Emergent Chaos

Va Pbaterff Nffrzoyrq, Whyl 4 1776

My usual celebration of Independence day is to post, in its entirety, the Declaration of Independence. It's very much worth reading, but this year, there's a little twist, from a delightful story starring Lawren Smithline and Robert Patterson, with a cameo by Thomas Jefferson. Patterson sent Jefferson a letter which read, in part:

“I shall conclude this paper with a specimen of such writing,” he boasted, “which I may safely defy the united ingenuity of the whole human race to decypher to the end of time….”

Well, perhaps it didn't last until the end of time, but the cipher apparently lasted until now, which is pretty darn good. There's an article in Harvard Magazine, and one in American Scientist, but it's behind a paywall. Finally, the Wall St Journal has an article, which mentions, both without linking to either.

I think what I really like about this story is how a mathematician bothered to send his new ciphertext to the author of Virginia's statue on religious liberty (as our third President preferred to be remembered). Having just finished Steven Johnson's very enjoyable "The Invention of Air," I'm struck by how broadly engaged with science and the useful arts the founders were. I think that sending an encrypted letter to President Obama would get you ... well, I don't really want to think about it, having just read the Declaration.

Thoughts on Iran

Our love affair with the Iranian Tweetolution has worn off. The thugs declared their election valid, told their armed representatives to

Sorry, next tweet: go impose some law or order or something, and it was done.

Well, as it often turns out, there was more to it than fits in 140 characters, and the real story is far more complicated. There's a good write up from StratFor, "The Real Struggle in Iran and Implications for U.S. Dialogue:"

This is because the real struggle in Iran has not yet been settled, nor was it ever about the liberalization of the regime. Rather, it has been about the role of the clergy — particularly the old-guard clergy — in Iranian life, and the future of particular personalities among this clergy.
[...]
The key to understanding the situation in Iran is realizing that the past weeks have seen not an uprising against the regime, but a struggle within the regime. Ahmadinejad is not part of the establishment, but rather has been struggling against it, accusing it of having betrayed the principles of the Islamic Revolution. The post-election unrest in Iran therefore was not a matter of a repressive regime suppressing liberals (as in Prague in 1989), but a struggle between two Islamist factions that are each committed to the regime, but opposed to each other.

The Punch Line Goes at the End

The Black Hat conference in Las Vegas always has its share of drama. This year, it's happened a month before the conference opens. The researcher Barnaby Jack had to cancel his talk. Risky.biz gives an account of this; his talk was to make an Automated Teller Machine spit out a "jackpot" of cash, in the style of a slot machine.

According to reports, the manufacturer of the ATM pressured Jack's employer, Juniper, to pressure him to withdraw the talk.

I certainly roll my eyes at this. It doesn't do a lot of good to pressure someone to withdraw their talk.

But even more so, if you're giving a talk, it behooves you to save the showmanship for the stage. I mean, come on.

Last year, the big cancellation was the team of MIT students who broke the Boston MBTA Charlie Card system. There was a legal injunction put against them that spoilt their presentation. The fault, in my opinion went to them for naming their talk, "How To Get Free Subway Rides For Life."

Imagine that you are a judge who is interrupted from an otherwise pleasant Saturday by panicky people who want an injunction against a talk with such a dramatic name, you'll at least listen to them. You decide that sure, no harm to society will come from an injunction from Saturday 'til Monday, and you'd be right. No harm came to society, DefCon was merely a little less interesting.

Now imagine that you are the same judge and you're asked for an injunction against the talk, "A Practical Cryptanalysis of the Mifare Chip as Implemented in the MBTA." That one can wait until Monday, and the talk goes on.

In a similar gedanken experiment, imagine that you are the VP of Corporate Communications for the XYZ ATM Corp. You learn that in a few weeks, someone is going to do "ATM Jackpot" with one of your ATMs in some show in Vegas. Despite the fact that someone else in the company approved it, what do you? You pressure them to cancel. Duh. If you don't, then you're going to spend most of August reassuring people about your products, your boss is going to be really ticked at you (after all, isn't it the job of Corporate Communications to control these things?), and it's just going to be no fun. This is also why you're paid the big bucks, to make embarrassments go away.

This is why if you are a researcher, you do not name your talk, "ATM Jackpot" you name it "Penetration Testing of Standalone Financial Services Systems." It is only on stage that you fire up the flashing lights and clanging bells and make the ATM spit out C-notes for minutes on end. That would get you all the publicity for your talk that you want, and you actually get to give it.

Remember, do as I say, not as I do. If you have a flashy Black Hat talk, put the punch line at the end of the joke.

Rebellion over an ID plan

What they were emphatically not doing, said Jay Platt, the third-generation proprietor of the ranch, was abiding by a federally recommended livestock identification plan, intended to speed the tracing of animal diseases, that has caused an uproar among ranchers. They were not attaching the recommended tags with microchips that would allow the computerized recording of livestock movements from birth to the slaughterhouse.
“This plan is expensive, it’s intrusive, and there’s no need for it,” Mr. Platt said.

