Judge Orders God To Break Up Into Small Deities



WASHINGTON, DC—Calling the theological giant’s stranglehold on the religion industry “blatantly anti-competitive,” a U.S. district judge ruled Monday that God is in violation of anti-monopoly laws and ordered Him to be broken up into several less powerful deities.

“The evidence introduced in this trial has convinced me that the deity known as God has willfully and actively thwarted competition from other deities and demigods, promoting His worship with such unfair scare tactics as threatening non-believers with eternal damnation,” wrote District Judge Charles Elliot Schofield in his decision. “In the process, He has carved out for Himself an illegal monotheopoly.”

The suit, brought against God by the Justice Department on behalf of a coalition of “lesser deities” and polytheistic mortals, alleged that He violated antitrust laws by claiming in the Holy Bible that He was the sole creator of the universe, and by strictly prohibiting the worship of what He termed “false idols.”

“God clearly commands that there shall be no other gods before Him, and He frequently employs the phrase ‘I AM the Lord’ to intimidate potential deserters,” prosecuting attorney Geoffrey Albert said. “God uses other questionable strongarm tactics to secure and maintain humanity’s devotion, demanding, among other things, that people sanctify their firstborn to Him and obtain circumcisions as a show of faith. There have also been documented examples of Him smiting those caught worshipping graven images.”

Attorneys for God did not deny such charges. They did, however, note that God offers followers “unbeatable incentives” in return for their loyalty, including eternal salvation, protection from harm, and “fruitfulness.”

“God was the first to approach the Jewish people with a ‘covenant’ contract that guaranteed they would be the most favored in His eyes, and He handed down standards of morality, cleanliness, and personal conduct that exceeded anything else practiced at the time,” lead defense attorney Patrick Childers said. “He readily admits to being a ‘jealous’ God, not because He is threatened by the prospect of competition from other gods, but because He is utterly convinced of the righteousness of His cause and that He is the best choice for mortals. Many of these so-called gods could care less if somebody bears false witness or covets thy neighbor’s wife. Our client, on the other hand, is truly a ‘People’s God.'”

In the end, however, God was unable to convince Schofield that He did not deliberately create a marketplace hostile to rival deities. God’s attorneys attempted to convince the judge of His openness to rivals, pointing to His longtime participation in the “Holy Trinity,” but the effort failed when Schofield determined that Jesus Christ and the Holy Ghost are “more God subsidiaries than competitors.”

To comply with federal antitrust statutes, God will be required to divide Himself into a pantheon of specialized gods, each representing a force of nature or a specific human custom, occupation, or state of mind.

“There will most likely be a sun god, a moon god, sea god, and rain god,” said religion-industry watcher Catherine Bailey. “Then there will be some second-tier deities, like a god of wine, a goddess of the harvest, and perhaps a few who symbolize human love and/or blacksmithing.”

Leading theologians are applauding the God breakup, saying that it will usher in a new era of greater worshipping options, increased efficiency, and more personalized service.

“God’s prayer-response system has been plagued by massive, chronic backlogs, and many prayers have gone unanswered in the process,” said Gene Suozzi, a Phoenix-area Wiccan. “With polytheism, you pray to the deity specifically devoted to your concern. If you wish to have children, you pray to the fertility goddess. If you want to do well on an exam, you pray to the god of wisdom, and so on. This decentralization will result in more individualized service and swifter response times.”

Other religious experts are not so confident that the breakup is for the best, pointing to the chaotic nature of polytheistic worship and noting that multiple gods demand an elaborate regimen of devotion that today’s average worshipper may find arduous and inconvenient.

“If people want a world in which they must lay burnt offerings before an earthenware household god to ensure that their car will start on a cold winter morning, I suppose they can have it,” said Father Thomas Reinholdt, theology professor at Chicago’s Loyola University. “What’s more, lesser deities are infamous for their mercurial nature. They often meddle directly in diplomatic affairs, abduct comely young mortal women for their concubines, and are not above demanding an infant or two for sacrifice. Monotheism, for all its faults, at least means convenience, stability, and a consistent moral code.”

One deity who is welcoming the verdict is the ancient Greek god Zeus, who described himself as “jubilant” and “absolutely vindicated.”

“For thousands of years, I’ve been screaming that this third-rate sky deity ripped me off wholesale,” said Zeus, speaking from his Mt. Olympus residence. “Every good idea He ever had He took from me: Who first created men in his own image? Who punished mankind for its sins? Who lived eternally up in the clouds? And the whole fearsome, patriarchal, white-beard, thunderbolt thing? I was doing that eons before this two-bit hustler started horning in on the action.”

Lawyers for God say they plan to appeal Schofield’s ruling and are prepared to go all the way to the Supreme Court if necessary.

“This decision is a crushing blow to God worshippers everywhere, and we refuse to submit to a breakup until every possible avenue of argument is pursued,” Childers said. “I have every confidence that God will ultimately win, as He and His lawyers are all-powerful.”

(c) The Onion – reproduced in full in case “God” uses his powers.
http://www.theonion.com/onion3803/judge_orders_god.html

Pick of the week

Hard but the funniest of the week goes to :

bbspot.com
http://www.bbspot.com/News/2000/6/php_suspend.html

Runner up :

the eye
http://www.private-eye.co.uk/innews.htm

SCHOOL NEWS

St Hashcakes

Marijuana Term begins today. There are 1,207 users in the school. R.S.J. Dope-Ffiend (Rizlas) is Keeper of the Stash. P.L.R. Pothead (Roaches) is Captain of Reefers. Mr L.S. Dealer replaces Dr Methadone as Head of Chemistry. He will be organising the school trip. The Bong will be held on The Grass on 23rd February. There will be a performance of the School Play (“Trainspotting”) in the Uppers Hall on 7th March. Tickets can be obtained from the Bursar, Wing Commander “Spliffy” Spliffington O.C. Ecstasies will be on 7th March.

Identity right or wrong / just a thought 2

Continued from …
http://www.pythonesque.org/mx/jarchives/00000109.htm

Would you prefer to wait 15 minutes to get through security at an airport or walk through and get your iris scanned. Or will we have any choice? and when?

Thought
The supermarkets grumble that they PAY to give you “cash back” at the check-outs. So why don’t they become banks and issue their own credit cards and get access to all our spending habits and then not cop the “cash back” charges? Then they could also offer you a handy barcode scanning, bluetooth enabled phone to do your shopping with?

London bus syndrome I guess…

Saturday January 19 11:43 PM ET

AOL in Talks to Buy Linux Distributor Red Hat
WASHINGTON (Reuters) – Media and Internet titan AOL Time Warner Inc. (NYSE:AOL – news) is in negotiations to acquire Red Hat Inc.(Nasdaq:RHAT – news), a distributor of the alternative computer operating system Linux (news – web sites), the Washington Post reported citing unidentified sources familiar with the matter.

The talks were fluid and it was unclear how much AOL, which runs the biggest U.S. Internet service provider and the second-largest U.S. cable television system, would pay for Red Hat, the newspaper said.

Red Hat is the leading distributor of Linux, which unlike software such as rival Microsoft Corp.’s (Nasdaq:MSFT – news) Windows operating system, is an “open source” platform that anyone can change to suit their needs.

Spokespeople for the three companies declined to comment on the negotiations, the newspaper reported.

Linux has gained growing favor with businesses, especially to power the heavy-duty server computers that dish up Web pages and run corporate networks.
The attempted acquisition is the latest indication that AOL is seeking alternative software to that made by rival Microsoft, the maker of Windows which runs 90 percent of the world’s personal computers, the Washington Post said.

To counter Microsoft, AOL could couple its Internet service with Red Hat’s operating system technology and could be configured to override Windows while launching a version of Linux, sources told the newspaper.

http://dailynews.yahoo.com/h/nm/20020119/tc/tech_redhat_aoltimewarner_dc_1.html

The geeks and nerds gather to get their hands on OS X
Chris Gulker
21 January 2002

They’re the geeks, the dweebs, the nerds. They’re sporting greying ponytails and bald spots, sandals and sneakers, thick eyeglasses in unfashionable frames, Linux PDAs and BlackBerry pagers. The scene was San Francisco, where I stood in a mobbed Moscone Convention Center, sallow cheek by unshaven jowl with this scruffy crew.

It’s not that a bunch of hardcore geeks is anything new in my life; indeed, I’m proud to count myself among those who’ve curled up with 900-page tomes with titles such as Linux Unleashed and DNS and BIND (3rd edition).

And these guys are hardly strangers to Moscone, where events like Linuxworld and the Bluetooth Developers’ Conference are routinely held.

It’s just that the event in question was Macworld San Francisco, the western version of Apple’s two annual high holy events. (The eastern version is in New York, mid-year.) And while the Macintosh can claim its own nerdly community, it tends to attract a crowd that’s more Picasso than Einstein.

The Macworld regulars, sporting expensive suites and coiffures, edgy body jewellery and expensive leather, even tie-dye tops and ragged jeans, surround these hardcore geeks like girl scouts at a Taliban convention. It’s weird, it’s, uh, almost unholy.

What brings them together is an operating system: Apple’s new Mac OS X. The nerdly are here to grok (absorb) OS X’s BSD underpinnings (BSD: a free UNIX clone that will run most of the stuff written for Linux, the other, if more famous, free UNIX clone).

The good-hygiene set is here to inspect the radical, if super-hyped, new iMac, and maybe learn how to do snappier computer graphics and whizzier special effects, the Mac’s forte.

I have a foot in both camps: I became a lifelong Mac user while a photographer and layout editor at a San Francisco daily newspaper. Since my rebirth as a hi-tech start-up foot soldier, I’ve gone so far as to build Linux machines from scratch, for fun.

One Linux commentator, Doc Searls, noted this new union in a recent Linux Journal piece. Slashdot, the do-it-yourself web-site-of-record of the open source movement, posted a report from the floor of Macworld, and has run 30 items about Apple and OS X in the past 90 days.

A number of open source heavies are weathering the start-up nuclear winter with jobs as Apple engineers, including recent hire Bud Tribble, a highly-respected Silicon Valley computer scientist. His last billet was at Eazel, a Linux start-up that was one of the brightest stars in the once-blazing start-up constellation.

Eazel was at Apple before, with chief exec Steve Jobs, and left to co-found NeXT Computer with Jobs; OS X is largely built on NeXT’s operating system.

Eazel wasn’t the usual hype-fuelled dot.com: it wanted to make, and had the people who knew how to make, the software that would make cheap PC clones both powerful and easy to use by making Linux user-friendly.

For everyone in the Valley knows that Linux puts the planet’s most widespread operating system to complete and utter technical shame: it’s fast, crash-proof and completely immune to the full spectrum of Windows virus pathology.

What Linux isn’t, is easy to use. You think Windows isn’t easy to use? Then trust me, if Windows is high-school algebra, Linux is post-doctoral theoretical physics.

Eazel was going to make the programs that would make Linux easy. Then last May it ran out of cash and shut its doors.

Enter almost simultaneously (well, March) Mac OS X. Suddenly, Unix that’s easy came in sight. Last year, it took me a weekend to set up a Linux firewall. I had to type a very long recipe, gleaned from a Linux HOW-TO website to make it go. I recently set up a rather more sophisticated firewall on Mac OS X in 15 minutes, using point-and-click. The underlying technology is identical; it was just easier on the Mac.

Apple has managed to make “easy” powerful, more quickly than open sourcers made “powerful” easy. Geeks like it, artists like it. Whither the “rest of us”?

http://news.independent.co.uk/digital/reviews/story.jsp?story=115467

on the stop press soon …

… on the grapevine today Broadband Britain is arriving 🙂

256Mbits downstream £14.99/month
10Mb @ 512kb 1 euro
10Mb @ 8Mbits 3.5 euros

Don’t forget you heard it here @ PYTHONESQUE.org!

Identity right or wrong / just a thought

When the Internet came to by attention at the end of 1993. I got a funny feeling.
When Linux reared it head good and proper by 1997. I got a funny feeling.

Well my next biggest gut feeling is the relationship between the Cellphone/PDA/Network Operators and credit checking agencies.

I reckon that biometrics in the form of 3D iris scanning will be in cellphone in the next 5-10 years.

Why? Home banking.
You will provide the bank with your biometrics for your security to access your account.

Once the biometrics is integral to the phone other companies will leaverage the interface.
As a consummer you paid the extra on the phone for the extra security.

Maybe some retailers will “trust” the cell phone companies technology to get rid some small purchase transactions.

You may decide to trust the supermarket with your iris print to enable you to get through the check-outs quick or go through the underground or the metro.

There has got to be a relation between the credit agencies and the phone networks because they can provide some evidence of last address used and alot credit scores.

Will there be a time when a local Health Center brokers it’s address records with credit checking agencies for a source of revenue?

The cross-checking and fewer address changes you have, the higher your “identity rating” will become.

Your identity will reliant on just a few trusted databases.

Summary
We will individually trust many retailers to make our lives easier (who doesn’t have a credit card)
They will sell your records for cross-checking with the credit agencies (just as you allow credit card companies and banks to go digging)
The credit agencies collate these records on you as an individual
The credit agencies end up in a better position to identify you as an individual than the state does through your driving license and birth certificate.

Korrect or Krong?

Thoughts
Do the credit agencies have more benefit with merging with a global telco players? or
Do the global telcos/satelite telcos benefit more from merging with credit agencies?

The Referendum Party is dead – long live the Referendum Party

I was actually by the looks of it member number 454 of the Referendum Party founded by the late Jimmy Goldsmith who I had the pleasure of meeting when he launched the Party at his club near St James Park.

My invitation to that meeting was the result of reading his book “The Trap” and then hearing about his interview with Frost on a Sunday morning on ITV (Channel 3 in the UK). + A letter that got to him by way of addressing it to the House of Commons!

The 1st of Janurary 2002 marks a special day of the people of the United Kingdom.
The Euro is now legal tender and the pound sterling will be phased out by 2007 as I remember.

When the UK had a vote on Europe in 1973 my parent’s generation seemed to have been “brain” washed into thinking that voting to join the EEC was something to do with NATO and standing together when the preverbial hits the fan.

Now I can’t think the next Referendum will be any different in the UK. Besides the Labour party have already lied to the British people by not giving us a vote in the last parliament 1997-2001. It was it not in their manifesto for that election? Then they just prompt forgot about it?

“We will give Britain leadership in Europe
Referendum on single currency”

http://www.psr.keele.ac.uk/area/uk/man/lab97.htm
Google cache incase it goes

The original appears to have been at :
http://www.labour.org.uk/views/manifesto/

But of course they’ve “removed” it. 1984/Brazil style.

Oi Tony it’s 2002 and you STILL haven’t given us a vote – LET ALONE A FAIR ONE.

Are you for a Federal Europe?
I am believe it or not.

What am I worried about?
The pace of the economic Union of the EU will give rise to Communism.
Instead of trying to get another 4 member States in by 2004. Why can’t we do the process over 20 years?
Instead the UK is looking at economic ruin.

FACT
The UK has more private pension money invested by private individuals than all the other EU countries added together.

What does this mean?
In 10/20 years time as the population of Europe gets older each EU state will have a greater burden to look after their old people. This will come out of current tax yields in each country. If European countries can pull us in they will use our budget surplus to pay for their old because more of our old will be self funding. Or they will print money.

Side note
If the UK state thinks that they can sell the homes of old people to pay for their care – that’s another “hiding to nothing”, because ulimately it will drive property values to freeze or even decrease. This will then inturn knock down annuity rates paid on those who tried to save for themselves.

I want a Democracy in Europe not a Dictatorship run by unelected representatives of the people.

Common Agriculture Policy
“Under the CAP, European taxpayers spent £4.5 billion annually subsidizing farmers to overproduce food that is then sold cheaply outside the EU, but not inside it (Purnell, 22 June 1998). In 1997 fresh fruit and vegetables from the glut, to a value of £213 million, were destroyed to prevent these same taxpayers buying the food they had already partly paid for in taxes, at lower market prices.”
– Ian Angell, “The NEW Barbarian Manifesto

The European Union Common Agricultural Policy is vastly expensive and, it would seem, structurally corrupt. It is estimated that the C.A.P. adds more than £20 per week to the food bill of the average family in the “UK”. Scottish figures might well be higher, taking geographic and logistic factors into consideration.
http://www.siol-nan-gaidheal.com/agg.htm

Czechs reject CAP – June 1995
“The Common Agricultural Policy (CAP) is not an agricultural policy, but a social policy,” says Milan Svoboda of the Czech Agriculture Ministry’s strategy department. His viewpoint is consistent with the government’s view of CAP as a vehicle which serves the economic interests of one group (farmers and food processors) at the expense of the rest of society.

