world it is, like tough-guy Saletan!

Okay, so I'm paraphrasing. A bit.

Do the numbers. Fly 20 times a year and your chances of being directly involved in a terrorist incident is about the same as getting hit by lightning that year. Fly daily for the rest of your life, and the risk goes up to almost a tenth of one percent. The marginal utility of forcing everyone to be scanned simply isn't worth it. (There's also the problem of false positives, which Saletan, conveniently, disregards, simply assuming 100% accuracy and 100% discrimination on the part of the technology and the operators.)

The Detroit incident doesn't show the failure of the scanners, it shows the failure of intelligence coordination. If they're already at the airport with explosives, it's already too late. This is theater, not security. But it's easier to install scanners and make it look like you're doing something than it is to actually do something. Particularly when it's something as hard to do and to get right as security. But the full-body scanners are analogous to searching for lost keys by looking under the streetlight because the light's better there.

Yes, there are bad people who want to do us harm. But Saletan has let himself be terrorized (which is, after all, the point of terrorism) into falling for the Yes, Minister fallacy: We must do something. This is something. Therefore we must do this. Instead of recognizing that there are risks, we have to bear them, such is life, he's cowering under the bed and begging TSA to make him feel secure, whether there's any basis for that feeling in reality or not.

Road accidents kill almost 40,000 people per year. That's about one 9/11 per month. But we haven't declared a "war on cars."

Quote of the Day

Nate Silver notes that from October 1999 through September 2009 there has been one terrorist incident per 16,553,385 airplane departures.

Furthermore, "the odds of being on given departure which is the subject of a terrorist incident have been 1 in 10,408,947 over the past decade. By contrast, the odds of being struck by lightning in a given year are about 1 in 500,000. This means that you could board 20 flights per year and still be less likely to be the subject of an attempted terrorist attack than to be struck by lightning."

With a large tip of the hat to Paddy at The Political Carnival.

My PGP public key

Cleaning some stuff up, realized I hadn't made this available... which rather defeats the purpose, now doesn't it?

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.12 (MingW32)

mQENBErznooBCADdHtfLKqscD9MyyVFH70owBwVedCIvk12RBQnPvom45HkKY7SV

eAViH1AzQ537qRk/DRNy/puYYgdCJHh7KeSBNqiFE1ERXlygbLobTO+EPOE0I8W7
MfCX+8R5hY4dFvqfnmp/2lBtU03DWvQnbXrmVUuR2CeFvzyuQU/UF4kgzRTut5Nb
S/t3h9mGe1IEmEAQdXtDPvcDo8LLqCaZ7KmfhdlGrb0PzcffYlgmiriDVjCp43zW
vDr1ddH+nRw3lq/RCwlIZ05AsaeVpM0jh85yv7zI5RPG2AvQ4qGgmvVNpSRuJc86
FY33bx95GMq/1ThMqxHVEfIk7EeyyzqWp03/ABEBAAG0IUJyaWFuIEhhcmUgPGJy
aWFua2hhcmVAZ21haWwuY29tPokBOAQTAQIAIgUCSvOeigIbAwYLCQgHAwIGFQgC
CQoLBBYCAwECHgECF4AACgkQ1BPDCPFp0t1zLQgAmA4SNo2bzxGuc536a6W5mPS6
e9pGoyJ0Z8/sePtmnacrpy/uwP692ESrI0ucBqzZDBlxcA0vnAkcu9ARb/9PwY6+
CQeNObq7c3WfuWwnv5NN+PL9t4bTDdFXulWueyluzDllKjOkREC35ylqDJq37cLs
FfJQwcV+ruSQ+0OI1l/CtGxZEmvv8H8Foiv5eWr1UVczYHxT2aK4gB0V7lOVxY3c
30HB1iOHfhaSvCCfjhYxBQW4tUScJVTctPo1LpKTJOqMsPzSNq/c+EW1qPVJnU5d
VhAVl1zrbG1luT57AjLkpSC85MjfjlQFf4Gh5msNIzvQRQoNe3+DRMUVJEcJuLkB
DQRK856KAQgA13YfESgnrPxcLVtP04kUejPWoJ+M1cumR6Sv66SYwS0Rbu4oKqzV
+CELSbk0sUmyPOfKm5XtSiGukJIpKvFCkMAaLoXe4XRn4oYlKPQZETeK242ytERb
JYvzp+i4Ix9Gd1HE6nL+Thqxyn50VYdUIBsdPEIryN7hc2RwAsxCcb8PxoINVTvL
lzcWnKWzY7XsGw7/57OvL/PUhUx7h8fddYVYrZ2klU+Plgr9XXPNFzXST4kcdZEL
3H0msP3ORL/Yo5qcpjTl1gBaYjY2P7169D7lrrdNFLhNsWM2Wko1tCm0x4MNIjW7
J0czPqpsODfNwr80wt7AI86xDBip0JxK+QARAQABiQEfBBgBAgAJBQJK856KAhsM
AAoJENQTwwjxadLdMXMIAIb6EyU/FMqGvpBmaCSn3p2MbTbgo2TosaLvmslr5VF0
tsV91/SJUVOYGL5LOiZU1w3RW2O92ZzlS3D67Ppa5Uo4dpqOt+7uBV6D6fgUEBLe
WmgL0xtWtjTAd73X3y7sgy//lyoKO9E0aotzKfuLzPVzzN7+lvX/tu2QuM9Gb71+
FeNPlg1mcE9HgApbFXeSa/yd8mHkmLgB/9fAvd+tG0o/2z4lzzqmvPPHumDjIhRR
Wk3VkZ2Aygw8+Cs9y/8pfFKIFIT2+LCsuhYWPmcEaE6nwZ+mYVUmleoQ/AjJhRvR
gV8RQ971C3LXMaTbyIeFztT1odnvaQkdrhAXCfcQybE=
=jrjI
-----END PGP PUBLIC KEY BLOCK-----

