Pentagon Budget Blackmail

A Defense Tech posting notes:

"Give us more money, or our soldiers are going to go broke. That's the cynical game the Pentagon's leadership has been playing with the Army's budget in recent months. And now, it's crunch time.
Since the fall, Rumsfeld & Co. have been dipping into the Army's day-to-day funds -- like money for soldiers' paychecks -- and then daring Congress not to make up the difference with a second, 'supplemental' pile of cash. The tab comes due this Spring, Defense Daily reports. The Army needs its $41 billion slice of that supplemental kitty by then, or else it is going to go broke, without cash left to pay G.I.s. Already, the service has pulled forward some $11 billion in funds from the third and fourth quarters of its [fiscal year 2005] budget, a senior Army budget officer said at a briefing on Friday."

What ChoicePoint sells about you

A story in the San Francisco Chronicle spells it out:

"What many people may not realize, though, is that ChoicePoint also profits by selling people's personal information to businesses for marketing purposes. On its Web site, the company says its direct-marketing database contains 'fresh, clean, reliable information on more than 220 million consumers.'
This includes 'data on demographics, lifestyle, credit bureau information, and proprietary insurance and financial attributes,' with files 'conveniently linked together for targeted direct mail efforts.'
More specifically, ChoicePoint boasts that it can provide corporate clients with consumers':
-- Age, income and number of children.
-- Home value, length of residence, year built, square footage and other property characteristics.
-- Telephone numbers.
-- Personal interests and activities.
-- Purchase behavior.
'In many cases, these companies know more about us than our families know, ' said Givens at the Privacy Rights Clearinghouse.
In Stokus' case, he discovered that his heavily guarded home address was available online to anyone willing to pay $7.95 to a Washington State company called Intelius that, like ChoicePoint, trades in consumer data."

Bank of America Loses Tapes With Federal Workers' Data

Guess who's going to start worrying about identity theft now?

According to a story in the Washington Post: "Bank of America Corp. has lost computer data tapes containing personal information on 1.2 million federal employees, including some members of the Senate. The lost data include Social Security numbers and account information that could make customers of a federal government charge-card program vulnerable to identity theft. Eloise Hale, a Bank of America spokeswoman, said federal law enforcement officials were notified as soon as the tapes were discovered missing."

Software makers may be held liable for flaws

An article in the Contra Costa Times, from the Wall Street Journal, registers a potentially seismic shift in the software industry. I say, the sooner, the better.
(Access to this site is free; however, first-time visitors must register.)

"Major technology customers, fed up with spending millions of dollars to fix problems caused by software flaws, are starting to press software makers to assume responsibility for the faults and pick up some of the costs. The moves are aimed at making tech companies such as Microsoft Corp. rethink the way they write and sell software. Executives responsible for computer security at companies including General Motors Corp., AT&T Corp. and Alcoa Inc. say software vendors should begin to stand behind their products much as sellers of other products and services do. The efforts are in their early stages, but even a whisper of the 'L-word' -- liability -- sends shudders through the software industry. Until now, most software makers have sold their products on the condition that they won't be held liable if flaws cause damage, be it from computer crashes or virus attacks that exploit the faults. The cost of repairing such flaws, or of reimbursing customers harmed by hacker attacks or viruses, could cost a vendor many millions of dollars."

"Customers are challenging the traditional exemption in the hope that increased liability will force vendors to deliver more secure and reliable software."

ChoicePoint's treatment of the public

An article in the San Francisco Chronicle sums it up in the lead:
"All you really need to know about data broker ChoicePoint is contained in letters the company is sending to thousands of consumers nationwide, including about 34,000 in California, affected by a huge security breach. The letters refer to 'crimes committed against ChoicePoint' and 'fraud against the company.' As to the fact that the names, addresses and Social Security numbers of nearly 145,000 people were released over a year's time to scammers operating behind fictitious businesses, ChoicePoint says it understands 'the inconvenience this incident may cause.'

"There."

Unless the author of the letter has been a victim of identity theft, as I have, I seriously doubt that they do understand the inconvenience they are causing.