Prime Minister Vaclav Klaus in February told a gathering of 2,000 farmers and agricultural representatives that they cannot depend on government price guarantees. They will only enjoy the same conditions as farmers in the European Union when CAP is either changed or dismantled.
http://europa.eu.int/comm/dg10/eur_dial/95i2a0s1.html

“The Treaty of Rome creating the European Economic Community (EEC) in 1957 contained provision for a “common agricultural policy” (the CAP). This policy sought to increase the productivity of European agriculture, ensure reasonable living standards for farmers, stabilise farm produce markets and guarantee a stable food supply at fair prices for consumers.”
http://europa.eu.int/comm/dgs/agriculture/hist_en.htm

That’s from the Official Site – interesting eh? Or just plain !OLLOCKS?

CAP isn’t anything to do with a Federal Europe – I just personally suspect it’s a taste of what’s comming next…

Take The AQ Test – “The Geek Syndrome” – didn’t Nancy Kress have an angle on this sometime ago?

Following an interesting article on Autism and Asperger’s – “The Geek Syndrome”

http://www.wired.com/wired/archive/9.12/aspergers_pr.html

Psychologist Simon Baron-Cohen and his colleagues at Cambridge’s Autism Research Centre have created the Autism-Spectrum Quotient, or AQ, as a measure of the extent of autistic traits in adults. In the first major trial using the test, the average score in the control group was 16.4. Eighty percent of those diagnosed with autism or a related disorder scored 32 or higher. The test is not a means for making a diagnosis, however, and many who score above 32 and even meet the diagnostic criteria for mild autism or Asperger’s report no difficulty functioning in their everyday lives.

http://www.wired.com/wired/archive/9.12/aqtest.html

Agree: 2,4,6,7,9,12,16,18,19,23,41,43: 1 point
Disagree: 8,10,14,15,24,25,27,29,30,32,36,37,40,48: 1 point
Score: 26

See also

http://www.ctheory.net/text_file.asp?pick=27

Tech Flesh 5: An Interview with Nancy Kress
Eugene Thacker

CTheory: Your novel Beggars in Spain introduces readers to a genetically altered future of the “Sleepless,” a generation of individuals that are genetically modified to need no sleep, are highly intelligent, are resistant to many diseases…there are even intimations of immortality in the Sleepless. What was it about genetics and biotech that drew you to imagine the Sleepless? Why did you choose the particular characteristics that you did?

Nancy Kress: When I first conceived of the Sleepless, it was long before my interest in biotech. The motive was pure jealousy. I need a lot of sleep, and I envy short-sleepers. I always thought that if I could get by on six hours a night, I could accomplish so much more.

The other characteristics of the Sleepless, such as intelligence and health, are logical choices for any parent who is having a child genetically engineered. It seemed to me that if we could manipulate something as complex as sleep, we could also manipulate those characteristics. Near-immortality, however, was added as a plot device. I don’t really think that’s in our genes — no matter how we adjust them.

CTheory: The worlds of Sleepers and Sleepless in the trilogy are divided by what seems to be a form of genetic discrimination: the genetically-modified against the biologically natural. Do you see similar divisions playing themselves out in genetics, and in what ways?

Nancy Kress: Divisions are inevitable, and they will follow the same lines that divisions in quality of health care follow: finances. Just as many expensive elective treatments in health care are currently available to the rich but no one else, so will many forms of genetic enhancement, at least for a while. This is already happening. In some instances, people with “bad” genetic profiles have been denied health insurance. This is true even though they carry the genetic marker for the disease but have not yet developed it themselves. In the near future, court cases and government regulations are going to have to address issues of genetic privacy, insurance, and employment. They’re big issues.

CTheory: What are your own responses as a science fiction writer to the human genome project?

Nancy Kress: My response is tremendous excitement. I can’t imagine anyone not being interested in this understanding of the basis of life itself…and even more interested in the manipulation of life that will surely follow. In fact, it is already well underway. We are using somatic gene therapy to help disease victims whose bodies cannot make needed proteins. We are using choice-among-embryos in vitro fertilization to ensure couples who carry genetic diseases have a healthy baby. We have manipulated organisms into producing medicines. Just a few weeks ago as I write this, the first commercial sale of a cloned animal, a champion cow, took place in Iowa. As we learn more about the human genome than simply the long, long listing of its base pairs — as we learn where individual genes are located and what they do — we will gain more and more power to create health, abundance, and beauty for ourselves. My biggest regret is that I’m not going to be around for a thousand years to observe what happens.

CTheory: What social roles do you think science fiction can have in response to scientific fields such as genetics and biotech? As a writer, do you think of these domains as sharply divided, or close together?

Nancy Kress: They’re very close. Genetics decodes the DNA, identifying how our genes create proteins, switch on and off, and interact with each other. Biotech then puts this knowledge to practical use. Without genetics, biotech has nothing to work with. Without biotech, genetics has only limited funding.

Science fiction acts as a theoretical laboratory, a “thought experiment,” for exploring the implications of genetics and biotech. Those implications can be ethical, social, or biological. The function of SF — other than to be interesting literature! — is to say, “If we did this in science…then what?” SF writers thus predict not THE future (we have a pretty lousy track record at that) but a plethora of futures.

In addition, I’ve heard many scientists say they studied science because of an early interest in SF.

CTheory: Often in the mass media and in press releases from biotech corporations we are presented with a future in which biotech promises to be able to eradicate disease and improve health and even quality of life. But what do you see as the darkside of this research? What are some specific danger-zones that you see in current biotech and genetics research and application?

Nancy Kress: Some of the specific danger zones I already mentioned: discrimination on the basis of personal genetic information, and division between those who can afford biotech solutions and advantages and those who cannot. Another danger with plant biotech is that some super-resistant crop could begin to proliferate dangerously without enemies, taking over ecologies (of course, we already have that with kudzu and loosestrife, neither of which was engineered). A final, very real danger, is terrorism with genetically engineered viruses or parasites for which we have no antidotes (I wrote about this in my thriller Stinger).

CTheory: Much of biotech research gains its support — both scientific and economic — from the ways in which it says “this research will lead to these kinds of applications in the future…” Is there something that biotech could learn from SF here in terms of socially-conscious extrapolation? Is there something SF-like in this process of imagining the future?

Nancy Kress: Biotech already does do the same kind of extrapolation SF does (“What if we could get this bacteria to produce insulin?”), although in a much more limited and near-future way than SF’s wide scope. I can’t say whether or not drug companies wrestle with ethical extrapolations as well. So far, it hasn’t been very necessary — no one disputes the good of using biotech to cure or prevent diseases. The university labs are a different story: Witness the controversy over, as I write this, NIH-funded research on human stem cells. Universities also have proliferating bioethics departments to do exactly what SF does: imagine consequences of future genetic engineering.

CTheory: Although there have been many scientific utopias about genetics, it is rare that we see attempts to imagine workable futures. In Beggars in Spain, however, we see attempts by characters to bridge the gap that has divided the Sleepless from the rest of humanity. Do you see such attempts as possibilities with the effects of genetics and biotech?

Nancy Kress: Before we can reconnect, we have to divide. Genetic engineering is a long way from that. Our first germ-line attempts will undoubtedly be to correct defective genes in an embryo, something very few people would object to. Later, and gradually, will come altering such simple things as eye color. Later still, we may — or may not — learn to manipulate complex characteristics like intelligence. But all this will be private. It probably won’t be possible for a very long time to discern who is genetically modified and who is just born physically lucky — unless we do make such dramatic modifications as sleeplessness. But how will the real-world scenarios play themselves out? I have no idea. That’s why I wish I could be here to find out!

——————————————————————————–
Nancy Kress is the author of eighteen books: three fantasy novels, seven SF novels, two thrillers, three collections of short stories, one YA novel, and two books on writing fiction. She is perhaps best known for the “Sleepless” trilogy that began with Beggars in Spain. The novel was based on a Nebula and Hugo-winning novella of the same name; the series then continued with Beggars and Choosers and Beggars Ride.

In 1996 Kress temporarily switched genres to write Oaths and Miracles (Forge, 1996), a thriller about Mafia penetration of the biotech industry. This was followed in 1998 by Stinger (Forge/Tor), about the introduction of a genetically-engineered and very nasty form of malaria into Maryland. Her most recent book is Probability Moon, the start of a trilogy, which takes place off-World and includes such grand old SF tropes as aliens and a space war.

In short fiction, Kress has won three Nebulas and a Hugo. Her work has been translated into Swedish, French, Italian, German, Spanish, Portuguese, Polish, Croatian, Lithuanian, Romanian, Japanese, and Russian. She is the monthly “Fiction” columnist for Writer’s Digest magazine.

Eugene Thacker is an Assistant Professor in the department of Literature, Communication, and Culture at Georgia Tech. His writes on new media and biotechnology, and is a part of the art group Fakeshop.

Slack Blogger am I

Well here is the Pathe newsreel in Stills’o’Vision :

September
http://www.pythonesque.org/photos/index.cgi?mode=album&album=/2001/9%5fSeptember

October
http://www.pythonesque.org/photos/index.cgi?mode=album&album=/2001/10%5fOctober

November

December’s pics to follow…

Flat News :
Carpet Down
Bed arrived
Bathroom and Kitchen to go but otherwise completely inhabitable and clean

Py News :
She’s had some grades she’s been pleased about this term.
Work is hectic.

Christmas was reasonable cool see Py’s take on that.
She got me neat book on Time travel and a biography on John Clease.
+ Spookily a copy of Animal Farm, which I had also just got from a second hand shop the other day. So we now have a loan copy available!

I’ve just finish Tim Berners-Lee’s “Weaving the Web” book – favourite extract was this :

“Already the attention of people, the following of links, and the flow of money are interlaced inextricably.” P223

Whilst his quoted thoughts about the future are often on these lines :

“Tim Berners-Lee, the inventor of the World Wide Web, reminisces about designing the first Web protocols and predicts that the next Web revolution will be led by the Semantic Web, a system of organizing information for the sharing and processing of Web data across a variety of programs and applications.”
NetDigest

I think that this Semantic Web revolution will be a real “cusp” ride – one day the world will have it and it will be a very different scary place.

Full CNet story about “What will the Web be tomorrow?” :

http://news.cnet.com/news/0-1014-201-8155733-0.html

mathworld relaunched again

http://mathworld.wolfram.com/

Welcome Back to MathWorld!

Gentle Readers,

In late October 2000, MathWorld disappeared from the web. It remained shut down by a lawsuit for more than a year. That year was a nightmare for me–the worst period of my life. I can’t tell you how much I have wanted to be able to announce that MathWorld is back. And now I can. The ordeal is finally over. The web site is back up and running.

My first impulse is just to invite old friends and new visitors to plunge back in. We’ve lost a year’s worth of work on the web site–no small thing at the rate Todd Rowland and I were adding entries and you were contributing suggestions and material. All the more reason to get back to the business of adding to and enhancing the contents of MathWorld!

Please use and enjoy this unique resource. Help me make it better. That’s why I created MathWorld in the first place. That’s why Wolfram Research decided to sponsor it and me. And that’s why Wolfram Research devoted tremendous amounts of time and money this last year to get it back online.

My second impulse is to thank all of you who sent me what eventually became thousands of encouraging emails during this horrible year. MathWorld has been a major focus of my life for more than a decade. It was devastating to find myself in a lawsuit that could have destroyed a major part of my life’s work.

The support you transmitted through your emails was matched only by that I received at Wolfram Research. My colleagues rallied to the defense of MathWorld immediately and decisively, and Wolfram Research, a privately held company run by the innovators who built it, stood up for me and for the principles behind MathWorld.

Founder and CEO Stephen Wolfram took time away from his around-the-clock effort to complete his decade-long project and long-awaited book A New Kind of Science. Similarly, Theodore Gray, a key Mathematica developer, put aside his own projects for days on end to lend his expertise to fight for and defend MathWorld.

Before we all get back to work, I invite you to spend a few minutes with the detailed narrative I have written describing my ordeal over the last year. Why take the time to read this story? Read it because I’m fairly certain you don’t want to again lose this or any other online resources that you have come to rely upon. And believe me, if you ever assemble a body of knowledge that you want to share with others, you don’t want to go through what I have just gone through.

So welcome back! Plunge in, enjoy, learn, and help share and spread the wonder of mathematics. And if you can, please also join the effort to keep online resources like this up and available.

Best wishes,

Eric W. Weisstein
mathworld@wolfram.com
Encyclopedist
Wolfram Research, Inc.

it’s coming

Carpet ordered
Bed ordered
Matress ordered

(I meant my blog will start getting posted to again!)

MX

Thursday 11th October 2001

Grandma made her 91st birthday. (Pictures to follow)

Py and I visited her in South Hams Cottage Hospital around 6 then picked up a Chinese from Jasmine in Kingsbridge and went back to cc.

I bought her Alan Bennett’s biography and Py gave her the hand lotion she’d brought all the way back from the US. In the UK it’s horrendously expensive stuff!

Jedi Knights have gained official recognition as a religion in the UK Census 2001

Jedi Knights achieve official recognition as a religion
By Kieren McCarthy
(C) The Register 2001 (Craftily copied here – but I’m sure they won’t mind…)
Posted: 09/10/2001 at 10:33 GMT

Coming very near the bottom of an official list of religions put out by the Statistics Office, Jedi Knight is known by the code 896. Heathen comes in at 897. Followed by Atheist at 898 and lastly None with 899. It’s not exactly a ringing endorsement though since the 800s come after every other religion, no matter how obscure, and 700 is used for all “other religions”.

We reported in April about a worldwide attempt to get Jedi Knight accepted as a religion. It started out a daft idea but thanks to email and the Internet soon a whole army of budding Luke Skywalkers had joined in.

We spoke to the Home Office – which was not overly entertained especially since the Census is supposed to be deadly serious. However the Home Office would not say what constituted a religion and we subsequently discovered that while you can be heavily fined for putting down false details on a census form, it does not apply to the religion question.

With 95 per cent of census forms now received and scanning, coding and data capture due to be completed by August next year, we should know just how many official Jedi Knights there are in the UK by the end of 2002.

If you want to check out the full list of religions, download the relevant pdf file here and look on page 18. ®

Update
An official from the National Statistics office had called us up to complain about the story. Apparently they’ve been getting a load of phone calls asking if Jedi Knight is officially a religion.

This is the official line: the Census does not provide recognition to any religion in the official statistics nor does it attempt to define religion. The list that you can see by checking out the pdf file above is merely a list of possible answers that people have been known to put in the box marked religion.

As such, Jedi Knight is not officially recognised as a religion.

However, looking at it another way, neither is any other religion. We imagine there are a few followers of Islam, Judaism, Christianity, Buddhism but the National Statistics office will not provide recognition of them officially. It’s job is simply to identify the number of people in the UK that have given a particular answer to a particular question.

The spokeswoman that clarified the situation for us was one Ms Knight (no relation but some irony).

Related Links
Census 2001 site

Related Stories
May the false declaration be with you
UK Jedi get green light

Tuesday saw Enigma

Took Py to see Enigma at the Paignton Apollo.

Verdict, quite good – but why did they change the ending from the book?

Wednesday – sanded the walls of the hall of the flat till 2 am. Yuck I feel ill with the lack of sleep. Boy am looking forward to an early night’s sleep.

link of the month… possibly the next few years

God Angrily Clarifies ‘Don’t Kill’ Rule

NEW YORK—Responding to recent events on Earth, God, the omniscient creator-deity worshipped by billions of followers of various faiths for more than 6,000 years, angrily clarified His longtime stance against humans killing each other Monday.

<>

“Look, I don’t know, maybe I haven’t made myself completely clear, so for the record, here it is again,” said the Lord, His divine face betraying visible emotion during a press conference near the site of the fallen Twin Towers. “Somehow, people keep coming up with the idea that I want them to kill their neighbor. Well, I don’t. And to be honest, I’m really getting sick and tired of it. Get it straight. Not only do I not want anybody to kill anyone, but I specifically commanded you not to, in really simple terms that anybody ought to be able to understand.”

