Quotulatiousness

July 8, 2014

The wine trade, legal “adjuncts”, and honest labelling

Filed under: Law, Technology, USA, Wine — Tags: , — Nicholas @ 14:47

In Wired, Christopher Null talks to Californian winemaker Paul Draper about what’s actually in the wine that you buy:

Unlike most food and drink, wine and other alcoholic beverages are governed not by the Food and Drug Administration (part of Health and Human Services) but by the Alcohol and Tobacco Tax and Trade Bureau (part of the U.S. Treasury). As the name suggests, the TTB’s primary goal is to collect taxes on booze and cigarettes, a longstanding vestige of Prohibition. Consumers have largely been left in the dark about what’s really inside the bottle.

Not everyone is thrilled about this, and as with many secrecy-laden industries, transparency is a buzzword that has a few wine industry leaders twittering. Their savior is Paul Draper, who has been lambasting adjuncts for years and who eschews their use at Ridge, where he’s been the chief winemaker since 1969. A legend in the business, his Cabernet placed fifth in the famous Judgment of Paris in 1976. His newest, somewhat Quixotic quest: to introduce full and truthful labeling to wine bottles. Ridge has published real ingredients labels on its bottles since 2012.

While Draper dislikes adjuncts, the enemy, he says, isn’t just cheap wine: It’s also winemakers’ increasing thirst for wines that are ready to drink without significant aging. This not only drives consumer sales, it also helps to drive higher scores from wine critics, as even professionals can struggle to rate a wine based on its future potential.

That in turn has led to a more nefarious way in which adjuncts are being deployed. While they are often used as an easy way to make cheap wine more palatable, adjuncts are increasingly being applied to high-end wines to eke another couple of points out of the critics. “You have that machine. It costs a half a million or a million dollars and it’s sitting in your winery,” Draper says. “The temptation to use it in years when you don’t need to use it is immense.” But ultimately, he complains, “If you use these techniques, you aren’t making fine wine.”

You’d think the various adjuncts wouldn’t make it past the sommeliers, high-end buyers, and big-name critics of the wine world, that such chemical or mechanical shortcuts would be picked up by their well-trained palates. But the truth is that these things can’t be sniffed, tasted, or spotted unless they are overused.

July 6, 2014

Even if you’re “doing nothing wrong”, the NSA is probably tracking you already

Filed under: Government, Liberty, Media, Technology, USA — Tags: , , , — Nicholas @ 09:17

The argument that you’ve got nothing to worry about because you’re not doing anything wrong has long since passed its best-before date. As Nick Gillespie points out, you don’t need to be a member of Al Qaeda, a black-hat hacker, or a registered Republican to be of interest to the NSA’s information gathering team:

If You’re Reading Reason.com, The NSA is Probably Already Following You

Two things to contemplate on early Sunday morning, before church or political talk shows get underway:

Remember all those times we were told that the government, especially the National Security Agency (NSA), only tracks folks who either guilty of something or involved in suspicious-seeming activity? Well, we’re going to have amend that a bit. Using documents from Edward Snowden, the Washington Post‘s Barton Gellman, Julie Tate, and Ashkan Soltani report

    Ordinary Internet users, American and non-American alike, far outnumber legally targeted foreigners in the communications intercepted by the National Security Agency from U.S. digital networks, according to a four-month investigation by The Washington Post.

    Nine of 10 account holders found in a large cache of intercepted conversations, which former NSA contractor Edward Snowden provided in full to The Post, were not the intended surveillance targets but were caught in a net the agency had cast for somebody else.

    Many of them were Americans. Nearly half of the surveillance files, a strikingly high proportion, contained names, e-mail addresses or other details that the NSA marked as belonging to U.S. citizens or residents. NSA analysts masked, or “minimized,” more than 65,000 such references to protect Americans’ privacy, but The Post found nearly 900 additional e-mail addresses, unmasked in the files, that could be strongly linked to U.S. citizens or U.S.residents.

The cache of documents in question date from 2009 through 2012 and comprise 160,000 documents collected up the PRISM and Upstream, which collect data from different sources. “Most of the people caught up in those programs are not the targets and would not lawfully qualify as such,” write Gellman, Julie Tate, and Ashkan Soltani, who also underscore that NSA surveillance has produced some very meaningful and good intelligence. The real question is whether the government can do that in a way that doesn’t result in massive dragnet programs that create far more problems ultimately than they solve (remember the Church Committee?).