Exposing abuses

An important article up at Salon about some of the Bush Regime's misconduct. A frustrating number of anonymous sources, but perhaps that's inevitable.

Go read it.

Back where we started

Frank Rich has a must-read op-ed about the degree of damage the Bush Administration has done not only to our moral standing, but to our security. The risk of a major terrorist attack today? About where it was in July 2001.

Go read it.

Still stuck in the 50's..

As the Bush Regime's War On Privacy (tm) continues, we're getting the finishing touches on an agreement to exchange large amounts of personal information with European agencies. Or rather, demand that they supply that information to us:

The United States is negotiating deals with European countries to exchange fingerprint and DNA data in criminal and terrorist cases, and in some circumstances to transfer data on race or ethnic origin, political and religious beliefs, or sexual orientation.
. . .
Senior Bush administration officials said the data exchange is crucial for spotting dangerous people before they enter the United States and for furthering criminal and terrorist investigations.

[emphasis added in both cases]

Explain to me how sexual orientation is a useful part of a terrorist investigation. Useful for compiling an enemies list and indulging in some good old-fashioned bigotry? Sure, I'll grant you that. But how is it actually useful for, you know, the purpose it's allegedly being gathered for?

But some European lawmakers fear that, taken together, the accords will lead to a far-reaching exchange of personal data without appropriate safeguards and that eventually the United States will seek access to Europe-wide databases. "We seem to be opening the floodgates, left, right and center," said Sophie in't Veld, a European Parliament member from the Netherlands. "It seems to me there are hardly any restrictions left."

No kidding.

[A DHS official] said the United States has agreed to limit the purpose for which the data are sought, not to share it with other governments and not to retain data if they are no longer useful -- if there is no match on a fingerprint, for instance. He said errors in records will be corrected.

But Schaar, who is independent from the government, said he found no "clear rules on purpose limitation" or on the storage period. "First," he said, "which data are of concern is not really completely clear. Second, who are the competent authorities on the U.S. side? Third, and most important, there is a lack of independent supervision in the United States over data protection." In European states, independent privacy commissions safeguard the privacy rights of citizens, he said.

Exactly. The gummint promises they won't ever misuse any of this data and they'll get rid of it as soon as there's no use for it anymore. And they decide when that is, and whether it should be done, and whether or not they're following their own rules, so there's no need for anyone else to know anything about it.

Of course, every time in the past when they've had the authority to go fishing, it's been misused to after political opponents and people engaging in unpopular but fully legal political activity. And recently the FBI was trying to recruit people to infiltrate vegan potlucks in Minnesota as a pre-emptive move against radical vegans disrupting the Republican National Convention.

So am I supposed to be reassured that they're gathering all this data, but show several signs of incompetence, so they probably won't be successful at any nefarious misuses?

Followup on false positives

This post from a few days ago has another implication as well.

Recall that our hypothetical screening system is 95% accurate at detecting terrorists. In our hypothetical population of 1,000 truly dangerous terrorists, we found 950, leaving 50 still at large and passed screening as non-dangerous.

