security

The way to trick smart people

From Paul’s “The easiest way to fool smart people“:

There’s a saying among con-men that smart people are easier targets, because they don’t think they can be conned.

I’m not sure if that’s true, but there’s one scam that’s almost guaranteed to make smart people switch off their brains and reach for their wallets. It’s a trick that’s used so pervasively in our culture, that once you become aware of it, you start to see it everywhere. …

Most smart people have a hidden weakness and it’s this – they’re absolute suckers for anything that sounds clever.

As soon as you start hitting people with technical terms, fancy graphs, famous names and the like, you’ll immediately increase your credibility. If they’re smart, they’re even more likely to find themselves nodding in agreement. Many intelligent people would rather cut off a finger than admit they don’t know what you’re talking about. …

Even better, they can pretend to be teaching their audience something important. A person who was previously completely ignorant about quantum physics now feels as if they understand something about it – even if that something is absolute baloney. The audience have been fed ideas they’ll now defend even against someone who’s a real expert in that subject. Nobody likes to be told that something they’ve been led to believe is wrong. …

Consultants behave this way because they know that’s how to get a sale. Bombard people with clever-sounding stuff they don’t really understand, and they’ll assume that you’re some kind of genius. It’s a great way of making money.

Stock analysts, economic forecasters, management consultants, futurologists, investment advisors and so on use this tactic all the time. It’s their chief marketing strategy for the simple reason that it works.

The way to trick smart people Read More »

Google’s data trove tempts the bad guys

From “Fuzzy maths” (The Economist: 11 May 2006):

Slowly, the company is realising that it is so important that it may not be able to control the ramifications of its own actions. “As more and more data builds up in the company’s disk farms,” says Edward Felten, an expert on computer privacy at Princeton University, “the temptation to be evil only increases. Even if the company itself stays non-evil, its data trove will be a massive temptation for others to do evil.”

Google’s data trove tempts the bad guys Read More »

Why it’s hard for prisoners to sue prison systems

From Daniel Brook’s “The Problem of Prison Rape” (Legal Affairs: March/April 2004):

When inmates seek civil damages against the prison system, as [Roderick Johnson, a 35-year-old African-American who is suing the Texas Department of Criminal Justice] has done, they must prove not merely that prison officials should have done more to prevent abuse but that they showed “deliberate indifference” – that is, that they had actual knowledge that an inmate was at risk and disregarded it. Showing that a prison guard should have known is not enough, no matter how obvious the signs of abuse.

This standard was established by the Supreme Court in the 1994 case Farmer v. Brennan, in which a transsexual inmate imprisoned for credit card fraud sued federal prison officials for ignoring his rape behind bars. While the court affirmed that prison rape is a violation of an inmate’s constitutional rights and stated plainly that sexual assault is “not part of the penalty that criminal offenders pay for their offenses,” it set up formidable barriers to establishing the culpability of corrections staff. At the cellblock level, the “deliberate indifference” standard discourages prison guards from shining a light into dark corners. What they don’t know can’t hurt them.

Why it’s hard for prisoners to sue prison systems Read More »

History & numbers on prison rape

From Daniel Brook’s “The Problem of Prison Rape” (Legal Affairs: March/April 2004):

In his 18 months at [the maximum-security Allred Unit in Iowa Park, Tex.], [Roderick Johnson, a 35-year-old African-American who is suing the Texas Department of Criminal Justice] did time as the property of the Bloods, the Crips, the Mandingo Warriors, and the Mexican Mafia, all of whom forced him to have sex with their members. They also sold his services to other inmates, usually for between $5 and $10. (A cigarette in Allred goes for $1.50.) …

The prevalence of rape in prison is fearsome. Line officers recently surveyed in one southern state estimated that one in five male prisoners were being coerced into sex; among higher-ranking officials, the estimate was one in eight. Prisoners themselves estimated one in three. (Female prisoners are the victims of rape as well, though they are usually assaulted by male guards, not other inmates; the phenomenon of male-on-male prison rape is generally studied separately.) …

The traditional rationale for prison rape is the lack of women, but most psychologists consider this facile. They see prison rape mainly as a means by which people who have been stripped of control over the most basic aspects of their lives – when to eat a meal, take a shower, or watch TV – can reclaim some sense of power. As one Louisiana prisoner, Wilbert Rideau, wrote, “the psychological pain involved in such an existence creates an urgent and terrible need for reinforcement of [a prisoner’s] sense of manhood and personal worth.” Others believe that prisoners become rapists out of fear of becoming victims themselves; it’s a choice between becoming predator or prey. The psychologist Daniel Lockwood, in his study Prison Sexual Violence, calls this strategy “pre-emptive self-defense.” …