Read the whole thing. And before anyone raises the old “if you’re innocent, you’ve got nothing to hide shtick,” read Scott Shackford’s “3 Reasons the ‘Nothing to Hide’ Crowd Should be worried about Government Surveillance.”

July 5, 2014

The mystic art of going viral – The Putter

Filed under: Britain, Business, Media, Technology — Tags: , — Nicholas @ 13:02

This is Collosal posted a lovely little video a few days ago, showing how one small century-old firm in Sheffield still “puts-together” scissors in the old way:

It’s been a popular video. It’s been a very popular video. In fact, it went viral.

The staff at Ernest Wright and Son Limited have been overwhelmed with interest from people who saw the video and decided they wanted a pair of hand-made scissors. A member of one of my mailing lists says he just got this response from the company about his order (placed before the video went online):

Dear Madam or Sir,

Firstly, may we thank you VERY MUCH for ordering a pair (or more) of our Hand-made in Sheffield England, Ernest Wright and Son Limited scissors.

Secondly, may I please take a moment to explain our current situation.

As you doubtless know, Shaun Bloodworth’s film “The Putter” was uploaded to the internet on Monday 23rdJune. We had been very much looking forward to seeing this film, if purely as an educational exercise documenting the immense skills of the ‘putter-togetherer’.

What we might not have expected was that Shaun’s own amazing skill, coupled with the gorgeous sound work from The Black Dog (wow!), would make such a beautiful and sensory-encompassing experience of something we just see our Cliff and Eric do every day.

And what we REALLY didn’t expect was for this film to go ‘viral’! This was not a ‘commercial launch’ by any means at all; so much as Shaun merely uploading the film for us back here in the factory to see. The power of the internet is truly an incredible and awesome thing.

This has rather caught us at an ‘interesting’ time. We have not been doing particularly well for a number of years as a business and have worryingly dwindled in size. Recently we actually had to make further redundancies and at a few times have thought that the end was truly nigh for Ernest Wright’s altogether. Cheap scissors are ubiquitous; no-one seems (seemed!) particularly interested in how scissors are made any more, and hardly anyone understood paying the price for a good pair – regardless of how we have ever tried to explain it. (Enter Shaun and “The Putter” – and what a benefit, hopefully, to us all!)

There are now just the five of us here in our little business:

Cliff and Eric are our putter-togetherers, although Cliff does the vast majority of the putting whilst Eric is also a skilled hand-grinder and finisher. Eric’s hands are actually those seen working the ‘insider’ machine in The Putter, linishing the inside of the bows (handles) with sparks flying in either direction. These two are both working through retirement years now – purely helping me to keep something we feel is so important, alive.

It would be remiss of me not to mention Ian, who eventually only retired last autumn (2013). All three can be seen here together by the way in a 2012 BBC documentary – http://www.youtube.com/watch?v=IitTC4PqcOI

These chaps have never earned too much – and there honestly hasn’t been too much to earn for a while. But they work hard; so very, very hard. And until around about this Tuesday, they had incredibly little appreciation for their life’s devotion to their craft. I am genuinely so touched that they are finally getting a mention, they so thoroughly deserve it.

We also now have young Jamie and Ryan, who are ‘the young blood’ apprentices and have been with us for around two years now. They began by learning tapping, grinding, then linishing, and are now slowly learning the full art of putting-together themselves – although not at all yet commercially. Practice will one day hopefully make them perfect.

Finally I am the managing director, van driver, salesman, go-fetcher and hopelessly-part-time receptionist. Ernest Wright was my great-grandfather, who formed the company in 1902. I took over when my father almost decided to close the business in 2012, and have since made it my mission in life to save these skills and their type – particularly in Sheffield, the hometown I am so very proud of.

So. Basically after a very long spell of quiet, since around Tuesday morning this week we have been suddenly inundated. With (gratefully) telephone calls, emails, tweets, views, messages, letters and (very gratefully) individual orders. I am honestly struggling to keep up at the moment. The telephone system has crashed and my inbox cannot download fast enough.

Regardless my aim is this: everyone who has ordered a pair of Cliff and Eric’s wonderful-handiwork scissors will receive them; as speedily and safely as is possible.

