<?xml version="1.0" encoding="utf-8"?>

<rdf:RDF
  xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
  xmlns:dc="http://purl.org/dc/elements/1.1/"
  xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
  xmlns:admin="http://webns.net/mvcb/"
  xmlns:cc="http://web.resource.org/cc/"
  xmlns="http://purl.org/rss/1.0/">

<channel rdf:about="http://www.emergentchaos.com/">
<title>Emergent Chaos</title>
<link>http://www.emergentchaos.com/</link>
<description>The Emergent Chaos Jazz Combo of the Blogosphere</description>
<dc:language>en-us</dc:language>
<dc:creator></dc:creator>
<dc:date>2008-05-12T11:13:11-05:00</dc:date>
<admin:generatorAgent rdf:resource="http://www.movabletype.org/?v=3.33" />
<cc:license rdf:resource="http://creativecommons.org/licenses/by-nc/2.5/" />


<items>
<rdf:Seq><rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/jack_jones_on_risk_manage.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/call_me_crazy.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/credit_bureaus_and_outsou.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/security_cameras_function.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/hiring_fraudsters.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/spending_to_protect_asset.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/a_question_of_ethics.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/fasilyce_upon_reading.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/brightening_up_the_day_fr.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/05/italy_posts_tax_return_da.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/04/quantum_debate.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/04/bushs_law_less_safe_less.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/04/everybody_run_crispins_go.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/04/quantum_uncertainty.html" />
<rdf:li rdf:resource="http://www.emergentchaos.com/archives/2008/04/the_messenger_is_the_mess.html" />
</rdf:Seq>
</items>