Worshipped by Christians, Jews, and Muslims alike, God said His name has been invoked countless times over the centuries as a reason to kill in what He called “an unending cycle of violence.”

“I don’t care how holy somebody claims to be,” God said. “If a person tells you it’s My will that they kill someone, they’re wrong. Got it? I don’t care what religion you are, or who you think your enemy is, here it is one more time: No killing, in My name or anyone else’s, ever again.”

The press conference came as a surprise to humankind, as God rarely intervenes in earthly affairs. As a matter of longstanding policy, He has traditionally left the task of interpreting His message and divine will to clerics, rabbis, priests, imams, and Biblical scholars. Theologians and laymen alike have been given the task of pondering His ineffable mysteries, deciding for themselves what to do as a matter of faith. His decision to manifest on the material plane was motivated by the deep sense of shock, outrage, and sorrow He felt over the Sept. 11 violence carried out in His name, and over its dire potential ramifications around the globe.

“I tried to put it in the simplest possible terms for you people, so you’d get it straight, because I thought it was pretty important,” said God, called Yahweh and Allah respectively in the Judaic and Muslim traditions. “I guess I figured I’d left no real room for confusion after putting it in a four-word sentence with one-syllable words, on the tablets I gave to Moses. How much more clear can I get?”

“But somehow, it all gets twisted around and, next thing you know, somebody’s spouting off some nonsense about, ‘God says I have to kill this guy, God wants me to kill that guy, it’s God’s will,'” God continued. “It’s not God’s will, all right? News flash: ‘God’s will’ equals ‘Don’t murder people.'”

Worse yet, many of the worst violators claim that their actions are justified by passages in the Bible, Torah, and Qur’an.

“To be honest, there’s some contradictory stuff in there, okay?” God said. “So I can see how it could be pretty misleading. I admit it—My bad. I did My best to inspire them, but a lot of imperfect human agents have misinterpreted My message over the millennia. Frankly, much of the material that got in there is dogmatic, doctrinal bullshit. I turn My head for a second and, suddenly, all this stuff about homosexuality gets into Leviticus, and everybody thinks it’s God’s will to kill gays. It absolutely drives Me up the wall.”

God praised the overwhelming majority of His Muslim followers as “wonderful, pious people,” calling the perpetrators of the Sept. 11 attacks rare exceptions.

“This whole medieval concept of the jihad, or holy war, had all but vanished from the Muslim world in, like, the 10th century, and with good reason,” God said. “There’s no such thing as a holy war, only unholy ones. The vast majority of Muslims in this world reject the murderous actions of these radical extremists, just like the vast majority of Christians in America are pissed off over those two bigots on The 700 Club.”

Continued God, “Read the book: ‘Allah is kind, Allah is beautiful, Allah is merciful.’ It goes on and on that way, page after page. But, no, some assholes have to come along and revive this stupid holy-war crap just to further their own hateful agenda. So now, everybody thinks Muslims are all murderous barbarians. Thanks, Taliban: 1,000 years of pan-Islamic cultural progress down the drain.”

God stressed that His remarks were not directed exclusively at Islamic extremists, but rather at anyone whose ideological zealotry overrides his or her ability to comprehend the core message of all world religions.

“I don’t care what faith you are, everybody’s been making this same mistake since the dawn of time,” God said. “The Muslims massacre the Hindus, the Hindus massacre the Muslims. The Buddhists, everybody massacres the Buddhists. The Jews, don’t even get me started on the hardline, right-wing, Meir Kahane-loving Israeli nationalists, man. And the Christians? You people believe in a Messiah who says, ‘Turn the other cheek,’ but you’ve been killing everybody you can get your hands on since the Crusades.”

Growing increasingly wrathful, God continued: “Can’t you people see? What are you, morons? There are a ton of different religious traditions out there, and different cultures worship Me in different ways. But the basic message is always the same: Christianity, Islam, Judaism, Buddhism, Shintoism… every religious belief system under the sun, they all say you’re supposed to love your neighbors, folks! It’s not that hard a concept to grasp.”

“Why would you think I’d want anything else? Humans don’t need religion or God as an excuse to kill each other—you’ve been doing that without any help from Me since you were freaking apes!” God said. “The whole point of believing in God is to have a higher standard of behavior. How obvious can you get?”

“I’m talking to all of you, here!” continued God, His voice rising to a shout. “Do you hear Me? I don’t want you to kill anybody. I’m against it, across the board. How many times do I have to say it? Don’t kill each other anymore—ever! I’m fucking serious!”

Upon completing His outburst, God fell silent, standing quietly at the podium for several moments. Then, witnesses reported, God’s shoulders began to shake, and He wept.

Please listen to Bruce and his friends, Mr Bush – ta MX

http://www.counterpane.com/crypto-gram-0109a.html[/url]

September 30, 2001

by Bruce Schneier
Founder and CTO
Counterpane Internet Security, Inc.

Copyright (c) 2001 by Counterpane Internet Security, Inc.


This is a special issue of Crypto-Gram, devoted to the September
11 terrorist attacks and their aftermath.

Please distribute this issue widely.

In this issue:

  • [url=#1]The Attacks[/url]
  • [url=#2]Airline Security Regulations[/url]
  • [url=#3]Biometrics in Airports[/url]
  • [url=#4]Diagnosing Intelligence Failures[/url]
  • [url=#5]Regulating Cryptography[/url]
  • [url=#6]Terrorists and Steganography[/url]
  • [url=#7]News[/url]
  • [url=#8]Protecting Privacy and Liberty[/url]
  • [url=#9]How to Help[/url]

The Attacks

Watching the television on September 11, my primary reaction was
amazement.

The attacks were amazing in their diabolicalness and audacity:
to hijack fuel-laden commercial airliners and fly them into buildings, killing
thousands of innocent civilians. We’ll probably never know if the attackers
realized that the heat from the jet fuel would melt the steel supports and collapse
the World Trade Center. It seems probable that they placed advantageous trades
on the world’s stock markets just before the attack. No one planned for an attack
like this. We like to think that human beings don’t make plans like this.

I was impressed when al-Qaeda simultaneously bombed two American
embassies in Africa. I was more impressed when they blew a 40-foot hole in an
American warship. This attack makes those look like minor operations.

The attacks were amazing in their complexity. Estimates are that
the plan required about 50 people, at least 19 of them willing to die. It required
training. It required logistical support. It required coordination. The sheer
scope of the attack seems beyond the capability of a terrorist organization.

The attacks rewrote the hijacking rule book. Responses to hijackings
are built around this premise: get the plane on the ground so negotiations can
begin. That’s obsolete now.

They rewrote the terrorism book, too. Al-Qaeda invented a new
type of attacker. Historically, suicide bombers are young, single, fanatical,
and have nothing to lose. These people were older and more experienced. They
had marketable job skills. They lived in the U.S.: watched television, ate fast
food, drank in bars. One left a wife and four children.

It was also a new type of attack. One of the most difficult things
about a terrorist operation is getting away. This attack neatly solved that
problem. It also solved the technological problem. The United States spends
billions of dollars on remote-controlled precision-guided munitions; al-Qaeda
just finds morons willing to fly planes into skyscrapers.

Finally, the attacks were amazing in their success. They weren’t
perfect. We know that 100% of the attempted hijackings were successful, and
75% of the hijacked planes successfully hit their targets. We don’t know how
many planned hijackings were aborted for one reason or another. What’s most
amazing is that the plan wasn’t leaked. No one successfully defected. No one
slipped up and gave the plan away. Al-Qaeda had assets in the U.S. for months,
and managed to keep the plan secret. Often law enforcement has been lucky here;
in this case we weren’t.

Rarely do you see an attack that changes the world’s conception
of attack, as these terrorist attacks changed the world’s conception of what
a terrorist attack can do. Nothing they did was novel, yet the attack was completely
new. And our conception of defense must change as well.


Airline Security Regulations

Computer security experts have a lot of expertise that can be
applied to the real world. First and foremost, we have well-developed senses
of what security looks like. We can tell the difference between real security
and snake oil. And the new airport security rules, put in place after September
11, look and smell a whole lot like snake oil.

All the warning signs are there: new and unproven security measures,
no real threat analysis, unsubstantiated security claims. The ban on cutting
instruments is a perfect example. It’s a knee-jerk reaction: the terrorists
used small knives and box cutters, so we must ban them. And nail clippers, nail
files, cigarette lighters, scissors (even small ones), tweezers, etc. But why
isn’t anyone asking the real questions: what is the threat, and how does turning
an airplane into a kindergarten classroom reduce the threat? If the threat is
hijacking, then the countermeasure doesn’t protect against all the myriad of
ways people can subdue the pilot and crew. Hasn’t anyone heard of karate? Or
broken bottles? Think about hiding small blades inside luggage. Or composite
knives that don’t show up on metal detectors.

Parked cars now must be 300 feet from airport gates. Why? What
security problem does this solve? Why doesn’t the same problem imply that passenger
drop-off and pick-up should also be that far away? Curbside check-in has been
eliminated. What’s the threat that this security measure has solved? Why, if
the new threat is hijacking, are we suddenly worried about bombs?

The rule limiting concourse access to ticketed passengers is another
one that confuses me. What exactly is the threat here? Hijackers have to be
on the planes they’re trying to hijack to carry out their attack, so they have
to have tickets. And anyone can call Priceline.com and “name their own price”
for concourse access.

Increased inspections — of luggage, airplanes, airports — seem
like a good idea, although it’s far from perfect. The biggest problem here is
that the inspectors are poorly paid and, for the most part, poorly educated
and trained. Other problems include the myriad ways to bypass the checkpoints
— numerous studies have found all sorts of violations — and the impossibility
of effectively inspecting everybody while maintaining the required throughput.
Unidentified armed guards on select flights is another mildly effective idea:
it’s a small deterrent, because you never know if one is on the flight you want
to hijack.

Positive bag matching — ensuring that a piece of luggage does
not get loaded on the plane unless its owner boards the plane — is actually
a good security measure, but assumes that bombers have self-preservation as
a guiding force. It is completely useless against suicide bombers.

The worst security measure of them all is the photo ID requirement.
This solves no security problem I can think of. It doesn’t even identify people;
any high school student can tell you how to get a fake ID. The requirement for
this invasive and ineffective security measure is secret; the FAA won’t send
you the written regulations if you ask. Airlines are actually more stringent
about this than the FAA requires, because the “security” measure solves a business
problem for them.

The real point of photo ID requirements is to prevent people from
reselling tickets. Nonrefundable tickets used to be regularly advertised in
the newspaper classifieds. Ads would read something like “Round trip, Boston
to Chicago, 11/22 – 11/30, female, $50.” Since the airlines didn’t check ID
but could notice gender, any female could buy the ticket and fly the route.
Now this doesn’t work. The airlines love this; they solved a problem of theirs,
and got to blame the solution on FAA security requirements.

Airline security measures are primarily designed to give the appearance
of good security rather than the actuality. This makes sense, once you realize
that the airlines’ goal isn’t so much to make the planes hard to hijack, as
to make the passengers willing to fly. Of course airlines would prefer it if
all their flights were perfectly safe, but actual hijackings and bombings are
rare events and they know it.

This is not to say that all airport security is useless, and that
we’d be better off doing nothing. All security measures have benefits, and all
have costs: money, inconvenience, etc. I would like to see some rational analysis
of the costs and benefits, so we can get the most security for the resources
we have.

One basic snake-oil warning sign is the use of self-invented security
measures, instead of expert-analyzed and time-tested ones. The closest the airlines
have to experienced and expert analysis is El Al. Since 1948 they have been
operating in and out of the most heavily terroristic areas of the planet, with
phenomenal success. They implement some pretty heavy security measures. One
thing they do is have reinforced, locked doors between their airplanes’ cockpit
and the passenger section. (Notice that this security measure is 1) expensive,
and 2) not immediately perceptible to the passenger.) Another thing they do
is place all cargo in decompression chambers before takeoff, to trigger bombs
set to sense altitude. (Again, this is 1) expensive, and 2) imperceptible, so
unattractive to American airlines.) Some of the things El Al does are so intrusive
as to be unconstitutional in the U.S., but they let you take your pocketknife
on board with you.

Airline security:
< [url=http://www.time.com/time/covers/1101010924/bsecurity.html]http://www.time.com/time/covers/1101010924/bsecurity.html[/url]>

< [url=http://www.accessatlanta.com/ajc/terrorism/atlanta/0925gun.html]http://www.accessatlanta.com/ajc/terrorism/atlanta/0925gun.html[/url]>

FAA on new security rules:
< [url=http://www.faa.gov/apa/faq/pr_faq.htm]http://www.faa.gov/apa/faq/pr_faq.htm[/url]>

A report on the rules’ effectiveness:
< [url=http://www.boston.com/dailyglobe2/266/nation/Passengers_say_banned_items_have_eluded_airport_monitors+.shtml]http://www.boston.com/dailyglobe2/266/nation/Passengers_say_banned_items_have_eluded_airport_monitors+.shtml[/url]>

El Al’s security measures:
< [url=http://news.excite.com/news/ap/010912/18/israel-safe-aviation]http://news.excite.com/news/ap/010912/18/israel-safe-aviation[/url]>

< [url=http://news.excite.com/news/r/010914/07/international-attack-israel-elal-dc]http://news.excite.com/news/r/010914/07/international-attack-israel-elal-dc[/url]>

More thoughts on this topic:
< [url=http://slate.msn.com/HeyWait/01-09-17/HeyWait.asp]http://slate.msn.com/HeyWait/01-09-17/HeyWait.asp[/url]>

< [url=http://www.tnr.com/100101/easterbrook100101.html]http://www.tnr.com/100101/easterbrook100101.html[/url]>

< [url=http://www.tisc2001.com/newsletters/317.html]http://www.tisc2001.com/newsletters/317.html[/url]>

Two secret FAA documents on photo ID requirement, in text and
GIF:
< [url=http://www.cs.berkeley.edu/~daw/faa/guid/guid.txt]http://www.cs.berkeley.edu/~daw/faa/guid/guid.txt[/url]>

< [url=http://www.cs.berkeley.edu/~daw/faa/guid/guid.html]http://www.cs.berkeley.edu/~daw/faa/guid/guid.html[/url]>

< [url=http://www.cs.berkeley.edu/~daw/faa/id/id.txt]http://www.cs.berkeley.edu/~daw/faa/id/id.txt[/url]>

< [url=http://www.cs.berkeley.edu/~daw/faa/id/id.html]http://www.cs.berkeley.edu/~daw/faa/id/id.html[/url]>

Passenger profiling:
< [url=http://www.latimes.com/news/nationworld/nation/la-091501profile.story]http://www.latimes.com/news/nationworld/nation/la-091501profile.story[/url]>

A CATO Institute report: “The Cost of Antiterrorist Rhetoric,”
written well before September 11:
< [url=http://www.cato.org/pubs/regulation/reg19n4e.html]http://www.cato.org/pubs/regulation/reg19n4e.html[/url]>

I don’t know if this is a good idea, but at least someone is thinking
about the problem:
< [url=http://www.zdnet.com/anchordesk/stories/story/0,10738,2812283,00.html]http://www.zdnet.com/anchordesk/stories/story/0,10738,2812283,00.html[/url]>


Biometrics in Airports

You have to admit, it sounds like a good idea. Put cameras throughout
airports and other public congregation areas, and have automatic face-recognition
software continuously scan the crowd for suspected terrorists. When the software
finds one, it alerts the authorities, who swoop down and arrest the bastards.
Voila, we’re safe once again.

Reality is a lot more complicated; it always is. Biometrics is
an effective authentication tool, and I’ve written about it before. There are
three basic kinds of authentication: something you know (password, PIN code,
secret handshake), something you have (door key, physical ticket into a concert,
signet ring), and something you are (biometrics). Good security uses at least
two different authentication types: an ATM card and a PIN code, computer access
using both a password and a fingerprint reader, a security badge that includes
a picture that a guard looks at. Implemented properly, biometrics can be an
effective part of an access control system.

I think it would be a great addition to airport security: identifying
airline and airport personnel such as pilots, maintenance workers, etc. That’s
a problem biometrics can help solve. Using biometrics to pick terrorists out
of crowds is a different kettle of fish.

In the first case (employee identification), the biometric system
has a straightforward problem: does this biometric belong to the person it claims
to belong to? In the latter case (picking terrorists out of crowds), the system
needs to solve a much harder problem: does this biometric belong to anyone in
this large database of people? The difficulty of the latter problem increases
the complexity of the identification, and leads to identification failures.