Ironically Cliff had gone off a well-earned holiday on Monday, and will be sitting in a deck chair in Filey or somewhere for the next week yet – hopefully wondering why on earth he is being asked for an autograph! He knows nothing about his new-found ‘internet popularity’, although he will be completely shy and modest about it as always when he finds out. Only Shaun’s down-to-earth and inconspicuous approach led him to be even filmed in the first place. Regardless I’m sure he will be pleased he can “learn some more” and get cracking with his hammer upon his return.

I cannot honestly promise how long these scissors are going to take to get to you at the moment! we haven’t yet worked out how many of each type are even required. Then they take a little while to be made – but you might know that now! One thing we won’t do, because Cliff and Eric would refuse every time, is to ‘do a rush job’. Your scissors might not always look quite perfect either, but that’s not what we 100% care about. Every pair might have a tiny mark, a scratch, a blemish or even the odd hammer dent, but that is precisely because they are hand, and not machine, made. They are made to be used, not looked at, is our opinion. What we concentrate on more than anything is that they work. Perfectly, every time. I actually reckon you that you can see that in Cliff’s face though, I’ve seen that a thousand times off-camera too.

We are working on strict order-date basis. I am hoping to keep up with at least broadcast emails for the next week until we see how much of a potential flash-in-the-pan this may be. It would be sadly more ironical than anything if this great new interest hurt us rather than helped, so please give me some time to address this situation properly? Meantime we have managed to send out quite a lot of orders already but the previous held-stock is now very low and new orders are still arriving! The lads are certainly preparing to get busy – apart from poor oblivious Cliff in his deckchair at the moment of course.

If orders are going to take more than one month to arrive, I will try to let you know in the next week? I hope that’s ok, it is honestly the very best we can do for now!

If you would prefer a refund, of course I understand completely. Please email me by reply to nick.wright@ernestwright.co.ukwith the title just “REFUND” and at least your order number (usually 4 digits) in the text. I will then get to it as soon as I also can.

Meantime THANK YOU so much, both to old followers and many new friends, for this amazing and wonderful support. This might be our chance for once to shine again. I will try my level best to reciprocate as much as I possibly can.

Yours with kindest regards,

Nick.

Nick Wright
Director
Ernest Wright and Son Limited
www.ernestwright.co.uk

July 2, 2014

Security threats and security myths

Filed under: Technology — Tags: , , — Nicholas @ 09:48

In Wired, Peter W. Singer And Allan Friedman analyze five common myths about online security:

“A domain for the nerds.” That is how the Internet used to be viewed back in the early 1990s, until all the rest of us began to use and depend on it. But this quote is from a White House official earlier this year describing how cybersecurity is too often viewed today. And therein lies the problem, and the needed solution.

Each of us, in whatever role we play in life, makes decisions about cybersecurity that will shape the future well beyond the world of computers. But by looking at this issue as only for the IT Crowd, we too often do so without the proper tools. Basic terms and essential concepts that define what is possible and proper are being missed, or even worse, distorted. Some threats are overblown and overreacted to, while others are ignored.

Perhaps the biggest problem is that while the Internet has given us the ability to run down the answer to almost any question, cybersecurity is a realm where past myth and future hype often weave together, obscuring what actually has happened and where we really are now. If we ever want to get anything effective done in securing the online world, we have to demystify it first.

[…]

Myth #2: Every Day We Face “Millions of Cyber Attacks”

This is what General Keith Alexander, the recently retired chief of US military and intelligence cyber operations, testified to Congress in 2010. Interestingly enough, leaders from China have made similar claims after their own hackers were indicted, pointing the finger back at the US. These numbers are both true and utterly useless.

Counting individual attack probes or unique forms of malware is like counting bacteria — you get big numbers very quickly, but all you really care about is the impact and the source. Even more so, these numbers conflate and confuse the range of threats we face, from scans and probes caught by elementary defenses before they could do any harm, to attempts at everything from pranks to political protests to economic and security related espionage (but notably no “Cyber Pearl Harbors,” which have been mentioned in government speeches and mass media a half million times). It’s a lot like combining everything from kids with firecrackers to protesters with smoke bombs to criminals with shotguns, spies with pistols, terrorists with grenades, and militaries with missiles in the same counting, all because they involve the same technology of gunpowder.

June 30, 2014

Has your Facebook feed been particularly “down” lately?