</channel>

<item rdf:about="http://www.emergentchaos.com/archives/2008/05/jack_jones_on_risk_manage.html">
<title>Jack Jones on Risk Management</title>
<link>http://www.emergentchaos.com/archives/2008/05/jack_jones_on_risk_manage.html</link>
<description><![CDATA[<img src="http://www.emergentchaos.com//images/08/may/jack-jones.jpg" alt="jack-jones.jpg" border="0" width="486" height="395" align="right" />
<p>
I really enjoyed watching the podcast version of a talk that Jack Jones gave at Purdue, "<a href="http://www.cerias.purdue.edu/news_and_events/events/calendar/cerias_event.php?uid=7j9nqk3f9ul97q6ijqg0r0j908@google.com">Shifting focus: Aligning security with risk management</a>."
<p>
I liked the opener, about what it's like for executives to talk to security professionals, and <a href="http://riskmanagementinsight.com/riskanalysis/?p=350">the difference between what might happen and what's likely to happen</a>.  The screenshot is from a discussion of how to play Russian Roulette.<p>
I also like the way he critiqued best practices (you'll have to watch).  It's a little hard for me to assess his risk management methodology from a podcast, but it's a very worthwhile 45 minutes.
<p>
(Now only if he had some Kandinsky in there, I'd have no doubt that the <a href="http://riskmanagementinsight.com">Risk Management Insight</a> <strike>Institute</strike>, which Jack heads, is part of what we call the "New School.")
<p>
]]></description>
<dc:subject>information security</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-12T11:13:11-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/call_me_crazy.html">
<title>Call me crazy?</title>
<link>http://www.emergentchaos.com/archives/2008/05/call_me_crazy.html</link>
<description><![CDATA[There's an article in the New York Times, "<a href="http://www.nytimes.com/2008/05/11/fashion/11madpride.html?_r=1&oref=slogin">&lsquo;Mad Pride&rsquo; Fights a Stigma</a>"
<blockquote>
&ldquo;It used to be you were labeled with your diagnosis and that was it; you were marginalized,&rdquo; said Molly Sprengelmeyer, an organizer for the Asheville Radical Mental Health Collective, a mad pride group in North Carolina. &ldquo;If people found out, it was a death sentence, professionally and socially.&rdquo;
<p>
She added, &ldquo;We are hoping to change all that by talking."
<p>
...<br>
Participants write and distribute publications, stage community talks, <strong>trade strategies for staying well</strong> and often share duties like cooking or shopping.<p>
...<br>
Many psychiatrists now recognize that patients&rsquo; candid discussions of their experiences can help their recoveries. &ldquo;<strong>Problems are created when people don&rsquo;t talk to each other</strong>,&rdquo; said Dr. Robert W. Buchanan, the chief of the Outpatient Research Program at the Maryland Psychiatric Research Center. &ldquo;It&rsquo;s critical to have an open conversation.&rdquo;
</blockquote>
Call me crazy, but I think these folks might be onto something.  Learning about coping strategies from one another?  Testing what works and what doesn't, and reporting on it? Maybe "we were broken into" isn't the most embarrassing thing you can say in public.
<p>]]></description>
<dc:subject>breach analysis</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-10T14:01:42-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/credit_bureaus_and_outsou.html">
<title>Credit Bureaus and Outsourcing</title>
<link>http://www.emergentchaos.com/archives/2008/05/credit_bureaus_and_outsou.html</link>
<description><![CDATA[The "I've Been Mugged" blog has a great three part series on outsourcing by credit bureaus:
"<a href="http://ivebeenmugged.typepad.com/my_weblog/2008/05/is-it-wise-fo-1.html">Is It Wise For Credit Bureaus To Outsource To Foreign Call Center Firms? (Part 1)</a>," "<a href="http://ivebeenmugged.typepad.com/my_weblog/2008/05/is-it-wise-for.html">part 2</a>" and "<a href="http://ivebeenmugged.typepad.com/my_weblog/2008/05/is-it-wise-fo-2.html">part 3</a>."
<p>
He digs deep into how extensively TransUnion outsources, and where.  I went looking, and was surprised to see that their <a href="http://www.transunion.com/corporate/privacyPolicy.page?">privacy policy</a> is at least honest.  They make no claim that they care about your privacy, nor any that they apply the highest standards of security to your information.
<p> ]]></description>
<dc:subject>background checks</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-09T11:03:18-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/security_cameras_function.html">
<title>Security Cameras Functional</title>
<link>http://www.emergentchaos.com/archives/2008/05/security_cameras_function.html</link>
<description><![CDATA[<a href="http://www.flickr.com/photos/herschell/2412494935/in/pool-banksy"><img src="http://www.emergentchaos.com/images/OneNation.jpg" alt="OneNation.jpg" border="0" width="245" height="342" align="right" /></a>
<blockquote>
Use of CCTV images for court evidence has so far been very poor, according to Detective Chief Inspector Mick Neville, the officer in charge of the Metropolitan police unit. "CCTV was originally seen as a preventative measure," Neville told the Security Document World Conference in London. "Billions of pounds has been spent on kit, but no thought has gone into how the police are going to use the images and how they will be used in court. It's been an utter fiasco: only 3% of crimes were solved by CCTV. There's no fear of CCTV. Why don't people fear it? [They think] the cameras are not working."  (BBC, "<a href="http://news.bbc.co.uk/1/hi/uk/7384843.stm">CCTV boom 'failing to cut crime.'</a>")