Setting up the system is different for the two applications. In
the first case, you can unambiguously know the reference biometric belongs to
the correct person. In the latter case, you need to continually worry about
the integrity of the biometric database. What happens if someone is wrongfully
included in the database? What kind of right of appeal does he have?

Getting reference biometrics is different, too. In the first case,
you can initialize the system with a known, good biometric. If the biometric
is face recognition, you can take good pictures of new employees when they are
hired and enter them into the system. Terrorists are unlikely to pose for photo
shoots. You might have a grainy picture of a terrorist, taken five years ago
from 1000 yards away when he had a beard. Not nearly as useful.

But even if all these technical problems were magically solved,
it’s still very difficult to make this kind of system work. The hardest problem
is the false alarms. To explain why, I’m going to have to digress into statistics
and explain the base rate fallacy.

Suppose this magically effective face-recognition software is
99.99 percent accurate. That is, if someone is a terrorist, there is a 99.99
percent chance that the software indicates “terrorist,” and if someone is not
a terrorist, there is a 99.99 percent chance that the software indicates “non-terrorist.”
Assume that one in ten million flyers, on average, is a terrorist. Is the software
any good?

No. The software will generate 1000 false alarms for every one
real terrorist. And every false alarm still means that all the security people
go through all of their security procedures. Because the population of non-terrorists
is so much larger than the number of terrorists, the test is useless. This result
is counterintuitive and surprising, but it is correct. The false alarms in this
kind of system render it mostly useless. It’s “The Boy Who Cried Wolf” increased
1000-fold.

I say mostly useless, because it would have some positive effect.
Once in a while, the system would correctly finger a frequent-flyer terrorist.
But it’s a system that has enormous costs: money to install, manpower to run,
inconvenience to the millions of people incorrectly identified, successful lawsuits
by some of those people, and a continued erosion of our civil liberties. And
all the false alarms will inevitably lead those managing the system to distrust
its results, leading to sloppiness and potentially costly mistakes. Ubiquitous
harvesting of biometrics might sound like a good idea, but I just don’t think
it’s worth it.

Phil Agre on face-recognition biometrics:
< [url=http://dlis.gseis.ucla.edu/people/pagre/bar-code.html]http://dlis.gseis.ucla.edu/people/pagre/bar-code.html[/url]>

My original essay on biometrics:
< [url=http://www.counterpane.com/crypto-gram-9808.html#biometrics]http://www.counterpane.com/crypto-gram-9808.html#biometrics[/url]>

Face recognition useless in airports:
< [url=http://www.theregister.co.uk/content/4/21916.html]http://www.theregister.co.uk/content/4/21916.html[/url]>

According to a DARPA study, to detect 90 per cent of terrorists we’d need to
raise an alarm for one in every three people passing through the airport.

A company that is pushing this idea:
< [url=http://www.theregister.co.uk/content/6/21882.html]http://www.theregister.co.uk/content/6/21882.html[/url]>

A version of this article was published here:
< [url=http://www.extremetech.com/article/0,3396,s%253D1024%2526a%253D15070,00.asp]http://www.extremetech.com/article/0,3396,s%253D1024%2526a%253D15070,00.asp[/url]>


Diagnosing Intelligence
Failures

It’s clear that U.S. intelligence failed to provide adequate warning
of the September 11 terrorist attacks, and that the FBI failed to prevent the
attacks. It’s also clear that there were all sorts of indications that the attacks
were going to happen, and that there were all sorts of things that we could
have noticed but didn’t. Some have claimed that this was a massive intelligence
failure, and that we should have known about and prevented the attacks. I am
not convinced.

There’s a world of difference between intelligence data and intelligence
information. In what I am sure is the mother of all investigations, the CIA,
NSA, and FBI have uncovered all sorts of data from their files, data that clearly
indicates that an attack was being planned. Maybe it even clearly indicates
the nature of the attack, or the date. I’m sure lots of information is there,
in files, intercepts, computer memory.

Armed with the clarity of hindsight, it’s easy to look at all
the data and point to what’s important and relevant. It’s even easy to take
all that important and relevant data and turn it into information. And it’s
real easy to take that information and construct a picture of what’s going on.

It’s a lot harder to do before the fact. Most data is irrelevant,
and most leads are false ones. How does anyone know which is the important one,
that effort should be spent on this specific threat and not the thousands of
others?

So much data is collected — the NSA sucks up an almost unimaginable
quantity of electronic communications, the FBI gets innumerable leads and tips,
and our allies pass all sorts of information to us — that we can’t possibly
analyze it all. Imagine terrorists are hiding plans for attacks in the text
of books in a large university library; you have no idea how many plans there
are or where they are, and the library expands faster than you can possibly
read it. Deciding what to look at is an impossible task, so a lot of good intelligence
goes unlearned.

We also don’t have any context to judge the intelligence effort.
How many terrorist attempts have been thwarted in the past year? How many groups
are being tracked? If the CIA, NSA, and FBI succeed, no one ever knows. It’s
only in failure that they get any recognition.

And it was a failure. Over the past couple of decades, the U.S.
has relied more and more on high-tech electronic eavesdropping (SIGINT and COMINT)
and less and less on old fashioned human intelligence (HUMINT). This only makes
the analysis problem worse: too much data to look at, and not enough real-world
context. Look at the intelligence failures of the past few years: failing to
predict India’s nuclear test, or the attack on the USS Cole, or the bombing
of the two American embassies in Africa; concentrating on Wen Ho Lee to the
exclusion of the real spies, like Robert Hanssen.

But whatever the reason, we failed to prevent this terrorist attack.
In the post mortem, I’m sure there will be changes in the way we collect and
(most importantly) analyze anti-terrorist data. But calling this a massive intelligence
failure is a disservice to those who are working to keep our country secure.

Intelligence failure is an overreliance on eavesdropping and not
enough on human intelligence:
< [url=http://www.sunspot.net/bal-te.intelligence13sep13.story]http://www.sunspot.net/bal-te.intelligence13sep13.story[/url]>

< [url=http://www.newscientist.com/news/news.jsp?id=ns99991297]http://www.newscientist.com/news/news.jsp?id=ns99991297[/url]>

Another view:
< [url=http://www.wired.com/news/politics/0,1283,46746,00.html]http://www.wired.com/news/politics/0,1283,46746,00.html[/url]>

Too much electronic eavesdropping only makes things harder:
< [url=http://www.wired.com/news/business/0,1367,46817,00.html]http://www.wired.com/news/business/0,1367,46817,00.html[/url]>

Israel alerted the U.S. about attacks:
< [url=http://www.latimes.com/news/nationworld/nation/la-092001probe.story]http://www.latimes.com/news/nationworld/nation/la-092001probe.story[/url]>

Mostly retracted:
< [url=http://www.latimes.com/news/nationworld/nation/la-092101mossad.story]http://www.latimes.com/news/nationworld/nation/la-092101mossad.story[/url]>


Regulating Cryptography

In the wake of the devastating attacks on New York’s World Trade
Center and the Pentagon, Senator Judd Gregg and other high-ranking government
officials quickly seized on the opportunity to resurrect limits on strong encryption
and key escrow systems that ensure government access to encrypted messages.

I think this is a bad move. It will do little to thwart terrorist
activities, while at the same time significantly reducing the security of our
own critical infrastructure. We’ve been through these arguments before, but
legislators seem to have short memories. Here’s why trying to limit cryptography
is bad for Internet security.

One, you can’t limit the spread of cryptography. Cryptography
is mathematics, and you can’t ban mathematics. All you can ban is a set of products
that use that mathematics, but that is something quite different. Years ago,
during the cryptography debates, an international crypto survey was completed;
it listed almost a thousand products with strong cryptography from over a hundred
countries. You might be able to control cryptography products in a handful of
industrial countries, but that won’t prevent criminals from importing them.
You’d have to ban them in every country, and even then it won’t be enough. Any
terrorist organization with a modicum of skill can write its own cryptography
software. And besides, what terrorist is going to pay attention to a legal ban?

Two, any controls on the spread of cryptography hurt more than
they help. Cryptography is one of the best security tools we have to protect
our electronic world from harm: eavesdropping, unauthorized access, meddling,
denial of service. Sure, by controlling the spread of cryptography you might
be able to prevent some terrorist groups from using cryptography, but you’ll
also prevent bankers, hospitals, and air-traffic controllers from using it.
(And, remember, the terrorists can always get the stuff elsewhere: see my first
point.) We’ve got a lot of electronic infrastructure to protect, and we need
all the cryptography we can get our hands on. If anything, we need to make strong
cryptography more prevalent if companies continue to put our planet’s critical
infrastructure online.

Three, key escrow doesn’t work. Short refresher: this is the notion
that companies should be forced to implement back doors in crypto products such
that law enforcement, and only law enforcement, can peek in and eavesdrop on
encrypted messages. Terrorists and criminals won’t use it. (Again, see my first
point.)

Key escrow also makes it harder for the good guys to secure the
important stuff. All key-escrow systems require the existence of a highly sensitive
and highly available secret key or collection of keys that must be maintained
in a secure manner over an extended time period. These systems must make decryption
information quickly accessible to law enforcement agencies without notice to
the key owners. Does anyone really think that we can build this kind of system
securely? It would be a security engineering task of unbelievable magnitude,
and I don’t think we have a prayer of getting it right. We can’t build a secure
operating system, let alone a secure computer and secure network.

Stockpiling keys in one place is a huge risk just waiting for
attack or abuse. Whose digital security do you trust absolutely and without
question, to protect every major secret of the nation? Which operating system
would you use? Which firewall? Which applications? As attractive as it may sound,
building a workable key-escrow system is beyond the current capabilities of
computer engineering.

Years ago, a group of colleagues and I wrote a paper outlining
why key escrow is a bad idea. The arguments in the paper still stand, and I
urge everyone to read it. It’s not a particularly technical paper, but it lays
out all the problems with building a secure, effective, scalable key-escrow
infrastructure.

The events of September 11 have convinced a lot of people that
we live in dangerous times, and that we need more security than ever before.
They’re right; security has been dangerously lax in many areas of our society,
including cyberspace. As more and more of our nation’s critical infrastructure
goes digital, we need to recognize cryptography as part of the solution and
not as part of the problem.

My old “Risks of Key Recovery” paper:
< [url=http://www.counterpane.com/key-escrow.html]http://www.counterpane.com/key-escrow.html[/url]>

Articles on this topic:
< [url=http://cgi.zdnet.com/slink?140437:8469234]http://cgi.zdnet.com/slink?140437:8469234[/url]>

< [url=http://www.wired.com/news/politics/0,1283,46816,00.html]http://www.wired.com/news/politics/0,1283,46816,00.html[/url]>

< [url=http://www.pcworld.com/news/article/0,aid,62267,00.asp]http://www.pcworld.com/news/article/0,aid,62267,00.asp[/url]>

< [url=http://www.newscientist.com/news/news.jsp?id=ns99991309]http://www.newscientist.com/news/news.jsp?id=ns99991309[/url]>

< [url=http://www.zdnet.com/zdnn/stories/news/0,4586,2814833,00.html]http://www.zdnet.com/zdnn/stories/news/0,4586,2814833,00.html[/url]>

Al-Qaeda did not use encryption to plan these attacks:
< [url=http://dailynews.yahoo.com/h/nm/20010918/ts/attack_investigation_dc_23.html]http://dailynews.yahoo.com/h/nm/20010918/ts/attack_investigation_dc_23.html[/url]>

Poll indicates that 72 percent of Americans believe that anti-encryption
laws would be “somewhat” or “very” helpful in preventing a repeat of last week’s
terrorist attacks on New York’s World Trade Center and the Pentagon in Washington,
D.C. No indication of what percentage actually understood the question.
< [url=http://news.cnet.com/news/0-1005-200-7215723.html?tag=mn_hd]http://news.cnet.com/news/0-1005-200-7215723.html?tag=mn_hd[/url]>


Terrorists and Steganography

Guess what? Al-Qaeda may use steganography. According to nameless
“U.S. officials and experts” and “U.S. and foreign officials,” terrorist groups
are “hiding maps and photographs of terrorist targets and posting instructions
for terrorist activities on sports chat rooms, pornographic bulletin boards
and other Web sites.”

I’ve written about steganography in the past, and I don’t want
to spend much time retracing old ground. Simply, steganography is the science
of hiding messages in messages. Typically, a message (either plaintext or, more
cleverly, ciphertext) is encoded as tiny changes to the color of the pixels
of a digital photograph. Or in imperceptible noise in an audio file. To the
uninitiated observer, it’s just a picture. But to the sender and receiver, there’s
a message hiding in there.

It doesn’t surprise me that terrorists are using this trick. The
very aspects of steganography that make it unsuitable for normal corporate use
make it ideally suited for terrorist use. Most importantly, it can be used in
an electronic dead drop.

If you read the FBI affidavit against Robert Hanssen, you learn
how Hanssen communicated with his Russian handlers. They never met, but would
leave messages, money, and documents for one another in plastic bags under a
bridge. Hanssen’s handler would leave a signal in a public place — a chalk
mark on a signpost — to indicate a waiting package. Hanssen would later collect
the package.

That’s a dead drop. It has many advantages over a face-to-face
meeting. One, the two parties are never seen together. Two, the two parties
don’t have to coordinate a rendezvous. Three, and most importantly, one party
doesn’t even have to know who the other one is (a definite advantage if one
of them is arrested). Dead drops can be used to facilitate completely anonymous,
asynchronous communications.

Using steganography to embed a message in a pornographic image
and posting it to a Usenet newsgroup is the cyberspace equivalent of a dead
drop. To everyone else, it’s just a picture. But to the receiver, there’s a
message in there waiting to be extracted.

To make it work in practice, the terrorists would need to set
up some sort of code. Just as Hanssen knew to collect his package when he saw
the chalk mark, a virtual terrorist will need to know to look for his message.
(He can’t be expected to search every picture.) There are lots of ways to communicate
a signal: timestamp on the message, an uncommon word in the subject line, etc.
Use your imagination here; the possibilities are limitless.

The effect is that the sender can transmit a message without ever
communicating directly with the receiver. There is no e-mail between them, no
remote logins, no instant messages. All that exists is a picture posted to a
public forum, and then downloaded by anyone sufficiently enticed by the subject
line (both third parties and the intended receiver of the secret message).

So, what’s a counter-espionage agency to do? There are the standard
ways of finding steganographic messages, most of which involve looking for changes
in traffic patterns. If Bin Laden is using pornographic images to embed his
secret messages, it is unlikely these pictures are being taken in Afghanistan.
They’re probably downloaded from the Web. If the NSA can keep a database of
images (wouldn’t that be something?), then they can find ones with subtle changes
in the low-order bits. If Bin Laden uses the same image to transmit multiple
messages, the NSA could notice that. Otherwise, there’s probably nothing the
NSA can do. Dead drops, both real and virtual, can’t be prevented.

Why can’t businesses use this? The primary reason is that legitimate
businesses don’t need dead drops. I remember hearing one company talk about
a corporation embedding a steganographic message to its salespeople in a photo
on the corporate Web page. Why not just send an encrypted e-mail? Because someone
might notice the e-mail and know that the salespeople all got an encrypted message.
So send a message every day: a real message when you need to, and a dummy message
otherwise. This is a traffic analysis problem, and there are other techniques
to solve it. Steganography just doesn’t apply here.

Steganography is good way for terrorist cells to communicate,
allowing communication without any group knowing the identity of the other.
There are other ways to build a dead drop in cyberspace. A spy can sign up for
a free, anonymous e-mail account, for example. Bin Laden probably uses those
too.