Filed under: Media, Technology — Tags: , , — Nicholas @ 08:42

If so, you may have been involuntarily recruited to take part in a “scientific” study as Facebook tailored hundreds of thousands of users’ feeds to show them only good news or only bad news:

As you may have heard (since it appears to have become the hyped up internet story of the weekend), the Proceedings of the National Academy of Sciences (PNAS) recently published a study done by Facebook, with an assist from researchers at UCSF and Cornell, in which they directly tried (and apparently succeeded) to manipulate the emotions of 689,003 users of Facebook for a week. The participants — without realizing they were a part of the study — had their news feeds “manipulated” so that they showed all good news or all bad news. The idea was to see if this made the users themselves feel good or bad. Contradicting some other research which found that looking at photos of your happy friends made you sad, this research apparently found that happy stuff in your feed makes you happy. But, what’s got a lot of people up in arms is the other side of that coin: seeing a lot of negative stories in your feed, appears to make people mad.

There are, of course, many different ways to view this: and the immediate response from many is “damn, that’s creepy.”

Did you know that your terms of service with Facebook allow this? I suspect a lot of Facebook users had no clue that their newsfeeds could be (and regularly are) manipulated without their awareness and consent.

If anything, what I think this does is really to highlight how much Facebook manipulates the newsfeed. This is something very few people seem to think about or consider. Facebook‘s newsfeed system has always been something of a black box (which is a reason that I prefer Twitter‘s setup where you get the self-chosen firehose, rather than some algorithm (or researchers’ decisions) picking what I get to see). And, thus, in the end, while Facebook may have failed to get the level of “informed consent” necessary for such a study, it may have, in turn, done a much better job accidentally “informing” a lot more people how its newsfeeds get manipulated. Whether or not that leads more people to rely on Facebook less, well, perhaps that will be the subject of a future study…

Related: Brendan posted this the other day, and I found it quite amusing.

June 23, 2014

Justice Department staff fall for phishing scam simulation

Filed under: Cancon, Government, Technology — Tags: , — Nicholas @ 06:36

This doesn’t speak well of the federal government’s staff security training:

Many of the Justice Department’s finest legal minds are falling prey to a garden-variety Internet scam.

An internal survey shows almost 2,000 staff were conned into clicking on a phoney “phishing” link in their email, raising questions about the security of sensitive information.

The department launched the mock scam in December as a security exercise, sending emails to 5,000 employees to test their ability to recognize cyber fraud.

The emails looked like genuine communications from government or financial institutions, and contained a link to a fake website that was also made to look like the real thing.

What’s even more interesting is that the government bureaucrats fell for this scam at a far higher rate than average Canadian internet users:

The Justice Department’s mock exercise caught 1,850 people clicking on the phoney embedded links, or 37 per cent of everyone who received the emails.

That’s a much higher rate than for the general population, which a federal website says is only about five per cent.

The exercise did not put any confidential information at risk, but the poor results raise red flags about public servants being caught by actual phishing emails.

A spokeswoman says “no privacy breaches have been reported” from any real phishing scams at Justice Canada.

Carole Saindon also said that two more waves of mock emails in February and April show improved results, with clicking rates falling by half.

So in an earlier test, our public servants were clicking on phishing links well over 50% of the time? Yikes.

June 21, 2014

The science of booze

Filed under: History, Science, Technology, Wine — Tags: , , — Nicholas @ 09:18

Mankind has been making alcoholic beverages for thousands of years, yet there are still some pretty basic things we don’t know about alcohol:

Consider the number of things we still don’t know: Yeast, the single-celled fungus responsible for fermentation (the conversion of sugar into alcohol), seems to have been domesticated about 12,000 years ago, but we don’t know for sure where it came from, why it makes ethanol, or why some strains do it better than others.

The physics of distillation are well established, but nobody knows who invented it — an alchemist in ancient Alexandria called Maria the Jewess? — and getting a consistent taste from the finicky process is more an art than a science.

Aging in toasted barrels clearly does hooch good, as the wood breaks down and the liquid penetrates its pores to mix with tannins and other molecules. But the final flavor of a spirit depends on everything from the temperature in the warehouse where it is aged to the climate where the trees are grown, and attempts to create synthetic processes to season liquor quicker (read: more profitably) have come mostly to naught.

Even at the most basic level, scientists don’t yet understand why booze makes us feel the way it does. Alcohol’s mode of action in the brain is much more complicated and elusive than that of a drug such as heroin, which locks into specific, identified receptors meant for natural neurotransmitters. “The truth is, we don’t know at the molecular level what alcohol is binding to,” Rogers quotes the director of the National Institute on Alcohol Abuse and Alcoholism as saying. “It’s never been resolved.”