</blockquote>
Blogosphere analysis: <a href="http://www.schneier.com/blog/archives/2008/05/londons_cameras_1.html">Schneier</a>, <a href="http://blog.privcom.gc.ca/index.php/2008/05/07/are-cctv-cameras-in-uk-a-&ldquo;fiasco&rdquo;/">Stoddard</a>. 
<p>
Our thought?  Their chocolate ration needs to be increased to 20 grammes.  Action this day.
<p>
Image credit: <a href="http://www.emergentchaos.com/archives/2008/04/one_nation_under_cctv.html">Emergent Chaos</a>]]></description>
<dc:subject>Privacy</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-07T11:14:14-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/hiring_fraudsters.html">
<title>Hiring Fraudsters?</title>
<link>http://www.emergentchaos.com/archives/2008/05/hiring_fraudsters.html</link>
<description><![CDATA[<img src="http://www.emergentchaos.com//images/08-april/kerviel.jpg" alt="kerviel.jpg" border="0" width="376" height="263" align="right" /><blockquote>
PARIS &mdash; J&eacute;r&ocirc;me Kerviel, the Soci&eacute;t&eacute; G&eacute;n&eacute;rale trader who used his knowledge of the French bank&rsquo;s electronic risk controls to conceal billions in unauthorized bets, has a new job &mdash; at a computer consulting firm.
<p>
Mr. Kerviel, who was given a provisional release from prison on March 18, started work last week as a trainee at Lemaire Consultants & Associates, which specializes in computer security and system development, a spokesman for the former trader, Christophe Reille, confirmed on Friday. ("<a href="http://www.nytimes.com/2008/04/25/business/worldbusiness/25cnd-socgen.html"> After Trading Scandal, Banker Gets I.T. Job</a>," The New York Times.)
</blockquote>
First let me say that I'm fond of the phrase "paid his debt to society."  It's out of fashion, but it used to mean that someone, after their sentence was carried out, was done.  That they ought to be allowed to get on with their lives.  I've <a href="http://www.emergentchaos.com/archives/2005/03/hank_asher.html">publicly commented</a> on <a href="http://www.abagnale.com/aboutfrank.htm">Frank Abagnale</a> being in this class.
<p>
Kerviel clearly understands how to get around IT controls.  I expect that there's a great deal which he might be able to teach people about what's important in security design, and some about what isn't.  (His ability to generalize his approach hasn't been tested yet.)
<p>
At the same time, he hasn't yet been tried for his actions.  What would be the right framework for making a hiring decision like this?
<p>
Photo: REUTERS/Benoit Tessier]]></description>
<dc:subject>background checks</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-05T11:00:22-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/spending_to_protect_asset.html">
<title>Spending to Protect Assets</title>
<link>http://www.emergentchaos.com/archives/2008/05/spending_to_protect_asset.html</link>
<description><![CDATA[<img src="http://www.emergentchaos.com//images/08/may/smartbike.jpg" alt="smartbike.jpg" border="0" width="320" height="320" align="right" />There's a story in the New York Times about a bike rental program in Washington DC.  It's targeted at residents, not tourists, and has a subscription-based model.
<blockquote>
Improved technology allows programs to better protect bicycles. In Washington, <a href="http://smartbikedc.com/program_information.asp">SmartBike</a> subscribers who keep bicycles longer than the three-hour maximum will receive demerits and could eventually lose renting privileges. Bicycles gone for more than 48 hours will be deemed lost, with the last user charged a $200 replacement fee.
<p>
That technology comes with a price, which is one reason cities and advertisers started joining forces to offer bike-sharing. The European programs would cost cities about $4,500 per bike if sponsors did not step in, Mr. DeMaio said.  "<a href="http://www.nytimes.com/2008/04/27/us/27bikes.html">Bicycle-Sharing Program to Be First of Kind in U.S.</a>"
</blockquote>
$4,500 is 22.5 bikes.  Put another way, they could buy 2,500 bikes, rather than the 120 they're buying.  That would require a lot more space if you bought them all at once, but you might just buy them as bikes are stolen.  Looking at it another way, if you took the $500,000 being spent on technology, and invested it at 5%, you would make $25,000 per year, enough to completely replace the fleet annually.
<P>
This is (obviously) an incomplete analysis.  But the cost of protection jumped out at me.  Maybe it's typical for how people in Washington think about asset protection.
<p>]]></description>
<dc:subject>Economics</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-04T13:02:18-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/a_question_of_ethics.html">
<title>A question of ethics</title>
<link>http://www.emergentchaos.com/archives/2008/05/a_question_of_ethics.html</link>
<description>Various estimates have been made regarding the quantity of personal identifying information which has been exposed by various mechanisms.  Obviously, though, we only know about what we can see, so seeing more would make such estimates better.