IN 1826, IN WHAT WAS LIKELY THE FIRST PUBLISHED MENTION of prison rape in the history of the republic, the Rev. Louis Dwight wrote that “Boys are Prostituted to the Lust of old Convicts” throughout the institutions he surveyed from Massachusetts to Georgia. Dwight, the founder of the Prison Discipline Society of Boston, a prison reform group, wrote that “Nature and humanity cry aloud for redemption from this dreadful degradation.” It was not until the 21st century, however, that the nation saw its first anti-prison-rape legislation.

Last year, Congress passed the Prison Rape Reduction Act, which allocates $60 million to support rape-prevention programs run by federal, state, and local corrections staff and to aid investigations and punishment of perpetrators. The bill, which enjoyed bipartisan support in the House and the Senate, also requires states to collect statistics on prison rape.

History & numbers on prison rape Read More »

Arnold Rothstein, criminal kingpin

From Daniel A. Nathan’s “The Big Fix” (Legal Affairs: March/April 2004):

THE BLACK SOX SCANDAL was the sports crime of the 20th century. In a complicated and poorly conceived and executed conspiracy, several prominent Chicago White Sox ballplayers teamed up with gamblers to lose the 1919 World Series to the Cincinnati Reds. …

Of those artfully deceitful manipulators, Arnold Rothstein was the most skillful, a criminal kingpin who had his hand in all manner of illicit endeavors. Known as “the Big Bankroll” and “the Great Brain,” Rothstein helped invent organized crime, and his influence survived his death in 1928. …

There is no denying that Rothstein was clever. A former pool shark, Rothstein managed to graduate from being a small-time bookmaker to what one historian describes as an important “intermediary between the underworld and upper world of New York.” He established successful gambling houses in New York City and Saratoga (then, as now, a popular summer resort town for the well-to-do, especially for those who like to play the ponies) and political connections with Tammany Hall. Rothstein, Pietrusza notes, “pretty much invented the floating crap game,” the illicit diversion later made famous by the Broadway musical Guys and Dolls, on his way to becoming “America’s most notorious gambler.” He was a bootlegger, a labor racketeer, a racetrack owner, a real estate magnate, a bail bondsman, a loan shark, a fence, and, according to [David Pietrusza, author of Rothstein: The Life, Times, and Murder of the Criminal Genius Who Fixed the 1919 World Series], the “founder and mastermind of the modern American drug trade.”

Arnold Rothstein, criminal kingpin Read More »

iSee: online map of CCTVs in Manhattan

From Patrick Keefe’s “Camera Shy” (Legal Affairs: July/August 2003):

One extralegal solution is a project called iSee. Launched several years ago, iSee is an online interactive map of the locations of surveillance cameras in Manhattan. To use iSee, you simply open the map of Manhattan and double-click on your point of departure and your destination. After a few moments of computation, iSee generates the “path of least surveillance.”

iSee can be accessed through the website of the organization which created it, the so-called Institute of Applied Autonomy. IAA is a collective of artists, engineers, and scientists who design technologies for the “burgeoning market” of “cultural insurrection.” The organization presents itself as a tech-savvy civil libertarian answer to the Defense Advanced Research Projects Agency, a shadowy R&D wing of the Pentagon. DARPA has recently been in the news for developing the Terrorist Information Awareness project, headed by John Poindexter, which would monitor the everyday transactions of American citizens. Whereas DARPA uses what IAA calls “tools of repression” to take your autonomy away, IAA answers with another set of tools that are intended to give you your autonomy back. …

iSee: online map of CCTVs in Manhattan Read More »

In Britain, you can see footage of you captured by CCTV

From Patrick Keefe’s “Camera Shy” (Legal Affairs: July/August 2003):

In London, a city even more intensively scrutinized by closed-circuit television cameras than New York, citizens can at least retrieve copies of footage taken of them through a provision in Britain’s Data Protection Act. Americans have no such legal recourse. …

In Britain, you can see footage of you captured by CCTV Read More »

The history of solitary confinement

From Daniel Brook’s “A History of Hard Time” (Legal Affairs: January/February 2003):