Added: Just to rub a little salt in the wound, CNN reports that "The chairman and the president of ChoicePoint -- under fire for allowing phony businesses to buy access last fall to their database of personal information on consumers -- have between them sold almost 500,000 shares of company stock for a profit of $17.6 million since November, according to Securities and Exchange Commission filings... The trades began about three months before the company disclosed the breach."

Air CIA

Newsweek article on the unfolding "extraordinary rendition" scandal.

"The agency ran a secret charter service, shuttling detainees to interrogation facilities worldwide. Was it legal?"

"No one's laughing these days, least of all the CIA. NEWSWEEK has obtained previously unpublished flight plans indicating the agency has been operating a Boeing 737 as part of a top-secret global charter servicing clandestine interrogation facilities used in the war on terror."

See also Dan Gillmor's post. "This is not just a blow to the CIA. It's yet another blow to America's image in the world, and to our national honor."

Hacking attacks rarely made public, experts say

A Computerworld article by Andy Sullivan from Reuters indicates that hacking attacks are rarely made public.

"A security breach that placed consumers at risk for identity theft grabbed headlines this week, but most hacking incidents go unreported to police or the public, experts said yesterday. Afraid of negative publicity, most companies that suffer intrusions take a tight-lipped approach that leaves consumers unaware that their identities may have been compromised, they said. At the same time, businesses are becoming more willing to discuss security issues with their competitors behind the scenes in an effort to head off online threats -- an approach experts that said has helped reduce the impact of computer worms and viruses. Still, a 2004 FBI cybercrime survey found that only 20% of companies report computer intrusions to the police -- and half don't report them to anybody."

Scientists feel stifled by Bush administration

A CNN story reports on concerns expressed at the AAAS meeting.

"The voice of science is being stifled in the Bush administration, with fewer scientists heard in policy discussions and money for research and advanced training being cut, according to panelists at a national science meeting. Speakers at the national meeting of the American Association for Advancement of Science expressed concern Sunday that some scientists in key federal agencies are being ignored or even pressured to change study conclusions that don't support policy positions. The speakers also said that Bush's proposed 2005 federal budget is slashing spending for basic research and reducing investments in education designed to produce the nation's future scientists."

Computer surpasses California educational system

An article in the Watley Review, with tongue partly in cheek, celebrates a triumph, of sorts, of machine over man.

"California's education system has long been a source of woe for policymakers and California residents alike, with the state struggling to adequately sustain a system with over 6 million students while facing crippling deficits. However, after years of serious news and heated debates, a bright side has finally been found to the state's predicament. 'I am proud to announce that IBM Almaden has succeeded with a truly historic project: the creation of a sentient, artificial intelligence,' said Dr. Mark Dean, director of the Almaden Research Facility. 'And we owe it all to California's years of slipshod education, paradoxically enough.' "

"IBM says it has developed a computer program capable of passing the Turing test, which is generally regarded as the definitive determination of whether a machine can effectively simulate human behavior."

Secret Service: Fraud Threatens Economy

A Washington Post article discusses the threat.

"Internet fraudsters, motivated by money and armed with sophisticated technology, pose an increased economic threat as they steal private data from companies and individuals, the director of the U.S. Secret Service said on Thursday. 'There is no longer any doubt about that threat ... With just a few key strokes, (online fraudsters) can disrupt our nation's economy,' said Ralph Basham at the RSA Security Conference in San Francisco."

Canada: Security gaps in federal computers

A post in CNEWS indicates that Canadian government privacy protection may not be as far ahead of the US in practice as it is in theory.

"The personal information of Canadians is at risk due to 'significant weaknesses' in government computer security that leave the digital door open to hackers and thieves, says the auditor general. In a highly critical report Tuesday, Sheila Fraser warns that federal agencies have failed to keep up with the demands of the electronic age, making sensitive files vulnerable. 'If security weaknesses allowed someone to access a database or confidential information, Canadians' trust in the government would be greatly eroded,' the report says. 'Further, if a citizen's privacy were violated because of a failure to keep confidential information secure, it could cause that person hardship and seriously undermine the government's efforts to deliver services to Canadians electronically.' Fraser told a news conference she was disappointed the government doesn't meet its own minimum standards for information technology security, even though most of them have been well known for more than a decade."