One way to see more would be to look in more places, for example on peer-to-peer file sharing networks.  

So here&apos;s the question:  would it be ethical (and if so, under what conditions) to deliberately seek out files containing PII as made available via P2P networks, in order to better understand the extent to which such information is exposed, and how?  

I have an opinion on this question, but I&apos;m very interested in what others think.</description>
<dc:subject>breach analysis</dc:subject>
<dc:creator>cwalsh</dc:creator>
<dc:date>2008-05-03T18:58:39-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/fasilyce_upon_reading.html">
<title>Fasilyce, upon Reading</title>
<link>http://www.emergentchaos.com/archives/2008/05/fasilyce_upon_reading.html</link>
<description><![CDATA[<a href="http://www.iain-banks.net/">Dear Mr. Banks</a>,
<p>
Much as I enjoy your work, it is entirely dis-congruous to your readers to <a href="http://www.iain-banks.net/science-fiction/matter/">insert words</a> known to neither the Oxford English Dictionary or the internet (as indexed <a href="http://www.google.com/search?q=fasilyce&hl=en&rls=en&start=0&sa=N&filter=0">here</a>, <a href="http://search.live.com/results.aspx?q=Fasilyce&go=Search&mkt=en-us&scope=&FORM=">here</a> or <a href="http://search.yahoo.com/search?ei=UTF-8&p=fasilyce&fr=yfp&dups=1">here</a>) whose meanings are not rapidly comprehensible. 
<p>
Thank you for your future attention to this matter.
<p>
I remain, etc, etc.
<p>]]></description>
<dc:subject>books</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-03T13:39:26-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/brightening_up_the_day_fr.html">
<title>Brightening up the day from an unexpected place</title>
<link>http://www.emergentchaos.com/archives/2008/05/brightening_up_the_day_fr.html</link>
<description><![CDATA[<img src="http://www.emergentchaos.com/images/08-may/ruby-on-trains.jpg" alt="ruby-on-trains.jpg" border="0" width="332" height="261" align="right" /><p>I would estimate that 2/3 of the calls I get are from people trying to sell me things I neither need nor want. Of those, over half are outsourcing services. Of the remainder, recruiters are over half.

<p>There are also people who call me for their services once a week. There's one particular outsourcing firm whose name is burned into my brain because of the number of times I've been subjected to it. I don't know how to spell their name, but I can sure pronounce it. There's also a recruiting firm that I know well, too. Each of these people I have asked to take me off their list,  asked to talk to supervisors, talked to supervisors, yelled at them, ranted at them, and finally sworn at them, and yet I still get my weekly call.

<p>As I was doing office stuff a few moments ago, I played a voicemail, and it was from my friends at Hadron Infotech, letting me know about their services just in case I have (a) developed a need I didn't have last week and (b) forgot their name. (One of my rants included telling them that when I do need such services, they will be the last people I call and sadly for them, I have no trouble remembering their name.)

<p>Since I was doing office stuff, I let the message drone on, and got the litany of things they can do for me including, Java, Jay-mumble-E, Dot-Net, Pee-Haitch-Pee, AJAX, Perl, Ruby on Trains, updating your web site, ....

<p>Wait a minute. Did he say what I thought he said? Ruby on <em>what</em>? I ran over to my computer, backed up the player, and ... Yes! Ruby on <em><a href="http://www.michigan.org/Places-to-Go/Getting-There/Trains/Default.aspx?city=G3503&page=2">Trains</a></em>! How delightful!

<p>I'm still laughing. I hope you are, too. Maybe I'll get another laugh next week.