Dickens wasn’t the first European intellectual who had crossed the Atlantic to visit Eastern State Penitentiary. A decade earlier, Alexis de Tocqueville had been sent by the French government to study the Philadelphia prison. …

What drew the attention of Americans and Europeans was an innovative method of punishment being pioneered at the prison called solitary confinement. While the practice had roots in medieval monasteries, where it was used to punish disobedient monks, solitary confinement came to prominence as a form of criminal punishment in the United States soon after the Revolution. …

In colonial America, capital punishment had been common, and not just for murder – burglary and sodomy could earn an offender the death penalty as well. For less serious offenses, criminals were generally subjected to physical punishments meted out on the public square. In a frontier nation of small towns, public embarrassment was seen as the key to deterring crime. Physical punishment, whether in the form of the stockade or the whipping post, was combined with the psychological punishment of being shamed in front of the community. Jails existed, but they were used mainly to hold criminals before trial and punishment. There were no cells and few rules: Men and women were housed together, and alcohol was often available. …

In 1787, at a soiree held in Benjamin Franklin’s living room, [Dr. Benjamin Rush of Philadelphia, a signatory of the Declaration of Independence & widely regarded as America’s foremost physician] presented an essay titled, “An Enquiry Into the Effects of Public Punishments Upon Criminals, and Upon Society.” Rush declared that “crimes should be punished in private, or not punished at all.” He claimed that public punishment failed to rehabilitate the criminal and risked letting the convict become an object of community sympathy. In lieu of public, physical punishments, Rush endorsed the creation of a “house of repentance.” Grounded in the Quaker principle that each individual is blessed with “Inner Light,” Rush envisioned a place of anonymity, solitude, and silence, where prisoners could dwell on their crimes, repent, and return rehabilitated into society. …

In 1821, the reformers finally convinced the Pennsylvania legislature to approve funding for Eastern State Penitentiary, which would be the largest public building in the country; with a price tag of nearly $800,000, it was likely the most costly one as well. No expense was spared: To prevent disease, each cell in the new prison was equipped with a toilet, a rare luxury at the time. When the penitentiary opened in 1829, President Andrew Jackson was still using an outhouse on the White House lawn.

The principles of the penitentiary system – silence, solitude, surveillance, and anonymity – were incorporated into the architectural plan. Eastern State was designed by John Haviland, a young architect, who proposed a hub-and-spokes model that allowed for constant surveillance. Inmates were housed in 8-by-12-foot cells arranged along a series of cellblocks radiating out from a central observation tower.

Each prisoner remained in his cell at all times, save for a brief daily exercise period held in an individual pen adjoining each cell. Prisoners ate their meals in their cells and did small-scale prison labor there like shoemaking. On the rare occasions when prisoners were allowed to leave their cells, they were prevented from interacting with other prisoners by hoods they were forced to wear to protect their anonymity. They were also forced to use numbers instead of names for the same reason. Silence was maintained at all times in the prison, and reading the Bible was the only activity other than labor that was permitted. Reformers believed that cutting inmates off from the world would foster meditation that would lead to rehabilitation, so visits from family or friends were prohibited. On average, inmates spent two to four years alone in their cells, underneath a single round skylight, known in the prison as the “eye of God.”

The expense of the building limited its influence in the United States, but Eastern State was widely copied in Europe and even in Latin America and Japan, where economic conditions made the model more attractive. Over 300 prisons were built on Eastern States’ hub-and-spokes model, in cities as diverse as London, Paris, Milan, St. Petersburg, and Beijing. Architectural historians consider the hub-and-spokes penitentiary to be the only American building type to have had global influence until the first skyscrapers began to rise in Chicago and New York in the 1880s. …

Dickens, who also interviewed prisoners at Eastern State, was far more skeptical. In his travelogue, American Notes, he described Philadelphia’s system of “rigid, strict, and hopeless solitary confinement” as “cruel and wrong.” …

Dickens didn’t accept that the penitentiary represented human progress over the days of floggings on the public square, or as his prose suggested, even the medieval torture chamber. “I hold this slow and daily tampering with the mysteries of the brain to be immeasurably worse than any torture of the body.” …

In New York, at the Auburn prison near Syracuse and later at Sing Sing in Westchester County, a modified system of solitary confinement was being put into practice. While inmates spent their nights in solitary cells, they worked together silently in a common area during the day. This allowed wardens to set up profitable prison industries that could offset the costs of prison construction. …

