Less Pretext?

It seems HP (and others) may soon have less pretext, since Congress just passed a law to criminalize pretexting:
“Stealing someone’s private phone records is a criminal act that can now be prosecuted,” said Sen. Chuck Schumer, D-N.Y., lead sponsor of the proposal in the Senate. “Phone information and call logs should be protected with the same safeguards as financial data or medical records.”

The issue became big news late last summer following revelations that investigators working for executives at Hewlett-Packard Co. used deception to obtain phone numbers of board members and reporters in an effort to track down news leaks.

Senate Approves Anti-Pretexting Bill, By JOHN DUNBAR, The Associated Press, Saturday, December 9, 2006; 5:17 AM

Three or four months is pretty quick for Congress. Let’s hope not so quick but that they took time to study the problem and to write a law that will actually do some good. As seen with other laws passed after corporate malfeasance, hastily written laws can produce as many problems as they help solve.

-jsq

What’s Your Score?

Q: What country rates everyone who goes in and out of it, citizen or not, as to whether they are likely terrorists or criminals, won’t show its ratings to those rated, can’t be challenged about them, uses them to decide who can work for a wide variety of governments and companies, and plans to keep them for 40 years? Continue reading →

P2P v. Censorship

Just as in the old days of USENET, the net still interprets censorship and damage and routes around:
Psiphon works through social networks. A net user in an uncensored country can download the program to their computer, which transforms it into an access point.

They can then give contacts in censored countries a unique web address, login and password, which enables the restricted users to freely browse the web through an encrypted connection to the proxy server.

Web censorship ‘bypass’ unveiled BBC, 27 Nov 2006

So even though Ahmedinejad or Castro may jail bloggers, people in Iran or Cuba could still see foreign bloggers. Continue reading →

Elastigirl’s Seven Powers

Kim Cameron has posted seven very sensible Laws of Identity. Numbers 2 and 3 add up to more or less Need to Know:

2. Limited Disclosure for Limited Use

    The solution which discloses the least identifying information and best limits its use is the most stable, long-term solution.

3. The Law of Fewest Parties

    Digital identity systems must limit disclosure of identifying information to parties having a necessary and justifiable place in a given identity relationship.

Kim Cameron’s Laws of Identity

But user identities have aspects that go beyond traditional spook security.

Continue reading →

IT vs. Big Pharma

It’s IT vs. Big Pharma in the patent arena:

Canada-based KSR manufactures gas pedals for General Motors Corp. It made a pedal that can be adjusted for the height of the driver and uses electronic signals rather than a mechanical cable to accelerate when the pedal is pushed.

Both features were developed separately _ the adjustable pedal over 25 years ago _ but Teleflex, a manufacturer based in Limerick, Pa., sued KSR in 2002, claiming that KSR’s combination of the two features infringed on a patent it was issued in May 2001.

KSR argued that the patent should be invalidated because the combination of the two features is obvious.

Businesses Split on Patent Case, By Christopher S. Rugaber, The Associated Press, Friday, November 24, 2006; 8:29 PM

In the patent reform corner, Microsoft, Cisco, Intel and others. In the no-reform corner: Johnson & Johnson, GE, DuPont, etc.

This case is expected by many parties to produce some sort of landmark ruling, probably with some sort of change to existing patent law. We’ll see.

-jsq

PS: Thanks, Johnny.

Outsourced Blog Spam

After outsourcing call centers, rote financial work, and programming, why not comment spam? This reporter’s blog comment filter was working, yet:
…so far it’s stopped 10,000 spams while allowing 377 human comments. So why had this got through? The electronic trail explained: the “captcha” (Completely Automated Public Turing test to tell Computers and Humans Apart) had been filled in.

The captcha is the junk filter’s last resort. Because it’s easy and cheap to program machines to post any sort of junk on blogs, a captcha (which puts numbers or letters in an image, which a machine in theory can’t read) shows whether you’ve got a real live person giving their thoughts, or just a dumb machine trying to up some spammer’s search-engine ranking.

If the captcha was filled in, it must have been done by a person; if it had been done by a machine, the spammers would have cracked the problem of solving captchas and would be busily spamming every blog they could find.

The price of humans who’ll spam blogs is falling to zero, Charles Arthur, The Guardian Thursday November 23, 2006

Who dunnit? Continue reading →

Evolving Risk

Gunnar has a good post about evolving risk. A small startup company has high business risk (easy to fail) and low security risk (not much to steal), while a big successful company has low business risk and high security risk. Pretending those different kinds of risk don’t change, or that they change in the same direction, leads to problems:

When the business reality is dynamic and the security model is static, then errors creep in.

Paul Madsen on Evolving Risk, Gunnar Peterson, 1 Raindrop, 20 Nov 2006

Continue reading →

SOX Redux

What do U.S. Treasury Secretary Henry Paulson and Barney Frank, D-Mass., the incoming chair of the House Financial Services Committee agree on?

U.S. Treasury Secretary Henry Paulson said the implementation of Sarbanes-Oxley corporate-governance regulations may pose a risk to the U.S. economy, advocating changes that fall short of introducing legislative adjustments.

"While necessary," the Sarbanes-Oxley accounting rules "are being implemented in a way that may be creating unnecessary costs and introducing new risks to our economy," Paulson, former head of Goldman Sachs Group Inc., said in a speech Monday to the Economic Club of New York.

Share sales have declined since the introduction of the law in 2002, and a "significant" amount of the time and cost taken complying with Sarbanes-Oxley might better have been spent creating jobs and rewarding shareholders, Paulson said.

Sarbanes-Oxley costs of compliance may threaten economy, official says BLOOMBERG NEWS, 11/21/2006

Paulson seems to be saying many euphemisms.

Continue reading →

Pro Status Quo Ante

About the new UK RFID passports:
Fatally, however, the ICAO suggested that the key needed to access the data on the chips should be comprised of, in the following order, the passport number, the holder’s date of birth and the passport expiry date, all of which are contained on the printed page of the passport on a “machine readable zone.”

Cracked it! Steve Boggan, The Guardian, Friday November 17, 2006

The UK Home Office says not to worry. Continue reading →