<p>Photo "<a href="http://www.flickr.com/photos/82971819@N00/1336689684/">Ruby on Train</a>" by <a href="http://www.flickr.com/photos/82971819@N00/">theresa_l_reed</a>.]]></description>
<dc:subject>Amusements</dc:subject>
<dc:creator>mordaxus</dc:creator>
<dc:date>2008-05-01T19:29:30-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/05/italy_posts_tax_return_da.html">
<title>Italy Posts Tax Return Data on Official Website</title>
<link>http://www.emergentchaos.com/archives/2008/05/italy_posts_tax_return_da.html</link>
<description><![CDATA[<blockquote>
How much do you make? How surprised would you be to learn that your magic number had been posted on the Internet by the government? And that it was not by mistake, as in other recent breaches of privacy.
</blockquote>
<a href="http://thelede.blogs.nytimes.com/2008/05/01/how-much-do-you-make-the-nation-already-knows/?hp">How Much Do You Make? The Nation Already Knows</a>.  The data <a href="http://marketplace.publicradio.org/display/web/2008/05/01/italian_taxes_online">has already been removed</a> from easy web access at the official site.  <a href="http://www.bloomberg.com/apps/news?pid=20601085&sid=axov0lz3zSIU&refer=europe">Bloomberg's report</a> indicates that it wasn't simply posted to the web, but offered up as spreadsheets:
<blockquote>
A ministry Web site was bombarded by Italians curious to see what their neighbors or favorite actors declared as income, making it often impossible later in the day to download spreadsheets with the name, date of birth, total income and amount each taxpayer paid.
</blockquote> 
<p>
If anyone knows where the mirrors are, please share.
<P>
I ask not out of prurient interest, but because it's not so easy as taking data off the website.
<p>]]></description>
<dc:subject>breach analysis</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-05-01T12:14:58-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/04/quantum_debate.html">
<title>Quantum Debate</title>
<link>http://www.emergentchaos.com/archives/2008/04/quantum_debate.html</link>
<description><![CDATA[<p>The debate about Shor's Algorithm (<a href="http://www.emergentchaos.com/archives/2008/04/quantum_uncertainty.html">which I blogged about a couple days ago) </a>continues. <a href="http://rdvlivefromtokyo.blogspot.com/">Rod Van Meter</a> has a good blog post about it <a href="http://rdvlivefromtokyo.blogspot.com/2008/04/shors-algorithm-in-danger.html">here</a>.

<p>While there are plenty of people who have just wholesale dismissed the Hill/Viamontes paper outright, apparently because they know Shor's algorithm works and that building a working quantum computer is obviously merely a matter of making some qubits, Van Meter is more to my thinking about the whole thing. 

<blockquote>
<p>I have read it, but not studied it in major detail yet. I don't know either of the authors personally, but the second author has done good work; he is certainly no dummy.

<p>The argument is pretty straightforward, arguably naive. That doesn't mean it's wrong, but there are a lot of assumptions and simplifications in the work, and they need to be examined carefully.
</blockquote>

<p>He also says:

<blockquote><p>Anyway, I hope this at least short-circuits any rush to burn Peter Shor in effigy. He's way too smart and sweet for that.</blockquote>

<p>Here's where I think I need to rant a bit. I'm certainly not calling for anyone to be burned in effigy or reality. I can't testify to how sweet Peter Shor is, but I agree that he's brilliant and I admire him.

<p>However, Leibniz was also smart and worked in the forefront of calculation as well. His calculator had issues with propagating carry with two-digit or three-digit multipliers. That doesn't make Leibniz any less brilliant or his achievements any less.

<p>Peter Shor is brilliant, and his algorithms are marvelous works. If no one implements them, for whatever reasons, they won't be any less marvelous, and he won't be any less brilliant.

<p>And for that matter, Hill and Viamonthes may turn out to be wrong, too. Or they may inspire someone to a tweak that makes Shor's algorithm work (or work better).