June 18, 2014

The liability concern in the future of driverless cars

Filed under: Law, Technology — Tags: , , , — Nicholas @ 08:04

Tim Worstall asks when it would be appropriate for your driverless car to kill you:

Owen Barder points out a quite delightful problem that we’re all going to have to come up with some collective answer to over the driverless cars coming from Google and others. Just when is it going to be acceptable that the car kills you, the driver, or someone else? This is a difficult public policy question and I’m really not sure who the right people to be trying to solve it are. We could, I guess, given that it is a public policy question, turn it over to the political process. It is, after all, there to decide on such questions for us. But given the power of the tort bar over that process I’m not sure that we’d actually like the answer we got. For it would most likely mean that we never do get driverless cars, at least not in the US.

The basic background here is that driverless cars are likely to be hugely safer than the current human directed versions. For most accidents come about as a result of driver error. So, we expect the number of accidents to fall considerably as the technology rolls out. This is great, we want this to happen. However, we’re not going to end up with a world of no car accidents. Which leaves us with the problem of how do we program the cars to work when there is unavoidably going to be an accident?

[…]

So we actually end up with two problems here. The first being the one that Barder has outlined, which is that there’s an ethical question to be answered over how the programming decisions are made. Seriously, under what circumstances should a driverless car, made by Google or anyone else, be allowed to kill you or anyone else? The basic Trolly Problem is easy enough, kill fewer people by preference. But when one is necessary which one? And then a second problem which is that the people who have done the coding are going to have to take legal liability for that decision they’ve made. And given the ferocity of the plaintiff’s bar at times I’m not sure that anyone will really be willing to make that decision and thus adopt that potential liability.

Clearly, this needs to be sorted out at the political level. Laws need to be made clarifying the situation. And hands up everyone who thinks that the current political gridlock is going to manage that in a timely manner?

Quite.

This is why computer security folks look so frustrated

Filed under: Technology — Tags: , , — Nicholas @ 07:41

It’s not that the “security” part of the job is so wearing … it’s that people are morons:

Security white hats, despair: users will run dodgy executables if they are paid as little as one cent.

Even more would allow their computers to become infected by botnet software nasties if the price was increased to five or 10 cents. Offer a whole dollar and you’ll secure a herd of willing internet slaves.

The demoralising findings come from a study lead by Nicolas Christin, research professor at Carnegie Mellon University’s CyLab which baited users with a benign Windows executable sold to users under the guise of contributing to a (fictitious) study.

It was downloaded 1,714 times and 965 users actually ran the code. The application ran a timer simulating an hour’s computational tasks after which a token for payment would be generated.

The researchers collected information on user machines discovering that many of the predominantly US and Indian user machines were already infected with malware despite having security systems installed, and were happy to click past Windows’ User Access Control warning prompts.

The presence of malware actually increased on machines running the latest patches and infosec tools in what was described as an indication of users’ false sense of security.

June 17, 2014

BC supreme court attempts to extend jurisdiction over Google’s global services

Filed under: Cancon, Law, Liberty, Media, Technology — Tags: , , , , , — Nicholas @ 08:10

Michael Geist talks about another court attempting to push local rules into other jurisdictions online — in this case it’s not the European “right to be forgotten” nonsense, it’s unfortunately a Canadian court pulling the stunt:

In the aftermath of the European Court of Justice “right to be forgotten” decision, many asked whether a similar ruling could arise in Canada. While a privacy-related ruling has yet to hit Canada, last week the Supreme Court of British Columbia relied in part on the decision in issuing an unprecedented order requiring Google to remove websites from its global index. The ruling in Equustek Solutions Inc. v. Jack is unusual since its reach extends far beyond Canada. Rather than ordering the company to remove certain links from the search results available through Google.ca, the order intentionally targets the entire database, requiring the company to ensure that no one, anywhere in the world, can see the search results. Note that this differs from the European right to be forgotten ruling, which is limited to Europe.

The implications are enormous since if a Canadian court has the power to limit access to information for the globe, presumably other courts would as well. While the court does not grapple with this possibility, what happens if a Russian court orders Google to remove gay and lesbian sites from its database? Or if Iran orders it remove Israeli sites from the database? The possibilities are endless since local rules of freedom of expression often differ from country to country. Yet the B.C. court adopts the view that it can issue an order with global effect. Its reasoning is very weak, concluding that:

    the injunction would compel Google to take steps in California or the state in which its search engine is controlled, and would not therefore direct that steps be taken around the world. That the effect of the injunction could reach beyond one state is a separate issue.