U.S. agencies earn D-plus on computer security

An AP story posted on SecurityFocus confirms the generally dismal state of cybersecurity in the US government. The report on the Department of Homeland Security is particularly disheartening.

"The overall security of computer systems inside the largest U.S. government agencies improved marginally since last year but still merits only a D-plus on the latest progress report from Congress. The departments of Transportation, Justice and the Interior made remarkable improvements, according to the rankings, which were compiled by the House Government Reform Committee and based on reports from each agency's inspector general. But seven of the 24 largest agencies received failing grades, including the departments of Energy and Homeland Security. The Homeland Security Department encompasses dozens of agencies and offices previously elsewhere in government but also includes the National Cyber Security Division, responsible for improving the security of the country's computer networks."

More from the Washington Post story by Brian Krebs:

"Committee Chairman Tom Davis (R-Va.) ... chided agencies for not moving fast enough. 'I hope it won't take some kind of major cyber-attack to wake everybody up,' Davis said."

"For years, lawmakers in Congress have warned federal agency leaders that they would slash funding for technology projects that fail to meet basic computer security requirements. But despite such threats, agency funding has remained unaffected by high or low grades on the computer security report cards, according federal security officers ... 'If there are no incentives for agencies to comply with FISMA requirements, what is the point?', said Richard P. Tracy, chief security officer for Telos."

Cerf and Kahn win Turing Award for TCP/IP

A lengthy story in the New York Times gives details and a pretty accurate history of TCP/IP and its impact.

"Late in the summer of 1973, two young scientists in the nascent field of computer networks hunkered down in a conference room of the Cabana Hyatt Hotel in Palo Alto, Calif., a clean but bland stopping place for salesmen and the parents of students at nearby Stanford University. Their goal was to thrash out a way to make different, isolated computer networks talk to each other."

"They wrote, they sketched, they argued, all the while passing a yellow legal pad back and forth to capture ideas as they crystallized. When they emerged two days later, they knew they had the makings of a solid technical paper. What they did not know was that they had created the essential underpinnings of today's vast and sprawling Internet."

"For the work that began on that yellow pad, the Association for Computing Machinery plans to announce Wednesday that Vinton G. Cerf and Robert E. Kahn will receive the 2004 A. M. Turing Award, widely considered to be the computing field's equivalent of the Nobel Prize."

Although the story suggests a controversy over "who invented the Internet," it's pretty clear who invented TCP/IP and that this contribution was seminal.

Here is ACM's Turing Award website, which also links to their press release.

The Budget's Misguided Parsimony

Business Week has an op-ed piece by its chief economist, Michael Mandel. It's a fairly dry and technical discussion of multifactor productivity (MFP), but the conclusion is unambiguous:

"Unfortunately, in an attempt to cut the budget deficit, the Bush Administration has held down government spending on R&D and education. The budget proposal calls for federal nondefense R&D spending for fiscal year 2006 to fall by 1% compared to the previous year, after inflation, while real outlays on education and training are proposed to drop by 6%. This misguided parsimony can only hurt the nation's ability to maintain a rapid pace of multifactor productivity growth. Putting more resources into technology and education is the best way to ensure that the bounty of higher MFP continues in the future."

Missile defense system flunks test - Feb 14, 2005

An AP story on CNN reports yet another failure.

"A test of the U.S. missile defense system failed Monday when an interceptor missile did not launch from its island base in the Pacific Ocean, the military said. It was the second failure in months for the experimental program. A statement from the Missile Defense Agency said the cause of the failure was under investigation."

"A spokesman for the agency, Rick Lehner, said the early indications was that there was a malfunction with the ground support equipment at the test range on Kwajalein Island in the Marshall Islands, not with the missile interceptor itself. If verified, that would be a relief for program officials because it would mean no new problems had been discovered with the missile. Previous failures of these high-profile, $85 million (euro 65.55 million) test launches have been regarded as significant setbacks by critics of the program."

My recent posts on BMD tests are here and here.