<p>The present spectator sport is how science works. It's what makes it exciting.]]></description>
<dc:subject>Science</dc:subject>
<dc:creator>mordaxus</dc:creator>
<dc:date>2008-04-30T19:40:21-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/04/bushs_law_less_safe_less.html">
<title>Bush&apos;s Law -- Less Safe, Less Free</title>
<link>http://www.emergentchaos.com/archives/2008/04/bushs_law_less_safe_less.html</link>
<description><![CDATA[

<a href="http://www.amazon.com/gp/product/037542492X?ie=UTF8&tag=httpwwwemer04-20&linkCode=as2&camp=1789&creative=9325&creativeASIN=037542492X"><img src="http://www.emergentchaos.com//images/08-april/bushs-law.jpg" alt="bushs-law.jpg" border="0" width="237" height="332" align="right" /></a>

<a href="http://www.amazon.com/gp/product/1595581332?ie=UTF8&tag=httpwwwemer04-20&linkCode=as2&camp=1789&creative=9325&creativeASIN=1595581332"><img src="http://www.emergentchaos.com//images/08-april/less-safe-less-free.jpg" alt="less-safe-less-free.jpg" border="0" width="233" height="332" align="right" /></a>

I'd like to review two recent books on the war on terror: "<a href="http://www.amazon.com/gp/product/037542492X?ie=UTF8&tag=httpwwwemer04-20&linkCode=as2&camp=1789&creative=9325&creativeASIN=037542492X">Bush's Law: The Remaking of American Justice</a>" by  by Eric Lichtblau, and "<a href="http://www.amazon.com/gp/product/1595581332?ie=UTF8&tag=httpwwwemer04-20&linkCode=as2&camp=1789&creative=9325&creativeASIN=1595581332">Less Safe, Less Free: Why America Is Losing the War on Terror</a>" by David Cole and Jules Lobel.  Both are well written assaults on the way in which the Bush administration is conducting itself, although each takes a tact aligned with the author's background and history.  Lichtblau is a reporter, currently for the New York Times, and Cole and Lobel are law professors.
<p>
<em>Bush's Law</em> is an extended view into some of the major stories that Lichtblau has covered.  Included are the NSA's warrant-less wiretapping, the SWIFT following of the money, and the Comey/Ashcroft hospital story.  Even as someone who follows these stories fairly closely, I still learned quite a bit-some new, some not previously reported, and all better organized and more readable than in the newspaper.  The theme that emerges from <em>Bush's Law</em> is one of secrecy, and the conflict which a free society faces when repeatedly begged to `trust us' by an administration which seems  to not understand how its actions undermine trust.
<p>
The undermining of trust is also a major theme of <em>Less Safe, Less Free</em>.  Before getting into the meat of the book, let me say that this is law professor writing at its best.  It's clear and compelling, and the notes are at the end.  They lay out a strong case that the Bush administration's concept of how to engage with the world is is at its core, preventative, rather than reactive.  In theory, this seems like a great plan.  In practice Cole and Lobel show how it inevitably undermines the concepts of justice on which our society is founded, as well as our reputation with the rest of the world.  That is, it is not merely a practical failure, it was inevitably going to be a practical failure.  Predictions are hard, especially about the future.  Reasonable people may disagree on the reasonableness of a preventative action.  The difficulty of reaching proof "beyond a reasonable doubt" about what would have happened undermines the legitimacy of claims about the future.
<p>
The essence of their argument is that prevention, be it preventative war, such as in Iraq, or preventative law enforcement, such as with the  justice, always requires the showing of evidence. You can't simply detain someone because they might in the future commit a crime. In a court, no single body acts as judge, jury and executioner.  Each party gets their day in court, with an opportunity to examine the evidence against them.  These things are impossible in the preventative paradigm.  Not only are <em>sources and methods</em> secret (sometimes with good reason), but the evidence is often lacking.  In the case of war, the court is that of public opinion in many places.  They also show a plethora of historical cases where preventative war went horribly wrong, and relate preventative war to a set of regimes with which no reasonable person wants to be associated.
<p>
The core reason which we demand that justice be reactive, or, at its fastest, at the instant of a crime, is that we rightfully fear the powers we invest in our government.  It is a mighty and fearsome machine which can crush anything in its path.  When it is allowed to do so, we are all less safe, and less free.
<p>
Two asides: I paid for both books, and I love the endnote styling of page number, excerpt, note used in <em>Bush's Law</em>.]]></description>
<dc:subject>books</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-04-30T01:10:12-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/04/everybody_run_crispins_go.html">
<title>Everybody Run, Crispin&apos;s Got a Blog</title>
<link>http://www.emergentchaos.com/archives/2008/04/everybody_run_crispins_go.html</link>
<description><![CDATA[My buddy, collaborator and co-worker <a href="http://crispincowan.com/">Crispin Cowan</a> has started a blog.  The first post is "<a href="http://blogs.msdn.com/crispincowan/archive/2008/04/28/uac-desert-topping-or-floor-wax.aspx">Security Is Simple: Only Use Perfect Software</a>."
<p>
[Update: Added a link to Crispin's home page, because some readers apparently have trouble with a search engine.]
<p>]]></description>
<dc:subject>blogging</dc:subject>
<dc:creator>adam</dc:creator>
<dc:date>2008-04-29T22:25:30-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/04/quantum_uncertainty.html">
<title>Quantum Uncertainty</title>
<link>http://www.emergentchaos.com/archives/2008/04/quantum_uncertainty.html</link>
<description><![CDATA[<p>Technology Review has a pair of articles on <a href="http://www.dwavesys.com/">D-Wave</a>'s adiabatic quantum computer. Quantum pioneer Seth Lloyd writes in "<a href="http://www.technologyreview.com/Infotech/20590/page1/">Riding D-Wave</a>" about quantum computing in general, adiabatic quantum computing, and D-Wave's efforts to show that they've actually built a quantum computer.