Unfortunately, it does not engage effectively with this “separate issue.”

June 13, 2014

Supreme Court rules unanimously in favour of internet privacy

Filed under: Cancon, Law, Liberty, Technology — Tags: , , , , — Nicholas @ 13:11

Some great news on the privacy front, this time a decision handed down by the Supreme Court of Canada, as reported by Michael Geist:

This morning another voice entered the discussion and completely changed the debate. The Supreme Court of Canada issued its long-awaited R. v. Spencer decision, which examined the legality of voluntary warrantless disclosure of basic subscriber information to law enforcement. In a unanimous decision written by (Harper appointee) Justice Thomas Cromwell, the court issued a strong endorsement of Internet privacy, emphasizing the privacy importance of subscriber information, the right to anonymity, and the need for police to obtain a warrant for subscriber information except in exigent circumstances or under a reasonable law.

I discuss the implications below, but first some of the key findings. First, the Court recognizes that there is a privacy interest in subscriber information. While the government has consistently sought to downplay that interest, the court finds that the information is much more than a simple name and address, particular in the context of the Internet. As the court states:

    the Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information about users’ interests. Search engines may gather records of users’ search terms. Advertisers may track their users across networks of websites, gathering an overview of their interests and concerns. “Cookies” may be used to track consumer habits and may provide information about the options selected within a website, which web pages were visited before and after the visit to the host website and any other personal information provided. The user cannot fully control or even necessarily be aware of who may observe a pattern of online activity, but by remaining anonymous – by guarding the link between the information and the identity of the person to whom it relates – the user can in large measure be assured that the activity remains private.

Given all of this information, the privacy interest is about much more than just name and address.

Second, the court expands our understanding of informational privacy, concluding that there three conceptually distinct issues: privacy as secrecy, privacy as control, and privacy as anonymity. It is anonymity that is particularly notable as the court recognizes its importance within the context of Internet usage. Given the importance of the information and the ability to link anonymous Internet activities with an identifiable person, a high level of informational privacy is at stake.

Third, not only is there a significant privacy interest, but there is also a reasonable expectation of privacy by the user. The court examines both PIPEDA and the Shaw terms of use (the ISP in this case) and concludes that PIPEDA must surely be understood within the context of protecting privacy (not opening the door to greater disclosures) and that the ISP agreement was confusing at best and may support the expectation of privacy. With those findings in mind:

    in the totality of the circumstances of this case, there is a reasonable expectation of privacy in the subscriber information. The disclosure of this information will often amount to the identification of a user with intimate or sensitive activities being carried out online, usually on the understanding that these activities would be anonymous. A request by a police officer that an ISP voluntarily disclose such information amounts to a search.

Fourth, having concluded that obtaining subscriber information was a search with a reasonable expectation of privacy, the information was unconstitutionally obtained therefore led to an unlawful search. Addressing the impact of the PIPEDA voluntary disclosure clause, the court notes:

    Since in the circumstances of this case the police do not have the power to conduct a search for subscriber information in the absence of exigent circumstances or a reasonable law, I do not see how they could gain a new search power through the combination of a declaratory provision and a provision enacted to promote the protection of personal information.

Update, 7 July: A few weeks later, the US Supreme Court also made a strong pro-privacy ruling, this one mandating a warrant for police to search the contents of a cellphone.

Politico‘s Josh Gerstein has more on the ruling in in Riley v. California:

The Supreme Court’s blunt and unequivocal decision Wednesday giving Americans strong protection against arrest-related searches of their cell phones could also give a boost to lawsuits challenging the National Security Agency’s vast collection of phone call data.

Chief Justice John Roberts’s 28-page paean to digital privacy was like music to the ears of critics of the NSA’s metadata program, which sweeps up details on billions of calls and searches them for possible links to terrorist plots.

“This is a remarkably strong affirmation of privacy rights in a digital age,” said Marc Rotenberg of the Electronic Privacy Information Center. “The court found that digital data is different and that has constitutional significance, particularly in the realm of [the] Fourth Amendment…I think it also signals the end of the NSA program.”

Roberts’s opinion is replete with rhetoric warning about the privacy implications of access to data in individuals’ smart phones, including call logs, Web search records and location information. Many of the arguments parallel, or are virtually identical to, the ones privacy advocates have made about the dangers inherent in the NSA’s call metadata program.