Scrounging for Iraq Excuses

A post in ArmsControlWonk takes direct aim at the Bush administration's changing stories:

"Assistant SecState Stephen Rademaker stated that:
'Perhaps that's what was going on, but I do think it's quite unfair to single out the Bush administration and say those guys were all wrong; they're a bunch of liars. I mean, the historical record here is quite clear that the Bush administration was hardly alone in the judgments it reached.' "

"I'm sorry if it strikes Rademaker as unfair, but those guys were all wrong; they are a bunch of liars."

And then proceeds to quote chapter and verse.

Pentagon starts space war training

According to a post in Defense Tech: "Just in case you were wondering whether or not the Pentagon was really serious about knocking other countries' satellites out of orbit, comes this item from C4ISR Journal. The Defense Department, it seems, has 'launched a series of exercises designed to sharpen its understanding and management of counter-satellite operations.' The three-year Joint Space Control Operations-Negation (JSCO-N) program will help the Pentagon figure out which satellite-killers to buy, and determine which procedures to follow when knocking the orbiters out. According to a report from the Pentagon's testing and evaluation office, the Defense Department wants to 'target an adversary's space capability by using a variety of permanent and/or reversible means to achieve five possible effects: deception, disruption, denial, degradation and destruction...' "

Hazards of E-voting

Thanks to Brian Randell for a pointer to this cartoon.

Post-mortem on Karla Fidora

A parody analysis of recent events at HP: "Fidora was then hired to re-invert the PH Corporation, a company known for little more than world class products and happy employees. It was a status quo that worried competitors and Fidora was committed to turning it around. With a twin strategy of abandoning high margin businesses or selling them to competitors; and acquiring struggling companies in low margin industries at exorbitant premiums, she was able to execute one of the great turnarounds in corporate history."

Star Wars Faces a Budget Hit

An article in Business Week reports that "there's probably more than missile mishaps behind the dollar drop for Star Wars."

"The war on terror and Iraq may have taken their toll on missile defense and changed the way Defense Secretary Donald Rumsfeld assesses potential threats. He went into office worried about space issues, the ballistic-missile threat, and transforming the military. Then came September 11, Afghanistan, and Iraq. 'The Rumsfeld vision of future warfare has had a severe collision with reality,' says Loren Thompson, chief operating officer of the Lexington Institute, a conservative think tank in Arlington, Va. The problems facing missile defense, he says, are 'the relatively weak case for the overall mission and the need to spend money in other ways.' "

"After more than 20 years of effort, major parts of the system are nowhere near ready for prime time, notes Philip Coyle, a top Pentagon weapons tester in the Clinton Administration. Neither the sophisticated X-band radar nor the Space-Based Infra-red System-High (SBIRS-High), both of which are critical to detecting and tracking incoming missiles, is close to operational. SBIRS-High is running into such difficulties that Lockheed Martin (LMT ) has agreed to defer a $10 million award -- its total profit on the project for 2004-2005. After a major restructuring in 2002, the cost of this one part of Star Wars was pegged at $4.4 billion -- and since then has swelled to $5.6 billion. What's more, every time there is an attempt to intercept a missile, the target carries a beacon to tell the interceptor where it is -- a service an enemy isn't likely to offer. The bottom line: The system 'has no demonstrated capability to defend against a realistic attack under realistic conditions,' Coyle says."

Patent: Pet display vest

United States Patent: 5,901,666: "A vest or belt is integrally formed with tubular, pet receiving passageways which extend around the wearer's body and terminate in pocket-like chambers for feeding and retrieval. Outer wall portions of the passageways are transparent so that a pet moving along the passageways can be seen by a spectator. Graphics or indicia depicting the pet's habitat or a pet story are marked on the vest and extend across portions of the passageways masking delineations or depicting the passageways as burrows."

Thanks to IEEE Spectrum for a pointer to this.

Per Brinch Hansen Papers

Per Brinch Hansen's online archive now holds both his professional memoirs and a selection of his scientific papers. Out of a hundred publications or so, he has selected close to forty papers. Written over a period of forty years, these essays document the technical side of his life in computing. Most of them are mentioned in his autobiography, which I mentioned previously.

Carl Landwehr on the need for security investment

An editorial in IEEE Security and Privacy points out that investments in computer security have not kept pace with those in other areas or the growth of the needs.