The New York Times reports that not even cattle need Real ID in"Rebellion on the Range Over a Cattle ID Plan." There's a web site, NoNAIS.org which is tracking things like

Oklahoma is now mandating Premises ID for anyone wanting participate in the Swine Shows. One more tricky little way that they make “voluntary” into mandatory.

Image: IstockPhoto

Unthinkable Foolishness from TSA

"Flying from Los Angeles to New York for a signing at Jim Hanley's Universe Wednesday (May 13th), I was flagged at the gate for 'extra screening'. I was subjected to not one, but two invasive searches of my person and belongings. TSA agents then 'discovered' the script for Unthinkable #3. They sat and read the script while I stood there, without any personal items, identification or ticket, which had all been confiscated.
"The minute I saw the faces of the agents, I knew I was in trouble. The first page of the Unthinkable script mentioned 9/11, terror plots, and the fact that the (fictional) world had become a police state. The TSA agents then proceeded to interrogate me, having a hard time understanding that a comic book could be about anything other than superheroes, let alone that anyone actually wrote scripts for comics. (From Boing Boing, "Comics creator stopped by TSA for carrying script about writer under suspicion by TSA"

Issues of Unthinkable are only $3.99 each, a bargain! Why not pop over to Boom studios and support the artist?

On the Assimilation Process

Three years and three days ago I announced that "I'm Joining Microsoft." While I was interviewing, my final interviewer asked me "how long do you plan to stay?" I told him that I'd make a three year commitment, but I really didn't know. We both knew that a lot of senior industry people have trouble finding a way to be effective in Microsoft's culture.

So I wanted to pipe up and say I'm having a heck of a lot of fun, and have found places and ways to be effective. I'm getting to develop and share things like our SDL Threat Modeling Tool, and I get to be very transparent about the drivers and decisions that shape it. I've got some even cooler stuff in the pipeline, which I'm hoping will be public in the next year or so. My management (which has shifted a little) is supportive of me having two external blogs.

It's been a heck of a ride so far. Dennis Fisher asked a great question to close this Hearsay Podcast, which is what surprised me the most? I was a little surprised by the question, but I'm going to stand by my answer, which is the intensity and openness of internal debate, and how it helps shape the perception that we're all reading from the same script. It's because we've seen the debate play out, with really well-informed participants, and remember which points were effective.

I can't wait to see what happens in the next three years.

Emergent Traffic Chaos

Paul Kedrosky has an amazing video: As described in the New Scientist:

Researchers from several Japanese universities managed the feat by putting 22 vehicles on a 230-metre single-lane circuit (see video).
They asked drivers to cruise steadily at 30 kilometres per hour, and at first the traffic moved freely. But small fluctuations soon appeared in distances between cars, breaking down the free flow, until finally a cluster of several vehicles was forced to stop completely for a moment.

The Cost of Anything is the Foregone Alternative

The New York Times reports:

At least six men suspected or convicted of crimes that threaten national security retained their federal aviation licenses, despite antiterrorism laws written after the attacks of Sept. 11, 2001, that required license revocation. Among them was a Libyan sentenced to 27 years in prison by a Scottish court for the 1988 bombing of Pan Am 103 over Lockerbie.

It's long been a truism of economics that the cost of anything is the foregone alternative. In this case, a huge amount of our air travel security spending goes into ensuring that you can't fly if your name and ID don't quite match (looking at you, Jim), rather than preventing convicted terrorists from getting aviation licenses.

The emergent chaos of fingerprinting at airports

HONG KONG (Reuters) - A Singapore cancer patient was held for four hours by immigration officials in the United States when they could not detect his fingerprints -- which had apparently disappeared because of a drug he was taking.
The incident, highlighted in the Annals of Oncology, was reported by the patient's doctor, Tan Eng Huat, who advised cancer patients taking this drug to carry a doctor's letter when traveling to the United States. ("Cancer patient held at airport for missing fingerprint", Reuters, May 27 2009)

Reuters classifies this as "oddlyEnoughNews," but in fact it's not odd at all that over time, additional layers of "no" will expose conditions unimagined by their designers. Chaos will emerge. In a free society, that chaos is an accepted part of life. We stop only that which is explicitly denied, not that which the designer didn't anticipate. In information security, we often default to deny, because we know our imaginations are limited. But the role of security in society used to be carefully limited, for precisely these reasons.

(Via Slashdot)

UnClear where the data will go

So Clear's Verified Line Jumper service has shut down. Aviation Week has a blog post, " Clear Shuts Down Registered Traveler Lanes."

Clear collected a lot of data:

The information that TSA requires us to request is full legal name, other names used, Social Security number (optional), citizenship, Alien Registration Number (if applicable), current home address, primary and secondary telephone numbers, current email address, date of birth, place of birth, gender and height. TSA also lists as optional, but helpful, the following personal information: home addresses, driver’s license number and employer’s name and address...digital photo and digital images of all of your fingerprints and your irises...your credit card.