<p>Linked to that is Scott Aaronson's article, "<a href="http://www.technologyreview.com/Infotech/20587/">Desultory D-Wave</a>," in which Lloyd's nail-biting is made a bit more plain. I hate giving away the punch line, but here's what Aaronson sums up with:

<p><blockquote> Let me be clear: I think that quantum computers are possible in principle, and that D-Wave's approach might even get us there. I've also met people from D&#8209;Wave; I don't think they're frauds. But the human capacity for self-deception being what it is, scientists train themselves to look for red flags--and D-Wave is pretty much a red-flag factory.</blockquote>

<p>Beyond that, there's a new paper that shows problems not in just one <em>implementation</em> of quantum computing, but about its very theoretical core. In "<a href="http://arxiv.org/pdf/0804.3076v1">Operator Imprecision and Scaling of Shor's Algorithm</a>," authors <a href="http://arxiv.org/find/quant-ph/1/au:+Hill_C/0/1/0/all/0/1">C. Ray Hill</a> and <a href="http://arxiv.org/find/quant-ph/1/au:+Viamontes_G/0/1/0/all/0/1">George F. Viamontes</a> claim that Shor's Algorithm doesn't work at an interesting scale. 

<p>The reason is that errors in the quantum fourier transforms accumulate faster than quantum error correcting codes can get rid of them, particularly when factoring the sort of numbers that a sane person might use for a public key. Hill and Viamontes seem to think that it is not possible to factor a key much more than 256 bits in length. Most importantly of all, the errors accumulate linearly with the number of quantum operations and the number of operations increases polynomially with the size of the integer. My peeks at the error rate graph lead me to guess that a hard limit is reached before you get to a 512-bit number, which is no longer considered interesting using conventional sieve methods.