"It is as if we wished for processing, storage, and communications, but forgot to mention security or dependability. Of course, these changes didn’t happen magically or through some Faustian bargain. We invented, developed, marketed, and purchased the technologies with which we are now both blessed and cursed. We create puzzles for ourselves—but can we solve them?"

"The DOM [decimal order of magnitude] advances in other technologies have been fueled by a combination of research investment and market forces, stimulating both new knowledge and commercial innovation. Can these same forces improve security as well?"

"We must raise our sights. We don’t have to live in a world where patches and worms chase each other around the networks on which we depend... We built this puzzle, so we should remind ourselves occasionally that it’s in our power to reshape the pieces."

President's Budget is Out: Here are the First Numbers

A quick note in the Computing Research Policy Blog: "The budget is out and the numbers, as promised, don't look very good. Here's the breakdown for the Networking and Information Technology R&D program--the federal budget crosscut for all agencies involved in funding IT R&D."

The overall NITR budget is down 7%.

FBI Shuts Down Email System

According to an AP story: "The FBI said Friday it has shut down an e-mail system that it uses to communicate with the public because of a possible security breach. The bureau is investigating whether someone hacked into the www.fbi.gov e-mail system, which is run by a private company, officials said."

With a straight face: Mac Mini vs. PC

A Divisiontwo article takes an irreverent look at the Mini. Conclusion:
"So is the mini a maxi value? For me, clearly, no. When I consider that a good deal of my time is spent running applications like Disk Defragmenter, Scandisk, Norton AV, Windows Update and Ad-Aware--none of which are available for the Mac platform--it doesn't make sense for me to 'switch' to a Mac at this time. But will Apple's famous marketing team be able to sell the the emperor an invisible computer anyway and turn the mini into a maxi hit? That's the question that remains to be answered."

Inspector General: Computer Woes Hinder FBI's Work

A story in the Washington Post cites a new report by the Inspector General that goes beyond the Virtual Case File system to criticize the FBI's attempts to implement Trilogy, a three-pronged $581 million effort to upgrade outdated and cumbersome computer systems.

"The FBI is 'significantly hampered' in its ability to prevent terrorism and combat other serious crimes because of its continued failure to replace antiquated and inefficient computer systems, the Justice Department's chief watchdog said yesterday. A report by Inspector General Glenn A. Fine also found that poor planning and botched management were the main reasons that the FBI may have to scrap a $170 million computer upgrade that has not performed up to standards."

"The problems raise 'national security implications,' Fine wrote, because FBI agents and analysts are still unable to adequately share and search for information."

You don't get much for a million bucks in Silicon Valley

An article in the San Jose Mercury News notes the continuation of a trend. And the local economy is still in a slump!

"If you have $1 million to spend on a house in Silicon Valley right now, there's a 1,400-square-foot, three-bedroom rancher for sale in Palo Alto you could buy. Or you could opt for a split-level, four-bedroom house in San Jose's Almaden Valley. Or perhaps a 1,900-square-foot, three-bedroom house in Cupertino not far from some railroad tracks. No vast yards, no architectural marvels, just plain old valley houses. In other words, a million dollars doesn't buy you a 'luxury' home around here."

" 'I hate to say it, but there are some pretty regular houses out there selling for a million bucks,' said John Karevoll of DataQuick, which Wednesday issued a report that said 33,107 homes sold in California for more than $1 million in 2004. That's almost 74 percent more such sales than in 2003, a tribute to last year's fast-appreciating prices, which were driven by low mortgage rates and strong buyer demand. DataQuick began issuing its 'million-dollar homes' report 15 years ago, 'and it probably was a genuine gauge of the "prestige" market back then,' Karevoll said. Now, however, 'a million dollars just isn't what a million dollars used to be,' he said."

"In the Bay Area, 11,399 homes sold last year for at least $1 million, or about 73 percent more than in 2003. Santa Clara County saw 3,137 such sales, 67 percent more than in the previous year."

The wages of sin (hacking)

According to an article in Computerworld, they can be considerable.