This raises a very serious problem with a company like Clear/Verified Identity Pass, Inc. The in-depth, validated customer data is likely to count amongst such a company's most valuable assets. Their privacy policies make no mention of what would happen to it in the event that the company goes bust.

Does anyone know where Clear was incorporated? Maybe I'll bid at the bankruptcy auction.

[Update: Tamzen points out that there's an update on their site, promising that Clear will abide by the "Transportation Security Administration’s Security, Privacy and Compliance Standards" and "take appropriate steps to delete the information." Google thinks that those standards might refer to "Transportation Security Administration’s Security, Privacy and Compliance Standards." Me, I wonder why they say "take appropriate steps" rather than just promising to delete it. Back in the day, Brill's Content might have taken them to task for that.]

Iran Links

The Economist's Bagehot writes about his idea of "The chemistry of revolution," while admitting he's generalizing from two.
Ethan Zuckerman on "Iran, citizen media and media attention." "Unfortunately, unlike positive online gestures of solidarity (retweeting reports from Iran, turning Twitter or Facebook pictures green), this one does little more than piss off sysadmins, helps Iranian authorities make the case that forces outside Iran are “attacking the country” and encourage user-driven censorship as a response to unwanted speech." See the excellent "DDOS attacks on Iran's web-sites: what a stupid idea!" for more on that idea
The Wall St Journal reports "Iran's Web Spying Aided By Western Technology."
BoingBoing has links to "10 Iran web videos."
Meanwhile, people in Iran are being "Arrested for asking a policeman for his badge number." Sorry, that should read Britian. Emergent Chaos regrets the confusion. Obviously, the corrupt politicians creating a police state in Britian speak English, which makes it all ok, like the US Department of Defense which presents "Protests are "Low-Level Terrorism""

Ron Paul supporter inadvertently gets iPhones banned from U.S. aircraft

Via CNN:

Steve Bierfeldt says the Transportation Security Administration pulled him aside for extra questioning in March. He was carrying a pocket edition of the U.S. Constitution and an iPhone capable of making audio recordings. And he used them.
On a recording a TSA agent can be heard berating Bierfeldt. One sample: "You want to play smartass, and I'm not going to play your f**king game."

Bierfeldt is director of development for the Campaign for Liberty, an outgrowth of the Ron Paul presidential campaign.
[...]
Unbeknownst to the TSA agents, Bierfieldt had activated the record application on his phone and slipped it into his pocket. It captured the entire conversation.

An excerpt:

Officer: Why do you have this money? That's the question, that's the major question.

Bierfeldt: Yes, sir, and I'm asking whether I'm legally required to answer that question.

Officer: Answer that question first, why do you have this money.

Bierfeldt: Am I legally required to answer that question?

Officer: So you refuse to answer that question?

Bierfeldt: No, sir, I am not refusing.

Officer: Well, you're not answering.

Bierfeldt: I'm simply asking my rights under the law.
[...]

The officers can be heard saying they will involve the Federal Bureau of Investigation and the Drug Enforcement Administration, and appear to threaten arrest, saying they are going to transport Bierfeldt to the local police station, in handcuffs if necessary.
[...]

Near the end of the recording an additional officer enters the situation and realizes the origins of the money.

Officer: So these are campaign contributions for Ron Paul?

Bierfeldt: Yes, sir.

Officer: You're free to go.

Suffering for Art

Joseph Carnevale, 21, was nabbed Wednesday after a Raleigh Police Department investigation determined that he was responsible for the work (seen below) constructed May 31 on a roadway adjacent to North Carolina State University. Carnevale, pictured in the mug shot at right, was charged with misdemeanor larceny for allegedly building his orange monster from materials pilfered from a construction site. According to an arrest warrant, Carnevale "destroyed three road blocking barrels by cutting and screwing them together to form a statue."

Via The Smoking Gun.

Happy Juneteenth!

Celebrate Juneteenth, but remember that we have not eliminated the scrouge of slavery.

Privacy Enhancing Technologies 2009

The organizers of the 9th Privacy Enhancing Technologies Symposium invite you to participate in PETS 2009, to be held at the University of Washington, Seattle, WA, USA, on Aug 5-7, 2009.

PETS features leading research in a broad array of topics, with sessions on network privacy, database privacy, anonymous communication, privacy policies, and privacy offline. (The PETS 2009 program is here.)

Like last year, we also present the HotPETs workshop, which showcases hot new research in the field.

We will also be presenting the Award for Outstanding Research in Privacy Enhancing Technologies to researchers who have made an outstanding contribution to the theory, design, implementation, or deployment of privacy enhancing technology.

Important dates:

Stipends deadline: July 2
Hotel group rate deadline: July 5
Earlybird registration deadline: July 9
Symposium: August 5-7

Venue and registration information, as well as the program, can be found at the PETS 2009 website.

We hope to see you in Seattle!

- The PETS 2009 organizers