News articles:
< [url=http://www.wired.com/news/print/0,1294,41658,00.html]http://www.wired.com/news/print/0,1294,41658,00.html[/url]>

< [url=http://www.usatoday.com/life/cyber/tech/2001-02-05-binladen.htm]http://www.usatoday.com/life/cyber/tech/2001-02-05-binladen.htm[/url]>

< [url=http://www.sfgate.com/cgi-bin/article.cgi?file=/gate/archive/2001/09/20/sigintell.DTL]http://www.sfgate.com/cgi-bin/article.cgi?file=/gate/archive/2001/09/20/sigintell.DTL[/url]>

< [url=http://www.cnn.com/2001/US/09/20/inv.terrorist.search/]http://www.cnn.com/2001/US/09/20/inv.terrorist.search/[/url]>

< [url=http://www.washingtonpost.com/wp-dyn/articles/A52687-2001Sep18.html]http://www.washingtonpost.com/wp-dyn/articles/A52687-2001Sep18.html[/url]>

My old essay on steganography:
< [url=http://www.counterpane.com/crypto-gram-9810.html#steganography]http://www.counterpane.com/crypto-gram-9810.html#steganography[/url]>

Study claims no steganography on eBay:
< [url=http://www.theregister.co.uk/content/4/21829.html]http://www.theregister.co.uk/content/4/21829.html[/url]>

Detecting steganography on the Internet:
< [url=http://www.citi.umich.edu/techreports/reports/citi-tr-01-11.pdf]http://www.citi.umich.edu/techreports/reports/citi-tr-01-11.pdf[/url]>

A version of this essay appeared on ZDnet:
< [url=http://www.zdnet.com/zdnn/stories/comment/0,5859,2814256,00.html]http://www.zdnet.com/zdnn/stories/comment/0,5859,2814256,00.html[/url]>

< [url=http://www.msnbc.com/news/633709.asp?0dm=B12MT]http://www.msnbc.com/news/633709.asp?0dm=B12MT[/url]>


News

I am not opposed to using force against the terrorists. I am not
opposed to going to war — for retribution, deterrence, and the restoration
of the social contract — assuming a suitable enemy can be identified. Occasionally,
peace is something you have to fight for. But I think the use of force is far
more complicated than most people realize. Our actions are important; messing
this up will only make things worse.

Written before September 11: A former CIA operative explains why
the terrorist Usama bin Laden has little to fear from American intelligence.

< [url=http://www.theatlantic.com/issues/2001/07/gerecht.htm]http://www.theatlantic.com/issues/2001/07/gerecht.htm[/url]>

And a Russian soldier discusses why war in Afghanistan will be a nightmare.

< [url=http://www.latimes.com/news/printedition/asection/la-000075191sep19.story]http://www.latimes.com/news/printedition/asection/la-000075191sep19.story[/url]>

A British soldier explains the same:
< [url=http://www.sunday-times.co.uk/news/pages/sti/2001/09/23/stiusausa02023.html?]http://www.sunday-times.co.uk/news/pages/sti/2001/09/23/stiusausa02023.html?[/url]>

Lessons from Britain on fighting terrorism:
< [url=http://www.salon.com/news/feature/2001/09/19/fighting_terror/index.html]http://www.salon.com/news/feature/2001/09/19/fighting_terror/index.html[/url]>

1998 Esquire interview with Bin Ladin:
< [url=http://www.esquire.com/features/articles/2001/010913_mfe_binladen_1.html]http://www.esquire.com/features/articles/2001/010913_mfe_binladen_1.html[/url]>

Phil Agre’s comments on these issues:
< [url=http://commons.somewhere.com/rre/2001/RRE.War.in.a.World.Witho.html]http://commons.somewhere.com/rre/2001/RRE.War.in.a.World.Witho.html[/url]>

< [url=http://commons.somewhere.com/rre/2001/RRE.Imagining.the.Next.W.html]http://commons.somewhere.com/rre/2001/RRE.Imagining.the.Next.W.html[/url]>

Why technology can’t save us:
< [url=http://www.osopinion.com/perl/story/13535.html]http://www.osopinion.com/perl/story/13535.html[/url]>

Hactivism exacts revenge for terrorist attacks:
< [url=http://news.cnet.com/news/0-1003-201-7214703-0.html?tag=owv]http://news.cnet.com/news/0-1003-201-7214703-0.html?tag=owv[/url]>

FBI reminds everyone that it’s illegal:
< [url=http://www.nipc.gov/warnings/advisories/2001/01-020.htm]http://www.nipc.gov/warnings/advisories/2001/01-020.htm[/url]>

< [url=http://www.ananova.com/news/story/sm_400565.html?menu=]http://www.ananova.com/news/story/sm_400565.html?menu=[/url]>

Hackers face life imprisonment under anti-terrorism act:
< [url=http://www.securityfocus.com/news/257]http://www.securityfocus.com/news/257[/url]>

Especially scary are the “advice or assistance” components. A security consultant
could face life imprisonment, without parole, if he discovered and publicized
a security hole that was later exploited by someone else. After all, without
his “advice” about what the hole was, the attacker never would have accomplished
his hack.

Companies fear cyberterrorism:
< [url=http://cgi.zdnet.com/slink?140433:8469234]http://cgi.zdnet.com/slink?140433:8469234[/url]>

< [url=http://computerworld.com/nlt/1%2C3590%2CNAV65-663_STO63965_NLTSEC%2C00.html]http://computerworld.com/nlt/1%2C3590%2CNAV65-663_STO63965_NLTSEC%2C00.html[/url]>

They’re investing in security:
< [url=http://www.washtech.com/news/software/12514-1.html]http://www.washtech.com/news/software/12514-1.html[/url]>

< [url=http://www.theregister.co.uk/content/55/21814.html]http://www.theregister.co.uk/content/55/21814.html[/url]>

Upgrading government computers to fight terrorism:
< [url=http://www.zdnet.com/zdnn/stories/news/0,4586,5096868,00.html]http://www.zdnet.com/zdnn/stories/news/0,4586,5096868,00.html[/url]>

Risks of cyberterrorism attacks against our electronic infrastructure:

< [url=http://www.businessweek.com/bwdaily/dnflash/sep2001/nf20010918_8931.htm?&_ref=1732900718]http://www.businessweek.com/bwdaily/dnflash/sep2001/nf20010918_8931.htm?&_ref=1732900718[/url]>

< [url=http://cgi.zdnet.com/slink?143569:8469234]http://cgi.zdnet.com/slink?143569:8469234[/url]>

Now the complaint is that Bin Laden is NOT using high-tech communications:

< [url=http://www.theregister.co.uk/content/57/21790.html]http://www.theregister.co.uk/content/57/21790.html[/url]>

Larry Ellison is willing to give away the software to implement
a national ID card.
< [url=http://www.siliconvalley.com/docs/news/svfront/ellsn092301.htm]http://www.siliconvalley.com/docs/news/svfront/ellsn092301.htm[/url]>

Security problems include: inaccurate information, insiders issuing fake cards
(this happens with state drivers’ licenses), vulnerability of the large database,
potential privacy abuses, etc. And, of course, no trans-national terrorists
would be listed in such a system, because they wouldn’t be U.S. citizens. What
do you expect from a company whose origins are intertwined with the CIA?


Protecting Privacy and Liberty

Appalled by the recent hijackings, many Americans have declared
themselves willing to give up civil liberties in the name of security. They’ve
declared it so loudly that this trade-off seems to be a fait accompli. Article
after article talks about the balance between privacy and security, discussing
whether various increases of security are worth the privacy and civil-liberty
losses. Rarely do I see a discussion about whether this linkage is a valid one.

Security and privacy are not two sides of a teeter-totter. This
association is simplistic and largely fallacious. It’s easy and fast, but less
effective, to increase security by taking away liberty. However, the best ways
to increase security are not at the expense of privacy and liberty.

It’s easy to refute the notion that all security comes at the
expense of liberty. Arming pilots, reinforcing cockpit doors, and teaching flight
attendants karate are all examples of security measures that have no effect
on individual privacy or liberties. So are better authentication of airport
maintenance workers, or dead-man switches that force planes to automatically
land at the closest airport, or armed air marshals traveling on flights.

Liberty-depriving security measures are most often found when
system designers failed to take security into account from the beginning. They’re
Band-aids, and evidence of bad security planning. When security is designed
into a system, it can work without forcing people to give up their freedoms.

Here’s an example: securing a room. Option one: convert the room
into an impregnable vault. Option two: put locks on the door, bars on the windows,
and alarm everything. Option three: don’t bother securing the room; instead,
post a guard in the room who records the ID of everyone entering and makes sure
they should be allowed in.

Option one is the best, but is unrealistic. Impregnable vaults
just don’t exist, getting close is prohibitively expensive, and turning a room
into a vault greatly lessens its usefulness as a room. Option two is the realistic
best; combine the strengths of prevention, detection, and response to achieve
resilient security. Option three is the worst. It’s far more expensive than
option two, and the most invasive and easiest to defeat of all three options.
It’s also a sure sign of bad planning; designers built the room, and only then
realized that they needed security. Rather then spend the effort installing
door locks and alarms, they took the easy way out and invaded people’s privacy.

A more complex example is Internet security. Preventive countermeasures
help significantly against script kiddies, but fail against smart attackers.
For a couple of years I have advocated detection and response to provide security
on the Internet. This works; my company catches attackers — both outside hackers
and insiders — all the time. We do it by monitoring the audit logs of network
products: firewalls, IDSs, routers, servers, and applications. We don’t eavesdrop
on legitimate users or read traffic. We don’t invade privacy. We monitor data
about data, and find abuse that way. No civil liberties are violated. It’s not
perfect, but nothing is. Still, combined with preventive security products it
is more effective, and more cost-effective, than anything else.

The parallels between Internet security and global security are
strong. All criminal investigation looks at surveillance records. The lowest-tech
version of this is questioning witnesses. In this current investigation, the
FBI is looking at airport videotapes, airline passenger records, flight school
class records, financial records, etc. And the better job they can do examining
these records, the more effective their investigation will be.

There are copycat criminals and terrorists, who do what they’ve
seen done before. To a large extent, this is what the hastily implemented security
measures have tried to prevent. And there are the clever attackers, who invent
new ways to attack people. This is what we saw on September 11. It’s expensive,
but we can build security to protect against yesterday’s attacks. But we can’t
guarantee protection against tomorrow’s attacks: the hacker attack that hasn’t
been invented, or the terrorist attack yet to be conceived.

Demands for even more surveillance miss the point. The problem
is not obtaining data, it’s deciding which data is worth analyzing and then
interpreting it. Everyone already leaves a wide audit trail as we go through
life, and law enforcement can already access those records with search warrants.
The FBI quickly pieced together the terrorists’ identities and the last few
months of their lives, once they knew where to look. If they had thrown up their
hands and said that they couldn’t figure out who did it or how, they might have
a case for needing more surveillance data. But they didn’t, and they don’t.

More data can even be counterproductive. The NSA and the CIA have
been criticized for relying too much on signals intelligence, and not enough
on human intelligence. The East German police collected data on four million
East Germans, roughly a quarter of their population. Yet they did not foresee
the peaceful overthrow of the Communist government because they invested heavily
in data collection instead of data interpretation. We need more intelligence
agents squatting on the ground in the Middle East arguing the Koran, not sitting
in Washington arguing about wiretapping laws.

People are willing to give up liberties for vague promises of
security because they think they have no choice. What they’re not being told
is that they can have both. It would require people to say no to the FBI’s power
grab. It would require us to discard the easy answers in favor of thoughtful
answers. It would require structuring incentives to improve overall security
rather than simply decreasing its costs. Designing security into systems from
the beginning, instead of tacking it on at the end, would give us the security
we need, while preserving the civil liberties we hold dear.

Some broad surveillance, in limited circumstances, might be warranted
as a temporary measure. But we need to be careful that it remain temporary,
and that we do not design surveillance into our electronic infrastructure. Thomas
Jefferson once said: “Eternal vigilance is the price of liberty.” Historically,
liberties have always been a casualty of war, but a temporary casualty. This
war — a war without a clear enemy or end condition — has the potential to
turn into a permanent state of society. We need to design our security accordingly.

The events of September 11th demonstrated the need for America
to redesign our public infrastructures for security. Ignoring this need would
be an additional tragedy.

Quotes from U.S. government officials on the need to preserve
liberty during this crisis:
< [url=http://www.epic.org/alert/EPIC_Alert_8.17.html]http://www.epic.org/alert/EPIC_Alert_8.17.html[/url]>

Quotes from editorial pages on the same need:
< [url=http://www.epic.org/alert/EPIC_Alert_8.18.html]http://www.epic.org/alert/EPIC_Alert_8.18.html[/url]>

Selected editorials:
< [url=http://www.nytimes.com/2001/09/16/weekinreview/16GREE.html]http://www.nytimes.com/2001/09/16/weekinreview/16GREE.html[/url]>

< [url=http://www.nytimes.com/2001/09/23/opinion/23SUN1.html]http://www.nytimes.com/2001/09/23/opinion/23SUN1.html[/url]>

< [url=http://www.freedomforum.org/templates/document.asp?documentID=14924]http://www.freedomforum.org/templates/document.asp?documentID=14924[/url]>

Schneier’s comments in the UK:
< [url=http://www.theregister.co.uk/content/55/21892.html]http://www.theregister.co.uk/content/55/21892.html[/url]>

War and liberties:
< [url=http://www.salon.com/tech/feature/2001/09/22/end_of_liberty/index.html]http://www.salon.com/tech/feature/2001/09/22/end_of_liberty/index.html[/url]>

< [url=http://www.washingtonpost.com/wp-dyn/articles/A21207-2001Sep12.html]http://www.washingtonpost.com/wp-dyn/articles/A21207-2001Sep12.html[/url]>

< [url=http://www.wired.com/news/politics/0,1283,47051,00.html]http://www.wired.com/news/politics/0,1283,47051,00.html[/url]>

More on Ashcroft’s anti-privacy initiatives:
< [url=http://www.theregister.co.uk/content/6/21854.html]http://www.theregister.co.uk/content/6/21854.html[/url]>

Editorial cartoon:
< [url=http://www.claybennett.com/pages/latest_08.html]http://www.claybennett.com/pages/latest_08.html[/url]>

Terrorists leave a broad electronic trail:
< [url=http://www.wired.com/news/politics/0,1283,46991,00.html]http://www.wired.com/news/politics/0,1283,46991,00.html[/url]>

National Review article from 1998: “Know nothings: U.S. intelligence
failures stem from too much information, not enough understanding”
< [url=http://www.findarticles.com/m1282/n14_v50/21102283/p1/article.jhtml]http://www.findarticles.com/m1282/n14_v50/21102283/p1/article.jhtml[/url]>

A previous version of this essay appeared in the San Jose Mercury
News:
< [url=http://www0.mercurycenter.com/premium/opinion/columns/security27.htm]http://www0.mercurycenter.com/premium/opinion/columns/security27.htm[/url]>


How to Help

How can you help? Speak about the issues. Write to your elected
officials. Contribute to organizations working on these issues.

This week the United States Congress will act on the most sweeping
proposal to extend the surveillance authority of the government since the end
of the Cold War. If you value privacy and live in the U.S., there are three
steps you should take before you open your next email message:

1. Urge your representatives in Congress to protect privacy.
– Call the Capitol switchboard at 202-224-3121.
– Ask to be connected to the office of your Congressional representative.
– When you are put through, say “May I please speak to the staff member who
is working on the anti-terrorism legislation?” If that person is not available
to speak with you, say “May I please leave a message?”
– Briefly explain that you appreciate the efforts of your representative to
address the challenges brought about by the September 11th tragedy, but it is
your view that it would be a mistake to make any changes in the federal wiretap
statute that do not respond to “the immediate threat of investigating or preventing
terrorist acts.”

2. Go to the In Defense of Freedom web site and endorse the statement:
< [url=http://www.indefenseoffreedom.org]http://www.indefenseoffreedom.org[/url]>

3. Forward this message to at least five other people.

We have less than 100 hours before Congress acts on legislation
that will (a) significantly expand the use of Carnivore, (b) make computer hacking
a form of terrorism, (c) expand electronic surveillance in routine criminal
investigations, and (d) reduce government accountability.

Please act now.

More generally, I expect to see many pieces of legislation that
will address these matters. Visit the following Web sites for up-to-date information
on what is happening and what you can do to help.

The Electronic Privacy Information Center:
< [url=http://www.epic.org]http://www.epic.org[/url]>

The Center for Democracy and Technology:
< [url=http://www.cdt.org]http://www.cdt.org[/url]>

The American Civil Liberties Union:
< [url=http://www.aclu.org]http://www.aclu.org[/url]>

Electronic Frontier Foundation:
< [url=http://www.eff.org]http://www.eff.org[/url]>


CRYPTO-GRAM is a free monthly newsletter providing summaries,
analyses, insights, and commentaries on computer security and cryptography.
Back issues are available on < [url=http://www.counterpane.com/crypto-gram.html]http://www.counterpane.com/crypto-gram.html[/url]>.

http://www.counterpane.com/crypto-gram.html[/url]>
or send a blank message to [email]crypto-gram-subscribe@chaparraltree.com[/email] To unsubscribe,
visit < [url=http://www.counterpane.com/unsubform.html]http://www.counterpane.com/unsubform.html[/url]>.