Despite this vehement defense of the solitary system, in the period after the Civil War, the regimen at Eastern State was slowly abandoned. … Without enough funding to keep the system running, inmates were frequently doubled up in cells. In 1913, the solitary system was officially abandoned. Solitary confinement became a short-term punishment for misbehaving prisoners rather than the prison’s standard operating procedure. …

More than half of all U.S. prisons in use today were built in the past 25 years, to house a prison population that has risen almost 500 percent over roughly the same period. The United States has the highest incarceration rate in the world. In raw numbers, it has more prisoners than China, a country with over four times as many people. …

Supermax prisons – high-tech, maximum-security facilities – were the answer politicians and corrections departments were looking for to solve the problem of increasing violence in prisons. Following Marion’s lead, corrections departments around the country began building supermax prisons, or adding supermax wings to their existing prisons to handle the growing number of violent prisoners who could not be controlled in the traditional prison system. Today there are 20,000 supermax inmates in the United States, roughly 2 percent of the total prison population, though in some states the proportion is much higher: In Mississippi, 12 percent of prisoners live in supermax units.

The system of punishment in supermax units resembles nothing so much as the system of punishment pioneered at Eastern State. The Pelican Bay Security Housing Unit, which cost California taxpayers a quarter of a billion dollars, is perhaps the most notorious supermax. From the air it looks like a high-tech version of the Philadelphia prison: Its hub-and-spokes design is clearly descended from John Haviland’s 19th-century architectural plan. Inmates in the SHU (known as “the shoe”) are kept in their cells close to 24 hours a day. As at Eastern State, inmates eat in their cells and exercise in isolated attached yards. …

Dr. Stuart Grassian, a Harvard Medical School psychiatrist who was given access to SHU inmates to prepare for providing expert testimony in lawsuits against the California Department of Corrections, has concluded that the regimen in security housing units drives prisoners insane, and he estimates that one-third of all SHU inmates are psychotic. He writes of what he calls “the SHU syndrome,” the symptoms of which include self-mutilation and throwing excrement.

Dr. Terry Kupers, a psychiatrist who has interviewed supermax inmates, writes that a majority of inmates “talk about their inability to concentrate, their heightened anxiety, their intermittent disorientation and confusion, their experience of unreality, and their tendency to strike out at the nearest person when they reach their ‘breaking point.’ ” Even those inmates who don’t become psychotic experience many of these symptoms. Those least likely to become mentally ill in solitary confinement are prisoners who can read, because reading prevents the boredom that can lead to insanity. (The human psyche appears not to have changed since the days of Eastern State, when an inmate told Alexis de Tocqueville that reading the Bible was his “greatest consolation.”) Because roughly 40 percent of U.S. prisoners are functionally illiterate, however, reading can provide solace and sanity to only a fraction of those behind bars.

The history of solitary confinement Read More »

Alcatraz: reality & Hollywood

From Dashka Slater’s “Lights, Camera, Lockdown” (Legal Affairs: May/June 2003):

The first two Alcatraz films, Alcatraz Island and The Last Gangster, arrived in theaters in 1937; the most recent, Half Past Dead, came out last November. In the 65 years in between, Alcatraz has been the subject of some two dozen movies and has made guest appearances in many more. There have been prison movies, horror movies, comedies, romances, action films, cartoons, and even porn flicks set on Alcatraz. It’s rare for a Hollywood set to last even a few weeks after a film is complete, but the prison is so popular with filmmakers that a meticulous replica of its cellblock, first created for the Clint Eastwood film Escape From Alcatraz, has resided on a Culver City soundstage for more than 20 years. It has provided penal ambience for hundreds of movies, television shows, commercials, and music videos. …

THE FEDERAL PENITENTIARY AT ALCATRAZ opened on August 22, 1934. It was to be a prison like no other, a high-tech, escape-proof, super-maximum warehouse for the nation’s most incorrigible bad guys. …

The secrecy had been designed to deflate the celebrity reputations of gangsters like Al Capone, who had enjoyed special treatment at other prisons. James A. Johnston, the prison’s first warden, believed that egoism was the chief failing of recidivists. His prescription was total isolation and total anonymity. At Alcatraz, he promised, Capone and his ilk would become “forgotten men.” …

The articles emphasized the prison’s harshness and brutality, chronicling its excruciating rule of silence, which required prisoners to stay mute except during a two-hour recreation period on Sundays, and describing the dank “Spanish dungeons” where prisoners were sent for disobeying rules.