"The black-market price for exploit code for a known flaw--such as some of the recently announced Internet Explorer flaws--is between $100 and $500. That's the price if no exploit code is available; after the exploit code is made available on public forums, the price drops to zero. Exploit code for an unknown flaw is--not surprisingly--considerably more valuable: Prices for unknown exploits range between $1,000 and $5,000. Among the buyers of those codes are various foreign governments, foreign and domestic organized crime groups, and iDefense, a company that buys the exploits then informs its clients of the flaw."

"Want to know who has your e-mail address? Get in line. A list of 5,000 IP addresses of computers infected with spyware and ready and able to go into 'bot' mode goes for $150 to $500. If you're in the black market for a list of 1,000 working credit card numbers, expect to fork over between $500 and $5,000..."

"What do these black-hat hackers working for spammers make for their trouble? According to Loveless, the annual salary of a top-end, skilled black-hat hacker working for spammers is between $100,000 and $200,000."

Spam costing companies $22 billion a year

CNN.com has an AP story on the costs to business of deleting spam.

"Time wasted deleting junk e-mail costs American businesses nearly $22 billion a year, according to a new study from the University of Maryland. A telephone-based survey of adults who use the Internet found that more than three-quarters receive spam daily. The average spam messages per day is 18.5 and the average time spent per day deleting them is 2.8 minutes."

There is no discussion of the cost of responding to telephone-based surveys, though.

UK view on voter-verifiable audit trails

An article in the Guardian views with alarm the prospect of using DRE equipment in UK elections, citing many problems in the UK and in the US.

"For the first time, vote-rigging may become a serious issue at a general election - perhaps in just three months' time. With several cases of alleged vote-rigging and fraud already under investigation - in Reading, Birmingham, Cheshire, Derbyshire, Lancashire, Greater Manchester and West Yorkshire - the Electoral Commission is pressing guidelines on detecting voting fraud on senior police and election officers. Meanwhile, the government remains keen on electronic voting and is aiming at 'an e-enabled election some time after 2006'. Will this raise turnout or simply increase the risk of fraud?"

"Several pilots have been held. In 2003, six local authorities electronically counted ballot papers where votes had also been cast electronically. Surprisingly, there has been no manual checking of the e-counting results. However, a full-blown test run of e-voting has been carried out elsewhere, with very instructive results. It shows that e-voting is neither secure nor tamper-proof, and allegations are surfacing that it may have affected the result. This dry run was the recent US presidential election..."

"We must be extremely cautious of the surge towards electronic voting. Before importing US voting systems into Britain, any software secrets in the machine technology must be made transparent. Software must be properly certified, and there must be paper trails. If these conditions cannot be met, electronic voting should not be introduced. There are better ways of increasing turnout than simply changing the voting technology."

Nine out of 10 VPNs not secure

According to a post by vnunet.com, the vulnerability of virtual private networks is generally underestimated.

"A three-year research project by security firm NTA Monitor has concluded that nine out of 10 virtual private networks have exploitable vulnerabilities. Most of the companies that had their VPNs tested as part of the project thought that they were invulnerable to hackers, but researchers found the same types of flaw repeated across the whole product range. The report stated that, in some cases, VPNs were actually the weakest security link in an organisation."

"The most widespread flaw involved the hacking of user names. Many VPNs give away useful information to someone guessing user names."

Cost of malware soars to over $169 billion in 2004

A post on vnunet.com puts the cost of malware last year at about $300 per Windows-based computer.

"Malware, including viruses, worms and Trojans, cost global businesses between $169bn and $204bn last year, making it the worst year on record by a wide margin, newly published research has claimed. According to digital risk management firm mi2g, malware in 2003 did not account for even half of the economic damage sustained in 2004."

Identity Theft Up in 2004

A Reuters news article summarizes:

"Americans lost at least $548 million to identity theft and consumer fraud last year as the Internet provided new victims for age-old scams, according to government statistics released Tuesday. The U.S. Federal Trade Commission said it received 635,000 consumer complaints in 2004 as criminals sold nonexistent products through online auction sites like eBay Inc. or went shopping with stolen credit cards. Identity theft -- the practice of running up bills or committing crimes in someone else's name -- topped the list with 247,000 complaints, up 15 percent from the previous year."

Worth a thousand words

Ed Felten says he's using this picture in his lectures from now on.