This implies that any act of terror that is carried out will quite possibly, in fact probably, be carried out by someone who was screened, and passed screening. So think about it. Another big incident, and it turns out the perp had been investigated, perhaps asked a few questions, and then let go as not a serious threat.

What happens to the screening procedures when it turns out "someone slipped through"? It gets even more draconian, we lose a few more liberties...and very little additional safety is gained.

Ultimately, the only way to be sure we've locked up all the terrorists is to lock up everybody. But instead of accepting a calculated risk, we've become a nation of cowards who refuse to accept that life has risks, and some risks can only be mitigated, not entirely eliminated.

Contrary to his rhetoric, the President doesn't take an oath to protect American lives or even American interests. He takes an oath to defend the Constitution. Certainly the Framers knew that requiring warrants and due process and trials by jury would hinder the efficiency of the government and probably result in some criminals going free. That's part of the price of liberty. Trying to achieve absolute safety, at the expense of essential liberties, is not only impossible, it's un-American. And remembering that is more important than ever when passions are running high and people are scared.

Privacy and Data Mining, and false positives

James Wimberly has an interesting post up at RBC about the possibility of large-scale data mining as an intelligence-gathering tool, its costs, and benefits. I'm less sanguine about the possibilities of any such large-scale operation than he is, but he's absolutely correct to note that we need to be having this discussion in the open, rather than relying on the "lawless-unitary-executive-knows-best" model that we've been running on so far.

The problem with any such operation is dealing with the false positives, the things the algorithm says are suspicious that turn out to be nothing. Let's say his "third-degree" assumption is roughly accurate and we're targeting about one million people nationwide for data surveillance. Further assume that there are as many as 1,000 truly dangerous terrorist organizers in the US--determined, competent, well-financed. I'm not talking about janitors with fantasies of blowing up airports, I'm talking about people who have figured out how an airport could be sabotaged, and have access to the means to carry it out, and are motivated to do so.

First of all, we note that 1,000 / 1,000,000 = 0.1% of our targets are actually dangerous. The other 999,000 are not dangerous--not motivated, incompetent, don't have the means, whatever.

Now suppose we have a screening method that can detect 95% of the bad guys and screen out 99% of the non-bad-guys. This is, of course, MUCH better than any actual method can do. But run the numbers:

We find 950 out of 1,000 terrorists (true positives), leaving 50 dangerous people at large (false negatives--people we think are harmless, who really aren't).

We also round up 999,000 * 0.01 = 9, 990 people who aren't dangerous but weren't screened out--false positives.

Meaning we round up a total of 9,990 + 950 = 10,940 people, of whom 9,900 (90.49%) aren't dangerous.

This isn't as much of a needle-in-a-haystack problem as we started with, I'll grant. But what happens when we tell investigators to go through a list of people with suspicious data traffic, but to remember most are probably completely innocent?

Well, we know that about 5% of Americans cheat on their taxes. And we know that IRS auditors, who spend all day dealing with tax fraud, estimate that 30% of Americans cheat on their taxes. When you deal with something out of the ordinary all day long, you can forget how out of the ordinary it is. When you deal with tax cheats all day, you tend to overestimate the prevalence of tax cheats.

Good luck getting your investigators going through the list of "data-based suspects" to remember that 90% are probably innocent or harmless, or both.

We can't just sit back and do nothing. But we should also avoid falling into the trap laid out in Yes, Minister:

We must do something.
This is something.
Therefore, we must do this.

'Believe me, it's torture'

Christopher Hitchens, vocal supporter of the Iraq war, certainly no bleeding-heart liberal, on being waterboarded.

This article and video should be required reading for everyone.

"Manners," Microsoft style

Microsoft has filed a patent on something euphemistically called "digital manners," which will restrict the behavior of mobile devices in areas where it's being deployed. No more annoying cell phone calls in the middle of a movie! No more worries about some creep with a camera phone at the gym locker room! What could possibly go wrong?

Of course, it also means your cell phone will politely refuse to take a picture at a concert. Or during a police raid. Or your iPod will politely refuse to transfer music to or from any computer other than yours.

But we're not supposed to notice that. Does anyone really think end users will be able to set "manners" policies? Or that it won't be implemented for the convenience of the media companies?

Useful link of the day

How to secure your Windows computer and protect your privacy online.

A very useful compendium aimed at the non-expert, describing the most common threats to security and privacy, and listing a wide variety of software tools, most of them free, for avoiding and fixing problems.

Good stuff.

Ouch!

Gotta watch that oversight, there...

PARIS (AP) -- French bank Societe Generale said Thursday it has uncovered a $7.14 billion fraud - one of history's biggest - by a single futures trader who fooled investors and overstepped his authority.