Many of these accounts were embellished, and some of the more lurid tales were pure fabrications. Alcatraz was tough but not barbaric. Inmates were guaranteed the basics of food, shelter, clothing, and medical attention; everything else – work, exercise, visitors – had to be earned. Minor infractions – failing to finish the food on your plate, talking while in the cellhouse, sassing a guard – brought a swift reduction in privileges. More serious violations, like taking a swing at a guard, sent prisoners to the chilly darkness of “the hole.” Particularly obstreperous prisoners were hosed down with cold water from the bay, a practice that earned the warden the nickname “Saltwater” Johnston.

Alcatraz was hardly a country club, but it was still one of the better-run prisons in the United States. Inmates had their own cells, an improvement over bunking with another con. These five-by-nine-foot cells were cramped, but each had its own light and running water, and prisoners could order as many books as they wanted from the prison library. The cellblock was kept at a comfortable 70 degrees and the food was considered some of the best in the prison system. …

Throughout the ’30s, ’40s, and ’50s, films like Train to Alcatraz, Prison Train, King of Alcatraz, San Francisco Docks, and The House Across the Bay picked up the mythology of the “Inside Alcatraz” accounts and ran with it, depicting the prison as a place that made even hardened cons quake in their leg irons. …

… fewer than 300 prisoners [were] kept there at any one time …

The island’s reputation was increasingly out of step with the times, and the prison was facing more tangible problems as well. After years of exposure to the salt air, the fortress was literally falling apart, and the cost of repairs was prohibitive. The prison closed in 1963 …

IN 1972, AFTER LANGUISHING IN BUREAUCRATIC LIMBO for nearly a decade, Alcatraz became a national park, a move that allowed Hollywood to begin making movies on the Rock itself. …

The Park Service originally thought interest in the prison would peter out within five years. Instead, the park receives 1.5 million visitors a year, about five times as many as Antietam or Little Big Horn and nearly as many as Mt. Rushmore. …

Hollywood is responsible, in large part, for making the former penitentiary recognizable as a prison rather than just a decaying collection of empty Depression-era buildings. Escape From Alcatraz brought fresh coats of paint to the mess hall and D block, as well as the yellow stripes (which never existed when the prison was open) that now run down the main cellhouse corridor. Murder in the First funded the restoration of a guard tower on the dock, and The Rock paid for the removal of hazardous waste. Leftover Hollywood props – metal detectors, cell cots, benches, even pillows – have stayed on as permanent adornments, giving tourists a sense of what the penitentiary was like when it was operating. Over time it has become difficult to distinguish Hollywood’s Alcatraz from the real one.

Alcatraz: reality & Hollywood Read More »

Modern mercenaries

From Rebecca Ulam Weiner’s “Sheep in Wolves’ Clothing” (Legal Affairs: January/February 2006):

YOU WON’T FIND THE WORD “MERCENARY” on the homepage of the International Peace Operations Association, the trade group for the private military industry. While many of the IPOA’s member companies are staffed by elite former soldiers of the United States military who now make a living hiring themselves out, the so-called “M word” isn’t in the IPOA’s corporate vocabulary. Members are known as private military companies (often called PMCs) or military service providers, who specialize in “private peace operations.” …

In recent years, private contractors have increasingly taken on important military functions, operating in some 50 countries and earning an estimated $100 billion in annual revenue. They provide security to civilian aid workers, other contractors, and even military forces. They train local armies for combat, develop future American soldiers (the firm MPRI helps run ROTC), and interrogate prisoners. At times, they’ve engaged in combat. During the invasion and occupation of Iraq, the U.S. has relied heavily on their support – private contractors make up a workforce of about 20,000, double the British troop presence. …

During the Iraq war, contractors have run the computers that control Predator drones, operated guided missile systems on naval ships, and maintained aerial surveillance and communications systems. In the Persian Gulf war of 1991, the ratio of soldiers to contractors was 50 to 1. In the current Iraqi conflict, it is 10 to 1 and falling.

This proliferation has worried many – in the academy, Congress, the media, and, increasingly, the military – because contractors operate outside the military chain of command and most legal jurisdictions. PMCs have no clear place under the framework of the Geneva Conventions – they aren’t noncombatants, because they carry weapons, but they aren’t lawful combatants, because they don’t wear uniforms. Nor do they fit the anachronistic definitions of mercenaries found in international treaties and resolutions, because those definitions generally require engagement in direct combat.