Please feel free to forward CRYPTO-GRAM to colleagues and friends
who will find it valuable. Permission is granted to reprint CRYPTO-GRAM, as
long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier. Schneier is founder
and CTO of Counterpane Internet Security Inc., the author of “Secrets and Lies”
and “Applied Cryptography,” and an inventor of the Blowfish, Twofish, and Yarrow
algorithms. He is a member of the Advisory Board of the Electronic Privacy Information
Center (EPIC). He is a frequent writer and lecturer on computer security and
cryptography.

Counterpane Internet Security, Inc. is the world leader in Managed
Security Monitoring. Counterpane’s expert security analysts protect networks
for Fortune 1000 companies world-wide.

http://www.counterpane.com/[/url]

Copyright (c) 2001 by Counterpane Internet Security, Inc.


Copyright Counterpane Internet Security, Inc., 2001
Reprint Permission

A plague of 3 things at the Malt House

And God send unto Cross – “WATER THREE TIMES”

Last Sunday the immerstion heater ballcock ball cocked it’s last.
Also followed by it’s Son the overflow pipe, which wasn’t connected to anything AT ALL!

So when we came in from visiting Mother (grass cut etc) the floor was starting to get wet. Good job we hadn’t got the new carpets yet.

Monday morning – “Mark the sink’s not going down”.
(Blocked waste disposal unit)

Tuesday washing machine leak appeared. The cold inlet piple leaking to the machine. The man who gets sent out to fix it says he’s never seen a new installation fail 🙂 hmm….

Up shot of this week
Plumbing basics learnt “on the job”
Replacing ballcock system and plumbing plastic 3/4″ piping

I have my own views on how to stop days like September 11th 2001, they’ll be coming later – when I get more time!!!

Other news: last weekend Py finished painting the front room. So we now have two nice rooms in the flat.

Thanks Py

XXX

It may appear as though I am dead but …

Py and I have been a bit busy – Py especially.

Bedroom painted.
Kitchen and bathroom new flooring.
Front room stripped of three layers of wall paper. Plaster emulsion applied.

Photos to follow on all of the above.

Washing machine arrived today. Py’s first day back at Uni.

Py & Mx’s physical anniversary yesterday.

Please listen to Bruce and his friends, Mr Bush – ta MX

http://www.counterpane.com/crypto-gram-0109a.html[/url]

September 30, 2001

by Bruce Schneier
Founder and CTO
Counterpane Internet Security, Inc.

Copyright (c) 2001 by Counterpane Internet Security, Inc.


This is a special issue of Crypto-Gram, devoted to the September
11 terrorist attacks and their aftermath.

Please distribute this issue widely.

In this issue:

  • [url=#1]The Attacks[/url]
  • [url=#2]Airline Security Regulations[/url]
  • [url=#3]Biometrics in Airports[/url]
  • [url=#4]Diagnosing Intelligence Failures[/url]
  • [url=#5]Regulating Cryptography[/url]
  • [url=#6]Terrorists and Steganography[/url]
  • [url=#7]News[/url]
  • [url=#8]Protecting Privacy and Liberty[/url]
  • [url=#9]How to Help[/url]

The Attacks

Watching the television on September 11, my primary reaction was
amazement.

The attacks were amazing in their diabolicalness and audacity:
to hijack fuel-laden commercial airliners and fly them into buildings, killing
thousands of innocent civilians. We’ll probably never know if the attackers
realized that the heat from the jet fuel would melt the steel supports and collapse
the World Trade Center. It seems probable that they placed advantageous trades
on the world’s stock markets just before the attack. No one planned for an attack
like this. We like to think that human beings don’t make plans like this.

I was impressed when al-Qaeda simultaneously bombed two American
embassies in Africa. I was more impressed when they blew a 40-foot hole in an
American warship. This attack makes those look like minor operations.

The attacks were amazing in their complexity. Estimates are that
the plan required about 50 people, at least 19 of them willing to die. It required
training. It required logistical support. It required coordination. The sheer
scope of the attack seems beyond the capability of a terrorist organization.

The attacks rewrote the hijacking rule book. Responses to hijackings
are built around this premise: get the plane on the ground so negotiations can
begin. That’s obsolete now.

They rewrote the terrorism book, too. Al-Qaeda invented a new
type of attacker. Historically, suicide bombers are young, single, fanatical,
and have nothing to lose. These people were older and more experienced. They
had marketable job skills. They lived in the U.S.: watched television, ate fast
food, drank in bars. One left a wife and four children.

It was also a new type of attack. One of the most difficult things
about a terrorist operation is getting away. This attack neatly solved that
problem. It also solved the technological problem. The United States spends
billions of dollars on remote-controlled precision-guided munitions; al-Qaeda
just finds morons willing to fly planes into skyscrapers.

Finally, the attacks were amazing in their success. They weren’t
perfect. We know that 100% of the attempted hijackings were successful, and
75% of the hijacked planes successfully hit their targets. We don’t know how
many planned hijackings were aborted for one reason or another. What’s most
amazing is that the plan wasn’t leaked. No one successfully defected. No one
slipped up and gave the plan away. Al-Qaeda had assets in the U.S. for months,
and managed to keep the plan secret. Often law enforcement has been lucky here;
in this case we weren’t.

Rarely do you see an attack that changes the world’s conception
of attack, as these terrorist attacks changed the world’s conception of what
a terrorist attack can do. Nothing they did was novel, yet the attack was completely
new. And our conception of defense must change as well.


Airline Security Regulations

Computer security experts have a lot of expertise that can be
applied to the real world. First and foremost, we have well-developed senses
of what security looks like. We can tell the difference between real security
and snake oil. And the new airport security rules, put in place after September
11, look and smell a whole lot like snake oil.

All the warning signs are there: new and unproven security measures,
no real threat analysis, unsubstantiated security claims. The ban on cutting
instruments is a perfect example. It’s a knee-jerk reaction: the terrorists
used small knives and box cutters, so we must ban them. And nail clippers, nail
files, cigarette lighters, scissors (even small ones), tweezers, etc. But why
isn’t anyone asking the real questions: what is the threat, and how does turning
an airplane into a kindergarten classroom reduce the threat? If the threat is
hijacking, then the countermeasure doesn’t protect against all the myriad of
ways people can subdue the pilot and crew. Hasn’t anyone heard of karate? Or
broken bottles? Think about hiding small blades inside luggage. Or composite
knives that don’t show up on metal detectors.

Parked cars now must be 300 feet from airport gates. Why? What
security problem does this solve? Why doesn’t the same problem imply that passenger
drop-off and pick-up should also be that far away? Curbside check-in has been
eliminated. What’s the threat that this security measure has solved? Why, if
the new threat is hijacking, are we suddenly worried about bombs?

The rule limiting concourse access to ticketed passengers is another
one that confuses me. What exactly is the threat here? Hijackers have to be
on the planes they’re trying to hijack to carry out their attack, so they have
to have tickets. And anyone can call Priceline.com and “name their own price”
for concourse access.

Increased inspections — of luggage, airplanes, airports — seem
like a good idea, although it’s far from perfect. The biggest problem here is
that the inspectors are poorly paid and, for the most part, poorly educated
and trained. Other problems include the myriad ways to bypass the checkpoints
— numerous studies have found all sorts of violations — and the impossibility
of effectively inspecting everybody while maintaining the required throughput.
Unidentified armed guards on select flights is another mildly effective idea:
it’s a small deterrent, because you never know if one is on the flight you want
to hijack.

Positive bag matching — ensuring that a piece of luggage does
not get loaded on the plane unless its owner boards the plane — is actually
a good security measure, but assumes that bombers have self-preservation as
a guiding force. It is completely useless against suicide bombers.

The worst security measure of them all is the photo ID requirement.
This solves no security problem I can think of. It doesn’t even identify people;
any high school student can tell you how to get a fake ID. The requirement for
this invasive and ineffective security measure is secret; the FAA won’t send
you the written regulations if you ask. Airlines are actually more stringent
about this than the FAA requires, because the “security” measure solves a business
problem for them.

The real point of photo ID requirements is to prevent people from
reselling tickets. Nonrefundable tickets used to be regularly advertised in
the newspaper classifieds. Ads would read something like “Round trip, Boston
to Chicago, 11/22 – 11/30, female, $50.” Since the airlines didn’t check ID
but could notice gender, any female could buy the ticket and fly the route.
Now this doesn’t work. The airlines love this; they solved a problem of theirs,
and got to blame the solution on FAA security requirements.

Airline security measures are primarily designed to give the appearance
of good security rather than the actuality. This makes sense, once you realize
that the airlines’ goal isn’t so much to make the planes hard to hijack, as
to make the passengers willing to fly. Of course airlines would prefer it if
all their flights were perfectly safe, but actual hijackings and bombings are
rare events and they know it.

This is not to say that all airport security is useless, and that
we’d be better off doing nothing. All security measures have benefits, and all
have costs: money, inconvenience, etc. I would like to see some rational analysis
of the costs and benefits, so we can get the most security for the resources
we have.

One basic snake-oil warning sign is the use of self-invented security
measures, instead of expert-analyzed and time-tested ones. The closest the airlines
have to experienced and expert analysis is El Al. Since 1948 they have been
operating in and out of the most heavily terroristic areas of the planet, with
phenomenal success. They implement some pretty heavy security measures. One
thing they do is have reinforced, locked doors between their airplanes’ cockpit
and the passenger section. (Notice that this security measure is 1) expensive,
and 2) not immediately perceptible to the passenger.) Another thing they do
is place all cargo in decompression chambers before takeoff, to trigger bombs
set to sense altitude. (Again, this is 1) expensive, and 2) imperceptible, so
unattractive to American airlines.) Some of the things El Al does are so intrusive
as to be unconstitutional in the U.S., but they let you take your pocketknife
on board with you.

Airline security:
< [url=http://www.time.com/time/covers/1101010924/bsecurity.html]http://www.time.com/time/covers/1101010924/bsecurity.html[/url]>

< [url=http://www.accessatlanta.com/ajc/terrorism/atlanta/0925gun.html]http://www.accessatlanta.com/ajc/terrorism/atlanta/0925gun.html[/url]>

FAA on new security rules:
< [url=http://www.faa.gov/apa/faq/pr_faq.htm]http://www.faa.gov/apa/faq/pr_faq.htm[/url]>

A report on the rules’ effectiveness:
< [url=http://www.boston.com/dailyglobe2/266/nation/Passengers_say_banned_items_have_eluded_airport_monitors+.shtml]http://www.boston.com/dailyglobe2/266/nation/Passengers_say_banned_items_have_eluded_airport_monitors+.shtml[/url]>

El Al’s security measures:
< [url=http://news.excite.com/news/ap/010912/18/israel-safe-aviation]http://news.excite.com/news/ap/010912/18/israel-safe-aviation[/url]>

< [url=http://news.excite.com/news/r/010914/07/international-attack-israel-elal-dc]http://news.excite.com/news/r/010914/07/international-attack-israel-elal-dc[/url]>

More thoughts on this topic:
< [url=http://slate.msn.com/HeyWait/01-09-17/HeyWait.asp]http://slate.msn.com/HeyWait/01-09-17/HeyWait.asp[/url]>

< [url=http://www.tnr.com/100101/easterbrook100101.html]http://www.tnr.com/100101/easterbrook100101.html[/url]>

< [url=http://www.tisc2001.com/newsletters/317.html]http://www.tisc2001.com/newsletters/317.html[/url]>

Two secret FAA documents on photo ID requirement, in text and
GIF:
< [url=http://www.cs.berkeley.edu/~daw/faa/guid/guid.txt]http://www.cs.berkeley.edu/~daw/faa/guid/guid.txt[/url]>

< [url=http://www.cs.berkeley.edu/~daw/faa/guid/guid.html]http://www.cs.berkeley.edu/~daw/faa/guid/guid.html[/url]>

< [url=http://www.cs.berkeley.edu/~daw/faa/id/id.txt]http://www.cs.berkeley.edu/~daw/faa/id/id.txt[/url]>

< [url=http://www.cs.berkeley.edu/~daw/faa/id/id.html]http://www.cs.berkeley.edu/~daw/faa/id/id.html[/url]>

Passenger profiling:
< [url=http://www.latimes.com/news/nationworld/nation/la-091501profile.story]http://www.latimes.com/news/nationworld/nation/la-091501profile.story[/url]>

A CATO Institute report: “The Cost of Antiterrorist Rhetoric,”
written well before September 11:
< [url=http://www.cato.org/pubs/regulation/reg19n4e.html]http://www.cato.org/pubs/regulation/reg19n4e.html[/url]>

I don’t know if this is a good idea, but at least someone is thinking
about the problem:
< [url=http://www.zdnet.com/anchordesk/stories/story/0,10738,2812283,00.html]http://www.zdnet.com/anchordesk/stories/story/0,10738,2812283,00.html[/url]>


Biometrics in Airports

You have to admit, it sounds like a good idea. Put cameras throughout
airports and other public congregation areas, and have automatic face-recognition
software continuously scan the crowd for suspected terrorists. When the software
finds one, it alerts the authorities, who swoop down and arrest the bastards.
Voila, we’re safe once again.

Reality is a lot more complicated; it always is. Biometrics is
an effective authentication tool, and I’ve written about it before. There are
three basic kinds of authentication: something you know (password, PIN code,
secret handshake), something you have (door key, physical ticket into a concert,
signet ring), and something you are (biometrics). Good security uses at least
two different authentication types: an ATM card and a PIN code, computer access
using both a password and a fingerprint reader, a security badge that includes
a picture that a guard looks at. Implemented properly, biometrics can be an
effective part of an access control system.

I think it would be a great addition to airport security: identifying
airline and airport personnel such as pilots, maintenance workers, etc. That’s
a problem biometrics can help solve. Using biometrics to pick terrorists out
of crowds is a different kettle of fish.

In the first case (employee identification), the biometric system
has a straightforward problem: does this biometric belong to the person it claims
to belong to? In the latter case (picking terrorists out of crowds), the system
needs to solve a much harder problem: does this biometric belong to anyone in
this large database of people? The difficulty of the latter problem increases
the complexity of the identification, and leads to identification failures.

Setting up the system is different for the two applications. In
the first case, you can unambiguously know the reference biometric belongs to
the correct person. In the latter case, you need to continually worry about
the integrity of the biometric database. What happens if someone is wrongfully
included in the database? What kind of right of appeal does he have?

Getting reference biometrics is different, too. In the first case,
you can initialize the system with a known, good biometric. If the biometric
is face recognition, you can take good pictures of new employees when they are
hired and enter them into the system. Terrorists are unlikely to pose for photo
shoots. You might have a grainy picture of a terrorist, taken five years ago
from 1000 yards away when he had a beard. Not nearly as useful.

But even if all these technical problems were magically solved,
it’s still very difficult to make this kind of system work. The hardest problem
is the false alarms. To explain why, I’m going to have to digress into statistics
and explain the base rate fallacy.

Suppose this magically effective face-recognition software is
99.99 percent accurate. That is, if someone is a terrorist, there is a 99.99
percent chance that the software indicates “terrorist,” and if someone is not
a terrorist, there is a 99.99 percent chance that the software indicates “non-terrorist.”
Assume that one in ten million flyers, on average, is a terrorist. Is the software
any good?

No. The software will generate 1000 false alarms for every one
real terrorist. And every false alarm still means that all the security people
go through all of their security procedures. Because the population of non-terrorists
is so much larger than the number of terrorists, the test is useless. This result
is counterintuitive and surprising, but it is correct. The false alarms in this
kind of system render it mostly useless. It’s “The Boy Who Cried Wolf” increased
1000-fold.

I say mostly useless, because it would have some positive effect.
Once in a while, the system would correctly finger a frequent-flyer terrorist.
But it’s a system that has enormous costs: money to install, manpower to run,
inconvenience to the millions of people incorrectly identified, successful lawsuits
by some of those people, and a continued erosion of our civil liberties. And
all the false alarms will inevitably lead those managing the system to distrust
its results, leading to sloppiness and potentially costly mistakes. Ubiquitous
harvesting of biometrics might sound like a good idea, but I just don’t think
it’s worth it.