June 12, 2014

Winnipeg Grade 9 students successfully hack Bank of Montreal ATM

Filed under: Business, Cancon, Technology — Tags: , , , , — Nicholas @ 08:00

“Hack” is the wrong word here, as it implies they did something highly technical and unusual. What they did was to use the formal documentation for the ATM and demonstrate that the installer had failed to change the default administrator password:

Matthew Hewlett and Caleb Turon, both Grade 9 students, found an old ATM operators manual online that showed how to get into the machine’s operator mode. On Wednesday over their lunch hour, they went to the BMO’s ATM at the Safeway on Grant Avenue to see if they could get into the system.

“We thought it would be fun to try it, but we were not expecting it to work,” Hewlett said. “When it did, it asked for a password.”

Hewlett and Turon were even more shocked when their first random guess at the six-digit password worked. They used a common default password. The boys then immediately went to the BMO Charleswood Centre branch on Grant Avenue to notify them.

When they told staff about a security problem with an ATM, they assumed one of their PIN numbers had been stolen, Hewlett said.

“I said: ‘No, no, no. We hacked your ATM. We got into the operator mode,'” Hewlett said.

“He said that wasn’t really possible and we don’t have any proof that we did it.

“I asked them: ‘Is it all right for us to get proof?’

“He said: ‘Yeah, sure, but you’ll never be able to get anything out of it.’

“So we both went back to the ATM and I got into the operator mode again. Then I started printing off documentation like how much money is currently in the machine, how many withdrawals have happened that day, how much it’s made off surcharges.

“Then I found a way to change the surcharge amount, so I changed the surcharge amount to one cent.”

As further proof, Hewlett playfully changed the ATM’s greeting from “Welcome to the BMO ATM” to “Go away. This ATM has been hacked.”

They returned to BMO with six printed documents. This time, staff took them seriously.

A lot of hardware is shipped with certain default security arrangements (known admin accounts with pre-set passwords, for example), and it’s part of the normal installation/configuration process to change them. A lazy installer may skip this, leaving the system open to inquisitive teens or more technically adept criminals. These two students were probably lucky not to be scapegoated by the bank’s security officers.

June 8, 2014

Modern weapons would make a D-Day style landing almost impossible

Filed under: Military, Technology, Weapons — Tags: , , , — Nicholas @ 11:34

At The Diplomat, Zachary Keck looks at how the evolution of military technology would make future D-Day style invasions much more difficult:

Seaborne invasions are one of, if not the most, difficult kind of military operation. That is partially why, as Mearsheimer points out, the great stopping power of water is so consequential in international politics. At first glance, it might seem like the innovations in transportation and communication technology that have triggered globalization would make contemporary amphibious assaults easier

Not so, however. To begin with, many of the basic challenges that have always plagued seaborne invasions are rooted in geography, which remains relatively fixed. Namely, the defending force in amphibious invasions are usually heavily fortified while the landing force typically has to initially fight in the open. The landing force also remains extremely vulnerable before actually reaching land, especially since the defending force can rely on land-based defense systems.

In fact, as Stratfor, a private global intelligence firm, points out, modern defense technologies have made amphibious assaults much more difficult. The most “significant development” since World War II, Stratfor points out, is precision-guided munitions (these did exist in rudimentary form during the conflict). The analysis goes to explain:

“A contemporary landing force would approach the beachhead in an amphibious landing vehicle such as the U.S. Assault Amphibious Vehicle, which moves at around 13 kph (8 mph). This would be vulnerable to anti-tank guided missiles fired from positions onshore. On D-Day, ships in the Allied invasion fleet were also able to come relatively close to shore to deploy landing craft. The deadly threat of anti-ship cruise missiles in modern warfare would force a modern fleet to remain farther out to sea, leaving amphibious vehicles even more exposed.”

This last point is especially important. As Sydney Freedberg noted back in April, “The new [Marine] Corps concept, Expeditionary Force 21, predicts long-range threats will force the fleet to stay at least 65 nautical miles offshore, a dozen times the distance that existing Marine amphibious vehicles are designed to swim.”

Smaller invasions against undefended coastline — think of both the initial Argentinian attack on the Falkland Islands and the British counter-attack as examples — are still possible, especially in bolt-from-the-blue surprise fashion, but an attack against an active defence with modern weapons might well be unacceptably hard for even the US Marine Corps.