Soldiers are subject to rules of engagement and can be court-martialed for breaking the law. Contractors are governed most directly by the terms of their contracts – their extraterritorial activities and corporate status make them virtually immune from federal law. …

Worse, critics argue, because the military has no direct control over its contractors, it won’t accept responsibility for their actions. And PMCs allow the Pentagon to evade accountability to Congress, because they circumvent caps on the number of troops approved for deployment and their casualties aren’t counted.

Modern mercenaries Read More »

Court acceptance of forensic & biometric evidence

From Brendan I. Koerner’s “Under the Microscope” (Legal Affairs: July/August 2002):

The mantra of forensic evidence examination is “ACE-V.” The acronym stands for Analysis, Comparison, Evaluation, and Verification, which forensic scientists compare with the step-by-step method drilled into countless chemistry students. “Instead of hypothesis, data collection, conclusion, we have ACE-V,” says Elaine Pagliaro, an expert at the Connecticut lab who specializes in biochemical analysis. “It’s essentially the same process. It’s just that it grew out of people who didn’t come from a background in the scientific method.” …

Yet for most of the 20th century, courts seldom set limits on what experts could say to juries. The 1923 case Frye v. United States mandated that expert witnesses could discuss any technique that had “gained general acceptance in the particular field in which it belongs.” Courts treated forensic science as if it were as well-founded as biology or physics. …

In 1993, the Supreme Court set a new standard for evidence that took into account the accelerated pace of scientific progress. In a case called Daubert v. Merrell Dow Pharmaceuticals, the plaintiffs wanted to show the jury some novel epidemiological studies to bolster their claim that Merrell Dow’s anti-nausea drug Bendectin caused birth defects. The trial judge didn’t let them. The plaintiff’s evidence, he reasoned, was simply too futuristic to have gained general acceptance.

When the case got to the Supreme Court, the justices seized the opportunity to revolutionize the judiciary’s role in supervising expert testimony. Writing for a unanimous court, Justice Harry Blackmun instructed judges to “ensure that any and all scientific testimony or evidence admitted is not only relevant, but reliable.” Daubert turned judges into “gatekeepers” responsible for discerning good science from junk before an expert takes the stand. Blackmun suggested that good science must be testable, subject to peer review, and feature a “known or potential rate of error.” …

There are a few exceptions, though. In 1999, Judge Nancy Gertner of the Federal District Court in Massachusetts set limits on the kinds of conclusions a handwriting expert could draw before a jury in United States v. Hines. The expert could point out similarities between the defendant’s handwriting and the writing on a stick-up note, the judge said, but she could not “make any ultimate conclusions on the actual authorship.” The judge questioned “the validity of the field” of handwriting analysis, noting that “one’s handwriting is not at all unique in the sense that it remains the same over time, or unique[ly] separates one individual from another.”

Early this year, Judge Pollak stunned the legal world by similarly reining in fingerprint experts in the murder-for-hire case United States v. Plaza. Pollak was disturbed by a proficiency test finding that 26 percent of the crime labs surveyed in different states did not correctly identify a set of latent prints on the first try. “Even 100 years of ‘adversarial’ testing in court cannot substitute for scientific testing,” he said. He ruled that the experts could show the jury similarities between the defendants’ prints and latent prints found at the crime scenes, but could not say the prints matched. …

… the University of West Virginia recently offered the nation’s first-ever four-year degree in biometrics …

Court acceptance of forensic & biometric evidence Read More »

5 reasons people exaggerate risk

From Bruce Schneier’s “Movie Plot Threat Contest: Status Report“:

In my book, Beyond Fear, I discusse five different tendencies people have to exaggerate risks: to believe that something is more risky than it actually is.

1. People exaggerate spectacular but rare risks and downplay common risks.
2. People have trouble estimating risks for anything not exactly like their normal situation.
3. Personified risks are perceived to be greater than anonymous risks.
4. People underestimate risks they willingly take and overestimate risks in situations they can’t control.
5. People overestimate risks that are being talked about and remain an object of public scrutiny.