Phil Agre on face-recognition biometrics:
< [url=http://dlis.gseis.ucla.edu/people/pagre/bar-code.html]http://dlis.gseis.ucla.edu/people/pagre/bar-code.html[/url]>

My original essay on biometrics:
< [url=http://www.counterpane.com/crypto-gram-9808.html#biometrics]http://www.counterpane.com/crypto-gram-9808.html#biometrics[/url]>

Face recognition useless in airports:
< [url=http://www.theregister.co.uk/content/4/21916.html]http://www.theregister.co.uk/content/4/21916.html[/url]>

According to a DARPA study, to detect 90 per cent of terrorists we’d need to
raise an alarm for one in every three people passing through the airport.

A company that is pushing this idea:
< [url=http://www.theregister.co.uk/content/6/21882.html]http://www.theregister.co.uk/content/6/21882.html[/url]>

A version of this article was published here:
< [url=http://www.extremetech.com/article/0,3396,s%253D1024%2526a%253D15070,00.asp]http://www.extremetech.com/article/0,3396,s%253D1024%2526a%253D15070,00.asp[/url]>


Diagnosing Intelligence
Failures

It’s clear that U.S. intelligence failed to provide adequate warning
of the September 11 terrorist attacks, and that the FBI failed to prevent the
attacks. It’s also clear that there were all sorts of indications that the attacks
were going to happen, and that there were all sorts of things that we could
have noticed but didn’t. Some have claimed that this was a massive intelligence
failure, and that we should have known about and prevented the attacks. I am
not convinced.

There’s a world of difference between intelligence data and intelligence
information. In what I am sure is the mother of all investigations, the CIA,
NSA, and FBI have uncovered all sorts of data from their files, data that clearly
indicates that an attack was being planned. Maybe it even clearly indicates
the nature of the attack, or the date. I’m sure lots of information is there,
in files, intercepts, computer memory.

Armed with the clarity of hindsight, it’s easy to look at all
the data and point to what’s important and relevant. It’s even easy to take
all that important and relevant data and turn it into information. And it’s
real easy to take that information and construct a picture of what’s going on.

It’s a lot harder to do before the fact. Most data is irrelevant,
and most leads are false ones. How does anyone know which is the important one,
that effort should be spent on this specific threat and not the thousands of
others?

So much data is collected — the NSA sucks up an almost unimaginable
quantity of electronic communications, the FBI gets innumerable leads and tips,
and our allies pass all sorts of information to us — that we can’t possibly
analyze it all. Imagine terrorists are hiding plans for attacks in the text
of books in a large university library; you have no idea how many plans there
are or where they are, and the library expands faster than you can possibly
read it. Deciding what to look at is an impossible task, so a lot of good intelligence
goes unlearned.

We also don’t have any context to judge the intelligence effort.
How many terrorist attempts have been thwarted in the past year? How many groups
are being tracked? If the CIA, NSA, and FBI succeed, no one ever knows. It’s
only in failure that they get any recognition.

And it was a failure. Over the past couple of decades, the U.S.
has relied more and more on high-tech electronic eavesdropping (SIGINT and COMINT)
and less and less on old fashioned human intelligence (HUMINT). This only makes
the analysis problem worse: too much data to look at, and not enough real-world
context. Look at the intelligence failures of the past few years: failing to
predict India’s nuclear test, or the attack on the USS Cole, or the bombing
of the two American embassies in Africa; concentrating on Wen Ho Lee to the
exclusion of the real spies, like Robert Hanssen.

But whatever the reason, we failed to prevent this terrorist attack.
In the post mortem, I’m sure there will be changes in the way we collect and
(most importantly) analyze anti-terrorist data. But calling this a massive intelligence
failure is a disservice to those who are working to keep our country secure.

Intelligence failure is an overreliance on eavesdropping and not
enough on human intelligence:
< [url=http://www.sunspot.net/bal-te.intelligence13sep13.story]http://www.sunspot.net/bal-te.intelligence13sep13.story[/url]>

< [url=http://www.newscientist.com/news/news.jsp?id=ns99991297]http://www.newscientist.com/news/news.jsp?id=ns99991297[/url]>

Another view:
< [url=http://www.wired.com/news/politics/0,1283,46746,00.html]http://www.wired.com/news/politics/0,1283,46746,00.html[/url]>

Too much electronic eavesdropping only makes things harder:
< [url=http://www.wired.com/news/business/0,1367,46817,00.html]http://www.wired.com/news/business/0,1367,46817,00.html[/url]>

Israel alerted the U.S. about attacks:
< [url=http://www.latimes.com/news/nationworld/nation/la-092001probe.story]http://www.latimes.com/news/nationworld/nation/la-092001probe.story[/url]>

Mostly retracted:
< [url=http://www.latimes.com/news/nationworld/nation/la-092101mossad.story]http://www.latimes.com/news/nationworld/nation/la-092101mossad.story[/url]>


Regulating Cryptography

In the wake of the devastating attacks on New York’s World Trade
Center and the Pentagon, Senator Judd Gregg and other high-ranking government
officials quickly seized on the opportunity to resurrect limits on strong encryption
and key escrow systems that ensure government access to encrypted messages.

I think this is a bad move. It will do little to thwart terrorist
activities, while at the same time significantly reducing the security of our
own critical infrastructure. We’ve been through these arguments before, but
legislators seem to have short memories. Here’s why trying to limit cryptography
is bad for Internet security.

One, you can’t limit the spread of cryptography. Cryptography
is mathematics, and you can’t ban mathematics. All you can ban is a set of products
that use that mathematics, but that is something quite different. Years ago,
during the cryptography debates, an international crypto survey was completed;
it listed almost a thousand products with strong cryptography from over a hundred
countries. You might be able to control cryptography products in a handful of
industrial countries, but that won’t prevent criminals from importing them.
You’d have to ban them in every country, and even then it won’t be enough. Any
terrorist organization with a modicum of skill can write its own cryptography
software. And besides, what terrorist is going to pay attention to a legal ban?

Two, any controls on the spread of cryptography hurt more than
they help. Cryptography is one of the best security tools we have to protect
our electronic world from harm: eavesdropping, unauthorized access, meddling,
denial of service. Sure, by controlling the spread of cryptography you might
be able to prevent some terrorist groups from using cryptography, but you’ll
also prevent bankers, hospitals, and air-traffic controllers from using it.
(And, remember, the terrorists can always get the stuff elsewhere: see my first
point.) We’ve got a lot of electronic infrastructure to protect, and we need
all the cryptography we can get our hands on. If anything, we need to make strong
cryptography more prevalent if companies continue to put our planet’s critical
infrastructure online.

Three, key escrow doesn’t work. Short refresher: this is the notion
that companies should be forced to implement back doors in crypto products such
that law enforcement, and only law enforcement, can peek in and eavesdrop on
encrypted messages. Terrorists and criminals won’t use it. (Again, see my first
point.)

Key escrow also makes it harder for the good guys to secure the
important stuff. All key-escrow systems require the existence of a highly sensitive
and highly available secret key or collection of keys that must be maintained
in a secure manner over an extended time period. These systems must make decryption
information quickly accessible to law enforcement agencies without notice to
the key owners. Does anyone really think that we can build this kind of system
securely? It would be a security engineering task of unbelievable magnitude,
and I don’t think we have a prayer of getting it right. We can’t build a secure
operating system, let alone a secure computer and secure network.

Stockpiling keys in one place is a huge risk just waiting for
attack or abuse. Whose digital security do you trust absolutely and without
question, to protect every major secret of the nation? Which operating system
would you use? Which firewall? Which applications? As attractive as it may sound,
building a workable key-escrow system is beyond the current capabilities of
computer engineering.

Years ago, a group of colleagues and I wrote a paper outlining
why key escrow is a bad idea. The arguments in the paper still stand, and I
urge everyone to read it. It’s not a particularly technical paper, but it lays
out all the problems with building a secure, effective, scalable key-escrow
infrastructure.

The events of September 11 have convinced a lot of people that
we live in dangerous times, and that we need more security than ever before.
They’re right; security has been dangerously lax in many areas of our society,
including cyberspace. As more and more of our nation’s critical infrastructure
goes digital, we need to recognize cryptography as part of the solution and
not as part of the problem.

My old “Risks of Key Recovery” paper:
< [url=http://www.counterpane.com/key-escrow.html]http://www.counterpane.com/key-escrow.html[/url]>

Articles on this topic:
< [url=http://cgi.zdnet.com/slink?140437:8469234]http://cgi.zdnet.com/slink?140437:8469234[/url]>

< [url=http://www.wired.com/news/politics/0,1283,46816,00.html]http://www.wired.com/news/politics/0,1283,46816,00.html[/url]>

< [url=http://www.pcworld.com/news/article/0,aid,62267,00.asp]http://www.pcworld.com/news/article/0,aid,62267,00.asp[/url]>

< [url=http://www.newscientist.com/news/news.jsp?id=ns99991309]http://www.newscientist.com/news/news.jsp?id=ns99991309[/url]>

< [url=http://www.zdnet.com/zdnn/stories/news/0,4586,2814833,00.html]http://www.zdnet.com/zdnn/stories/news/0,4586,2814833,00.html[/url]>

Al-Qaeda did not use encryption to plan these attacks:
< [url=http://dailynews.yahoo.com/h/nm/20010918/ts/attack_investigation_dc_23.html]http://dailynews.yahoo.com/h/nm/20010918/ts/attack_investigation_dc_23.html[/url]>

Poll indicates that 72 percent of Americans believe that anti-encryption
laws would be “somewhat” or “very” helpful in preventing a repeat of last week’s
terrorist attacks on New York’s World Trade Center and the Pentagon in Washington,
D.C. No indication of what percentage actually understood the question.
< [url=http://news.cnet.com/news/0-1005-200-7215723.html?tag=mn_hd]http://news.cnet.com/news/0-1005-200-7215723.html?tag=mn_hd[/url]>


Terrorists and Steganography

Guess what? Al-Qaeda may use steganography. According to nameless
“U.S. officials and experts” and “U.S. and foreign officials,” terrorist groups
are “hiding maps and photographs of terrorist targets and posting instructions
for terrorist activities on sports chat rooms, pornographic bulletin boards
and other Web sites.”

I’ve written about steganography in the past, and I don’t want
to spend much time retracing old ground. Simply, steganography is the science
of hiding messages in messages. Typically, a message (either plaintext or, more
cleverly, ciphertext) is encoded as tiny changes to the color of the pixels
of a digital photograph. Or in imperceptible noise in an audio file. To the
uninitiated observer, it’s just a picture. But to the sender and receiver, there’s
a message hiding in there.

It doesn’t surprise me that terrorists are using this trick. The
very aspects of steganography that make it unsuitable for normal corporate use
make it ideally suited for terrorist use. Most importantly, it can be used in
an electronic dead drop.

If you read the FBI affidavit against Robert Hanssen, you learn
how Hanssen communicated with his Russian handlers. They never met, but would
leave messages, money, and documents for one another in plastic bags under a
bridge. Hanssen’s handler would leave a signal in a public place — a chalk
mark on a signpost — to indicate a waiting package. Hanssen would later collect
the package.

That’s a dead drop. It has many advantages over a face-to-face
meeting. One, the two parties are never seen together. Two, the two parties
don’t have to coordinate a rendezvous. Three, and most importantly, one party
doesn’t even have to know who the other one is (a definite advantage if one
of them is arrested). Dead drops can be used to facilitate completely anonymous,
asynchronous communications.

Using steganography to embed a message in a pornographic image
and posting it to a Usenet newsgroup is the cyberspace equivalent of a dead
drop. To everyone else, it’s just a picture. But to the receiver, there’s a
message in there waiting to be extracted.

To make it work in practice, the terrorists would need to set
up some sort of code. Just as Hanssen knew to collect his package when he saw
the chalk mark, a virtual terrorist will need to know to look for his message.
(He can’t be expected to search every picture.) There are lots of ways to communicate
a signal: timestamp on the message, an uncommon word in the subject line, etc.
Use your imagination here; the possibilities are limitless.

The effect is that the sender can transmit a message without ever
communicating directly with the receiver. There is no e-mail between them, no
remote logins, no instant messages. All that exists is a picture posted to a
public forum, and then downloaded by anyone sufficiently enticed by the subject
line (both third parties and the intended receiver of the secret message).

So, what’s a counter-espionage agency to do? There are the standard
ways of finding steganographic messages, most of which involve looking for changes
in traffic patterns. If Bin Laden is using pornographic images to embed his
secret messages, it is unlikely these pictures are being taken in Afghanistan.
They’re probably downloaded from the Web. If the NSA can keep a database of
images (wouldn’t that be something?), then they can find ones with subtle changes
in the low-order bits. If Bin Laden uses the same image to transmit multiple
messages, the NSA could notice that. Otherwise, there’s probably nothing the
NSA can do. Dead drops, both real and virtual, can’t be prevented.

Why can’t businesses use this? The primary reason is that legitimate
businesses don’t need dead drops. I remember hearing one company talk about
a corporation embedding a steganographic message to its salespeople in a photo
on the corporate Web page. Why not just send an encrypted e-mail? Because someone
might notice the e-mail and know that the salespeople all got an encrypted message.
So send a message every day: a real message when you need to, and a dummy message
otherwise. This is a traffic analysis problem, and there are other techniques
to solve it. Steganography just doesn’t apply here.

Steganography is good way for terrorist cells to communicate,
allowing communication without any group knowing the identity of the other.
There are other ways to build a dead drop in cyberspace. A spy can sign up for
a free, anonymous e-mail account, for example. Bin Laden probably uses those
too.

News articles:
< [url=http://www.wired.com/news/print/0,1294,41658,00.html]http://www.wired.com/news/print/0,1294,41658,00.html[/url]>

< [url=http://www.usatoday.com/life/cyber/tech/2001-02-05-binladen.htm]http://www.usatoday.com/life/cyber/tech/2001-02-05-binladen.htm[/url]>

< [url=http://www.sfgate.com/cgi-bin/article.cgi?file=/gate/archive/2001/09/20/sigintell.DTL]http://www.sfgate.com/cgi-bin/article.cgi?file=/gate/archive/2001/09/20/sigintell.DTL[/url]>

< [url=http://www.cnn.com/2001/US/09/20/inv.terrorist.search/]http://www.cnn.com/2001/US/09/20/inv.terrorist.search/[/url]>

< [url=http://www.washingtonpost.com/wp-dyn/articles/A52687-2001Sep18.html]http://www.washingtonpost.com/wp-dyn/articles/A52687-2001Sep18.html[/url]>

My old essay on steganography:
< [url=http://www.counterpane.com/crypto-gram-9810.html#steganography]http://www.counterpane.com/crypto-gram-9810.html#steganography[/url]>

Study claims no steganography on eBay:
< [url=http://www.theregister.co.uk/content/4/21829.html]http://www.theregister.co.uk/content/4/21829.html[/url]>

Detecting steganography on the Internet:
< [url=http://www.citi.umich.edu/techreports/reports/citi-tr-01-11.pdf]http://www.citi.umich.edu/techreports/reports/citi-tr-01-11.pdf[/url]>

A version of this essay appeared on ZDnet:
< [url=http://www.zdnet.com/zdnn/stories/comment/0,5859,2814256,00.html]http://www.zdnet.com/zdnn/stories/comment/0,5859,2814256,00.html[/url]>

< [url=http://www.msnbc.com/news/633709.asp?0dm=B12MT]http://www.msnbc.com/news/633709.asp?0dm=B12MT[/url]>


News

I am not opposed to using force against the terrorists. I am not
opposed to going to war — for retribution, deterrence, and the restoration
of the social contract — assuming a suitable enemy can be identified. Occasionally,
peace is something you have to fight for. But I think the use of force is far
more complicated than most people realize. Our actions are important; messing
this up will only make things worse.

Written before September 11: A former CIA operative explains why
the terrorist Usama bin Laden has little to fear from American intelligence.

< [url=http://www.theatlantic.com/issues/2001/07/gerecht.htm]http://www.theatlantic.com/issues/2001/07/gerecht.htm[/url]>

And a Russian soldier discusses why war in Afghanistan will be a nightmare.