June 5, 2014

Living in a post-Snowden world, under the gaze of the Five Eyes

Filed under: Australia, Cancon, Government, Technology, USA — Tags: , , , , — Nicholas @ 07:12

It’s been a year since the name Edward Snowden became known to the world, and it’s been a bumpy ride since then, as we found out that the tinfoil-hat-wearing anti-government conspiracy theorists were, if anything, under-estimating the actual level of organized, secret government surveillance. At The Register, Duncan Campbell takes us inside the “FIVE-EYED VAMPIRE SQUID of the internet”, the five-way intelligence-sharing partnership of US/UK/Canada/Australia/New Zealand:

One year after The Guardian opened up the trove of top secret American and British documents leaked by former National Security Agency (NSA) sysadmin Edward J Snowden, the world of data security and personal information safety has been turned on its head.

Everything about the safety of the internet as a common communication medium has been shown to be broken. As with the banking disasters of 2008, the crisis and damage created — not by Snowden and his helpers, but by the unregulated and unrestrained conduct the leaked documents have exposed — will last for years if not decades.

Compounding the problem is the covert network of subornment and control that agencies and collaborators working with the NSA are now revealed to have created in communications and computer security organisations and companies around the globe.

The NSA’s explicit objective is to weaken the security of the entire physical fabric of the net. One of its declared goals is to “shape the worldwide commercial cryptography market to make it more tractable to advanced cryptanalytic capabilities being developed by the NSA”, according to top secret documents provided by Snowden.

Profiling the global machinations of merchant bank Goldman Sachs in Rolling Stone in 2009, journalist Matt Taibbi famously characterized them as operating “everywhere … a great vampire squid wrapped around the face of humanity, relentlessly jamming its blood funnel into anything that smells like money”.

The NSA, with its English-speaking “Five Eyes” partners (the relevant agencies of the UK, USA, Australia, New Zealand and Canada) and a hitherto unknown secret network of corporate and government partners, has been revealed to be a similar creature. The Snowden documents chart communications funnels, taps, probes, “collection systems” and malware “implants” everywhere, jammed into data networks and tapped into cables or onto satellites.

June 4, 2014

Sarcasm-detecting software wanted

Filed under: Media, Technology — Tags: , , , , — Nicholas @ 09:02

Charles Stross discusses some of the second-order effects should the US Secret Service actually get the sarcasm-detection software they’re reportedly looking for:

… But then the Internet happened, and it just so happened to coincide with a flowering of highly politicized and canalized news media channels such that at any given time, whoever is POTUS, around 10% of the US population are convinced that they’re a baby-eating lizard-alien in a fleshsuit who is plotting to bring about the downfall of civilization, rather than a middle-aged male politician in a business suit.

Well now, here’s the thing: automating sarcasm detection is easy. It’s so easy they teach it in first year computer science courses; it’s an obvious application of AI. (You just get your Turing-test-passing AI that understands all the shared assumptions and social conventions that human-human conversation rely on to identify those statements that explicitly contradict beliefs that the conversationalist implicitly holds. So if I say “it’s easy to earn a living as a novelist” and the AI knows that most novelists don’t believe this and that I am a member of the set of all novelists, the AI can infer that I am being sarcastic. Or I’m an outlier. Or I’m trying to impress a date. Or I’m secretly plotting to assassinate the POTUS.)

Of course, we in the real world know that shaved apes like us never saw a system we didn’t want to game. So in the event that sarcasm detectors ever get a false positive rate of less than 99% (or a false negative rate of less than 1%) I predict that everybody will start deploying sarcasm as a standard conversational gambit on the internet.

Wait … I thought everyone already did?

Trolling the secret service will become a competitive sport, the goal being to not receive a visit from the SS in response to your totally serious threat to kill the resident of 1600 Pennsylvania Avenue. Al Qaida terrrrst training camps will hold tutorials on metonymy, aggressive irony, cynical detachment, and sarcasm as a camouflage tactic for suicide bombers. Post-modernist pranks will draw down the full might of law enforcement by mistake, while actual death threats go encoded as LOLCat macros. Any attempt to algorithmically detect sarcasm will fail because sarcasm is self-referential and the awareness that a sarcasm detector may be in use will change the intent behind the message.

As the very first commenter points out, a problem with this is that a substantial proportion of software developers (as indicated by their position on the Asperger/Autism spectrum) find it very difficult to detect sarcasm in real life…

« Newer Posts — Older Posts »

Powered by WordPress