5 reasons people exaggerate risk Read More »

Matching identities across databases, anonymously

From MIT Technology Review‘s’ “Blindfolding Big Brother, Sort of“:

In 1983, entrepreneur Jeff Jonas founded Systems Research and Development (SRD), a firm that provided software to identify people and determine who was in their circle of friends. In the early 1990s, the company moved to Las Vegas, where it worked on security software for casinos. Then, in January 2005, IBM acquired SRD and Jonas became chief scientist in the company’s Entity Analytic Solutions group.

His newest technology, which allows entities such as government agencies to match an individual found in one database to that same person in another database, is getting a lot of attention from governments, banks, health-care providers, and, of course, privacy advocates. Jonas claims that his technology is as good at protecting privacy as it as at finding important information. …

JJ: The technique that we have created allows the bank to anonymize its customer data. When I say “anonymize,” I mean it changes the name and address and date of birth, or whatever data they have about an identity, into a numeric value that is nonhuman readable and nonreversible. You can’t run the math backwards and compute from the anonymized value what the original input value was. …

Here’s the scenario: The government has a list of people we should never let into the country. It’s a secret. They don’t want people in other countries to know. And the government tends to not share this list with corporate America. Now, if you have a cruise line, you want to make sure you don’t have people getting on your boat who shouldn’t even be in the United States in the first place. Prior to the U.S. Patriot Act, the government couldn’t go and subpoena 100,000 records every day from every company. Usually, the government would have to go to a cruise line and have a subpoena for a record. Section 215 [of the Patriot Act] allows the government to go to a business entity and say, “We want all your records.” Now, the Fourth Amendment, which is “search and seizure,” has a legal test called “reasonable and particular.” Some might argue that if a government goes to a cruise line and says, “Give us all your data,” it is hard to envision that this would be reasonable and particular.

But what other solution do they have? There was no other solution. Our Anonymous Resolution technology would allow a government to take its secret list and anonymize it, allow a cruise line to anonymize their passenger list, and then when there’s a match it would tell the government: “record 123.” So they’d look it up and say, “My goodness, it’s Majed Moqed.” And it would tell them which record to subpoena from which organization. Now it’s back to reasonable and particular. ….

TR: How is this is based on earlier work you did for Las Vegas casinos?

JJ: The ability to figure out if two people are the same despite all the natural variability of how people express their identity is something we really got a good understanding of assisting the gaming industry. We also learned how people try to fabricate fake identities and how they try to evade systems. It was learning how to do that at high speed that opened the door to make this next thing possible. Had we not solved that in the 1990s, we would not have been able to conjure up a method to do anonymous resolution.

Matching identities across databases, anonymously Read More »

Killer search terms

From The Inquirer‘s “Killer phrase will fill your PC with spam”:

THERE IS ONE phrase which, if you type into any search engine will expose your PC to shed-loads of spam, according to a new report.

Researchers Ben Edelman and Hannah Rosenbaum reckon that typing the phrase “Free Screensavers” into any search engine is the equivalent of lighting a blue touch paper and standing well back. …

More than 64 per cent of sites that are linked to this phrase will cause you some trouble, either with spyware or adware. The report found 1,394 popular keywords searches found via Google, Yahoo, MSN, AOL and Ask that were linked to spyware or adware and the list is quite amusing. Do not type in the following words into any search engine:

Bearshare
Screensavers
Winmx
Limewire
Download Yahoo messenger
Lime wire
Free ringtones

Killer search terms Read More »

Problems with fingerprints for authentication

From lokedhs’ “There is much truth in what you say”:

The problem with fingerprints is that it’s inherently a very insecure way of authentication for two reasons:

Firstly, you can’t change it if it leaks out. A password or a credit card number can be easily changed and the damage minimised in case of an information leak. Doing this with a fingerprint is much harder.

Secondly, the fingerprint is very hard to keep secret. Your body has this annoying ability to leave copies of your identification token all over the place, very easy for anyone to pick up.

Problems with fingerprints for authentication Read More »

Why infosec is so hard

From Noam Eppel’s “Security Absurdity: The Complete, Unquestionable, And Total Failure of Information Security“:

A cyber-criminal only needs to identify a single vulnerability in a system’s defenses in order to breach its security. However, information security professionals need to identify every single vulnerability and potential risk and come up with suitable and practical fix or mitigation strategy.