<p><a href="http://arxiv.org/abs/0804.3076">Here is their abstract</a>:

<p><blockquote>Shor's algorithm (SA) is a quantum algorithm for factoring integers. Since SA has polynomial complexity while the best classical factoring algorithms are sub-exponential, SA is cited as evidence that quantum computers are more powerful than classical computers. SA is critically dependent on the Quantum Fourier Transform (QFT) and it is known that the QFT is sensitive to errors in the quantum state input to it. In this paper, we show that the polynomial scaling of SA is destroyed by input errors to the QFT part of the algorithm. We also show that Quantum Error Correcting Codes (QECC) are not capable of suppressing errors due to operator imprecision and that propagation of operator precision errors is sufficient to severely degrade the effectiveness of SA. Additionally we show that operator imprecision in the error correction circuit for the Calderbank-Shor-Steane QECC is mathematically equivalent to decoherence on every physical qubit in a register. We conclude that, because of the effect of operator precision errors, it is likely that physically realizable quantum computers will be capable of factoring integers no more efficiently than classical computers.</blockquote>

<p>Hill and Viamontes also claim that this brings up a serious question about quantum computing in general. Take a deep
breath and read this:

<p><blockquote>It is natural to ask whether these results have wider implications about the power of quantum computers relative to classical computers. While the results presented in this paper do not answer this question definitively, it is important to note the singular stature of Shor&rsquo;s algorithm as the only quantum algorithm that appears to efficiently solve a classically intractable problem. The 
fact that Shor&rsquo;s algorithm is not more efficient than classical algorithms removes the only strong evidence for the superior computational power of quantum computers relative to classical 
computers.</blockquote>

<p>Wow. They have by no means the last word on this, but this means that quantum computing is going to get much more interesting as a spectator sport. And perhaps this fall's <a href="http://math.uc.edu/~aac/pqcrypto2008/">Post-Quantum Cryptography</a> workshop will be a little less interesting.]]></description>
<dc:subject>emergent chaos</dc:subject>
<dc:creator>mordaxus</dc:creator>
<dc:date>2008-04-29T00:50:45-05:00</dc:date>
</item>
<item rdf:about="http://www.emergentchaos.com/archives/2008/04/the_messenger_is_the_mess.html">
<title>The messenger is the message</title>
<link>http://www.emergentchaos.com/archives/2008/04/the_messenger_is_the_mess.html</link>
<description><![CDATA[<p>In a blog post entitled "<a href="http://www.banklawyersblog.com/3_bank_lawyers/2008/04/lending-tree-a.html">Lending Tree A Little Late In Cutting Off Network Access?</a>", I read that in the recent <a href="http://breachblog.com/2008/04/23/lendingtree.aspx">Lending Tree breach</a>:<br />
<blockquote><br />
several former employees may have helped a handful of mortgage lenders gain access to Lending Tree's customer information by sharing confidential passwords with the lenders.<br />
</blockquote></p>

<p>Later, the author describes "an obvious chink in Lending Tree's information security armor", (reprinting a U.S. News quotation from Brian Cleary):</p>

<blockquote>
These are former employees&mdash;how can those user accounts to critical customer data still be active? Those should be shut down. So, their access to all of the information and resources should be revoked on the day of their termination.
</blockquote><Cite><a href="http://www.usnews.com/blogs/the-collar/2008/4/24/a-letter-you-never-want-to-receive.html">USNews.com</a></cite>

<p>Finally, he observes that <br />
<blockquote><br />
If you're going to rely primarily on human beings to implement the policies, then you'd better make sure that those human beings are either themselves subject to checks and reviews to make certain that they're following the policies.<br />
</blockquote></p>

<p>All of this is nothing new to EC readers.  What surprised me, and what I think is noteworthy here, is that the guy writing this is not some CISSP, CISA, or even CISO.  He's the voice behind the <a href="http://www.banklawyersblog.com/">Bank Lawyer's Blog</a>, an attorney with banking and other corporate clients.</p>

<p>Not to read too much into this, but when the legal profession starts commenting knowledgeably about access termination policies, there's something interesting afoot.</p>

<p><br />
</p>]]></description>
<dc:subject>breach analysis</dc:subject>
<dc:creator>cwalsh</dc:creator>
<dc:date>2008-04-28T20:29:01-05:00</dc:date>
</item>


</rdf:RDF>