< [url=http://www.latimes.com/news/printedition/asection/la-000075191sep19.story]http://www.latimes.com/news/printedition/asection/la-000075191sep19.story[/url]>

A British soldier explains the same:
< [url=http://www.sunday-times.co.uk/news/pages/sti/2001/09/23/stiusausa02023.html?]http://www.sunday-times.co.uk/news/pages/sti/2001/09/23/stiusausa02023.html?[/url]>

Lessons from Britain on fighting terrorism:
< [url=http://www.salon.com/news/feature/2001/09/19/fighting_terror/index.html]http://www.salon.com/news/feature/2001/09/19/fighting_terror/index.html[/url]>

1998 Esquire interview with Bin Ladin:
< [url=http://www.esquire.com/features/articles/2001/010913_mfe_binladen_1.html]http://www.esquire.com/features/articles/2001/010913_mfe_binladen_1.html[/url]>

Phil Agre’s comments on these issues:
< [url=http://commons.somewhere.com/rre/2001/RRE.War.in.a.World.Witho.html]http://commons.somewhere.com/rre/2001/RRE.War.in.a.World.Witho.html[/url]>

< [url=http://commons.somewhere.com/rre/2001/RRE.Imagining.the.Next.W.html]http://commons.somewhere.com/rre/2001/RRE.Imagining.the.Next.W.html[/url]>

Why technology can’t save us:
< [url=http://www.osopinion.com/perl/story/13535.html]http://www.osopinion.com/perl/story/13535.html[/url]>

Hactivism exacts revenge for terrorist attacks:
< [url=http://news.cnet.com/news/0-1003-201-7214703-0.html?tag=owv]http://news.cnet.com/news/0-1003-201-7214703-0.html?tag=owv[/url]>

FBI reminds everyone that it’s illegal:
< [url=http://www.nipc.gov/warnings/advisories/2001/01-020.htm]http://www.nipc.gov/warnings/advisories/2001/01-020.htm[/url]>

< [url=http://www.ananova.com/news/story/sm_400565.html?menu=]http://www.ananova.com/news/story/sm_400565.html?menu=[/url]>

Hackers face life imprisonment under anti-terrorism act:
< [url=http://www.securityfocus.com/news/257]http://www.securityfocus.com/news/257[/url]>

Especially scary are the “advice or assistance” components. A security consultant
could face life imprisonment, without parole, if he discovered and publicized
a security hole that was later exploited by someone else. After all, without
his “advice” about what the hole was, the attacker never would have accomplished
his hack.

Companies fear cyberterrorism:
< [url=http://cgi.zdnet.com/slink?140433:8469234]http://cgi.zdnet.com/slink?140433:8469234[/url]>

< [url=http://computerworld.com/nlt/1%2C3590%2CNAV65-663_STO63965_NLTSEC%2C00.html]http://computerworld.com/nlt/1%2C3590%2CNAV65-663_STO63965_NLTSEC%2C00.html[/url]>

They’re investing in security:
< [url=http://www.washtech.com/news/software/12514-1.html]http://www.washtech.com/news/software/12514-1.html[/url]>

< [url=http://www.theregister.co.uk/content/55/21814.html]http://www.theregister.co.uk/content/55/21814.html[/url]>

Upgrading government computers to fight terrorism:
< [url=http://www.zdnet.com/zdnn/stories/news/0,4586,5096868,00.html]http://www.zdnet.com/zdnn/stories/news/0,4586,5096868,00.html[/url]>

Risks of cyberterrorism attacks against our electronic infrastructure:

< [url=http://www.businessweek.com/bwdaily/dnflash/sep2001/nf20010918_8931.htm?&_ref=1732900718]http://www.businessweek.com/bwdaily/dnflash/sep2001/nf20010918_8931.htm?&_ref=1732900718[/url]>

< [url=http://cgi.zdnet.com/slink?143569:8469234]http://cgi.zdnet.com/slink?143569:8469234[/url]>

Now the complaint is that Bin Laden is NOT using high-tech communications:

< [url=http://www.theregister.co.uk/content/57/21790.html]http://www.theregister.co.uk/content/57/21790.html[/url]>

Larry Ellison is willing to give away the software to implement
a national ID card.
< [url=http://www.siliconvalley.com/docs/news/svfront/ellsn092301.htm]http://www.siliconvalley.com/docs/news/svfront/ellsn092301.htm[/url]>

Security problems include: inaccurate information, insiders issuing fake cards
(this happens with state drivers’ licenses), vulnerability of the large database,
potential privacy abuses, etc. And, of course, no trans-national terrorists
would be listed in such a system, because they wouldn’t be U.S. citizens. What
do you expect from a company whose origins are intertwined with the CIA?


Protecting Privacy and Liberty

Appalled by the recent hijackings, many Americans have declared
themselves willing to give up civil liberties in the name of security. They’ve
declared it so loudly that this trade-off seems to be a fait accompli. Article
after article talks about the balance between privacy and security, discussing
whether various increases of security are worth the privacy and civil-liberty
losses. Rarely do I see a discussion about whether this linkage is a valid one.

Security and privacy are not two sides of a teeter-totter. This
association is simplistic and largely fallacious. It’s easy and fast, but less
effective, to increase security by taking away liberty. However, the best ways
to increase security are not at the expense of privacy and liberty.

It’s easy to refute the notion that all security comes at the
expense of liberty. Arming pilots, reinforcing cockpit doors, and teaching flight
attendants karate are all examples of security measures that have no effect
on individual privacy or liberties. So are better authentication of airport
maintenance workers, or dead-man switches that force planes to automatically
land at the closest airport, or armed air marshals traveling on flights.

Liberty-depriving security measures are most often found when
system designers failed to take security into account from the beginning. They’re
Band-aids, and evidence of bad security planning. When security is designed
into a system, it can work without forcing people to give up their freedoms.

Here’s an example: securing a room. Option one: convert the room
into an impregnable vault. Option two: put locks on the door, bars on the windows,
and alarm everything. Option three: don’t bother securing the room; instead,
post a guard in the room who records the ID of everyone entering and makes sure
they should be allowed in.

Option one is the best, but is unrealistic. Impregnable vaults
just don’t exist, getting close is prohibitively expensive, and turning a room
into a vault greatly lessens its usefulness as a room. Option two is the realistic
best; combine the strengths of prevention, detection, and response to achieve
resilient security. Option three is the worst. It’s far more expensive than
option two, and the most invasive and easiest to defeat of all three options.
It’s also a sure sign of bad planning; designers built the room, and only then
realized that they needed security. Rather then spend the effort installing
door locks and alarms, they took the easy way out and invaded people’s privacy.

A more complex example is Internet security. Preventive countermeasures
help significantly against script kiddies, but fail against smart attackers.
For a couple of years I have advocated detection and response to provide security
on the Internet. This works; my company catches attackers — both outside hackers
and insiders — all the time. We do it by monitoring the audit logs of network
products: firewalls, IDSs, routers, servers, and applications. We don’t eavesdrop
on legitimate users or read traffic. We don’t invade privacy. We monitor data
about data, and find abuse that way. No civil liberties are violated. It’s not
perfect, but nothing is. Still, combined with preventive security products it
is more effective, and more cost-effective, than anything else.

The parallels between Internet security and global security are
strong. All criminal investigation looks at surveillance records. The lowest-tech
version of this is questioning witnesses. In this current investigation, the
FBI is looking at airport videotapes, airline passenger records, flight school
class records, financial records, etc. And the better job they can do examining
these records, the more effective their investigation will be.

There are copycat criminals and terrorists, who do what they’ve
seen done before. To a large extent, this is what the hastily implemented security
measures have tried to prevent. And there are the clever attackers, who invent
new ways to attack people. This is what we saw on September 11. It’s expensive,
but we can build security to protect against yesterday’s attacks. But we can’t
guarantee protection against tomorrow’s attacks: the hacker attack that hasn’t
been invented, or the terrorist attack yet to be conceived.

Demands for even more surveillance miss the point. The problem
is not obtaining data, it’s deciding which data is worth analyzing and then
interpreting it. Everyone already leaves a wide audit trail as we go through
life, and law enforcement can already access those records with search warrants.
The FBI quickly pieced together the terrorists’ identities and the last few
months of their lives, once they knew where to look. If they had thrown up their
hands and said that they couldn’t figure out who did it or how, they might have
a case for needing more surveillance data. But they didn’t, and they don’t.

More data can even be counterproductive. The NSA and the CIA have
been criticized for relying too much on signals intelligence, and not enough
on human intelligence. The East German police collected data on four million
East Germans, roughly a quarter of their population. Yet they did not foresee
the peaceful overthrow of the Communist government because they invested heavily
in data collection instead of data interpretation. We need more intelligence
agents squatting on the ground in the Middle East arguing the Koran, not sitting
in Washington arguing about wiretapping laws.

People are willing to give up liberties for vague promises of
security because they think they have no choice. What they’re not being told
is that they can have both. It would require people to say no to the FBI’s power
grab. It would require us to discard the easy answers in favor of thoughtful
answers. It would require structuring incentives to improve overall security
rather than simply decreasing its costs. Designing security into systems from
the beginning, instead of tacking it on at the end, would give us the security
we need, while preserving the civil liberties we hold dear.

Some broad surveillance, in limited circumstances, might be warranted
as a temporary measure. But we need to be careful that it remain temporary,
and that we do not design surveillance into our electronic infrastructure. Thomas
Jefferson once said: “Eternal vigilance is the price of liberty.” Historically,
liberties have always been a casualty of war, but a temporary casualty. This
war — a war without a clear enemy or end condition — has the potential to
turn into a permanent state of society. We need to design our security accordingly.

The events of September 11th demonstrated the need for America
to redesign our public infrastructures for security. Ignoring this need would
be an additional tragedy.

Quotes from U.S. government officials on the need to preserve
liberty during this crisis:
< [url=http://www.epic.org/alert/EPIC_Alert_8.17.html]http://www.epic.org/alert/EPIC_Alert_8.17.html[/url]>

Quotes from editorial pages on the same need:
< [url=http://www.epic.org/alert/EPIC_Alert_8.18.html]http://www.epic.org/alert/EPIC_Alert_8.18.html[/url]>

Selected editorials:
< [url=http://www.nytimes.com/2001/09/16/weekinreview/16GREE.html]http://www.nytimes.com/2001/09/16/weekinreview/16GREE.html[/url]>

< [url=http://www.nytimes.com/2001/09/23/opinion/23SUN1.html]http://www.nytimes.com/2001/09/23/opinion/23SUN1.html[/url]>

< [url=http://www.freedomforum.org/templates/document.asp?documentID=14924]http://www.freedomforum.org/templates/document.asp?documentID=14924[/url]>

Schneier’s comments in the UK:
< [url=http://www.theregister.co.uk/content/55/21892.html]http://www.theregister.co.uk/content/55/21892.html[/url]>

War and liberties:
< [url=http://www.salon.com/tech/feature/2001/09/22/end_of_liberty/index.html]http://www.salon.com/tech/feature/2001/09/22/end_of_liberty/index.html[/url]>

< [url=http://www.washingtonpost.com/wp-dyn/articles/A21207-2001Sep12.html]http://www.washingtonpost.com/wp-dyn/articles/A21207-2001Sep12.html[/url]>

< [url=http://www.wired.com/news/politics/0,1283,47051,00.html]http://www.wired.com/news/politics/0,1283,47051,00.html[/url]>

More on Ashcroft’s anti-privacy initiatives:
< [url=http://www.theregister.co.uk/content/6/21854.html]http://www.theregister.co.uk/content/6/21854.html[/url]>

Editorial cartoon:
< [url=http://www.claybennett.com/pages/latest_08.html]http://www.claybennett.com/pages/latest_08.html[/url]>

Terrorists leave a broad electronic trail:
< [url=http://www.wired.com/news/politics/0,1283,46991,00.html]http://www.wired.com/news/politics/0,1283,46991,00.html[/url]>

National Review article from 1998: “Know nothings: U.S. intelligence
failures stem from too much information, not enough understanding”
< [url=http://www.findarticles.com/m1282/n14_v50/21102283/p1/article.jhtml]http://www.findarticles.com/m1282/n14_v50/21102283/p1/article.jhtml[/url]>

A previous version of this essay appeared in the San Jose Mercury
News:
< [url=http://www0.mercurycenter.com/premium/opinion/columns/security27.htm]http://www0.mercurycenter.com/premium/opinion/columns/security27.htm[/url]>


How to Help

How can you help? Speak about the issues. Write to your elected
officials. Contribute to organizations working on these issues.

This week the United States Congress will act on the most sweeping
proposal to extend the surveillance authority of the government since the end
of the Cold War. If you value privacy and live in the U.S., there are three
steps you should take before you open your next email message:

1. Urge your representatives in Congress to protect privacy.
– Call the Capitol switchboard at 202-224-3121.
– Ask to be connected to the office of your Congressional representative.
– When you are put through, say “May I please speak to the staff member who
is working on the anti-terrorism legislation?” If that person is not available
to speak with you, say “May I please leave a message?”
– Briefly explain that you appreciate the efforts of your representative to
address the challenges brought about by the September 11th tragedy, but it is
your view that it would be a mistake to make any changes in the federal wiretap
statute that do not respond to “the immediate threat of investigating or preventing
terrorist acts.”

2. Go to the In Defense of Freedom web site and endorse the statement:
< [url=http://www.indefenseoffreedom.org]http://www.indefenseoffreedom.org[/url]>

3. Forward this message to at least five other people.

We have less than 100 hours before Congress acts on legislation
that will (a) significantly expand the use of Carnivore, (b) make computer hacking
a form of terrorism, (c) expand electronic surveillance in routine criminal
investigations, and (d) reduce government accountability.

Please act now.

More generally, I expect to see many pieces of legislation that
will address these matters. Visit the following Web sites for up-to-date information
on what is happening and what you can do to help.

The Electronic Privacy Information Center:
< [url=http://www.epic.org]http://www.epic.org[/url]>

The Center for Democracy and Technology:
< [url=http://www.cdt.org]http://www.cdt.org[/url]>

The American Civil Liberties Union:
< [url=http://www.aclu.org]http://www.aclu.org[/url]>

Electronic Frontier Foundation:
< [url=http://www.eff.org]http://www.eff.org[/url]>


CRYPTO-GRAM is a free monthly newsletter providing summaries,
analyses, insights, and commentaries on computer security and cryptography.
Back issues are available on < [url=http://www.counterpane.com/crypto-gram.html]http://www.counterpane.com/crypto-gram.html[/url]>.

http://www.counterpane.com/crypto-gram.html[/url]>
or send a blank message to [email]crypto-gram-subscribe@chaparraltree.com[/email] To unsubscribe,
visit < [url=http://www.counterpane.com/unsubform.html]http://www.counterpane.com/unsubform.html[/url]>.

Please feel free to forward CRYPTO-GRAM to colleagues and friends
who will find it valuable. Permission is granted to reprint CRYPTO-GRAM, as
long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier. Schneier is founder
and CTO of Counterpane Internet Security Inc., the author of “Secrets and Lies”
and “Applied Cryptography,” and an inventor of the Blowfish, Twofish, and Yarrow
algorithms. He is a member of the Advisory Board of the Electronic Privacy Information
Center (EPIC). He is a frequent writer and lecturer on computer security and
cryptography.

Counterpane Internet Security, Inc. is the world leader in Managed
Security Monitoring. Counterpane’s expert security analysts protect networks
for Fortune 1000 companies world-wide.

http://www.counterpane.com/[/url]

Copyright (c) 2001 by Counterpane Internet Security, Inc.


Copyright Counterpane Internet Security, Inc., 2001
Reprint Permission

“The future is wireless for PCs” – yes indeed it is

… ‘Last week Jim Allchin, group vice-president of Microsoft, was talking up Windows XP, the new version of Windows for consumers (that will, by the way, make Windows95 obsolete; no more new device drivers for you, Mr Stopped-Paying-Microsoft-Six-Years-Ago-Win95 user!).

Allchin said XP will have lots of new features that will persuade people (like you, Mr SPMSYAW95 user) to upgrade their operating system, and presumably their computer. “We should have a very good next year, and when I say we, I mean the industry,” he told the Intel Developer Forum. “There are 140 million computers out there that haven’t been upgraded in three years; the operating systems and applications haven’t changed enough – haven’t added enough value – to get people to upgrade.”

Developers, or “software writers” to you and me, like such talk. Intel loves such talk, since it wants to shift some of those gigahertz-plus chips out the door.’ …

http://news.independent.co.uk/digital/reviews/story.jsp?story=91932