Why infosec is so hard Read More »

Windows Metafile vulnerability

From Noam Eppel’s “Security Absurdity: The Complete, Unquestionable, And Total Failure of Information Security“:

On Dec. 27, 2005 a Windows Metafile (.WMF) flaw was discovered affecting fully patched versions of XP and Windows 2003 Web Server. Simply by viewing an image on a web site or in an email or sent via instant messenger, code can be injected and run on the target computer. The vulnerability was in the Windows Graphics Rendering Engine which handles WMF files, so all programs such as Internet Explorer, Outlook and Windows Picture and Fax viewer which process this type of file were affected.

Within hours, hundred of sites start to take advantage of the vulnerability to distribute malware. Four days later, the first Internet messenger worm exploiting the .wmf vulnerability was found. Six days later, Panda Software discovers WMFMaker, an easy-to-use tool which allows anyone to easily create a malicious WMF file which exploits the vulnerability.

While it took mere hours for cybercriminals to take advantage of the vulnerability, it took Microsoft nine days to release an out-of-cycle patch to fix the vulnerability. For nine entire days the general public was left with no valid defenses.

The WMF Flaw was a security nightmare and a cybercriminal dream.It was a vulnerability which (a) affected the large majority of Windows computers (b) was easy to exploit as the victim simply had to view an image contained on a web site or in an email, and (c) was a true zero-day with no patch available for nine days. During those nine days, the majority of the general population had no idea how vulnerable they were.

Windows Metafile vulnerability Read More »

IE unsafe 98% of the time

From Noam Eppel’s “Security Absurdity: The Complete, Unquestionable, And Total Failure of Information Security“:

The security company Scanit recently conducted a survey which tracked three web browsers (MSIE, Firefox, Opera) in 2004 and counted which days they were “known unsafe.” Their definition of “known unsafe”: a remotely exploitable security vulnerability had been publicly announced and no patch was yet available. Microsoft Internet Explorer, which is the most popular browser in use today and installed by default on most Windows-based computers, was 98% unsafe. Astonishingly, there were only 7 days in 2004 without an unpatched publicly disclosed security hole. Read that last sentence again if you have to.

IE unsafe 98% of the time Read More »

Even worse spam is coming

From Spam Daily News’s “Spam zombies from outer space“:

Spammers could soon use zombie computers in a totally new way. Infected computers could run programs that spy into a person’s email, mine it for information, and generate realistic-looking replies.

John Aycock, an assistant professor of computer science at the University of Calgary, and his student Nathan Friess conducted new research that shows it is possible to create a new type of spam that would likely bypass even the best spam filters and trick experienced computer users who would normally delete suspicious email messages.

There are two key reasons why spam is suspicious to anti-spam filters and human targets alike. First, it often comes from an unrecognized source. Second, it doesn’t look right.

The evolution of spam zombies will change this. These new zombies will mine corpora of email they find on infected machines, using this data to automatically forge and send improved, convincing spam to others.

The next generation of spam could be sent from your friends’ and colleagues’ email addresses – and even mimic patterns that mark their messages as their own (such as common abbreviations, misspellings, capitalization, and personal signatures) – making you more likely to click on a Web link or open an attachment.

What features can be easily extracted from an email corpus? There are four categories:

1. Email addresses. The victim’s email address and any other email aliases they have can be extracted, as can the email addresses of people with whom the victim corresponds.

2. Information related to the victim’s email program and its configuration. For example, the User-Agent, the message encoding as text and/or HTML, automatically-appended signature file, the quoting style used for replies and forwarded messages, etc.

3. Vocabulary. The normal vocabulary used by the victim and the people with whom they correspond.

4. Email style.

  • Line length, as some people never break lines;
  • Capitalization, or lack thereof;
  • Manually-added signatures, often the victim’s name;
  • Abbreviations, e.g., “u” for “you”;
  • Misspellings and typos;
  • Inappropriate synonyms, e.g., “there” instead of “their”;
  • Replying above or below quoted text in replies.

Even worse spam is coming Read More »

The Flash Worm, AKA the Warhol Worm

From Noam Eppel’s “Security Absurdity: The Complete, Unquestionable, And Total Failure of Information Security“:

In 2001, the infamous Code Red Worm was infecting a remarkable 2,000 new hosts each minute. Nick Weaver at UC Berkeley proposed the possibility of a “Flash Worm” which could spread across the Internet and infect all vulnerable servers in less than 15 minutes. A well engineered flash worm could spread worldwide in a matter of seconds.

The Flash Worm, AKA the Warhol Worm Read More »