As usual with this sort of thing, it was done (as it only could have been) by someone on the inside.

It said a trader at the futures desk had misled investors in 2007 and 2008 through a "scheme of elaborate fictitious transactions."

The trader, who was not named, used his knowledge of the group's security systems to conceal his fraudulent positions, a statement from the bank said.

Any system can be subverted. And subversion usually does not happen because of weak algorithms (although that's only because most professional systems use peer-reviewed algorithms and protocols).

The problem, of course, and it's not a trivial problem at all, is making a set of procedures and checks that can't be gamed or subverted, but are still usable. (Who watches the watchers, etc.)

Sinking into Oligarchy

Glenn Greenwald has a must-read post about what the BushCo criminal enterprise has done to the rule of law and the idea that no one is above it.

Most revealing of all, anyone who insists that this should be different -- anyone who believes that our highest political officials and largest corporations should be held accountable when they break the law -- is a shrill "partisan," bent on vengeance and Guilty of obstructionism: trying to prevent the political establishment from operating in a harmonious, bipartisan manner to do their Important Work. At least under the Bush presidency, investigations into wrongdoing are bad and disruptive and mean-spirited, and calls for consequences for illegal behavior are shrill and nasty.

Count me as a proudly shrill partisan, then. Eight years of BushCo has done fundamental damage to American democracy, far more than Al Qaeda could ever dream of doing.

Also in that article, check out the link to Privacy International's new annual report. Based on their objective criteria, the US is now an "endemic surveillance society," right up there with China, Russia and a few of the military juntas of southeast Asia.

They just don't learn

Sony is in trouble, once again, for putting virus-like "security" software on its products and not letting anyone know it's there.

What's interesting is that this "vulnerability" is being compared to the XCD fiasco. That "vulnerability" was a botched implementation that weakened security, was impossible to remove, and--coincidence of coincidences--even though it used many of the same techniques as viruses, leading antivirus software ignored it. The AV companies just said they worked with "industry partners." Uh huh....

At one time, Sony defined cool in consumer electronics. Today, they're not only user-hostile, they're incompetent.

Read Schneier's book. Or Schneier's other book. Security by obscurity is inherently insecure. And in this case, once again, using products that relied upon it put users at risk.

Yes, security is hard to get right. But you'd think after getting burned on a fundamentally flawed approach that outraged users, outraged regulators, and cost the company millions, they'd have learned their lesson.

Apparently not.

Bad ideas, probably ready for import

From the BBC we learn about a plan in Germany to plant spyware onto suspect's computers via spam email.

The e-mails would contain Trojans - software that secretly installs itself on suspects' computers, allowing agents to search the hard drives.

There would only be "a few" of these (no specification of how many) and for a limited time (no hint of how long).

I don't know what the situation is with German law, though news reports are cited that privacy laws may be violated by this. In the US, of course, there would (in theory) need to be court approval, but as we've seen lately, that's not really required; it's more of a suggestion, just being in the constitution and all.

I give it 6 months before it's done here, and 6 months after that before the story breaks and we find out how many cases it's been used on. And it'll be a much higher number than anyone expects.

And of course, this raises some questions. Will antivirus software be "updated" to ignore "official" spyware? If I find it and delete it anyway, is that taken as proof of malicious or criminal intent? Is it interfering with an investigation?

Feh.

Missing the point, again

A discussion of digital restrictions management (DRM) on the BBC website quotes the usual sources, and gets the usual party line. That music was released on CD's, without DRM, so people expect it to be available. Video, on the other hand, hasn't been released in a non-crippled protected form and so it's perfectly okay to keep doing that, or so says the industry spokesdrone:

"There isn't a contradiction of approach between the physical and digital products... Video content and DVD has always been very protected - people do not expect to copy DVDs easily."

[sigh] No. Let's take this from the top. Again.

Users have certain rights. They're a matter of law. The fact that the MPAA threatened and bribed hardware manufacturers into selling crippled players that don't protect those rights, does not mean those rights don't apply. Just because the MPAA could do it, and dare anyone to stop them, doesn't mean they were right to do so, or that there's any presumption that they should continue to do so.

But as long as no one complains, they can go right on ignoring the law.

2008 Preview

Straw Poll Results Delayed Due To Voting Machine Malfunction

Look who's involved:

The state party rented optical scan machines from Diebold, a company at the center of several recent voting controversies. Recently, the state of California decertified Diebold machines for the 2008 election.

Is anyone surprised?